Record approved API guard delivery and completed owner returns
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Reject generated-only commits / generated-commit-guard (push) Successful in 9s

This commit is contained in:
codex 2026-10-17 04:02:49 +02:00
parent b17e753efc
commit ceaeef1ee7
33 changed files with 2800 additions and 9 deletions

View file

@ -828,8 +828,8 @@
},
{
"proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
"disposition": "pending",
"outcome": "not_executed",
"disposition": "accepted_revised",
"outcome": "succeeded",
"proposal_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/proposal-metadata.json",
"original_revision": 1,
"original_digest_sha256": "81d365926fc585a186955d8c98ee83501fd3cec12135b2256d71b46a75097932",
@ -838,18 +838,18 @@
"current_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"target": "railiance01/92.205.62.239 state-hub release API/MCP and exact-new-trial migration Job",
"expected_result": "New API binding guard delivered and current-baseline native/whole-pipeline preservation verified, with earlier parent mismatch retained as explicit exception.",
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md",
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json",
"rollback_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/RECOVERY.md",
"cost_estimate_eur": null,
"risk_estimate_eur": null,
"cost_estimate": "Unpriced incremental execution and recovery costs on existing infrastructure.",
"risk_estimate": "Unpriced coordination outage, hook lifetime, lock mapping and recovery; reviewed conditional limits stop for attended owner on unknown state.",
"supervisor": "Bernd Worsch",
"approval_ref": null,
"approved_revision": null,
"approved_digest_sha256": null,
"executed_revision": null,
"executed_digest_sha256": null,
"approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
"approved_revision": 2,
"approved_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"executed_revision": 2,
"executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"refinement_or_rescue": true,
"promotion_evidence": false,
"related_proposal_id": "STATE-WP-0095-T06-cluster-frozen-receiving-r1",
@ -867,7 +867,17 @@
"outcome": "not_executed",
"refinement": "Typed module/SHA256 records; unchanged runtime and probe logic."
}
]
],
"approved_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"approved_at": "2026-10-17T01:51:27.526327+00:00",
"approval_record_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json",
"approval_scope": "Exact revision2 new API image rollout, eight rollback/intercepted probes, corrected normal pipeline and current-baseline exception, plus scoped conditional recovery; no authority promotion.",
"executed_digest": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"execution_started_at": "2026-10-17T01:52:59.649596+00:00",
"execution_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json",
"verified_at": "2026-10-17T01:55:19.742775+00:00",
"verified_outcome": "Exactapprovedrevision2 deliveredHelm77; eightactualrollback/interceptedcasespass, all18CURRENTfullrows equalafterrolloutandnormalpipeline; archives/stagedworkpreserved. Originalthreeparentfailure retainedasfounder-approvedhistoricalexception, notrestored/backfilled.",
"recovery_required": false
}
],
"trials": [

View file

@ -0,0 +1,18 @@
{
"workplan_id": "79579572-8120-5d3b-aca5-dd4aff60d058",
"id": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
"topic_id": null,
"title": "Review exact frozen-binding API guard successor and retained baseline exception",
"description": "Pending proposal STATE-WP-0095-T10-frozen-bindings-guard-r1 revision2 SHA2565d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e. Image main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1; frozen chart b5c0663d830fc8d3b65080f237a0be8d01f8b2f7fec9dc33aeba91b1b6b281d4. Eight-identity image-only server dry-run and explicit target/headroom/schema pass. Verified installed checker maintenance preserves all18 CURRENT rows; prior three-parent hash failures remain historical exceptions, never restored or backfilled. Requested ADMINISTER @ realm:kubernetes/railiance01 activation=APPROVED includes exact new Job conditional recovery, rollback76 after verified quiescence, current-baseline successor acceptance, unpriced cost/risk and attended stop for unknown mapping. Full review: the-custodian/docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md. No new runtime is approved or executed. Original revision1 remains retained and unexecuted. Revision2 only represents source hashes as typed metadata after the normal scanner false positive; runtime, case logic, acceptance and recovery scope are unchanged.",
"decision_type": "made",
"status": "resolved",
"rationale": "Founder replied \"go ahead\" to the exact revision2 API guard deployment review, including current-baseline exception and conditional recovery. Approved STATE-WP-0095-T10-frozen-bindings-guard-r1 revision2 SHA256 5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e. ADMINISTER @ realm:kubernetes/railiance01 activation=APPROVED. Exact pinned image, frozen chart, acceptance and recovery scope as reviewed; no autopilot or credential grant.",
"decided_by": "Bernd Worsch",
"decided_at": "2026-10-17T01:51:27.526327Z",
"deadline": null,
"escalation_note": null,
"superseded_by": null,
"created_at": "2026-10-17T00:37:26.205185Z",
"updated_at": "2026-10-17T01:51:27.812490Z",
"workstream_id": "79579572-8120-5d3b-aca5-dd4aff60d058"
}

View file

@ -0,0 +1,105 @@
"""Approved trial's bounded metadata reads, dry-run and private hash/probe calls."""
from pathlib import Path
import argparse
import datetime
import hashlib
import json
import os
import shlex
import subprocess
import urllib.request
BASE = Path(__file__).resolve().parent
REVIEW = BASE.parent / 'guard-successor-review-r2'
OLD = 'forgejo.coulomb.social/coulomb/state-hub:main-51bc70d@sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015'
NEW = 'forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1'
SNAPSHOT = BASE.parent.parent / 'netkingdom-target-2026-10-16/cluster-historical-publication-r1/postdeployment-verifier-r1/snapshot_full_row_hashes.py'
def save(name, data):
(BASE / (name + '.json')).write_text(json.dumps(data, indent=2) + '\n')
def remote(args, content=None):
p = subprocess.run(['ssh', 'railiance01', 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml ' + shlex.join(args)],
input=content, capture_output=True, text=True, timeout=50)
assert p.returncode == 0, 'private-owner-command-refused'
return json.loads(p.stdout) if p.stdout.strip() else None
def runtime(after):
image = NEW if after else OLD
nodes = remote(['kubectl', 'get', 'nodes', '-o', 'json'])
assert any(a['address'] == '92.205.62.239' for n in nodes['items'] for a in n['status']['addresses'])
status = remote(['helm', '-n', 'state-hub', 'status', 'state-hub', '-o', 'json'])
assert status['version'] == (77 if after else 76) and status['info']['status'] == 'deployed'
assert remote(['kubectl', '-n', 'state-hub', 'get', 'job', 'state-hub-migrate', '--ignore-not-found', '-o', 'json']) is None
assert not remote(['kubectl', '-n', 'state-hub', 'get', 'pods', '-l', 'job-name=state-hub-migrate', '-o', 'json'])['items']
checked = []
api = None
for name in ['state-hub', 'state-hub-mcp']:
d = remote(['kubectl', '-n', 'state-hub', 'get', 'deployment', name, '-o', 'json'])
assert d['status']['observedGeneration'] == d['metadata']['generation']
assert d['status'].get('readyReplicas') == d['spec']['replicas'] == 1
assert [c['image'] for c in d['spec']['template']['spec']['containers']] == [image]
selector = ','.join(k+'='+v for k,v in sorted(d['spec']['selector']['matchLabels'].items()))
pods = remote(['kubectl', '-n', 'state-hub', 'get', 'pods', '-l', selector, '-o', 'json'])
active = [p for p in pods['items'] if not p['metadata'].get('deletionTimestamp')]
assert len(active) == 1
p = active[0]
assert any(c['type'] == 'Ready' and c['status'] == 'True' for c in p['status']['conditions'])
assert all(c['ready'] and c['imageID'].endswith(image.split('@')[1]) for c in p['status']['containerStatuses'])
identity = {'name': p['metadata']['name'], 'uid': p['metadata']['uid']}
checked.append({'deployment': name, 'ready': True, 'image': image, 'pod': identity})
if name == 'state-hub':
api = identity
health = json.load(urllib.request.urlopen('http://127.0.0.1:8000/state/health', timeout=20))
assert health['status'] == 'ok' and health['instance_role'] == 'primary' and health['instance_label'] == 'railiance01'
assert health['schema']['applied'] == health['schema']['expected'] == 'c4d5e6f7a8b9'
result = {'status': 'verified', 'observed_at': datetime.datetime.now(datetime.timezone.utc).isoformat(),
'helm_revision': status['version'], 'target': 'railiance01/92.205.62.239',
'deployments': checked, 'api_pod': api, 'schema': health['schema'],
'migration_job_and_pods_absent': True, 'primary': 'primary/railiance01'}
save('runtime-after' if after else 'runtime-before', result)
return result
def pod_command(after, helper):
state = json.loads((BASE / ('runtime-after.json' if after else 'runtime-before.json')).read_text())
pod = state['api_pod']
actual = remote(['kubectl', '-n', 'state-hub', 'get', 'pod', pod['name'], '-o', 'json'])
assert actual['metadata']['uid'] == pod['uid']
return remote(['kubectl', '-n', 'state-hub', 'exec', '-i', pod['name'], '-c', 'state-hub', '--', 'python', '-'], helper.read_text())
parser = argparse.ArgumentParser()
parser.add_argument('phase', choices=['preflight', 'delivered', 'before', 'after', 'post-pipeline', 'probes'])
phase = parser.parse_args().phase
if phase == 'preflight':
runtime(False)
env = {**os.environ, 'KUBECONFIG': '/home/worsch/.kube/config-railiance01'}
headroom = subprocess.run(['python3', '/home/worsch/state-hub/scripts/release_headroom_preflight.py'],
capture_output=True, env=env, timeout=125)
report = json.loads(headroom.stdout)
save('fresh-headroom', report)
assert headroom.returncode == 0 and report['ok']
dry = subprocess.run(['python3', str(REVIEW / 'reuse_values_dryrun.py')], capture_output=True, timeout=160)
report = json.loads(dry.stdout)
save('fresh-server-dryrun', report)
assert dry.returncode == 0 and report['status'] == 'passed_images_only'
assert report['changed_object_count'] == 3 and len(report['objects']) == 8
elif phase == 'delivered':
runtime(True)
elif phase == 'probes':
helper = REVIEW / 'native_binding_probes.py'
assert hashlib.sha256(helper.read_bytes()).hexdigest() == 'ce492d0713c987e47eefc991a6312c1c63ed72056a597e9e28aee959d06e71d5'
report = pod_command(True, helper)
save('native-binding-probes', report)
assert report['status'] == 'passed' and len(report['cases']) == 8 and report['commits_performed'] == 0
else:
assert hashlib.sha256(SNAPSHOT.read_bytes()).hexdigest() == 'f01e93c0fcb4ca155bdf76813626c33e4343f6a8caec2870ab1d785243c60479'
report = pod_command(phase != 'before', SNAPSHOT)
assert report['status'] == 'captured_readonly'
if phase != 'before':
original = json.loads((BASE / 'full-rows-before.json').read_text())
report['current_baseline_equal'] = report['tables'] == original['tables']
save('full-rows-' + phase, report)
assert report['current_baseline_equal']
else:
save('full-rows-before', report)
print(json.dumps({'phase': phase, 'status': 'verified'}))

View file

@ -0,0 +1,35 @@
{
"workplan_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52",
"id": "ad3a6ef1-1c42-4396-bab4-b89ff3ec8962",
"topic_id": null,
"task_id": null,
"decision_id": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
"event_type": "coordination_receipt",
"summary": "Frozen-binding guard successor and registrar return satisfied; native target gates remain separate.",
"detail": {
"state": "satisfied",
"flavor": "implementation",
"reason": "Founder approved exactrevision2; Helm77 exact4cc guard delivery, eight nativezero-commitcases and current18fullrow/normalpipeline pass. StateT10done publishedbb525 and RMGR19T06done/parentfinished published3bcb verified. Original3parentfailure retained as approved historicalexception; no native16gateclosure.",
"case_id": "cluster-frozen-binding-guard-successor-r1",
"observer": "codex",
"driver_repo": "prj-state-hub-retirement",
"next_action": "Retain actual runtime and source-owner receipts; independent native-owner waits remain live. No worker wake.",
"approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
"scenario_type": "project_driver",
"obligor_task_id": "STATE-WP-0095-T10",
"registrar_commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
"native_acceptance": false,
"driver_workplan_id": "SHR-WP-0001",
"beneficiary_task_id": "RMGR-WP-0019-T06",
"obligor_workplan_id": "STATE-WP-0095",
"coordination_context": "CUST-WP-0080",
"runtime_return_sha256": "09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a",
"human_gate_never_woken": true,
"beneficiary_workplan_id": "RMGR-WP-0019",
"runtime_worker_injection_enabled": false
},
"author": "codex",
"session_id": null,
"created_at": "2026-10-17T02:00:08.768238Z",
"workstream_id": "dfadb19b-445e-59c6-bcd6-48e87b912c52"
}

