---
id: CUST-WP-0079
type: workplan
title: "Deterministic security flow: standing authorizations, flow report, and agent re-engagement"
domain: infotech
repo: the-custodian
status: active
owner: claude-code
topic_slug: custodian
created: "2026-10-11"
updated: "2026-10-19"
flavor: implementation
depends_on: []
state_hub_workstream_id: "ab288f92-d364-5c24-9362-aee451f266c3"
---

Follow-up to `history/20261011-netkingdom-security-progress-assessment.md`. About 80 % of the
security estate's open tasks were `wait`, and agent time went into re-reading waits and producing
evidence packets. This plan replaces that loop with (1) standing founder authorizations,
(2) deterministic reports and sync, and (3) a narrow, re-scoped coding-agent goal.

Critical path (everything else is residual until promoted):
identity (key-cape, user-engine) → authorization (access-engine + policy-nexus guardrails) →
secrets (secrets-engine over OpenBao, response-wrapped delivery) → SecurityCase execution
(ops-mason → ops-warden / ArgoCD), proven first on oidc-browser-relying-party (NK-WP-0048-T06,
KEY-WP-0038).

## Founder decision batch and hub/repo decision sync

```task
id: CUST-WP-0079-T01
status: done
priority: high
state_hub_task_id: "618b32bb-3b30-5c31-b054-65b455d62b0b"
```

2026-10-11: D1, D2, D3 resolved, plus round 2 (standing build-mode change rule; D10 MFA remainder;
D4 + D5). Recorded in `docs/decisions/2026-10-11-security-unblock-decisions.md`. 31 open hub
decisions were already resolved in repo decision logs (gate-house, kings-guard, tenant-engine,
security-canon, repo-manager) and were synced. Open hub decisions went from 61 to 22. 26 tasks were
requalified, including fixes for tasks mislabeled as human gates. 10 workplans were demoted to
residual.

## Deterministic tooling

```task
id: CUST-WP-0079-T02
status: done
priority: high
state_hub_task_id: "2764581a-ff8f-5a05-90bd-3dc6bd058ae5"
```

`scripts/security_flow_report.py` (READY / UNBLOCKED / ATTENDED / STALLED from workplan files),
`scripts/requalify_tasks.py` (apply task requalifications from a JSON plan),
`scripts/sync_resolved_decisions.py` (resolve hub decisions that repo logs already record as
resolved or accepted).

## Schedule the flow report and decision sync

```task
id: CUST-WP-0079-T03
status: progress
priority: high
state_hub_task_id: "1be0569c-221d-5925-a0ff-fd2af88e52b1"
depends_on: [ACTIVITY-WP-0047]
blocking_reason: "ACTIVITY-WP-0047 now selects existing bounded operations: the prior coding profile cannot run Python or access the Hub. Await runtime-owner source/mount/state/network bindings, activation and first unassisted activity/report/sink/owner receipt."
```

Run `sync_resolved_decisions.py --apply` and `security_flow_report.py --json` daily (activity-core
schedule, or a workstation timer until activity-core has the lane). Post a hub message to the
coding agent only when UNBLOCKED or READY changed, and to the founder only when ATTENDED is
non-empty. Agents must not poll wait tasks themselves.

Implementation (2026-10-11): `scripts/security_flow_daily.py` runs both commands, includes
`the-custodian` in the default security estate, checkpoints each delivered recipient, and
notifies the coding agent only when READY/UNBLOCKED changes. Empty ATTENDED lists never
message the founder. User timer units are in `infra/security-flow/`; `make security-flow-check`
passes nine tests including interrupted delivery and retry. Live hub dry-run succeeds.
Schedule activation handoff `117e538e-da06-48b8-ba68-b82300a832e7` to `activity-core`
is attached to `case:cross-owner:CUST-WP-0079-T03:activity-core`
(`infra/security-flow/scheduling-handoff.json`); no owner acceptance or foreign dependency is
invented. Schedule activation remains pending: workstation `systemctl --user` cannot connect to its
user bus (`No data available`), so checked-in units alone do not establish daily execution.

