migrations/0007_forgejo_hubs.sql: table forgejo_hubs, auto-populated
via a BEFORE INSERT trigger on phase_manifests that reads repo_hub/
repo_hub_uri straight out of the manifest JSONB (no top-level columns
needed). ON CONFLICT DO NOTHING -- a hub already seen is left alone;
correcting a URI is a SECURITY DEFINER governance action
(correct_forgejo_hub_uri), not a plain UPDATE, matching every other
governance-action pattern in this project. Thin Python wrappers added
to registry.py.
tests/test_forgejo_hubs.py (6 Docker-gated tests) and
tests/test_reference_docs.py (13 tests, no Docker needed -- smoke-tests
every real specs/policies/specs/profiles/ file, not just the two
exercised incidentally by T03's Control Plane tests).
All seven WP-0015 tasks done; workplan marked finished. Final suite:
94 passing offline, 183 passing under the service extras venv. No
stray Docker containers left running.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New service/reference_docs.py renders specs/policies/*.md and
specs/profiles/*.md read-only at request time via a small markdown
library (added markdown + PyYAML to the service extras) -- not a
static-build pipeline, matching the WP-0012-T03 decision to skip
state-hub's heavier Observable Framework pattern.
One parameterized route, GET /reference/{kind}/{slug}, covers both
addendum URL shapes. Discovered phase_detail.html's Status table never
displayed the degeneration_policy id at all -- added that row (with
the reference link) rather than wiring a link with nothing to attach
it to. phase_new.html gets a plain link next to the field.
Deliberately did not wire extension-id links into the UI in this task
-- extension ids don't appear anywhere in the Control Plane today
(that's WP-0014's gap, not this one's to expand).
6 new Docker-gated tests. Full suite: 94 passing offline, 164 passing
with Docker (up from 158).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
specs/policies/linear-longstop-v0.md extracted from
OpenQuestions-WorkingDefaults.md Q7's prose, with policy_id/title
frontmatter -- Q7 now records only the adoption decision, pointing at
this file for the formula itself.
Six specs/profiles/*.md files extracted from
CanonicalMonetizationProfiles.md's per-profile sections (#1-6), each
with extension_id/title frontmatter matching the ids already used in
real Phase Manifests. CanonicalMonetizationProfiles.md keeps the
cross-profile summary and non-goals sections, now pointing at the
extracted files instead of containing their content.
DevelopmentEffortCalculatorConcept.md gets calculator_id/revision/title
frontmatter for consistency, no move (already conformed as one file per
model). Checked for stale cross-references before editing -- nothing
in the repo links to the removed section anchors.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Schema: phase.milestone_release gains required repo_hub/repo_hub_uri/
repo_id/repo_name; phase gains optional base_phase_id. Backfilled the
golden phase-001 fixture (placeholder values, it's synthetic) and the
three real pilot-candidate manifests with actual Forgejo repo ids
confirmed live (net-kingdom=67, vergabe-teilnahme=62,
info-tech-canon=47, all coulomb/*).
Discovered along the way: the schema change alone would have broken
the existing Control Plane registration form, since nothing collected
the four new fields. Fixed inline rather than leaving it broken
between tasks -- this also completes T04's ledger UI change (drop the
hand-typed ledger input, auto-compute /phases/{id}/ledger, add a
drill-down reference link on phase_detail.html) since both changes
touch the same form/route.
Full suite: 94 passing offline (was 84), 158 passing with Docker
(was 146).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
specs/PhaseProvenanceSpecAddendum.md accepted 2026-08-03. Implementation
filed as its own workplan (TREV-WP-0015), seven tasks mapping 1:1 to
the addendum's sections rather than repeating field shapes/rationale:
schema change, specs/policies/ + specs/profiles/ extraction, Control
Plane reference-rendering routes, ledger UI change, forgejo_hubs
migration, backfilling the three example manifests, and tests/closeout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
specs/PhaseProvenanceSpecAddendum.md synthesizes T02-T04's accepted
decisions into one reviewable document: the phase_manifest schema diff
(repo_hub/repo_hub_uri/repo_id/repo_name, base_phase_id), the
specs/policies/ + specs/profiles/ extraction with concrete file lists
and frontmatter shapes, the ledger UI change, a forgejo_hubs migration
sketch for the hosted hub registry, the three-example-manifest backfill
plan, and a suggested implementation task breakdown.