View file

@ -0,0 +1,75 @@
"""Execute exactly the founder-approved revision2 rollout, with live observation."""
from pathlib import Path
import datetime
import hashlib
import json
import shutil
import subprocess
import time
BASE = Path(__file__).resolve().parent
ROOT = BASE.parents[3]
REVIEW = BASE.parent / 'guard-successor-review-r2'
PIN = '5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e'
proposal = REVIEW / 'proposal-metadata.json'
assert hashlib.sha256(proposal.read_bytes()).hexdigest() == PIN
meta = json.loads(proposal.read_text())
for r in meta['bound_receipts']:
assert hashlib.sha256(Path(r['path']).read_bytes()).hexdigest() == r['sha256']
approval = json.loads((BASE / 'approval-decision.json').read_text())
assert approval['status'] == 'resolved' and approval['decision_type'] == 'made'
assert PIN in approval['rationale']
before = json.loads((BASE / 'full-rows-before.json').read_text())
prior = json.loads((BASE.parent / 'rollout-close-current-full-row-hashes.json').read_text())
assert before['tables'] == prior['tables'], 'unexpected-preexecution-historical-drift'
preflight = json.loads((BASE / 'runtime-before.json').read_text())
assert (datetime.datetime.now(datetime.timezone.utc) - datetime.datetime.fromisoformat(preflight['observed_at'])).total_seconds() < 600
archive = Path(meta['chart_archive'])
assert hashlib.sha256(archive.read_bytes()).hexdigest() == meta['chart_sha256']
def call(argv, timeout=30):
return subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
directory = '/tmp/statehub-binding-guard-b5c0663d830f'
stage = call(['ssh', 'railiance01', 'set -eu; test ! -e ' + directory + '; umask 077; mkdir ' + directory + '; stat -c "%u %a" ' + directory + '; id -u'])
assert stage.returncode == 0, 'owned-staging-creation-refused'
parts = stage.stdout.split()
assert len(parts) == 3 and parts[0] == parts[2] and parts[1] == '700'
staging_uid = int(parts[0])
copy = call(['scp', str(archive), 'railiance01:' + meta['remote_owned_chart']], timeout=45)
assert copy.returncode == 0, 'reviewed-chart-transfer-refused'
check = call(['ssh', 'railiance01', 'set -eu; chmod 600 ' + meta['remote_owned_chart'] + '; sha256sum ' + meta['remote_owned_chart'] + '; stat -c "%u %a" ' + meta['remote_owned_chart']])
assert check.returncode == 0 and check.stdout.split()[0] == meta['chart_sha256']
assert check.stdout.splitlines()[1] == str(staging_uid) + ' 600'
(BASE / 'staging.json').write_text(json.dumps({'status':'verified','directory':directory,'uid':staging_uid,'directory_mode':'700','file_mode':'600','archive_sha256':meta['chart_sha256'],'remote_archive':meta['remote_owned_chart']},indent=2)+'\n')
shutil.copy2(REVIEW / 'watch_rollout.py', BASE / 'watch_rollout.py')
observer = subprocess.Popen(['python3', str(BASE / 'watch_rollout.py')], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
started = datetime.datetime.now(datetime.timezone.utc).isoformat()
record = {'proposal_id':meta['proposal_id'],'revision':2,'executed_digest_sha256':PIN,
'approval_ref':approval['id'],'started_at':started,'status':'executing',
'mode_of_authority':'ADMINISTER @ realm:kubernetes/railiance01','activation':'APPROVED',
'exact_argv':meta['exact_upgrade_argv']}
(BASE / 'execution.json').write_text(json.dumps(record,indent=2)+'\n')
supervision = ROOT / '.kaizen/agents/custodian-codex/supervision.json'
data = json.loads(supervision.read_text())
entry = next(x for x in data['proposals'] if x['proposal_id'] == meta['proposal_id'])
entry.update(executed_revision=2,executed_digest_sha256=PIN,executed_digest=PIN,
execution_started_at=started,execution_ref=str((BASE/'execution.json').relative_to(ROOT)))
supervision.write_text(json.dumps(data,indent=2)+'\n')
try:
result = call(meta['exact_upgrade_argv'], timeout=240)
outcome = {'exit_code':result.returncode,'returned_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),
'raw_helm_output_retained':False,'recovery_required':result.returncode != 0}
except subprocess.TimeoutExpired:
outcome = {'exit_code':None,'returned_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),
'raw_helm_output_retained':False,'recovery_required':True,'ssh_outcome':'timeout-unverified'}
(BASE / 'helm-return.json').write_text(json.dumps(outcome,indent=2)+'\n')
try:
observer.wait(timeout=15)
except subprocess.TimeoutExpired:
observer.terminate()
observer.wait(timeout=5)
record['status'] = 'helm-returned-awaiting-acceptance' if outcome['exit_code'] == 0 else 'recovery-assessment-required'
(BASE / 'execution.json').write_text(json.dumps(record,indent=2)+'\n')
print(json.dumps(outcome))
assert outcome['exit_code'] == 0, 'approved-recovery-assessment-required'

View file

@ -0,0 +1,18 @@
{
"proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
"revision": 2,
"executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
"started_at": "2026-10-17T01:52:59.649596+00:00",
"status": "verified",
"mode_of_authority": "ADMINISTER @ realm:kubernetes/railiance01",
"activation": "APPROVED",
"exact_argv": [
"ssh",
"railiance01",
"KUBECONFIG=/etc/rancher/k3s/k3s.yaml helm -n state-hub upgrade state-hub /tmp/statehub-binding-guard-b5c0663d830f/state-hub-0.1.0.tgz --reuse-values --set-string image.tag=main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1 --atomic --timeout 3m"
],
"verified_at": "2026-10-17T01:55:19.742775+00:00",
"verification_ref": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json",
"recovery_required": false
}

View file

@ -0,0 +1,23 @@
{
"schema": "state-hub.release-headroom-preflight.v1",
"ok": true,
"observed_at": "2026-10-17T01:52:16.534776+00:00",
"freshness_seconds": 0,
"remaining_cpu_m": 420,
"remaining_memory_bytes": 6535979008,
"pending_unrelated_cpu_m": 0,
"api_surge_cpu_m": 100,
"mcp_surge_cpu_m": 10,
"migrate_cpu_m": 50,
"atomic": true,
"reasons": [],
"notes": [
"Aggregate remaining millicores is not a kube-scheduler guarantee.",
"Preflight does not lower requests and does not start Helm."
],
"hook_order": [
"pre-upgrade migrate job (helm.sh/hook-weight -5)",
"API RollingUpdate maxSurge=1 maxUnavailable=0",
"MCP RollingUpdate maxSurge=1 maxUnavailable=0"
]
}

View file

@ -0,0 +1,136 @@
{
"schema": "statehub.exact-reuse-values-readonly-diff.v1",
"status": "passed_images_only",
"dryrun_argv": [
"helm",
"--kubeconfig",
"/home/worsch/.kube/config-railiance01",
"-n",
"state-hub",
"upgrade",
"state-hub",
"/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/cluster-historical-publication-r1/revisions/r4-rollout-review/state-hub-0.1.0.tgz",
"--reuse-values",
"--set-string",
"image.tag=main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
"--dry-run=server",
"--hide-secret",
"--no-hooks",
"--timeout",
"3m"
],
"production_mutations": false,
"hooks_executed": false,
"raw_helm_values_release_content_logs_retained": false,
"limitations": [
"Dry-run admission/render only, not an actual image pull/migration/deployment.",
"Helm timeout does not stop a later live migration Job; exact scoped cancellation/quiescence remains required."
],
"chart_archive_sha256": "sha256:b5c0663d830fc8d3b65080f237a0be8d01f8b2f7fec9dc33aeba91b1b6b281d4",
"stage": "exact_upgrade_server_dryrun",
"objects": [
{
"api_version": "apps/v1",
"kind": "Deployment",
"namespace": "state-hub",
"name": "state-hub",
"intended_images": [
"forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
],
"intended_spec_sha256": "sha256:df32d106c28b270c67aa683c8a4f20b26c430b121420c4023d34d23ede0eaed9",
"baseline_object_sha256": "sha256:01e7278447f3204ec8abfd9a7b5b6be61850995b3e792fc1f97fbc3207536d69",
"intended_object_sha256": "sha256:7b7c78921b071732c8e7c4c062bdbd26787498581102ea9916b07c1f57887a73",
"changed_paths": [
"/spec/template/spec/containers/0/image"
]
},
{
"api_version": "apps/v1",
"kind": "Deployment",
"namespace": "state-hub",
"name": "state-hub-mcp",
"intended_images": [
"forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
],
"intended_spec_sha256": "sha256:50ae88c8c57919bf745a772a8ff34ea7e469751a403ac39d1d01ab2e9d3a27db",
"baseline_object_sha256": "sha256:9a4376e004060a4ec2c76784fd50ec6ce05f61b3793f6458625d88122a7b8713",
"intended_object_sha256": "sha256:b78c66a3e27bca60ff4dd4f51c1bbe789a4e246be3d1e7e6fb9659ffdce80127",
"changed_paths": [
"/spec/template/spec/containers/0/image"
]
},
{
"api_version": "batch/v1",
"kind": "Job",
"namespace": "state-hub",
"name": "state-hub-migrate",
"intended_images": [
"forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1"
],
"intended_spec_sha256": "sha256:2eb273b5e2ca5538fa1b13a8cf8cd10d259ad7cd3510bce1e86075f8c4c4a915",
"baseline_object_sha256": "sha256:6909dca9acd5e1b816491b91b6a32ef6d934e288e2d8d0d3d66fac9fe67468ec",
"intended_object_sha256": "sha256:208b52d9b958b9d4490182bda4d0da27b4a6f0961f6bf182c34ef4b640fcbb5e",
"changed_paths": [
"/spec/template/spec/containers/0/image"
]
},
{
"api_version": "v1",
"kind": "ConfigMap",
"namespace": "state-hub",
"name": "state-hub-classification-allowed",
"intended_images": [],
"intended_spec_sha256": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"baseline_object_sha256": "sha256:924d16a0a6b4ba8a46b59f0990dcc2adc6dd813cf5d7d83bdb389844068d7cfd",
"intended_object_sha256": "sha256:924d16a0a6b4ba8a46b59f0990dcc2adc6dd813cf5d7d83bdb389844068d7cfd",
"changed_paths": []
},
{
"api_version": "v1",
"kind": "ConfigMap",
"namespace": "state-hub",
"name": "state-hub-config",
"intended_images": [],
"intended_spec_sha256": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"baseline_object_sha256": "sha256:26707b20933b4f6de78f9059c0efec6df7f0e90c8f1a67db6d2f1ac72e674560",
"intended_object_sha256": "sha256:26707b20933b4f6de78f9059c0efec6df7f0e90c8f1a67db6d2f1ac72e674560",
"changed_paths": []
},
{
"api_version": "v1",
"kind": "Service",
"namespace": "state-hub",
"name": "state-hub",
"intended_images": [],
"intended_spec_sha256": "sha256:da5895e6aee1f619d16c07dafd4342cf7ec8f9de0944a84979c624a4e9eea22a",
"baseline_object_sha256": "sha256:62098bbc3ef6265e072f416ecb11de85d59fce7e2e0d22b2616bd233e720dafe",
"intended_object_sha256": "sha256:62098bbc3ef6265e072f416ecb11de85d59fce7e2e0d22b2616bd233e720dafe",
"changed_paths": []
},
{
"api_version": "v1",
"kind": "Service",
"namespace": "state-hub",
"name": "state-hub-mcp",
"intended_images": [],
"intended_spec_sha256": "sha256:4e04175b03bcd75833109d6843e282cee79d73eae2bc85e36097264b832ba26f",
"baseline_object_sha256": "sha256:ab096d239c9cd72e6177a260d9b4d548a7d5b7c0a285c3a11b7267193e336bba",
"intended_object_sha256": "sha256:ab096d239c9cd72e6177a260d9b4d548a7d5b7c0a285c3a11b7267193e336bba",
"changed_paths": []
},
{
"api_version": "v1",
"kind": "ServiceAccount",
"namespace": "state-hub",
"name": "state-hub",
"intended_images": [],
"intended_spec_sha256": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
"baseline_object_sha256": "sha256:750594b51a534d603f50640d02a3c4eec79cc52fe07d5f442102d37b7299adb8",
"intended_object_sha256": "sha256:750594b51a534d603f50640d02a3c4eec79cc52fe07d5f442102d37b7299adb8",
"changed_paths": []
}
],
"changed_object_count": 3,
"intended_diff_only_images": true,
"object_identity_set_unchanged": true
}

