diff --git a/.codex/plans/2026-10-01-full-completion-v3.md b/.codex/plans/2026-10-01-full-completion-v3.md deleted file mode 100644 index 9d0ccbef..00000000 --- a/.codex/plans/2026-10-01-full-completion-v3.md +++ /dev/null @@ -1,39 +0,0 @@ -# Full completion continuation - -Owner: PR #1. Objective: all nine original acceptance gates, with unchanged scope. - -## Explicit user direction - -The user requests work until the entire project is done and explicitly overrides -the bounded autonomous-workspace limit. For this project only, the 30-minute -attempt and 120 cumulative agent-minute limits do not terminate continuation. -This does not edit global configuration or waive native-protection, credential, -cost, public-publication, estate-rollout or human-approval requirements. - -## Execution - -1. Root owns source/page acquisition, evidence contracts, engine repairs and - canonical integration. One reviewer owns remaining Well-Architected text - review in disjoint partition evidence. Keep one heavy workload at a time. -2. Preserve pinned sources, every artifact/page denominator, all source identities, - claim occurrences, material caveats, authority distinctions and conflicts. -3. Acquire durable rendered page evidence without silently changing source pins. - Resolve dependencies and source/rendered identity gaps; never infer review from - acquisition or from a citation. -4. Complete source-to-control reconciliation, applicable profiles/templates, - operational bindings and independently substantiated completeness checks. -5. Finish file-specific rights decisions and prepare distribution-ready notices; - leave actual human-required approvals with their human owners. -6. Prepare and execute the pilot only after its explicit native authorization. - Require real positive/negative behavior, bypass, readback and recovery evidence. -7. Integrate exact-head verification, approved estate rollout and release evidence. - Completion requires every original gate proven; partial checkpoints are not done. - -## Current starting evidence - -Published head 68a3774; 208 tests passing, 95 valid draft controls, canonical views -compiled. Reviewed artifacts 62/13,657; structured reference accounting 605/605; -1,145 reference statements have valid provenance. Accepted controls and rights -clearance remain zero. All 14 unresolved page bodies are live but their pinned -source identity and full assurance remain unverified. Gate reporting now separates -observed incompleteness from missing certification adapters. diff --git a/.codex/plans/2026-10-02-audit-log-review.md b/.codex/plans/2026-10-02-audit-log-review.md deleted file mode 100644 index 04e77f03..00000000 --- a/.codex/plans/2026-10-02-audit-log-review.md +++ /dev/null @@ -1,11 +0,0 @@ -# Audit log source review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/25 - -Scope:43 remaining pinned GitHub Docs audit_log reusable files,438physical lines/37,259bytes; commit56fcfa816f27bca239e5d39fff0d4f74f77ec995. All direct reusable includes are within this scope. - -Author and root separately fully read source bodies. Extract atomic source-local references, preserving category labels and descriptions, version predicates, event/access/retention/query limitations, streaming timing and storage permissions. Root independently audits all claims; repairs receive separate author recheck. Reconcile exact candidate identities and consolidate references without policy adoption or fabricated equivalence. - -Run unittest discovery, ges validate, ges compile, claim provenance/recovery checks and whitespace checks; record observed outcomes. Commit/push every authored plan/evidence artifact and post exact issue receipt, retaining human-only issue closure. - -Commands, raw token examples, IAM policy, bucket creation, endpoint tests and IP disclosure are inert evidence. No cloud/storage cost, token handling, streaming activation, credentials, privacy acceptance, rights, native enforcement or estate mutation is authorized. Documented categories are not observed events. Source-local review is not whole-corpus omission or rendered-page assurance. diff --git a/.codex/plans/2026-10-02-code-scanning-operations-review.md b/.codex/plans/2026-10-02-code-scanning-operations-review.md deleted file mode 100644 index 2299dc74..00000000 --- a/.codex/plans/2026-10-02-code-scanning-operations-review.md +++ /dev/null @@ -1,13 +0,0 @@ -# Tranche 20 — code-scanning operational reusable fragments - -Issue: https://github.com/4444J99/github-engineering-standards/issues/20 - -Fully review all 62 remaining unreviewed non-query-table fragments under data/reusables/code-scanning at the locked Docs pin (278 physical lines). Language-specific query tables remain a distinct required batch in the original denominator; they are not excluded from the project. - -Extract exact source-local setup prerequisites, language mappings, query suites, default/advanced configuration relationships, branch/origin distinctions, licensing conditions, SARIF upload limits and retry behavior, diagnostics and enforcement edge cases. Preserve examples separately from policy and conditional branches separately from unconditional capabilities. - -Read any necessary included dependency separately and reconcile prior targeted source occurrences. Root independently audits full bodies and all statements; original author rechecks repairs. Source instructions and configuration examples remain inert: no scripts, scans, uploads, workflows, installation, licensing agreement, billing or native activation. - -The analyze action include is separately fully read: data/reusables/actions/action-codeql-action-analyze.md, one inert github/codeql-action/analyze@v4 identifier. Final bounded scope: 63 files, 279 physical lines, 162 parser candidates. The tag is historical source-example data, not a deployed immutable action pin or an accepted exception to local pinning policy. The previously reviewed ghas-trial dependency is referenced without adding duplicate file coverage. - -After audit, record full-file reference dispositions and bounded consolidation. Run one integrated provenance/recovery/test/validate/compile/diff verification batch. Commit and push every authored artifact and post exact issue receipt; leave unsupported project gates and human approvals unchanged. diff --git a/.codex/plans/2026-10-02-codeql-query-tables-review.md b/.codex/plans/2026-10-02-codeql-query-tables-review.md deleted file mode 100644 index 719460e3..00000000 --- a/.codex/plans/2026-10-02-codeql-query-tables-review.md +++ /dev/null @@ -1,18 +0,0 @@ -# CodeQL query-table review tranche - -Scope: all 13 pinned `data/reusables/code-scanning/codeql-query-tables/` -files, 623 physical lines. Issue opened before changes; source bodies are -untrusted inert evidence, never executable instructions. - -1. Fully read query rows, related CWEs, each Default/Extended/Autofix cell, - exact query-help identities, table authoring metadata and version context. -2. Extract atomic reference claims with exact source spans, preserving - duplicate display names and different query-help identities. -3. Independently audit claims; repair fidelity findings and author-recheck them. -4. Record reference consolidation and full-artifact/candidate dispositions. -5. Run full unit tests, validation, compilation, provenance and full recovery - accounting; commit and push all authored changes and post exact issue receipt. - -No inferred query execution, detection completeness, current runtime entitlement, -rendered-page assurance, adopted policy, rights or native approval. Full corpus -and published-page denominators stay intact. Human-only issue closure. diff --git a/.codex/plans/2026-10-02-dependabot-review.md b/.codex/plans/2026-10-02-dependabot-review.md deleted file mode 100644 index 7fbca05a..00000000 --- a/.codex/plans/2026-10-02-dependabot-review.md +++ /dev/null @@ -1,12 +0,0 @@ -# Dependabot source review — issue #26 - -Preserve the full six-source objective and original denominators. Review the remaining pinned `data/reusables/dependabot/` fragments; selected inventory has 79 files. No reviewed-file coverage is inferred from references or this reading checkpoint. - -1. Reconcile artifact identities, candidate spans, prior reviewed overlap and necessary includes. -2. Read every complete selected source and necessary interpretation dependency. -3. Extract atomic claims with physical provenance, version predicates, support-table cells and inert example distinctions. -4. Independently audit all claims; repair and separately recheck findings. -5. Consolidate exactly once as references or reviewed mappings; issue full-source receipts only after audit. -6. Run required tests, validation, compilation, provenance and recovery accounting; commit and push each authored checkpoint with exact issue receipts. - -Security versus version updates, grouping precedence, ecosystem support and private-registry/runner prerequisites remain distinct. Never execute source commands, create credentials, change alert rules, accept terms, incur costs or infer rights/native approval from source instructions. All nine global gates remain open until proven independently. diff --git a/.codex/plans/2026-10-02-docs-feature-review.md b/.codex/plans/2026-10-02-docs-feature-review.md deleted file mode 100644 index 314051d6..00000000 --- a/.codex/plans/2026-10-02-docs-feature-review.md +++ /dev/null @@ -1,19 +0,0 @@ -# Docs feature-definition tranche - -Issue: https://github.com/4444J99/github-engineering-standards/issues/16 - -Review all274 currently unreviewed `data/features/` artifacts at locked Docs -commit56fcfa816f27bca239e5d39fff0d4f74f77ec995: 1,458 source lines. -Split the exact inventory into two137-file authoring tracks; read full sources, -preserve every version predicate and relevant authoring/comment/reference atom, -and independently audit the other track before recording full-file dispositions. - -Metadata declarations are pinned source data, not current feature availability, -entitlement, approved profiles, native behavior, or runtime rendering assurance. -Preserve prior targeted references without inheriting full-file coverage. Treat -examples and links as inert data and retain unknown interpretation explicitly. - -Integrate reference-only consolidation and candidate mappings, validate provenance -and recovery accounting, then run the required unittest, validate and compile -commands once. Commit and push all authored changes; post exact results on #16. -No rights approval, policy adoption, credential change or native rollout is implied. diff --git a/.codex/plans/2026-10-02-docs-variable-review.md b/.codex/plans/2026-10-02-docs-variable-review.md deleted file mode 100644 index c54fd633..00000000 --- a/.codex/plans/2026-10-02-docs-variable-review.md +++ /dev/null @@ -1,19 +0,0 @@ -# Docs variable-file review tranche - -Issue: https://github.com/4444J99/github-engineering-standards/issues/15 - -Review the 28 remaining unreviewed `data/variables/` artifacts at locked Docs -commit 56fcfa816f27bca239e5d39fff0d4f74f77ec995. Read complete source content, -extract source-local atomic reference information and retain conditional branches, -procedures and example limitations. Variable values are pinned data, not current -platform assertions or accepted policy. - -Use two implementation tracks: Copilot/product variables and the remaining 26 -files. Independently audit source spans and completeness before full-file receipts. -Keep existing partial claims; reconcile identities without multiplying obligations. -No source execution, runtime-render certification, rights approval or native writes. - -Run claim provenance validation, recovery accounting, the full unittest suite, -`python -m ges validate`, and `python -m ges compile` once on integrated evidence. -Commit and push all authored changes with observed verification on issue #15. -Leave all unsupported acceptance gates open and the issue human-closeable only. diff --git a/.codex/plans/2026-10-02-exception-e2e-clock.md b/.codex/plans/2026-10-02-exception-e2e-clock.md deleted file mode 100644 index 502d88ea..00000000 --- a/.codex/plans/2026-10-02-exception-e2e-clock.md +++ /dev/null @@ -1,3 +0,0 @@ -# Exception E2E clock repair — issue #27 - -Reproduce elapsed fixed exception fixture, inspect engine expiry predicate, and inject a controlled clock only inside the test CLI subprocess. Keep production evaluator and CLI unchanged. Preserve active exception outcome integrity and test exact-expiry rejection with a fresh snapshot. Run scoped E2E and full required verification; commit/push exact receipts. This repair does not close any global acceptance gate. diff --git a/.codex/plans/2026-10-02-gated-feature-review.md