{ "schema": "nutricoach-telegram-checkin-stepper-task-11-day-status-migration-design-v1", "task_id": "st_01a05dd4", "status": "DESIGN_COMPLETE_NO_EXECUTION", "decision": "RECOMMEND_ONE_USE_CANONICAL_REISSUE", "scope": { "advisory_only": true, "source_edits": 0, "live_profile_edits": 0, "authority_edits": 0, "observer_appends": 0, "service_or_timer_actions": 0, "network_provider_customer_actions": 0, "evidence_files_written": 1 }, "constraints": [ "Treat the sole r70 2026-08-31 day-status row as truthful and immutable.", "Keep the committed a41c97c8 r71 root as the sole current authority selected by config.", "Do not delete, replace, truncate, or rewrite either authority root, either authority marker/registry, or the failed observer-r71 prefix.", "Permit exactly one append-only semantic status reissue into r71 and append-only observer receipts later.", "Use a fresh globally unique one-use authorization and execution namespace; do not reuse consumed r71 or occupied/failed r71b namespaces.", "Make process crash, short write, replay, and host restart recoverable without a second authorization attempt.", "Migrate only the one status required by the observer contract and preserve its source provenance.", "Perform no customer, Telegram provider, model provider, or recovery-process network call." ], "architecture_survey": { "authority_creation": { "owner": "scripts/nutricoach_v150_weekly_authority.py", "flow": "weekly_authority_path selects a candidate-suffixed root when a predecessor exists; _register_authority creates a fresh marker and canonical registration; build_weekly_authority_postimage points config at the fresh root.", "gap": "The rotation path registers current canonical files but carries no day-status history, so a valid fresh authority can be semantically incomplete for an observation window." }, "day_status_domain": { "types": "checkin_cli.weekly_operations defines immutable WeeklyOperationRow, canonical row digest, KST-day constraints, state transitions, logical identity, canonical pin, reminder identity, and source lineage.", "persistence": "WeeklyOperationsStore serializes per customer through the authority-root lock then the 0600 sidecar lock; it validates the complete hash chain and appends canonical JSONL with fsync.", "validation": "weekly_operations_history validates filename/customer binding, predecessor digests, canonical pins, logical keys, KST times, and legal state transitions.", "filesystem": "weekly_operations_parent/layout/fs bind no-follow directory descriptors, exact 0700/0600 modes, effective-uid ownership, regular files, nlink=1, and named/open inode equality." }, "runtime_consumers": { "startup": "nutrition_weekly_reminder_bootstrap opens only weekly_operations_authority_path, reconstructs the root binding from marker and registry, and binds registered canonical customer capabilities.", "dispatcher": "nutrition_weekly_dispatcher validates every status row against the current canonical prefix, correlates only the current KST day for Topic 59, and never consults a predecessor root.", "blast_radius": "The missing row affects continuity observations and historical weekly summaries for one customer. Reissuing an old-day row cannot itself select a current-day Topic-59 publication because dispatch filters row.kst_day == now.date()." }, "observer": { "collector": "nutricoach_v150_observer_runtime.day_status_days correctly reads only the configured current authority root.", "contract": "nutricoach_v150_observer_contract requires 2026-08-31 after the first-day deadline.", "persistence": "observer-r71 is an append-only SHA-256-linked JSONL chain. Its existing FAIL rows are truthful and must remain as the byte-identical prefix.", "finalization_limit": "Because final_verdict rejects any failed observation, this recovery must not claim that the original seven-day chain became an all-PASS chain. It may truthfully prove a later manual PASS and directly linked natural timer PASS." }, "control_plane": { "current_r71": "Original r71 authorization is already CONSUMED/SUCCEEDED and execution COMMITTED; it cannot authorize this append.", "pattern": "nutricoach_v150_sealed_authority and nutricoach_v150_phase_journal provide the existing global one-use ledger and durable phase concept, but the recovery package must strengthen all new path opens with exact no-follow/owner/gid/mode/nlink checks.", "recovery_boundary": "No gateway deployment or restart is needed. A net-unshared one-shot controller can use the installed a41c97c8 checkin_cli modules and the same descriptor-bound authority/store contracts." } }, "verified_design_time_facts": { "captured_at_kst": "2026-09-02T01:42:17.285018+09:00", "current_candidate_digest": "a41c97c8a467b0308b9f50ac072cc3adae1c2d47ca515b76f123e7c1debee9be", "config": { "path": "/home/cube/.hermes/profiles/dualcoachtest/config.yaml", "sha256": "9e3bf9fb0233e1c317b968eab6f51f5bc73f729d5a09a6b4011829eb7352f86b", "selected_authority": "data/weekly-operations-authority-a41c97c8a467b030" }, "r70_source": { "root": "/home/cube/.hermes/profiles/dualcoachtest/data/weekly-operations-authority-81a7a06ec2e7a159", "root_device_inode": [66306, 