2026-10-13 owner return: Activity Core accepted the handoff in message
`00704319-97b2-469c-977e-6168ef20b9f9`. Verified owner record
`ACTIVITY-WP-0047` (implementation, active) and committed definition
`activity-definitions/daily-security-flow.md`: daily 07:30 Europe/Berlin,
misfire skip, fixed `python3 scripts/security_flow_daily.py --apply` command,
correlation CUST-WP-0079-T03, no repository grant. Definition remains
`enabled: false`; source acceptance is complete, activation is not.
The existing coordination case now names ACTIVITY-WP-0047 as obligor. T03
remains wait until its claiming rein can reach workstation checkouts/the hub,
the owner activates the schedule, and the first unassisted fire proves completed
ops_run, report delivery and checkpoint behavior. No scheduler was enabled and
no foreign owner task was changed by this reconciliation.

## Encode the standing change rule as a policy-nexus guardrail

```task
id: CUST-WP-0079-T04
status: progress
depends_on: [PNEX-WP-0006]
blocking_reason: "Founder approved exact publication packet on 2026-10-19; policy-nexus owner executing PNEX-WP-0006 release. Native/public verification remains required before closure."
priority: high
state_hub_task_id: "5dd52156-09a8-5781-b288-99ae822f59a6"
```

Canon source written 2026-10-11: `canon/standards/build-mode-change-authorization_v0.1.md`
(founder-decided). Closes when PNEX-WP-0006 publishes it.

## Stop agent-authored index and sync commits

```task
id: CUST-WP-0079-T05
status: done
priority: medium
state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c"
```

WORK-RECORDS.md, source inventories, publication indexes and "projection refresh" files must be
regenerated by a `make` target in a pre-commit hook or a Forgejo Action, not by agent commits.
Start with the security repos. Done when a week of git log shows no standalone index-only commits
from agents.

Implementation (2026-10-11): `scripts/check_generated_only_commit.py` checks staged files
or every commit in a revision range. Forgejo workflow `generated-commit-guard.yaml` rejects
standalone WORK-RECORDS, source-inventory, publication-index, projection-refresh,
generated briefs and explicit evidence/decision-packet commits regardless of author; a later source commit cannot hide an earlier
generated-only commit. `make generated-commit-check` provides the local hook entry point.
The CI suite covers the rejection using a real temporary git repository. Consumer generator
adoption and the required week of clean logs remain open; this task is not claimed complete.

The local guard is installed; `make generated-commit-hook` reproduces that
installation and refuses to replace a different hook. The consistency CLI has
no no-commit/no-push mode: its first invocation unexpectedly published brief-only
`ebaa38b`, retained as a failed acceptance observation. Its subsequent invocation
committed the already reviewed, staged implementation as `6fe7201`; that commit
includes source code. Future generated-only commits are rejected locally and in
CI. The full Custodian suite passes 77 tests.

The default flow report now includes Custodian and activity-core, both required
by the renewed critical path. Cross-owner completion can therefore unblock the
platform activation task without an agent polling its wait body. Human gates
also retain their intervention note in the generated report instead of a blank
reason. CLI regression checks cover the actual owner completion transition and
the default Custodian lane.

The report also excludes todo/progress tasks with unresolved explicit task
dependencies, an owner gate or a human flag from READY. They remain visible
under DEPENDENT or ATTENDED, without agent polling of wait bodies. Regression
tests prove that owner completion admits the successor and that an unknown
predecessor or stale progress label cannot produce readiness. This is queue
qualification, not evidence that the corresponding live work has finished.

