Admit reviewed receiver evidence batch 8

This commit is contained in:
codex 2026-10-17 03:43:25 +02:00
parent e55394c968
commit 33e49e7a26
24 changed files with 2343 additions and 0 deletions

View file

@ -0,0 +1,41 @@
{
"schema": "custodian.registrar-receiving-return.v1",
"status": "verified",
"proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1",
"receiver_source_commit": "51bc70d1ff8f25450a8650d8e50caf053093a02e",
"receiver_image_digest": "sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015",
"delivered_module_sha256": "e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2",
"schema_revision": "c4d5e6f7a8b9",
"api_ready": true,
"mcp_ready": true,
"historical_three_parents_fifteen_tasks_preserved": true,
"safe_refusal_probe_rollback_verified": true,
"helm_revision": 76,
"verified_at": "2026-10-17T00:07:47.015454+00:00",
"native_receipts": [
{
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/delivered-runtime.json",
"sha256": "89681066e8fe139456163ebfafa3efe77ffae8534ea167219230b0a74367f129"
},
{
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/native-refusal-probes.json",
"sha256": "673ccef965c820704dc310a1bf7832b583c30c3edfeb814528cf892555199172"
},
{
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/before-full-row-hashes.json",
"sha256": "75cdd87eef79059ff3f484ed24ca69e285899cdf8d851cc4e472653c417eb0ee"
},
{
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/after-full-row-hashes.json",
"sha256": "2156aad18f190384838c27e792706a156a7423391408afbc6107e6c28c5872d8"
},
{
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/helm-return.json",
"sha256": "61727deacf22d37da2d28cbaf04f5a3ddee0f9ff7571c77f1e85dba97963b572"
},
{
"path": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/job-observation.json",
"sha256": "b0db49a54f040142be46f0caa76bfd3f09e4ac060fbc1e88c74c4077eeb0552c"
}
]
}

View file

@ -0,0 +1,15 @@
{
"schema": "custodian.registrar-receiving-return.v1",
"status": "pending-root-native-verification",
"proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1",
"receiver_source_commit": "51bc70d1ff8f25450a8650d8e50caf053093a02e",
"receiver_image_digest": "sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015",
"delivered_module_sha256": "e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2",
"schema_revision": "c4d5e6f7a8b9",
"api_ready": null,
"mcp_ready": null,
"historical_three_parents_fifteen_tasks_preserved": null,
"safe_refusal_probe_rollback_verified": null,
"native_receipts": [],
"authority_note": "evidence binding only; root explicit go remains required"
}

View file

@ -0,0 +1,49 @@
{
"status": "committed-exact-seven-paths",
"head": "70cd754996870638848616e37819790a5c4d52b3",
"parent": "9ebde0a9bd60d5c82910494fbe6bd1b891455cee",
"paths": [
"src/repo_manager/historical_sources.py",
"src/repo_manager/identifiers.py",
"tests/test_cluster_frozen_history.py",
"workplans/RMGR-WP-0019-historical-source-admission.md",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md"
],
"managed_assignments": [
{
"kind": "task",
"record_id": "RMGR-WP-0019-T04",
"uuid": "1ccb06c6-ad30-5847-8704-e5628ba81f35",
"path": "workplans/RMGR-WP-0019-historical-source-admission.md"
},
{
"kind": "task",
"record_id": "RMGR-WP-0019-T05",
"uuid": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"path": "workplans/RMGR-WP-0019-historical-source-admission.md"
},
{
"kind": "task",
"record_id": "RMGR-WP-0019-T06",
"uuid": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"path": "workplans/RMGR-WP-0019-historical-source-admission.md"
}
],
"scanner_sha256_unchanged": "e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400",
"t05": "done",
"t06": "wait",
"commit_output": "[main 70cd754] Admit exact frozen Cluster histories after verified receiving\n 7 files changed, 934 insertions(+), 6 deletions(-)\n create mode 100644 tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md\n create mode 100644 tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md\n create mode 100644 tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md\n create mode 100644 tests/test_cluster_frozen_history.py\n",
"source_files": {
"src/repo_manager/historical_sources.py": "838a0422b81e1215e3ec148c3104dd603d9dfc476610bb5617d98ccf5d3be218",
"src/repo_manager/identifiers.py": "4e35fcd009c20822574fd33171176bd14a1ff2dd5af8b0bb2820954974593a2a",
"tests/test_cluster_frozen_history.py": "0490ef3eb474f653e4a6a52b711999876bef061c07de3e7a6d327a8ba54acaf3",
"workplans/RMGR-WP-0019-historical-source-admission.md": "c09c685313de13ad4a31891fd67b8a92f3d9a085c37cee92257d15b485a32cde",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md": "8d6f8533c119117686bc0d5bb9ed5349726aa6c3189ff98b53409c68ac685ca9",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md": "4dc2f61e15adc3c5c81f9ecf8b933512275b95e8f829fac52ae7cde1385cea4a",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md": "04f787078232395bd2d43861de16c521848559fa286f06e1caa9cb779aa71ac3"
},
"receiving_gate_sha256": "d088c336d62c7bdde0e586b0f1b73c3aa3d4031a4debd9ac90206128728257f4",
"cluster_source_mutation": false
}

View file

@ -0,0 +1,136 @@
{
"status": "verified",
"scope": "RepoManager registrar WP19 and preserved scanner WP21; read-only Git ls-remote and Hub GET snapshots",
"writes_to_source_index_refs_or_Hub": false,
"rows": [
{
"repo": "repo-manager",
"published_commit": "70cd754996870638848616e37819790a5c4d52b3",
"remote": {
"HEAD": "70cd754996870638848616e37819790a5c4d52b3",
"refs/heads/main": "70cd754996870638848616e37819790a5c4d52b3",
"symbolic_HEAD": "refs/heads/main"
},
"workplan": {
"id": "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab",
"slug": "rmgr-wp-0019",
"status": "active"
},
"source_record_id": "RMGR-WP-0019",
"tasks": [
{
"id": "d78a622e-39f9-5923-b4e1-f70fdc17fb42",
"record_id": "RMGR-WP-0019-T01",
"status": "done"
},
{
"id": "95240c81-1805-5365-9b35-d238621a16bf",
"record_id": "RMGR-WP-0019-T02",
"status": "done"
},
{
"id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"record_id": "RMGR-WP-0019-T03",
"status": "done"
},
{
"id": "1ccb06c6-ad30-5847-8704-e5628ba81f35",
"record_id": "RMGR-WP-0019-T04",
"status": "done"
},
{
"id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"record_id": "RMGR-WP-0019-T05",
"status": "done"
},
{
"id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"record_id": "RMGR-WP-0019-T06",
"status": "wait"
}
],
"external_source_declarations_not_projected": [
{
"from_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"target_record_id": "STATE-WP-0095-T03",
"target_uuid": "e8566341-cf6e-5b9c-ad80-8564d14cd52a"
},
{
"from_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"target_record_id": "STATE-WP-0095-T06",
"target_uuid": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4"
}
],
"dependencies": [
{
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"relationship_type": "starts_after"
},
{
"from_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"to_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"relationship_type": "starts_after"
}
],
"source_file_sha256": "c09c685313de13ad4a31891fd67b8a92f3d9a085c37cee92257d15b485a32cde",
"source_file_unchanged": true,
"dependency_scope": "internal edges verified; external source target identities checked without claiming projected external edges",
"index_stat_unchanged": true
},
{
"repo": "repo-manager",
"published_commit": "70cd754996870638848616e37819790a5c4d52b3",
"remote": {
"HEAD": "70cd754996870638848616e37819790a5c4d52b3",
"refs/heads/main": "70cd754996870638848616e37819790a5c4d52b3",
"symbolic_HEAD": "refs/heads/main"
},
"workplan": {
"id": "5aa6f84a-c682-5996-ae26-96daef670833",
"slug": "rmgr-wp-0021",
"status": "active"
},
"source_record_id": "RMGR-WP-0021",
"tasks": [
{
"id": "d3d20c18-5a5f-5f8a-b5c4-a22b4b662ebe",
"record_id": "RMGR-WP-0021-T01",
"status": "done"
},
{
"id": "e27817e6-b298-581f-b99a-05ec459be749",
"record_id": "RMGR-WP-0021-T02",
"status": "done"
},
{
"id": "0ab44bd9-00d8-5470-ad45-7350e7868d0a",
"record_id": "RMGR-WP-0021-T03",
"status": "progress"
},
{
"id": "44272818-db49-58a2-83b1-d2f9e9d5976c",
"record_id": "RMGR-WP-0021-T04",
"status": "todo"
},
{
"id": "25fbe694-41d8-5232-bce0-4ed362387d5a",
"record_id": "RMGR-WP-0021-T05",
"status": "done"
}
],
"external_source_declarations_not_projected": [],
"dependencies": [],
"source_file_sha256": "966d15ccdabc8edf98bc58f9422ea190566d05fe4208f4749f59a9731f4e108d",
"source_file_unchanged": true,
"dependency_scope": "internal edges verified; external source target identities checked without claiming projected external edges",
"index_stat_unchanged": true
}
],
"hub_instance": {
"status": "ok",
"instance_role": "primary",
"instance_label": "railiance01"
},
"verifier_sha256": "a7ea9793e5d31a1deddecf9422e57178cb8734aad9619dc1ec5c4d01cc8b53f7"
}

View file

@ -0,0 +1,58 @@
{
"evidence_type": "normalized actual command output",
"command": [
"/home/worsch/repo-manager/.venv/bin/rmgr",
"sync",
"--path",
"/home/worsch/repo-manager",
"--push"
],
"exit_code": 0,
"ok": true,
"status": "applied",
"repo_slug": "repo-manager",
"commit": "70cd754996870638848616e37819790a5c4d52b3",
"requests": 2,
"elapsed_ms": 22911.0,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"assignments": [],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "70cd754996870638848616e37819790a5c4d52b3",
"derived_commit": "70cd754996870638848616e37819790a5c4d52b3",
"outcome": {
"status": "applied",
"counts": {
"created": 0,
"updated": 25,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 3,
"updated_tasks": 0,
"cancelled_tasks": 0,
"created_edges": 1,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 0
},
"created_tasks": [
"RMGR-WP-0019-T04",
"RMGR-WP-0019-T05",
"RMGR-WP-0019-T06"
],
"refused": [],
"retired": [],
"notes": []
}
}
}

View file

@ -0,0 +1,20 @@
{
"status": "applied-exact-local-registrar-source",
"base": "9ebde0a9bd60d5c82910494fbe6bd1b891455cee",
"frozen_patch_sha256": "232552c3d601d185984be5a8e5bc9937bc9ddda7327923b5f0440f6deb2c87fc",
"receiving_gate_sha256": "d088c336d62c7bdde0e586b0f1b73c3aa3d4031a4debd9ac90206128728257f4",
"files": {
"src/repo_manager/historical_sources.py": "838a0422b81e1215e3ec148c3104dd603d9dfc476610bb5617d98ccf5d3be218",
"src/repo_manager/identifiers.py": "4e35fcd009c20822574fd33171176bd14a1ff2dd5af8b0bb2820954974593a2a",
"tests/test_cluster_frozen_history.py": "0490ef3eb474f653e4a6a52b711999876bef061c07de3e7a6d327a8ba54acaf3",
"workplans/RMGR-WP-0019-historical-source-admission.md": "6378d96b70259ae81435b6ce8f97864698bdc5b6679cabbe9dc61a1fc1d09699",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md": "8d6f8533c119117686bc0d5bb9ed5349726aa6c3189ff98b53409c68ac685ca9",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md": "4dc2f61e15adc3c5c81f9ecf8b933512275b95e8f829fac52ae7cde1385cea4a",
"tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md": "04f787078232395bd2d43861de16c521848559fa286f06e1caa9cb779aa71ac3"
},
"index_unchanged": true,
"allocator_executed": false,
"task_completion_applied": false,
"cluster_source_or_hub_mutation": false,
"commit_or_push_performed": false
}

View file

@ -0,0 +1,55 @@
{
"state": "read-onlypreimagesverified; isolatedcandidatechecks only; notcanonicaladmission",
"owner_head": "9ebde0a9bd60d5c82910494fbe6bd1b891455cee",
"frozen_patch_sha256": "232552c3d601d185984be5a8e5bc9937bc9ddda7327923b5f0440f6deb2c87fc",
"preimages": [
{
"path": "src/repo_manager/historical_sources.py",
"expected": "a465aa595867c5e80918168158f8a27bf429d469b2e5249eca98b4e5ef84ce03",
"actual": "a465aa595867c5e80918168158f8a27bf429d469b2e5249eca98b4e5ef84ce03",
"matched": true
},
{
"path": "src/repo_manager/identifiers.py",
"expected": "68dbbd3f137f326a49d20ba3f5855d6b00b4d62eb01dc904b51a08d77552d2bf",
"actual": "68dbbd3f137f326a49d20ba3f5855d6b00b4d62eb01dc904b51a08d77552d2bf",
"matched": true
},
{
"path": "tests/test_cluster_frozen_history.py",
"expected": null,
"actual": null,
"matched": true
},
{
"path": "workplans/RMGR-WP-0019-historical-source-admission.md",
"expected": "638af4000aa442a57df8eddef2d8b5aa5dffb9dbc9ccf547d9e04cf25012ffe4",
"actual": "638af4000aa442a57df8eddef2d8b5aa5dffb9dbc9ccf547d9e04cf25012ffe4",
"matched": true
},
{
"path": "tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md",
"expected": null,
"actual": null,
"matched": true
},
{
"path": "tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
"expected": null,
"actual": null,
"matched": true
},
{
"path": "tests/fixtures/railiance-cluster/workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md",
"expected": null,
"actual": null,
"matched": true
}
],
"test_exit_code": 0,
"test_result": "............................................... [100%]\n47 passed in 5.34s",
"canonical_registrar_modified": false,
"actual_cluster_allocator_run": false,
"managed_cluster_UUIDs_applied": false,
"scanner_T05_preserved": true
}

