railiance-platform/docs/evidence/repo-review-2026-09-05.md

Repository review — 2026-09-05

Reviewed the working tree, fetched origin, scanned all local workplan statuses, and read/acknowledged the State Hub inbox. Existing WORK-RECORDS.md changes correct renumbered plans 0025–0027 and are retained.

Open plans 0015, 0025 and 0027 retain their attended gates: approved exercise windows/abort operators, operator listener cutover, and exact recovery/custody receipts. No new qualifying receipts were in the unread inbox.

New actionable source work is tracked by RPF-WP-0028 (durable image inventory) and RPF-WP-0029 (backup credential fallback). Their live completion gates remain explicit. No prune, reboot, lease revocation, or provider rotation was run.

Other inbox demands requiring scoped design or owner inputs remain pending:

• ops-mason fluid-telegram: tenant prefix and actual OIDC group claim remain unconfirmed. Read/write policy requires reviewed CCR schema/validator support; current read-only request shape must not be bypassed.
• secrets-engine: native AppRole apply still requires serving canonical action authorization, exact targets, attended authority and consumer health proof. Its separate service JWT mount/role contract is not yet established here.
• State Hub rename preflight: dedicated signing-secret lane remains to be designed and approved; the rename is outside this session's scope.
• Policy Nexus CCR-2026-0014 request is superseded by the repository's existing activation commit 62423fd; no duplicate provisioning performed.
• Activity-core OpenRouter recovery was reported complete and its intentional reuse decision retained in RPF-WP-0004.

No coordination messages were sent. Incoming requests are recorded here for follow-up rather than treated as permission to invent identities or credentials.

Validation: unittest discovery passed 158 tests; full pytest discovery passed 164 tests, including the function-based tests omitted by unittest. Bash syntax and git diff whitespace checks passed. The inventory and credential tests use synthetic inputs and mocked custody only.

State Hub synchronization remains pending: statehub fix-consistency was attempted in the sandbox and once outside it. Both were interrupted after prolonged HTTP reads during the check phase, before a repair report was returned. No registrar skip was reported, so registrar authority was not assumed. Re-run statehub fix-consistency when these reads complete reliably to index the new workplans and refresh the generated records/brief. Progress was logged successfully as 7e317a96-eb7e-4b36-9d81-4efe49efa22c.

Follow-up: prune guard and consistency latency

The CLI now refuses apply before authentication if any explicitly requested image export is missing, unreadable, empty, or comment-only. Focused tests: 14 passed. Full suite: 166 passed. No production prune was run. Implementation commit: f637989.

Read-only HTTP timing reproduced the consistency problem:

• /repos/railiance-platform: HTTP 200 in 13.58 seconds.
• /repos/railiance-platform/work-record-projection/snapshot: HTTP 200 in 16.02 seconds; schema and repository ID match the checker contract.
• The installed consistency checker defaults to a 10-second HTTP timeout; snapshot failure causes fallback to individual workplan/task reads.

A further ordinary sync was interrupted during slow reads. The installed checker was then invoked in-process with only its HTTP client timeout increased to 60 seconds (same --here . --fix arguments and repair/identity rules). It also failed to return a repair report within several minutes and was stopped; no generated repository changes were observed. This confirms a latency issue, but does not establish that timeout tuning alone is sufficient. State Hub sync remains pending. A focused State Hub endpoint/query latency investigation is needed before another full consistency run. No registrar authority was changed.

Operational migration and precise sync blocker

RPF-WP-0028 is now finished: durable directory and versioned capture hook installed on railiance01; actcore-worker rolled out; definition synchronized and read back from the API. All 51 restored entries survive in the 86-entry union. The worker mount is read-only, and missing input is rejected before subprocess invocation. No prune was executed. See the dedicated JSON receipt. Platform code da42f76; activity-core integration 4083f31.

The current State Hub AGENTS.md documents rmgr sync --path . --push for fast projection sync, reserving fix-consistency for deep audits. That command assigned missing identifiers and pushed 05f315b, verified primary/railiance01 and the exact Forge commit, then returned a refusal in 5.8 seconds. The blocker is six duplicated identities shared by the archived May apps-pg plan and the August Core Hub onboarding plan, both RPF-WP-0021. No projection mutations were performed. RPF-WP-0031 tracks the exact repair proposal and the required exception to this repository's managed-UUID editing prohibition. This supersedes the previous undifferentiated "sync latency" blocker; deep audit latency is separate.

Read-only State Hub source inspection also found eager relationship loading on RepositorySlug, ManagedRepo, Workplan and Task. Avoiding unrelated relationship loads is a candidate optimization for the snapshot/identity endpoints, not a measured root-cause finding. No State Hub service code or deployment was changed.