This is a proposal only, not yet accepted for implementation -- per
the maintainer's own established sequencing, this is the document to
discuss before any of it is filed as its own workplan. All five
WP-0012 tasks are done; workplan marked finished.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Registration form drops the ledger input entirely -- Trust Service
auto-computes the canonical /phases/{id}/ledger reference at
registration time, no human types it in v0. Schema field itself is
unaffected (still present, still federation-ready). Drill-down shows
only the raw reference + a live-data link when it resolves to this
instance; the existing Ledger entries table on phase_detail.html is
untouched and stays exactly as prominent.
All four T02-T04 decisions now feed T05's spec addendum draft.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Checked the maintainer's specific state-hub Reference mechanism before
deciding rather than assuming from the earlier discussion: it's a
dashboard/src/docs/*.md corpus built via Observable Framework into
static HTML, opened standalone or in a "?" context-help overlay. Real,
but a materially heavier static-site pipeline than this repo has or
needs. Decided to carry the spirit (markdown spec -> rendered read-only
view, linked from wherever the id appears) via a small server-side
markdown render route instead, matching the existing lightweight
FastAPI+Jinja2 stack.
Decided: new specs/policies/ and specs/profiles/ subdirectories, one
file per policy/profile, id+revision frontmatter, git's own history as
the audit trail (no new versioning infrastructure). Calculator concept
doc already conforms as-is. No files moved yet -- deferred to after
T04/T05 per the same implementation-after-addendum sequencing used for
T02.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Confirmed live against forgejo.coulomb.social before deciding rather
than assuming: repo ids are real and stable (target-revenue is 103),
but no instance-level hub identity exists (no nodeinfo endpoint), so
the hub identifier has to be minted, not read from Forgejo.
Decided: milestone_release gains required repo_hub/repo_hub_uri/
repo_id/repo_name; phase.base_phase_id is optional, absent for a
first-ever Phase. The hub-to-URI mapping is hosted Trust Service data
(a new table, parallel to licensor_identities), not a file in this
framework repo, per the maintainer's steer that target-revenue must
stay the generic framework rather than carry a specific deployment's
repo list. Backfilling the three example manifests is deferred to
after T03/T04/T05, since the schema change is shared across all three.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
specs/PhaseLifecycleUseCases.md enumerates all nine use cases from the
workplan systematically, grounded in the actual schema, code, and the
three real pilot-candidate manifests rather than abstractly. Two
findings surfaced beyond the original scope: first-Phase and
successive-Phase provenance turn out to be one shared modeling
question (both feed T02), and breach-record publication already has a
decided Operator+ rights tier per the Control Plane concept doc while
extension registration/canonicalization does not — recorded as an
explicit open question for WP-0014-T01 instead of an assumption.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
TREV-WP-0012 is the modeling-only workplan requested after using the
Control Plane UI surfaced real gaps: Phase registration has no
structured repo/provenance fields, the ledger URI is hand-typed, and
degeneration policies are opaque ids with no reviewable spec behind
them. It produces a use-cases document and a discussable spec addendum
before any schema/UI implementation.
Two of the use cases uncovered while scoping this turned out to be
bigger than documentation gaps and are tracked as their own workplans
per that direction: TREV-WP-0013 (nothing currently computes or writes
Remission Credit ledger entries at all) and TREV-WP-0014 (Extension
Registry, Breach Record, and Conversion Attestation backends already
exist from WP-0006 but have no Control Plane UI).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Deploys the Trust Service and Control Plane UI to Railiance
infrastructure-as-code behind revenue.coulomb.social. T01 is a human
decision gate on deployment pattern (own-repo k8s/railiance vs.
railiance-apps chart, one process vs. two, CNPG database, OpenBao
secrets, subdomain/TLS, credential bootstrap) before any manifest work
starts. Deployment is explicitly scoped as infrastructure delivery,
not a Phase go-live decision (that remains WP-0008-T05).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Builds the Control Plane's browser UI (login, dashboard, Phase
registration, Development Credit entry/proposal/review, credential
admin, audit log) as a FastAPI + Jinja2 app over the already-finished
T03 backend, rather than from scratch — whynot-design's Lit web
components are vendored as static assets (source commit 4b62cffc,
v0.4.1), with lit itself resolved via an esm.sh CDN import map.
Session auth re-checks the credential token against the database on
every request rather than trusting the session cookie's cached rights,
so a mid-session revocation takes effect immediately.