45242251], "marker_sha256": "39d786bef523af384252b1be17ae929b26435b70b759746eb3704072a9f11a8f", "registry_sha256": "542555cf4068012028711441ed220e6c80ab182462bbfd6eff95856bb0ba472f", "sidecar_sha256": "7a8d7d6ecc66c863bc27793df6a5f3efd1ba0661cf3568095b6b9bcf4cb45208", "sidecar_inode": 45242255, "sidecar_size": 792, "row_count": 1, "row_digest": "405b519c7f0ae51d413d26e4ca5bb1fd69786c3eb11a5dbe1f00e2701bd90d26", "customer_identity_digest": "253243ad46f32f8d456514b1c8a8fda4f605dc04874b69b1e3ded72de49c877c", "storage_digest": "93f977332e8ca6e15d229c7154154b373bd9c07259fb3940b4c07e1b4227e823", "kst_day": "2026-08-31", "state": "missed", "canonical_sequence": 0, "canonical_digest": "dd9cdc73c717380a6aa3e1d35edfcafc8ba949eaf7203029b159422330257cdf", "predecessor_row_digest": "0000000000000000000000000000000000000000000000000000000000000000", "structural_validation": "PASS via installed validate_history_bytes" }, "r71_target": { "root": "/home/cube/.hermes/profiles/dualcoachtest/data/weekly-operations-authority-a41c97c8a467b030", "root_device_inode": [66306, 45242337], "marker_sha256": "dd5981f94300d1fa9269fac018c8c309badee2dd4096daab82237630d105c57f", "registry_sha256": "b7a5dde559c7de527a69a41037e95d2337579370bf22668b064a7295e7b19e20", "sidecar_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "sidecar_inode": 45242341, "sidecar_size": 0, "row_count": 0, "canonical_sequence_zero_digest": "dd9cdc73c717380a6aa3e1d35edfcafc8ba949eaf7203029b159422330257cdf", "canonical_compatibility": "The source row's sequence-zero pin exactly equals canonical_prefix_pin({sequence:0,rows:[]}) for the current canonical stream." }, "r71_receipts": { "execution_phase_sha256": "4e5ff24c555205b9bfe7417cc02f70c375254065c70d6073a4025faf53b8ec9d", "authorization_consumed_sha256": "fc242dec4cab503922222377b047503529528c8aa666e38e0c34aaa77e297e19", "production_evidence_sha256": "a34a44aca67772f894cfac6f081f28c5a1f5e8ef43974216702dc434c12f84eb" }, "observer_r71_volatile_snapshot": { "warning": "This is design-time evidence only. The timer is live; execution must fence the timer and capture a fresh validated head under the reserved transaction.", "rows": 3, "sha256": "adbcd2a147ad9930f4be1993b0a0c5d09b5ff2a8584145e1552f4eca521ff2cb", "head_row_digest": "9d288f833f278ee00d6965415d262826d11eb992f58803105e6bdca159e631c9", "head_status": "FAIL", "head_failures": ["first_day_status"], "task11_evidence_sha256": "64b3eeee5d3b1621b7cd5e258c1a2c8fcf28274b0d8aca41c0e459635e085f85" }, "installed_source_parity": "The installed a41c97c8 weekly_operations, store, history, fs, layout, authority, and authority_root modules are byte-identical to the inspected worktree versions.", "concurrent_codemap": { "path": "/home/cube/projects/richard/traning coach/.omo/evidence/nutricoach-telegram-checkin-stepper/task-11-day-status-migration-codemap.json", "sha256": "e96c5fce1ba436a47ae24f5904506951514dbc96a144c00e76286d4eadceb8fd", "agreed_findings": [ "No supported cross-authority migration API/CLI currently exists.", "The row is customer/canonical-history bound rather than candidate/authority bound, and exact typed reconstruction reproduces all 792 bytes.", "Raw live copy is unsafe; a fresh sealed one-use package and external predecessor-provenance receipt are required.", "Original r71 cannot be replayed and observer-r71 can never become an all-PASS seven-day chain." ], "adjudication": "For this explicitly minimum one-row recovery, a package-local controller that composes the existing Store read/append contracts is smaller than adding a permanent generic migration module and redeploying the gateway. The requested postcondition is a later linked manual/timer PASS pair, not retroactive all-PASS seven-day coverage, so appending those truthful receipts to the preserved failed chain is smaller than introducing a new observer implementation/namespace. If clean genesis or a new seven-day final verdict becomes a requirement, use a fresh observer namespace as a separate scope." } }, "options": [ { "name": "one_use_canonical_reissue", "viability": "VIABLE_RECOMMENDED", "design": "A sealed net-unshared one-shot controller parses and validates the sole r70 row, verifies its canonical pin against r71's current registered canonical source, reconstructs the equivalent WeeklyOperationInput, and calls the installed WeeklyOperationsStore append path against r71. A separate immutable execution receipt binds source root/row to target root/row.", "coupling": "Narrow coupling to the current row/store/authority contracts and observer systemd unit; no gateway source or config