View file

@ -0,0 +1,142 @@
#!/usr/bin/env python3
"""Read-only Git+Hub task binding verifier; never syncs or changes source/index."""
import hashlib
import json
import os
from pathlib import Path
import re
import subprocess
import urllib.request
HERE=Path(__file__).resolve().parent
OWNERS=[
{'repo':'repo-manager','commit':'70cd754996870638848616e37819790a5c4d52b3','path':'workplans/RMGR-WP-0019-historical-source-admission.md','id':'RMGR-WP-0019','tasks':6},
{'repo':'repo-manager','commit':'70cd754996870638848616e37819790a5c4d52b3','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5},
]
API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/')
EXTERNAL={'STATE-WP-0095-T03':'e8566341-cf6e-5b9c-ad80-8564d14cd52a','STATE-WP-0095-T06':'6af973b4-1964-5d4d-a2f8-8dbd4c01fda4','NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
class Refused(Exception):pass
def git(root,*args):
result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args],
capture_output=True,timeout=30,check=False)
if result.returncode:raise Refused('read-only-git-failed')
return result.stdout
def field(text,key):
values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M)
if len(values)!=1:raise Refused('source-field-ambiguous')
return values[0].strip('"\'')
def source(text):
header=text.split('---',2)[1]
tasks=[]
for block in re.findall(r'```task\n(.*?)\n```',text,re.S):
deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M)
tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'),
'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []})
return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'),
'slug':field(header,'id').lower(),
'status':field(header,'status'),'tasks':tasks}
def get(path):
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused')
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect)
with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response:
data=response.read(8*1024**2+1)
if len(data)>8*1024**2:raise Refused('hub-read-limit')
return json.loads(data)
def index_stat(root):
raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw)
if not path.is_absolute():path=root/path
try:item=path.lstat()
except FileNotFoundError:return None
return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode]
def remote(root,expected,repo):
if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git':
raise Refused('remote-route-drift')
lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines()
if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}:
raise Refused('remote-head-mismatch')
return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'}
def verify():
result={'status':'unverified','scope':'RepoManager registrar WP19 and preserved scanner WP21; read-only Git ls-remote and Hub GET snapshots',
'writes_to_source_index_refs_or_Hub':False,'rows':[]}
try:
if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}:
raise Refused('unrecognized-hub-endpoint')
health=get('/state/health')
result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')}
if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}:
raise Refused('hub-identity-mismatch')
for owner in OWNERS:
root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root)
if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']:
raise Refused('local-head-drift')
committed=git(root,'show',owner['commit']+':'+owner['path'])
local=(root/owner['path']).read_bytes()
if local!=committed:raise Refused('published-workplan-local-drift')
expected=source(committed.decode())
if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
raise Refused('source-task-denominator-mismatch')
snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot')
plans=[row for row in snapshot['workplans'] if row['id']==expected['id']]
if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')):
raise Refused('workplan-binding-mismatch')
projected=[row for row in snapshot['tasks']
if row.get('workplan_id',row.get('workstream_id'))==expected['id']]
if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch')
byid={row['id']:row for row in projected}
if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid')
observed=[]
for task in expected['tasks']:
row=byid.get(task['id'],{})
if any(row.get(key)!=task[key] for key in ('id','record_id','status')):
raise Refused('task-id-uuid-status-mismatch')
observed.append({key:row[key] for key in ('id','record_id','status')})
identifiers={task['record_id']:task['id'] for task in expected['tasks']}
edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies'] if dep in identifiers}
actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']]
projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual}
if len(actual)!=len(edges) or projected_edges!=edges:
raise Refused('dependency-binding-mismatch')
if any(edge.get('source_commit') not in (None,owner['commit']) for edge in actual):
raise Refused('dependency-source-commit-mismatch')
for task in expected['tasks']:
for dep in task['dependencies']:
if dep in EXTERNAL:
target=get('/tasks/'+EXTERNAL[dep])
if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep:
raise Refused('external-dependency-target-mismatch')
remote_readback=remote(root,owner['commit'],owner['repo'])
if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local:
raise Refused('source-or-index-stat-changed')
result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'],
'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')},
'source_record_id':expected['source_record_id'],
'tasks':observed,'external_source_declarations_not_projected':[{'from_task_id':task['id'],'target_record_id':dep,'target_uuid':EXTERNAL[dep]} for task in expected['tasks'] for dep in task['dependencies'] if dep in EXTERNAL],'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)],
'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True,'dependency_scope':'internal edges verified; external source target identities checked without claiming projected external edges',
'index_stat_unchanged':True})
result['status']='verified'
except Exception as error:
result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable'
result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
(HERE/'registrar-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps({'status':result['status'],'owners':len(result['rows'])}))
return 0 if result['status']=='verified' else 2
if __name__=='__main__':raise SystemExit(verify())

View file

@ -0,0 +1,28 @@
[
{
"id": "5f8d26dc-836c-40a0-92ad-409e0c03c9ba",
"from_workplan_id": "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab",
"from_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"to_workplan_id": null,
"to_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"relationship_type": "starts_after",
"description": "RMGR-WP-0019-T03 depends_on RMGR-WP-0019-T02",
"source_owner": null,
"source_commit": null,
"created_at": "2026-10-06T08:38:27.839836Z",
"updated_at": "2026-10-06T08:38:27.839836Z"
},
{
"id": "6830cfe7-d935-4682-af36-b1f508cf73d6",
"from_workplan_id": "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab",
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_workplan_id": null,
"to_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"relationship_type": "starts_after",
"description": "RMGR-WP-0019-T06 depends_on RMGR-WP-0019-T05",
"source_owner": "forge:repo-manager",
"source_commit": "70cd754996870638848616e37819790a5c4d52b3",
"created_at": "2026-10-17T00:11:55.880322Z",
"updated_at": "2026-10-17T00:11:55.880322Z"
}
]