9 new Docker-gated HTTP-level tests via FastAPI's TestClient (no
browser-automation tool available, so real rendering of the <wn-*>
components was never visually verified). All four WP-0009 tasks are
now done; workplan marked finished.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
migrations/0006_control_plane.sql: control_plane_audit_log (append-only,
no UPDATE/DELETE for trf_app) and control_plane_proposed_entries (the
Contributor tier's "propose, don't append" workflow from concept §2) -
review decisions go through a review_proposed_entry() SECURITY DEFINER
function, same governance-action pattern as
set_extension_status/revoke_credential, not a direct UPDATE.
src/target_revenue/control_plane.py is the enforcement layer concept
§2 called for: register_phase/append_development_credit require
Operator+; propose_ledger_entry requires Contributor+ and stores a
pending proposal without touching the real Ledger; approve_proposed_entry
(Operator+) appends it under the *reviewer's own* credential/attribution
(not the original proposer's - the reviewer is who's authorizing it into
the real Ledger, while the proposer stays on record in the proposal row
and audit log); reject_proposed_entry (Operator+) discards it. issue_/
revoke_user_credential (Admin+) wrap registry.py's T02 functions with
the same rights check and audit logging. Every action funnels through
record_audit_event, independent of the Trust Service's own signed
records.
tests/test_control_plane.py (12 tests): rights enforcement at each
tier boundary, the full propose -> approve -> appended-under-reviewer
flow, propose -> reject -> nothing appended, double-review rejection,
audit log content/attribution, DB-level UPDATE rejection on both new
tables. Full suite: 84 offline (unchanged), 53 with Docker (up from
41); no stray containers left running.
migrations/0005_licensor_credentials.sql: licensors can now hold
multiple rows per licensor_id (credential_label, rights tier,
issued_by, revoked_at). Real structural finding: licensor_id couldn't
simply become non-unique, since phase_manifests, extensions, and
breach_records all FK to licensors(licensor_id), which only worked
because that column used to be unique. Introduced licensor_identities
(one row per tenant) as the new FK target for all four tables, with an
ensure_licensor_identity trigger auto-creating the identity on first
credential insert - so existing code (including every earlier test
fixture) needed no changes.
registry.py: Licensor gains credential_label/rights; RIGHTS_TIERS +
has_right() ordinal helper (enforcement is Control Plane's job, T03/
T04, not this task's); issue_sub_credential/revoke_sub_credential
(revocation via a SECURITY DEFINER function, matching
set_extension_status's existing pattern - trf_app has no UPDATE grant
on licensors); authenticate() rejects revoked credentials identically
to unrecognized ones.
Attribution scoped honestly: ledger_entry.schema.json stays unmodified
(frozen Stage 0 surface, additionalProperties:false) - per-entry human
attribution is a hosting-layer-only column
(ledger_entries.submitted_by_token, ledger.get_ledger_attribution()),
recorded alongside but never inside the signed entry payload. Narrower
than "the signature names the human," but exactly the "(or an
accompanying attributable field)" alternative this task's own
description anticipated.
All four Docker-gated test files that append Ledger entries needed
migration 0005 added (append_entry's INSERT now references the new
column). New tests/test_licensor_credentials.py (8 tests): multi-
credential resolution, duplicate-label rejection, revocation and its
idempotence, invalid-rights rejection, the has_right helper, per-entry
attribution recorded and not leaking into exported ledger JSON, and
DB-level UPDATE rejection. Full suite: 84 offline, 41 with Docker (up
from 30); no stray containers left running.
Adds since/until date-range scoping to cluster_commit_hours() and
workplan_task_counts() (threaded through calculate_target_basis()),
needed whenever a candidate is one bounded workplan within a repo
whose overall history spans much more (net-kingdom, railiance-apps)
rather than the whole repo being the candidate (vergabe-teilnahme,
info-tech-canon).
Fixes a real bug found along the way: workplan_task_counts() only
scanned the top level of workplans/, missing net-kingdom's
workplans/archived/ convention entirely - silently reported zero
finished workplans for NK-WP-0002, which lives there. Fixed to scan
recursively; added a regression test.
Updates all three draft pilot-candidate manifests with calculator-
derived target_basis/initial_target values, replacing the hand-picked
placeholders:
net-kingdom-local-identity: 200,000 -> 10,000 EUR (floor + sanity warnings)
railiance-vergabe-teilnahme: 3,500,000 -> 648,800 EUR (no warnings)
info-tech-canon-service-surface: 2,500,000 -> 141,800 EUR (sanity warning)
history/260730-EffortCalculator-CandidateApplication.md records full
derivation, warnings, and the judgment calls made explicit rather than
silently picked (date-scoping windows; measuring vergabe-teilnahme's
own repo rather than railiance-apps' deployment-only wiring, with both
figures shown). Still draft/non-binding - WP-0008-T05 unaffected.
