state-hub/workplans/STATE-WP-0095-historical-source-receiving.md

id	type	title	domain	repo	status	owner	created	updated	flavor	depends_on	state_hub_workstream_id
STATE-WP-0095	workplan	Preserve exact closed historical source bindings in Forge receiving	infotech	state-hub	active	codex	2026-10-04	2026-10-17	implementation		79579572-8120-5d3b-aca5-dd4aff60d058

Goal

Normal Forge receiving must preserve the seven bound Activity legacy source views and the Custodian retired ADHOC source without new identities, source rewrites, task movement, deletion, relabeling or unretirement. This implements receiving support before RMGR-WP-0019 registrar admission. CUST-WP-0077 owns cross-owner coordination; deployment and replay remain explicit owner returns.

Verify source bindings and shared views

id: STATE-WP-0095-T01
status: done
priority: high
state_hub_task_id: "6a5f87bb-e63d-5e20-b9fc-c1b5cd403ff7"

Reviewed seven exact Activity files: four existing workplans and 64 UUID-bound closed tasks. The archived custodian-WP-0003 parent and three split_from views share one existing parent UUID; every repeated task binding/content agrees. Custodian ADHOC-2026-08-25-retired retains parent 1c53d3db-6633-5e2d-987f-10706d73be9e and task d8af3e6b-26ae-580c-bbeb-caa8ad419bec. No identity migration is authorized.

Implement preservation receiving and global collision refusal

id: STATE-WP-0095-T02
status: done
priority: high
state_hub_task_id: "ebb24194-e4cc-5130-aaa6-663f2ea2c822"

Prepared exact source digest manifest, existing-parent/task verification, immutable receiving and UUID-based historical diff. Ordinary canonical sources continue deriving their identities. Missing/changed/symlinked source, absent bound rows or nonterminal hub histories refuse. Check task UUID holders globally, including retired and acknowledged-stale parent workplans, before INSERT.

Offline preview tests and snapshot proof are evidence of source behavior only; finish after applying reviewed source and its focused tests to the owning repo.

Deliver receiving through normal deployment and verify owner return

id: STATE-WP-0095-T03
status: done
priority: high
depends_on: [STATE-WP-0095-T02]
state_hub_task_id: "e8566341-cf6e-5b9c-ad80-8564d14cd52a"
decision_id: "36772026-f43d-4331-b466-5f4b1afe4eca"

No direct live code patch. This task is a deployment return, not policy authority or permission to resolve identity decisions. Exact receiving fixture acceptance and global collision rejection must hold in the delivered version.

Verify normal historical replay preserves existing identities

id: STATE-WP-0095-T04
status: done
priority: high
depends_on: [STATE-WP-0095-T03, RMGR-WP-0019-T03]
state_hub_task_id: "3bbb311f-194e-5862-8aed-358a580f22b4"

Verify Activity four historical parent UUIDs/64 task UUIDs and Custodian retired parent/task unchanged; no historical row creation, movement, deletion, relabeling or unretirement. Unrelated stale projections remain separate decisions.

2026-10-05: Source exact-set retirement support now exists. Repository projection reconcile accepts expected_retirement_uuids; that set must equal the stale projections, and any task or dependency edge on a stale row refuses the call. Live apply still needs a reviewed rollout. On 2026-10-05 the founder accepted review review-1ece4f3e-d0e3-4fd6-abc8-272f1b1876f4, which names only the three empty projections and preserves parent b4eb45a9-69e3-4ab0-b00c-67a53c3117c5. That acceptance is not a live retirement and does not resolve 91b7c633-a66f-5d43-9f4b-6565aefb9356.

Offline evidence, 2026-10-04

Prepared receiver suite: Forge projection regression plus historical preservation, missing/changed source, terminality, immutable UUID diff, and global holder query. Real-source offline snapshot proof preserves four Activity parents/64 tasks and one Custodian parent/task without mutations; no API writes or deployment occurred. Exact original bindings are maintained in api/services/historical_projection.py.