View file

@ -0,0 +1,20 @@
{
"status": "verified",
"archives": [
{
"path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md",
"sha256": "8d6f8533c119117686bc0d5bb9ed5349726aa6c3189ff98b53409c68ac685ca9",
"unchanged": true
},
{
"path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
"sha256": "4dc2f61e15adc3c5c81f9ecf8b933512275b95e8f829fac52ae7cde1385cea4a",
"unchanged": true
},
{
"path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md",
"sha256": "04f787078232395bd2d43861de16c521848559fa286f06e1caa9cb779aa71ac3",
"unchanged": true
}
]
}

View file

@ -0,0 +1,147 @@
{
"credential_values_exposed": false,
"historical_module_sha256": "sha256:e24e57c58f4aaa4ec9d9bf088009ac69006e53f75b9477ee53dc26c4e850b975",
"raw_rows_retained": false,
"schema": "state95.full-db-row-hash-snapshot.v1",
"status": "captured_readonly",
"tables": {
"tasks": {
"all_rows_sha256": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
"columns": [
"assignee",
"blocked_on",
"blocking_reason",
"created_at",
"decision_id",
"description",
"due_date",
"flavor",
"id",
"intervention_note",
"needs_human",
"parent_task_id",
"priority",
"record_id",
"status",
"title",
"updated_at",
"wait_until",
"workplan_id"
],
"row_count": 15,
"rows": [
{
"sha256": "sha256:89b3be69fbaf5ad60f5aefa6f2b630e1d6124e0fca7b01a5e9ce1ff41a451106",
"uuid": "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
},
{
"sha256": "sha256:3aa20e9695e110468d13baa3c813ac5b474896d89eeb6edc56e9ea00d9199fd7",
"uuid": "08233868-d522-4117-bc4e-6c0f52545665"
},
{
"sha256": "sha256:72fb54d9a271067a62f33377d56e0bb9e6874a3f9c475b9ae049609b93d1f643",
"uuid": "140da396-8e30-4f4d-b88c-c42c0cd46c01"
},
{
"sha256": "sha256:15198017e5c7d31b4e8ce1d5c0ef0de99ac1c50d3bffd0ea0ee807bef70ce5d1",
"uuid": "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
},
{
"sha256": "sha256:29a6f1e50db6a7b4ba5b98a2f7d8d109b4df1720fce58777c21f7538084f8cda",
"uuid": "3f042630-eab0-4c6a-9167-e2b28ff20e40"
},
{
"sha256": "sha256:2e00141f0d7382dd34859b686a500dc740a543efe81e23f5805754cbc6761f2e",
"uuid": "4526a842-ea31-4874-9231-92ab556cfe7b"
},
{
"sha256": "sha256:7b3ecacb7be3c1a24a100d7b732b7f60e1a99329a6847612264cd01d13c7ecf0",
"uuid": "5c3d40e4-239b-488e-9519-6f7a38d2325f"
},
{
"sha256": "sha256:71107455d1d453d69d65466ca66da1fd4ee4aa95ecdf7920b9acdce767f0c55c",
"uuid": "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
},
{
"sha256": "sha256:f8e44ea79125870ab3ade44afab8752c126c424e2b751f48b9fe555e00b5b708",
"uuid": "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
},
{
"sha256": "sha256:435e39ffee3a59eae3b890739a6ed8e06801fb23dead15073653d8650f9d5ff5",
"uuid": "a6313e06-1976-46a7-8e31-df4eb2eca880"
},
{
"sha256": "sha256:2fcda8440a166fc628f8fadf91a4a23ba7728ccac2e629248c6eccd00d5d4345",
"uuid": "ab166073-30a7-4702-a037-4091e8706e20"
},
{
"sha256": "sha256:b2e11b8fdc580e6cb7ec20c7e90018ba9fb468893b6eda5b9519dc68737a0ca0",
"uuid": "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
},
{
"sha256": "sha256:788862d9cc5015b927d27303585431a0db4af6077178ab3bfdde37f900cee821",
"uuid": "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
},
{
"sha256": "sha256:f7bc1f3acf187301430df0623417fb90b6af1869c0383a0bff9ec25f79ffe4af",
"uuid": "e8510646-46ed-4697-a345-f3d3009eea78"
},
{
"sha256": "sha256:f2760deded2f7136a60fba0156c4956ba373fbcf5eda986f5c380d7ee9c925ff",
"uuid": "f8e4a094-c367-40eb-b895-da17bc144b07"
}
]
},
"workplans": {
"all_rows_sha256": "sha256:1cd4e695c8f8da8bdb2335a8770a219f704f3989f14d28ebf0b1494f2458dc4a",
"columns": [
"backing_archived",
"backing_filename",
"backing_relative_path",
"backing_synced_at",
"concurrency_mode",
"created_at",
"derived_from_commit",
"description",
"due_date",
"execution_group",
"execution_state",
"flavor",
"flavor_promoted_from",
"flavor_promotion_reason",
"id",
"launch_mode",
"owner",
"planning_order",
"planning_priority",
"projection_retired_at",
"projection_retired_reason",
"queue_rank",
"repo_goal_id",
"repo_id",
"scheduled_for",
"slug",
"status",
"title",
"topic_id",
"updated_at"
],
"row_count": 3,
"rows": [
{
"sha256": "sha256:bfd3b3abe48d989b1c253d8cca57c463c40e63413885f467b3f3e2187d33cb49",
"uuid": "4c63dfc6-9eac-4e79-9f77-8f644ad7147d"
},
{
"sha256": "sha256:c3f19622843b62cea0fd987ed550fe8d050214a952f77f9250e1696506130303",
"uuid": "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
},
{
"sha256": "sha256:a406d311c2c0421eb7646edf4d215dbd96f570d07b2ba0bc6a747d7c573f0b9a",
"uuid": "7ee9ee22-1fae-4567-9194-8d70a9e0f45b"
}
]
}
},
"current_baseline_equal": true
}

View file

@ -0,0 +1,146 @@
{
"credential_values_exposed": false,
"historical_module_sha256": "sha256:e3c4bf965764b32a6df5d61c71272ee22569df9a9ddae2a3fc3df97ec554e0b2",
"raw_rows_retained": false,
"schema": "state95.full-db-row-hash-snapshot.v1",
"status": "captured_readonly",
"tables": {
"tasks": {
"all_rows_sha256": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
"columns": [
"assignee",
"blocked_on",
"blocking_reason",
"created_at",
"decision_id",
"description",
"due_date",
"flavor",
"id",
"intervention_note",
"needs_human",
"parent_task_id",
"priority",
"record_id",
"status",
"title",
"updated_at",
"wait_until",
"workplan_id"
],
"row_count": 15,
"rows": [
{
"sha256": "sha256:89b3be69fbaf5ad60f5aefa6f2b630e1d6124e0fca7b01a5e9ce1ff41a451106",
"uuid": "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
},
{
"sha256": "sha256:3aa20e9695e110468d13baa3c813ac5b474896d89eeb6edc56e9ea00d9199fd7",
"uuid": "08233868-d522-4117-bc4e-6c0f52545665"
},
{
"sha256": "sha256:72fb54d9a271067a62f33377d56e0bb9e6874a3f9c475b9ae049609b93d1f643",
"uuid": "140da396-8e30-4f4d-b88c-c42c0cd46c01"
},
{
"sha256": "sha256:15198017e5c7d31b4e8ce1d5c0ef0de99ac1c50d3bffd0ea0ee807bef70ce5d1",
"uuid": "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
},
{
"sha256": "sha256:29a6f1e50db6a7b4ba5b98a2f7d8d109b4df1720fce58777c21f7538084f8cda",
"uuid": "3f042630-eab0-4c6a-9167-e2b28ff20e40"
},
{
"sha256": "sha256:2e00141f0d7382dd34859b686a500dc740a543efe81e23f5805754cbc6761f2e",
"uuid": "4526a842-ea31-4874-9231-92ab556cfe7b"
},
{
"sha256": "sha256:7b3ecacb7be3c1a24a100d7b732b7f60e1a99329a6847612264cd01d13c7ecf0",
"uuid": "5c3d40e4-239b-488e-9519-6f7a38d2325f"
},
{
"sha256": "sha256:71107455d1d453d69d65466ca66da1fd4ee4aa95ecdf7920b9acdce767f0c55c",
"uuid": "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
},
{
"sha256": "sha256:f8e44ea79125870ab3ade44afab8752c126c424e2b751f48b9fe555e00b5b708",
"uuid": "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
},
{
"sha256": "sha256:435e39ffee3a59eae3b890739a6ed8e06801fb23dead15073653d8650f9d5ff5",
"uuid": "a6313e06-1976-46a7-8e31-df4eb2eca880"
},
{
"sha256": "sha256:2fcda8440a166fc628f8fadf91a4a23ba7728ccac2e629248c6eccd00d5d4345",
"uuid": "ab166073-30a7-4702-a037-4091e8706e20"
},
{
"sha256": "sha256:b2e11b8fdc580e6cb7ec20c7e90018ba9fb468893b6eda5b9519dc68737a0ca0",
"uuid": "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
},
{
"sha256": "sha256:788862d9cc5015b927d27303585431a0db4af6077178ab3bfdde37f900cee821",
"uuid": "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
},
{
"sha256": "sha256:f7bc1f3acf187301430df0623417fb90b6af1869c0383a0bff9ec25f79ffe4af",
"uuid": "e8510646-46ed-4697-a345-f3d3009eea78"
},
{
"sha256": "sha256:f2760deded2f7136a60fba0156c4956ba373fbcf5eda986f5c380d7ee9c925ff",
"uuid": "f8e4a094-c367-40eb-b895-da17bc144b07"
}
]
},
"workplans": {
"all_rows_sha256": "sha256:1cd4e695c8f8da8bdb2335a8770a219f704f3989f14d28ebf0b1494f2458dc4a",
"columns": [
"backing_archived",
"backing_filename",
"backing_relative_path",
"backing_synced_at",
"concurrency_mode",
"created_at",
"derived_from_commit",
"description",
"due_date",
"execution_group",
"execution_state",
"flavor",
"flavor_promoted_from",
"flavor_promotion_reason",
"id",
"launch_mode",
"owner",
"planning_order",
"planning_priority",
"projection_retired_at",
"projection_retired_reason",
"queue_rank",
"repo_goal_id",
"repo_id",
"scheduled_for",
"slug",
"status",
"title",
"topic_id",
"updated_at"
],
"row_count": 3,
"rows": [
{
"sha256": "sha256:bfd3b3abe48d989b1c253d8cca57c463c40e63413885f467b3f3e2187d33cb49",
"uuid": "4c63dfc6-9eac-4e79-9f77-8f644ad7147d"
},
{
"sha256": "sha256:c3f19622843b62cea0fd987ed550fe8d050214a952f77f9250e1696506130303",
"uuid": "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
},
{
"sha256": "sha256:a406d311c2c0421eb7646edf4d215dbd96f570d07b2ba0bc6a747d7c573f0b9a",
"uuid": "7ee9ee22-1fae-4567-9194-8d70a9e0f45b"
}
]
}
}
}