5 new tests (20 -> now covering since/until scoping and the
archived-subdirectory fix). Full suite: 84 passing offline.
src/target_revenue/effort_calculator.py implements Candidate A
(labor-cost-anchored, accepted T01): commit-timestamp session-gap
clustering for human interaction time, workplan/task-volume counts via
direct workplans/ directory parsing (no state-hub dependency, works
uniformly on any repo using this repo's own convention), file/line
counts with generated/vendored-path exclusion, and caller-supplied
token-cost pricing. estimate_target_basis() combines these and returns
a derivation dict (every input shown) plus a warnings list - never a
black-box dollar figure.
1-day manual-work floor, as requested: any raw commit-clustered
estimate below 1.0 day is floored and flagged with a warning that this
is very likely a measurement gap (commit-clustering is a floor
estimate by design) that should usually be compensated for by manual
override, not trusted at face value. A second, independent
sanity-check warning fires when finished-workplan/task volume is
substantial but the time estimate is still low, even above the floor -
demonstrated live against target-revenue's own history (7 finished
workplans, 57 tasks correctly flagged a 2.38-day estimate as
under-counted).
scripts/effort_calculator_cli.py: CLI wrapper printing JSON, following
the same offline-first, no-Phase-declaration pattern as
scripts/trf_onboard.py. tests/test_effort_calculator.py (15
deterministic tests, throwaway git repos/tmp_path fixtures) covers
commit clustering, workplan/task parsing, size-metric exclusion,
token-cost pricing, the floor-and-warning behavior, the sanity-check
warning, and an end-to-end smoke test. No new hard dependency.
Maintainer (Bernd) accepted 2026-07-30: four rights tiers
(Viewer/Contributor/Operator/Admin) confirmed as proposed. Selected
option (a) - per-human sub-credentials at the Trust Service layer -
over this concept's own recommended option (b), meaning the Trust
Service's signed ledger records can attest to the specific human who
acted, not merely the binky tenant.
This adds a real, firm prerequisite the workplan didn't have before:
extending WP-0006's already-finished licensors/token auth model.
Restructured T02 (was: backend+audit) into T02 (WP-0006 auth
extension, new) + T03 (Control Plane backend, renumbered) + T04
(interactive UI, renumbered) to keep that scope visible as its own
task rather than folding it silently into backend work.
Maintainer (Bernd) accepted 2026-07-30: estimated_effort_days/daily_rate
driven directly by commit-clustered human interaction time;
approved_direct_costs from real metered AI token cost
(get_token_summary); workplan/task-volume and file/line-size metrics
serve only as a sanity check on the human-time estimate, never their
own dollar figure; Target Multiple remains a human classification.
Candidate B recorded as the considered, not-adopted alternative.
The two deliverables have independent formula/rights decisions and
implementation arcs; keeping them in one workplan blurred that they
can be reviewed and sequenced separately, even though the Control
Plane's Phase-registration flow is expected to consume the
Calculator's output once both exist.
WP-0009 (Target Revenue Control Plane): keeps the original workstream
ID, retitled and re-tasked to 3 focused tasks - rights-model decision
(human gate), backend auth/audit layer, interactive UI flows.
WP-0010 (Development Effort Calculator, new): 3 tasks - formula
decision (human gate), implementation, application to the real
candidate repos already identified in WP-0008. No real Phase
declaration in either workplan's scope.
Updated both concept documents' workplan cross-references and
README.md's summary table accordingly.
specs/TargetRevenueControlPlaneConcept.md: an interactive UI over the
hosted Trust Service for the binky tenant, prioritizing interactive
Development Credit entry creation. Flags the actual new design gap
WP-0006 didn't need to solve: one Licensor token vs. multiple human
users needing individually attributable actions - recommends the
Control Plane hold the Licensor token server-side and layer its own
human-user auth/audit log in front, rather than requiring a WP-0006
auth schema change, while leaving the choice to a human gate (T02).
specs/DevelopmentEffortCalculatorConcept.md: turns four metric
families (human interaction time via commit-clustering, workplan/task
volume, file/line complexity, AI token cost via the state hub's
get_token_summary) into target_basis values feeding the framework's
own existing Initial Target formula - not a new formula. Presents two
combination strategies (labor-cost-anchored vs. composite-index) as
alternatives for a human gate (T01) rather than picking one.
workplans/TREV-WP-0009-control-plane-and-effort-calculator.md: 5 tasks
(two human-gated formula/rights decisions, two implementation tasks,
one task to apply the calculator to the real candidate repos already
identified in WP-0008). Explicitly does not declare any real Phase -
both deliverables feed WP-0008-T05's own gate, they don't bypass it.