2026-10-04 actual owning-source validation: 155 focused receiver/qualifier/planner cases passed; the independent offline current-source/current-hub-snapshot proof retained five existing parents and 65 task UUIDs, no mutations, clean historical diff. T02 is source-complete; T03/T04 remain wait for reviewed deployment and normal registrar/replay receiving, respectively. Evidence: docs/evidence/2026-10-04-historical-receiving-source.json.

Verified receiving rollout and remaining replay gate, 2026-10-04

T03 is done on actual founder approval of proposal STATE-WP-0095-T03-historical-receiving revision 1, SHA256 d6789359b3fe7988a6201fff6f367cb46948aa197e1cc0ca66c31f45e1ea9981, approval receipt reference user_reply:call_o87uEfFs3AtXfxO5YqUnSpcg:0. The normal owner Helm path delivered main-5dd3df9, commit 5dd3df9c69eb564af10ea5ea01e349786212501a, revision 72; API and MCP are Ready, primary/railiance01 health and schema a0b1c2d3e4f5 verified, running source hashes match. Rollback remains revision 71; no receipt-table downgrade is needed. Actual historical preservation and global task-holder refusal were verified in the delivered version. Durable receipt: verified historical receiving rollout.

Custodian immutable replay applied while preserving the retired historical parent/task UUIDs. Activity immutable replay retained all four historical parent and 64 task UUIDs and historical row contents, but refused transactionally on three unrelated stale projections: custodian-wp-0003 (archived), custodian-wp-0003a (done), custodian-wp-0003b (done). No retirement acknowledgement was issued and that refusal is not represented as normal replay success.

Registrar source c41d36c2 has 38 actual passing tests and Repo Manager's own normal sync succeeded; registrar admission does not authorize retiring Activity projections. T04 therefore remains wait, retaining RMGR-WP-0019-T03 and awaiting Activity Core's precise reviewed disposition of those three stale rows. No rename, identity migration, new paid native trial or further live action is included in this source status update.

Activity Core return, 2026-10-06

Activity Core returned the exact disposition (message cf2d5847-8b3f-4653-9d9f-d5fcfbe3f1e4, ACTIVITY-WP-0045, activity-core commit 941fac0). expected_retirement_uuids: 683724d9-4249-5e0e-88e0-7baff4330d58 (custodian-wp-0003), 644017c7-c5f2-5a64-81c3-d8ee806f8251 (custodian-wp-0003a), a5806df9-5b9a-50da-81c1-7e606076bed9 (custodian-wp-0003b). Each has zero tasks and zero dependency edges. None is preserved parent b4eb45a9-69e3-4ab0-b00c-67a53c3117c5. Repo Manager independently verified the set (message 916841f6, repo-manager commit 498682c). Nothing was retired. T04 now waits on decision 91b7c633 and a reviewed live rollout. After that, Repo Manager re-runs the Activity owner sync and closes RMGR-WP-0019-T03.

Retirement rollout and T04 verification, 2026-10-06

The founder resolved decision 91b7c633 (retire exactly the three projections) and approved the rollout. The founder ran the normal Helm upgrade to main-968a811 (revision 74; rollback revision 73, main-fad9b3f). API and MCP are Ready, health is ok on primary/railiance01, and schema b3c4d5e6f7a8 is unchanged; no migrations. The activity-core reconcile at commit 67a92d2ff8e033baf2c36998d24187fe83edec84 with expected_retirement_uuids set to the three UUIDs applied: 0 created, 3 retired (tombstoned with an @retired-20261006 slug; UUIDs and statuses kept), 0 refused, 0 tasks cancelled. All 7 bound Activity source files still match their digests. The four historical parents and 64 task UUIDs are present under their bound parents with unchanged fields. The Custodian retired parent and task are unchanged. Activity had 54 workplans and 288 tasks before and after. Evidence: activity stale retirement rollout. Repo Manager's re-run of the Activity owner sync (RMGR-WP-0019-T03) and ACTIVITY-WP-0045-T02 remain with their owners.

Cluster exact historical receiving successor, 2026-10-17

This scoped extension retains the completed Activity/Custodian outcomes above. Three frozen cluster archives contain three existing parent UUIDs and 15 existing closed task UUIDs. Extend the existing exact historical receiving path before registrar admission; never derive replacement identities or modify those sources. Cross-owner observation attaches to existing SHR-WP-0001, with RMGR-WP-0019 as obligor/beneficiary and NK-WP-0049-T35 benefiting indirectly. The local derived case is waiting; no live worker injection is authorized.