View file

@ -0,0 +1,147 @@
{
"credential_values_exposed": false,
"historical_module_sha256": "sha256:e24e57c58f4aaa4ec9d9bf088009ac69006e53f75b9477ee53dc26c4e850b975",
"raw_rows_retained": false,
"schema": "state95.full-db-row-hash-snapshot.v1",
"status": "captured_readonly",
"tables": {
"tasks": {
"all_rows_sha256": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
"columns": [
"assignee",
"blocked_on",
"blocking_reason",
"created_at",
"decision_id",
"description",
"due_date",
"flavor",
"id",
"intervention_note",
"needs_human",
"parent_task_id",
"priority",
"record_id",
"status",
"title",
"updated_at",
"wait_until",
"workplan_id"
],
"row_count": 15,
"rows": [
{
"sha256": "sha256:89b3be69fbaf5ad60f5aefa6f2b630e1d6124e0fca7b01a5e9ce1ff41a451106",
"uuid": "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
},
{
"sha256": "sha256:3aa20e9695e110468d13baa3c813ac5b474896d89eeb6edc56e9ea00d9199fd7",
"uuid": "08233868-d522-4117-bc4e-6c0f52545665"
},
{
"sha256": "sha256:72fb54d9a271067a62f33377d56e0bb9e6874a3f9c475b9ae049609b93d1f643",
"uuid": "140da396-8e30-4f4d-b88c-c42c0cd46c01"
},
{
"sha256": "sha256:15198017e5c7d31b4e8ce1d5c0ef0de99ac1c50d3bffd0ea0ee807bef70ce5d1",
"uuid": "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
},
{
"sha256": "sha256:29a6f1e50db6a7b4ba5b98a2f7d8d109b4df1720fce58777c21f7538084f8cda",
"uuid": "3f042630-eab0-4c6a-9167-e2b28ff20e40"
},
{
"sha256": "sha256:2e00141f0d7382dd34859b686a500dc740a543efe81e23f5805754cbc6761f2e",
"uuid": "4526a842-ea31-4874-9231-92ab556cfe7b"
},
{
"sha256": "sha256:7b3ecacb7be3c1a24a100d7b732b7f60e1a99329a6847612264cd01d13c7ecf0",
"uuid": "5c3d40e4-239b-488e-9519-6f7a38d2325f"
},
{
"sha256": "sha256:71107455d1d453d69d65466ca66da1fd4ee4aa95ecdf7920b9acdce767f0c55c",
"uuid": "6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
},
{
"sha256": "sha256:f8e44ea79125870ab3ade44afab8752c126c424e2b751f48b9fe555e00b5b708",
"uuid": "7f9e0e58-a130-467a-a2d0-b3f2564e496f"
},
{
"sha256": "sha256:435e39ffee3a59eae3b890739a6ed8e06801fb23dead15073653d8650f9d5ff5",
"uuid": "a6313e06-1976-46a7-8e31-df4eb2eca880"
},
{
"sha256": "sha256:2fcda8440a166fc628f8fadf91a4a23ba7728ccac2e629248c6eccd00d5d4345",
"uuid": "ab166073-30a7-4702-a037-4091e8706e20"
},
{
"sha256": "sha256:b2e11b8fdc580e6cb7ec20c7e90018ba9fb468893b6eda5b9519dc68737a0ca0",
"uuid": "d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
},
{
"sha256": "sha256:788862d9cc5015b927d27303585431a0db4af6077178ab3bfdde37f900cee821",
"uuid": "dab2c07f-8aa0-4635-8df6-857e87e93fc5"
},
{
"sha256": "sha256:f7bc1f3acf187301430df0623417fb90b6af1869c0383a0bff9ec25f79ffe4af",
"uuid": "e8510646-46ed-4697-a345-f3d3009eea78"
},
{
"sha256": "sha256:f2760deded2f7136a60fba0156c4956ba373fbcf5eda986f5c380d7ee9c925ff",
"uuid": "f8e4a094-c367-40eb-b895-da17bc144b07"
}
]
},
"workplans": {
"all_rows_sha256": "sha256:1cd4e695c8f8da8bdb2335a8770a219f704f3989f14d28ebf0b1494f2458dc4a",
"columns": [
"backing_archived",
"backing_filename",
"backing_relative_path",
"backing_synced_at",
"concurrency_mode",
"created_at",
"derived_from_commit",
"description",
"due_date",
"execution_group",
"execution_state",
"flavor",
"flavor_promoted_from",
"flavor_promotion_reason",
"id",
"launch_mode",
"owner",
"planning_order",
"planning_priority",
"projection_retired_at",
"projection_retired_reason",
"queue_rank",
"repo_goal_id",
"repo_id",
"scheduled_for",
"slug",
"status",
"title",
"topic_id",
"updated_at"
],
"row_count": 3,
"rows": [
{
"sha256": "sha256:bfd3b3abe48d989b1c253d8cca57c463c40e63413885f467b3f3e2187d33cb49",
"uuid": "4c63dfc6-9eac-4e79-9f77-8f644ad7147d"
},
{
"sha256": "sha256:c3f19622843b62cea0fd987ed550fe8d050214a952f77f9250e1696506130303",
"uuid": "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
},
{
"sha256": "sha256:a406d311c2c0421eb7646edf4d215dbd96f570d07b2ba0bc6a747d7c573f0b9a",
"uuid": "7ee9ee22-1fae-4567-9194-8d70a9e0f45b"
}
]
}
},
"current_baseline_equal": true
}

View file

@ -0,0 +1,6 @@
{
"exit_code": 0,
"returned_at": "2026-10-17T01:53:28.489168+00:00",
"raw_helm_output_retained": false,
"recovery_required": false
}

View file

@ -0,0 +1,34 @@
{
"schema": "state95.approved-job-observation.v1",
"mutation": false,
"started_at": "2026-10-17T01:52:59.690085+00:00",
"jobs": {
"99ebab16-f0e7-49ac-8db3-b3b34f7331df": {
"uid": "99ebab16-f0e7-49ac-8db3-b3b34f7331df",
"name": "state-hub-migrate",
"created_at": "2026-10-17T01:53:02Z",
"image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
"managed_by": "Helm",
"release": "state-hub",
"hook": "pre-install,pre-upgrade",
"pods": {
"38fa8c07-e688-4838-a079-42fe15e5309a": {
"name": "state-hub-migrate-vq7jf",
"uid": "38fa8c07-e688-4838-a079-42fe15e5309a",
"owner_job_uid": "99ebab16-f0e7-49ac-8db3-b3b34f7331df",
"pod_ip": "10.42.0.58",
"phase": "Succeeded"
}
},
"last_status": {
"active": 1,
"succeeded": null,
"failed": null
}
}
},
"poll_failures": 0,
"job_absent_after_observation": true,
"helm_return_observed": true,
"ended_at": "2026-10-17T01:53:28.735886+00:00"
}

View file

@ -0,0 +1,81 @@
{
"after_full_row_hashes": {
"tasks": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
"workplans": "sha256:2636d0a3e0ac6a3fe4e599b47f67b0b5dde6abfcb8da1ab5df446fe5ebe69d85"
},
"before_full_row_hashes": {
"tasks": "sha256:7f42dea1cabd2f5802aab5e2b1535a530192a1f35721ca1ca2cddc2fb5319cc9",
"workplans": "sha256:2636d0a3e0ac6a3fe4e599b47f67b0b5dde6abfcb8da1ab5df446fe5ebe69d85"
},
"cases": {
"foreign-holder-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"foreign-repo-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"invalid-last-binding-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"invalid-path-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"missing-task-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"nonterminal-parent-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"nonterminal-task-mixed": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "refused",
"rolled_back": true,
"status": "passed"
},
"preserve-three": {
"commit_attempts": 0,
"full_rows_restored": true,
"outcome": "preserved",
"rolled_back": true,
"status": "passed"
}
},
"commit_interception_enforced": true,
"commits_performed": 0,
"fresh_transaction_full_rows_equal": true,
"historical_parents": 3,
"historical_tasks": 15,
"limits": [
"No claim of restoring pre-legacy-refresh parent preimages.",
"Missing actual parent/repo rows and full concurrent-writer behavior remain source-test coverage, not claimed as these native cases."
],
"ordinary_parent_also_preserved": true,
"raw_rows_or_credentials_retained": false,
"schema": "state95.native-guard-probes.v1",
"status": "passed"
}

View file

@ -0,0 +1,304 @@
{
"schema": "custodian.rollout-owner-bindings.v1",
"status": "verified",
"primary": "primary/railiance01",
"task_bindings": 26,
"rows": [
{
"repo": "state-hub",
"workplan_id": "STATE-WP-0095",
"commit": "200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a",
"remote_exact": true,
"source_sha256": "31bea1d5b54f9f6e5bc01d11d271c3a86ac76389350b467ba568b9dc93e41c61",
"status": "finished",
"tasks": [
{
"id": "2dd9b04f-2250-5a8a-b5bc-c8a009872858",
"record_id": "STATE-WP-0095-T08",
"status": "done",
"needs_human": false
},
{
"id": "339b9a37-181c-5599-9a89-0393e199bd4b",
"record_id": "STATE-WP-0095-T05",
"status": "done",
"needs_human": false
},
{
"id": "3bbb311f-194e-5862-8aed-358a580f22b4",
"record_id": "STATE-WP-0095-T04",
"status": "done",
"needs_human": false
},
{
"id": "6a5f87bb-e63d-5e20-b9fc-c1b5cd403ff7",
"record_id": "STATE-WP-0095-T01",
"status": "done",
"needs_human": false
},
{
"id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
"record_id": "STATE-WP-0095-T06",
"status": "done",
"needs_human": false
},
{
"id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
"record_id": "STATE-WP-0095-T10",
"status": "done",
"needs_human": false
},
{
"id": "8be8f13b-6352-5295-9755-de6fbfb13593",
"record_id": "STATE-WP-0095-T09",
"status": "done",
"needs_human": false
},
{
"id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
"record_id": "STATE-WP-0095-T07",
"status": "done",
"needs_human": false
},
{
"id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
"record_id": "STATE-WP-0095-T03",
"status": "done",
"needs_human": false
},
{
"id": "ebb24194-e4cc-5130-aaa6-663f2ea2c822",
"record_id": "STATE-WP-0095-T02",
"status": "done",
"needs_human": false
}
],
"projected_edges": [],
"unprojected_source_declarations": [
{
"from_task_id": "3bbb311f-194e-5862-8aed-358a580f22b4",
"to_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"relationship_type": "starts_after"
},
{
"from_task_id": "3bbb311f-194e-5862-8aed-358a580f22b4",
"to_task_id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
"relationship_type": "starts_after"
},
{
"from_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
"to_task_id": "339b9a37-181c-5599-9a89-0393e199bd4b",
"relationship_type": "starts_after"
},
{
"from_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
"to_task_id": "8be8f13b-6352-5295-9755-de6fbfb13593",
"relationship_type": "starts_after"
},
{
"from_task_id": "8be8f13b-6352-5295-9755-de6fbfb13593",
"to_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
"relationship_type": "starts_after"
},
{
"from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
"to_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"relationship_type": "starts_after"
},
{
"from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
"to_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
"relationship_type": "starts_after"
},
{
"from_task_id": "cfd1ea99-e75b-542e-a434-acefb62f3c7d",
"to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
"relationship_type": "starts_after"
},
{
"from_task_id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
"to_task_id": "ebb24194-e4cc-5130-aaa6-663f2ea2c822",
"relationship_type": "starts_after"
}
]
},
{
"repo": "repo-manager",
"workplan_id": "RMGR-WP-0019",
"commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
"remote_exact": true,
"source_sha256": "189372458e1b072451eb64333e38f849835c16dba5bb69deed2a17794644986d",
"status": "finished",
"tasks": [
{
"id": "1ccb06c6-ad30-5847-8704-e5628ba81f35",
"record_id": "RMGR-WP-0019-T04",
"status": "done",
"needs_human": false
},
{
"id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"record_id": "RMGR-WP-0019-T05",
"status": "done",
"needs_human": false
},
{
"id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"record_id": "RMGR-WP-0019-T06",
"status": "done",
"needs_human": false
},
{
"id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"record_id": "RMGR-WP-0019-T03",
"status": "done",
"needs_human": false
},
{
"id": "95240c81-1805-5365-9b35-d238621a16bf",
"record_id": "RMGR-WP-0019-T02",
"status": "done",
"needs_human": false
},
{
"id": "d78a622e-39f9-5923-b4e1-f70fdc17fb42",
"record_id": "RMGR-WP-0019-T01",
"status": "done",
"needs_human": false
}
],
"projected_edges": [
{
"from_task_id": "682eea14-a4a8-5f33-9a9f-8f2f1ac8288d",
"to_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"relationship_type": "starts_after"
}
],
"unprojected_source_declarations": [
{
"from_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"to_task_id": "6af973b4-1964-5d4d-a2f8-8dbd4c01fda4",
"relationship_type": "starts_after"
},
{
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_task_id": "36f47e21-42d0-5aef-b065-4a5dd3af0726",
"relationship_type": "starts_after"
},
{
"from_task_id": "4d1675b6-f49f-5b01-8d76-bbf2030d1b34",
"to_task_id": "88585c69-d9b9-5e1f-a256-6416ff71e824",
"relationship_type": "starts_after"
},
{
"from_task_id": "95240c81-1805-5365-9b35-d238621a16bf",
"to_task_id": "e8566341-cf6e-5b9c-ad80-8564d14cd52a",
"relationship_type": "starts_after"
}
]
},
{
"repo": "repo-manager",
"workplan_id": "RMGR-WP-0021",
"commit": "3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
"remote_exact": true,
"source_sha256": "966d15ccdabc8edf98bc58f9422ea190566d05fe4208f4749f59a9731f4e108d",
"status": "active",
"tasks": [
{
"id": "0ab44bd9-00d8-5470-ad45-7350e7868d0a",
"record_id": "RMGR-WP-0021-T03",
"status": "progress",
"needs_human": false
},
{
"id": "25fbe694-41d8-5232-bce0-4ed362387d5a",
"record_id": "RMGR-WP-0021-T05",
"status": "done",
"needs_human": false
},
{
"id": "44272818-db49-58a2-83b1-d2f9e9d5976c",
"record_id": "RMGR-WP-0021-T04",
"status": "todo",
"needs_human": false
},
{
"id": "d3d20c18-5a5f-5f8a-b5c4-a22b4b662ebe",
"record_id": "RMGR-WP-0021-T01",
"status": "done",
"needs_human": false
},
{
"id": "e27817e6-b298-581f-b99a-05ec459be749",
"record_id": "RMGR-WP-0021-T02",
"status": "done",
"needs_human": false
}
],
"projected_edges": [],
"unprojected_source_declarations": []
},
{
"repo": "railiance-cluster",
"workplan_id": "RCLUSTER-WP-0018",
"commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
"remote_exact": true,
"source_sha256": "96d52b6dbae056399159632d50b32ccc6662e4f6d3677af154f7c8a3d618334b",
"status": "active",
"tasks": [
{
"id": "021b07bb-65bc-5743-bac5-4294b4be74f6",
"record_id": "RCLUSTER-WP-0018-T04",
"status": "wait",
"needs_human": true
},
{
"id": "5bc67a22-0991-5625-86a6-f749560d8a0e",
"record_id": "RCLUSTER-WP-0018-T05",
"status": "todo",
"needs_human": false
},
{
"id": "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a",
"record_id": "RCLUSTER-WP-0018-T03",
"status": "wait",
"needs_human": false
},
{
"id": "7280193d-0d59-5b78-a2d3-96ebd127127f",
"record_id": "RCLUSTER-WP-0018-T01",
"status": "done",
"needs_human": false
},
{
"id": "90836435-917f-504c-a711-3f29ece348e3",
"record_id": "RCLUSTER-WP-0018-T02",
"status": "todo",
"needs_human": false
}
],
"projected_edges": [
{
"from_task_id": "021b07bb-65bc-5743-bac5-4294b4be74f6",
"to_task_id": "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a",
"relationship_type": "starts_after"
},
{
"from_task_id": "021b07bb-65bc-5743-bac5-4294b4be74f6",
"to_task_id": "90836435-917f-504c-a711-3f29ece348e3",
"relationship_type": "starts_after"
},
{
"from_task_id": "5dfa9a3a-2639-5cf6-b0a4-13eef417d47a",
"to_task_id": "90836435-917f-504c-a711-3f29ece348e3",
"relationship_type": "starts_after"
}
],
"unprojected_source_declarations": []
}
],
"runtime_deployed_source": "c103cbf3c8bed5dba87a03e320595ddded9301a3",
"helm_revision": 77,
"native_target_gates_closed": 0
}