Maintainer decision, 2026-07-29/30: adopts TRSL V1C1 as the preliminary
governing LICENSE across every repo in the coulomb Forgejo org,
confirmed explicitly as "every repo, no exceptions" including
target-revenue itself and internal tooling repos. This is a
license-text adoption, not a Phase declaration - no Initial Target,
Trust Service registration, or Development Credit tracking exists for
any repo as a result. WP-0008-T05 (real Phase go-live) remains todo
and unaccepted.
Applies TRSL to this repo's own LICENSE (self-referential wording,
since target-revenue is the canonical source) and updates
pyproject.toml's license field from MIT-0 to TRSL-0.1.
history/260730-TRSL-OrgWideLicenseRollout.md is the full execution
record: ~90 repos adopted successfully, 2 committed locally only (no
git remote configured: executor-sandbox, executor-worker), and one
explicitly flagged exception (the-custodian - carried a pre-existing
proprietary/confidential license, deliberately not touched pending
separate confirmation, not silently folded into the blanket
instruction).
scripts/rollout/LICENSE.trsl-v1c1 is the deployed template used across
all repos (operative legal text only, points back to this repo's
specs/TargetRevenueSourceLicense-V1C1.md for the full candidate-status
banner and Appendix A rather than duplicating it ~90 times).
Maintainer chose info-tech-canon (outside the original four product
lines) as the actual first repo to build up the practical
Phase-declaration routine on, explicitly confirmed as a dry run, not a
T05 go-live decision.
Adds a third draft, non-binding manifest
(examples/pilot-candidates/info-tech-canon-service-surface/): the
cumulative service surface across ITC-WP-0001-0012 (all finished),
Product-defining (100x). Flags a notable complication rather than
smoothing it over: this repo's current LICENSE is already MIT-0, so a
real Phase here would mean replacing an already-open license with
restricted pre-conversion TRSL terms - a materially different step
than the other two candidates.
Exercised the full onboarding routine end-to-end against a real,
ephemeral local instance of the hosted Trust Service (Docker Postgres,
migrations applied, binky Licensor token seeded, uvicorn running the
actual service/app.py): register-phase -> append-entry -> status all
worked via scripts/trf_onboard.py exactly as
specs/TrustServiceOnboarding.md describes, no code changes needed.
Dry-run infrastructure torn down afterward; only the draft manifest
files persist.
T01: specs/TRSL-Governance.md. Resolves the Licensor-identity question
(maintainer decision, 2026-07-29): a single shared Licensor, Binky
Hedgehog GmbH, operating as the binky tenant, across all four product
lines - not per-product-line. Unblocks (does not itself resolve) the
License/CUA arbitral-institution selection now that the Licensor's own
jurisdiction is known. Tables versioning/extension-governance/operator-
governance status per concept §20, naming open items (compatibility
rules, deprecation criteria, conflict-of-interest rule, key-rotation
history) rather than silently assuming them solved.
T02: specs/PilotPhaseCandidateSurvey.md. Direct repo inspection (hub
had no goal data for three of four product lines) plus an Explore-agent
survey of all ten railiance-* repos. Two defensible candidates found:
NK-WP-0002 Local Identity (net-kingdom, Incremental 10x) and
vergabe-teilnahme (railiance-apps, Product-defining 100x, the only
genuinely product-shaped deliverable across ten railiance-* repos).
coulomb-loop and helix-forge have no candidate, for stated principled
reasons (internal tooling; pre-implementation-stage, respectively).
T03: examples/pilot-candidates/ - draft, non-binding Phase Manifests
for both real candidates, trsl:phase:draft-* ids, empty ledgers,
schema-validated, explicit README stating nothing here is authorized
to go live.
T04: specs/TRSL-ContributorLicenseAgreement-Draft.md, implementing the
CLA-not-assignment recommendation from
history/260729-TRSL-ContributorRights-Research.md - narrowly scoped to
the current Phase's TRSL terms plus its already-declared Future
License at Conversion, same preliminary-candidate treatment as the
License/CUA V1C1 documents. CONTRIBUTING.md updated to point at it
while keeping the external-contribution block in effect until accepted.
T05's precondition list updated to reflect what's now resolved, still
left todo by design pending the maintainer's own go-live decision.
Maintainer (Bernd) accepted 2026-07-29: trsl:policy:linear-longstop-v0
is confirmed as the degeneration formula for the first pilot cohort,
per T01's recommendation - already implemented/tested, pilot-ready
today. progress-paused-longstop-v1 remains the named next iteration,
not required before WP-0008's pilot Phases proceed. Updates
OpenQuestions-WorkingDefaults.md Q7 from "working default" to
"Adopted 2026-07-29." All 4 WP-0007 tasks now done; workplan finished.
