# NutriCoach v1.5 live-controller debug journal

## Runtime

- CPython via `uv`
- systemd user service `hermes-gateway-dualcoachtest.service`
- live process is observation-only until a successor approval is supplied

## Reproduced failure

Concrete v2 rehearsal copied the sealed read-only current runtime, failed while
preparing the successor, then raised a second `PermissionError` from rollback
cleanup. That secondary error masked the primary error and prevented synthetic
service restart. The live target and live approval ledger were untouched.

Receipt:

- `/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/live-transaction-rehearsal-v2/blocker-receipt.json`
- SHA-256 `8a3a05acb12ff05d09628a8cf02b6326b38cdcb15828b1fd2194a796aa4c044c`

## Orthogonal hypotheses

1. **Installer semantics:** copying a sealed read-only runtime creates an
   unwritable successor; a fresh writable venv toggles the install failure.
2. **Rollback semantics:** plain `shutil.rmtree` on read-only files raises
   during cleanup; permission-safe removal plus error aggregation toggles
   residue and service-restart failures without hiding the primary error.
3. **Contract parsing:** omitted `channel_inbox` is the shipped default OFF;
   treating omission as OFF toggles the false rejection while explicit ON
   remains denied.
4. **Authority binding:** package v2 binds paths but not concrete controller
   derivation; adding the canonical derivation to the approved payload toggles
   altered-source/target/ledger acceptance to denial.

## RED to GREEN requirements

- exact live-config fixture with omitted Channel Inbox
- copied/read-only current runtime with fresh successor install
- cleanup `PermissionError` after primary install failure
- cleanup failure must not mask primary failure
- prior service restart after every post-stop `BaseException`
- altered controller source, target, ledger, wheel, or v7 reference denial
- global one-use denial across alternate execution roots

## Artifacts

| Artifact | Classification | Cleanup |
|---|---|---|
| v2 blocker receipt and network trace | permanent evidence | preserve |
| disposable rehearsal clone | temporary | already removed |
| v2 approval ledger | forbidden live side effect | confirmed absent |
| v3 source and tests | deliverable | preserve after GREEN |
| v3 rehearsal clones/caches | temporary | remove before PASS |
| Oracle Triple sessions | read-only evidence | no filesystem cleanup |

## Final cleanup gate

- no disposable clone, cache, or unauthorized ledger
- live profile/unit/drop-in/runtime/PID/start identity unchanged before approval
- only source/tests and immutable evidence remain

## Resume checkpoint — 2026-08-28

- Tier: **HEAVY** — authorization, permissions, one-use transaction,
  crash-recovery and systemd rollback boundaries are in scope.
- Skills:
  - `coding-agent-sessions`: reconstruct the exact parent transcript and child
    linkage instead of relying on compacted memory.
  - `programming`: strict Python/TDD/static requirements for V3 source/tests.
  - `debugging`: hypothesis journal, Oracle Triple, runtime RED→GREEN and
    cleanup discipline.
  - `review-work`: fresh independent post-repair audit before authorization.
  - `ultrawork`: binding goal/notepad/todo/evidence synchronization.
- Transcript source:
  `/home/cube/.senpi/agent/sessions/--home-cube-projects-richard-traning coach--/2026-08-15T03-46-57-912Z_01a00387-aaf8-7f2f-89e3-e24c1af24859.jsonl`
- Oracle Triple terminal results were recovered from existing children; no
  duplicate child was created.
- Oracle verdict: V2 is not authorizable. Critical additions are detached
  trusted-bootstrap closure, actual nested weekly migration, installed/loaded
  identity, real systemd observation, durable short-write/fsync-safe ledger,
  complete restore, owned-path deletion, SIGKILL recovery, and enforced
  network/environment isolation.
- Goal registry drift: current registered goal is the superseded v1.4 goal and
  Boulder still marks it active. V1.5 todo/plan already superseded it. Preserve
  completed history, archive the stale goal, then register the V3 HEAVY goal.
- Live invariant: no profile/service/Telegram/customer/provider/network write;
  neither V1/V2/V3 live ledger may be created or consumed.

