GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.
GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.
FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
B1 was found with a shell pipeline and published as a finding. The review it
appeared in had already argued that a mechanical check nobody can re-run is an
assertion, and §11's entire claim is mechanical checkability — so asserting B1
unmechanically was that defect committed by the repository reporting it.
tools/survey_layer_declarations.go reads both §11 forms per repository, reports
intra-repository disagreement, and writes a receipt. Run once, it showed the
published B1 was wrong: the estate does not spell layer: three ways across
repositories. The original pipeline took the first ^layer: match per repository
without recording which file it came from, reporting one value where there were
two.
The corrected finding is stronger. Nine of nine repositories carrying both §11
forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml
says engine/staff. The disagreement is within each repository, between the two
forms §11 permits, and it is universal rather than careless — two generators, two
conventions. Nobody is inconsistent with anybody else.
That relocates the question from casing to precedence: §11 accepts either form
and does not say which governs when both exist and disagree, so a conformance run
reading INTENT.md and one reading layer.yaml reach different answers for nine
repositories while both follow §11. flex-auth is the only declared repository
that cannot exhibit this, and only because it never wrote the second file.
The correction is recorded in the review rather than edited away: a published
review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no
exception for the reviewer.
Four tests cover the disagreement case, the refusal to fold case, a missing
declaration, and the single-form shape that must not read as self-disagreement.
The survey checks only the §3 vocabulary and never applies flex-auth's house
rules to peers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
FLEX-WP-0020-T04: reuse-surface is the first owner to return a live work-record
(REUSE-WP-0023, two tasks, both deliberately in wait). Recorded in the handoff
evidence and verified rather than taken on report — the hub record is active,
access-engine raw returns 404, flex-auth returns 303, so the rename has not
landed and their refusal to pre-rewrite the federation source URL is correct.
That refusal changed the plan rather than only their side: flipping an enabled,
publish-passing source before the rename drops a live capability from the
composed federated index, so the source rewrite is ordered after T06, and
flex-auth owes them a ping when access-engine serves the capabilities index.
Nine owners remain pending; T05 stays blocked.
FLEX-WP-0022-T01: re-asked tenant-engine what CheckRequest.tenant denotes on the
write API, stating that "none" is a complete answer. Their code copies tenant_id
onto both tenant and resource.id, but that is observation, not admission, and
encoding a rule from it would make flex-auth the author of their tenancy model.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
FLEX-WP-0020 T01-T03: fresh preflight is zero-blocker, repository-only
scope is FLEX-DEC-2026-013, concurrent work is FLEX-DEC-2026-014.
T04 handoff requests are posted; owner work-records are still required.
T06 stays behind the exact human confirm string and a post-commit preflight.
Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
CI image 8007ede@sha256:6da9543d02ff556d5d5e33624599eb26b73ef365ed0e1ee2fac2ad7703b7dcba
now serves examples/informed-decision-sitting. T03 deployment is unchanged.
Native caller checks pass with synthetic identities; human bind stays with
INFD-WP-0002.
Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
Seven exact-record pins from the 2026-09-15 sitting-create receipt.
c01 is omitted. Identity bar matches T03. 147 local evaluator checks
pass. Deploy waits on a CI image that contains the new package.
Assistant: grok
Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