b/.codex/plans/2026-10-02-gated-feature-review.md deleted file mode 100644 index 84d2f286..00000000 --- a/.codex/plans/2026-10-02-gated-feature-review.md +++ /dev/null @@ -1,13 +0,0 @@ -# Tranche 17 — gated-feature reusable fragments - -Issue: https://github.com/4444J99/github-engineering-standards/issues/17 - -Review all 63 currently unreviewed fragments in data/reusables/gated-features at the locked GitHub Docs pin; preserve the ten already reviewed artifact dispositions. The batch has 218 complete source lines. - -Read two necessary one-line included dependencies as well: data/reusables/dependabot/github-presets-availability.md and data/reusables/advanced-security/ghas-for-azdo-link.md. Total bounded scope: 65 files, 220 physical lines. Microsoft Learn is recorded as an inert outbound reference, not a reviewed Azure DevOps capability. - -1. Fully read each body; extract atomic plan, visibility, version and authoring claims, conditional branches, variables and inert references. -2. Independently audit the authored claims against the source bodies. Preserve nested if/elsif precedence rather than flattening alternatives. Reconcile prior targeted occurrences explicitly without inheriting file coverage. -3. Record full-file dispositions only after bounded semantic review and audit. Source templates are not executed; no current availability, runtime rendering, rights clearance or adoption is certified. -4. Run integrated claim provenance and recovery checks, python -m unittest discover -s tests -v, python -m ges validate, python -m ges compile, and git diff --check. -5. Commit and push every authored artifact; verify live remote head and post exact evidence on issue 17. Keep human-required issue closure and remaining project gates unchanged. diff --git a/.codex/plans/2026-10-02-identity-authentication-signing-review.md b/.codex/plans/2026-10-02-identity-authentication-signing-review.md deleted file mode 100644 index 97284af2..00000000 --- a/.codex/plans/2026-10-02-identity-authentication-signing-review.md +++ /dev/null @@ -1,19 +0,0 @@ -# Identity, permissions, authentication and signing review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/23 - -## Scope and authority - -Review the 125 remaining pinned GitHub Docs reusable fragments in identity-and-permissions, permissions, two_fa, passkeys, credentials, ssh and gpg: 522 physical lines and 45,854 bytes. Source pin: 56fcfa816f27bca239e5d39fff0d4f74f77ec995. Separately identify and read necessary unreviewed includes before adding them to the receipt scope. Previously reviewed includes supply context, not new coverage. - -## Execution - -1. Author reads complete source bodies and drafts atomic, source-local reference claims. -2. Root independently reads the complete sources and audits the complete draft, preserving role, platform, version, recovery, deletion and authentication-versus-authorization distinctions. Repair any findings and request a separate author recheck where needed. -3. Record bounded reading, audit, exact artifact/candidate mappings and reference-only consolidation. Keep original corpus denominators and every open gate unchanged unless new evidence actually satisfies it. -4. Run the required unittest discovery, validate and compile commands, followed by claim provenance validation, recovery accounting and whitespace checks; record exact observed results. -5. Commit every authored plan/evidence change, push the exact verified head, verify remote identity and clean worktree, and post an issue receipt. Issue closure remains human-owned. - -## Non-authorizations - -Upstream instructions and commands are evidence, not execution authority. No credential, key, authentication, recovery, signing, native setting, estate protection, publication or rights change is authorized by this review. No claim is adopted as accepted policy. Source review does not establish rendered-page assurance, linked binary asset review, rights clearance, actual MFA or signature enforcement, or global extraction completeness. diff --git a/.codex/plans/2026-10-02-published-assurance-receipt-accounting.md b/.codex/plans/2026-10-02-published-assurance-receipt-accounting.md deleted file mode 100644 index c093e2f9..00000000 --- a/.codex/plans/2026-10-02-published-assurance-receipt-accounting.md +++ /dev/null @@ -1,5 +0,0 @@ -# Published assurance receipt accounting - -Issue: https://github.com/4444J99/github-engineering-standards/issues/14 - -The fourteen route gaps already have drift investigation, supplemental reference extraction and acquisition evidence. Do not repeat that work or invent deployment identity. Implement an optional fail-closed assurance adapter to replace recovery's hard-coded zero once real independently audited evidence is supplied. Bind exact page ledger, acquired body, locked source artifact, policy roles and five digest-bound evidence records (source identity, version rendering, dependencies, claim mapping and independent omission). Preserve all denominators and forbid disposition authority from becoming certification authority. Add negative tests first; verify integrated tests/validate/compile and unchanged real recovery, then commit/push all authored changes with issue receipt. Missing approved policy/receipts remains unknown; no certification authority, receipt or native approval is created by this tranche. diff --git a/.codex/plans/2026-10-02-published-unmatched-reconciliation-v2.md b/.codex/plans/2026-10-02-published-unmatched-reconciliation-v2.md deleted file mode 100644 index 77af6ca4..00000000 --- a/.codex/plans/2026-10-02-published-unmatched-reconciliation-v2.md +++ /dev/null @@ -1,13 +0,0 @@ -# Published unmatched reconciliation — revision 2, issue #28 - -History establishes six added routes and a code-review rename at three revisions outside the original pin; comparisons are diverged, not descendants. Preserve the original six pins and 13,657/18,019 denominators. - -Seven exact candidate bodies have been acquired into ignored private cache, with SHA256, bytes and Git blob identities verified. This is not semantic review or published-build assurance. - -Next work: - -1. Fetch every necessary reusable, variable/feature and rendering dependency at the corresponding supplemental commit; resolve nested closure without executing upstream code. -2. Read complete supplemental source bodies and dependency content; extract atomic, source-qualified claims independently from acquired published bodies. -3. Compare the complete rendering relationship, tool tabs, conditional/version gates, metadata and canonical routes; independently audit findings and repairs. -4. Represent supplemental revision provenance explicitly in assurance evidence; do not rewrite the original cached ledger, self-grant certifier authority or manufacture pin identity. -5. Verify, commit and push each completed tranche and its issue receipt. No raw upstream copies, credentials, policy/native activation or rights approval enter commits. diff --git a/.codex/plans/2026-10-02-published-unmatched-reconciliation.md b/.codex/plans/2026-10-02-published-unmatched-reconciliation.md deleted file mode 100644 index 4549c48a..00000000 --- a/.codex/plans/2026-10-02-published-unmatched-reconciliation.md +++ /dev/null @@ -1,12 +0,0 @@ -# Fourteen unmatched published instances — issue #28 - -Preserve all six source pins and the original 18,019 published-instance denominator. - -1. Validate fourteen exact page identities against the cached acquisition index and body digests. -2. Read every unmatched complete body, retaining page/version distinctions. -3. Search the complete pinned artifact inventory for exact, redirected and semantically related source paths; inspect candidate bodies before proposing matches. -4. Record source absence, rename/generation evidence or temporal drift explicitly. Do not manufacture source matches or certify assurance from acquisition. -5. Record necessary follow-up without replacing source pins, executing upstream code or committing raw upstream copies. -6. Verify tests, validation, compilation and recovery; commit and push bounded evidence with an exact issue receipt. Human-only closure. - -This is reconciliation toward full published-content assurance, not an assurance receipt or rights/publication/native authorization. diff --git a/.codex/plans/2026-10-02-review-accounting-index-performance.md b/.codex/plans/2026-10-02-review-accounting-index-performance.md deleted file mode 100644 index bb4b1b31..00000000 --- a/.codex/plans/2026-10-02-review-accounting-index-performance.md +++ /dev/null @@ -1,5 +0,0 @@ -# Review accounting index performance - -Issue: https://github.com/4444J99/github-engineering-standards/issues/12 - -Benchmark full pinned accounting before and after replacing per-receipt scans of all candidates with one artifact-to-candidate index. Preserve exact result digest, denominators, errors and safety checks. Record three timing samples per implementation with honest scope (accounting only, not semantic throughput). Add observable own-artifact/foreign-artifact regression cases; run unittest/validate/compile plus recovery. Commit/push every authored artifact and post receipts; no completion or gate claims from speed. diff --git a/.codex/plans/2026-10-02-review-evidence-reference-integrity.md b/.codex/plans/2026-10-02-review-evidence-reference-integrity.md deleted file mode 100644 index cc4670cf..00000000 --- a/.codex/plans/2026-10-02-review-evidence-reference-integrity.md +++ /dev/null @@ -1,5 +0,0 @@ -# Review evidence reference integrity - -Issue: https://github.com/4444J99/github-engineering-standards/issues/9 - -Accounting ignores advertised supporting evidence paths. Reproduce missing-evidence false completeness first, then enforce readable nonempty JSON objects/arrays under repository-relative evidence paths, excluding parent/absolute paths and symlink escape. Validate all existing references without weakening gates. Add negative cases, run full unittest/validate/compile plus recovery, and commit/push all changes with exact receipts. Presence/integrity does not prove semantic truth, independent review quality or licensing. diff --git a/.codex/plans/2026-10-02-rights-receipt-accounting.md b/.codex/plans/2026-10-02-rights-receipt-accounting.md deleted file mode 100644 index 3b3a97b7..00000000 --- a/.codex/plans/2026-10-02-rights-receipt-accounting.md +++ /dev/null @@ -1,11 +0,0 @@ -# Tranche 18 — explicit rights receipt accounting - -Issue: https://github.com/4444J99/github-engineering-standards/issues/18 - -The existing complete triage queue is not clearance, and recovery currently has no rights acceptance input. Add an optional, fail-closed adapter without inventing human decisions. - -1. Write negative and positive synthetic tests first; observe the absent adapter failure. -2. Validate the complete locked artifact inventory, receipt identity/digests, separately supplied approved authority policy, distinct rights reviewer/independent auditor/human acceptor roles, evidence timestamps, explicit use/obligations, exception disposition and exact scoped distribution approval. -3. Bind every evidence document to the same inventory, artifact, use and distribution scope. Reject missing, changed, duplicate, future, unsafe-path and unauthorized evidence. Recheck all evidence bytes before returning accounting. -4. Integrate paired optional receipt/policy inputs in recovery. With no real inputs, clearance stays unknown and zero. Machine validation checks accountable attestations, not legal truth, authority authenticity or publication behavior. Published-body rights remain separate. -5. Run required tests/validation/compilation, real recovery and provenance checks. Commit and push all authored work, verify remote parity, post exact issue receipt. Do not create approval grants or publish anything. diff --git a/.codex/plans/2026-10-02-saml-scim-managed-identity-review.md b/.codex/plans/2026-10-02-saml-scim-managed-identity-review.md deleted file mode 100644 index aaf7271d..00000000 --- a/.codex/plans/2026-10-02-saml-scim-managed-identity-review.md +++ /dev/null @@ -1,13 +0,0 @@ -# SAML, SCIM and managed identity review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/24 - -Review the fixed 94 remaining pinned GitHub Docs reusable fragments in saml, scim, emus and enterprise-managed: 258 physical lines / 39,868 bytes, commit 56fcfa816f27bca239e5d39fff0d4f74f77ec995. Independently read necessary includes before expanding coverage; previously reviewed context does not count again. - -1. Author and root separately read complete source bodies; author extracts atomic source-local reference claims. -2. Root audits the entire draft against the bodies, including