change.", "testability": "High. The controller can run against disposable descriptor-bound roots with injected short writes and fake systemd observation events.", "migration_cost": "One row, one fresh authorization/execution package, no service restart, no future dual-root read.", "failure_modes": "Known strict-prefix partial append, full append with missing receipt, or pre-append no mutation; each has a deterministic recovery disposition. Unknown target bytes fail closed." }, { "name": "general_authority_rotation_migrator", "viability": "VIABLE_NOT_RECOMMENDED_FOR_THIS_INCIDENT", "design": "Add a product-supported migration phase to weekly_authority creation so every future candidate root canonically reissues an explicitly retained status window before config switches authority.", "coupling": "Touches root creation, live upgrade snapshots, rollback, candidate packaging, startup smoke, and every future authority rotation.", "testability": "Good but broad: all rotation, rollback, multi-customer, retention-window, and upgrade fault matrices must be rerun.", "migration_cost": "High relative to one missing row; requires new wheels and a gateway deployment even though runtime read behavior is already correct.", "failure_modes": "A migration bug can block or contaminate all future rotations, copy more history than required, or complicate upgrade rollback.", "decision": "Defer as a separately scoped prevention fix; it does not earn its blast radius for the present recovery." }, { "name": "raw_byte_copy", "viability": "REJECT_UNSAFE", "design": "Copy or append the 792 source bytes directly into the empty r71 sidecar.", "rejection_reasons": [ "It bypasses the installed typed store, current canonical-pin verification, authority binding, conflict detection, and normal lock order.", "The resulting row is byte-valid only accidentally because both roots currently have an empty first-row predecessor; that is not a migration contract.", "It provides no authenticated cross-root provenance unless a second receipt is invented, at which point canonical reissue is equally small and safer.", "A direct copy/append has an unjournaled partial-write window and invites future use as a generic history copier." ] }, { "name": "observer_fallback_to_r70", "viability": "REJECT_UNSAFE_FOR_STATED_GOAL", "design": "Teach the observer to union or fall back from the configured current root to a sealed predecessor root when the required day is absent.", "rejection_reasons": [ "It repairs only the observer's view; the current r71 authority remains semantically discontinuous for weekly summaries and every non-observer consumer.", "It creates permanent dual-authority read semantics and retention coupling to a stale root.", "The current observer day collector does not perform the full sidecar authority/hash-chain validation that the store performs, so fallback would enlarge its trust boundary.", "It can turn a real authority-rotation defect into PASS evidence without repairing the authoritative data surface." ], "narrow_exception": "It would be viable only for an explicitly evidence-only observer whose contract said predecessor history is authoritative. That is not this goal." } ], "recommended_architecture": { "name": "one-use typed canonical reissue with external provenance receipt", "why": "It is the only small design that restores the single current authority, preserves r70 truth, leaves both roots and the failed observer prefix intact, and reuses the exact production validation/locking semantics instead of creating dual-root behavior.", "assumptions": [ "The r70 source remains exactly the package-bound sole valid row through execution preflight.", "The r71 config, candidate credential, COMMITTED phase, CONSUMED/SUCCEEDED authorization, marker, registry, and empty target inode remain exact until the transaction holds the relevant locks.", "The current canonical sequence-zero prefix still hashes to the source row's canonical digest.", "Before mutation, a read-only observer evaluation has every health check true and its failure set exactly ['first_day_status'].", "The recovery process is launched with its network namespace unshared; existing gateway health/polling sockets are observed but are not recovery calls." ], "fresh_namespaces": { "authorization": "live-authorization-v15/nutricoach-v150-day-status-continuity-r71-r1", "execution": "live-executions-v15/nutricoach-v150-day-status-continuity-r71-r1", "rule": "Both must be absent by lstat before qualification. Never reuse consumed r71 or any r71b path, and never delete an occupied failed attempt." }, "authenticated_inputs_and_digest_binding": { "permission": "Seal a canonical JSON permission package in a private immutable package root. The exact operator phrase is AUTHORIZE NUTRICOACH DAY STATUS CONTINUITY . A correct phrase and package are checked before reservation; the first accepted