# Assessment evidence and reproduction

Snapshot: 2026-09-08, before this assessment was authored. Exact HTTP retrieval
times and SHA-256 hashes of the temporary raw responses are in `baseline.json`.
Raw responses remain outside the repository; this folder retains selected
non-secret metadata and source fingerprints rather than full task/message bodies.
This is a dated assessment snapshot, not another live backlog.

Files:

- `baseline.json`: fleet totals, normalization, quality signals and capture provenance.
- `open-workplans.csv`: all 98 raw open workplans, including the four explicitly
  retired identities; local source resolution, statuses and task counts.
- `source-records.json`: 94 canonical open records plus local KG-WP-0005,
  with exact source paths, hashes and parsed task counts.
- `cohorts.json`: disjoint repo membership and aggregated load.
- `dependency-coverage.json`: all 94 dependency responses, including empty ones.
- `human-flags.csv`: the nineteen flagged tasks' lifecycle metadata.
- `checkout-provenance.json`: principal source revisions and pre-existing dirty state.
- `live-upstream-issuer-continuation.json`: subsequent admitted live signed-token
  proof, completed scoped cleanup and resolved probe decision/source parity.
- `upstream-issuer-probe-continuation.json`: completed upstream diagnostic
  preparation, image and route checks, owner/source sync and pending live decision.
- `runtime-custody-continuation.json`: later runtime installation and attended
  capability proof, with published source/projection and progress receipts.
- `consistency-check.json`: session-close consistency result, including thirteen
  existing-record assessment failures; this check did not pass.

Read-only reproduction against the current Hub will produce a **new snapshot**:

1. Fetch `/openapi.json`, `/repos/`, `/workplans/`, `/tasks/`, `/tasks/counts`,
   `/intakes/` from `http://127.0.0.1:8000`. Send
   `X-StateHub-Component: the-custodian.factory-assessment` on follow-up requests.
   Inspect the API contract for pagination and drain all pages if required.
   The captured contract had no limit for `/workplans/` or `/repos/`; `/tasks/`
   defaults to no limit and accepts explicit limit/offset. Verify list totals
   against `/tasks/counts`. The initial capture did not set the attribution header.
2. Open workplans are statuses `proposed`, `ready`, `active`, `blocked`, `backlog`.
   Raw terminal statuses are `finished`, `archived`. Canonical planning counts
   additionally exclude slugs containing the explicit `@retired-` marker.
   Do not infer retirement from title similarity or age.
3. Join tasks by `workplan_id`. Open tasks have status `wait`, `todo`, `progress`.
   Count terminal-parent and retired-parent tasks separately. Raw open tasks:
   287 = 264 canonical-open-parent + 7 retired-open-parent + 16 terminal-parent.
4. Resolve local sources from registered paths and file UUIDs, falling back to
   canonical workplan identifiers within the same repo. Parse frontmatter and
   all fenced `task` blocks (including multiple blocks under a heading).
   Compare statuses; retain file hashes. Legacy `done`/`completed` workplan
   statuses are terminal in historic files, not hundreds of additional open plans.
   Invalid historic YAML, missing paths and registry aliases prevent claiming a
   complete independently validated source-only census.
5. For each canonical open plan fetch `/workplans/{uuid}/dependencies/`.
   Report returned edges and empty responses. Coverage measures this API view,
   not dependency mentions in source or intake/message relationships; do not
   assume edge direction without inspecting `from_workplan_id`/`to_workplan_id`.
6. Group repositories exactly as in `cohorts.json`. Each canonical open plan
   occurs once. Railiance membership is `railiance-*`, `rail-*`, `rapp-*`,
   `reef-*`; the other named sets are explicit. No portfolio-wide priority or
   classification was modified to construct these analytical groups.
7. Ages use 2026-09-08 minus the declared date. Report missing timestamps
   separately. Sync dates can refresh without progress; source `updated` can be
   stale despite recent body additions. Neither measures blocked duration.

Validation performed: task-count reconciliation; 98 = 94 + 4; all six cohort
totals sum to 94 plans/264 tasks/27 blocked; 94 canonical source statuses match;
19 human flags split into 17 terminal and two open; all dependency requests
succeeded. Principal checkouts were compared with **cached** upstream refs only.
Runtime outcomes cited in the report are owner-recorded evidence, not a fresh
live acceptance test by this assessment.