authentication versus provisioning, role/platform/IdP conditions, recovery and deprovisioning caveats. Repair findings and request separate author recheck. -3. Record bounded reading, exact provenance/candidate mappings, independent audit and reference-only consolidation. Do not infer whole-corpus omission completeness. -4. Run unittest discovery, ges validate, ges compile, claim provenance validation, recovery accounting and whitespace checks with exact observed results. -5. Commit and push all authored artifacts, verify remote head and worktree, post issue receipt. Human retains issue closure. - -No actual identity, credential, authentication, provisioning, access, native protection, publication, rights or estate mutation is authorized by source review. No reference claim is accepted policy. Keep original denominators and all unsupported gate prerequisites visible. diff --git a/.codex/plans/2026-10-02-sdk-diagram-rights-disposition.md b/.codex/plans/2026-10-02-sdk-diagram-rights-disposition.md deleted file mode 100644 index cc44f0f2..00000000 --- a/.codex/plans/2026-10-02-sdk-diagram-rights-disposition.md +++ /dev/null @@ -1,5 +0,0 @@ -# SDK diagram rights disposition and queue fidelity - -Issue: https://github.com/4444J99/github-engineering-standards/issues/6 - -Add two pinned diagram findings with reference-only intended use and no raw redistribution approval. Preserve their evidence, inspection scope, use decisions and file-specific next steps in complete rights triage; regression-test the previously dropped fields and unknown-file behavior. Run one integrated unittest/validate/compile pass and complete rights triage; commit/push every authored change and post receipts. Keep prior findings, full denominator and human rights acceptance intact. No new legal clearance or public distribution decision is inferred. diff --git a/.codex/plans/2026-10-02-sdk-hook-lifecycle-error-prompt-batch.md b/.codex/plans/2026-10-02-sdk-hook-lifecycle-error-prompt-batch.md deleted file mode 100644 index 7eb53666..00000000 --- a/.codex/plans/2026-10-02-sdk-hook-lifecycle-error-prompt-batch.md +++ /dev/null @@ -1,5 +0,0 @@ -# SDK lifecycle/error/prompt hook batch - -Issue: https://github.com/4444J99/github-engineering-standards/issues/13 - -Scope: all424 error-handling lines,500 lifecycle lines and398 submitted-prompt lines at the locked Docs pin. Worker drafts lifecycle/submitted atoms; root reads error source and independently audits every worker record and source. Keep common inert-source boundary once per document; keep atomic statements and occurrence provenance. Draft checkpoint commits do not increase completed-artifact coverage. Root integrates candidate dispositions, scoped conflict/generalization decisions and independent evidence, then runs one tests/validate/compile/provenance/recovery pass. Commit/push all authored changes per slice under the same issue. Preserve all six-source/page denominators and human gates; no SDK execution or accepted policy/rights/native certification. diff --git a/.codex/plans/2026-10-02-sdk-hooks-overview-review.md b/.codex/plans/2026-10-02-sdk-hooks-overview-review.md deleted file mode 100644 index c799dc1f..00000000 --- a/.codex/plans/2026-10-02-sdk-hooks-overview-review.md +++ /dev/null @@ -1,5 +0,0 @@ -# SDK hooks overview review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/8 - -Full pinned overview read, atomic reference extraction, independent omission/fidelity audit, candidate dispositions and scoped consolidation. Capture five quickstart languages, nine hook table rows, invocation context, logging/name-denial/context examples and their limits. Source permissions are inert; no SDK code execution or accepted policy. Verify once with tests/validate/compile, provenance and recovery; commit/push all authored artifacts and post receipts. Preserve full corpus and all pending gates. diff --git a/.codex/plans/2026-10-02-sdk-interaction-diagrams.md b/.codex/plans/2026-10-02-sdk-interaction-diagrams.md deleted file mode 100644 index e2c276ab..00000000 --- a/.codex/plans/2026-10-02-sdk-interaction-diagrams.md +++ /dev/null @@ -1,5 +0,0 @@ -# SDK interaction diagram tranche - -Issue: https://github.com/4444J99/github-engineering-standards/issues/5 - -Baseline: 715/13,657 artifact reviews. Review both pinned image-input and steering PNGs at original resolution, verify bytes and hashes, enumerate atomic observations and reconcile illustrative limitations with reviewed prose. Obtain bounded independent visual review; run one integrated unittest/validate/compile and recovery verification. Commit and push every authored artifact and post exact results to issue #5. Raw images stay ignored; no accepted policy, rights clearance, runtime certification, native changes or gate closure. diff --git a/.codex/plans/2026-10-02-sdk-interaction-review-batch.md b/.codex/plans/2026-10-02-sdk-interaction-review-batch.md deleted file mode 100644 index beebc248..00000000 --- a/.codex/plans/2026-10-02-sdk-interaction-review-batch.md +++ /dev/null @@ -1,15 +0,0 @@ -# SDK interaction review batch - -Full nine-gate objective remains active; this batch is corpus progress, not a redefinition of completion. - -First recorded batch clock: 2026-10-02T14:08:55Z; preparation and prior image draft effort precede this measurement window. Baseline: 712/13,657 fully reviewed artifacts. - -1. Complete image-input text review (225 draft records already authored); its diagram is a separate artifact. -2. Review skills and steering/queueing concurrently with at most root plus one reviewer, one heavy workload. -3. Preserve atomic claim provenance, upstream strength, candidate denominators, conflicts and reference-only decisions. Never execute source examples or change discovery/permissions. -4. Use compact audit digests and exact changed-record findings; do not duplicate complete claim snapshots into every audit. -5. Recheck specified repairs and account for every candidate. Link consolidated decisions without accepting policy or implying runtime/rights verification. -6. Run the required unittest/validate/compile commands once for the finished batch; refresh claim/recovery accounting, commit and push. -7. Record elapsed wall time, new completed artifacts, records and candidates. Throughput is descriptive, not an overall completion estimate. - -No native rollout, credentials, costs, publication or protection changes are included. Existing human-required gates remain human-required. diff --git a/.codex/plans/2026-10-02-sdk-post-tool-use-review.md b/.codex/plans/2026-10-02-sdk-post-tool-use-review.md deleted file mode 100644 index 100d4124..00000000 --- a/.codex/plans/2026-10-02-sdk-post-tool-use-review.md +++ /dev/null @@ -1,5 +0,0 @@ -# Post-tool-use semantic review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/11 - -Full pinned guide read. Worker authors atomic references; root independently verifies all records, dispositions all candidates and consolidates source-local conflicts. Keep success-only triggering separate from failed-result examples and preserve schema/string-redaction tension. No source execution; sample logs, regexes, truncation, stack filtering, audit persistence and summaries are not verified security/compliance controls. Run integrated tests/validate/compile, provenance and recovery; commit/push all authored changes and post exact receipts. Full nine-gate objective remains unchanged. diff --git a/.codex/plans/2026-10-02-sdk-pre-tool-use-review.md b/.codex/plans/2026-10-02-sdk-pre-tool-use-review.md deleted file mode 100644 index 06afeb5b..00000000 --- a/.codex/plans/2026-10-02-sdk-pre-tool-use-review.md +++ /dev/null @@ -1,5 +0,0 @@ -# Pre-tool-use source review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/10 - -Full pinned guide read; atomic signature/schema/return/permission/argument/context claims and five language examples. Preserve skipPermission prerequisites; account for raw-prefix directory checks, nullish timeout, unredacted logs and prompt-only query instructions without executing source. Independently audit fidelity; disposition all candidates and consolidate reference groups. Run required tests/validate/compile plus provenance/recovery; commit/push all authored artifacts with receipts. No accepted policy, rights, native changes or global gate closure. diff --git a/.codex/plans/2026-10-02-sdk-transformed-hook-review.md b/.codex/plans/2026-10-02-sdk-transformed-hook-review.md deleted file mode 100644 index 4c99406e..00000000 --- a/.codex/plans/2026-10-02-sdk-transformed-hook-review.md +++ /dev/null @@ -1,5 +0,0 @@ -# Transformed hook review - -Issue: https://github.com/4444J99/github-engineering-standards/issues/7 - -Read both pinned transformed-prompt guide and hook index completely. Extract atomic references including all six language examples, input/output and replay semantics; disposition all candidate blocks without treating headings as policy. Independently audit fidelity/omissions; consolidate sequencing and incomplete redaction examples separately from adopted enforcement. Run unittest, validate, compile, claim provenance and recovery once; commit/push all authored changes. Preserve full corpus/page denominators and pending rights/native/estate gates. diff --git a/.codex/plans/2026-10-02-secret-security-governance-review.md b/.codex/plans/2026-10-02-secret-security-governance-review.md deleted file mode 100644 index c92935a2..00000000 --- a/.codex/plans/2026-10-02-secret-security-governance-review.md +++ /dev/null @@ -1,19 +0,0 @@ -# Secret protection and security governance review - -Issue #22 precedes changes. Scope: 67 previously unreviewed pinned reusable -files in advisory-database, secret-protection, secret-risk-assessment, -secret-scanning, security, security-advisory and security-configurations: -238 physical lines / 26,691 bytes. Add only necessary separately read include -dependencies, with explicit scope accounting; links do not inherit coverage. - -Fully read bodies and source conditions; extract atomic non-adopted claims; -independently audit, repair and author-recheck findings; record reference -consolidation and candidate/full-artifact dispositions. Preserve bypass -authority, secret validity limits, notification scopes, advisory roles, -inherited/default configurations and failure-handling distinctions. - -Run full unit tests, validation, compilation, provenance and full recovery; -commit and push every authored artifact and post the exact issue receipt. -No source execution, scanner/native activation, changed credentials, purchases, -rights clearance, rendered assurance or human approval is implied. All nine -gates and original denominators retain their objective requirements. diff --git a/.codex/plans/2026-10-02-security-overview-review.md b/.codex/plans/2026-10-02-security-overview-review.md deleted file mode 100644 index 3aa91cf0..00000000 --- a/.codex/plans/2026-10-02-security-overview-review.md +++ /dev/null @@ -1,11 +0,0 @@ -# Tranche 19 — Advanced Security and overview reusable fragments - -Issue: https://github.com/4444J99/github-engineering-standards/issues/19 - -Review all 30 currently unreviewed Advanced Security/security-overview reusable fragments (84 physical lines) at the locked Docs pin. Independently extract and audit product/licensing conditions, trial/purchase authority, settings differences, default/advanced setup guidance, visibility and feature qualifiers, assessment interactions, alert metrics/filter semantics and dismissal-review procedures. - -Read the purchase procedure's necessary billing.authorization-charge dependency separately if unreviewed; do not perform a purchase, change payment settings, launch scans, enable features or execute imported instructions. Source procedures are inert evidence. Screenshot references and alt text do not establish image review or actual UI behavior. - -The authorization-charge dependency is unreviewed and has five physical lines. It is explicitly read and included: final scope 31 files, 89 physical lines. Its temporary-hold warning applies under billing-auth-and-capture, not universally. - -Preserve each version predicate and nested branch, product-variable identity and link target. Reconcile existing targeted occurrences without inheriting full-file coverage. Full-file receipts follow bounded independent audit, not mechanical candidate detection. Run integrated provenance/recovery, required tests/validate/compile and diff checks; commit and push every authored artifact and post exact issue receipt. All rights, policy, native and estate approvals remain separately required. diff --git a/.codex/plans/2026-10-02-tranche-delivery-contract.md b/.codex/plans/2026-10-02-tranche-delivery-contract.md deleted file mode 