T01: specs/TargetDegenerationPolicyResearch.md. Survey finds no
precedent (BSL/FSL/Elastic) implements progress-sensitive degeneration
- TRSL's model is original design. Proposes a candidate v1 formula
(90-day rolling "quiet period" pause on Remission Credit accrual
during active Development Credit periods), resolves the
contributor-diversity input as explicitly not-adopted (no
gaming-resistant signal exists yet), and resolves the
longstop/progress-sensitivity relationship as a hard, unconditional
backstop. Does not recommend v0 vs v1 for T02 - that's the human gate.
T02: recommendation added (confirm v0 for the first pilot cohort, name
v1 as the next iteration) - left todo per the human-accept policy.
T03: specs/CanonicalMonetizationProfiles.md with worked narratives for
all six catalog profiles, plus two new fixtures (product-ideation,
general-consulting), both schema-validated and added to the
parametrized conformance test.
T04: specs/CanonicalizationReviewChecklist.md, an 8-item checklist
layered on the already-implemented promote_extension_canonical()
mechanism (WP-0006-T03) - defines what a reviewer must verify, not a
new promotion mechanism.
migrations/0004_breach_records.sql models a case's lifecycle as
append-only events (alleged/cured/determined/terminated) grouped by
case_id rather than one mutable row - resolution is always a new,
later event, never an edit. A CHECK constraint makes the
anonymized-default rule (License V1C1 §7.4) a database fact:
named_entitlement_holder can be set if and only if anonymized = false.
src/target_revenue/breach_record.py's publish_breach_event() enforces
per-Licensor phase ownership and rejects named-disclosure requests
that don't also set named_disclosure_authorized_under_cua: true - the
Trust Service records the Licensor's assertion that the CUA's naming
clause authorizes it, it never verifies the underlying CUA text
itself. Signs every event with the same instance Ed25519 key already
used for Ledger entries and Attestations.
Adds POST/GET /phases/{id}/breach-records. Guarded the .registry
import behind a lazy in-function import (matching attestation.py's
TYPE_CHECKING pattern) so tests/test_breach_record.py (7 tests) runs
under plain system Python with no psycopg dependency. 5 new
Docker-gated tests cover the default-anonymized lifecycle, the
named-disclosure authorization gate, cross-Licensor rejection,
signature verification, and DB-level UPDATE/DELETE rejection.
This closes WP-0006 again - all 9 tasks done.
Reopens WP-0006 (status: active) to track the gap T01's Trust Service
PRD flagged: the Breach/Compliance Record component (TSD §4.1, added
alongside License V1C1 §7.4) postdates WP-0002 and was never assigned
to T03-T08. Scopes it: publish alleged/determined breach status
without adjudicating, default anonymized with CUA-§9-gated named
disclosure, append-only per the existing pattern, reusing the
per-Licensor token model for writes.
tests/test_hosted_conformance.py (6 Docker-gated tests) addresses all
three requirements from the task description: the golden Phase example
(manifest + full ledger + all 4 extensions) replayed through the
hosted API reproduces exactly the offline-established outcome
(Development Credit 67000, Remission Credit 33000, Outstanding Target
0, MIT) including the hosted Attestation; two Phases under different
Licensors operate with interleaved appends and are proven isolated
both positively and negatively (cross-Licensor writes rejected); a
parametrized regression test across four ledger shapes (credits-only,
remission, reversal, admin corrections) confirms hosted-append-then-
offline-fold always matches expected totals.
WP-0006 is now finished - all 8 tasks (PRD, ADR-0002, registries,
ledger API, metrics, attestation, onboarding, conformance) done. T01's
flagged gap (no task owns hosting the Breach/Compliance Record
component from License V1C1 §7.4) remains open and unassigned.
specs/TrustServiceOnboarding.md defines the mechanism: a Phase Manifest
file is committed to the declaring repo (durable, independently
foldable forever) and separately registered with the hosted service;
once registered, the Ledger's live authoritative copy is the hosted
service only, not a second competing file. Licensor token bootstrapping
is explicitly out of scope here (a WP-0008-T01 governance action).
scripts/trf_onboard.py: a dependency-light CLI (stdlib urllib +
target_revenue.validation only, no FastAPI/psycopg needed to onboard a
Phase) with validate/register-phase/append-entry/status subcommands.