View file

@ -0,0 +1,297 @@
---
id: RMGR-WP-0019
type: workplan
title: "Admit exact historical source views after receiving preservation support"
domain: infotech
repo: repo-manager
status: active
owner: codex
created: "2026-10-04"
updated: "2026-10-17"
flavor: implementation
depends_on: []
state_hub_workstream_id: "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab"
---
## Goal
Unblock normal authoritative registration of the exact closed Activity legacy
source views and Custodian retired ADHOC source after receiving preserves their
existing records. Preserve every legacy source byte, label and UUID; do not
expand canonical syntax or the general grandfathering rules. CUST-WP-0077 owns
cross-owner coordination with STATE-WP-0095.
## Review exact historical receiving contract
```task
id: RMGR-WP-0019-T01
status: done
priority: high
state_hub_task_id: "d78a622e-39f9-5923-b4e1-f70fdc17fb42"
```
Seven Activity sources yield four existing parents/64 closed bound tasks;
three split views repeat the archived parent. One Custodian retired source keeps
its existing parent/task IDs. Earlier /tmp/activity-core-bound-history-write.py
is superseded and must not be applied: registrar bypass alone would admit an
unsupported receiving projection. RMGR-WP-0014/0015 are finished and do not own
this new implementation demand; this workplan is not residual.
## Enable exact frozen registrar exceptions after receiving deployment
```task
id: RMGR-WP-0019-T02
status: done
priority: high
depends_on: [STATE-WP-0095-T03]
state_hub_task_id: "95240c81-1805-5365-9b35-d238621a16bf"
```
Prepared code permits only source paths with reviewed full SHA256 digests in
repo_manager/historical_sources.py. Strict conformance scans retain their legacy
findings. Unknown/missing/altered source refuses before allocation. Source UUIDs
are neither changed nor allocated for these histories. Receiving and registrar
manifests must remain identical. Apply helper requires a deployment receipt.
## Run normal owner sync and verify preserved identities
```task
id: RMGR-WP-0019-T03
status: done
priority: high
depends_on: [RMGR-WP-0019-T02]
state_hub_task_id: "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d"
```
Use rmgr sync --path <owning-repo> --push. No deep-check repair or direct hub UUID
patch substitutes for receiving. Historical unrelated stale projections are not
retirement-authorized by this workplan. Feed receipts back to STATE-WP-0095-T04.
## Offline evidence, 2026-10-04
Prepared registrar suite: 38 focused cases passed (identifiers, registrar,
Custodian legacy identity and exact frozen source cases). Read-only execute=False
against both current owning repos accepted exact histories without source writes.
Implementation is staged; deployment gate is unresolved.
## Approved deployment and actual registrar verification, 2026-10-04
STATE-WP-0095-T03 returned verified main-5dd3df9 / Helm revision72.
Global task-holder refusal passed inside the delivered API against the retired
Custodian parent, with transaction rollback and no committed probe. Five
historical parents/65 tasks retained their entire row snapshots. The gated
three-file registrar patch committed as c41d36c2ef8930628221ef36ec81d8b5d2145ed6;
38 actual owning-source cases passed and Repo Manager primary sync applied.
Normal owner sync admitted all exact frozen histories without changing their
source bytes, UUIDs, parent ownership or row content. Custodian receiving
applied. Activity receiving refused only three empty duplicate projections
that would be retired; no retirement acknowledgement was issued. Registrar
allocated four missing IDs in ordinary Activity ad-hoc sources through its
normal path; frozen historical source files stayed unchanged. T03 remains wait
for explicit disposition and bounded receiving support under STATE-WP-0095-T04
(decision91b7c633-a66f-5d43-9f4b-6565aefb9356).
Evidence: docs/evidence/2026-10-04-historical-registrar-verification.json.
## Ungated T03 preparation, 2026-10-06
Re-ran the registrar suite at 8a47a5c (registrar source unchanged since
c41d36c2): 89 focused registrar/identity/historical cases and the full suite
(226) passed. Read-only hub check: the three refused projections are
683724d9 (custodian-wp-0003), 644017c7 (custodian-wp-0003a) and a5806df9
(custodian-wp-0003b), each with zero tasks; every custodian-WP-0003* source
file binds parent b4eb45a9, which holds the tasks and must not be retired.
Added repo_manager.retirement_disposition, a read-only check that an Activity
expected_retirement_uuids set equals exactly those three empty projections and
excludes the preserved parent. It authorizes nothing; retirement stays with
Activity receiving under STATE-WP-0095-T04.
## Activity disposition received, 2026-10-06
activity-core returned the exact expected_retirement_uuids (message 17ba4201,
evidence activity-core 941fac0, ACTIVITY-WP-0045): 683724d9, 644017c7,
a5806df9. repo_manager.retirement_disposition accepted the set: it equals the
three projections the 2026-10-04 run refused, each holds zero tasks, and it
excludes preserved parent b4eb45a9. Nothing was applied. T03 stays wait: its
acceptance needs a successful Activity owner sync with receipts, which can run
only after the founder decides 91b7c633 and STATE-WP-0095-T04 retires exactly
this set in a reviewed live rollout. Then re-run rmgr sync --path
~/activity-core --push and feed the receipt back to STATE-WP-0095-T04.
## Post-retirement owner sync attempt, 2026-10-06
State Hub reported decision 91b7c633 resolved, main-968a811 / Helm rev 74
deployed, and Activity reconcile at 67a92d2 retiring exactly the three empty
projections (3 retired, 0 created, 0 refused; 4 historical parents / 64 tasks
unchanged). Evidence: state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
`rmgr sync --path ~/activity-core --push` stopped before reconciliation with
status pending_commit: uncommitted `state_hub_workstream_id` / `state_hub_task_id`
writeback in activity-core workplans/ACTIVITY-WP-0045-stale-historical-projection-disposition.md
(plus WORK-RECORDS.md). No hub request was made. Repo Manager does not commit in
activity-core; T03 stays wait until Activity Core commits and the sync re-runs.
Re-run 2026-10-06 08:42Z after Activity Core committed the writeback (e809fb2):
status applied, created 0 / updated 45 (ACTIVITY-WP only) / retired 0 / refused 0,
no task changes, notes preserve custodian-WP-0001..0004 UUIDs; hub shows 4 parents,
64 tasks. Not closed: historical parent b4eb45a9 (custodian-WP-0003, source
`status: archived`, evidence snapshot archived) now reads `finished` in the hub,
updated 08:42:03Z during this sync. Needs State Hub review before T03 closes.
Closed 2026-10-06: State Hub traced the b4eb45a9 status change to its own C-04
check, which ran once per file. The custodian-WP-0003a/b/c split views share the
parent UUID, so whichever view ran last set the row. The Forge reconcile did not
cause it. Fixed in state-hub 2b5d8f9 (STATE-WP-ADHOC-2026-10-06-T01); b4eb45a9 is
back to `archived`. Re-check: 4 parents (b4eb45a9 archived; 3a4f47d9, 759b1255,
e22516cc finished) holding 64 tasks (24+12+7+21). Receipt: Activity sync at e809fb2,
primary/railiance01, applied, 0 created / 45 updated (ACTIVITY-WP only) / 0 retired
/ 0 refused, 0 task changes, historical UUIDs preserved. Evidence:
state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
## Cluster exact historical source successor, 2026-10-17
This scoped extension preserves the completed Activity/Custodian work above.
The cluster publisher now refuses three closed RAIL-BS source files containing
15 existing UUID-bound bare task labels. Preserve all three source bytes, IDs,
and UUIDs. No new alias or general syntax exemption is introduced. Evidence and
exact receiver-first proposal: cluster-historical-publication-r1 in the Custodian
NetKingdom change packet. The existing SHR-WP-0001 project driver owns the
Repo Manager / State Hub cross-owner wait; NK-WP-0049-T35 benefits from the
blocked cluster publication. No worker or human gate is woken here.
## Prepare exact cluster registrar successor
```task
id: RMGR-WP-0019-T04
status: done
priority: high
state_hub_task_id: "1ccb06c6-ad30-5847-8704-e5628ba81f35"
```
Prepared full-file SHA256 bindings for three archives and 15 exact task
occurrences; strict scans still return 15 invalid labels and five collisions.
Unknown/live sources, changed/missing/symlinked histories, UUID drift and
qualified/global collisions refuse before allocation. Candidate tests pass 47;
canonical application remains a separate reviewed step. The read-only current
cluster preview proposes seven ordinary UUID bindings in two files and changes
no bytes. One pre-existing ADHOC field is included explicitly: task
RCLUSTER-WP-ADHOC-2026-07-27-T01 in workplans/ADHOC-2026-07-27.md receives
3e3f39d3-5070-5ba3-97db-19f5f361f264 through managed allocation only.
## Admit cluster registrar successor only after receiving verification
```task
id: RMGR-WP-0019-T05
status: done
priority: high
depends_on: [STATE-WP-0095-T06]
state_hub_task_id: "36f47e21-42d0-5aef-b065-4a5dd3af0726"
```
Retain the current guard until exact reviewed receiving source has been delivered
and verified through State Hub's normal owner deployment. Match both manifests,
then integrate reviewed registrar source and verify ordinary allocator preview.
No direct API patch, history rename or bypass substitutes for this gate.
## Run ordinary cluster owner publication and verify preservation
```task
id: RMGR-WP-0019-T06
status: wait
priority: high
depends_on: [RMGR-WP-0019-T05, STATE-WP-0095-T10]
blocking_reason: "Await State Hub T10 founder approval, delivered API guard verification and explicit current-baseline/historical-exception disposition; original parent hashes are not restored."
state_hub_task_id: "4d1675b6-f49f-5b01-8d76-bbf2030d1b34"
```
Only then run normal owner consistency/publication with the reviewed expected
file set: RCLUSTER-WP-0018 and the one-field ADHOC managed backfill, plus ordinary
generated indexes. Preserve all three archived files and all 18 existing
parent/task rows. Return actual receiving/publication receipts to STATE-WP-0095-T07.
Do not infer TLS recovery, credential custody or native acceptance from sync.
Cluster publication returned, preservation acceptance failed, 2026-10-17:
normal owner publication at c562d7134c38679952a8ffd17a8a893a900aef0d
is applied on primary/railiance01 with expected and derived commits equal.
Read-only source/remote/Hub verification confirms WP0018's five task bindings
and three internal dependency edges. These publication results do not close T06.
The full-row guard after the required legacy deep consistency pass failed:
all three historical parent full-row hashes changed; all 15 historical task
full-row hashes remain equal. The entire pipeline therefore has no successful
18-row preservation acceptance.
Custodian receipts under docs/changes/netkingdom-target-2026-10-17:
railiance-cluster-projection.json and cluster-publication-readback.json retain
the applied publication and bounded readback; receiver-rollout-r4/
pre-publication-full-row-hashes.json retains the passing pre-publication guard;
receiver-rollout-r4/post-publication-full-row-hashes-FAILED.json retains the
failed native comparison. Exact receipt digests are retained in
registrar-t06-preservation-failure-r1/manifest.json. Coordinator and recovery
source review identified the unguarded PUT /workplans/index/bindings path
writing backing_synced_at and ORM updated_at, outside the native forge
projection's preservation guard. Full baseline rows were not retained, only
full-row hashes; no guessed database restoration is authorized or claimed.
The original rollout's pre-Cluster preservation/refusal verification remains
valid for that earlier stage, and T05 remains done. T06 stays wait pending
the reviewed exact-frozen binding guard, regression coverage and a verified
recovery/preservation disposition. No source or native gate is promoted by the
successful publication alone; no TLS or credential-custody acceptance follows.
Verified installed-client successor, 2026-10-17: after verifying the installed
R6 checker module rather than assuming canonical source was loaded, the full
normal Cluster maintenance pipeline preserved all 18 CURRENT historical row
hashes. It synced 20/20 ordinary bindings while omitting the three exact frozen
histories. Cluster HEAD remained 6ae3f847c83da3402883453ee7110457bfb2d0d6;
the owner's original staged brief and dirty WORK-RECORDS content were preserved.
Passing CURRENT before/after snapshots are retained under the Custodian packet
receiver-rollout-r4/before-verified-client.json and after-verified-client.json;
verified-loaded-client.json, verified-client-cluster-consistency.json and
verified-client-cluster-projection.json retain the actual client/pipeline proof.
This new baseline pass does not restore or replace the earlier failed three
parent comparisons; those failures and unavailable original preimages remain.
The new API guard artifact c103cbf3c8bed5dba87a03e320595ddded9301a3 at
image digest sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1
has image-only server dry-run proof, not delivered-runtime acceptance. T06
therefore also depends on STATE-WP-0095-T10. Founder decision
df703266-6719-4c04-ae1b-ba9afd3bca1c remains pending for exact proposal
STATE-WP-0095-T10-frozen-bindings-guard-r1 revision 1, metadata SHA256
81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932, in
Custodian docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r1/.
That decision includes the proposed CURRENT-baseline acceptance with the
earlier mismatch retained as an exception; no baseline disposition is inferred
here. Await its approved scope and verified owner return before T06 closes.
T05 stays done; no runtime activation, guessed database restoration, worker
wakeup, TLS recovery or native private-admission acceptance follows.
## Receiver-first registrar source follow-through, 2026-10-17
The exact receiving return is retained in Custodian
`docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json`,
bound to the actual native rollout/preservation/refusal receipts. It verifies the
reviewed receiver source/image/module, API/MCP readiness, expected additive schema,
three existing historical parents/15 tasks and rolled-back safe refusal probes.
Only after that return was the exact registrar patch
`232552c3d601d185984be5a8e5bc9937bc9ddda7327923b5f0440f6deb2c87fc`
admitted in the Repo Manager owner source. T04 retains its source-preparation
outcome; T05 records this receiving-gated registrar admission, not a substitute
for receiving. Canonical focused registrar/identity checks passed 47 cases in 5.84 seconds.
The actual bounded read-only current Cluster allocator preview agreed with the
reviewed source: seven ordinary missing UUID bindings in exactly the new WP0018 and
one-field existing ADHOC backfill, with 15 invalid labels/five collisions still
reported by the strict conformance scan. The three historical file bytes, IDs,
UUIDs and ownership are unchanged. No broad syntax relaxation or direct Hub UUID
patch is introduced. Exact source application/test/preview receipts travel with
the same packet; source publication/projection is verified separately.
T06 remains wait until actual ordinary Cluster owner publication and receiving
preservation are verified. Registrar source readiness alone does not mark that
publication complete. Preserve the 18 existing rows and all three archives; the
root coordinator owns the normal seven-field managed allocation and dirty-source
preservation. Own Repo Manager projection must show exactly T01–T05 done, T06
wait and active workplan status, including the managed new T04/T05/T06 UUIDs and
unchanged earlier task UUIDs. The separate scanner RMGR-WP-0021-T05 completion
and unrelated owner work remain untouched. No native TLS recovery, custody,
current registration/private admission or NetKingdom target acceptance follows.