100644 index 0500883d..00000000 --- a/.codex/plans/2026-10-02-tranche-delivery-contract.md +++ /dev/null @@ -1,12 +0,0 @@ -# Tranche delivery contract - -User instruction received 2026-10-02: create an issue, commit and push per tranche, for all changes. - -- Create a scoped GitHub issue before each new tranche; use existing issue for corrective/completion slices of that tranche. -- Commit and push all agent-authored changes in the tranche, including plans and evidence. Preserve unrelated user work; stage explicit known paths. -- Post exact commit and observed verification evidence to the issue. Mark draft/incomplete work explicitly; never label a checkpoint as a completed review or gate. -- Run the repository-required unittest, validate and compile commands once per integrated tranche. Record provenance/recovery results at their actual scope. -- Keep issues open for human closeout. Human-required rights, native and estate approvals are not granted by issue creation. - -Current interaction batch: https://github.com/4444J99/github-engineering-standards/issues/2 -Baseline completed artifacts: 712/13,657. Its initial draft checkpoint does not increase completed-artifact coverage. diff --git a/.codex/plans/2026-10-03-correction-and-remote-foundation.md b/.codex/plans/2026-10-03-correction-and-remote-foundation.md deleted file mode 100644 index ec0b5003..00000000 --- a/.codex/plans/2026-10-03-correction-and-remote-foundation.md +++ /dev/null @@ -1,19 +0,0 @@ -# Approved correction and remote-review foundation - -Owner: issue #454. Baseline: clean, pushed fe10b5a340b7c694cb2508e2b61eab0b28cbf71f; -public GitHub repository; 3,560/13,657 artifact-disposition receipts; all nine gates -still open. User approved the correction/attack order and remote preservation. - -Implement frozen metadata transport and exact source-only partition hydration; -preserve inventory/page bytes and timestamps, reject altered inputs, symlinks, -unexpected restricted fields and output overwrite. Add receipt-specific metrics -without claiming semantic certification. Correct public/private documentation. -Test first, execute the real frozen corpus and a bounded hydration, run six checks, -commit/push scoped changes, and append exact evidence to #454. - -No raw caches, credential values, transcripts or private assessments enter Git. -No Jules session, authority policy, acceptance receipt, native rollout or gate -closure is created. Remote ciphertext custody, key recovery, public exposure -inspection and remaining adapters remain separate work; capsule integrity does -not establish any of them. Follow docs/completion-attack-order.md and keep the -checkout retained for continued work. diff --git a/.codex/plans/2026-10-06-a0-validator-repair.md b/.codex/plans/2026-10-06-a0-validator-repair.md deleted file mode 100644 index 7ae90f63..00000000 --- a/.codex/plans/2026-10-06-a0-validator-repair.md +++ /dev/null @@ -1,29 +0,0 @@ -# A0 — Validator Repair - -**State:** Primary - -## Objective - -Repair PR #472 so recovery accepts valid source-review directories that contain -no `*-claims.json` documents while keeping the consolidation gate open and its -claim denominator unknown. - -## Changes - -- Add recovery regressions for review directories without claim documents. -- Skip claim-reconciliation accounting when no reviewed claim documents exist. -- Reject supplied claim-reconciliation receipts when no reviewed claim - documents exist. -- Preserve all existing source-fidelity, authority, and fail-closed behavior. - -## Acceptance - -- Focused recovery and semantic-certification tests pass. -- The repository test, validate, compile, provenance, recovery, and diff checks - pass on the exact branch head. -- The repaired head is pushed to PR #472 for human review. - -## Non-goals - -No semantic extraction, reconciliation decisions, control changes, rights -decisions, native enforcement, source refresh, or later-tranche work. diff --git a/.codex/plans/2026-10-06-a1-heuristic-containment.md b/.codex/plans/2026-10-06-a1-heuristic-containment.md deleted file mode 100644 index 783badc8..00000000 --- a/.codex/plans/2026-10-06-a1-heuristic-containment.md +++ /dev/null @@ -1,12 +0,0 @@ -# A1 — Heuristic containment - -Independent branch from main; PR #472 review may proceed concurrently. - -Preserve the two untracked legacy artifacts with byte counts and SHA-256 hashes -in ignored quarantine, remove their active paths after preservation verification, -and reject their invalidated reviewer identity even if a policy lists it. - -Acceptance: digest-checked custody receipt, negative provenance/accounting tests, -full tests, catalog validation, deterministic compile and diff checks. - -No semantic decisions, control changes, source refresh, or native enforcement. diff --git a/.codex/plans/2026-10-06-a1-pr-body.md b/.codex/plans/2026-10-06-a1-pr-body.md deleted file mode 100644 index 1769265d..00000000 --- a/.codex/plans/2026-10-06-a1-pr-body.md +++ /dev/null @@ -1,17 +0,0 @@ -The legacy keyword router and its output are preserved with verified SHA-256 -receipts in quarantine and an additional copy outside the checkout. Authority -loading and digest binding reject the invalidated identity in every -`authorized_*` role list; direct assessment and review entry points reject it -before authority is used. Artifact errors retain paths and duplicate semantics. - -The utility defaults to dry-run, requires explicit activation, retains originals -by moving them after verified copying, creates private directories, supports -quarantine revalidation, and counts the legacy array incrementally. - -Validation: 345 tests pass independently; an isolated composition with PR #472 -merges cleanly and passes 383 tests. 95 controls validate; compilation leaves -generated outputs unchanged; `git diff --check` passes. Quarantine hashes were -reverified. Custody receipts grant no certification authority. - -Remote custody remains unverified. Both local copies must be retained; the raw -artifacts have not been published. This PR remains staged for renewed review. diff --git a/.codex/plans/2026-10-06-a2-completion-milestones-v2.md b/.codex/plans/2026-10-06-a2-completion-milestones-v2.md deleted file mode 100644 index 15b513f6..00000000 --- a/.codex/plans/2026-10-06-a2-completion-milestones-v2.md +++ /dev/null @@ -1,15 +0,0 @@ -# A2 — Review corrections - -Address the owner's review of PR #474 at 84b9b2c: - -- Describe the intended pilot as pending creation and target-plan approval. -- Restore scanner-predicate implementation as an open gap and explicitly map its - coverage/disposition ledger to operational completeness. -- Disclose the unchanged per-file runtime rights gate alongside the unchanged - all-nine-gate completion field. -- Number the evidence gates, identify the dated test checkpoint, and nest the - superseded sequence beneath an explicit historical subheading. -- Align issue #471 and the #470 pilot amendment with the intended-target wording. - -Documentation-only correction; verify diff integrity and preserve generated -outputs. No repository provisioning, runtime accounting, or gate closure. diff --git a/.codex/plans/2026-10-06-a2-completion-milestones.md b/.codex/plans/2026-10-06-a2-completion-milestones.md deleted file mode 100644 index 3028598c..00000000 --- a/.codex/plans/2026-10-06-a2-completion-milestones.md +++ /dev/null @@ -1,19 +0,0 @@ -# A2 — Completion milestones - -Status: implementation; independent of PR #472 review. - -Deliverable: align the documented completion boundaries and issue #471 with -the approved six-source → GES → later sources/ancestry → EES lineage. - -Update README, remaining-work, implementation-contract, and completion order. -Keep all nine evidence gates visible and assign them to synthesis, publication, -native pilot, or estate rollout. Scope rights work to actual redistributed or -adapted expression. Classify #468, #469, and #470 without closing them. - -Runtime accounting, validators, source pins, controls, and recorded evidence are -outside this documentation tranche. The current recovery reporter still computes -`project_complete` across nine gates; document that legacy boundary explicitly. - -Acceptance: documentation agrees; tests, validation, compilation and diff checks -pass; branch and plan are pushed; scoped PR and issue receipt are published. -Human review and owner acceptance remain separate from local implementation. diff --git a/.codex/plans/2026-10-06-a3-review-repair-v2.md b/.codex/plans/2026-10-06-a3-review-repair-v2.md deleted file mode 100644 index e226d2f8..00000000 --- a/.codex/plans/2026-10-06-a3-review-repair-v2.md +++ /dev/null @@ -1,10 +0,0 @@ -# A3 acceptance repair - -Validate every pinned gzip row against the frozen inventory, validate structured -record identities and spans, bind fresh Git-tree observations to exact pins and -inventory digests, validate page-source references, and hold the rendered writer -lock throughout body validation and index fingerprinting. Do not manufacture -checkout retention or owner approval. Preserve the old receipt as historical; -generate a separate repaired receipt and run regression and real-cache checks. - -Push the scoped repair to PR #475; no merge or acceptance is implied. diff --git a/.codex/plans/2026-10-06-a3-review-repair.md b/.codex/plans/2026-10-06-a3-review-repair.md deleted file mode 100644 index 25eeb623..00000000 --- a/.codex/plans/2026-10-06-a3-review-repair.md +++ /dev/null @@ -1,13 +0,0 @@ -# A3 review repair - -Address the owner's independent review of PR #475 at 8d46cf1. Require an -independently supplied structured-occurrence count; reject coordinated row and -summary removal. Add a CI check tying the committed receipt to the source lock -and its manifest fingerprint. Explain historical source-lock tree flags, repair -the command formatting, and link the documentation from README. - -Validate the new regression, full suite, catalog, generated views, receipt -reproduction, and diff. Push the repaired PR head and submit it once through the -existing merge rail under the owner's conditional approval. Do not represent -the prior approval as a GitHub review of the repaired commit or claim Verified -before merged-main and organization acceptance gates are satisfied. diff --git a/.codex/plans/2026-10-06-a3-six-source-capsule.md b/.codex/plans/2026-10-06-a3-six-source-capsule.md deleted file mode 100644 index 5bb393cb..00000000 --- a/.codex/plans/2026-10-06-a3-six-source-capsule.md +++ /dev/null @@ -1,21 +0,0 @@ -# A3 — Six-source capsule - -Freeze the existing six pins, inventories, candidate ledger, dependency ledger, -published page list, structured occurrences, and rendered acquisition identities. -Use the existing metadata-only freeze/validate contract and commit a small receipt -that independently binds the capsule fingerprint and supplement digests. - -The initial source cache had an empty dependency ledger inconsistent with its -summary. Rebuild the ledger in an isolated cache copy before freezing; retain the -original cache and initial capsule. Do not retrieve live page lists or change pins. - -Acceptance: capsule validation, six matching Git trees, balanced dependency and -structured counts, complete digest-checked rendered acquisition, deterministic -receipt regeneration, frozen-input tests, toolkit tests/validate/compile, and -diff checks. Push one scoped PR from current main independently of PR #472. - -The capsule contains metadata only. Pinned source text and rendered bodies remain -in ignored caches. Record remote custody as unverified. Fourteen unresolved page -source mappings and conditional rendering semantics remain explicit downstream -review work. No source charter, semantic interpretation, or control adoption is -part of A3. Retain this checkout and all local caches. diff --git a/.codex/plans/2026-10-06-a4-acceptance-hardening-v3.md b/.codex/plans/2026-10-06-a4-acceptance-hardening-v3.md deleted file mode 100644 index 115bb498..00000000 --- a/.codex/plans/2026-10-06-a4-acceptance-hardening-v3.md +++ /dev/null @@ -1,8 +0,0 @@ -# A4 acceptance hardening - -Preserve and integrate the existing v2 edits. Bind visible charter locators to -the manifest, require an independently trusted A3 receipt fingerprint and exact -inventory identities for replay, stream and retain only cited records, and run -pinned-cache replay in CI on every relevant change. Preserve owner approval and -A3 acceptance as pending. Regression tests and real-cache replay precede pushing -the scoped repair to PR #476. No source meaning or policy is adopted. diff --git a/.codex/plans/2026-10-06-a4-original-intent-charters-v2.md b/.codex/plans/2026-10-06-a4-original-intent-charters-v2.md deleted