From b800daedbc853be91a5fe08e941b0e0596e72940 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 17:43:38 +0100 Subject: [PATCH] Record verified historical backup custody repair and operator handoff Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3 --- WORK-RECORDS.md | 1 + ...ed-evidence-custody-return-2026-10-31.json | 280 ++++++++++++++++++ ...eted-evidence-custody-review-2026-10-31.md | 28 +- ...nstallation-execution-review-2026-10-31.md | 6 +- .../operator-handoff-check-2026-10-31.json | 55 ++++ ...0012-durable-recovery-service-readiness.md | 67 ++++- 6 files changed, 416 insertions(+), 21 deletions(-) create mode 100644 docs/release/backup-completed-evidence-custody-return-2026-10-31.json create mode 100644 docs/release/operator-handoff-check-2026-10-31.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 9f9371b..b1b636c 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -100,6 +100,7 @@ | task | CSOC-WP-0012-T12 | progress | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0012-T13 | done | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0012-T14 | done | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | +| task | CSOC-WP-0012-T15 | done | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0013-T01 | done | — | workplans/CSOC-WP-0013-sharing-content-hardening.md | | task | CSOC-WP-0013-T02 | progress | — | workplans/CSOC-WP-0013-sharing-content-hardening.md | | task | CSOC-WP-0013-T03 | todo | — | workplans/CSOC-WP-0013-sharing-content-hardening.md | diff --git a/docs/release/backup-completed-evidence-custody-return-2026-10-31.json b/docs/release/backup-completed-evidence-custody-return-2026-10-31.json new file mode 100644 index 0000000..d44ab55 --- /dev/null +++ b/docs/release/backup-completed-evidence-custody-return-2026-10-31.json @@ -0,0 +1,280 @@ +{ + "schema": "coulomb.completed-evidence-custody-independent-return.v1", + "verified_at": "2026-10-31T16:37:46.139987+00:00", + "proposal_digest": "sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611", + "receipt_sha256": "b79b26b1572faff0e2f2257e39e438bc065a4d2c71f92d879749e0e8b4b03493", + "receipt": { + "bytes_modified": false, + "capture_executed": false, + "changes": [ + { + "after": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 543834, + "kind": "directory", + "mode": "0o700", + "mtime_ns": 1793430825511133103, + "nlink": 4, + "relative_path": "releases", + "sha256": "3190439b978096a16c28aa0dd6b372735594808217b59a01dadbbe744d4110c8", + "uid": 0 + }, + "before": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 543834, + "kind": "directory", + "mode": "0o755", + "mtime_ns": 1793430825511133103, + "nlink": 4, + "relative_path": "releases", + "sha256": "3190439b978096a16c28aa0dd6b372735594808217b59a01dadbbe744d4110c8", + "uid": 0 + }, + "path": "releases" + }, + { + "after": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549330, + "kind": "directory", + "mode": "0o700", + "mtime_ns": 1793430825511133103, + "nlink": 3, + "relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/charts", + "sha256": "6b8295661773cb5820c305091679383b09fb0d7dcdde4412eeae48bfabab28b5", + "uid": 0 + }, + "before": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549330, + "kind": "directory", + "mode": "0o755", + "mtime_ns": 1793430825511133103, + "nlink": 3, + "relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/charts", + "sha256": "6b8295661773cb5820c305091679383b09fb0d7dcdde4412eeae48bfabab28b5", + "uid": 0 + }, + "path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/charts" + }, + { + "after": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549341, + "kind": "directory", + "mode": "0o700", + "mtime_ns": 1793430825512133101, + "nlink": 3, + "relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/release", + "sha256": "25a35515bc386a0c0a1a91b5fa3c966fffad64e2ce1d8bde35959bc164b11d79", + "uid": 0 + }, + "before": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549341, + "kind": "directory", + "mode": "0o755", + "mtime_ns": 1793430825512133101, + "nlink": 3, + "relative_path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/release", + "sha256": "25a35515bc386a0c0a1a91b5fa3c966fffad64e2ce1d8bde35959bc164b11d79", + "uid": 