View file

@ -0,0 +1,269 @@
---
id: RMGR-WP-0019
type: workplan
title: "Admit exact historical source views after receiving preservation support"
domain: infotech
repo: repo-manager
status: active
owner: codex
created: "2026-10-04"
updated: "2026-10-17"
flavor: implementation
depends_on: []
state_hub_workstream_id: "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab"
---
## Goal
Unblock normal authoritative registration of the exact closed Activity legacy
source views and Custodian retired ADHOC source after receiving preserves their
existing records. Preserve every legacy source byte, label and UUID; do not
expand canonical syntax or the general grandfathering rules. CUST-WP-0077 owns
cross-owner coordination with STATE-WP-0095.
## Review exact historical receiving contract
```task
id: RMGR-WP-0019-T01
status: done
priority: high
state_hub_task_id: "d78a622e-39f9-5923-b4e1-f70fdc17fb42"
```
Seven Activity sources yield four existing parents/64 closed bound tasks;
three split views repeat the archived parent. One Custodian retired source keeps
its existing parent/task IDs. Earlier /tmp/activity-core-bound-history-write.py
is superseded and must not be applied: registrar bypass alone would admit an
unsupported receiving projection. RMGR-WP-0014/0015 are finished and do not own
this new implementation demand; this workplan is not residual.
## Enable exact frozen registrar exceptions after receiving deployment
```task
id: RMGR-WP-0019-T02
status: done
priority: high
depends_on: [STATE-WP-0095-T03]
state_hub_task_id: "95240c81-1805-5365-9b35-d238621a16bf"
```
Prepared code permits only source paths with reviewed full SHA256 digests in
repo_manager/historical_sources.py. Strict conformance scans retain their legacy
findings. Unknown/missing/altered source refuses before allocation. Source UUIDs
are neither changed nor allocated for these histories. Receiving and registrar
manifests must remain identical. Apply helper requires a deployment receipt.
## Run normal owner sync and verify preserved identities
```task
id: RMGR-WP-0019-T03
status: done
priority: high
depends_on: [RMGR-WP-0019-T02]
state_hub_task_id: "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d"
```
Use rmgr sync --path <owning-repo> --push. No deep-check repair or direct hub UUID
patch substitutes for receiving. Historical unrelated stale projections are not
retirement-authorized by this workplan. Feed receipts back to STATE-WP-0095-T04.
## Offline evidence, 2026-10-04
Prepared registrar suite: 38 focused cases passed (identifiers, registrar,
Custodian legacy identity and exact frozen source cases). Read-only execute=False
against both current owning repos accepted exact histories without source writes.
Implementation is staged; deployment gate is unresolved.
## Approved deployment and actual registrar verification, 2026-10-04
STATE-WP-0095-T03 returned verified main-5dd3df9 / Helm revision72.
Global task-holder refusal passed inside the delivered API against the retired
Custodian parent, with transaction rollback and no committed probe. Five
historical parents/65 tasks retained their entire row snapshots. The gated
three-file registrar patch committed as c41d36c2ef8930628221ef36ec81d8b5d2145ed6;
38 actual owning-source cases passed and Repo Manager primary sync applied.
Normal owner sync admitted all exact frozen histories without changing their
source bytes, UUIDs, parent ownership or row content. Custodian receiving
applied. Activity receiving refused only three empty duplicate projections
that would be retired; no retirement acknowledgement was issued. Registrar
allocated four missing IDs in ordinary Activity ad-hoc sources through its
normal path; frozen historical source files stayed unchanged. T03 remains wait
for explicit disposition and bounded receiving support under STATE-WP-0095-T04
(decision91b7c633-a66f-5d43-9f4b-6565aefb9356).
Evidence: docs/evidence/2026-10-04-historical-registrar-verification.json.
## Ungated T03 preparation, 2026-10-06
Re-ran the registrar suite at 8a47a5c (registrar source unchanged since
c41d36c2): 89 focused registrar/identity/historical cases and the full suite
(226) passed. Read-only hub check: the three refused projections are
683724d9 (custodian-wp-0003), 644017c7 (custodian-wp-0003a) and a5806df9
(custodian-wp-0003b), each with zero tasks; every custodian-WP-0003* source
file binds parent b4eb45a9, which holds the tasks and must not be retired.
Added repo_manager.retirement_disposition, a read-only check that an Activity
expected_retirement_uuids set equals exactly those three empty projections and
excludes the preserved parent. It authorizes nothing; retirement stays with
Activity receiving under STATE-WP-0095-T04.
## Activity disposition received, 2026-10-06
activity-core returned the exact expected_retirement_uuids (message 17ba4201,
evidence activity-core 941fac0, ACTIVITY-WP-0045): 683724d9, 644017c7,
a5806df9. repo_manager.retirement_disposition accepted the set: it equals the
three projections the 2026-10-04 run refused, each holds zero tasks, and it
excludes preserved parent b4eb45a9. Nothing was applied. T03 stays wait: its
acceptance needs a successful Activity owner sync with receipts, which can run
only after the founder decides 91b7c633 and STATE-WP-0095-T04 retires exactly
this set in a reviewed live rollout. Then re-run rmgr sync --path
~/activity-core --push and feed the receipt back to STATE-WP-0095-T04.
## Post-retirement owner sync attempt, 2026-10-06
State Hub reported decision 91b7c633 resolved, main-968a811 / Helm rev 74
deployed, and Activity reconcile at 67a92d2 retiring exactly the three empty
projections (3 retired, 0 created, 0 refused; 4 historical parents / 64 tasks
unchanged). Evidence: state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
`rmgr sync --path ~/activity-core --push` stopped before reconciliation with
status pending_commit: uncommitted `state_hub_workstream_id` / `state_hub_task_id`
writeback in activity-core workplans/ACTIVITY-WP-0045-stale-historical-projection-disposition.md
(plus WORK-RECORDS.md). No hub request was made. Repo Manager does not commit in
activity-core; T03 stays wait until Activity Core commits and the sync re-runs.
Re-run 2026-10-06 08:42Z after Activity Core committed the writeback (e809fb2):
status applied, created 0 / updated 45 (ACTIVITY-WP only) / retired 0 / refused 0,
no task changes, notes preserve custodian-WP-0001..0004 UUIDs; hub shows 4 parents,
64 tasks. Not closed: historical parent b4eb45a9 (custodian-WP-0003, source
`status: archived`, evidence snapshot archived) now reads `finished` in the hub,
updated 08:42:03Z during this sync. Needs State Hub review before T03 closes.
Closed 2026-10-06: State Hub traced the b4eb45a9 status change to its own C-04
check, which ran once per file. The custodian-WP-0003a/b/c split views share the
parent UUID, so whichever view ran last set the row. The Forge reconcile did not
cause it. Fixed in state-hub 2b5d8f9 (STATE-WP-ADHOC-2026-10-06-T01); b4eb45a9 is
back to `archived`. Re-check: 4 parents (b4eb45a9 archived; 3a4f47d9, 759b1255,
e22516cc finished) holding 64 tasks (24+12+7+21). Receipt: Activity sync at e809fb2,
primary/railiance01, applied, 0 created / 45 updated (ACTIVITY-WP only) / 0 retired
/ 0 refused, 0 task changes, historical UUIDs preserved. Evidence:
state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
## Cluster exact historical source successor, 2026-10-17
This scoped extension preserves the completed Activity/Custodian work above.
The cluster publisher now refuses three closed RAIL-BS source files containing
15 existing UUID-bound bare task labels. Preserve all three source bytes, IDs,
and UUIDs. No new alias or general syntax exemption is introduced. Evidence and
exact receiver-first proposal: cluster-historical-publication-r1 in the Custodian
NetKingdom change packet. The existing SHR-WP-0001 project driver owns the
Repo Manager / State Hub cross-owner wait; NK-WP-0049-T35 benefits from the
blocked cluster publication. No worker or human gate is woken here.
## Prepare exact cluster registrar successor
```task
id: RMGR-WP-0019-T04
status: done
priority: high
state_hub_task_id: "1ccb06c6-ad30-5847-8704-e5628ba81f35"
```
Prepared full-file SHA256 bindings for three archives and 15 exact task
occurrences; strict scans still return 15 invalid labels and five collisions.
Unknown/live sources, changed/missing/symlinked histories, UUID drift and
qualified/global collisions refuse before allocation. Candidate tests pass 47;
canonical application remains a separate reviewed step. The read-only current
cluster preview proposes seven ordinary UUID bindings in two files and changes
no bytes. One pre-existing ADHOC field is included explicitly: task
RCLUSTER-WP-ADHOC-2026-07-27-T01 in workplans/ADHOC-2026-07-27.md receives
3e3f39d3-5070-5ba3-97db-19f5f361f264 through managed allocation only.
## Admit cluster registrar successor only after receiving verification
```task
id: RMGR-WP-0019-T05
status: done
priority: high
depends_on: [STATE-WP-0095-T06]
state_hub_task_id: "36f47e21-42d0-5aef-b065-4a5dd3af0726"
```
Retain the current guard until exact reviewed receiving source has been delivered
and verified through State Hub's normal owner deployment. Match both manifests,
then integrate reviewed registrar source and verify ordinary allocator preview.
No direct API patch, history rename or bypass substitutes for this gate.
## Run ordinary cluster owner publication and verify preservation
```task
id: RMGR-WP-0019-T06
status: wait
priority: high
depends_on: [RMGR-WP-0019-T05]
state_hub_task_id: "4d1675b6-f49f-5b01-8d76-bbf2030d1b34"
```
Only then run normal owner consistency/publication with the reviewed expected
file set: RCLUSTER-WP-0018 and the one-field ADHOC managed backfill, plus ordinary
generated indexes. Preserve all three archived files and all 18 existing
parent/task rows. Return actual receiving/publication receipts to STATE-WP-0095-T07.
Do not infer TLS recovery, credential custody or native acceptance from sync.
Cluster publication returned, preservation acceptance failed, 2026-10-17:
normal owner publication at c562d7134c38679952a8ffd17a8a893a900aef0d
is applied on primary/railiance01 with expected and derived commits equal.
Read-only source/remote/Hub verification confirms WP0018's five task bindings
and three internal dependency edges. These publication results do not close T06.
The full-row guard after the required legacy deep consistency pass failed:
all three historical parent full-row hashes changed; all 15 historical task
full-row hashes remain equal. The entire pipeline therefore has no successful
18-row preservation acceptance.
Custodian receipts under docs/changes/netkingdom-target-2026-10-17:
railiance-cluster-projection.json and cluster-publication-readback.json retain
the applied publication and bounded readback; receiver-rollout-r4/
pre-publication-full-row-hashes.json retains the passing pre-publication guard;
receiver-rollout-r4/post-publication-full-row-hashes-FAILED.json retains the
failed native comparison. Exact receipt digests are retained in
registrar-t06-preservation-failure-r1/manifest.json. Coordinator and recovery
source review identified the unguarded PUT /workplans/index/bindings path
writing backing_synced_at and ORM updated_at, outside the native forge
projection's preservation guard. Full baseline rows were not retained, only
full-row hashes; no guessed database restoration is authorized or claimed.
The original rollout's pre-Cluster preservation/refusal verification remains
valid for that earlier stage, and T05 remains done. T06 stays wait pending
the reviewed exact-frozen binding guard, regression coverage and a verified
recovery/preservation disposition. No source or native gate is promoted by the
successful publication alone; no TLS or credential-custody acceptance follows.
## Receiver-first registrar source follow-through, 2026-10-17
The exact receiving return is retained in Custodian
`docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json`,
bound to the actual native rollout/preservation/refusal receipts. It verifies the
reviewed receiver source/image/module, API/MCP readiness, expected additive schema,
three existing historical parents/15 tasks and rolled-back safe refusal probes.
Only after that return was the exact registrar patch
`232552c3d601d185984be5a8e5bc9937bc9ddda7327923b5f0440f6deb2c87fc`
admitted in the Repo Manager owner source. T04 retains its source-preparation
outcome; T05 records this receiving-gated registrar admission, not a substitute
for receiving. Canonical focused registrar/identity checks passed 47 cases in 5.84 seconds.
The actual bounded read-only current Cluster allocator preview agreed with the
reviewed source: seven ordinary missing UUID bindings in exactly the new WP0018 and
one-field existing ADHOC backfill, with 15 invalid labels/five collisions still
reported by the strict conformance scan. The three historical file bytes, IDs,
UUIDs and ownership are unchanged. No broad syntax relaxation or direct Hub UUID
patch is introduced. Exact source application/test/preview receipts travel with
the same packet; source publication/projection is verified separately.
T06 remains wait until actual ordinary Cluster owner publication and receiving
preservation are verified. Registrar source readiness alone does not mark that
publication complete. Preserve the 18 existing rows and all three archives; the
root coordinator owns the normal seven-field managed allocation and dirty-source
preservation. Own Repo Manager projection must show exactly T01–T05 done, T06
wait and active workplan status, including the managed new T04/T05/T06 UUIDs and
unchanged earlier task UUIDs. The separate scanner RMGR-WP-0021-T05 completion
and unrelated owner work remain untouched. No native TLS recovery, custody,
current registration/private admission or NetKingdom target acceptance follows.

View file

@ -0,0 +1,14 @@
{
"status": "committed-exact-one-file",
"head": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"parent": "7c15c0ea48981867fc1683d9b7576f6444c256da",
"path": "workplans/RMGR-WP-0019-historical-source-admission.md",
"source_sha256": "3c28ff7809a56a2096f58986f1b3d7e6f99d365d42d0e8a97ee786ae7d067cc1",
"scanner_sha256_unchanged": "e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400",
"task_statuses_and_UUIDs_unchanged": true,
"added_dependency": "STATE-WP-0095-T10",
"t05": "done",
"t06": "wait",
"commit_output": "[main 1dacdd4] Qualify Cluster preservation wait with verified client and API gate\n 1 file changed, 29 insertions(+), 1 deletion(-)\n",
"cluster_or_database_mutation": false
}

View file

@ -0,0 +1,149 @@
{
"status": "verified",
"scope": "RepoManager registrar WP19 and preserved scanner WP21; read-only Git ls-remote and Hub GET snapshots",
"writes_to_source_index_refs_or_Hub": false,
"rows": [
{
"repo": "repo-manager",
"published_commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"remote": {
"HEAD": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"refs/heads/main": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"symbolic_HEAD": "refs/heads/main"
},
"workplan": {
"id": "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab",
"slug": "rmgr-wp-0019",
"status": "active"
},
"source_record_id": "RMGR-WP-0019",
"tasks": [
{
"id": "d78a622e-39f9-5923-b4e1-f70fdc17fb42",
"record_id": "RMGR-WP-0019-T01",
"status": "done"
},
{
"id": "95240c81-1805-5365-9b35-d238621a16bf",
"record_id": "RMGR-WP-0019-T02",
"status": "done"
},
{
"id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"record_id": "RMGR-WP-0019-T03",
"status": "done"
},
{
"id": "1ccb06c6-ad30-5847-8704-e5628ba81f35",
"record_id": "RMGR-WP-0019-T04",
"status": "done"
},
{
"id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"record_id": "RMGR-WP-0019-T05",
"status": "done"
},
{
"id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"record_id": "RMGR-WP-0019-T06",
"status": "wait"
}
],
"external_source_declarations_not_projected": [
{
"from_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"target_record_id": "STATE-WP-0095-T03",
"target_uuid": "e8566341-cf6e-5b9c-ad80-8564d14cd52a"
},
{
"from_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"target_record_id": "STATE-WP-0095-T06",
"target_uuid": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4"
}
],
"projected_external_dependencies": [
{
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"target_record_id": "STATE-WP-0095-T10",
"target_uuid": "88585c69-d9b9-5e1f-a256-6416ff71e824"
}
],
"dependencies": [
{
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"relationship_type": "starts_after"
},
{
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
"relationship_type": "starts_after"
},
{
"from_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"to_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"relationship_type": "starts_after"
}
],
"source_file_sha256": "3c28ff7809a56a2096f58986f1b3d7e6f99d365d42d0e8a97ee786ae7d067cc1",
"source_file_unchanged": true,
"dependency_scope": "exact internal and active-task external edges verified; closed-task external declarations retained separately",
"index_stat_unchanged": true
},
{
"repo": "repo-manager",
"published_commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"remote": {
"HEAD": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"refs/heads/main": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"symbolic_HEAD": "refs/heads/main"
},
"workplan": {
"id": "5aa6f84a-c682-5996-ae26-96daef670833",
"slug": "rmgr-wp-0021",
"status": "active"
},
"source_record_id": "RMGR-WP-0021",
"tasks": [
{
"id": "d3d20c18-5a5f-5f8a-b5c4-a22b4b662ebe",
"record_id": "RMGR-WP-0021-T01",
"status": "done"
},
{
"id": "e27817e6-b298-581f-b99a-05ec459be749",
"record_id": "RMGR-WP-0021-T02",
"status": "done"
},
{
"id": "0ab44bd9-00d8-5470-ad45-7350e7868d0a",
"record_id": "RMGR-WP-0021-T03",
"status": "progress"
},
{
"id": "44272818-db49-58a2-83b1-d2f9e9d5976c",
"record_id": "RMGR-WP-0021-T04",
"status": "todo"
},
{
"id": "25fbe694-41d8-5232-bce0-4ed362387d5a",
"record_id": "RMGR-WP-0021-T05",
"status": "done"
}
],
"external_source_declarations_not_projected": [],
"projected_external_dependencies": [],
"dependencies": [],
"source_file_sha256": "966d15ccdabc8edf98bc58f9422ea190566d05fe4208f4749f59a9731f4e108d",
"source_file_unchanged": true,
"dependency_scope": "exact internal and active-task external edges verified; closed-task external declarations retained separately",
"index_stat_unchanged": true
}
],
"hub_instance": {
"status": "ok",
"instance_role": "primary",
"instance_label": "railiance01"
},
"verifier_sha256": "c794ce4e1b1672982a606dce9bd364de0754dd905d63fbaf3cf6b1b2c42f4764"
}