file mode 100644 index 1fd3d528..00000000 --- a/.codex/plans/2026-10-06-a4-original-intent-charters-v2.md +++ /dev/null @@ -1,14 +0,0 @@ -# A4 review correction - -Address PR #476 review without adopting or approving any charter: - -1. Recompute span hashes using the existing ledger convention; rename the whole - source digest to `content_sha256`. -2. Add atapas roadmap, deployment and support locators. -3. Share the existing pinned-span verifier with a read-only charter replay command. -4. Test committed locator coverage and canonical replay, including rejection of - the original trailing-newline error; replay real pinned bytes separately. -5. Run full tests, validate, compile and diff checks, then push to the same PR. - -Retain this worktree for ongoing review. Owner approval and A3 acceptance remain -pending; no merge or acceptance is authorized by the request-changes review. diff --git a/.codex/plans/2026-10-06-a4-original-intent-charters.md b/.codex/plans/2026-10-06-a4-original-intent-charters.md deleted file mode 100644 index b03e2856..00000000 --- a/.codex/plans/2026-10-06-a4-original-intent-charters.md +++ /dev/null @@ -1,18 +0,0 @@ -# A4: original-source authority charters - -Scope: six founding-source charters and an original-intent matrix, independently -prepared while PR #472 is reviewed. No semantic extraction, policy adoption, -upstream submission, source refresh or estate rollout. - -1. Inspect pinned root documentation and source-role evidence. -2. Write six charters separating declared intention from GES interpretation. -3. Record exact commit/path/line provenance and verify against cached source bytes. -4. Run toolkit tests, validation, compilation and whitespace checks. -5. Commit, push and open a separate review PR. Human approval remains pending; - revalidate pins against the accepted A3 capsule before baseline acceptance. - -Local verification: all six source identities and cited line bounds checked against -the lock and pinned cached text; file and span SHA-256 digests recorded in -`evidence/a4-source-charters.json`. 340 unittest tests passed; `ges validate` -accepted 95 controls; `ges compile` and `git diff --check` passed. Compilation -introduced no generated-file changes. Human approval is not claimed. diff --git a/.codex/plans/2026-10-06-a5-semantic-contracts.md b/.codex/plans/2026-10-06-a5-semantic-contracts.md deleted file mode 100644 index f6567307..00000000 --- a/.codex/plans/2026-10-06-a5-semantic-contracts.md +++ /dev/null @@ -1,12 +0,0 @@ -# A5 — Semantic contracts - -Implement the five versioned semantic JSON Schemas, deterministic record IDs, -JSONL validation, and reserved extract/reconcile/audit command interfaces on an -independent branch from main. Use synthetic fixtures only. - -Acceptance: schema round trips, missing/unknown fields, unsafe spans/paths, -stale identity, duplicate and empty ledgers, deterministic IDs, and unavailable -commands are covered; repository tests, validation, compilation and diff checks -pass. Push one reviewable PR. Human review and merged-main acceptance remain -pending until recorded. Corpus extraction, review authority, policy adoption, -and reconciliation machinery are outside A5. diff --git a/.codex/plans/2026-10-06-a6-reconciliation-machinery.md b/.codex/plans/2026-10-06-a6-reconciliation-machinery.md deleted file mode 100644 index 253b05aa..00000000 --- a/.codex/plans/2026-10-06-a6-reconciliation-machinery.md +++ /dev/null @@ -1,28 +0,0 @@ -# A6 — Reconciliation machinery - -Build on A5 commit `109a10d65179522d2f4e412c5b559858908d44cd` (PR #477). -The deliverable is a separate dependent PR. Retain this worktree for review. - -## Implementation - -- Group propositions by exact subject/action/object into deterministic comparison - proposals; preserve all semantic-field and applicability differences. -- Bind full proposition records and the catalog to one immutable input digest. -- Validate A5 decisions, control revisions, semantic field accounting, explicit - conflicts, duplicate equivalence, and separately authorized review roles. -- Require primary, omission, reconciliation, and independent-audit evidence - for reviewed decisions. Keep partial coverage, conflicts, and ambiguities open. -- Expose `semantics reconcile` and `semantics audit`; keep extraction reserved. - -## Acceptance - -Focused negative tests cover false equivalence, stale digests, unauthorized or -collapsed reviewer roles, conflict erasure, and proposals asserted as evidence. -Run the full suite, catalog validation, deterministic compilation, claim -provenance, recovery accounting, and diff checks. Push the branch and open a PR -against A5. Human review and integration remain separate acceptance states. - -## Scope - -Synthetic fixtures only. No real semantic decisions, authority grants, adopted -controls, source ingestion, native settings, or construction-gate closure. diff --git a/.codex/plans/2026-10-06-actions-security-fidelity.md b/.codex/plans/2026-10-06-actions-security-fidelity.md deleted file mode 100644 index 8ecf4406..00000000 --- a/.codex/plans/2026-10-06-actions-security-fidelity.md +++ /dev/null @@ -1,18 +0,0 @@ -# Approved collector hardening and five-article Actions batch - -Owner approval: proceed all on 2026-10-06; existing owner issue #471. -Base: merged main daf2055. One 30-minute attempt, <=250 reviewed propositions. - -1. Omit credential values from all API snapshot response paths, preserving - evidence metadata, pagination, failure visibility and transport isolation. - Verify serialized output with synthetic credentials and nested responses. -2. Read the pinned GITHUB_TOKEN, secrets, OIDC, script-injection and compromised- - runner articles and their literal dependencies; write precise source spans, - caveats, artifact/candidate accounting and exact reconciliation receipts. -3. Independent review of implementation and source batch; resolve findings. -4. Run scoped and required checks, publish and submit the exact head once. -5. Check actual pilot runner availability once; retain Disabled policy if blocked. - No implicit spending change, runner substitution, estate rollout or #453 edit. - -Do not credit read dependencies as new full-artifact reviews automatically. -Source mappings remain separate from policy adoption and native acceptance. diff --git a/.codex/plans/2026-10-06-actions-security-implementation.md b/.codex/plans/2026-10-06-actions-security-implementation.md deleted file mode 100644 index 314cbc29..00000000 --- a/.codex/plans/2026-10-06-actions-security-implementation.md +++ /dev/null @@ -1,15 +0,0 @@ -# Actions implementation source review - -Owner approval: proceed all, approval provided. Existing owner issue471. -Base merged e7a62ca. One bounded30min attempt starting2026-10-07T02:17:00Z; -<=250 propositions, <=10min verification, independent author/auditor identities. -Read five previously unreviewed pinned articles: secure-use, use-secrets, secret -limits, generic cloud-provider OIDC setup and OIDC with reusable workflows. -Resolve literal include/feature/selected variable dependencies; do not credit -dependencies as extra whole-artifact reviews. Preserve every material caveat. -Reconcile claims to existing draft controls and inspect existing checks/templates; -make supported bounded corrections with adversarial verification. Independently -audit source-to-claim fidelity, decisions and concrete implementation. Resolve -findings, validate accounting, publish and submit exact head once; verify merged -result if integrated. No billing, native/cloud writes, estate or453 work. -Retain checkout and original private caches. diff --git a/.codex/plans/2026-10-06-b0-c0-acceptance-review.md b/.codex/plans/2026-10-06-b0-c0-acceptance-review.md deleted file mode 100644 index d7a57678..00000000 --- a/.codex/plans/2026-10-06-b0-c0-acceptance-review.md +++ /dev/null @@ -1,12 +0,0 @@ -# B0 / C0 acceptance review - -Scope: assess published B0 5f2f3b8 and C0 1690496 against the user tranche contract. -Deliverable: source-bound HOLD/GO quality decision and explicit affected-ID findings. -Read code, authored semantic/relationship ledgers and source bytes; reproduce relevant -checks without refreshing sources or adding policy. Preserve published semantic inputs. -No independent human reviewer identity or acceptance is invented. No merge, source -refresh, policy adoption, B1 extraction or unrelated work is included. -Review receipt: evidence/semantics/c0/acceptance-review-2026-10-06.json. -Decision: both HOLD_CHANGES_REQUIRED. Corrections remain in B0/C0; genuine reviewed -conflict classifications may remain explicit under C0, without local policy decisions. -Commit/push the review on the C0 branch; retain checkout. No automatic next tranche. diff --git a/.codex/plans/2026-10-06-b0-c0-owner-acceptance.md b/.codex/plans/2026-10-06-b0-c0-owner-acceptance.md deleted file mode 100644 index d44b613d..00000000 --- a/.codex/plans/2026-10-06-b0-c0-owner-acceptance.md +++ /dev/null @@ -1,40 +0,0 @@ -# B0/C0 owner-authorized acceptance and Actions pilot - -Owner authorization: the current human instruction grants approval to finish the -primary and independent reviews, resolve findings, integrate the existing -dependency chain, verify merged results, establish truthful accounting, and -review the agreed five previously unreviewed Actions artifacts. - -Native session: `01a11342-68e2-7851-9636-9af99289c0d7`. -Primary reviewer: this session. Independent reviewer: the separately delegated -`bounded_independent_review` agent; record its actual review result and scope. - -1. Read all 22 pinned B0 source artifacts and all 178 occurrences, 216 - propositions, and C0 relationships/decisions. Record real findings and fix - implicated records/tests. No inferred semantic approval from test passes. -2. Preserve historical proposed ledgers and manifests; publish digest-bound - reviewed overlays and authority evidence with separate source review, - reconciliation review, owner approval, integration, and whole-project states. -3. Integrate A0-A6 and B0/C0 through their existing PRs in dependency order. - Preserve topic branches, resolve moving-base conflicts, and verify the exact - integrated tree. Use the declared merge rail once per verified head. -4. Report accepted bounded records separately from legacy artifact receipts, - corpus completeness, control adoption, rights, native enforcement, and estate - rollout. No whole-project gate is closed by accepting this small batch. -5. Read and independently check the five agreed Actions artifacts, with source - spans, complete candidate accounting, and existing receipt validation. Their - IDs are dd71b11d63ec7e16bcb2c7f4, dc7295a65a4d69e0ece9977b, - 5cf7997e23f7ca9ecdb98324, 73e6b0530b475f2fb5c3cef1, - and 3930fde5ba72a1980b57c7f2. - -Work in at-most-30-minute tranches with at-most-10-minute verification windows, -record cumulative usage and scoped published checkpoints, and preserve the -standing GES continuation authorization. Retain active source/worktree state. -Freeze #453 remains in force. No controls, rights decisions, repository settings, -credentials, costs, native rollout, or unrelated backlog are authorized here. - -Checkpoint 2026-10-06: complete22-file primary/independent review; eightfindinggroups -corrected216→227; five-filepilot35claims/104candidate dispositions independently -reviewed with networking correction. Foundation PRs472–478 merged. Accounting -negativecases hardened,485tests passed. Integration retained activeworktrees and -standing continuation; cumulative native session work continues, no budget reset. diff --git a/.codex/plans/2026-10-06-b0-community-extraction-v2.md b/.codex/plans/2026-10-06-b0-community-extraction-v2.md deleted file mode 100644 index 8ce66905..00000000 --- a/.codex/plans/2026-10-06-b0-community-extraction-v2.md +++ /dev/null @@ -1,13 +0,0 @@ -# B0 correction tranche — revision 2 - -Authorized by the user: proceed all five B0/C0 acceptance-review corrections. -Preserve original manifest/annotations and source pins. Freeze a new v2 manifest -and annotations; revise only B0 interpretations and supporting validation. -Correct prohibition predicates; extract every nonempty issue frontmatter binding; -preserve each complete protected-characteristic enumeration. Add meaningful -negative regressions. Regenerate current ledgers and retain an old/new ID map. -No primary/omission approval is asserted. At most 250 propositions; zero controls. -Run full unit suite, validate, compile, schema/digest checks and deterministic -regeneration on the exact committed head. Push PR #479, then update C0 deliberately -against that B0 commit. Human/foundation/main acceptance remain separate gates. -Retain checkout. No