The Licensor token is read only from a named environment variable,
never accepted as a literal argument.
tests/test_trf_onboard.py (4 tests, no network/Docker) proves
invalid-manifest and missing-token-env cases fail before any HTTP
attempt, by monkeypatching the request function to raise if called.
tests/test_onboarding_hosted.py (1 Docker-gated test) runs an actual
uvicorn server on a real socket and drives the full
register -> append -> status round trip through the CLI as an external
repo would invoke it.
migrations/0003_attestations.sql: one row per Phase, no UPDATE/DELETE
grant for trf_app (a published attestation is permanent).
src/target_revenue/attestation.py: publish_attestation() is idempotent
(existing row returned unchanged, never regenerated) and derives
conversion_timestamp from the ledger itself via _find_conversion_prefix(),
which finds the earliest prefix where the fold reaches Outstanding
Target = 0 rather than trusting entries[-1] or wall-clock publish time -
so a later unrelated entry can never change an already-converged Phase's
recorded conversion moment. Raises NotConvertedError rather than
fabricating a conversion. Reuses conversion.generate_attestation()
unchanged. Guarded the psycopg import behind TYPE_CHECKING so the pure
helper stays testable under plain system Python.
service/app.py adds GET /phases/{id}/attestation (unauthenticated,
publish-on-first-observation).
tests/test_attestation.py (3 tests, no Docker/Postgres) proves the
earliest-crossing behavior. 6 new Docker-gated tests in
test_ledger_hosting.py cover pre-conversion 404, the core
legal-technical property that /metrics facts/calculations/forecasts
are identical whether or not /attestation was ever called, one-time
publication, signature verification, and DB-level UPDATE/DELETE
rejection.
src/target_revenue/metrics.py: compute_metrics(manifest, entries, as_of)
is pure/deterministic like fold.py, reusing fold.py/conversion.py
unchanged. Returns facts/calculations/forecasts as three explicitly
separated blocks (TrustServicePRD TS-FR-5), covering the mandatory Q9
set plus the recommended velocity/forecast tier - forecasts are always
null rather than populated once a Phase has converted or velocity is
non-positive, so nothing disguises a projection as a fact.
Adds GET /phases/{id}/metrics (unauthenticated per FR-9/FR-10).
tests/test_metrics.py (6 tests) needs no Docker/Postgres and runs
under plain system Python. One new Docker-gated test in
test_ledger_hosting.py proves the hosted /metrics response exactly
matches compute_metrics() run offline against the same export.
migrations/0002_ledger.sql adds ledger_entries with an identity-column
sequence for exact append order and no UPDATE/DELETE grant for trf_app.
src/target_revenue/ledger.py: append_entry() rejects caller-supplied
previous_entry_hash/signature, enforces per-Licensor phase ownership,
serializes concurrent appends via pg_advisory_xact_lock, computes the
chain tip and signs with the Trust Service instance's own Ed25519 key
(service/keys.py), reusing validation.py's checks unchanged. Adds
POST/GET /phases/{id}/ledger and an unauthenticated GET /public-key.
Also fixes a route-ordering bug found while wiring this in: phase IDs
never needed the {phase_id:path} converter (they contain colons, not
slashes), and its greedy matching was swallowing /ledger-suffixed
paths into the plain GET /phases/{id} route.
tests/test_ledger_hosting.py (8 Docker-gated tests) exercises hash-chain
linkage, forged-field rejection, cross-Licensor isolation, currency and
duplicate-id rejection, DB-privilege enforcement, signature
verification via the public-key endpoint, and the task's own
highest-priority property: append -> export -> offline fold reproduces
the exact expected Development/Remission Credit and Outstanding Target.
Adds migrations/0001_registries.sql (licensors, phase_manifests,
extensions tables; trf_app role with no UPDATE/DELETE grant on either
table, canonicalization only via a SECURITY DEFINER function), and
src/target_revenue/registry.py + service/app.py: a thin FastAPI layer
wrapping the existing validation.py checks with persistence and
per-Licensor token auth, adding no new validation logic per ADR-0002.
New optional service/service-dev dependency groups keep the core
offline library dependency-free. tests/test_registry_hosting.py (7
tests, Docker-gated, auto-skip otherwise) spins an ephemeral disposable
Postgres container and verifies registration, rejection, duplicate/
unknown-token handling, extension canonicalization, and two explicit
database-privilege checks that the app role cannot bypass the
append-only/governance-gated guarantees.
Maintainer (Bernd) accepted 2026-07-29 with no changes requested.
T03-T08 may now build against PostgreSQL + per-Licensor API tokens +
railiance-cluster hosting + Python/src/target_revenue reuse.