`scripts/install_shared_generated_guard.py` now checks or installs the guard in
the repository's already configured shared hook directory. It preserves existing
hook routing and other hooks, and refuses a differing or redirected pre-commit
hook. Real temporary-repository tests prove rejection and source-change acceptance.
The missing shared guard was installed for the existing repo-manager hook path;
the week's fleet evidence and generator adoption still remain open.

The generated attended list now retains unresolved ordered dependencies. An owner token session following the first SecurityCase can therefore be listed as a future attended act without implying it is ready to run now. CLI regression coverage checks this boundary.

2026-10-12 closeout: `make generated-commit-hook` now recognizes the existing
shared hook and preserves its routing and other owner hooks. A real Git/Make
regression test checks repeat installation and rejection of a generated-only
commit. Local implementation is complete; T05 remains waiting for fleet generator
adoption and the originally required week of clean history. Neither one day of
observations nor this local repair satisfies that acceptance condition.

Session closeout reviewed all three open Custodian plans. CUST-WP-0071 and
CUST-WP-0073 remain blocked on their existing named owner/founder returns.
CUST-WP-0079 is now blocked because all remaining tasks wait on scheduling-owner
acceptance, policy publication, fleet/time-based acceptance or attended actions.
No tasks or workplans were added, and CUST-WP-0076 remains finished.
The cross-repo critical-path goal was paused by the operator; this bounded
closeout does not resume it or claim native estate completion.

## Attended window #1

```task
id: CUST-WP-0079-T06
status: wait
needs_human: true
blocking_reason: "Owner source rechecked 2026-10-19: RPF-WP-0044-T08 is done and KEY-WP-0040-T01 preview is done. Remaining attended acts are USER-WP-0026-T03 positive readback, USER-WP-0028-T03 U08 recovery, and RPF-WP-0044-T04 OpenBao OIDC/MFA login; completed preview does not authorize factor mutation."
priority: high
state_hub_task_id: "e3da807f-9a6e-513f-82dc-3714a489e7bf"
```

## Re-engage the coding agent with the renewed goal

```task
id: CUST-WP-0079-T07
status: done
priority: high
state_hub_task_id: "91ec924c-b305-5a63-925d-087a3b927d60"
```

Replace the Sol goal with the renewed text in the assessment history file (section "Renewed
goal"). Re-engage now for the READY lane. It does not depend on T06.

Completed 2026-10-11: the renewed critical-path goal is active in thread
`01a126e1-76f8-7643-8cf3-e93336539ade`; its attached text was read before
execution. Work resumed from READY/UNBLOCKED, with three workers pinned to
eligible workplans and the accepted build-mode authorization in force. This
closes re-engagement only, not the live critical-path goal.

## Current owner-source audit — 2026-10-19

Activity Core source remains disabled (`daily-security-flow`, ACTIVITY-WP-0047
T02/T03 wait), so neither checked-in scheduling nor clean source establishes an
unassisted fire. Policy Nexus PNEX-WP-0006 remains blocked for founder-batch
publication and its source-inventory gate; its eight guardrail tests pass.
No privileged activation or policy publication was attempted.

The fixed seven-day local Git window `[2026-10-12T00:00:00+02:00,
2026-10-19T00:00:00+02:00]` contains 498 commits across all 15 repositories in
`security_flow_report.DEFAULT_REPOS`. Applying the existing generated-only
classifier to each commit found zero standalone generated-only commits.
The receipt `docs/evidence/2026-10-19-security-flow-week-history.json` records
repository HEADs and counts. This proves the observed local history window;
it does not prove unobserved remote branches or fleet generator adoption.
The shared repo-manager pre-commit hook rejects generated-only commits and
scans staged secrets, but does not regenerate indexes. T05 therefore remains
open for actual Make/hook or Forgejo generator adoption. Reuse the existing
State Hub `scripts/consistency_check.py` work-record rendering functions rather
than the auto-committing consistency CLI inside a hook; any integration must
preserve unstaged edits and generate from the staged source snapshot.