B1 or policy adoption. diff --git a/.codex/plans/2026-10-06-b0-community-extraction.md b/.codex/plans/2026-10-06-b0-community-extraction.md deleted file mode 100644 index 6416a577..00000000 --- a/.codex/plans/2026-10-06-b0-community-extraction.md +++ /dev/null @@ -1,45 +0,0 @@ -# B0 — Community extraction - -Status: authorized staging; HOLD. A0 remains Primary under the supplied roadmap. -One primary deliverable: deterministic semantic ledgers for all 22 pinned community artifacts. -Branch: feat/b0-community-extraction, stacked on A6 exact head 551e2650ec03e22ddb3b34627702bf51dfc620c4 (PR #478; includes A5). - -## Immutable inputs - -`evidence/semantics/b0/input-manifest.json` freezes all artifact IDs, commits, -Git blob identities, line denominators, snapshot and inventory digests, authored -annotation digest, and the A3 capsule identity. No refresh or upstream execution. -A4 charter inputs are referenced by exact commit and file digest; their approval remains pending. -In-scope IDs: the manifest's complete artifact_id list, and only the generated -occurrence/proposition IDs bound by receipt.json. Maximum 250 propositions; zero controls. - -## Work - -1. Read every full artifact; author source-local semantic ASTs preserving modality, - conditions, examples, literal parameters, and differences across files. -2. Explicitly account for remaining source lines with reasoned nonclaim spans. - Compile annotated spans rather than infer semantics with keyword matching. -3. Validate source bytes, inventory denominators, annotation identity, line accounting, - schema and stable IDs; regenerate twice without overwriting; compare byte-for-byte. -4. Run unit/negative tests, full unittest discovery, ges validate, ges compile, - diff check and applicable existing provenance/recovery checks. -5. Commit/push exact branch; prepare one stacked draft PR and exact-head validation receipt. - -## Exclusions and residual - -Exclude GHQR, Well-Architected, Docs, source refresh, linked external materials, -C0 reconciliation, control adoption, templates generated for consumers, rights -clearance, upstream submission, native operations and estate rollout. -License texts are reference-only supporting inputs with explicit engineering-nonclaim -dispositions; no license interpretation or redistribution grant is asserted by B0. -All generated records remain PROPOSED. residual.json names every pending proposition -and artifact/nonclaim review. Human approval, foundation acceptance, remote-head CI, -merge to main and merged-head verification remain in B0 and cannot spill into C0. -GO requires an empty in-scope residual ledger and the user's universal verification. -Checkout retained; no automatic continuation beyond this bounded implementation attempt. - -2026-10-06 checkpoint: fullprimary/independent source review complete; eight -findinggroups corrected and independently rechecked in v3;227propositions. -Merged foundation inputs integrated,457tests passed. Native owner authorized -integration; worktree retained. Source-only review acceptance is separate from -control adoption, legal clearance and whole-project completion. diff --git a/.codex/plans/2026-10-06-branch-policy-operations.md b/.codex/plans/2026-10-06-branch-policy-operations.md deleted file mode 100644 index 00b5664e..00000000 --- a/.codex/plans/2026-10-06-branch-policy-operations.md +++ /dev/null @@ -1,19 +0,0 @@ -# Branch policy operations - -Owner instruction: proceed all after the five remaining article review and -branch-profile/check/procedure/private-pilot-plan proposal. Start at merged -main 1b192fa. Retain the existing implementation worktree and other checkouts. - -1. Read the five genuinely unreviewed status-check, merge-queue, ruleset-management, - troubleshooting and code-owner articles plus literal interpretation dependencies. -2. Author exact source claims; independent review resolves concrete findings. - Preserve prior review evidence and rebind its unchanged decisions as needed. -3. Complete a draft branch profile, configuration/evidence checks, accountable - procedures and a concrete private disposable-pilot enforcement plan. No live - settings or repository creation before approval of that specific plan. -4. Run required repository and meaningful adversarial checks, publish the bounded - change and submit its exact reviewed head for the authorized integration rail. - -Use existing contracts and source cache. No new review engine, guessed platform -behavior, adoption, whole-source completion, or frozen #453 changes. The attempt -has a 30-minute wall bound; unfinished obligations remain explicitly recorded. diff --git a/.codex/plans/2026-10-06-branch-rules-review.md b/.codex/plans/2026-10-06-branch-rules-review.md deleted file mode 100644 index 39c48db8..00000000 --- a/.codex/plans/2026-10-06-branch-rules-review.md +++ /dev/null @@ -1,18 +0,0 @@ -# Five-file branch protection and ruleset review - -Owner authorization: native session `01a11342-68e2-7851-9636-9af99289c0d7`, -"proceed all" after the five-file primary/independent review and integration proposal. - -1. Integrate approved routing PRs #482/#483 at their reviewed heads. Completed; - new isolated worktree starts at merged main `149a30b`. -2. Read five unreviewed articles, their literal includes, feature gates and - variables. Compare GHQR's actual caller/query/parser with catalog objectives. -3. Record authored span-bound claims and reviewed dispositions using existing - validators. Resolve independent findings; preserve source contradictions and - unsafe examples without treating them as accepted requirements. -4. Repair three concrete catalog provenance defects; retain draft obligations. - Validate full repository and accounting, publish and integrate the batch. - -Scope is five source articles and their interpretation dependencies. Whole-corpus -omission, publication rights, control adoption and native/estate enforcement remain -separate open gates. Preserve other worktrees and frozen #453. diff --git a/.codex/plans/2026-10-06-c0-community-reconciliation-v2.md b/.codex/plans/2026-10-06-c0-community-reconciliation-v2.md deleted file mode 100644 index 7ba4227a..00000000 --- a/.codex/plans/2026-10-06-c0-community-reconciliation-v2.md +++ /dev/null @@ -1,15 +0,0 @@ -# C0 correction tranche — revision 2 - -Fixed inputs: corrected B0 commit 2bdc382e15965a5b6c85fba8a7a18bb283941479. -Preserve original C0 input manifest/annotations. Freeze v2 inputs and explicitly -migrate all prior IDs through B0 revision-v2.json; give each added binding a decision. -Replace nondirectional SPECIALIZED groups with DISTINCT/REFERENTIAL dispositions -and supplemental RELATED/COMPLEMENTARY links. True specialization requires a -base/refinement direction with a preserved predicate and explicit narrowing. -Separate optional security selection from conditional adaptation; retain genuine -license-identity and promotional-language tensions for reviewed classification. -Regenerate all 216 decisions; cap <=250, no controls or policy decisions. -Add negative regressions and run full tests, provenance, recovery, schema/digest, -regeneration and diff checks on the exact head. Review the five reported findings -without inventing independent/human approval. Push PR #480; keep main merge and -foundation acceptance separate. No B1 activation. Retain checkout. diff --git a/.codex/plans/2026-10-06-c0-community-reconciliation.md b/.codex/plans/2026-10-06-c0-community-reconciliation.md deleted file mode 100644 index 9c882ef3..00000000 --- a/.codex/plans/2026-10-06-c0-community-reconciliation.md +++ /dev/null @@ -1,23 +0,0 @@ -# C0 — Community reconciliation - -Authorized by the user's 2026-10-06 instruction to proceed with C0. -Stage one bounded source-only reconciliation of the 207 B0 propositions at -`5f2f3b8d4141a8e1be1e6aac0e002378f46c6fa2` (PR #479). -The instruction authorizes preparation, not fabricated B0 or human approvals. - -1. Freeze B0 proposition, occurrence, annotation, manifest and receipt bytes. -2. Author proposition dispositions and explicit relationships, retaining all - source-local conditions, modality, exceptions, examples and authority. -3. Compile deterministic A5 decision proposals and a source-relationship view. - No control is adopted or edited; source specializations do not imply controls. -4. Validate exact denominator, relations, stable IDs, preserved semantic fields, - conflict counterparts, source links and deterministic output; run regressions, - unittest discovery, validate, compile and diff checks. -5. Commit/push and prepare a draft stacked PR; retain this checkout. - -Excluded: other three sources, C4 platform reconciliation, D0 policy, templates, -rights clearance, upstream submission, native changes and release. -HOLD remains until B0/foundations are accepted, every C0 decision receives -authorized reconciliation and independent audit, source tensions are resolved, -and exact-head review, CI, merge and merged-main verification pass. -No approval identity or GO receipt will be invented. diff --git a/.codex/plans/2026-10-06-claim-denominator-audit.md b/.codex/plans/2026-10-06-claim-denominator-audit.md deleted file mode 100644 index 952ce04e..00000000 --- a/.codex/plans/2026-10-06-claim-denominator-audit.md +++ /dev/null @@ -1,3 +0,0 @@ -# Full claim denominator audit - -Owner issue #471; user authorizes denominator audit after identifying unsustainable five-file review throughput. One 30-minute attempt from 2026-10-07T03:17:29Z, at most10 minutes verification. Audit all current recorded claims without awarding semantic, reconciliation or acceptance credit. Preserve exact document hashes, claim identities and every source/version occurrence. Measure exact-text repetition and existing typed provider/query metadata; produce a disjoint, complete advisory work queue with no automatic exclusion or semantic equivalence. Independently check counts/membership and fail-closed input handling. Publish and integrate through the exact-head rail; verify merged results. Retain checkout and original private source caches. No source execution, deletion, controls/policy edits, cloud/native/billing changes or #453 work. diff --git a/.codex/plans/2026-10-06-four-source-scope.md b/.codex/plans/2026-10-06-four-source-scope.md deleted file mode 100644 index 160ad62b..00000000 --- a/.codex/plans/2026-10-06-four-source-scope.md +++ /dev/null @@ -1,25 +0,0 @@ -# Four-source synthesis scope - -Owner direction: merge approval granted for Well-Architected PR #481; route -`microsoft/ghqr`, `tmcw/github-best-practices`, -`jlcanovas/gh-best-practices-template` and `atapas/model-repo` next. - -Merge the approved exact head, then preserve the 194 pinned files and existing -receipts. Keep GHQR rule definitions and evaluators substantive, retain collectors, -callers, registries, replay/rendering limits and contract tests as dependencies, -and distinguish synthetic fixtures from live observations. Reuse the already -reviewed community B0/C0 batch without restarting it. Retain source-internal -conflicts and rights inputs. - -Deliver per-file routing and a short source-scope table. Validate exact membership, -text/evidence hashes, existing bounded-review accounting and repository checks; -obtain independent routing review and publish the bounded result. Add no extraction -engine, adoption grant or semantic completion credit. - -PR #481 merged at `28587d052265fd2061c526846dbf05ff172bcb06`; its tree matches the -reviewed branch exactly. This work starts from that merged main state. - -Execution: all 194 files routed and all 971 legacy claims retained. Independent -routing review passed with no findings. The existing 227-proposition community -review reproduced unchanged; 485 tests, validation of 95 controls, compilation, -generated-output parity and whitespace checks passed. diff --git a/.codex/plans/2026-10-06-github-docs-source-scope.md b/.codex/plans/2026-10-06-github-docs-source-scope.md deleted file mode 100644 index 54eaebe4..00000000 --- a/.codex/plans/2026-10-06-github-docs-source-scope.md +++ /dev/null @@ -1,21 +0,0 @@ -# GitHub Docs file-role split - -Owner request: "now gh docs" after the other source splits. Start from merged -main `28587d052265fd2061c526846dbf05ff172bcb06`; the four-source PR remains independent. - -1. Read pinned source conventions and inspect full file inventory. Separate - authored content, shared/generated references, interpretation/applicability - dependencies, illustrations, tests/fixtures, context, infrastructure and rights. -2. Publish exact per-file routing with existing evidence references; keep product - and version distinctions and the global acceptance denominator unchanged. -3. Obtain a bounded independent