the-custodian/workplans/CUST-WP-0077-dependency-root-execution-wave.md

---
id: CUST-WP-0077
type: workplan
title: "Advance implementable dependency roots after receiving rollout"
domain: infotech
repo: the-custodian
status: finished
flavor: implementation
owner: codex
topic_slug: helix-forge
created: "2026-10-04"
updated: "2026-10-08"
depends_on: []
state_hub_workstream_id: "b5f87f0c-fed0-5a19-a61a-0fb5bddefdf7"
---

Founder mandate: start tackling blocked plans and move them forward from the
dependency graph. This is a bounded source implementation wave. Independent
identity, custody, native execution, publication and human gates keep their
existing owner records and authority.

## Select source work from the current graph

```task
id: CUST-WP-0077-T01
status: done
priority: high
state_hub_task_id: "23e9d8a1-a4eb-56e4-952b-897865d9fe17"
```

Fresh visible scan: 146 registered repos, 144 checkouts, 105 open non-residual
plans (99 blocked), 239 waits, 85 human gates. SAND-WP-0015-T04 affects nine
plans; SECRETS-WP-0009-T03 seven and GLAS-WP-0012 six. There are no remaining
terminal-predecessor waits. Select executable preparation and source fixes,
not a mechanical status reset. Two frontend waits lack qualifiers and one
projected qualifier differs; retain these observation limits.

## Prepare native runtime entrypoint evidence at the largest root

```task
id: CUST-WP-0077-T02
status: done
priority: high
state_hub_task_id: "c80f0755-4c28-51d9-84ff-bb42f129cfe6"
```

The sandbox owner worker strengthens the existing no-credential bwrap runtime
smoke for the actual installed rein and Glas launchers. Broken relocated
entrypoints must be observable before paid native trials. This does not supply
fresh retry authority, reconciliation of the EUR10 trial, credential delivery
or acceptance of SAND-WP-0015-T04 / GLAS-WP-0012.

## Advance receiving compatibility and owner-return source handling

```task
id: CUST-WP-0077-T03
status: done
priority: high
state_hub_task_id: "881554bd-e16f-5681-a013-d2cffcb4d3c0"
```

Repo Manager/State Hub workers prepare source-bound legacy-record receiving
compatibility, duplicate-holder protection, and the supported owner-return
planner with receipt deduplication. Preserve identities and historical views;
do not widen registrar acceptance before the receiving path is safe. Existing
owner plans retain rollout and runtime activation obligations.

## Deliver the ready operator-matrix construction contract

```task
id: CUST-WP-0077-T04
status: done
priority: high
state_hub_task_id: "66eb5ab6-0c2c-5426-9db4-91d537c53aef"
```

Implement the ops-mason side of MASON-WP-0005-T02 with exact four-entry policy,
confirmed identity/review parameters and fresh exact-spec approval checks.
Local tests prove scope and refusal; platform contract review and the confirmed
OIDC identity remain live dependencies. No OpenBao command is run in this wave.

## Verify and synchronize owner progress

```task
id: CUST-WP-0077-T05
status: done
priority: high
depends_on: [STATE-WP-0095-T03, STATE-WP-0095-T04, RMGR-WP-0019-T02, RMGR-WP-0019-T03]
state_hub_task_id: "4cefbd21-3c54-52b5-8569-7e43487203f3"
```

Apply reviewed guarded source artifacts, run meaningful owner checks, retain
failed attempts, commit scoped changes and obtain exact primary receipts where
supported. Attach cross-owner observations as coordination cases through the
existing project driver when available. Retain receiving/registrar failures
without direct DB edits or invented approvals. Leave actionable continuing
owner work in live records before closing this wave.

2026-10-04 source delivery: State Hub 155 actual-source tests; ops-mason 92;
sandbox full lint/test gate 219. Initial owner-return planner review identified
missing independent human-gate eligibility; corrected before commit/activation,
with 30 planner cases in the final combined suite. Historical source snapshot
proof preserved five parents and 65 tasks without mutation. At initial source delivery, registrar was unapplied behind STATE-WP-0095-T03;
the approved deployment/admission return below supersedes that observation. Source receipts and waiting coordination
cases: docs/evidence/2026-10-04-dependency-root-wave/.