0 + }, + "path": "releases/9f1daf6c5fb56b2b4fc9817f28f5ad090c884b0295f7d6f4469e42d48fa8d59f/capsule/release" + }, + { + "after": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549219, + "kind": "directory", + "mode": "0o700", + "mtime_ns": 1793406468579820277, + "nlink": 3, + "relative_path": "releases/5fd7ccd8f68057346367d81efb82b48280a16dd31d87683a5bd83e60e3d1837e/capsule/charts", + "sha256": "6b8295661773cb5820c305091679383b09fb0d7dcdde4412eeae48bfabab28b5", + "uid": 0 + }, + "before": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549219, + "kind": "directory", + "mode": "0o755", + "mtime_ns": 1793406468579820277, + "nlink": 3, + "relative_path": "releases/5fd7ccd8f68057346367d81efb82b48280a16dd31d87683a5bd83e60e3d1837e/capsule/charts", + "sha256": "6b8295661773cb5820c305091679383b09fb0d7dcdde4412eeae48bfabab28b5", + "uid": 0 + }, + "path": "releases/5fd7ccd8f68057346367d81efb82b48280a16dd31d87683a5bd83e60e3d1837e/capsule/charts" + }, + { + "after": { + "bytes": 4096, + "device": 2049, + "gid": 0, + "hash_kind": "directory-entry-names", + "inode": 549263, + "kind": "directory", + "mode": "0o700", + "mtime_ns": 1793412565567095985, + "nlink": 2, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private", + "sha256": "384eaf76c1a05ea25236c7a0d7bee390638b68fc89186604def37028364992fb", + "uid": 0 + }, + "before": { + "bytes": 4096, + "device": 2049, + "gid": 10001, + "hash_kind": "directory-entry-names", + "inode": 549263, + "kind": "directory", + "mode": "0o700", + "mtime_ns": 1793412565567095985, + "nlink": 2, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private", + "sha256": "384eaf76c1a05ea25236c7a0d7bee390638b68fc89186604def37028364992fb", + "uid": 10001 + }, + "path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private" + }, + { + "after": { + "bytes": 455, + "device": 2049, + "gid": 0, + "hash_kind": "file-bytes", + "inode": 549311, + "kind": "regular", + "mode": "0o600", + "mtime_ns": 1793412565564096058, + "nlink": 1, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/result.json", + "sha256": "859e5a80442ad77b5eff61b68e5062a167d51f5db1b6c2d1ee064db977beb022", + "uid": 0 + }, + "before": { + "bytes": 455, + "device": 2049, + "gid": 10001, + "hash_kind": "file-bytes", + "inode": 549311, + "kind": "regular", + "mode": "0o600", + "mtime_ns": 1793412565564096058, + "nlink": 1, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/result.json", + "sha256": "859e5a80442ad77b5eff61b68e5062a167d51f5db1b6c2d1ee064db977beb022", + "uid": 10001 + }, + "path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/result.json" + }, + { + "after": { + "bytes": 12930, + "device": 2049, + "gid": 0, + "hash_kind": "file-bytes", + "inode": 549315, + "kind": "regular", + "mode": "0o600", + "mtime_ns": 1793412565062108322, + "nlink": 1, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/journal.json", + "sha256": "fef62ad9317066d5d82eccbea0317eceb2f883e07f50935104e47113855fe0dd", + "uid": 0 + }, + "before": { + "bytes": 12930, + "device": 2049, + "gid": 10001, + "hash_kind": "file-bytes", + "inode": 549315, + "kind": "regular", + "mode": "0o600", + "mtime_ns": 1793412565062108322, + "nlink": 1, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/journal.json", + "sha256": "fef62ad9317066d5d82eccbea0317eceb2f883e07f50935104e47113855fe0dd", + "uid": 10001 + }, + "path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/journal.json" + }, + { + "after": { + "bytes": 0, + "device": 2049, + "gid": 0, + "hash_kind": "file-bytes", + "inode": 549310, + "kind": "regular", + "mode": "0o600", + "mtime_ns": 1793412563167160722, + "nlink": 1, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/execute.lock", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "uid": 0 + }, + "before": { + "bytes": 0, + "device": 2049, + "gid": 10001, + "hash_kind": "file-bytes", + "inode": 549310, + "kind": "regular", + "mode": "0o600", + "mtime_ns": 1793412563167160722, + "nlink": 1, + "relative_path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/execute.lock", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "uid": 10001 + }, + "path": "date-operations/47829c7ac2e6fd2c81fde1c914aec7c6e433098fa66985db6cfb9b34069942dc/private/execute.lock" + } + ], + "data_deleted": false, + "paths_moved": false, + "postflight": { + "historical_operations_still_terminal": true, + "state_bytes": 11259904, + "whole_state_custody_guard_passed": true + }, + "proposal_digest": "sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611", + "schema": "coulomb.completed-evidence-custody.v1", + "started_at": "2026-10-31T16:36:38.149305+00:00", + "status": "completed_evidence_private_root_custody_verified", + "timers_activated": false, + "updated_at": "2026-10-31T16:36:38.939513+00:00", + "verified_entries": 8 + }, + "native_entries_verified": 8, + "all_historical_hashes_inodes_paths_mtimes_preserved": true, + "whole_state_custody_guard_passed": true, + "state_bytes": 11259904, + "verification_read_only": true, + "verifier_source_sha256": "27fb56bb621ab9141f6b7ae205790e8a7eeb1618e2628940b3b6bc5525b4393d" +} diff --git a/docs/release/backup-completed-evidence-custody-review-2026-10-31.md b/docs/release/backup-completed-evidence-custody-review-2026-10-31.md index 651eaeb..11cc589 100644 --- a/docs/release/backup-completed-evidence-custody-review-2026-10-31.md +++ b/docs/release/backup-completed-evidence-custody-review-2026-10-31.md @@ -1,11 +1,19 @@ # Completed backup evidence custody repair This is the exact proposed repair for the eight historical metadata exceptions -recorded in CSOC-WP-0012-T04. Native preflight passes. **Nothing has been changed.** +recorded in CSOC-WP-0012-T04. **Founder execution and independent postflight are +complete, under T15. Do not rerun the seal command.** Proposal: `sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611`. +State Hub decision `3ec2f98e-9db3-47d9-bc1a-0387f980b81c` is resolved from the +founder's actual execution at16:36:38Z. Independent read-only verification at +16:37:46Z confirms all eight intended deltas and unchanged hashes, paths, inodes +and mtimes. The whole-state custody guard passes at11,259,904bytes. Evidence: +`backup-completed-evidence-custody-return-2026-10-31.json`. +`operator-handoff-check-2026-10-31.json` retains the earlier pre-execution check. + ## Exact change Within `/var/lib/coulomb-social-backup/`, change: @@ -33,9 +41,9 @@ The strict backup capacity guard is unchanged. Successful execution also runs it existing state-usage/custody check over the entire state tree. This is neither a blanket chmod/chown nor an exception that omits historical data from accounting. -## Founder terminal command +## Historical founder terminal command — completed -Run this from the workstation after reviewing the scope above: +Retained for provenance; do not run again: ```bash python3 /home/worsch/coulomb-social/scripts/seal-backup-evidence.py \ @@ -48,9 +56,9 @@ At the prompt, enter: SEAL sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611 ``` -Expected status: `completed_evidence_private_root_custody_verified`, eight entries -verified and `postflight.whole_state_custody_guard_passed: true`. Paste the result -back for independent readback. The private durable receipt is: +Recorded status: `completed_evidence_private_root_custody_verified`, eight entries +verified and `postflight.whole_state_custody_guard_passed: true`. Independent +readback is complete. The private durable receipt is: `/var/lib/coulomb-social-backup-custody/fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611/receipt.json`. @@ -106,12 +114,12 @@ Nineteen dedicated cases exercise real metadata/lock IO, preserved bytes/paths, explicit/partial rollback, interference refusal, source/digest boundaries, nonterminal refusal, and native receipt/process/helper/mount/cluster/timer guards. -This resolves only the current custody mismatch after attended success. T04 still +The verified attended execution resolves the historical custody mismatch. T04 still owns retention/capacity admission and historical-copy disposition. Preventing future release/date producers from reintroducing these metadata mismatches is also -live T04 work before recurring service acceptance: nested release directory -creation currently uses default intermediate modes, and date helper journals -retain the execution UID after completion. Do