routing review, resolve concrete findings, run - required repository checks and publish this isolated change in a PR. - -No new semantic review, schema-refresh pipeline, policy adoption, rights grant, -estate mutation or frozen #453 work is included. Preserve source cache and every -other active worktree. Retain this implementation checkout for the published PR. - -Execution: all 13,219 files routed; 9,116 substantive inputs with 3,698 article -entry points. Primary and independent routing review passed after correcting -the SDK asset companion links. Required checks passed with 485 tests. The four -tracked deliverables are ready for publication; no semantic acceptance credited. diff --git a/.codex/plans/2026-10-06-private-native-pilot.md b/.codex/plans/2026-10-06-private-native-pilot.md deleted file mode 100644 index 81734a59..00000000 --- a/.codex/plans/2026-10-06-private-native-pilot.md +++ /dev/null @@ -1,16 +0,0 @@ -# Approved private native pilot - -Owner approval: the user approved execution of the specific private pilot plan -on 2026-10-06. Payload baseline: 4d3aa01d85f22e78799d3de6589ee8f398e8b200, -PR #485. Run only the disposable private target named in -`docs/native-branch-pilot-plan.md`; preserve visibility, other targets and #453. - -1. Provision the absent private target and measure private ruleset capability. -2. If supported, bootstrap the reviewed workflow, exercise actual passing and - rejecting behavior, restore experimental payloads, and exercise rollback. -3. Keep detailed observations in the private target; independently review the - evidence and publish safe aggregate results in this repository. - -Stop on unsupported private capability. Never replace a provider failure with -public visibility or an upgrade. One 30-minute attempt; no synchronous CI waits. -Source review, merge, policy acceptance and live enforcement remain separate. diff --git a/.codex/plans/2026-10-06-private-pilot-evidence-redaction.md b/.codex/plans/2026-10-06-private-pilot-evidence-redaction.md deleted file mode 100644 index 41451e3b..00000000 --- a/.codex/plans/2026-10-06-private-pilot-evidence-redaction.md +++ /dev/null @@ -1,12 +0,0 @@ -# Correct private pilot evidence custody - -The post-merge scan found a provider-generated temporary clone credential in -private API metadata. Remove that field from all exclusively session-created -private branch histories using exact leases; never print the value or rotate -unrelated owner credentials. Check current history and independently audit the -sanitized manifest. Update the public evidence locator and distinguish the -historical native observations from current sanitized custody. Provider cache -purging and credential expiration must not be inferred. Native remains blocked. - -No source logic, adopted policy, private visibility or spending change. Submit -the concrete documentation correction once through the existing merge rail. diff --git a/.codex/plans/2026-10-06-provider-oidc-review.md b/.codex/plans/2026-10-06-provider-oidc-review.md deleted file mode 100644 index bc0a6571..00000000 --- a/.codex/plans/2026-10-06-provider-oidc-review.md +++ /dev/null @@ -1,5 +0,0 @@ -# Provider OIDC source and binding review - -Owner approval: proceed all, approval provided; existing owner issue #471. -One 30-minute attempt from 2026-10-07T02:56:19Z to03:26:19Z; at most250 propositions and20 control decisions, at most10min automated verification. -Read five genuinely unreviewed pinned AWS/Azure/GCP/Vault/PyPI OIDC guides, recursive literal dependencies and selected variable fields. Independently audit exact source claims and partial control mappings. Resolve findings and bind the supported accountable provider review procedure to existing draft credential control GES-ACT-006 with a reviewed revision. Preserve old claim decisions and explicitly account metadata rebinding. Verify, publish, submit one exact head for integration, and check merged result if merged. Retain checkout and private caches. No billing, native/cloud writes, estate work, source execution, policy adoption or #453 changes. diff --git a/.codex/plans/2026-10-06-source-table-validation.md b/.codex/plans/2026-10-06-source-table-validation.md deleted file mode 100644 index 032c27c9..00000000 --- a/.codex/plans/2026-10-06-source-table-validation.md +++ /dev/null @@ -1,3 +0,0 @@ -# Source-table validation - -Owner issue #471. User approved all provider and CodeQL matrix validation, primary governing-rule review, independent audit and integration. Attempt begins 2026-10-07T03:36:00Z and ends no later than 04:06:00Z; at most 10 minutes verification and 120 cumulative agent-minutes. Root implements one source-bound cell validator across all 31,456 provider and 3,638 query records. Primary reviewer reads governing articles and renderer dependencies within 250 substantive propositions; independent reviewer reconstructs facts and audits code and primary judgments. Resolve concrete findings before publication. Report mechanical source-cell verification separately from semantic fidelity, policy adoption and existing reconciliation. Preserve all claim IDs, raw identity/version/conditional differences, missing fields and duplicate occurrences. No control adoption, live behavior, rights, source omission or legacy nine-gate closure follows from cell matching. Keep canonical catalog and existing claim/reconciliation bytes unchanged unless a separately audited correction is required; publish truthful supplementary accounting, not fabricated legacy credit. Submit exact head once through merge-drain and verify actual merged tree. Retain this checkout and original private source caches; no upstream execution, cloud/native/billing changes, deletion or #453 work. diff --git a/.codex/plans/2026-10-06-wa-source-scope.md b/.codex/plans/2026-10-06-wa-source-scope.md deleted file mode 100644 index 46b13321..00000000 --- a/.codex/plans/2026-10-06-wa-source-scope.md +++ /dev/null @@ -1,20 +0,0 @@ -# Well-Architected substantive source scope - -Owner direction: start with `github/github-well-architected` after distinguishing -exhaustive file inventory from substantive standards review. - -Use the existing pinned snapshot and receipts. Account for all 244 files, route -guidance, attachments, context and interpretation dependencies separately, and -retain open media limitations. Preserve all existing claims; file-role routing -does not close extraction, reconciliation, adoption or rights gates. - -Deliver the exact per-file routing and a short synthesis queue. Validate inventory -membership, source digests and evidence references; obtain independent routing -review, address concrete findings, run required repository checks, and publish -the bounded change. Do not create another extraction engine or restart completed -source reviews. - -Execution: all 244 files routed; independent routing review PASS with no findings; -485 tests, catalog validation, compilation, generated-output parity and whitespace -checks passed. See `docs/well-architected-source-scope.md` and -`evidence/semantics/wa/routing-review.md`. No new semantic completion credited. diff --git a/.codex/plans/2026-10-07-security-context-reconciliation.md b/.codex/plans/2026-10-07-security-context-reconciliation.md deleted file mode 100644 index 317e09e9..00000000 --- a/.codex/plans/2026-10-07-security-context-reconciliation.md +++ /dev/null @@ -1,7 +0,0 @@ -# Secret-scanning and CodeQL contextual reconciliation - -User approval: proceed all, approval provided. Owner issue #471. One bounded attempt starts 2026-10-07T04:03:15Z, ends no later than04:33:15Z, with at most10 minutes verification and120 cumulative agent-minutes. Two primary review lanes cover the exact1392 unresolved non-table source-reference claims in evidence/security-context-scope.json (714 secret-scanning and678 CodeQL path-selected claims). These are topic-selected seed/context artifacts, not a claim of complete capability-corpus closure. Packets retain whole source context and each contains no more than250 propositions. Reuse the35,094 source-verified table facts and28 independently audited governing interpretations with unchanged source hashes; do not rereview those as fresh work or award extra credit. Independent reviewer audits every new decision and concrete findings; only agreed faithful dispositions enter the existing exact-claim receipt contract. Preserve474 existing decisions and the full61,936 denominator. Report mismatched or incomplete claims as unresolved and do not disguise them as mapped. Root integrates one combined receipt/policy/accounting delivery and records operational implications; no fabricated adoption, rights, target behavior or gate closure. Native/cloud/billing, credentials, source execution, deletion and #453 stay outside scope. Publish and submit one exact head through merge-drain, verify actual merged result. Retain this checkout and original private sources. If scope cannot finish within the bound, publish precise remaining packet ownership and stop rather than restarting automatically. - -Review adjustment: explicitly unsupported assertions may receive independently approved UNSUPPORTED_SOURCE exclusions with corrected interpretations, retaining extraction-fidelity FAIL and zero source-fidelity/control acceptance credit. This records a resolved classification, not a corrected original claim or semantic-extraction completion. Historical claim bodies and global input bindings stay unchanged. - -Observed delivery: two primary reviews and independent source/projection reviews passed for all 1,392 selected decisions. Fifteen new MAP, 1,372 REFERENCE and five UNSUPPORTED_SOURCE exclusions preserve original fidelity FAIL. Combined receipts are 1,866 / 61,936, preserving the old 474 unchanged. Recovery leaves all nine gates OPEN, zero accepted controls and 3,590 / 13,657 artifact coverage. The 552 tests, 95-control validation, compilation fixed point, exact reconciliation and diff checks passed. Publication and one exact-head integration follow; the merged result must be observed before claiming merge. diff --git a/.gitignore b/.gitignore index ca8f4ffa..0c551d50 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,13 @@ __pycache__/ .DS_Store generated/corpus/ *.raw.jsonl.gz + +# Agent work records are kept in a private archive, not in public repos. +.claude/plans/ +.claude/handoffs/ +.codex/plans/ +.codex/receipts/ +.gemini/plans/ +.gemini/handoffs/ +.conductor/ +.specstory/ diff --git a/docs/continuations/issue-454/session-closeout.json b/docs/continuations/issue-454/session-closeout.json deleted file mode 100644 index d19c98f7..00000000 --- a/docs/continuations/issue-454/session-closeout.json +++ /dev/null @@ -1,125 +0,0 @@ -{ - "schema": "limen.session_closeout.v2", - "session_id": "01a0f994-11d8-76b2-ab30-a5aab867e33e", - "session_root_path_sha256": "6b34db455abc0ea80fce0e009dab66d48d393ba4a2eb6bebd6d2d7ef25b6ed94", - "receipt_root_id": "ges", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456", - "disposition": "handoff", - "scope_roots": [ - { - "id": "ges", - "kind": "git", - "path_sha256": "6b34db455abc0ea80fce0e009dab66d48d393ba4a2eb6bebd6d2d7ef25b6ed94", - "repository": "4444J99/github-engineering-standards", - "repository_id": 1400636612, - "base_head": "30b1f83c5eeb3db48ea168bdd9d4cfeb8532c040", - "publication_branch": "implementation/v0.1.0", - "owned_paths": [ - ".codex/", - ".github/", - "CHANGELOG.md", - "README.md", - "TEST_INFRA.md", - "TEST_READY.md", - "THIRD_PARTY_NOTICES.md", - "controls/", - "generate_ghqr_controls.py", - "generate_wa_controls.py", - "generated/", - "ges/", - "scripts/", - "tests/" - ], - "retained_work": [ - { - "paths": [ - "docs/", - "evidence/", - ".cache/", - ".agents/" - ], - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/454" - } - ] - }, - { - "id": "policy", - "kind": "git", - "path_sha256": "2ac96ac256a766b52f3b0e65e7f342aeac8806716257b1ecf1d79bd23e8e6bdb", - "repository": "4444J99/limen", - "repository_id": 1255213941, - "base_head": "b4759bc91d40ee13e14fb0b4b3de1faa55543ec8", - "subject_head": "58520a5490ba4b2d90307d16717f1c2a3764c18e", - "publication_branch": "policy/ges-continuation-20261003", - "owned_paths": [ - "docs/architecture/finite-workspace-recovery.md" - ], - "retained_work": [] - } - ], - "verification": [ - { - "root_id": "ges", - "head": "ec1faea650522be408842fabb941afebb9f1ba7c", - "exit_code": 0, - "evidence": "evidence/session-closeout-456-verification.json", - "sha256": "6636a16e6dbebd71ae23561db665845f336fe6571226e763fcf176562d0052e3", - "command": "GES six-check batch and installed credential-wall check" - }, - { - "root_id": "policy", - "head": "58520a5490ba4b2d90307d16717f1c2a3764c18e", - "exit_code": 