Prepare exact cluster source preservation and refusal cases

id: STATE-WP-0095-T05
status: done
priority: high
state_hub_task_id: "339b9a37-181c-5599-9a89-0393e199bd4b"

Prepared the same full-file SHA256 and 15 task binding manifest as Repo Manager. Candidate receiving tests pass 26: existing rows remain entirely unchanged; missing/foreign/nonterminal rows and unknown, changed, missing or symlinked source refuse. Read-only public metadata confirms all 18 existing rows have the expected ownership and terminal status. These are source and metadata checks, not delivered receiving or a committed native trial.

Deliver reviewed cluster receiving successor before registrar admission

id: STATE-WP-0095-T06
status: done
priority: high
depends_on: [STATE-WP-0095-T05]
needs_human: false
intervention_note: "Exact revision 4 approved and verified; no pending rollout intervention."
state_hub_task_id: "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4"

Completed 2026-10-17 on the founder's approval of exact revision 4 of stable proposal STATE-WP-0095-T06-cluster-frozen-receiving-r1 (decision e3798419-8aa9-5425-8c08-20df6bd82a19; approved digest sha256:63a02e8296d126c0158b7eb2c4ce79c7eeb6f8d6f61298d473c1065c7557ba32). The ordinary owner Helm path delivered revision 76, runtime source 51bc70d and exact image manifest sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015. API/MCP Ready and primary/railiance01 health report expected schema c4d5e6f7a8b9; delivered historical module sha256:e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2 matches. All three parent and 15 task full DB row hashes/columns/UUIDs remained unchanged. Five actual native probes passed: preserve, actual foreign-parent holder move, nonterminal task, nonterminal parent and missing task. Every probe rolled back; a fresh transaction confirmed complete row restoration. The foreign-holder case precisely verified historical binding refusal, not the separate global UUID-holder creation branch. No committed probe writes were made.

Evidence: verified receiving rollout. This actual receiving return satisfies the prerequisite of RMGR-WP-0019-T05. Normal cluster publication and its immutable-source/row return remain T07; source readiness and this deployment do not count that later acceptance twice. The additive inbox migration is retained; Helm rollback does not downgrade schema or stop an active migration Job. Original failures and exact-UID recovery limits remain in the referenced approved packet. No TLS recovery/native private admission or new autonomy/cost grant is inferred.

Verify ordinary cluster receiving and immutable historical rows

id: STATE-WP-0095-T07
status: wait
priority: high
depends_on: [STATE-WP-0095-T06, RMGR-WP-0019-T06]
state_hub_task_id: "cfd1ea99-e75b-542e-a434-acefb62f3c7d"

Capture normal cluster owner publication/receiving receipts and compare entire existing row snapshots and exact source bytes. No creation, movement, relabel, unretirement or retirement is authorized for these histories. A rollback first fences cluster sync and restores registrar refusal before removing receiving support; it never rewrites archived IDs or UUIDs. This work does not establish original TLS recovery or owner-native admission.

Fix policy-compatible Secret-template server dry-run preparation

id: STATE-WP-0095-T08
status: done
priority: high
state_hub_task_id: "2dd9b04f-2250-5a8a-b5bc-c8a009872858"

Prepared the narrow Makefile successor after the existing readiness command refused its first Secret-template phase. Ordinary client-side apply adds the last-applied annotation, correctly denied by the existing Platform reject-secret-last-applied policy. Only the two Secret-template server dry-run requests now use server-side apply with dry-run; no force-conflicts, Secret value change, policy relaxation or actual Secret write is introduced. Command-fixture tests verify both requests and preserve other dry-run phases. Evidence and original refusal remain in the Custodian cluster historical publication packet, revisions/r2 and r3-readiness. This is completed source preparation; T06 separately records the verified actual rollout. The runtime image continues to be main-51bc70d; Makefile/workplan changes do not create a new application image or native acceptance.