View file

@ -0,0 +1,103 @@
{
"ok": true,
"status": "applied",
"repo_slug": "repo-manager",
"commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"requests": 2,
"elapsed_ms": 8706.5,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "repo-manager",
"namespace": "helixforge",
"assignments": [],
"historical_invalid_identifiers": [],
"historical_identity_collisions": [],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"instance_role": "primary",
"instance_label": "railiance01",
"expected_commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"derived_commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"outcome": {
"schema": "state-hub.projection-reset.v1",
"repo_slug": "repo-manager",
"commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"status": "applied",
"counts": {
"created": 0,
"updated": 25,
"retired": 0,
"refused": 0,
"released": 0,
"created_tasks": 0,
"updated_tasks": 1,
"cancelled_tasks": 0,
"created_edges": 1,
"removed_edges": 0,
"unresolved_edges": 0,
"external_edges": 0
},
"created": [],
"updated": [
"RMGR-WP-0001",
"RMGR-WP-0002",
"RMGR-WP-0003",
"RMGR-WP-0004",
"RMGR-WP-0005",
"RMGR-WP-0006",
"RMGR-WP-0007",
"RMGR-WP-0008",
"RMGR-WP-0009",
"RMGR-WP-0010",
"RMGR-WP-0011",
"RMGR-WP-0012",
"RMGR-WP-0013",
"RMGR-WP-0014",
"RMGR-WP-0015",
"RMGR-WP-0016",
"RMGR-WP-0017",
"RMGR-WP-0018",
"RMGR-WP-0019",
"RMGR-WP-0020",
"RMGR-WP-0021",
"RMGR-WP-ADHOC-2026-09-06",
"RMGR-WP-ADHOC-2026-09-09",
"RMGR-WP-ADHOC-2026-09-11",
"RMGR-WP-ADHOC-2026-10-03"
],
"retired": [],
"released": [],
"created_tasks": [],
"updated_tasks": [
"RMGR-WP-0019-T06"
],
"cancelled_tasks": [],
"created_edges": [
{
"workplan": "RMGR-WP-0019",
"from": "RMGR-WP-0019-T06",
"target": "STATE-WP-0095-T10",
"relationship_type": "starts_after",
"from_workplan_id": "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab",
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_workplan_id": null,
"to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824"
}
],
"removed_edges": [],
"unresolved_edges": [],
"external_edges": [],
"refused": [],
"notes": []
}
}
}

View file

@ -0,0 +1,23 @@
{
"status": "prepared-not-applied",
"base": "7c15c0ea48981867fc1683d9b7576f6444c256da",
"path": "workplans/RMGR-WP-0019-historical-source-admission.md",
"preimage_sha256": "4ff763ea24b9948d59b4bdd4f5ef3e95bee72fef3016f0b6404b5db663cb83ff",
"candidate_sha256": "3c28ff7809a56a2096f58986f1b3d7e6f99d365d42d0e8a97ee786ae7d067cc1",
"patch_sha256": "8527c5fa953a86dea8bc3f3bcf783084608c6850dd323f3390cfa27157f9cd2a",
"t05": "done",
"t06": "wait",
"added_dependency": "STATE-WP-0095-T10",
"UUIDs_unchanged": true,
"runtime_activation": false,
"original_rows_restored": false,
"receipts": {
"receiver-rollout-r4/before-verified-client.json": "ee41be2d74085603abf2bfe2c91c1bb430b4ea0539a6cbf988528b18f3f5ef46",
"receiver-rollout-r4/after-verified-client.json": "8cd8921271cd647fe40dde0f00bc55b714313426e14091397d8fd11314c5e610",
"verified-loaded-client.json": "0745b5df92d2533714e2a87a43c73b3b685e7bab7bcf4444f7a5fbd82dd4722f",
"verified-client-cluster-consistency.json": "fd8a7d58d9e08b4866420ad77d01fbc7c28c0c2c9610ffbe95ddc77dddd9b1a6",
"verified-client-cluster-projection.json": "c25b43575273df0e648842d447979aca1b41ade16fcdaf9f5f870024e7ca06e9",
"guard-successor-review-r1/proposal-metadata.json": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932",
"guard-successor-review-r1/pending-decision.json": "b1dbd9b700555c0081231d49ca03522bd0af1a635b6e11ecbd72ff0797b27de5"
}
}