View file

@ -0,0 +1,26 @@
[
[
"state-hub",
"STATE-WP-0095",
"200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a",
10
],
[
"repo-manager",
"RMGR-WP-0019",
"3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
6
],
[
"repo-manager",
"RMGR-WP-0021",
"3bcb1e1cf3e58b263f690534f7f28024d75cdbf6",
5
],
[
"railiance-cluster",
"RCLUSTER-WP-0018",
"6ae3f847c83da3402883453ee7110457bfb2d0d6",
5
]
]

View file

@ -0,0 +1,168 @@
{
"schema": "custodian.scoped-runtime-checkpoint.v1",
"base_commit": "b17e753efc8022fd482e3b2169ba3a604e4bb526",
"approved_executed_proposal_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"runtime_return_sha256": "09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a",
"files": [
{
"path": ".kaizen/agents/custodian-codex/supervision.json",
"sha256": "4a4b0e61df23f1499916c04d85e61c558df810f43f485abf84792acfbbb66016",
"bytes": 80030
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json",
"sha256": "f7b12514c52f815854c5bcda8b41fdfef34ee8488c8d4ec779cfc41ae6493d7e",
"bytes": 2249
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/check_live.py",
"sha256": "f099a44ae5781d9c626c3875db4032bf1d8f2f058be859130a21fe9d0536ea32",
"bytes": 6292
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/coordination-receipt.json",
"sha256": "16228c4a915bb23e0ab16c2cf7a5f9db1a5fa54785d1baa39a9b8b9b771d94ca",
"bytes": 1821
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execute.py",
"sha256": "9f9a43f6d6441bc15782ebb9f912590a729af023bee4c60598241f8fad03757a",
"bytes": 4750
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json",
"sha256": "b772cb147a2ee18eecfa39fc8eda0fe92b6cec35a1f302bbe3da024ae6e06d5c",
"bytes": 957
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json",
"sha256": "a296873b93c18a31068f1c41c3600d681c2829c00fb6fb458ce6faa5f3718c27",
"bytes": 698
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json",
"sha256": "2bfb02130876aeb71a773585dae8b446ad5c671050ebc14d0fc7bcce86dffea5",
"bytes": 5916
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json",
"sha256": "95995c0184c707238d531d5113ae3798ef66051a507bf5a0b70af2966900b217",
"bytes": 643
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json",
"sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf",
"bytes": 4973
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json",
"sha256": "bd6f1629bc44858dd914ae33c94e72ef4cbd1893c1ff164c5bbf27db02d1d3b8",
"bytes": 4939
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json",
"sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf",
"bytes": 4973
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json",
"sha256": "af4d48460996dadb460f9a01a33fc6b06dfcd762b36a34dbac078a758ea94ac6",
"bytes": 141
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json",
"sha256": "dc2d959cdcc342395fc53a2e316f6d95b650d6526343a7b07eb8fdc90570c12a",
"bytes": 1136
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json",
"sha256": "682cc03c42af5b9be1046390b2f50b83b3e5cad6fb2f89d51740a768706e8489",
"bytes": 2423
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-bindings.json",
"sha256": "aa545a86b66a8c455ecd553af0293306b05e69c8be4b114b11a3463c33ca0ba9",
"bytes": 9887
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/owner-heads.json",
"sha256": "8d166a4a518e5b7c24f3e98bcd0c50797d896d188d2d731ac5065c6280bbee91",
"bytes": 423
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/publish_checkpoint.py",
"sha256": "763fac660cf2f2f1cc5e937f751ba99662595631fbc1bcf55309073779c7caa7",
"bytes": 2238
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/run_maintenance.py",
"sha256": "02a1728772d5c8a6f50a5e0087de74de0e3a9818719bd8ba92042930980d8da8",
"bytes": 3777
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json",
"sha256": "4da5d5b9eedd5338c58d692a0c6918a6b4a2a46cca98e0b0303bd250d2a6b8a7",
"bytes": 1130
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json",
"sha256": "55ab3a40f06ca07299d346f5d060509e0a25ddad88b849fb48e504c987328ba1",
"bytes": 1133
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json",
"sha256": "bd9a555826f65279163a3f8efc346b5b8af82e43824780302eb3617632395eea",
"bytes": 189
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/sync_custodian.py",
"sha256": "a22c0d6fc2b8e5a6524958817b7ec44dc51288dbed3a6ec6fe8c79785bb2816e",
"bytes": 1791
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json",
"sha256": "fd8a7d58d9e08b4866420ad77d01fbc7c28c0c2c9610ffbe95ddc77dddd9b1a6",
"bytes": 22953
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json",
"sha256": "f737ff91b75362ee367441d2fdeb83eed83208d222f592f2942ad62b19bc7b06",
"bytes": 7691
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json",
"sha256": "0745b5df92d2533714e2a87a43c73b3b685e7bab7bcf4444f7a5fbd82dd4722f",
"bytes": 183
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json",
"sha256": "09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a",
"bytes": 4968
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_close.py",
"sha256": "063d711568856163ec8bf4283dec2274238ebce49125dfb6c1d86cebdc62b896",
"bytes": 4263
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verify_owner_bindings.py",
"sha256": "aa9ca68b3c0a0922d91f40bd5d4aca77a3f27fa4fdb7e84860981bc287d9adb8",
"bytes": 3789
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/watch_rollout.py",
"sha256": "a496da3c9a415ac800921ce755446be4bb55bc17e4e6b913143a5d6baf48f815",
"bytes": 3274
},
{
"path": "docs/netkingdom-target-implementation.md",
"sha256": "02ee43e554f05ad0376271531b4de0699fdb64f97b5b839184eb50283703ba0f",
"bytes": 68162
},
{
"path": "workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md",
"sha256": "d8723566dbdfd8140b89d7e12ba2aeabf3fdf704b501dd899ab056e440981536",
"bytes": 75594
}
]
}

View file

@ -0,0 +1,42 @@
"""Publish the exact reviewed runtime-return checkpoint through normal hooks."""
from pathlib import Path
import hashlib
import json
import subprocess
ROOT = Path('/home/worsch/the-custodian')
BASE = Path(__file__).resolve().parent
BACKUP = BASE.parent / 'custodian-publication-backup'
OLD = 'b17e753efc8022fd482e3b2169ba3a604e4bb526'
def git(*args):
return subprocess.check_output(['git', '-C', str(ROOT), *args], stderr=subprocess.PIPE)
def preserve():
for name, entry in json.loads((BACKUP / 'originals.json').read_text()).items():
assert (ROOT / name).read_bytes() == (BACKUP / (name + '.worktree')).read_bytes()
assert git('ls-files', '--stage', '--', name).decode() == entry
assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin
for name, pin in json.loads((BACKUP / 'other-dirty-hashes.json').read_text()).items())
assert git('rev-parse', 'HEAD').decode().strip() == OLD
preserve()
manifest = json.loads((BASE / 'publication-inputs.json').read_text())
paths = [r['path'] for r in manifest['files']] + [str((BASE / 'publication-inputs.json').relative_to(ROOT))]
for r in manifest['files']:
assert hashlib.sha256((ROOT / r['path']).read_bytes()).hexdigest() == r['sha256']
git('add', '--', *paths)
result = subprocess.run(['git', '-C', str(ROOT), 'commit', '--only', '-m',
'Record approved API guard delivery and completed owner returns', '--', *paths],
capture_output=True, text=True, timeout=240)
head = git('rev-parse', 'HEAD').decode().strip()
receipt = {'status': 'committed' if result.returncode == 0 else 'commit-refused',
'commit': head, 'exit_code': result.returncode, 'paths': paths,
'stdout': result.stdout, 'stderr': result.stderr, 'unrelated_work_preserved': True}
(BASE / 'publication-commit.json').write_text(json.dumps(receipt, indent=2) + '\n')
preserve()
print(json.dumps({'status': receipt['status'], 'commit': head, 'paths': len(paths),
'unrelated_work_preserved': True}))
assert result.returncode == 0
sync = subprocess.run(['python3', str(BASE / 'sync_custodian.py')], timeout=510)
assert sync.returncode == 0, 'required-sync-failed-receipts-retained'

View file

@ -0,0 +1,40 @@
"""Run authorized normal Cluster maintenance with exact client source and retained baseline."""
from pathlib import Path
import hashlib,json,subprocess
here=Path(__file__).resolve().parent;source=here.parent;root=Path('/home/worsch/railiance-cluster')
packet=source.parent/'netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r6'
manifest=json.loads((packet/'manifest.json').read_text())
for name in ['scripts/consistency_check.py']:
pin=next(x['candidate_sha256'] for x in manifest['files'] if x['path']==name)
assert hashlib.sha256((Path('/home/worsch/state-hub')/name).read_bytes()).hexdigest()==pin,'fixed-client-source-drift'
assert json.loads((here/'full-rows-before.json').read_text())['status']=='captured_readonly'
# Verify the installed entrypoint's actual packaged checker, not just checkout bytes.
probe=subprocess.run(['/home/worsch/state-hub/.venv/bin/python','-c',"import custodian_cli,hashlib,json; p=custodian_cli.STATE_HUB_DIR/'scripts/consistency_check.py'; print(json.dumps({'path':str(p),'sha256':hashlib.sha256(p.read_bytes()).hexdigest()}))"],cwd=root,capture_output=True,text=True,timeout=10)
assert probe.returncode==0;loaded=json.loads(probe.stdout);assert loaded['sha256']==next(x['candidate_sha256'] for x in manifest['files'] if x['path']=='scripts/consistency_check.py')
(here/'verified-loaded-client.json').write_text(json.dumps(loaded,indent=2)+'\n')
baseline_head=subprocess.check_output(['git','-C',str(root),'rev-parse','HEAD'],text=True).strip();assert baseline_head=='6ae3f847c83da3402883453ee7110457bfb2d0d6'
backup=source/'railiance-cluster-publication-backup';originals=json.loads((backup/'originals.json').read_text())
def git(*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE)
for name,index in originals.items():
assert (root/name).read_bytes()==(backup/(name+'.worktree')).read_bytes()
assert git('ls-files','--stage','--',name).decode()==index
# Shield original staged generated content from any legacy writeback index.
for name in originals:
raw=git('ls-tree','HEAD','--',name).decode().split();git('update-index','--cacheinfo',raw[0],raw[2],name)
try:
for label,argv,limit in [('verified-client-cluster-consistency',['statehub','fix-consistency','--repo','railiance-cluster','--json'],300),('verified-client-cluster-projection',['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(root),'--push'],180)]:
r=subprocess.run(argv,cwd=root,capture_output=True,text=True,timeout=limit)
(here/(label+'.json')).write_text(r.stdout);(here/(label+'.stderr.txt')).write_text(r.stderr)
assert r.returncode==0,label+'-refused-receipt-retained'
finally:
for name,index in originals.items():
(root/name).write_bytes((backup/(name+'.worktree')).read_bytes())
mode,oid,stage,path=index.split();assert stage=='0';git('update-index','--cacheinfo',mode,oid,path)
assert git('ls-files','--stage','--',name).decode()==index
c=json.loads((here/'verified-client-cluster-consistency.json').read_text());assert c['summary']['fail']==c['summary']['automation_error']==0
assert 'bindings: synced 20/20' in c['fixes_applied'],'frozen-binding-omission-not-observed'
p=json.loads((here/'verified-client-cluster-projection.json').read_text());assert p['status']=='applied'
assert p['commit']==p['receipt']['expected_commit']==p['receipt']['derived_commit']==baseline_head
assert p['receipt']['instance_role']=='primary' and p['receipt']['instance_label']=='railiance01'
assert not p['receipt']['outcome']['refused'] and not p['receipt']['outcome']['retired']
print(json.dumps({'status':'applied','commit':p['commit'],'fixed_client_source_verified':True,'current_hash_comparison':'pending','original_failed_comparison_retained':True,'unrelated_work_preserved':True}))