Scope discovery is now explicit and the three relevant owner checkouts are
clean after source-only commits: policy-nexus `19b65d5` adds SCOPE and links it
from its existing capability declaration; repo-manager `027b54e` documents
sync, shared-hook boundaries and the missing generator adoption; activity-core
`70ff241` documents the disabled fixed-command consumer and execution boundary.
These are source capabilities, not runtime publication or authorization claims.

T06's stale blockers were corrected from owner workplans: the coulombcore check
was already complete, and KeyCape's attended TOTP preview completed October 17.
Actual U08 recovery remains with USER-WP-0028-T03; a successful preview is not
factor-disable/re-enrollment acceptance.

T05 preparation now includes `scripts/generate_staged_work_records.py` and
`make generated-work-records` / `make generated-work-records-check`. The adapter
reuses the State Hub renderer against staged Markdown blobs, refuses conflicts,
symlink sources and unstaged generated-file edits, and stages only the generated
index. It never invokes the consistency CLI, hub, commit or push. Seven regression
tests cover actual owner rendering, staged-versus-unstaged source isolation,
generated-file preservation, read-only checking, idempotency and symlink refusal;
these and the existing generated guard tests pass (ten tests). Shared-hook
activation and fleet Make target adoption are still outstanding; the adapter
alone is not evidence that repository indexes are generated during commits.

Review refinement: generation requires `--repo-slug`, so worktrees and renamed
checkouts retain canonical identity. Each explicit renderer checkout is loaded
in a fresh subprocess, preventing cross-checkout module-cache reuse. Tests prove
both boundaries. Usage and adoption limitations are documented in
`docs/staged-work-record-generation.md` and the local SCOPE capability; no shared
hook routing was changed.


### T05 generator adoption — 2026-10-19

T05 is progress and the workplan active because authorized source adoption is
underway. The shared repo-manager hook now composes the original generated-only
guard, opt-in staged generator and unchanged exact-scope secret scanner. The
Custodian's separate local scanner hook was upgraded with the reviewed installer
(`changed: true`); its routing and other hooks were preserved. Opt-in is explicit
in `.generated-work-records.json`, with a dedicated staged Make recipe. Ordinary
Makefiles and `.env` includes are not loaded by the hook. Recipe content remains
trusted source, not an arbitrary-code sandbox.

Actual owner commits exercised the hook: activity-core `8a7275c` found its index
current; policy-nexus `c89364d` and repo-manager `05046fb` regenerated and included
WORK-RECORDS with the adoption source. All three checkouts were clean after their
commits, and the latter two retained successful secret scans. Subsequent owner
work may change those checkouts independently.

Twenty-one adapter/shared-hook/guard tests pass, including preservation of
partially staged source and unrelated staged briefs. Real `git commit --only`
exposed Git's temporary-index behavior; the adapter now refuses regeneration in
an alternate index before mutation. Pre-generating against normally staged
sources and including WORK-RECORDS in the partial commit passes with unrelated
staging intact. Instructions are in `docs/staged-work-record-generation.md`.

This is WORK-RECORDS adoption in three provider repos plus Custodian preparation,
not fleet completion. Remaining surfaces include the other security repositories,
hub-derived `.custodian-brief.md`, policy-nexus source inventory (whose authored
configuration/dispositions must be retained), and net-kingdom's generated
coordination-frame receiver through `tools/coordination-frame/render.py`.
Historic evidence inventories are not recurring generator outputs. T05 stays
open until those applicable owner generation paths and fleet acceptance are
verified; the independent schedule, publication and attended gates remain open.


### Fleet WORK-RECORDS adoption and source cleanup — 2026-10-19

The staged WORK-RECORDS lane is now adopted across every repository in the
15-repository default security report estate, plus the relevant implementation
providers. Each adopted repository declares its canonical slug, isolated Make
recipe and SCOPE boundary. Real commit hooks checked/rendered the staged index;
shared generated-only rejection and existing exact-scope secret scans remained
in force. No native runtime, credentials, public policy or schedule activation
was performed by this adoption.