not silently change frozen capsules. +required before recurring service acceptance. That source correction is now +completed under T13/RAPPS-WP-0015-T06; it does not repair the historical entries +listed here or change frozen capsules. T07 still needs the existing route execution; T08 then needs inactive installation and independent readback. No native backup-operation or migration acceptance is inferred from this repair. diff --git a/docs/release/backup-source-installation-execution-review-2026-10-31.md b/docs/release/backup-source-installation-execution-review-2026-10-31.md index b003566..f60c40a 100644 --- a/docs/release/backup-source-installation-execution-review-2026-10-31.md +++ b/docs/release/backup-source-installation-execution-review-2026-10-31.md @@ -3,7 +3,9 @@ The final wrapper is prepared for CSOC-WP-0012-T08. It installs the previously sealed22-member archive into its exact19 target paths, using the existing transaction library. It neither captures data nor starts/enables a service or -timer. Current native preflight **refuses**; do not execute this packet yet. +timer. The earlier custody refusal was resolved by verified T15 execution at +16:36:38Z. T07's route return and a fresh installer preflight remain required; +do not execute this packet yet. Proposal: `sha256:8f442bf0ebed8bbf3b7f227b52081df52613f3f5f6874c4a59511cfc2ba06d42`. @@ -105,7 +107,7 @@ corrected. The sender preparer's embedded remote Python AST is unchanged, and the send-free return-mail rehearsal passed again. Historical evidence keeps its original source hashes; the new validation binds the current formatted sources. -T08 remains progress until actual installation and independent inactive-state +T08 remains wait until actual installation and independent inactive-state readback. T09 still needs native service/failure/retry/stale/producer-death proof; T10 still needs activation and observation after its existing prerequisites. No full service acceptance, mail delivery or migration verdict follows from diff --git a/docs/release/operator-handoff-check-2026-10-31.json b/docs/release/operator-handoff-check-2026-10-31.json new file mode 100644 index 0000000..dac6aeb --- /dev/null +++ b/docs/release/operator-handoff-check-2026-10-31.json @@ -0,0 +1,55 @@ +{ + "schema": "coulomb.operator-handoff-check.v1", + "recorded_at": "2026-10-31T16:35:39.718467+00:00", + "custody_preflight": { + "status": "completed_evidence_seal_preflight_verified", + "proposal_digest": "sha256:fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611", + "entries": 8, + "modified": false, + "historical_operations_terminal": true + }, + "route_preflight": { + "schema": "rapp-telemetry.backup-route-execution.v1", + "execution_digest": "sha256:4d8481061dc9ce6835169defc96887945052332a0db8d4234ae84032d63cc328", + "proposal_digest": "sha256:4bcad54f7b8e1e77b94112e452cbb58eaf8e882dc10305129c5f9ca69f014a66", + "status": "preflight_verified", + "timers_activated": false, + "notification_sent_by_helper": false, + "production_data_restored": false + }, + "native_receipts_present": { + "custody": false, + "route": false, + "inactive_installation": false + }, + "owner_tasks": { + "RPF-WP-0068-T03": "wait", + "RPF-WP-0068-T04": "todo", + "NK-reset-role-transition": "wait", + "CSOC-WP-0012-T07": "wait", + "CSOC-WP-0012-T08": "wait" + }, + "decision_queue": [ + { + "id": "3ec2f98e-9db3-47d9-bc1a-0387f980b81c", + "title": "Seal eight completed backup-evidence entries (fa2763d1)", + "status": "escalated", + "decision_type": "pending", + "decided_by": null, + "escalation_note": "Auto-escalated per constitution \u00a74: this pending decision touches financial or legal territory and requires explicit human approval before action." + }, + { + "id": "5fa7234f-2a41-4eed-b4fc-9384f493572b", + "title": "Deploy recurring Coulomb backup alert route (4d848106)", + "status": "escalated", + "decision_type": "pending", + "decided_by": null, + "escalation_note": "Auto-escalated per constitution \u00a74: this pending decision touches financial or legal territory and requires explicit human approval before