Proposes PostgreSQL with database-enforced append-only guarantees,
per-Licensor API tokens decoupled from the existing Ed25519 entry
signatures, and railiance-cluster's existing k3s/GitOps baseline for
hosting rather than new infrastructure, reusing src/target_revenue/
directly behind a thin HTTP layer. Task left todo per the human-accept
gate policy already applied to ADR-0001.
Elaborates framework PRD FR-8/9/10 for a hosted, multi-tenant service:
stakeholders, which Stage 0 guarantees (WP-0002) carry over unchanged
vs. which single-Phase/no-auth/no-tenancy constraints must lift and
onto which task (T03-T08), functional/non-functional requirements, and
an API surface sketch. Flags that no current task owns hosting the
Breach/Compliance Record component added by License V1C1 SS7.4.
Maintainer decision (2026-07-29): full specialist legal review of the
TRSL/CUA is postponed until the framework moves out of beta, given
limited legal/commercial exposure during build/alpha. WP-0004-T10 and
WP-0005-T10 synthesize their jurisdiction research into adopted alpha/beta
working defaults (governing law -> arbitration at a neutral seat,
liability cap, data protection minimal-collection practice, and the
Enforcement Network's fee mechanics) rather than full resolution, and are
accepted on that basis. Propagates the decision to the License/CUA V1C1
Appendix A tables and status banners, SCOPE.md, CONTRIBUTING.md, the
WP-0008-T05 go-live gate, and README.md.
With WP-0001/0002/0003 finished, PRD Phase 4b (hosted Trust Service) is
unblocked per SCOPE.md's own sequencing rule, and the midterm goal shifts
from framework design to practical application: governing and monetizing
repos across the coulomb Forgejo org's product lines (coulomb-loop,
net-kingdom, helix-forge, the railiance-* family).
- TREV-WP-0006: Trust Service reference implementation (PRD Phase 4b).
Eight tasks from PRD to conformance-tested hosted service, explicit that
it builds infrastructure only - no real payments or Phase tracking.
- TREV-WP-0007: Degeneration policy finalization (PRD Phase 5) and the
full canonical monetization profile catalog (remainder of Phase 3) -
pilot Phases can't responsibly launch on the placeholder pilot policy
and one-line profile defaults alone.
- TREV-WP-0008: Governance formalization (PRD Phase 7) and pilot rollout
preparation. Forces a real design decision the framework never had to
answer while single-repo-hypothetical: who is "the Licensor" across four
independent product lines. Produces draft, non-binding Phase Manifests
as worked examples for one repo per product line, and a CLA draft.
All three explicitly preserve SCOPE.md's existing "no production Phases
until legal review" guardrail rather than overriding it under pressure to
monetize real repos: WP-0008-T05 is a dedicated, human-gated go-live
decision, and no other task in any of the three workplans is permitted to
authorize a real Phase, real Commercial Entitlement sale, or real
Development Credit tracking.
Updates SCOPE.md (new Stage 0/Stage 1 maturity table, revised out-of-scope
table distinguishing "infrastructure in scope" from "going live still
gated"), PRD roadmap (Phase 4b/5/7 now active, pointing at the new
workplans), and README's active-work table accordingly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bernd reviewed all four extracts (TargetRevenueFrameworkCore.md,
PhaseManifestSpecification.md, TargetLedgerSpecification.md,
MonetizationExtensionSpecification.md) plus cross-links and open-question
coverage. Six-item checklist complete: one real fix (§1.11's extension-
redefinition list had drifted broader than concept §7.11's closed list),
one polish pass (PRD/CONTRIBUTING cross-link symmetry), four items
confirmed with no changes needed. Marks WP-0003-T06 done and the WP-0003
workplan finished (all 6 tasks complete).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Per reviewer request (polish only, item 5): added the same "ultimate
source / day-to-day reference" dual-citation to the PRD header's
Terminology alignment line, matching README/TSD/CONTRIBUTING. Named all
three other normative extracts (PhaseManifestSpecification.md,
TargetLedgerSpecification.md, MonetizationExtensionSpecification.md) in
CONTRIBUTING.md's Terminology section, which previously named only
TargetRevenueFrameworkCore.md - now symmetric with README's full
four-document table.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Verified the six-field extension contract matches concept §12's YAML
verbatim, the core-term redefinition list matches (consistent with the
item 1 fix), registered/canonical wording matches concept §12.1-§12.2, and
the six canonical candidates match concept §12.2's list in the same order
with product-ideation/general-consulting honestly labeled as not yet
fixture-backed rather than implied complete.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