All 25 provider checkouts were clean at verification (3 earlier adopters, 11
security-fleet adoptions, 4 isolation providers and 7 sizing providers). Current
source revisions:

| Repository | Commit |
| --- | --- |
| net-kingdom | `4c7f32a` |
| railiance-platform | `b06d1f0` |
| access-engine | `7eb4e22` |
| secrets-engine | `510d292` |
| ops-mason | `3457ecf` |
| key-cape | `5defa33` |
| user-engine | `db05c13` |
| tenant-engine | `f94bb5d` |
| gate-house | `c7d47f8` |
| kings-guard | `5e4942f` |
| rapp-policy-nexus | `ff41754` |
| activity-core | `7490eb8` |
| policy-nexus | `c89364d` |
| repo-manager | `05046fb` |
| ops-warden | `6ed0e9e` |
| railiance-cluster | `4604faf` |
| railiance-forge | `9aa2ac6` |
| railiance-apps | `a6fe0ab` |
| resource-framework (`resource-control`) | `0754009` |
| rapp-telemetry | `6015b54` |
| railiance-telemetry | `d089325` |
| vergabe-watch (`vergabe-teilnahme`) | `17429f8` |
| railiance-infra | `5094c30` |
| glas-harness | `579cefd` |
| rein-codex (`rein-aharness`) | `fb14c38` |

The first fifteen provider rows were rechecked directly after the final commit;
the additional sizing/isolation rows carry their worker completion receipts and
root's independent checkout verification. Custodian's own source adoption was
committed separately and uses its reviewed local scanner-hook composition.

Dirty generated indexes were inspected and original snapshots retained under
`/tmp/cust79-fleet-adoption/<repo>/`. Platform, Access and King's Guard originals
matched the staged owner renderer exactly. NetKingdom and Secrets originals
were stale row subsets of current source; regeneration added the missing source
records. User Engine's original reflected its pending source handoff, which was
reviewed and committed with the derived index rather than discarded.

Existing unfinished source was inspected and retained: Ops Mason's lock matched
its current pyproject (`uv lock --check --offline`) and all 260 tests passed;
its lock is now committed. Rapp Policy Nexus passed its nine packaging tests and
Helm lint. USER-WP-0035-T02's pending owner handoff was checked against current
caller/receiver/provider/portal code and retained with dated source hashes.
EMAIL-IN-0001 is durable in email-connect `994db7d` (clean), and NET-IN-0005 is
included in `4c7f32a`. Both remain owner preparation requests; they do not prove
setup-mail capability or runtime delivery. NetKingdom's pending cadence capture
receipts were preserved (3 events, 3 receipts, 588 inventory observations); their
record still says independent receiver readback is pending. No current process
or cadence acceptance is inferred from those historical files.

User Engine's typo-suffixed `.claude/settings.local.json.` was inspected and
preserved inactive at
`/home/worsch/.local/state/custodian-preserved/user-engine/settings.local.json.inactive-2026-10-19`,
SHA256 `b70496e3978a7e45304ad6e2042f81953bc8d6ac518aa82fcab36c4e5c754243`.
It was not renamed to active settings or used to grant permissions; the location
and hash receipt is committed with the source reconciliation.

State Hub supplied a separate strict rendering-only brief CLI in `09803dc`,
with identifier follow-up `f8f9cd9` verified in publication/projection and
published capability declaration `eac38b7`. Owner
validation passed 17 focused tests and 168 consistency tests on rerun; initial
combined-suite database teardown errors are retained in the owner/root report.
The CLI does not perform Git operations or Hub writes. Attempts to refresh the
five pending security briefs failed closed at `/repo-goals` or `/repos/<slug>`;
no replacement snapshot was written. Their existing generated deltas were
reviewed against source, retained with their original October 15–18 timestamps,
and committed alongside meaningful adoption source. They are historical
orientation, not fresh Hub readback. Originals remain in the preservation
snapshot. The brief's deliberate Markdown hard-break whitespace was retained.