### Exact QA scenarios

1. `uv run <v3-verifier> --verify <v3-seal>` → exit 0 plus one canonical PASS;
   every altered source/target/ledger/wheel and old phrase → nonzero before
   ledger creation.
2. `<v3-rehearsal> --matrix --root-a <clone-a> --root-b <clone-b>` → all
   success/fault/crash/replay cases PASS; exact rollback state and zero external
   events.
3. `<v3-rehearsal> --full-success` twice → actual offline wheel install,
   parsed weekly authority ON, capacity 5, Inbox OFF, exact loaded identity and
   real systemd-shaped active/running/PID.
4. Fresh independent architecture/rollback/authority audits → unconditional
   PASS and live before/after receipt exact.

## Synchronized control plane

- Old v1.4 goal archived complete (`11583s`, `426908` tokens).
- New HEAVY V3 goal registered.
- Boulder and `v3-state-ledger.json` now identify V1.5 V3 as active.
- Existing team topology retained:
  - `live-controller`: source/tests/package/seal
  - `transaction-rehearsal`: two-root success/fault/crash/replay matrix
  - `pre-exec-audit`: final independent audit
- All three completed Oracle outputs were delivered to those existing roles.
- Project memory write was unavailable because this session has no bound memory
  identity; this journal, the ultrawork notepad, plan, Boulder and V3 ledger are
  the durable fallback.

## V3 sealed, rehearsed and independently audited

- Five strict source gates: PASS.
- Manifest-last V3 verifier: `V3_PRESEAL_VERIFIED`.
- Two-root success, 66 stage/BaseException cases, durable write/restore faults,
  SIGTERM/SIGKILL recovery and replay matrix: PASS.
- Rehearsal cleanup: exactly five evidence files; no harness/cache/clone.
- Independent audit: unconditional PASS, SHA-256
  `e7ed25be87684eb6e79448537696bd02e918a6bf98b8ae84194af7bdffd12b24`.
- Final lead proof:
  - service active/running, PID `571685`, start `2234547821498`
  - unit/drop-in/config/registry hashes equal audit baseline
  - all predecessor/current ledgers and V3 execution root absent
  - verifier still PASS
- State: `AWAITING_EXACT_OWNER_AUTHORIZATION`; nothing consumed.

## Exact V3 owner authorization received

- Exact digest: `3fbaea7e19a77a1007e27f3f0a3610a727baeeb2ab7bded1f5301a3da5872dd9`.
- Pre-execution verifier: PASS.
- Global ledger/execution root: absent before launch.
- One sealed live invocation authorized; no retry authorized.

## Live attempt 1 failure and root cause

- Exit: `1`, before ledger/controller/live mutation.
- Exception: `PermissionError: /proc/1/ns/net`.
- Hypotheses:
  - sandbox did not unshare networking — disproved by real Bubblewrap view
  - procfs visibility made `/proc/1` unreadable — confirmed
  - arbitrary sandbox command omitted isolation — disproved by sealed command
- Runtime toggle:
  - host `/proc/net` gate: `BootstrapDenied: network_namespace`
  - Bubblewrap `--unshare-net`: `BWRAP_NETWORK_ISOLATED`
- Regression: RED import failure, then GREEN.
- Strict successor source: 66 tests; Ruff/basedpyright/ty/no-excuse PASS.
- Containment: no ledger/execution root, no service transition, critical hashes
  exact.
- Directive: never retry digest `3fba…72dd9`; mint a new audited authorization.

## V4 rehearsal controller-binding blocker

- Network gate itself: real Bubblewrap PASS, direct host DENY, zero connects.
- Transaction stopped before first mutation:
  `V4_DISPOSABLE_DENIED:wrong_approval`.
- Root cause:
  - controller `PACKAGE_DIGEST = DISPOSABLE_V3`
  - controller/host hardcoded `live-transaction-preseal-v3`
  - worker could not route V4 sealed authority into the transaction
- Blocker receipt SHA:
  `9429231b07dba4a44bf58e9435859e4231ee9455e86fbf2ae7143c3ae9f4a27d`.
- Cleanup SHA:
  `3745c9808143977f9c3255ed65d1a9a954538f2c440af8e8e03cd57e9d06498a`.
- V4 digest `cb18…2f41` is non-authorizable.
- V5 binding regression was RED on `wrong_approval`, then GREEN.
- V5 source gates: 67 tests, all 30-file strict gates PASS.