View file

@ -0,0 +1,37 @@
{
"status": "verified",
"observed_at": "2026-10-17T01:53:39.422129+00:00",
"helm_revision": 77,
"target": "railiance01/92.205.62.239",
"deployments": [
{
"deployment": "state-hub",
"ready": true,
"image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
"pod": {
"name": "state-hub-6c5b9c676-8chmx",
"uid": "a035f7fe-4887-40ab-89a4-3930579073f9"
}
},
{
"deployment": "state-hub-mcp",
"ready": true,
"image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
"pod": {
"name": "state-hub-mcp-b955b86b4-x849p",
"uid": "6641c962-6a74-4019-af66-57d1dee93d21"
}
}
],
"api_pod": {
"name": "state-hub-6c5b9c676-8chmx",
"uid": "a035f7fe-4887-40ab-89a4-3930579073f9"
},
"schema": {
"status": "ok",
"applied": "c4d5e6f7a8b9",
"expected": "c4d5e6f7a8b9"
},
"migration_job_and_pods_absent": true,
"primary": "primary/railiance01"
}

View file

@ -0,0 +1,37 @@
{
"status": "verified",
"observed_at": "2026-10-17T01:52:15.321571+00:00",
"helm_revision": 76,
"target": "railiance01/92.205.62.239",
"deployments": [
{
"deployment": "state-hub",
"ready": true,
"image": "forgejo.coulomb.social/coulomb/state-hub:main-51bc70d@sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015",
"pod": {
"name": "state-hub-65958bd89d-zcmbz",
"uid": "77173cfd-14a9-4e30-a26e-08f8a8fbb369"
}
},
{
"deployment": "state-hub-mcp",
"ready": true,
"image": "forgejo.coulomb.social/coulomb/state-hub:main-51bc70d@sha256:c802690ee1811b3d77df4077936f9cdced1385514e8673fcbc9232b84d645015",
"pod": {
"name": "state-hub-mcp-76fcddf67d-2c9p7",
"uid": "5231c231-437c-44e3-b0ed-12517087b48f"
}
}
],
"api_pod": {
"name": "state-hub-65958bd89d-zcmbz",
"uid": "77173cfd-14a9-4e30-a26e-08f8a8fbb369"
},
"schema": {
"status": "ok",
"applied": "c4d5e6f7a8b9",
"expected": "c4d5e6f7a8b9"
},
"migration_job_and_pods_absent": true,
"primary": "primary/railiance01"
}

View file

@ -0,0 +1,6 @@
{
"status": "removed-exact-owned-staging",
"archive_sha256": "b5c0663d830fc8d3b65080f237a0be8d01f8b2f7fec9dc33aeba91b1b6b281d4",
"directory_absent": true,
"broad_deletion": false
}

View file

@ -0,0 +1,33 @@
"""Required consistency/projection with exact restoration of unrelated work."""
from pathlib import Path
import hashlib
import json
import subprocess
ROOT = Path('/home/worsch/the-custodian')
BASE = Path(__file__).resolve().parent
BACKUP = BASE.parent / 'custodian-publication-backup'
originals = json.loads((BACKUP / 'originals.json').read_text())
other = json.loads((BACKUP / 'other-dirty-hashes.json').read_text())
def git(*argv):
return subprocess.check_output(['git', '-C', str(ROOT), *argv], stderr=subprocess.PIPE)
try:
for label, argv, timeout in [
('consistency', ['statehub', 'fix-consistency', '--repo', 'the-custodian', '--json'], 300),
('projection', ['/home/worsch/repo-manager/.venv/bin/rmgr', 'sync', '--path', str(ROOT), '--push'], 180),
]:
result = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, timeout=timeout)
(BASE / ('guard-custodian-' + label + '.json')).write_text(result.stdout)
(BASE / ('guard-custodian-' + label + '.stderr.txt')).write_text(result.stderr)
assert result.returncode == 0, label + ' failed; receipt retained'
finally:
for name, entry in originals.items():
(ROOT / name).write_bytes((BACKUP / (name + '.worktree')).read_bytes())
mode, oid, stage, path = entry.split()
assert stage == '0'
git('update-index', '--cacheinfo', mode, oid, path)
assert git('ls-files', '--stage', '--', name).decode() == entry
assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin for name, pin in other.items())
receipt = json.loads((BASE / 'guard-custodian-projection.json').read_text())
assert receipt['status'] == 'applied'
print(json.dumps({'status': 'applied', 'commit': receipt['commit'], 'other_work_preserved': True}))

View file

@ -0,0 +1,531 @@
{
"repo_slug": "railiance-cluster",
"repo_path": "/home/worsch/railiance-cluster",
"source_revision": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
"source_revision_reason": null,
"issues": [
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager warning: .repo-classification.yaml: category is project but slug is not prj-*; not every category:project is a prj- repo",
"file_path": ".repo-classification.yaml",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1: task id 'T01' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2: task id 'T02' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3: task id 'T03' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4: task id 'T04' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5: task id 'T05' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1: task id 'T01' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2: task id 'T02' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3: task id 'T03' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4: task id 'T04' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1: task id 'T01' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2: task id 'T02' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3: task id 'T03' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4: task id 'T04' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5: task id 'T05' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6: task id 'T06' is not accepted by the canon kind registry",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1: task 'T01' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1']",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2: task 'T02' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2']",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3: task 'T03' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3']",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4: task 'T04' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4', 'workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4']",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-35",
"message": "Repo Manager contradictory: workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5: task 'T05' has conflicting UUID assignments at ['workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5', 'workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5']",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-33",
"message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)",
"file_path": "WORK-RECORDS.md",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": true
},
{
"severity": "WARN",
"check_id": "C-39",
"message": "Human wait task 'RCLUSTER-WP-0018-T04' in workplan 'RCLUSTER-WP-0018' has needs_human: true without decision_id \u2014 unrouted human gate",
"file_path": "workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md#RCLUSTER-WP-0018-T04",
"db_id": "",
"file_value": "needs_human: true",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'rail-bs-wp-0008-activity-core-wp0016-triage-output-deploy@retired-20260828' (id=f2ca1a5d\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "f2ca1a5d-4dd6-42ea-8003-969c7265f891",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'rail-bs-wp-0009-activity-core-admin-sync-smoke@retired-20260828' (id=366eec46\u2026, status=archived) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "366eec46-3139-4810-ace6-ea75750fe821",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Closed DB workstream 'rail-bs-wp-0008' (id=5032c55c\u2026, status=finished) has no backing workplan file",
"file_path": "",
"db_id": "5032c55c-2ee2-4b7e-b1eb-157f0f8ac647",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0014@retired-20260826' (id=a152ddda\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "a152ddda-d60a-4a65-9b9c-59e2db9ff2b7",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0012@retired-20260826' (id=6434f7cb\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "6434f7cb-e13c-4c05-839b-197bb239d5cd",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'railiance-wp-0013@retired-20260826' (id=a3abb83a\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "a3abb83a-2d42-40f9-a5f6-1dbc36903436",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'rail-bs-rcluster-wp-adhoc-2026-07-27@retired-20260828' (id=b37f3c6e\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "b37f3c6e-a9e5-58c2-84ec-77ef2a2978a7",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "INFO",
"check_id": "C-08",
"message": "Retired DB workstream 'rail-bs-adhoc-2026-07-27@retired-20260828' (id=9a77bc91\u2026, status=finished) has no backing workplan file \u2014 projection tombstone, not live work",
"file_path": "",
"db_id": "9a77bc91-f457-5545-996f-04f49707f54b",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "8 unread inbox message(s) older than 3 day(s): railiance-platform:0c1023ce, railiance-platform:f643ce05, prj-forgejo-org-refactor:be06609c, prj-forgejo-org-refactor:6eac8c3f, prj-forgejo-org-refactor:82225aca, ...",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-28",
"message": "8 unread message(s) lack thread_id for supersession tracking: railiance-platform:0c1023ce, railiance-platform:f643ce05, prj-forgejo-org-refactor:be06609c, prj-forgejo-org-refactor:6eac8c3f, prj-forgejo-org-refactor:82225aca",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-29",
"message": "Unread work request from railiance-platform (f643ce05) may need a workplan file: RPF56: implement native JWT consumer-group mapping for Playwright",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-29",
"message": "Unread work request from the-custodian (a1368d99) may need a workplan file: Workplan 'three-phoenix-ha-cluster' is blocked with no wait task",
"file_path": "",
"db_id": "",
"file_value": "",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0007' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/RCLUSTER-WP-0007-threephoenix-ha-cluster.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0007",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0014' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/RCLUSTER-WP-0014-capacity-utilization-and-allocation-evidence.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0014",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0016' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0016",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0017' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0017",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0018' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0018",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0001' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/archived/260622-RCLUSTER-WP-0001-activity-core-cluster-owned-deploy-verify.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0001",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0002' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/archived/260622-RCLUSTER-WP-0002-activity-core-verifier-evidence-hardening.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0002",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-26",
"message": "Workplan id 'RCLUSTER-WP-0003' uses prefix 'RCLUSTER-WP' but repo canonical prefix is 'RAIL-BS-WP' \u2014 new plans must conform",
"file_path": "workplans/archived/260701-RCLUSTER-WP-0003-activity-core-llm-connect-live-reconcile.md",
"db_id": "",
"file_value": "RCLUSTER-WP-0003",
"db_value": "RAIL-BS-WP",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0008' collides across repos: railiance-bootstrap/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md, railiance-cluster/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md",
"file_path": "workplans/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0008",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0009' collides across repos: railiance-bootstrap/RAIL-BS-WP-0009-activity-core-admin-sync-smoke.md, railiance-cluster/RAIL-BS-WP-0009-activity-core-admin-sync-smoke.md",
"file_path": "workplans/RAIL-BS-WP-0009-activity-core-admin-sync-smoke.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0009",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0001' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0001-dependency-management.md, railiance-cluster/260622-RAIL-BS-WP-0001-dependency-management.md",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0001-dependency-management.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0001",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0002' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0002-k3s-baseline.md, railiance-cluster/260622-RAIL-BS-WP-0002-k3s-baseline.md",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0002",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0003' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md, railiance-cluster/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0003",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0004' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0004-safety-net.md, railiance-cluster/260622-RAIL-BS-WP-0004-safety-net.md",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0004",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0005' collides across repos: railiance-bootstrap/260622-RAIL-BS-WP-0005-kubeconfig-delivery.md, railiance-cluster/260622-RAIL-BS-WP-0005-kubeconfig-delivery.md",
"file_path": "workplans/archived/260622-RAIL-BS-WP-0005-kubeconfig-delivery.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0005",
"db_value": "",
"fixable": false
},
{
"severity": "WARN",
"check_id": "C-27",
"message": "Workplan id 'RAIL-BS-WP-0006' collides across repos: railiance-bootstrap/260627-RAIL-BS-WP-0006-staged-promotion-lifecycle.md, railiance-cluster/260627-RAIL-BS-WP-0006-staged-promotion-lifecycle.md",
"file_path": "workplans/archived/260627-RAIL-BS-WP-0006-staged-promotion-lifecycle.md",
"db_id": "",
"file_value": "RAIL-BS-WP-0006",
"db_value": "",
"fixable": false
}
],
"fixes_applied": [
"bindings: synced 20/20",
"C-33 fixed: regenerated WORK-RECORDS.md",
"brief: .custodian-brief.md updated",
"push: pushed"
],
"summary": {
"fail": 0,
"automation_error": 0,
"warn": 43,
"info": 8
},
"result": "warn"
}