T05 remains progress: WORK-RECORDS adoption does not establish automation for
hub-derived briefs, Policy Nexus source inventory, or NetKingdom's generated
coordination-frame receiver. Those owner generator families and recurring
execution remain to be implemented/verified without changing authored source
inventory dispositions. T03, T04 and T06 retain their independent schedule,
publication and attended acceptance gates. No new owner acceptance is inferred
from clean checkouts or the earlier clean seven-day Git window.

State Hub's five older metric snapshots remain intentionally dirty after owner
review; they were not included in the 25 clean provider claim. Custodian's
inherited NetKingdom assessment receipts also remain outside these owner cleanup
commits. Neither source adoption nor clean provider worktrees authorizes deleting
unrelated observations.


### Local brief policy and preserved metric snapshots — 2026-10-19

The operator selected local generated briefs and removal of tracked snapshots.
State Hub's renderer now omits Git operations for brief refreshes, including the
ordinary consistency path. The migration preserves the existing local bytes,
adds root-anchored ignores and removes only the tracked snapshot. No offline
orientation file is deleted. The explicit strict brief CLI remains available;
failed fresh reads preserve prior local orientation. This supersedes the earlier
plan to couple hub-derived brief snapshots to source commits.

The five State Hub legacy-meter snapshots reviewed in the preceding session are
now preserved outside its checkout at
`/home/worsch/.local/state/custodian-preserved/state-hub/legacy-meter-20261019/`.
`manifest.json` records every original path, SHA256 and tracked-baseline hash.
The tracked Oct14 baseline was restored and the four untracked copies removed
only after exact archive verification. These are historical observations, not
scheduled-execution or retirement acceptance. State Hub was clean after this
archive and before the local-brief source migration. This updates the earlier
intentionally-dirty observation without discarding evidence or committing a
generated-only packet. Custodian's inherited NetKingdom receipts remain intact.


### T05 acceptance audit — 2026-10-19

T05 is done. The earlier full seven-day local history audit covered 498 commits
across the 15-repository default estate with no standalone generated-only
commits. Staged WORK-RECORDS generation is adopted in all those repositories
and the additional providers. The concrete remaining recurring artifacts were
rechecked against tracked source paths, rather than inferred from filenames:

- NetKingdom `generated/coordination-frame/approval-engine-receiver.json` now
  derives from indexed owner sources through the local commit recipe (`bde143e`).
  Eleven tests cover the existing compiler plus partial staging, sibling
  preservation, target edits, symlinks and alternate-index refusal. The hook
  never rewrites sibling repos. Its subsequent local-brief migration is `1bd869c`.
- Policy Nexus's generated release inventories and manifests already run in the
  scheduled Forgejo build. Its tracked `source-inventory.json` and config carry
  authored dispositions and must not be auto-refreshed as disposable output.
  `5a6e78f` adds a non-destructive staged review utility (65 tests), not a second
  versioned inventory. Publication remains a separate T04 gate: two newly
  discovered documents still need explicit dispositions and the founder's
  public-release batch. This audit does not claim a fresh scheduled release.
- Brief snapshots are deliberately no longer Git artifacts, per operator choice.
  State Hub `39b51a2` removes the renderer's commit path; all 185 focused and
  consistency regression tests pass. Its owner sync returned applied at that
  exact revision. Local brief preservation was checked with hashes during the
  provider migration; the files remain available and ignored.

The default-estate path audit found no additional recurring source inventory,
publication index or projection refresh output lacking its owner generation
path. Dated historical receipts are retained observations, not refresh jobs.
This closes generation and local-history acceptance only. T03, T04 and T06
remain waiting on their named runtime/publication/attended gates, so this
workplan is blocked rather than finished. No residual work is concealed by T05.