## V5 post-stop snapshot blocker

- V5 approval reached the unmodified transaction and was clone-consumed
  `FAILED`; recovery reached `ROLLED_BACK`.
- First blocker: `AuthorityError: unsafe_snapshot_source`.
- Cause: 26,960 hardlinked predecessor-runtime files were incorrectly treated
  as rollback copy sources.
- Blocker receipt SHA:
  `e326d0acb1f40b3b36497125adfeabec4f1703ba7bd19e1454964e8f40e70eb2`.
- Cleanup SHA:
  `543d8936a0d2dba7a1d2e12ca3053f1d496cb6430e2e7498e73f728ff9dc2ce8`.
- Trace SHA:
  `eb91aa88928433fc2ea09fa81a1f73689f3e905094bbbc931af1d3202c046d15`.
- V5 phrase is non-authorizable.
- V6 keeps hardlink rejection for snapshot sources, snapshots only mutable
  paths, hashes stable protected files verify-only, and verifies them after
  rollback.
- V6 strict closure: 68 tests; all 31-file gates PASS.

## V6 offline install and cleanup blocker

- V6 authority reached `install_exact_wheels`.
- Primary: read-only `/tmp/.tmpE0zy0y` blocked exact offline `uv`.
- Secondary: cleanup chmod followed `venv/bin/python` symlink into read-only
  root, leaving a partial successor in the failed clone.
- Clone authority consumed FAILED; no live mutation.
- Blocker SHA:
  `22ffce99e7f27b07083af6943fb1ee83ae05a7aa17fe129e706086e36fc7c25e`.
- Cleanup SHA:
  `8ac13d4a7ad836fe6f36101d0acb811d7b20d811bcc86b9b23488288db4debbd`.
- V6 phrase is non-authorizable.
- V7 adds isolated tmpfs `/tmp` and symlink-safe cleanup.
- Real bwrap tmpfs write PASS; regressions RED→GREEN.
- V7 strict closure: 69 tests; all 32-file gates PASS.

## V7 device-node blocker

- Writable tmpfs `/tmp`: PASS.
- Symlink-safe partial-successor cleanup: PASS.
- Primary: `uv` interpreter query failed opening `/dev/null` with EACCES.
- Both clone authorities consumed FAILED and rolled back exactly.
- Blocker SHA:
  `fc54ac3ef542ceeb62bc9df20447ce93e6dfcc1929016c45fd242e597a852942`.
- Cleanup SHA:
  `140e1ba974027fe4d2cd326c933dbaf649a23897445598811e1b91230ab34662`.
- V7 phrase is non-authorizable.
- V8 mounts isolated `--dev /dev`; never host `--dev-bind`.
- Real offline uv interpreter query inside bwrap: PASS.
- V8 strict closure: 69 tests; all 33-file gates PASS.

## V8 full rehearsal PASS

- Unmodified full chain: PASS.
- Two unrelated committed success clones: PASS.
- Stage/BaseException: 66/66.
- Related regression suite: 45 passed.
- Durable faults/signals/replay: PASS.
- Exact wheels/RECORD/scripts/import origins: PASS.
- Weekly capacity five, Inbox OFF, exact postimages: PASS.
- External events: 0.
- Live state/critical hashes: unchanged.
- V8 live ledger/execution: absent.
- Receipt SHA:
  `a0066988edecd637ad75f1f37dc7f61d2256bf6c0915a17f08b9febc06fbc9df`.
- Cleanup SHA:
  `88838fc1992275e67a9761c906aa829b632e15cb73ab00d260c32a8b2ac9952a`.
- Next gate: fresh independent V8 audit; phrase still withheld.

## V8 independent audit BLOCK — gateway log classification

- Seal/rehearsal/rollback/privacy/cleanup: PASS.
- Fresh live gate: `DENIED:stale_protected_bytes`.
- Path-level diff:
  - target stable rows checked: 86,776
  - target drift: exactly `logs/gateway.log`, append-only size +403
  - other target rows: exact
  - contract inventory: exact
  - unrelated profile rows: exact
- Audit receipt SHA:
  `a978031a9497db1f0edbaa960f8cc330f50affeddf5fbdd4328a22948240a623`.
- V8 phrase is non-authorizable.
- V9 explicitly classifies `logs/gateway.log` as volatile beside agent/errors.
- Regression RED→GREEN; V9 69 tests and all 34-file gates PASS.