View file

@ -0,0 +1,246 @@
{
"ok": true,
"status": "applied",
"repo_slug": "railiance-cluster",
"commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
"requests": 2,
"elapsed_ms": 1555.4,
"git": {
"upstream": "origin/main",
"behind": 0,
"ahead": 0
},
"identifiers": {
"schema": "repo-manager.identifier-assignment.v1",
"ok": true,
"executed": true,
"repo": "railiance-cluster",
"namespace": "helixforge",
"assignments": [],
"historical_invalid_identifiers": [
{
"kind": "task",
"id": "T01",
"source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1"
},
{
"kind": "task",
"id": "T02",
"source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2"
},
{
"kind": "task",
"id": "T03",
"source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3"
},
{
"kind": "task",
"id": "T04",
"source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4"
},
{
"kind": "task",
"id": "T05",
"source": "workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5"
},
{
"kind": "task",
"id": "T01",
"source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1"
},
{
"kind": "task",
"id": "T02",
"source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2"
},
{
"kind": "task",
"id": "T03",
"source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3"
},
{
"kind": "task",
"id": "T04",
"source": "workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4"
},
{
"kind": "task",
"id": "T01",
"source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1"
},
{
"kind": "task",
"id": "T02",
"source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2"
},
{
"kind": "task",
"id": "T03",
"source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3"
},
{
"kind": "task",
"id": "T04",
"source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4"
},
{
"kind": "task",
"id": "T05",
"source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5"
},
{
"kind": "task",
"id": "T06",
"source": "workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-6"
}
],
"historical_identity_collisions": [
{
"kind": "task",
"id": "T01",
"uuid": null,
"sources": [
"workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-1",
"workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-1",
"workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-1"
],
"parent_id": "RAIL-BS-WP-0002",
"uuids": [
"3f042630-eab0-4c6a-9167-e2b28ff20e40",
"4526a842-ea31-4874-9231-92ab556cfe7b",
"6841c93a-f146-47eb-9f7c-8fa0e02c1bbc"
]
},
{
"kind": "task",
"id": "T02",
"uuid": null,
"sources": [
"workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-2",
"workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-2",
"workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-2"
],
"parent_id": "RAIL-BS-WP-0002",
"uuids": [
"a6313e06-1976-46a7-8e31-df4eb2eca880",
"ab166073-30a7-4702-a037-4091e8706e20",
"e8510646-46ed-4697-a345-f3d3009eea78"
]
},
{
"kind": "task",
"id": "T03",
"uuid": null,
"sources": [
"workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-3",
"workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-3",
"workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-3"
],
"parent_id": "RAIL-BS-WP-0002",
"uuids": [
"05d42a55-921f-4aa7-bb76-e8af9c7e0ac3",
"140da396-8e30-4f4d-b88c-c42c0cd46c01",
"dab2c07f-8aa0-4635-8df6-857e87e93fc5"
]
},
{
"kind": "task",
"id": "T04",
"uuid": null,
"sources": [
"workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-4",
"workplans/archived/260622-RAIL-BS-WP-0003-pgpool-ha-failover-fix.md#task-block-4",
"workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-4"
],
"parent_id": "RAIL-BS-WP-0002",
"uuids": [
"08233868-d522-4117-bc4e-6c0f52545665",
"5c3d40e4-239b-488e-9519-6f7a38d2325f",
"d8a3ba40-fda0-4c1f-a9f1-ffcd621a5b3d"
]
},
{
"kind": "task",
"id": "T05",
"uuid": null,
"sources": [
"workplans/archived/260622-RAIL-BS-WP-0002-k3s-baseline.md#task-block-5",
"workplans/archived/260622-RAIL-BS-WP-0004-safety-net.md#task-block-5"
],
"parent_id": "RAIL-BS-WP-0002",
"uuids": [
"2d5acff7-4a4e-4ddd-ad06-08237ad3dac8",
"7f9e0e58-a130-467a-a2d0-b3f2564e496f"
]
}
],
"files_changed": []
},
"receipt": {
"schema": "state-hub.repository-projection-reconcile.v1",
"outcome": {
"notes": [
"Preserved bound historical row and task UUIDs: RAIL-BS-WP-0002",
"Preserved bound historical row and task UUIDs: RAIL-BS-WP-0003",
"Preserved bound historical row and task UUIDs: RAIL-BS-WP-0004"
],
"commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
"counts": {
"created": 0,
"refused": 0,
"retired": 0,
"updated": 20,
"released": 0,
"created_edges": 0,
"created_tasks": 0,
"removed_edges": 0,
"updated_tasks": 1,
"external_edges": 0,
"cancelled_tasks": 0,
"unresolved_edges": 0
},
"schema": "state-hub.projection-reset.v1",
"status": "applied",
"created": [],
"refused": [],
"retired": [],
"updated": [
"RAIL-BS-WP-0001",
"RAIL-BS-WP-0005",
"RAIL-BS-WP-0006",
"RAIL-BS-WP-0008",
"RAIL-BS-WP-0009",
"RAIL-BS-WP-0010",
"RAIL-BS-WP-0011",
"RAIL-BS-WP-0012",
"RAIL-BS-WP-0013",
"RAIL-BS-WP-0014",
"RAIL-BS-WP-0015",
"RCLUSTER-WP-0001",
"RCLUSTER-WP-0002",
"RCLUSTER-WP-0003",
"RCLUSTER-WP-0007",
"RCLUSTER-WP-0014",
"RCLUSTER-WP-0016",
"RCLUSTER-WP-0017",
"RCLUSTER-WP-0018",
"RCLUSTER-WP-ADHOC-2026-07-27"
],
"released": [],
"repo_slug": "railiance-cluster",
"created_edges": [],
"created_tasks": [],
"removed_edges": [],
"updated_tasks": [
"RCLUSTER-WP-0018-T01"
],
"external_edges": [],
"cancelled_tasks": [],
"unresolved_edges": []
},
"instance_role": "primary",
"derived_commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6",
"instance_label": "railiance01",
"expected_commit": "6ae3f847c83da3402883453ee7110457bfb2d0d6"
}
}

View file

@ -0,0 +1,4 @@
{
"path": "/home/worsch/state-hub/.venv/lib/python3.12/site-packages/scripts/consistency_check.py",
"sha256": "1bfbc89d3ff5c621ec541fd32384083cc7dcf96a639b217d62b6fc34de238efd"
}

View file

@ -0,0 +1,96 @@
{
"schema": "state95.guard-successor-verified-return.v1",
"status": "verified",
"verified_at": "2026-10-17T01:55:19.742775+00:00",
"proposal_id": "STATE-WP-0095-T10-frozen-bindings-guard-r1",
"executed_revision": 2,
"executed_digest_sha256": "5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e",
"approval_ref": "df703266-6719-4c04-ae1b-ba9afd3bca1c",
"helm_revision": 77,
"deployed_source": "c103cbf3c8bed5dba87a03e320595ddded9301a3",
"deployed_image": "forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1",
"schema_expected_and_applied": "c4d5e6f7a8b9",
"api_mcp_ready": true,
"actual_native_cases_passed": 8,
"actual_commits_in_probes": 0,
"current_full_historical_rows_preserved": 18,
"frozen_archives_unchanged": 3,
"normal_loaded_client_pipeline": "passed20ordinarybindings3frozenomitted",
"exact_job_uid": "99ebab16-f0e7-49ac-8db3-b3b34f7331df",
"observed_owned_pod_succeeded": true,
"job_and_owned_pods_absent_after": true,
"exact_owned_chart_staging_removed": true,
"recovery_required": false,
"original_three_parent_failure_disposition": "Founder approved current-baseline successor acceptance; original failure retained as historicalexception, unavailable preimages notguessed/restored and no backfilledsuccess.",
"native_security_target_gates_closed": 0,
"bound_receipts": [
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/approval-decision.json",
"sha256": "f7b12514c52f815854c5bcda8b41fdfef34ee8488c8d4ec779cfc41ae6493d7e"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-before.json",
"sha256": "55ab3a40f06ca07299d346f5d060509e0a25ddad88b849fb48e504c987328ba1"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-headroom.json",
"sha256": "a296873b93c18a31068f1c41c3600d681c2829c00fb6fb458ce6faa5f3718c27"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/fresh-server-dryrun.json",
"sha256": "2bfb02130876aeb71a773585dae8b446ad5c671050ebc14d0fc7bcce86dffea5"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-before.json",
"sha256": "bd6f1629bc44858dd914ae33c94e72ef4cbd1893c1ff164c5bbf27db02d1d3b8"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/execution.json",
"sha256": "b772cb147a2ee18eecfa39fc8eda0fe92b6cec35a1f302bbe3da024ae6e06d5c"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/helm-return.json",
"sha256": "af4d48460996dadb460f9a01a33fc6b06dfcd762b36a34dbac078a758ea94ac6"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/job-observation.json",
"sha256": "dc2d959cdcc342395fc53a2e316f6d95b650d6526343a7b07eb8fdc90570c12a"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/runtime-after.json",
"sha256": "4da5d5b9eedd5338c58d692a0c6918a6b4a2a46cca98e0b0303bd250d2a6b8a7"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/native-binding-probes.json",
"sha256": "682cc03c42af5b9be1046390b2f50b83b3e5cad6fb2f89d51740a768706e8489"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-after.json",
"sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-loaded-client.json",
"sha256": "0745b5df92d2533714e2a87a43c73b3b685e7bab7bcf4444f7a5fbd82dd4722f"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-consistency.json",
"sha256": "fd8a7d58d9e08b4866420ad77d01fbc7c28c0c2c9610ffbe95ddc77dddd9b1a6"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-client-cluster-projection.json",
"sha256": "f737ff91b75362ee367441d2fdeb83eed83208d222f592f2942ad62b19bc7b06"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/full-rows-post-pipeline.json",
"sha256": "07b044de04049758383c7160afd06f1d65785e066faeee985f4b89597698ceaf"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/staging-cleanup.json",
"sha256": "bd9a555826f65279163a3f8efc346b5b8af82e43824780302eb3617632395eea"
},
{
"path": "docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/frozen-archives.json",
"sha256": "95995c0184c707238d531d5113ae3798ef66051a507bf5a0b70af2966900b217"
}
]
}

View file

@ -0,0 +1,71 @@
"""Verify final canonical publication, source task bindings and retained proofs."""
from pathlib import Path
import hashlib
import json
import re
import subprocess
import urllib.request
import yaml
ROOT = Path('/home/worsch/the-custodian')
BASE = Path(__file__).resolve().parent
BACKUP = BASE.parent / 'custodian-publication-backup'
def git(*args):
return subprocess.check_output(['git', '-C', str(ROOT), *args], stderr=subprocess.PIPE).decode().strip()
def get(path):
return json.load(urllib.request.urlopen('http://127.0.0.1:8000' + path, timeout=20))
head = git('rev-parse', 'HEAD')
assert git('ls-remote', 'origin', 'refs/heads/main').split()[0] == head
projection = json.loads((BASE / 'guard-custodian-projection.json').read_text())
assert projection['status'] == 'applied' and projection['commit'] == head
receipt = projection['receipt']
assert receipt['expected_commit'] == receipt['derived_commit'] == head
assert receipt['instance_role'] == 'primary' and receipt['instance_label'] == 'railiance01'
path = ROOT / 'workplans/CUST-WP-0080-netkingdom-security-blueprint-and-gap-closure.md'
raw = path.read_text()
assert git('show', head + ':' + str(path.relative_to(ROOT))) == raw.strip()
front = yaml.safe_load(raw.split('---', 2)[1])
tasks = [yaml.safe_load(v) for v in re.findall(r'```task\n(.*?)\n```', raw, re.S)]
assert len(tasks) == 6 and front['status'] == 'active'
snapshot = get('/repos/the-custodian/work-record-projection/snapshot')
plan = next(p for p in snapshot['workplans'] if p['id'] == front['state_hub_workstream_id'])
assert plan['status'] == 'active'
actual = {t['id']:t for t in snapshot['tasks'] if t.get('workplan_id', t.get('workstream_id')) == plan['id']}
assert len(actual) == len(tasks)
for task in tasks:
row = actual[task['state_hub_task_id']]
assert row['record_id'] == task['id'] and row['status'] == task['status']
for name, entry in json.loads((BACKUP / 'originals.json').read_text()).items():
assert (ROOT / name).read_bytes() == (BACKUP / (name + '.worktree')).read_bytes()
assert git('ls-files', '--stage', '--', name) == entry.strip()
assert all(hashlib.sha256((ROOT / name).read_bytes()).hexdigest() == pin
for name,pin in json.loads((BACKUP / 'other-dirty-hashes.json').read_text()).items())
decision = get('/decisions/df703266-6719-4c04-ae1b-ba9afd3bca1c')
assert decision['status'] == 'resolved' and decision['decision_type'] == 'made' and decision['decided_by'] == 'Bernd Worsch'
proposal = BASE.parent / 'guard-successor-review-r2/proposal-metadata.json'
assert hashlib.sha256(proposal.read_bytes()).hexdigest() == '5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e'
for r in json.loads(proposal.read_text())['bound_receipts']:
assert hashlib.sha256(Path(r['path']).read_bytes()).hexdigest() == r['sha256']
returned = BASE / 'verified-receiving-return.json'
assert hashlib.sha256(returned.read_bytes()).hexdigest() == '09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a'
for r in json.loads(returned.read_text())['bound_receipts']:
assert hashlib.sha256((ROOT / r['path']).read_bytes()).hexdigest() == r['sha256']
owners = json.loads((BASE / 'owner-bindings.json').read_text())
assert owners['status'] == 'verified' and owners['task_bindings'] == 26
for row in owners['rows']:
if row['workplan_id'] in ['STATE-WP-0095', 'RMGR-WP-0019']:
assert row['status'] == 'finished' and all(t['status'] == 'done' and not t.get('needs_human') for t in row['tasks'])
manifest = json.loads((BASE / 'publication-inputs.json').read_text())
for r in manifest['files']:
committed = subprocess.check_output(['git', '-C', str(ROOT), 'show', head + ':' + r['path']], stderr=subprocess.PIPE)
assert hashlib.sha256(committed).hexdigest() == r['sha256']
result = {'status':'verified', 'commit':head, 'remote_exact':True,
'primary_projection_expected_equals_derived':True, 'task_bindings':32,
'state95_and_registrar19_finished':True, 'approved_revision':2,
'runtime_return_and_proposal_bound_receipts_unchanged':True,
'unrelated_index_and_worktree_preserved':True, 'native_target_gates_closed':0}
(BASE / 'close-verification.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps(result))