invocation reserves globally once.", "package_digest": "SHA-256 over canonical JSON excluding only package_digest, with sorted keys and compact separators.", "bind_exactly": [ "recovery schema/id, fresh authorization/execution paths, controller source closure, installed interpreter and relevant wheel/RECORD hashes", "r71 candidate digest, runtime credential digest, config path/hash and configured authority relative path", "r71 COMMITTED phase receipt and CONSUMED/SUCCEEDED authorization receipt hashes", "r70 root path/device/inode, authority marker hash/id, registry hash, source sidecar path/device/inode/mode/uid/gid/nlink/size/hash, sole row digest and all canonical row fields", "r71 root path/device/inode, marker hash/id, registry hash, target data and lock path/device/inode/mode/uid/gid/nlink, and empty preimage hash", "current registered canonical customer binding and canonical prefix pin for sequence zero", "observer source/checksum/service/timer hashes and allowed pre-recovery failure set", "protected customer, scheduled-delivery, Topic-59, config, authority marker/registry, and gateway service-state preimages", "a complete no-send/no-update oracle and zero recovery socket/provider/customer-call oracle" ], "dynamic_observer_head": "After reservation, stop only the observer timer, verify the observer service is inactive, fully validate the existing observer chain, and durably bind its exact byte length/hash/head in append-intent.json. This is an authenticated transaction observation under the sealed admissibility rule, not an unbound input.", "privacy": "The package and receipts store only opaque customer/storage/row/canonical/reminder digests or the already opaque row fields. The raw customer key may be read from the bound current registry in memory solely to instantiate WeeklyOperationsStore; it is never emitted." }, "authorization_and_phase_journal": { "one_use_rule": "A correct accepted launch creates authorization-reserved.json with O_CREAT|O_EXCL, fsyncs it and the directory, and can never be launched again. A recovery entry point may only resume that exact pending reservation; recovery is not a new attempt and accepts no approval phrase.", "phases": [ "RESERVED", "OBSERVER_TIMER_FENCED", "INPUTS_LOCKED_AND_VERIFIED", "APPEND_INTENT_DURABLE", "ROW_DURABLE", "PROVENANCE_DURABLE", "MANUAL_PASS_DURABLE", "TIMER_WATCH_ARMED", "TIMER_PASS_DURABLE", "COMMITTING", "COMMITTED" ], "journal_contract": "Each phase is canonical JSON written to a same-directory temporary, fsynced, atomically renamed, directory-fsynced, reopened no-follow, and read back. Every phase document contains package_digest, prior_phase_digest, source_row_digest, expected_target_frame_digest, and current observer baseline/manual/timer heads as applicable.", "terminal_authorization": "Only after the linked timer PASS does authorization-consumed.json become CONSUMED/SUCCEEDED. Any nonrecoverable failure consumes FAILED. A crash after the row becomes exact always rolls forward within the pending authority rather than deleting the row." }, "canonical_reissue_algorithm": [ "Fence the observer timer, then capture and validate its immutable existing prefix; do not stop or restart the gateway.", "Open the r70 and r71 roots by descriptor-only no-follow traversal. Acquire locks in production order: authority root, then customer sidecar lock. Validate complete inventories, markers, registries, data/lock identities, and source history.", "Require source history to contain exactly the package-bound 2026-08-31 missed row and target history to be empty. Require source and target customer identity/storage digest equality and source canonical pin equality with the current r71 registered canonical prefix.", "Reconstruct WeeklyOperationInput from the validated source row, preserving state, KST occurrence, canonical sequence/digest, source lineage, and reminder reservation/audit lineage. Do not synthesize a new current timestamp or migration state.", "Durably write append-intent.json before target mutation. It binds the canonical expected target frame, whose row digest is expected to equal the source row digest because the target is empty and every semantic field is preserved.", "Release the inspection locks and invoke the installed WeeklyOperationsStore.append operation against r71. This is semantic canonical reissue, not cp, copyfile, or an unparsed raw append. Require appended=True on the first clean execution.", "Reopen under locks and require the same target data inode, exact one-row length, canonical bytes, valid hash chain, expected row digest, and no other authority mutation. Fsync/readback is mandatory.", "Write provenance-receipt.json outside the authority root. Bind source authority id/root/marker/registry/file/row digest to target authority id/root/marker/registry/file/row digest, method=canonical_reissue, package digest, intent