T08 source repair refinement, 2026-10-17: the required normal Make render correctly refused a pre-existing generated chart classification copy at v1.0 after authoritative canon reached v1.1. Regenerated only through the existing scripts/sync_classification_allowed.py, preserving canon and strict check. The exact source diff is version 1.0→1.1 plus publication/history/participation. Normal Make rendering and the focused classification check passed in an isolated owner-layout copy. The original refusal is retained in the Custodian owner-followthrough-r1 validation receipt. This is source repair only: no live ConfigMap apply, new runtime image, policy relaxation or T07 completion.

T07 actual ordinary-publication return, 2026-10-17: cluster owner deep consistency and normal fast projection completed, exact archived source bytes and all 15 historical task full-row hashes remained unchanged. The later full-row check FAILED for exactly the three parent rows. The earlier approved T06 rollout had preserved all 18 rows at its verification stage; that success is not the later whole-pipeline acceptance. The original snapshots retain hashes only, so exact changed columns and original field preimages are not established. No guessed DB repair or claim that all 18 original row hashes are restored is authorized. T07 and RMGR-WP-0019-T06 remain waiting pending T09/T10 and a reviewed return.

Guard immutable historical index bindings in CLI and receiving API

id: STATE-WP-0095-T09
status: done
priority: high
depends_on: [STATE-WP-0095-T06]
state_hub_task_id: "8be8f13b-6352-5295-9755-de6fbfb13593"

Prepare and publish the narrowly scoped ordinary-binding repair for the three existing task-bound Cluster registry entries. The CLI verifies exact frozen source metadata/bytes and omits those bindings, including on old receivers. The API independently validates the complete batch before any mutation, checks actual repo ownership and the existing terminal parent/task closure, and preserves valid frozen rows without field or timestamp assignments. Invalid metadata, missing/foreign/nonterminal rows refuse the batch. Unknown ordinary bindings retain existing behavior; historical IDs, UUIDs and source bytes stay unchanged. Isolated regression tests and normal owner rendering are required. Reviewed source preparation and canonical regression proof completed on 2026-10-17: 102 isolated tests pass and normal Make render/classification check passes (eight objects, three unchanged delivered runtime images). This completion record accompanies the same source publication/projection; source preparation does not establish delivered runtime or T07 acceptance. Central check/fix engines also refuse the complete repair batch if any fixable context touches an exact registered parent/task UUID or frozen source path. This runs before index bindings and before reconcile/push/individual fixes; ordinary earlier fixes cannot partially execute before a later frozen refusal.

Deliver and verify the ordinary-binding guard successor

id: STATE-WP-0095-T10
status: wait
priority: high
depends_on: [STATE-WP-0095-T09]
needs_human: true
intervention_note: "New API runtime requires its own exact image, reviewed preflight and scoped rollout approval; prior revision-4 approval does not cover it."
state_hub_task_id: "88585c69-d9b9-5e1f-a256-6416ff71e824"

After source publication, resolve normal CI status and immutable image identity, verify delivered guard source closure, prepare exact chart/reuse-values dry-run, full closure/headroom/schema baseline and conditional recovery. Retain additive migration and active-Job cancellation limitations; no Helm schema downgrade or bounded-outage claim. Obtain scoped approval before live rollout. Then verify new full-row baseline preservation and actual rollback-only refusal probes, and only then return to T07 ordinary-pipeline acceptance. This prevents future binding mutation; it does not reconstruct or restore original parent hashes. No production changes, new autonomy or credential authority are granted here.

T09 source repair refinement, 2026-10-17: the attempted current-client regression actually loaded an older packaged consistency checker from the owner virtualenv, not the reviewed canonical source. That trial again failed parent-row hash preservation; it is retained separately and does not count as R5 client proof. Normal C-23 also legitimately normalized WP18 ready to active and created a source commit, but the generic writeback commit included an unrelated staged brief. A narrow successor scopes git add and git commit --only to the actual writeback file, preserving unrelated index/worktree state. Real disposable Git regression tests cover pre-existing staged changes, hooks, no-op and path names. Verify the actually loaded CLI checker hash after ordinary owner package refresh before any retry; capture legitimate source HEAD transitions rather than assume a static revision. T07 and T10 remain wait. No original parent preimage recovery, new runtime delivery or broader authority follows from this source repair.