action." + } + ], + "new_approval_recorded": false, + "operator_execution_performed": false, + "message_sent": false, + "timers_activated": false, + "existing_destinations_and_schedule_preserved": true +} diff --git a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md index dcbeec4..c5bc5d2 100644 --- a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md +++ b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md @@ -558,7 +558,7 @@ status: progress priority: high state_hub_task_id: "a36722a5-5f13-5728-9d58-24f030c2bb00" needs_human: true -intervention_note: "Eight-entry completed-evidence custody repair is prepared and native preflight passes; founder terminal command is in docs/release/backup-completed-evidence-custody-review-2026-10-31.md, proposal fa2763d1dcbe92fe638a29c9a7a7d51c03d30849c4232f2d43f81ef705bae611. No change executed. Historical pair disposition and retention/capacity admission remain open; existing destinations and schedule are settled." +intervention_note: "Eight-entry historical custody repair is founder-executed and independently verified under completed T15. Historical pair disposition and retention/capacity admission remain open; the exact inactive installer carries the prepared capacity profile. Existing destinations and schedule are settled." ``` Remaining scope from T01. Close with owner-admitted capacity/headroom limits, a current generation/expiry plan, and explicit retention or deletion disposition for historical private production-pair copies. Execute only admitted expiry and retain native receipts. Proposed limits and a deletion candidate list are not admission. Evidence: `docs/release/backup-capacity-review-2026-10-30.md` and `generation-retention-post-date-2026-10-31.json`. No deletion has occurred. Existing RPF-WP-0053 custody/expiry ownership remains canonical. @@ -587,6 +587,22 @@ helper ownership exceptions. T04 still owns the exact historical eight-entry rep retention/capacity admission and historical-copy disposition. Source correction does not execute that repair or establish native recurring-service acceptance. +2026-10-31 operator-handoff audit: fresh native preflight again verifies all eight +entries and terminal historical operations with proposalfa2763d1 unchanged; its +execution receipt is absent. The existing human gate now links pending decision +3ec2f98e-9db3-47d9-bc1a-0387f980b81c, which State Hub automatically escalated to +human review. It is not approval or a changed scope. The founder has been given +the one-line command and exact SEAL response. After the return, independently +verify durable receipt and custody before progressing to installation. Evidence: +`docs/release/operator-handoff-check-2026-10-31.json`. + +Founder execution subsequently completed at16:36:38Z. Independent readback at +16:37:46Z verifies all eight intended metadata changes, unchanged hashes/paths/ +inodes/mtimes, terminal historical operations and whole-state custody at11,259,904 +bytes. The custody decision is resolved from this actual execution. Completed +native milestone T15 now holds that requirement; do not replay the seal command. +T04 remains progress for retention/capacity and historical-copy disposition. + ## T05 — Verify both approved backup alert destinations ```task @@ -615,6 +631,7 @@ Durable independent channel attempts, retry/replay, failed/pending/stale episode id: CSOC-WP-0012-T07 status: wait wait_kind: human +decision_id: "5fa7234f-2a41-4eed-b4fc-9384f493572b" blocking_reason: "Exact reviewed route is prepared; founder terminal execution and its durable verified receipt are pending." priority: high state_hub_task_id: "8c8e4810-d967-54b2-ae49-25d367eac459" @@ -624,6 +641,14 @@ intervention_note: "Existing attended route packet4d848106 awaits founder execut The exact owner execution packet is ready; durable receipt was absent at the 10:04:37Z observation. Founder execution and independent complete-resource/runtime-config postflight remain. Use the existing reviewed owner packet in `/home/worsch/rapp-telemetry/docs/coulomb-backup-route-execution-2026-10-31.md`, digest4d848106; inspect any existing attempt before further action. No renewed recipient approval is needed. Close only on durable verified native success, preserving the existing PVC and