digest, and observed append result.", "Run one read-only observer collection and require PASS before allowing the observer append sequence." ], "provenance": { "row_level": "The canonical target row preserves every original semantic and opaque reminder/source field; it does not pretend a new customer event occurred on recovery day.", "cross_root": "provenance-receipt.json records that target row 405b... is a canonical reissue of source row 405b... from r70 into r71. The strict authority inventory forbids placing this receipt inside either authority root.", "immutability_proof": "Postconditions require the entire r70 root hash inventory unchanged and the r71 target data inode unchanged, proving an append rather than file replacement." }, "crash_replay_restart_idempotency": { "normal_replay": "A second launch is refused by the global reservation/consumption root. WeeklyOperationsStore's exact-operation replay would return appended=False, but the launcher must not use that as permission for a second attempt.", "pending_recovery": "The recovery-only entry point inspects phase plus durable bytes. It never revalidates an approval phrase and never creates another authorization root.", "target_state_table": [ { "state": "empty and phase before APPEND_INTENT_DURABLE", "action": "No authority mutation occurred. Restore the observer timer, consume FAILED, record ROLLED_BACK_NO_MUTATION." }, { "state": "empty and phase APPEND_INTENT_DURABLE", "action": "Resume the same reserved attempt through the canonical append; this is crash completion, not retry." }, { "state": "strict nonempty prefix of the exact expected canonical frame", "action": "Under root and sidecar exclusive locks, append only the missing suffix with full-write/EINTR handling, fsync, and exact readback. Never truncate or replace." }, { "state": "exact full expected canonical frame", "action": "Do not append again. Roll forward provenance, observer receipts, authorization consumption, and COMMITTED." }, { "state": "anything else, including a byte mismatch, extra row, changed inode, or unrecognized child", "action": "Do not alter authority bytes. Restore/leave the observer timer active for truthful failures, consume FAILED, emit an incident, and forbid retry of this namespace." } ], "observer_restart": "The fenced baseline head makes observer append recovery deterministic. If the first suffix row already exists and is a valid PASS linked to baseline, it is the manual result and is not repeated. If the next row is a valid PASS linked to manual and systemd timer evidence names that invocation, it is the timer result. Additional valid timer descendants after a controller crash are retained and do not invalidate the required pair.", "host_restart": "A recovery-only command may be invoked after restart whenever the exact reservation is pending and phase is nonterminal. It first reopens every path no-follow, checks package/intent digests, and resumes only the state-table action." }, "permission_mode_no_follow_contract": { "directories": "Package, authorization, and execution directories are real directories, exact euid:egid owned, nlink=2, mode 0700, and reached component-by-component with O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC.", "authority_paths": "Both live roots must remain mode 0700. Marker, registry, source/target data, and source/target lock must remain regular, exact euid:egid owned, nlink=1, mode 0600, and opened relative to pinned root dir_fds with O_NOFOLLOW|O_CLOEXEC|O_NONBLOCK.", "control_files": "Permission package, reservation, consumption, phase, intent, and terminal provenance receipts are regular exact-owner files with nlink=1 and mode 0400 after publication. Transaction locks are mode 0600. Existing observer unit/timer files are hash-checked but not chmodded or rewritten.", "writes": "Use full-write loops, EINTR handling, fsync(file), atomic same-directory publication for control receipts, fsync(directory), and no-follow readback. The authority data mutation is append-only to the existing inode; no rename, truncate, unlink, chmod, or replacement is allowed.", "unexpected_paths": "Any unexpected package/execution child or authority-root child fails closed. No broad volatile prefix is authorized." }, "observer_choreography": { "preserve_history": "Use the existing observer-r71 chain. Its complete failed prefix remains byte-for-byte intact; no new clean namespace or false seven-day DoneClaim is needed for the requested recovery pair.", "race_fence": "Stop only nutricoach-v15-seven-day-observer.timer before capturing the baseline head; verify the service is inactive and no append is in flight. Revalidate the head after the stop.", "manual_pass": "After ROW_DURABLE and PROVENANCE_DURABLE, invoke the observer service exactly once. Require the first row after baseline to have status PASS, failures=[], previous_row_digest