Daily/weekly executor source is committed in Activity Core `4ae00fc`, with 57
focused bounded-operation/evidence/definition tests passing. It reuses the
existing ADR-007 fixed-command stage, suppresses raw command output, validates
trusted bindings before subprocess execution and returns compact hash/count
receipts. The selected commands emit no agent ops_run or model call. Both
schedules remain disabled. ACTIVITY-WP-0047 records the replacement receipt
contract and runtime acceptance gates; the corresponding Custodian handoff and
weekly-report documentation now consume that contract. NetKingdom's required
consistency pass synced 64/64 bindings with zero automation/assessment failures
(27 existing warnings, 5 informational findings); its brief refreshed locally
without any brief commit.


Runtime review refinement: Activity Core `0319fe8` retains the concrete proposal
in `docs/custodian-runtime-binding-proposal.md`. It pins the four stdlib owner
scripts from Custodian `60d893a` (30,169 bytes), source/state/fleet paths, direct
Hub service semantics, paused verification and checkpoint-preserving rollback.
Direct Kubernetes ConfigMap projection is unsuitable because its symlinks are
correctly refused by the executor; image-baked files or a hash-verified init copy
are the two existing delivery patterns. Existing worker vs dedicated placement,
fleet publisher/freshness and state retention/backup acceptance remain owner
inputs. They were requested without enabling schedules or claiming deployment
approval. This is source preparation for T03, not a new scheduler or first-fire
proof. Activity Core remained clean after the documentation commit.


## Owner delivery resumed after interview — 2026-10-19

Decision `8a64ba65-1068-409c-86f8-b9414b29b7b4` selects the existing Activity
Core worker with pinned owner scripts and private retained state. T03 is progress
for the delegated Activity Core/Repo Manager source packaging and snapshot
publisher work. Both definitions remain disabled pending the exact reviewed
implementation and existing activation conditions. No second worker/scheduler is
needed by this selected design. Routine live changes use the existing standing
build-mode rule only when its concrete review, rollback, abort-owner and receipt
conditions hold; access/secret scope, spend and public-publication exclusions
remain in force.

Policy Nexus `8af92bf` resolves the two source-discovery review rows as explicit
metadata-pending under existing inventory rules. No publication mappings or
foreign canon changed. Its 65 tests,186-source audit (74 published/94 pending),
local immutable release verification and currency checks pass. T04 still needs
the founder's existing public-release disposition for the build-mode standard
and derived JSON; the two unrelated pending documents are not part of that ask.

### Exact publication approved; execution pending verification

Founder approved the prepared publication and deployment in async reply
`call_5157a09329d34746a3fdf857d5a47b8d`, item 0. The immutable packet is
`docs/changes/CUST-WP-0079/policy-publication-r1/PLAN.md`, hashlist SHA256
`309ef01650b65bc6b28e86daad9b2835a242631cf60e0896e849461bb917504f`.
The supervision record binds original and approved revision 1. It authorizes
image `214b122c3d175563f114552fa1826dac9642433be019c736c3265d0a3ef379f1`,
paired release hashes, exact hosting changes and rollback to verified live
revision 9. Nine rendered resources passed server dry-run; only image/release
metadata changes. The owner is executing the approved sequence after fresh
preconditions. T04 remains open until public and native verification succeeds.

Activity Core `fed119a` bakes the pinned commands and enforces required input
admission; `3b25aea` selects an immutable snapshot through a protected descriptor
under a fixed retained mount. The latter has 76 focused passing tests. This
avoids a deployment patch for every new snapshot. The existing core-hub publisher
has Forge custody, but no accepted file-transport path to Activity Core exists.
An opt-in endpoint, exact 15-repository disclosure policy, narrowly selected
network access and receiver are being prepared. Existing Forge read authority
does not authorize this new downstream disclosure. No new credential mount or
live access change has been made; both job definitions remain disabled.