unrelated routes. +Fresh operator-handoff audit again finds no route receipt; the exact native +preflight passes with execution digest4d848106 unchanged. The previously unrouted +human gate now links pending decision5fa7234f-2a41-4eed-b4fc-9384f493572b, automatically +escalated by State Hub for human review. Existing destinations and schedule stay +settled. This fixes decision-queue visibility; it is not deployment, permission to +send another proof email or monitoring activation. The installation receipt is +also absent. Evidence: `docs/release/operator-handoff-check-2026-10-31.json`. + ## T08 — Finish the supervised source installer and install inactive units ```task @@ -640,9 +665,10 @@ The installation/rollback library and final supervised wrapper are implemented. The wrapper binds sources, archive/manifest, native preimages, both exclusive locks, full owner route verification, capacity/profile, SDK/custody and inactive/ disabled/no-queued-job guards. Explicit rollback retains preimages and refuses -interference. Current native preflight reaches and refuses the capacity guard's -historical custody exceptions; T04 now records that exact blocker. T07's route -receipt is also still absent. No installation attempt or target change occurred. +interference. The earlier native preflight refused the capacity guard's historical +custody exceptions; T15 now records their completed repair and independent +verification. T07's route execution is still awaiting its return. No installation +attempt or target change occurred. Then obtain the attended return and independently verify installed hashes and disabled units. Review: docs/release/backup-source-installation-execution-review-2026-10-31.md; source/gate evidence: backup-supervised-installer-validation-2026-10-31.json. @@ -653,11 +679,11 @@ currently fixes atdcc8dd2a. Both existing packet digests are preserved. Technica sequencing decision: de5a4528-0864-4769-b9d0-2f658b0310c6; this is not image execution approval. -Preparation is complete; task status is now wait for the T04 custody/profile -return and T07 attended route. The exact eight-entry custody repair has a passing -native preflight but has not executed. Installation and independent postflight -still prevent this task from being done. T07 likewise waits for its founder run; -neither task represents a currently running native job. +Preparation is complete; task status remains wait for T07's verified attended +route, then a fresh installer preflight and attended installation including the +displayed capacity-profile admission. The eight-entry custody repair is complete +under T15. Installation and independent postflight still prevent T08 from being +done. No installer job has been started. ## T09 — Prove native paired service and recurring failure reception @@ -805,3 +831,26 @@ Evidence: docs/release/service-provenance-binding-2026-10-31.json and the latest service-provenance reconciliation. T11 remains progress for registration, finance, current SLO and stage-1 smoke; no runtime, credentials, cost facts or acceptance were fabricated or changed by this audit. + +## T15 — Seal completed historical backup evidence custody + +```task +id: CSOC-WP-0012-T15 +status: done +priority: high +needs_human: false +decision_id: "3ec2f98e-9db3-47d9-bc1a-0387f980b81c" +state_hub_task_id: "4c1ee823-c148-5c8c-8fea-0ab8c3a4213e" +``` + +Completed2026-10-31. This extracts the verified historical custody requirement +from T04; its retention/capacity/copy-disposition scope remains live there. +Founder executed exact proposalfa2763d1 at16:36:38Z. The durable private receipt +and independent native readback verify root/private ownership and modes for all +eight reviewed entries with original hashes, bytes, paths, device/inodes and +mtimes preserved. Historical operations remain terminal, their helper is absent, +the four operation locks are available, no overlapping hostPath mount exists, +and the whole-state custody guard passes at11,259,904bytes. No capture, data +deletion, application write or timer activation occurred. Do not rerun the seal +command. Evidence: +`docs/release/backup-completed-evidence-custody-return-2026-10-31.json`.