View file

@ -0,0 +1,34 @@
"""Read-only final source/remote/Hub binding check, retaining only public identifiers."""
from pathlib import Path
import hashlib,json,re,subprocess,urllib.request,yaml
here=Path(__file__).resolve().parent
specs=json.loads((here/'owner-heads.json').read_text())
def git(root,*a):return subprocess.check_output(['git','--no-optional-locks','-C',str(root),*a],stderr=subprocess.PIPE,timeout=30).decode().strip()
def get(path):return json.load(urllib.request.urlopen('http://127.0.0.1:8000'+path,timeout=20))
health=get('/state/health');assert health['instance_role']=='primary' and health['instance_label']=='railiance01'
rows=[];snapshots={};targets={'NK-WP-0049-T33':'56c8d469-7a10-5d50-a30e-95cbf3cd4756'}
for repo,wp,head,count in specs:
root=Path('/home/worsch')/repo;assert git(root,'rev-parse','HEAD')==head
paths=list((root/'workplans').glob(wp+'-*.md'));assert len(paths)==1;path=paths[0];raw=path.read_text();assert git(root,'show',head+':'+str(path.relative_to(root)))==raw.strip()
front=yaml.safe_load(raw.split('---',2)[1]);tasks=[yaml.safe_load(v) for v in re.findall(r'```task\n(.*?)\n```',raw,re.S)];assert len(tasks)==count
for task in tasks:targets[task['id']]=task['state_hub_task_id']
rows.append(dict(repo=repo,wp=wp,head=head,source_path=str(path),front=front,tasks=tasks,source_sha256=hashlib.sha256(path.read_bytes()).hexdigest()))
result=[]
for item in rows:
repo=item['repo'];root=Path('/home/worsch')/repo
remote=git(root,'ls-remote','origin','refs/heads/main').split()[0];assert remote==item['head']
snapshot=snapshots.setdefault(repo,get('/repos/'+repo+'/work-record-projection/snapshot'))
plan=next(p for p in snapshot['workplans'] if p['id']==item['front']['state_hub_workstream_id']);assert plan['status']==item['front']['status']
actual=[t for t in snapshot['tasks'] if t.get('workplan_id',t.get('workstream_id'))==plan['id']];assert len(actual)==len(item['tasks']);byid={t['id']:t for t in actual}
for task in item['tasks']:
t=byid[task['state_hub_task_id']];assert t['record_id']==task['id'] and t['status']==task['status']
if 'needs_human' in task:assert bool(t.get('needs_human'))==task['needs_human']
expected={(t['state_hub_task_id'],targets[d],'starts_after') for t in item['tasks'] for d in t.get('depends_on',[]) if d in targets}
edges=[e for e in snapshot['dependencies'] if e['from_workplan_id']==plan['id'] and e.get('from_task_id')]
observed={(e['from_task_id'],e.get('to_task_id'),e['relationship_type']) for e in edges}
assert observed<=expected,'undeclared-projected-edge'
required_pairs={'RCLUSTER-WP-0018':[('RCLUSTER-WP-0018-T03','RCLUSTER-WP-0018-T02'),('RCLUSTER-WP-0018-T04','RCLUSTER-WP-0018-T02'),('RCLUSTER-WP-0018-T04','RCLUSTER-WP-0018-T03')]}
assert all((targets[a],targets[b],'starts_after') in observed for a,b in required_pairs.get(item['wp'],[])),'required-current-edge-missing'
result.append({'repo':repo,'workplan_id':item['wp'],'commit':item['head'],'remote_exact':True,'source_sha256':item['source_sha256'],'status':plan['status'],'tasks':[{k:t[k] for k in ['id','record_id','status','needs_human'] if k in t} for t in actual],'projected_edges':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(observed)],'unprojected_source_declarations':[{'from_task_id':a,'to_task_id':b,'relationship_type':c} for a,b,c in sorted(expected-observed)]})
v={'schema':'custodian.rollout-owner-bindings.v1','status':'verified','primary':'primary/railiance01','task_bindings':sum(len(r['tasks']) for r in result),'rows':result,'runtime_deployed_source':'c103cbf3c8bed5dba87a03e320595ddded9301a3','helm_revision':77,'native_target_gates_closed':0}
(here/'owner-bindings.json').write_text(json.dumps(v,indent=2)+'\n');print(json.dumps({'status':'verified','task_bindings':v['task_bindings']}))

View file

@ -0,0 +1,57 @@
"""Observe the approved release Job and owned Pods; never mutate resources."""
from pathlib import Path
from datetime import datetime, timezone
import json
import subprocess
import time
BASE = Path(__file__).resolve().parent
KUBE = ['kubectl', '--kubeconfig', '/home/worsch/.kube/config-railiance01', '-n', 'state-hub']
IMAGE = 'forgejo.coulomb.social/coulomb/state-hub:main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1'
def get(args):
result = subprocess.run(KUBE + args, capture_output=True, timeout=10)
if result.returncode:
return None
return json.loads(result.stdout) if result.stdout.strip() else {}
result = {'schema': 'state95.approved-job-observation.v1', 'mutation': False,
'started_at': datetime.now(timezone.utc).isoformat(), 'jobs': {}, 'poll_failures': 0}
deadline = time.monotonic() + 240
while time.monotonic() < deadline:
try:
job = get(['get', 'job', 'state-hub-migrate', '--ignore-not-found', '-o', 'json'])
if job is None:
result['poll_failures'] += 1
elif job:
meta = job['metadata']
images = [c['image'] for c in job['spec']['template']['spec']['containers']]
if (images != [IMAGE] or meta.get('labels', {}).get('app.kubernetes.io/instance') != 'state-hub'
or meta.get('labels', {}).get('app.kubernetes.io/managed-by') != 'Helm'
or meta.get('annotations', {}).get('helm.sh/hook') != 'pre-install,pre-upgrade'):
result['unexpected_job_identity'] = True
break
entry = result['jobs'].setdefault(meta['uid'], {'uid': meta['uid'], 'name': meta['name'],
'created_at': meta['creationTimestamp'], 'image': IMAGE, 'managed_by': 'Helm',
'release': 'state-hub', 'hook': 'pre-install,pre-upgrade', 'pods': {}})
entry['last_status'] = {k: job.get('status', {}).get(k) for k in ['active', 'succeeded', 'failed']}
pods = get(['get', 'pods', '-l', 'job-name=state-hub-migrate', '-o', 'json'])
if pods:
for pod in pods['items']:
owners = pod['metadata'].get('ownerReferences', [])
if not any(o['uid'] == meta['uid'] and o['kind'] == 'Job' for o in owners):
continue
entry['pods'][pod['metadata']['uid']] = {'name': pod['metadata']['name'],
'uid': pod['metadata']['uid'], 'owner_job_uid': meta['uid'],
'pod_ip': pod.get('status', {}).get('podIP'), 'phase': pod.get('status', {}).get('phase')}
elif result['jobs']:
result['job_absent_after_observation'] = True
(BASE / 'job-observation.json').write_text(json.dumps(result, indent=2) + '\n')
if (BASE / 'helm-return.json').exists():
result['helm_return_observed'] = True
break
except (subprocess.TimeoutExpired, ValueError, KeyError):
result['poll_failures'] += 1
time.sleep(0.7)
result['ended_at'] = datetime.now(timezone.utc).isoformat()
(BASE / 'job-observation.json').write_text(json.dumps(result, indent=2) + '\n')
print(json.dumps({'observed_trial_jobs': len(result['jobs']), 'mutation': False}))

View file

@ -903,3 +903,32 @@ All sixteen native target gates remain open.
The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained.
The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`.
## Approved API guard delivered and verified, 2026-10-17
The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2,
SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`,
through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned
`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1`
image is delivered at Helm 77. API and MCP are Ready; applied/expected schema
remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone,
and only the verified owned chart staging was removed. No recovery was needed.
All eight deployed owner-handler cases passed with enforced commit interception,
rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline
passes with the verified installed checker: 20/20 ordinary bindings, three frozen
bindings omitted, and all eighteen CURRENT historical full rows unchanged across
the rollout, native probes and maintenance. All three frozen archives and
unrelated staged/worktree state are preserved. The earlier three-parent mismatch
remains a founder-approved historical exception: unavailable old preimages were
not guessed, restored or relabeled as a passing result. Runtime acceptance is
separate from all sixteen NetKingdom native target gates, which remain open.
Frozen acceptance return:
`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`,
SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`.
The supervision record retains original revision 1, the approved/executed revision
2, exact digests and successful refined outcome; it grants no autopilot authority.
Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken.

View file

@ -1092,3 +1092,32 @@ All sixteen native target gates remain open.
The same pending API guard proposal now has revision 2, SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`, at `docs/changes/netkingdom-target-2026-10-17/guard-successor-review-r2/FINAL-PROPOSAL.md`. Only the probe source-hash metadata representation changed after the normal scanner flagged hashes as generic API keys. Revision 1 remains unapproved and unexecuted; the runtime image, probe case logic, acceptance exception and recovery scope are unchanged. Source-publication receipt hashes are exposed through reversible typed metadata companions; original bytes and the refused scan remain retained.
The owner’s WP-only revision-2 reference amendment is published at State Hub `4c03c9d2c6a47f5c7247473f74b2e2f188b787bd`. Final source/remote/primary readback verifies all 26 affected owner task bindings; runtime source remains `51bc70d` and the proposed guard image remains `c103cbf`.
## Approved API guard delivered and verified, 2026-10-17
The founder approved `STATE-WP-0095-T10-frozen-bindings-guard-r1` revision 2,
SHA256 `5d0ddebc21bcb035809cc8b57f4c2e1ba8ed09204be5b965460e178a90913f1e`,
through decision `df703266-6719-4c04-ae1b-ba9afd3bca1c`. The exact pinned
`main-c103cbf@sha256:4cc4ce17bbcdb1b66132d07c5b7b741f46df83124ef1c8403ffabdafba6993d1`
image is delivered at Helm 77. API and MCP are Ready; applied/expected schema
remains `c4d5e6f7a8b9`. The exact observed migration Job and owned Pod are gone,
and only the verified owned chart staging was removed. No recovery was needed.
All eight deployed owner-handler cases passed with enforced commit interception,
rollback and fresh-transaction comparison. The actual ordinary Cluster pipeline
passes with the verified installed checker: 20/20 ordinary bindings, three frozen
bindings omitted, and all eighteen CURRENT historical full rows unchanged across
the rollout, native probes and maintenance. All three frozen archives and
unrelated staged/worktree state are preserved. The earlier three-parent mismatch
remains a founder-approved historical exception: unavailable old preimages were
not guessed, restored or relabeled as a passing result. Runtime acceptance is
separate from all sixteen NetKingdom native target gates, which remain open.
Frozen acceptance return:
`docs/changes/netkingdom-target-2026-10-17/guard-successor-execution-r2/verified-receiving-return.json`,
SHA256 `09958bd69367cc6903e2a21a56eb81b6a8a46c2a1907afc93f787cd63732e92a`.
The supervision record retains original revision 1, the approved/executed revision
2, exact digests and successful refined outcome; it grants no autopilot authority.
Source follow-through: State Hub `200cbd0a61a805d0fe29f9d6d1c49a6cf1f1703a` finishes STATE-WP-0095 with all ten tasks done and declared image pins matching the verified deployment; Repo Manager `3bcb1e1cf3e58b263f690534f7f28024d75cdbf6` finishes RMGR-WP-0019 with all six tasks done. Task UUIDs remain unchanged. The existing binding-guard successor coordination case is satisfied; independent native-owner work remains live, and no worker was woken.