## Dependency review before verified receiving return — 2026-10-04

T01–T04's source deliveries remain done. The remaining T05 owner-return
verification cannot be implemented in this checkout, so T05 is `wait` and the
workplan is `blocked`. Current file/Hub observations and coordination cases
are retained in `docs/evidence/2026-10-04-custodian-blocked-review.json`.

| Owner commitment | Required return before T05 can finish |
| --- | --- |
| state-hub STATE-WP-0095-T03 | Exact deployed receiving commit/image and health/schema/source verification; prove immutable historical receiving and global UUID-holder refusal. The existing rollout approval/execution record remains unverified at review time; do not duplicate its execution or score approval as success. |
| repo-manager RMGR-WP-0019-T02/T03 | Admit only after the verified receiving return, then provide actual registrar tests and normal activity-core/the-custodian replay receipts. Preserve the four Activity historical parents/64 tasks and Custodian retired parent/task: no creation, movement, deletion, relabeling or unretirement. |
| state-hub STATE-WP-0095-T04 | Accept the before/after historical identity proof from the normal replay and record the owner outcome. Unrelated refusal gates remain live, separately qualified work. |

These waits attach to the existing HFACT-WP-0001 project driver. No owner task
is patched and no deployment is initiated here. Other continuing obligations
already have live owner records in the source-summary receipt: SAND-WP-0015,
REINAH-WP-0003, MASON-WP-0005 and STATE-WP-0094. Their source preparation does
not satisfy their native execution, identity, custody, human or publication
gates. No additional residual plan is needed to preserve those obligations.

Review synchronization: `statehub fix-consistency --repo the-custodian
--no-writeback --json` was interrupted during its read phase after inspection
showed that its Git lifecycle automatically pushes ahead commits. The existing
no-push instruction remains in force. The committed source status, wait reason
and four task dependency edges were instead projected through supported Hub
REST endpoints and read back; all three reviewed workplan statuses and eight
wait reasons match the files. `WORK-RECORDS.md` was regenerated with the
consistency checker's local renderer. Receipt:
`docs/evidence/2026-10-04-custodian-blocked-sync.json`. This is a scoped cache
sync, not successful full consistency or historical registrar reconciliation;
the latter retains the owner requirements above.

2026-10-04 approved receiving closure: exact revision1 deployed as main-5dd3df9,
Helm72. API/MCP Ready, health/schema/source verified, five frozen parents65tasks
unchanged. Native global UUID-holder probe refused and rolled back. Registrar
gated apply/38 tests and Repo Manager primary sync passed. Normal Custodian
sync applied; Activity registrar accepted its histories but receiving refused
three unrelated empty duplicate projections requiring separate disposition.
No retirement acknowledgement was issued. Supervised record retains exact
approved/executed digest and actual receipts.

Continuing actionable work remains live; T05 and this plan stay blocked for
the outstanding Activity owner return:
SAND-WP-0015-T04 / REINAH-WP-0003 (corrected immutable artifact, EUR10 and
fresh native-trial authority); MASON-WP-0005-T02 / RPF-WP-0035 (platform
contract review and confirmed IAM binding); STATE-WP-0094-T03/T05 (planner
activation and remaining owner-return contracts); STATE-WP-0095-T04 /
RMGR-WP-0019-T03 (Activity disposition91b7c633-a66f-5d43-9f4b-6565aefb9356
and bounded receiving/replay). These are existing non-residual owner tasks,
not leftovers parked only in prose. Receipts and cases live in the evidence
directory named above.

The earlier deployment/admission dependency review is now partially satisfied:
STATE-WP-0095-T03 and RMGR-WP-0019-T02 are done in owner files and primary
receipts. T05 remains wait because Activity replay still refuses the three
separately dispositioned duplicate projections. No claim of finished full
owner-return verification is made. Exact pending decision and live ownership
are recorded above; the paid native and operator-matrix gates also remain.

## Owner-return closure — 2026-10-08

The Activity owner return T05 waited on is complete in owner files. The founder
resolved decision `91b7c633` and approved the rollout. State Hub `main-968a811`
(Helm revision 74) retired exactly the three empty stale projections: 0 created,
3 retired, 0 refused, 0 tasks cancelled. The four Activity historical parents,
their 64 tasks and the Custodian retired parent/task are unchanged (state-hub
`docs/evidence/2026-10-06-activity-stale-retirement-rollout.json`, commit
`30c9b1a`). Repo Manager re-ran the Activity owner sync and closed
RMGR-WP-0019-T03 (`242d85a`). STATE-WP-0095 and RMGR-WP-0019 are both
`finished`.

Continuing owner work stays in live owner records, not in this wave:
SAND-WP-0015-T04 (wait), STATE-WP-0094-T03/T05 (wait), REINAH-WP-0003 and
RPF-WP-0035. MASON-WP-0005-T02 is done. T05 is done and this wave is finished.