## V9 immutable seal

- Digest: `f64ffbde…e92b`.
- Package SHA: `8efea3ed…c4de`.
- Package-manifest SHA: `5ea633ca…47a4`.
- Closure: `sha256:a96bc1b1…c8e1a`.
- Verifier: `V9_LIVE_LOG_CLASSIFICATION_PRESEAL_VERIFIED`.
- PID/start: `571685`/`2234547821498`; active/running.
- V9 ledger and execution roots: absent.
- No rehearsal, live mutation or approval consumption during freeze.
- Next gate: full V9 rehearsal; phrase withheld.

## V9 full rehearsal PASS

- Two unrelated committed-success roots; both consumed SUCCEEDED.
- Exact wheels, RECORDs, scripts and installed imports.
- Capacity five; Channel Inbox OFF.
- Stable verify-only inventory and four mutable snapshot sources.
- Three append-only logs tolerated.
- Stage/BaseException: 66/66.
- Durable faults, SIGTERM/SIGKILL and replay denial: PASS.
- External events: zero.
- Final residue: seven mode-0444 evidence files.
- Rehearsal SHA: `1ba92306…60e5d`.
- Cleanup SHA: `8b3af58b…99f1a`.
- Live PID/start/critical bytes exact; V9 roots absent.
- Independent V9 audit resumed; phrase withheld.

## V9 independent audit PASS

- 78 bound hashes recomputed; zero mismatches.
- Seal, durable one-use authority, rollback, exact installs, capacity 5,
  Inbox OFF, three-log classification, privacy/network, cleanup: PASS.
- Fresh no-write current boundary: PASS.
- Audit receipt SHA: `7ec3374e…168c3`.
- Final verifier: `V9_LIVE_LOG_CLASSIFICATION_PRESEAL_VERIFIED`.
- Final boundary: `AWAITING_AUTHORIZATION`.
- PID/start exact; service active/running; V9 roots absent.
- Stop at exact owner authorization request; no V9 execution in this
  checkpoint.

## V9 owner authorization received

- Exact digest-bound V9 phrase received from owner.
- Authorized attempts: exactly one.
- V3-V8 remain spent/superseded/non-authorizable.
- Next action: invoke `execute_nutricoach_v150_sealed_live.py` once and preserve
  its terminal durable outcome.

## V9 live attempt 1 — FAILED before ledger/mutation

- Exact authorized entrypoint invoked once; exit 1.
- Failure: `systemctl --user show` inside `--clearenv` sandbox lacked
  `XDG_RUNTIME_DIR`.
- No package ledger, global approval ledger, execution root, successor runtime,
  service stop or live mutation was created.
- PID/start and four critical hashes exact.
- External events: zero.
- V9 phrase operationally spent; automatic/manual retry forbidden.
- Failure receipt SHA: `4a7ef0fe…6b6cc58`.

## V10 user-bus environment GREEN

- Read-only RED probe reproduced missing bus environment.
- Same sandbox GREEN with only `XDG_RUNTIME_DIR=/run/user/<uid>`.
- `DBUS_SESSION_BUS_ADDRESS` remains unset.
- Regression RED→GREEN.
- 70 tests; Ruff 35; basedpyright 0/0/0; ty PASS; no-excuse 35.
- Fresh V10 seal/rehearsal/audit/new authorization required.

## V10 immutable seal

- Digest: `e6ddec2e…f30c7`.
- Package SHA: `248540f4…cd2b`.
- Manifest SHA: `20cc15b7…c5b8`.
- Snapshot SHA: `97731e77…c43a`.
- Closure: `sha256:895b2354…e65e6`.
- Verifier: `V10_USER_BUS_ENVIRONMENT_PRESEAL_VERIFIED`.
- PID/start exact; active/running; V10 roots absent.
- Full V10 rehearsal delegated; phrase withheld.