View file

@ -0,0 +1,46 @@
--- a/workplans/RMGR-WP-0019-historical-source-admission.md
+++ b/workplans/RMGR-WP-0019-historical-source-admission.md
@@ -199,7 +199,8 @@
id: RMGR-WP-0019-T06
status: wait
priority: high
-depends_on: [RMGR-WP-0019-T05]
+depends_on: [RMGR-WP-0019-T05, STATE-WP-0095-T10]
+blocking_reason: "Await State Hub T10 founder approval, delivered API guard verification and explicit current-baseline/historical-exception disposition; original parent hashes are not restored."
state_hub_task_id: "4d1675b6-f49f-5b01-8d76-bbf2030d1b34"
```
@@ -236,6 +237,33 @@
the reviewed exact-frozen binding guard, regression coverage and a verified
recovery/preservation disposition. No source or native gate is promoted by the
successful publication alone; no TLS or credential-custody acceptance follows.
+
+Verified installed-client successor, 2026-10-17: after verifying the installed
+R6 checker module rather than assuming canonical source was loaded, the full
+normal Cluster maintenance pipeline preserved all 18 CURRENT historical row
+hashes. It synced 20/20 ordinary bindings while omitting the three exact frozen
+histories. Cluster HEAD remained 6ae3f847c83da3402883453ee7110457bfb2d0d6;
+the owner's original staged brief and dirty WORK-RECORDS content were preserved.
+Passing CURRENT before/after snapshots are retained under the Custodian packet
+receiver-rollout-r4/before-verified-client.json and after-verified-client.json;
+verified-loaded-client.json, verified-client-cluster-consistency.json and
+verified-client-cluster-projection.json retain the actual client/pipeline proof.
+This new baseline pass does not restore or replace the earlier failed three
+parent comparisons; those failures and unavailable original preimages remain.
+
+The new API guard artifact c103cbf3c8bed5dba87a03e320595ddded9301a3 at
+image digest sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1
+has image-only server dry-run proof, not delivered-runtime acceptance. T06
+therefore also depends on STATE-WP-0095-T10. Founder decision
+df703266-6719-4c04-ae1b-ba9afd3bca1c remains pending for exact proposal
+STATE-WP-0095-T10-frozen-bindings-guard-r1 revision 1, metadata SHA256
+81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932, in
+Custodian docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r1/.
+That decision includes the proposed CURRENT-baseline acceptance with the
+earlier mismatch retained as an exception; no baseline disposition is inferred
+here. Await its approved scope and verified owner return before T06 closes.
+T05 stays done; no runtime activation, guessed database restoration, worker
+wakeup, TLS recovery or native private-admission acceptance follows.
## Receiver-first registrar source follow-through, 2026-10-17

View file

@ -0,0 +1,32 @@
{
"status": "published-and-readback-verified",
"commit": "1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd",
"scope": "one owner-record qualifier; no code/Cluster/rollout changes",
"t05": "done",
"t06": "wait",
"task_statuses_and_UUIDs_unchanged": true,
"scanner_unchanged": true,
"repo_worktree_clean": true,
"wp19_six_task_bindings_and_wp21_five_bindings_verified": true,
"new_actual_projected_external_edge": {
"from": "RMGR-WP-0019-T06",
"to": "STATE-WP-0095-T10",
"target_uuid": "88585c69-d9b9-5e1f-a256-6416ff71e824",
"target_identity_GET_verified": true
},
"closed_task_external_declarations_not_claimed_as_projected": true,
"first_verifier_mismatch_retained": "R1 expected only internal edges; actual current wait-task external edge existed, R2 verifies exact three projected edges and target",
"original_parent_hash_failure_retained": true,
"new_runtime_approval_or_execution": false,
"files": {
"manifest.json": "5b5600ccc9611b86ef190895a39dca2bda6032caa37e664cd995a6ae36868c2f",
"owner-amendment.patch": "8527c5fa953a86dea8bc3f3bcf783084608c6850dd323f3390cfa27157f9cd2a",
"publish_amendment.py": "d30ea83e814b32ef603056a8338125e5a5cf49765d698adfda317e8a3f8e3435",
"amendment-commit.json": "c73ee532b9018808de14c03cf42ded7eeddf4589dd5521eeae052703644a2748",
"amendment-sync.json": "43467eb3ada96f3207ed97d3809e6b5230636280b400569660ece5813b1535ab",
"verify_amendment_publication.py": "c794ce4e1b1672982a606dce9bd364de0754dd905d63fbaf3cf6b1b2c42f4764",
"amendment-publication-readback.json": "ef1a342f12b2007480f7c3bf9039f257a238ebce921be076ce277641642e2f96",
"r1-verify_amendment_publication.py": "f1c08cf2912c894de4825291fc9d56c2813dfd21436a7596781967b139cd4ec8",
"r1-amendment-publication-readback.json": "e4478c48af15dac3a67b8514ce68cf50c4a6502c497dcb7d29e8873c97941737"
}
}

View file

@ -0,0 +1,30 @@
#!/usr/bin/env python3
from pathlib import Path
import hashlib,json,subprocess
P=Path(__file__).resolve().parent
R=Path('/home/worsch/repo-manager')
m=json.loads((P/'manifest.json').read_text()); f=R/m['path']
def h(p):return hashlib.sha256(p.read_bytes()).hexdigest()
def git(*args):
r=subprocess.run(['git',*args],cwd=R,text=True,capture_output=True,timeout=180)
if r.returncode: raise RuntimeError(json.dumps({'args':args,'stdout':r.stdout,'stderr':r.stderr,'code':r.returncode}))
return r.stdout
assert git('rev-parse','HEAD').strip()==m['base']
assert h(f)==m['preimage_sha256']
assert h(P/'owner-amendment.patch')==m['patch_sha256']=='8527c5fa953a86dea8bc3f3bcf783084608c6850dd323f3390cfa27157f9cd2a'
assert h(P/'WP19.candidate.md')==m['candidate_sha256']
assert not git('diff','--cached','--name-only')
scanner=R/'src/repo_manager/secret_scan.py'; before=h(scanner)
assert before=='e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400'
git('apply','--check',str(P/'owner-amendment.patch'))
git('apply',str(P/'owner-amendment.patch'))
assert h(f)==m['candidate_sha256']
git('add','--',m['path'])
assert git('diff','--cached','--name-only').splitlines()==[m['path']]
git('diff','--cached','--check')
output=git('commit','-m','Qualify Cluster preservation wait with verified client and API gate')
head=git('rev-parse','HEAD').strip()
assert git('diff-tree','--no-commit-id','--name-only','-r',head).splitlines()==[m['path']]
assert h(scanner)==before
receipt={'status':'committed-exact-one-file','head':head,'parent':m['base'],'path':m['path'],'source_sha256':h(f),'scanner_sha256_unchanged':before,'task_statuses_and_UUIDs_unchanged':True,'added_dependency':'STATE-WP-0095-T10','t05':'done','t06':'wait','commit_output':output,'cluster_or_database_mutation':False}
(P/'amendment-commit.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps(receipt,indent=2))

View file

@ -0,0 +1,13 @@
{
"status": "unverified",
"scope": "RepoManager registrar WP19 and preserved scanner WP21; read-only Git ls-remote and Hub GET snapshots",
"writes_to_source_index_refs_or_Hub": false,
"rows": [],
"hub_instance": {
"status": "ok",
"instance_role": "primary",
"instance_label": "railiance01"
},
"reason": "dependency-binding-mismatch",
"verifier_sha256": "f1c08cf2912c894de4825291fc9d56c2813dfd21436a7596781967b139cd4ec8"
}

View file

@ -0,0 +1,150 @@
#!/usr/bin/env python3
"""Read-only Git+Hub task binding verifier; never syncs or changes source/index."""
import hashlib
import json
import os
from pathlib import Path
import re
import subprocess
import urllib.request
HERE=Path(__file__).resolve().parent
OWNERS=[
{'repo':'repo-manager','commit':'1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd','path':'workplans/RMGR-WP-0019-historical-source-admission.md','id':'RMGR-WP-0019','tasks':6},
{'repo':'repo-manager','commit':'1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5},
]
API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/')
EXTERNAL={'STATE-WP-0095-T10':'88585c69-d9b9-5e1f-a256-6416ff71e824','STATE-WP-0095-T03':'e8566341-cf6e-5b9c-ad80-8564d14cd52a','STATE-WP-0095-T06':'6af973b4-1964-5d4d-a2f8-8dbd4c01fda4','NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
class Refused(Exception):pass
def git(root,*args):
result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args],
capture_output=True,timeout=30,check=False)
if result.returncode:raise Refused('read-only-git-failed')
return result.stdout
def field(text,key):
values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M)
if len(values)!=1:raise Refused('source-field-ambiguous')
return values[0].strip('"\'')
def source(text):
header=text.split('---',2)[1]
tasks=[]
for block in re.findall(r'```task\n(.*?)\n```',text,re.S):
deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M)
tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'),
'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []})
return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'),
'slug':field(header,'id').lower(),
'status':field(header,'status'),'tasks':tasks}
def get(path):
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused')
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect)
with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response:
data=response.read(8*1024**2+1)
if len(data)>8*1024**2:raise Refused('hub-read-limit')
return json.loads(data)
def index_stat(root):
raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw)
if not path.is_absolute():path=root/path
try:item=path.lstat()
except FileNotFoundError:return None
return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode]
def remote(root,expected,repo):
if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git':
raise Refused('remote-route-drift')
lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines()
if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}:
raise Refused('remote-head-mismatch')
return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'}
def verify():
result={'status':'unverified','scope':'RepoManager registrar WP19 and preserved scanner WP21; read-only Git ls-remote and Hub GET snapshots',
'writes_to_source_index_refs_or_Hub':False,'rows':[]}
try:
if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}:
raise Refused('unrecognized-hub-endpoint')
health=get('/state/health')
result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')}
if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}:
raise Refused('hub-identity-mismatch')
for owner in OWNERS:
root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root)
if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']:
raise Refused('local-head-drift')
committed=git(root,'show',owner['commit']+':'+owner['path'])
local=(root/owner['path']).read_bytes()
if local!=committed:raise Refused('published-workplan-local-drift')
expected=source(committed.decode())
if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
raise Refused('source-task-denominator-mismatch')
snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot')
plans=[row for row in snapshot['workplans'] if row['id']==expected['id']]
if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')):
raise Refused('workplan-binding-mismatch')
projected=[row for row in snapshot['tasks']
if row.get('workplan_id',row.get('workstream_id'))==expected['id']]
if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch')
byid={row['id']:row for row in projected}
if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid')
observed=[]
for task in expected['tasks']:
row=byid.get(task['id'],{})
if any(row.get(key)!=task[key] for key in ('id','record_id','status')):
raise Refused('task-id-uuid-status-mismatch')
observed.append({key:row[key] for key in ('id','record_id','status')})
identifiers={task['record_id']:task['id'] for task in expected['tasks']}
edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies'] if dep in identifiers}
actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']]
projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual}
if len(actual)!=len(edges) or projected_edges!=edges:
raise Refused('dependency-binding-mismatch')
# An unchanged edge retains its original forge creation commit on description-only sync.
def valid_edge_commit(edge):
if edge.get('source_commit') in (None,owner['commit']):return True
return (owner['id']=='RMGR-WP-0019' and
edge.get('from_task_id')=='4d1675b6-f49f-5b01-8d76-bbf2030d1b34' and
edge.get('to_task_id')=='36f47e21-42d0-5aef-b065-4a5dd3af0726' and
edge.get('source_owner')=='forge:repo-manager' and
edge.get('source_commit')=='70cd754996870638848616e37819790a5c4d52b3')
if any(not valid_edge_commit(edge) for edge in actual):
raise Refused('dependency-source-commit-mismatch')
for task in expected['tasks']:
for dep in task['dependencies']:
if dep in EXTERNAL:
target=get('/tasks/'+EXTERNAL[dep])
if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep:
raise Refused('external-dependency-target-mismatch')
remote_readback=remote(root,owner['commit'],owner['repo'])
if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local:
raise Refused('source-or-index-stat-changed')
result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'],
'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')},
'source_record_id':expected['source_record_id'],
'tasks':observed,'external_source_declarations_not_projected':[{'from_task_id':task['id'],'target_record_id':dep,'target_uuid':EXTERNAL[dep]} for task in expected['tasks'] for dep in task['dependencies'] if dep in EXTERNAL],'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)],
'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True,'dependency_scope':'internal edges verified; external source target identities checked without claiming projected external edges',
'index_stat_unchanged':True})
result['status']='verified'
except Exception as error:
result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable'
result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
(HERE/'amendment-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps({'status':result['status'],'owners':len(result['rows'])}))
return 0 if result['status']=='verified' else 2
if __name__=='__main__':raise SystemExit(verify())

View file

@ -0,0 +1,150 @@
#!/usr/bin/env python3
"""Read-only Git+Hub task binding verifier; never syncs or changes source/index."""
import hashlib
import json
import os
from pathlib import Path
import re
import subprocess
import urllib.request
HERE=Path(__file__).resolve().parent
OWNERS=[
{'repo':'repo-manager','commit':'1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd','path':'workplans/RMGR-WP-0019-historical-source-admission.md','id':'RMGR-WP-0019','tasks':6},
{'repo':'repo-manager','commit':'1dacdd4a31c8e9b1bb1ddfb0c349dfb87e29e8cd','path':'workplans/RMGR-WP-0021-secret-detection-controls.md','id':'RMGR-WP-0021','tasks':5},
]
API=os.environ.get('API_BASE','http://127.0.0.1:8000').rstrip('/')
EXTERNAL={'STATE-WP-0095-T10':'88585c69-d9b9-5e1f-a256-6416ff71e824','STATE-WP-0095-T03':'e8566341-cf6e-5b9c-ad80-8564d14cd52a','STATE-WP-0095-T06':'6af973b4-1964-5d4d-a2f8-8dbd4c01fda4','NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
class Refused(Exception):pass
def git(root,*args):
result=subprocess.run(['git','--no-optional-locks','-C',str(root),*args],
capture_output=True,timeout=30,check=False)
if result.returncode:raise Refused('read-only-git-failed')
return result.stdout
def field(text,key):
values=re.findall(r'^'+re.escape(key)+r':\s*(.*?)\s*$',text,re.M)
if len(values)!=1:raise Refused('source-field-ambiguous')
return values[0].strip('"\'')
def source(text):
header=text.split('---',2)[1]
tasks=[]
for block in re.findall(r'```task\n(.*?)\n```',text,re.S):
deps=re.findall(r'^depends_on:\s*\[(.*?)\]',block,re.M)
tasks.append({'record_id':field(block,'id'),'id':field(block,'state_hub_task_id'),
'status':field(block,'status'),'dependencies':[x.strip() for x in deps[0].split(',') if x.strip()] if deps else []})
return {'id':field(header,'state_hub_workstream_id'),'source_record_id':field(header,'id'),
'slug':field(header,'id').lower(),
'status':field(header,'status'),'tasks':tasks}
def get(path):
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):raise Refused('hub-redirect-refused')
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect)
with opener.open(urllib.request.Request(API+path,method='GET'),timeout=20) as response:
data=response.read(8*1024**2+1)
if len(data)>8*1024**2:raise Refused('hub-read-limit')
return json.loads(data)
def index_stat(root):
raw=git(root,'rev-parse','--git-path','index').decode().strip();path=Path(raw)
if not path.is_absolute():path=root/path
try:item=path.lstat()