equal baseline head, current r71 candidate/receipts, and day_status_days containing 2026-08-31.", "natural_timer_pass": "Subscribe to the exact observations.jsonl append/replacement event before starting the timer. Start/restore the timer, never the observer service a second time. Await the timer-caused service invocation with a bounded timeout derived from the next OnCalendar deadline plus grace; no sleep or polling. Require the next observer row to be PASS with previous_row_digest equal the manual row digest and corroborate it with systemd timer LastTrigger/InvocationID journal evidence.", "terminal_state": "Timer enabled and active/waiting, gateway PID stable, NRestarts=0. The original failed rows remain visible, so the original seven-day final verdict remains historically failed even though recovery health is proven." }, "postconditions": [ "r70 marker, registry, status data, lock, inode/mode/owner/link metadata, complete tree digest, and row digest are unchanged.", "r71 remains the configured sole current authority; config, marker, registry, canonical customer files, registration row, lock inode, and authority directory are unchanged.", "The pre-existing r71 status data inode now contains exactly one 792-byte canonical row for 2026-08-31; its row digest and complete bytes equal the source semantic reissue; no second day/status row exists.", "A valid external provenance receipt binds source and target roots/rows and is linked from the phase journal.", "Fresh authorization is CONSUMED/SUCCEEDED exactly once and execution is COMMITTED; approval replay is refused.", "observer-r71's pre-transaction bytes are an exact prefix, followed first by manual PASS and then a timer-caused PASS whose previous_row_digest equals the manual row digest.", "Observer timer is active/waiting; gateway remains active/running on the same PID with NRestarts=0.", "Customer registry/events/bindings/drafts, scheduled-delivery ledgers/fence, Topic-59 ledger, cron definition, config, and all unrelated authority roots are byte-identical.", "Recovery send/edit/model/network/customer-action counts are all zero; no delivery state or provider receipt is fabricated." ], "rollback_and_no_retry": { "before_append_intent": "Restore the observer timer to its prior enabled/waiting state, consume FAILED if reservation exists, record no-mutation rollback, and leave all authority/observer bytes unchanged.", "after_append_intent_before_any_byte": "The same pending recovery may continue once. It is not a new launch or retry.", "after_expected_partial_or_full_row": "Rollback is forbidden because it would delete/rewrite append-only truth. Complete a strict prefix or roll forward receipts and observations.", "unknown_target_bytes": "No truncate, repair, replacement, or retry. Leave evidence intact, return the timer to truthful operation, consume FAILED, and require a separately designed forensic decision.", "observer_failure_after_row": "Preserve the valid status row and every truthful observer PASS/FAIL append, leave the timer active, consume FAILED, and do not replay the manual observer or reuse authority.", "postcommit": "There is no rollback. The row is truthful continuity, not a temporary deployment artifact." } }, "test_plan": { "contract_and_unit": [ "Parse the bound r70 frame through validate_history_bytes and reconstruct the exact typed operation; canonical reissue into an empty r71 fixture yields the same row digest and bytes while preserving reminder/source fields.", "Reject any source history other than the one exact row and any target preimage other than empty or a pending-attempt strict prefix/full expected frame.", "Verify current canonical prefix sequence/digest before append and reject canonical drift, customer mismatch, root aliasing, marker/registry drift, or current-config pointer drift.", "Spy that the clean path calls WeeklyOperationsStore.append and never cp/copyfile/raw initial append." ], "filesystem_adversarial": [ "Symlink at every path component and at package, reservation, phase, intent, marker, registry, data, lock, observer log, and timer/unit path.", "Hardlink, wrong uid, wrong gid, wrong mode, wrong nlink, directory/file kind swap, FIFO/device/socket, oversized/trailing/duplicate-key/noncanonical JSON, inode replacement after open, and unexpected authority/execution child.", "Require zero target mutation and zero provider/network/customer calls for every rejection." ], "fault_injection": [ "Inject before/after reservation, timer fence, each phase rename/fsync/readback, intent publication, every possible short-write offset, data fsync, data readback, provenance publication, manual observer append, watcher arm, timer start, timer append, authorization consume, and COMMITTED publication.", "For every expected strict prefix, one recovery invocation produces exactly one valid row without