## V10 nested rehearsal blocker

- Outer exact-path bwrap + real entrypoint inner bwrap denied by host.
- Three nested/user-map strategies failed before controller/authority.
- Clone/live mutations: zero; V10 roots absent; live exact.
- Blocker `fbb47f38…e6623`; cleanup `c8f2f218…e24d`.
- Classified as harness topology, not product-chain failure.
- Same role resumed with single-namespace argv projected directly from sealed
  `sandbox_command()`; only bind source operands may differ.

## V10 single-namespace projection BLOCK

- Exact `sandbox_command()` argv assertions: PASS.
- Real XDG-only read-only user-bus probe: PASS.
- Decisive syscall:
  `connect(AF_UNIX, /run/user/1000/systemd/private) = 0`.
- Projected full transaction intentionally not invoked because unchanged
  `systemctl stop/start` would mutate the live service.
- Controller/authority not reached; live exact; V10 roots absent.
- Blocker `3f11001a…10472`; cleanup `215139fb…61bd4`.
- Assertions `822a6ef3…30103`; probe `97b48e0e…25899`.
- Four distinct host-topology approaches exhausted. Await owner choice:
  compositional audit or isolated user-manager capability.

## Owner selected V10 compositional assurance

- Exact V10 clone rehearsal dropped due proven host safety conflict.
- Evidence composition:
  - V9 complete two-success/66-fault/durable/signal/replay matrix.
  - V10 delta-only source and 70-test/35-file strict closure.
  - Exact `sandbox_command()` argv assertions.
  - Real XDG-only read-only user-bus probe.
  - Both no-mutation host blocker/cleanup receipts.
- Existing independent auditor resumed for terminal PASS/BLOCK.
- V10 phrase remains withheld.

## V10 compositional independent audit PASS

- 84 bound/inherited/probe/topology hashes; zero mismatches.
- V9/V10 transaction `_execute` body byte-identical.
- V10 launcher delta limited to XDG runtime environment.
- Exact argv, real read-only user bus, topology blockers, inherited full
  transaction matrix and fresh live boundary: PASS.
- Audit SHA `abd0d3b8…a1f51`.
- Final verifier PASS; final boundary `AWAITING_AUTHORIZATION`.
- PID/start exact; service active/running; V10 roots absent.
- Stop at exact new owner authorization request.

## Owner authorization UX simplified

- Standalone exact message `진행해` means one attempt against the sole current
  fully sealed, independently audited, awaiting-authorization package.
- The orchestrator resolves it to the exact sealed digest phrase internally.
- Embedded/quoted/ explanatory occurrences are not approval.
- The sealed controller and one-use ledger semantics remain unchanged.
- The owner's current explanatory request is not itself an execution command.

## V10 short authorization received

- Standalone exact `진행해` received.
- Resolved internally to the sealed V10 digest phrase.
- Authorized attempts: exactly one.
- No predecessor phrase was revived.

## V10 live attempt 1 — terminal FAILED/ROLLED_BACK

- Exact sealed entrypoint invoked once.
- Failure at `stopped_probe`: service stop removed stable-classified
  `gateway.pid`.
- Global authority consumed FAILED.
- Initial rollback restarted predecessor but phase marked RECOVERY_REQUIRED
  due six misclassified service-lifecycle files.
- Lifecycle regression RED→GREEN; 71 tests/all strict gates PASS.
- No-service-action recovery verified 86,775 rows, six contracts, four mutable
  snapshots, current PID and absent successor.
- Phase durably advanced to ROLLED_BACK.
- Replay denied `authorization_already_used` with zero ledger mutation.
- Terminal receipt `9667ff4c…918eb`.
- Ledger `d06d951c…793b`; phase `8e429e77…e3e7d`; recovery
  `cf0a43b8…5779b`.
- Service predecessor active/running PID/start
  `3415172`/`2431627836475`; critical hashes exact.
- Independent terminal audit resumed.

## V10 terminal outcome audit PASS

- Audit SHA `fb2eee4d…d2cef`.
- CONSUMED/FAILED ledger and ROLLED_BACK phase exact.
- Replay denied with zero mutation.
- Fresh all-row recovery verification PASS.
- Predecessor active, successor absent, critical bytes exact.
- Terminal FAILED branch complete; no further attempt authorized.

## V10 short authorization received

- Standalone exact `진행해` received.
- Resolved internally to the sealed V10 digest phrase.
- Authorized attempts: exactly one.
- No predecessor phrase was revived.