except FileNotFoundError:return None
return [item.st_dev,item.st_ino,item.st_size,item.st_mtime_ns,item.st_mode]
def remote(root,expected,repo):
if git(root,'remote','get-url','origin').decode().strip()!='forgejo-remote:coulomb/'+repo+'.git':
raise Refused('remote-route-drift')
lines=git(root,'ls-remote','--symref','origin','HEAD','refs/heads/main').decode().splitlines()
if set(lines)!={'ref: refs/heads/main\tHEAD',expected+'\tHEAD',expected+'\trefs/heads/main'}:
raise Refused('remote-head-mismatch')
return {'HEAD':expected,'refs/heads/main':expected,'symbolic_HEAD':'refs/heads/main'}
def verify():
result={'status':'unverified','scope':'RepoManager registrar WP19 and preserved scanner WP21; read-only Git ls-remote and Hub GET snapshots',
'writes_to_source_index_refs_or_Hub':False,'rows':[]}
try:
if API not in {'http://127.0.0.1:8000','http://127.0.0.1:18080','http://10.43.68.154:8000'}:
raise Refused('unrecognized-hub-endpoint')
health=get('/state/health')
result['hub_instance']={key:health.get(key) for key in ('status','instance_role','instance_label')}
if result['hub_instance']!={'status':'ok','instance_role':'primary','instance_label':'railiance01'}:
raise Refused('hub-identity-mismatch')
for owner in OWNERS:
root=Path('/home/worsch')/owner['repo'];before_index=index_stat(root)
if git(root,'rev-parse','HEAD').decode().strip()!=owner['commit']:
raise Refused('local-head-drift')
committed=git(root,'show',owner['commit']+':'+owner['path'])
local=(root/owner['path']).read_bytes()
if local!=committed:raise Refused('published-workplan-local-drift')
expected=source(committed.decode())
if expected['source_record_id']!=owner['id'] or len(expected['tasks'])!=owner['tasks']:
raise Refused('source-task-denominator-mismatch')
snapshot=get('/repos/'+owner['repo']+'/work-record-projection/snapshot')
plans=[row for row in snapshot['workplans'] if row['id']==expected['id']]
if len(plans)!=1 or any(plans[0].get(key)!=expected[key] for key in ('id','slug','status')):
raise Refused('workplan-binding-mismatch')
projected=[row for row in snapshot['tasks']
if row.get('workplan_id',row.get('workstream_id'))==expected['id']]
if len(projected)!=len(expected['tasks']):raise Refused('projected-task-denominator-mismatch')
byid={row['id']:row for row in projected}
if len(byid)!=len(projected):raise Refused('duplicate-projected-uuid')
observed=[]
for task in expected['tasks']:
row=byid.get(task['id'],{})
if any(row.get(key)!=task[key] for key in ('id','record_id','status')):
raise Refused('task-id-uuid-status-mismatch')
observed.append({key:row[key] for key in ('id','record_id','status')})
identifiers={task['record_id']:task['id'] for task in expected['tasks']}|EXTERNAL
edges={(task['id'],identifiers[dep],'starts_after') for task in expected['tasks'] for dep in task['dependencies'] if dep in identifiers and (dep not in EXTERNAL or task['status'] not in {'done','cancel'})}
actual=[edge for edge in snapshot['dependencies'] if edge['from_workplan_id']==expected['id']]
projected_edges={(edge.get('from_task_id'),edge.get('to_task_id'),edge['relationship_type']) for edge in actual}
if len(actual)!=len(edges) or projected_edges!=edges:
raise Refused('dependency-binding-mismatch')
# An unchanged edge retains its original forge creation commit on description-only sync.
def valid_edge_commit(edge):
if edge.get('source_commit') in (None,owner['commit']):return True
return (owner['id']=='RMGR-WP-0019' and
edge.get('from_task_id')=='4d1675b6-f49f-5b01-8d76-bbf2030d1b34' and
edge.get('to_task_id')=='36f47e21-42d0-5aef-b065-4a5dd3af0726' and
edge.get('source_owner')=='forge:repo-manager' and
edge.get('source_commit')=='70cd754996870638848616e37819790a5c4d52b3')
if any(not valid_edge_commit(edge) for edge in actual):
raise Refused('dependency-source-commit-mismatch')
for task in expected['tasks']:
for dep in task['dependencies']:
if dep in EXTERNAL:
target=get('/tasks/'+EXTERNAL[dep])
if target.get('id')!=EXTERNAL[dep] or target.get('record_id')!=dep:
raise Refused('external-dependency-target-mismatch')
remote_readback=remote(root,owner['commit'],owner['repo'])
if index_stat(root)!=before_index or (root/owner['path']).read_bytes()!=local:
raise Refused('source-or-index-stat-changed')
result['rows'].append({'repo':owner['repo'],'published_commit':owner['commit'],
'remote':remote_readback,'workplan':{key:plans[0][key] for key in ('id','slug','status')},
'source_record_id':expected['source_record_id'],
'tasks':observed,'external_source_declarations_not_projected':[{'from_task_id':task['id'],'target_record_id':dep,'target_uuid':EXTERNAL[dep]} for task in expected['tasks'] for dep in task['dependencies'] if dep in EXTERNAL and task['status'] in {'done','cancel'}],'projected_external_dependencies':[{'from_task_id':task['id'],'target_record_id':dep,'target_uuid':EXTERNAL[dep]} for task in expected['tasks'] for dep in task['dependencies'] if dep in EXTERNAL and task['status'] not in {'done','cancel'}],'dependencies':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(edges)],
'source_file_sha256':hashlib.sha256(local).hexdigest(),'source_file_unchanged':True,'dependency_scope':'exact internal and active-task external edges verified; closed-task external declarations retained separately',
'index_stat_unchanged':True})
result['status']='verified'
except Exception as error:
result['reason']=error.args[0] if isinstance(error,Refused) else 'readback-unavailable'
result['verifier_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
(HERE/'amendment-publication-readback.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps({'status':result['status'],'owners':len(result['rows'])}))
return 0 if result['status']=='verified' else 2
if __name__=='__main__':raise SystemExit(verify())

View file

@ -0,0 +1,269 @@
---
id: RMGR-WP-0019
type: workplan
title: "Admit exact historical source views after receiving preservation support"
domain: infotech
repo: repo-manager
status: active
owner: codex
created: "2026-10-04"
updated: "2026-10-17"
flavor: implementation
depends_on: []
state_hub_workstream_id: "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab"
---
## Goal
Unblock normal authoritative registration of the exact closed Activity legacy
source views and Custodian retired ADHOC source after receiving preserves their
existing records. Preserve every legacy source byte, label and UUID; do not
expand canonical syntax or the general grandfathering rules. CUST-WP-0077 owns
cross-owner coordination with STATE-WP-0095.
## Review exact historical receiving contract
```task
id: RMGR-WP-0019-T01
status: done
priority: high
state_hub_task_id: "d78a622e-39f9-5923-b4e1-f70fdc17fb42"
```
Seven Activity sources yield four existing parents/64 closed bound tasks;
three split views repeat the archived parent. One Custodian retired source keeps
its existing parent/task IDs. Earlier /tmp/activity-core-bound-history-write.py
is superseded and must not be applied: registrar bypass alone would admit an
unsupported receiving projection. RMGR-WP-0014/0015 are finished and do not own
this new implementation demand; this workplan is not residual.
## Enable exact frozen registrar exceptions after receiving deployment
```task
id: RMGR-WP-0019-T02
status: done
priority: high
depends_on: [STATE-WP-0095-T03]
state_hub_task_id: "95240c81-1805-5365-9b35-d238621a16bf"
```
Prepared code permits only source paths with reviewed full SHA256 digests in
repo_manager/historical_sources.py. Strict conformance scans retain their legacy
findings. Unknown/missing/altered source refuses before allocation. Source UUIDs
are neither changed nor allocated for these histories. Receiving and registrar
manifests must remain identical. Apply helper requires a deployment receipt.
## Run normal owner sync and verify preserved identities
```task
id: RMGR-WP-0019-T03
status: done
priority: high
depends_on: [RMGR-WP-0019-T02]
state_hub_task_id: "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d"
```
Use rmgr sync --path <owning-repo> --push. No deep-check repair or direct hub UUID
patch substitutes for receiving. Historical unrelated stale projections are not
retirement-authorized by this workplan. Feed receipts back to STATE-WP-0095-T04.
## Offline evidence, 2026-10-04
Prepared registrar suite: 38 focused cases passed (identifiers, registrar,
Custodian legacy identity and exact frozen source cases). Read-only execute=False
against both current owning repos accepted exact histories without source writes.
Implementation is staged; deployment gate is unresolved.
## Approved deployment and actual registrar verification, 2026-10-04
STATE-WP-0095-T03 returned verified main-5dd3df9 / Helm revision72.
Global task-holder refusal passed inside the delivered API against the retired
Custodian parent, with transaction rollback and no committed probe. Five
historical parents/65 tasks retained their entire row snapshots. The gated
three-file registrar patch committed as c41d36c2ef8930628221ef36ec81d8b5d2145ed6;
38 actual owning-source cases passed and Repo Manager primary sync applied.
Normal owner sync admitted all exact frozen histories without changing their
source bytes, UUIDs, parent ownership or row content. Custodian receiving
applied. Activity receiving refused only three empty duplicate projections
that would be retired; no retirement acknowledgement was issued. Registrar
allocated four missing IDs in ordinary Activity ad-hoc sources through its
normal path; frozen historical source files stayed unchanged. T03 remains wait
for explicit disposition and bounded receiving support under STATE-WP-0095-T04
(decision91b7c633-a66f-5d43-9f4b-6565aefb9356).
Evidence: docs/evidence/2026-10-04-historical-registrar-verification.json.
## Ungated T03 preparation, 2026-10-06
Re-ran the registrar suite at 8a47a5c (registrar source unchanged since
c41d36c2): 89 focused registrar/identity/historical cases and the full suite
(226) passed. Read-only hub check: the three refused projections are
683724d9 (custodian-wp-0003), 644017c7 (custodian-wp-0003a) and a5806df9
(custodian-wp-0003b), each with zero tasks; every custodian-WP-0003* source
file binds parent b4eb45a9, which holds the tasks and must not be retired.
Added repo_manager.retirement_disposition, a read-only check that an Activity
expected_retirement_uuids set equals exactly those three empty projections and
excludes the preserved parent. It authorizes nothing; retirement stays with
Activity receiving under STATE-WP-0095-T04.
## Activity disposition received, 2026-10-06
activity-core returned the exact expected_retirement_uuids (message 17ba4201,
evidence activity-core 941fac0, ACTIVITY-WP-0045): 683724d9, 644017c7,
a5806df9. repo_manager.retirement_disposition accepted the set: it equals the
three projections the 2026-10-04 run refused, each holds zero tasks, and it
excludes preserved parent b4eb45a9. Nothing was applied. T03 stays wait: its
acceptance needs a successful Activity owner sync with receipts, which can run
only after the founder decides 91b7c633 and STATE-WP-0095-T04 retires exactly
this set in a reviewed live rollout. Then re-run rmgr sync --path
~/activity-core --push and feed the receipt back to STATE-WP-0095-T04.
## Post-retirement owner sync attempt, 2026-10-06
State Hub reported decision 91b7c633 resolved, main-968a811 / Helm rev 74
deployed, and Activity reconcile at 67a92d2 retiring exactly the three empty
projections (3 retired, 0 created, 0 refused; 4 historical parents / 64 tasks
unchanged). Evidence: state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
`rmgr sync --path ~/activity-core --push` stopped before reconciliation with
status pending_commit: uncommitted `state_hub_workstream_id` / `state_hub_task_id`
writeback in activity-core workplans/ACTIVITY-WP-0045-stale-historical-projection-disposition.md
(plus WORK-RECORDS.md). No hub request was made. Repo Manager does not commit in
activity-core; T03 stays wait until Activity Core commits and the sync re-runs.
Re-run 2026-10-06 08:42Z after Activity Core committed the writeback (e809fb2):
status applied, created 0 / updated 45 (ACTIVITY-WP only) / retired 0 / refused 0,
no task changes, notes preserve custodian-WP-0001..0004 UUIDs; hub shows 4 parents,
64 tasks. Not closed: historical parent b4eb45a9 (custodian-WP-0003, source
`status: archived`, evidence snapshot archived) now reads `finished` in the hub,
updated 08:42:03Z during this sync. Needs State Hub review before T03 closes.
Closed 2026-10-06: State Hub traced the b4eb45a9 status change to its own C-04
check, which ran once per file. The custodian-WP-0003a/b/c split views share the
parent UUID, so whichever view ran last set the row. The Forge reconcile did not
cause it. Fixed in state-hub 2b5d8f9 (STATE-WP-ADHOC-2026-10-06-T01); b4eb45a9 is
back to `archived`. Re-check: 4 parents (b4eb45a9 archived; 3a4f47d9, 759b1255,
e22516cc finished) holding 64 tasks (24+12+7+21). Receipt: Activity sync at e809fb2,
primary/railiance01, applied, 0 created / 45 updated (ACTIVITY-WP only) / 0 retired
/ 0 refused, 0 task changes, historical UUIDs preserved. Evidence:
state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
## Cluster exact historical source successor, 2026-10-17
This scoped extension preserves the completed Activity/Custodian work above.
The cluster publisher now refuses three closed RAIL-BS source files containing
15 existing UUID-bound bare task labels. Preserve all three source bytes, IDs,
and UUIDs. No new alias or general syntax exemption is introduced. Evidence and
exact receiver-first proposal: cluster-historical-publication-r1 in the Custodian
NetKingdom change packet. The existing SHR-WP-0001 project driver owns the
Repo Manager / State Hub cross-owner wait; NK-WP-0049-T35 benefits from the
blocked cluster publication. No worker or human gate is woken here.
## Prepare exact cluster registrar successor
```task
id: RMGR-WP-0019-T04
status: done
priority: high
state_hub_task_id: "1ccb06c6-ad30-5847-8704-e5628ba81f35"
```
Prepared full-file SHA256 bindings for three archives and 15 exact task
occurrences; strict scans still return 15 invalid labels and five collisions.
Unknown/live sources, changed/missing/symlinked histories, UUID drift and
qualified/global collisions refuse before allocation. Candidate tests pass 47;
canonical application remains a separate reviewed step. The read-only current
cluster preview proposes seven ordinary UUID bindings in two files and changes
no bytes. One pre-existing ADHOC field is included explicitly: task
RCLUSTER-WP-ADHOC-2026-07-27-T01 in workplans/ADHOC-2026-07-27.md receives
3e3f39d3-5070-5ba3-97db-19f5f361f264 through managed allocation only.
## Admit cluster registrar successor only after receiving verification
```task
id: RMGR-WP-0019-T05
status: done
priority: high
depends_on: [STATE-WP-0095-T06]
state_hub_task_id: "36f47e21-42d0-5aef-b065-4a5dd3af0726"
```
Retain the current guard until exact reviewed receiving source has been delivered
and verified through State Hub's normal owner deployment. Match both manifests,
then integrate reviewed registrar source and verify ordinary allocator preview.
No direct API patch, history rename or bypass substitutes for this gate.
## Run ordinary cluster owner publication and verify preservation
```task
id: RMGR-WP-0019-T06
status: wait
priority: high
depends_on: [RMGR-WP-0019-T05]
state_hub_task_id: "4d1675b6-f49f-5b01-8d76-bbf2030d1b34"
```
Only then run normal owner consistency/publication with the reviewed expected
file set: RCLUSTER-WP-0018 and the one-field ADHOC managed backfill, plus ordinary
generated indexes. Preserve all three archived files and all 18 existing
parent/task rows. Return actual receiving/publication receipts to STATE-WP-0095-T07.
Do not infer TLS recovery, credential custody or native acceptance from sync.
Cluster publication returned, preservation acceptance failed, 2026-10-17:
normal owner publication at c562d7134c38679952a8ffd17a8a893a900aef0d
is applied on primary/railiance01 with expected and derived commits equal.
Read-only source/remote/Hub verification confirms WP0018's five task bindings
and three internal dependency edges. These publication results do not close T06.
The full-row guard after the required legacy deep consistency pass failed:
all three historical parent full-row hashes changed; all 15 historical task
full-row hashes remain equal. The entire pipeline therefore has no successful
18-row preservation acceptance.
Custodian receipts under docs/changes/netkingdom-target-2026-10-17:
railiance-cluster-projection.json and cluster-publication-readback.json retain
the applied publication and bounded readback; receiver-rollout-r4/
pre-publication-full-row-hashes.json retains the passing pre-publication guard;
receiver-rollout-r4/post-publication-full-row-hashes-FAILED.json retains the
failed native comparison. Exact receipt digests are retained in
registrar-t06-preservation-failure-r1/manifest.json. Coordinator and recovery
source review identified the unguarded PUT /workplans/index/bindings path
writing backing_synced_at and ORM updated_at, outside the native forge
projection's preservation guard. Full baseline rows were not retained, only
full-row hashes; no guessed database restoration is authorized or claimed.
The original rollout's pre-Cluster preservation/refusal verification remains
valid for that earlier stage, and T05 remains done. T06 stays wait pending
the reviewed exact-frozen binding guard, regression coverage and a verified
recovery/preservation disposition. No source or native gate is promoted by the
successful publication alone; no TLS or credential-custody acceptance follows.
## Receiver-first registrar source follow-through, 2026-10-17
The exact receiving return is retained in Custodian
`docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json`,
bound to the actual native rollout/preservation/refusal receipts. It verifies the
reviewed receiver source/image/module, API/MCP readiness, expected additive schema,
three existing historical parents/15 tasks and rolled-back safe refusal probes.
Only after that return was the exact registrar patch
`232552c3d601d185984be5a8e5bc9937bc9ddda7327923b5f0440f6deb2c87fc`
admitted in the Repo Manager owner source. T04 retains its source-preparation
outcome; T05 records this receiving-gated registrar admission, not a substitute
for receiving. Canonical focused registrar/identity checks passed 47 cases in 5.84 seconds.
The actual bounded read-only current Cluster allocator preview agreed with the
reviewed source: seven ordinary missing UUID bindings in exactly the new WP0018 and
one-field existing ADHOC backfill, with 15 invalid labels/five collisions still
reported by the strict conformance scan. The three historical file bytes, IDs,
UUIDs and ownership are unchanged. No broad syntax relaxation or direct Hub UUID
patch is introduced. Exact source application/test/preview receipts travel with
the same packet; source publication/projection is verified separately.
T06 remains wait until actual ordinary Cluster owner publication and receiving
preservation are verified. Registrar source readiness alone does not mark that
publication complete. Preserve the 18 existing rows and all three archives; the
root coordinator owns the normal seven-field managed allocation and dirty-source
preservation. Own Repo Manager projection must show exactly T01–T05 done, T06
wait and active workplan status, including the managed new T04/T05/T06 UUIDs and
unchanged earlier task UUIDs. The separate scanner RMGR-WP-0021-T05 completion
and unrelated owner work remain untouched. No native TLS recovery, custody,
current registration/private admission or NetKingdom target acceptance follows.

View file

@ -0,0 +1,241 @@
---
id: RMGR-WP-0019
type: workplan
title: "Admit exact historical source views after receiving preservation support"
domain: infotech
repo: repo-manager
status: active
owner: codex
created: "2026-10-04"
updated: "2026-10-17"
flavor: implementation
depends_on: []
state_hub_workstream_id: "efe0ecb2-2f3f-5f49-baee-b90ad1d353ab"
---
## Goal
Unblock normal authoritative registration of the exact closed Activity legacy
source views and Custodian retired ADHOC source after receiving preserves their
existing records. Preserve every legacy source byte, label and UUID; do not
expand canonical syntax or the general grandfathering rules. CUST-WP-0077 owns
cross-owner coordination with STATE-WP-0095.
## Review exact historical receiving contract
```task
id: RMGR-WP-0019-T01
status: done
priority: high
state_hub_task_id: "d78a622e-39f9-5923-b4e1-f70fdc17fb42"
```
Seven Activity sources yield four existing parents/64 closed bound tasks;
three split views repeat the archived parent. One Custodian retired source keeps
its existing parent/task IDs. Earlier /tmp/activity-core-bound-history-write.py
is superseded and must not be applied: registrar bypass alone would admit an
unsupported receiving projection. RMGR-WP-0014/0015 are finished and do not own
this new implementation demand; this workplan is not residual.
## Enable exact frozen registrar exceptions after receiving deployment
```task
id: RMGR-WP-0019-T02
status: done
priority: high
depends_on: [STATE-WP-0095-T03]
state_hub_task_id: "95240c81-1805-5365-9b35-d238621a16bf"
```
Prepared code permits only source paths with reviewed full SHA256 digests in
repo_manager/historical_sources.py. Strict conformance scans retain their legacy
findings. Unknown/missing/altered source refuses before allocation. Source UUIDs
are neither changed nor allocated for these histories. Receiving and registrar
manifests must remain identical. Apply helper requires a deployment receipt.
## Run normal owner sync and verify preserved identities
```task
id: RMGR-WP-0019-T03
status: done
priority: high
depends_on: [RMGR-WP-0019-T02]
state_hub_task_id: "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d"
```
Use rmgr sync --path <owning-repo> --push. No deep-check repair or direct hub UUID
patch substitutes for receiving. Historical unrelated stale projections are not
retirement-authorized by this workplan. Feed receipts back to STATE-WP-0095-T04.
## Offline evidence, 2026-10-04
Prepared registrar suite: 38 focused cases passed (identifiers, registrar,
Custodian legacy identity and exact frozen source cases). Read-only execute=False
against both current owning repos accepted exact histories without source writes.
Implementation is staged; deployment gate is unresolved.
## Approved deployment and actual registrar verification, 2026-10-04
STATE-WP-0095-T03 returned verified main-5dd3df9 / Helm revision72.
Global task-holder refusal passed inside the delivered API against the retired
Custodian parent, with transaction rollback and no committed probe. Five
historical parents/65 tasks retained their entire row snapshots. The gated
three-file registrar patch committed as c41d36c2ef8930628221ef36ec81d8b5d2145ed6;
38 actual owning-source cases passed and Repo Manager primary sync applied.
Normal owner sync admitted all exact frozen histories without changing their
source bytes, UUIDs, parent ownership or row content. Custodian receiving
applied. Activity receiving refused only three empty duplicate projections
that would be retired; no retirement acknowledgement was issued. Registrar
allocated four missing IDs in ordinary Activity ad-hoc sources through its
normal path; frozen historical source files stayed unchanged. T03 remains wait
for explicit disposition and bounded receiving support under STATE-WP-0095-T04
(decision91b7c633-a66f-5d43-9f4b-6565aefb9356).
Evidence: docs/evidence/2026-10-04-historical-registrar-verification.json.
## Ungated T03 preparation, 2026-10-06
Re-ran the registrar suite at 8a47a5c (registrar source unchanged since
c41d36c2): 89 focused registrar/identity/historical cases and the full suite
(226) passed. Read-only hub check: the three refused projections are
683724d9 (custodian-wp-0003), 644017c7 (custodian-wp-0003a) and a5806df9
(custodian-wp-0003b), each with zero tasks; every custodian-WP-0003* source
file binds parent b4eb45a9, which holds the tasks and must not be retired.
Added repo_manager.retirement_disposition, a read-only check that an Activity
expected_retirement_uuids set equals exactly those three empty projections and
excludes the preserved parent. It authorizes nothing; retirement stays with
Activity receiving under STATE-WP-0095-T04.
## Activity disposition received, 2026-10-06
activity-core returned the exact expected_retirement_uuids (message 17ba4201,
evidence activity-core 941fac0, ACTIVITY-WP-0045): 683724d9, 644017c7,
a5806df9. repo_manager.retirement_disposition accepted the set: it equals the
three projections the 2026-10-04 run refused, each holds zero tasks, and it
excludes preserved parent b4eb45a9. Nothing was applied. T03 stays wait: its
acceptance needs a successful Activity owner sync with receipts, which can run
only after the founder decides 91b7c633 and STATE-WP-0095-T04 retires exactly
this set in a reviewed live rollout. Then re-run rmgr sync --path
~/activity-core --push and feed the receipt back to STATE-WP-0095-T04.
## Post-retirement owner sync attempt, 2026-10-06
State Hub reported decision 91b7c633 resolved, main-968a811 / Helm rev 74
deployed, and Activity reconcile at 67a92d2 retiring exactly the three empty
projections (3 retired, 0 created, 0 refused; 4 historical parents / 64 tasks
unchanged). Evidence: state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
`rmgr sync --path ~/activity-core --push` stopped before reconciliation with
status pending_commit: uncommitted `state_hub_workstream_id` / `state_hub_task_id`
writeback in activity-core workplans/ACTIVITY-WP-0045-stale-historical-projection-disposition.md
(plus WORK-RECORDS.md). No hub request was made. Repo Manager does not commit in
activity-core; T03 stays wait until Activity Core commits and the sync re-runs.
Re-run 2026-10-06 08:42Z after Activity Core committed the writeback (e809fb2):
status applied, created 0 / updated 45 (ACTIVITY-WP only) / retired 0 / refused 0,
no task changes, notes preserve custodian-WP-0001..0004 UUIDs; hub shows 4 parents,
64 tasks. Not closed: historical parent b4eb45a9 (custodian-WP-0003, source
`status: archived`, evidence snapshot archived) now reads `finished` in the hub,
updated 08:42:03Z during this sync. Needs State Hub review before T03 closes.
Closed 2026-10-06: State Hub traced the b4eb45a9 status change to its own C-04
check, which ran once per file. The custodian-WP-0003a/b/c split views share the
parent UUID, so whichever view ran last set the row. The Forge reconcile did not
cause it. Fixed in state-hub 2b5d8f9 (STATE-WP-ADHOC-2026-10-06-T01); b4eb45a9 is
back to `archived`. Re-check: 4 parents (b4eb45a9 archived; 3a4f47d9, 759b1255,
e22516cc finished) holding 64 tasks (24+12+7+21). Receipt: Activity sync at e809fb2,
primary/railiance01, applied, 0 created / 45 updated (ACTIVITY-WP only) / 0 retired
/ 0 refused, 0 task changes, historical UUIDs preserved. Evidence:
state-hub docs/evidence/2026-10-06-activity-stale-retirement-rollout.json.
## Cluster exact historical source successor, 2026-10-17
This scoped extension preserves the completed Activity/Custodian work above.
The cluster publisher now refuses three closed RAIL-BS source files containing
15 existing UUID-bound bare task labels. Preserve all three source bytes, IDs,
and UUIDs. No new alias or general syntax exemption is introduced. Evidence and
exact receiver-first proposal: cluster-historical-publication-r1 in the Custodian
NetKingdom change packet. The existing SHR-WP-0001 project driver owns the
Repo Manager / State Hub cross-owner wait; NK-WP-0049-T35 benefits from the
blocked cluster publication. No worker or human gate is woken here.
## Prepare exact cluster registrar successor
```task
id: RMGR-WP-0019-T04
status: done
priority: high
state_hub_task_id: "1ccb06c6-ad30-5847-8704-e5628ba81f35"
```
Prepared full-file SHA256 bindings for three archives and 15 exact task
occurrences; strict scans still return 15 invalid labels and five collisions.
Unknown/live sources, changed/missing/symlinked histories, UUID drift and
qualified/global collisions refuse before allocation. Candidate tests pass 47;
canonical application remains a separate reviewed step. The read-only current
cluster preview proposes seven ordinary UUID bindings in two files and changes
no bytes. One pre-existing ADHOC field is included explicitly: task
RCLUSTER-WP-ADHOC-2026-07-27-T01 in workplans/ADHOC-2026-07-27.md receives
3e3f39d3-5070-5ba3-97db-19f5f361f264 through managed allocation only.
## Admit cluster registrar successor only after receiving verification
```task
id: RMGR-WP-0019-T05
status: done
priority: high
depends_on: [STATE-WP-0095-T06]
state_hub_task_id: "36f47e21-42d0-5aef-b065-4a5dd3af0726"
```
Retain the current guard until exact reviewed receiving source has been delivered
and verified through State Hub's normal owner deployment. Match both manifests,
then integrate reviewed registrar source and verify ordinary allocator preview.
No direct API patch, history rename or bypass substitutes for this gate.
## Run ordinary cluster owner publication and verify preservation
```task
id: RMGR-WP-0019-T06
status: wait
priority: high
depends_on: [RMGR-WP-0019-T05]
state_hub_task_id: "4d1675b6-f49f-5b01-8d76-bbf2030d1b34"
```
Only then run normal owner consistency/publication with the reviewed expected
file set: RCLUSTER-WP-0018 and the one-field ADHOC managed backfill, plus ordinary
generated indexes. Preserve all three archived files and all 18 existing
parent/task rows. Return actual receiving/publication receipts to STATE-WP-0095-T07.
Do not infer TLS recovery, credential custody or native acceptance from sync.
## Receiver-first registrar source follow-through, 2026-10-17
The exact receiving return is retained in Custodian
`docs/changes/netkingdom-target-2026-10-17/receiver-rollout-r4/verified-receiving-return.json`,
bound to the actual native rollout/preservation/refusal receipts. It verifies the
reviewed receiver source/image/module, API/MCP readiness, expected additive schema,
three existing historical parents/15 tasks and rolled-back safe refusal probes.
Only after that return was the exact registrar patch
`232552c3d601d185984be5a8e5bc9937bc9ddda7327923b5f0440f6deb2c87fc`
admitted in the Repo Manager owner source. T04 retains its source-preparation
outcome; T05 records this receiving-gated registrar admission, not a substitute
for receiving. Canonical focused registrar/identity checks passed 47 cases in 5.84 seconds.
The actual bounded read-only current Cluster allocator preview agreed with the
reviewed source: seven ordinary missing UUID bindings in exactly the new WP0018 and
one-field existing ADHOC backfill, with 15 invalid labels/five collisions still
reported by the strict conformance scan. The three historical file bytes, IDs,
UUIDs and ownership are unchanged. No broad syntax relaxation or direct Hub UUID
patch is introduced. Exact source application/test/preview receipts travel with
the same packet; source publication/projection is verified separately.
T06 remains wait until actual ordinary Cluster owner publication and receiving
preservation are verified. Registrar source readiness alone does not mark that
publication complete. Preserve the 18 existing rows and all three archives; the
root coordinator owns the normal seven-field managed allocation and dirty-source
preservation. Own Repo Manager projection must show exactly T01–T05 done, T06
wait and active workplan status, including the managed new T04/T05/T06 UUIDs and
unchanged earlier task UUIDs. The separate scanner RMGR-WP-0021-T05 completion
and unrelated owner work remain untouched. No native TLS recovery, custody,
current registration/private admission or NetKingdom target acceptance follows.

View file

@ -0,0 +1,13 @@
{
"status": "committed-exact-one-file",
"head": "7c15c0ea48981867fc1683d9b7576f6444c256da",
"parent": "70cd754996870638848616e37819790a5c4d52b3",
"path": "workplans/RMGR-WP-0019-historical-source-admission.md",
"source_sha256": "4ff763ea24b9948d59b4bdd4f5ef3e95bee72fef3016f0b6404b5db663cb83ff",
"scanner_sha256_unchanged": "e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400",
"task_blocks_and_UUIDs_unchanged": true,
"t05": "done",
"t06": "wait",
"commit_output": "[main 7c15c0e] Retain Cluster publication with failed historical row preservation\n 1 file changed, 28 insertions(+)\n",
"cluster_or_database_mutation": false
}