truncation/replacement; for full rows it never appends again.", "Host restart at every phase exercises only the recovery entry point and never accepts the approval twice." ], "concurrency_and_observer": [ "Race a real current-root store reader/writer with the migration using barriers/events and assert production lock order serializes it.", "Fence an observer timer event concurrent with stop and require the recaptured baseline to include either the complete prior append or none, never a torn assumption.", "Subscribe before manual/timer trigger and await exact events with bounded timeouts; no fixed sleep, polling delay, or timing-luck assertion.", "Crash after manual append and after timer append, then prove recovery recognizes existing linked rows without duplicate manual invocation." ], "integration": [ "Run from the sealed installed a41c97c8 wheel in a disposable profile clone with PYTHONPATH cleared and a socket guard/network namespace; prove no source-tree import.", "Use fake provider/model transports that raise on call and assert send=0, edit=0, model=0, network=0, customer updates=0.", "Run one disposable end-to-end success plus the complete failure matrix once; verify source/target inode semantics and protected before/after inventories.", "Verify a normal current-day synthetic dispatcher still reads only r71 and that the historical reissue does not select a Topic-59 delivery." ], "live_qualification": [ "Fresh candidate/package/preseal verification and source closure hashes.", "Independent package mutation, approval replay, occupied-root, partial-frame, observer-chain, and no-follow attacks.", "Read-only immediate live preflight, one authorized invocation, event-driven observer pair, and independent postcondition verification without rerunning the launcher." ] }, "evidence_contract": { "preseal": "Record package digest, exact bound input hashes/metadata, source closure, installed wheel RECORD, fresh-root absence, approval phrase digest, test commands/exit codes/counts, and independent verifier output.", "execution": "Record reservation/consumption bytes, every phase digest, append intent, source and target before/after inode/hash/mode, append result, strict-prefix recovery disposition if any, and provenance receipt.", "observer": "Record fenced baseline byte hash/head, exact manual row, exact natural timer row, systemd trigger evidence, prefix preservation, timer final state, and explicitly state that historical FAIL rows remain.", "safety": "Record protected inventory before/after, gateway PID/NRestarts, zero send/edit/model/network/customer counters, no unexpected paths, and forbidden-operation count.", "failure": "On any failure, record phase, authorization outcome, exact target classification, timer restoration state, whether row is valid, and why retry/rollback is forbidden. Never delete failed evidence." }, "risks_and_controls": [ { "risk": "The target row is byte-identical to the source and could look like an unaudited copy.", "control": "Require typed Store reissue on the clean path plus a package/intent/provenance chain binding both authority identities and the exact source row." }, { "risk": "Regular-file append is not transactionally atomic across short write or process death.", "control": "Durable expected-frame intent plus append-only strict-prefix completion; never truncate or replace." }, { "risk": "A timer fires before the manual PASS and breaks required ordering.", "control": "Fence and revalidate the timer/chain before mutation; start the timer only after the manual row is durable and an exact event subscription is armed." }, { "risk": "The observer pair could be misreported as repairing the original seven-day history.", "control": "Preserve FAIL prefix, do not alter final-verdict rules, and label the result continuity-recovery PASS only." }, { "risk": "Same-uid replacement of package, runtime, and authority together defeats local digest checks.", "control": "This is the existing explicit operator trust boundary. Exact owner/mode/no-follow/inode/package closure checks detect narrower substitutions but do not claim protection from a fully compromised profile uid." } ], "done_definition": [ "Exactly one source-bound 2026-08-31 status row exists in current r71 and no other status was migrated.", "The source row/root and target authority marker/registry/config are unchanged; target data was append-only on the same inode.", "Fresh one-use authorization is SUCCEEDED and execution COMMITTED with provenance receipt.", "The preserved observer-r71 chain later contains manual PASS followed immediately by a naturally timer-triggered linked PASS.", "All provider, customer, model, and recovery-network effects are zero, and all unrelated protected bytes are unchanged.", "No claim is made that historical FAIL observations or the original seven-day final verdict were erased." ] }