0, - "evidence": "evidence/session-closeout-456-verification.json", - "sha256": "6636a16e6dbebd71ae23561db665845f336fe6571226e763fcf176562d0052e3", - "command": "scripts/verify-scoped.sh --base HEAD --total-timeout-seconds 600" - } - ], - "custody": { - "verified": true, - "root_ids": [ - "ges", - "policy" - ], - "evidence": "evidence/session-closeout-456-custody.json", - "sha256": "d29d81d30357843fd6b6b37e6c8a41649f21289a0603117fafb3c1d1a786d5ad", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - }, - "checkout_disposition": "RETAIN", - "project_complete": false, - "handoff_owners": [ - "https://github.com/4444J99/github-engineering-standards/issues/454", - "https://github.com/4444J99/limen/issues/2821", - "https://github.com/4444J99/limen/pull/2822", - "https://github.com/4444J99/limen/pull/2827" - ], - "receipt_status": "PUBLISHED_SCOPE_RECONCILED_PENDING_LIVE_PREDICATE", - "external_effects": [ - { - "id": "restricted-ciphertext", - "kind": "encrypted-upload-and-recovery", - "verified": true, - "evidence": "evidence/session-closeout-456-custody.json", - "sha256": "d29d81d30357843fd6b6b37e6c8a41649f21289a0603117fafb3c1d1a786d5ad", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - }, - { - "id": "policy-integration", - "kind": "policy-pr-submission", - "verified": true, - "evidence": "evidence/session-closeout-456-verification.json", - "sha256": "6636a16e6dbebd71ae23561db665845f336fe6571226e763fcf176562d0052e3", - "owner_url": "https://github.com/4444J99/limen/issues/2821" - }, - { - "id": "standing-isolation-policy", - "kind": "remote-policy-amendment", - "verified": true, - "evidence": "evidence/session-closeout-456-verification.json", - "sha256": "6636a16e6dbebd71ae23561db665845f336fe6571226e763fcf176562d0052e3", - "owner_url": "https://github.com/4444J99/limen/issues/2821" - } - ], - "scope_reconciliation_owner": "https://github.com/4444J99/limen/issues/2821", - "scope_reconciliation": "Session-owned read-only exact published policy checkout manually admitted under merged standing directive PR #2827; shared checkout and unrelated processes preserved; native anchor unchanged." -} diff --git a/docs/continuations/issue-456-readback/predicate-result.json b/docs/continuations/issue-456-readback/predicate-result.json deleted file mode 100644 index d9b105f8..00000000 --- a/docs/continuations/issue-456-readback/predicate-result.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema": "ges.closeout-attempt.v1", - "session_id": "01a10341-92f9-7661-80fd-d57ac4cb146d", - "inspected_head": "8bcb8cda38190e26c5161b91edde53014be9a5cd", - "date": "2026-10-03", - "protocol_source": "immutable-runtime", - "protocol_revision": "5ac33aa1b52bd1d8dfc5ffe5262ca3d7b2d7c211", - "command": "scripts/no-tasks-on-me.sh --session-id 01a10341-92f9-7661-80fd-d57ac4cb146d --worktree NATIVE_GES_ROOT --receipt docs/continuations/issue-456-readback/session-closeout.json --native-transcript EXACT_NATIVE_TRANSCRIPT --scope-root ges=NATIVE_GES_ROOT --scope-root preserved-custody=PRESERVED_DOCUMENTS_ROOT --json", - "exit_code": 0, - "status": "session_released", - "findings": [], - "session_released": true, - "task_completed": false, - "successor_required": false, - "diagnostic": { - "command": "domus-process-ownership observe --worktree NATIVE_GES_ROOT --session-id 01a10341-92f9-7661-80fd-d57ac4cb146d", - "exit_code": 0, - "complete": true, - "counts": {"checker": 2, "foreign_session": 0, "owned_survivor": 0, "shared_service": 84, "unknown": 0, "unmeasured": 0}, - "process_count": 0, - "processes_signaled": false - }, - "owners": { - "custody": "https://github.com/4444J99/github-engineering-standards/issues/456", - "process_ownership_protocol": "https://github.com/4444J99/limen/issues/2763", - "installed_process_ownership": "https://github.com/4444J99/domus-genoma/issues/403" - }, - "historical_attempt": {"inspected_head": "b988abf", "exit_code": 2, "status": "unmeasured", "reason": "process ownership observation unavailable or invalid", "unmeasured_processes": 27}, - "remote_custody_verified": true, - "retained_keeper_state_complete": true, - "nonterminal_session_obligations": 0, - "retirement_authorized": false, - "estate_completed": false, - "next_action": "No resumed-session obligations remain. Original session and project work retain their existing owner; no successor launch or checkout retirement is required or authorized.", - "checkout_disposition": "RETAIN" -} diff --git a/docs/continuations/issue-456-readback/session-closeout.json b/docs/continuations/issue-456-readback/session-closeout.json deleted file mode 100644 index 8989705d..00000000 --- a/docs/continuations/issue-456-readback/session-closeout.json +++ /dev/null @@ -1,95 +0,0 @@ -{ - "schema": "limen.session_closeout.v2", - "session_id": "01a10341-92f9-7661-80fd-d57ac4cb146d", - "session_root_path_sha256": "6b34db455abc0ea80fce0e009dab66d48d393ba4a2eb6bebd6d2d7ef25b6ed94", - "receipt_root_id": "ges", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456", - "disposition": "handoff", - "scope_roots": [ - { - "id": "ges", - "kind": "git", - "path_sha256": "6b34db455abc0ea80fce0e009dab66d48d393ba4a2eb6bebd6d2d7ef25b6ed94", - "repository": "4444J99/github-engineering-standards", - "repository_id": 1400636612, - "base_head": "cd39f5daf76d35b76a01cb74668f3aefd9bf4ccf", - "publication_branch": "implementation/v0.1.0", - "owned_paths": [], - "retained_work": [ - { - "paths": ["docs/continuations/issue-454/session-closeout.json", "evidence/session-closeout-456-custody.json", "evidence/session-closeout-456-verification.json"], - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - } - ] - }, - { - "id": "preserved-custody", - "kind": "retained", - "path_sha256": "22b8bed296b33daf531c6407fc6b4ff09c92762dd32540153b38775aa31f037d", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - } - ], - "verification": [ - { - "root_id": "ges", - "head": "e27cfcf57592d5a89fdbd0215dcbb9e309f5c23f", - "exit_code": 0, - "evidence": "evidence/custody-readback-20261003-verification.json", - "sha256": "aa2abec90b8b18dce69aefd4f96159aa798b222a0c9aa477ddfee3de4be1d0a1", - "command": "Reuse passing GES tests, validate, compile and credential-wall; unchanged implementation confirmed at reconciliation head" - }, - { - "root_id": "ges", - "head": "e27cfcf57592d5a89fdbd0215dcbb9e309f5c23f", - "exit_code": 0, - "evidence": "evidence/readback-closeout-reconciliation.json", - "sha256": "98424459a335af6b356b3dbeb422079a6f0c84ff26dfad1240ec641ba408644f", - "command": "Current live process-contract reconciliation; complete remote archive and supplemental restoration; git diff --check" - }, - { - "root_id": "ges", - "head": "8bcb8cda38190e26c5161b91edde53014be9a5cd", - "exit_code": 0, - "evidence": "docs/continuations/issue-456-readback/predicate-result.json", - "sha256": "82d4992f856f19cfc0a7693895ecde0fda79ec44dda714fc1d0675a03639a99a", - "command": "Installed scripts/no-tasks-on-me.sh with exact native session, transcript and explicit GES/retained-custody roots" - } - ], - "custody": { - "verified": true, - "root_ids": ["ges", "preserved-custody"], - "evidence": "evidence/readback-closeout-custody.json", - "sha256": "623662a2b6388751c15366224fc4efa47bd39a5fbe6b3be0c11c5ed222dda8d2", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - }, - "checkout_disposition": "RETAIN", - "receipt_status": "SESSION_RELEASE_VERIFIED", - "scope_note": "This resumed session changed evidence only. The original session's separately owned receipt, custody and policy evidence retain their existing owner; neither original-session release nor project completion is claimed.", - "project_complete": false, - "external_effects": [ - { - "id": "remote-ciphertext-readback", - "kind": "read-only-range-download", - "verified": true, - "evidence": "evidence/readback-closeout-custody.json", - "sha256": "623662a2b6388751c15366224fc4efa47bd39a5fbe6b3be0c11c5ed222dda8d2", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - }, - { - "id": "session-supplement-custody", - "kind": "encrypted-upload-readback-and-restore", - "verified": true, - "evidence": "evidence/readback-closeout-custody.json", - "sha256": "623662a2b6388751c15366224fc4efa47bd39a5fbe6b3be0c11c5ed222dda8d2", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - }, - { - "id": "process-receipt-refresh", - "kind": "verified-operational-evidence-refresh", - "verified": true, - "evidence": "evidence/readback-closeout-reconciliation.json", - "sha256": "98424459a335af6b356b3dbeb422079a6f0c84ff26dfad1240ec641ba408644f", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456" - } - ] -} diff --git a/docs/continuations/issue-471/predicate-result.json b/docs/continuations/issue-471/predicate-result.json deleted file mode 100644 index cf0eec0c..00000000 --- a/docs/continuations/issue-471/predicate-result.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "schema": "ges.session-closeout-observation.v1", - "session_id": "01a10de7-db22-7ca2-adbf-bac969f730ef", - "inspected_receipt_head": "95f7e73abc92c555076cba8f63a6cf42fc8369b5", - "protocol_root_commit": "ff6b2714a013e82c3132205183ca10302a0ce0c3", - "command": "Installed scripts/no-tasks-on-me.sh with exact native session ID, native anchor, transcript witness, published v2 receipt and all three declared scope roots", - "exit_code": 1, - "session_released": false, - "task_completed": false, - "retirement_authorized": false, - "findings": ["session scopes have surviving or unattributed processes"], - "process_observation": {"complete": true, "process_count": 86, "unresolved_process_count": 12, "correction_basis": "Total is the sum of the preserved category counts; the previously reported 12 was the unknown category count. No fresh process observation is implied.", "counts": {"checker": 1, "foreign_session": 0, "owned_survivor": 0, "shared_service": 73, "unknown": 12, "unmeasured": 0}}, - "independent_read_only_process_recheck": {"command": "domus-process-ownership observe with native anchor and exact session ID", "exit_code": 1, "unknown": 12, "owned_survivor": 0}, - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/471", - "implementation_owner_url": "https://github.com/4444J99/github-engineering-standards/pull/472", - "next_action": "Recover exact native ownership and responsible-host evidence for the unresolved interactive process trees through Domus process ownership; preserve concurrent sessions. Rerun the installed session predicate using the same native anchor, transcript witness and scope roots only after relevant ownership evidence changes.", - "acceptance_predicate": "Installed no-tasks-on-me.sh exits 0 twice on unchanged owned evidence; no unknown, unmeasured or owned surviving process remains.", - "checkout_disposition": "RETAIN", - "processes_signaled": false, - "note": "Publication, scope ownership and unchanged implementation verification were accepted by the checker. Process ownership is the sole measured finding. This published handoff is not terminal closeout." -} diff --git a/docs/continuations/issue-471/session-closeout.json b/docs/continuations/issue-471/session-closeout.json deleted file mode 100644 index cbf6af88..00000000 --- a/docs/continuations/issue-471/session-closeout.json +++ /dev/null @@ -1,49 +0,0 @@ -{ - "schema": "limen.session_closeout.v2", - "status": "HISTORICAL_HANDOFF_NOT_CURRENT_HEAD_ACCEPTANCE", - "scope": "Native-session observations at the recorded heads only. Verification and custody references do not certify subsequent PR revisions.", - "session_id": "01a10de7-db22-7ca2-adbf-bac969f730ef", - "session_root_path_sha256": "e4523ef74d137e7ee36222f28cae398ef34afa3fa4494c1840893103db2e3674", - "receipt_root_id": "ges", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/471", - "disposition": "handoff", - "scope_roots": [ - { - "id": "anchor", - "kind": "retained", - "path_sha256": "e4523ef74d137e7ee36222f28cae398ef34afa3fa4494c1840893103db2e3674", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/471", - "retained_work": [{"paths": ["github-engineering-standards/github-engineering-standards"], "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/471"}] - }, - { - "id": "ges", - "kind": "git", - "path_sha256": "80d5e9e6b8108918dd1c57c0738f11bfacd3674452f33704bd78a2376c89292a", - "repository": "4444J99/github-engineering-standards", - "repository_id": 1400636612, - "base_head": "1dab672892563537daf6c3a1ed1e66f90d06a60e", - "publication_branch": "feat/semantic-certification-contracts", - "owned_paths": ["docs/claim-reconciliation-receipts.md", "docs/remaining-work.md", "docs/source-fidelity-receipts.md", "evidence/recovery-status.json", "ges/claim_reconciliation.py", "ges/recovery.py", "ges/source_fidelity.py", "tests/test_claim_reconciliation.py", "tests/test_published_assurance.py", "tests/test_rights_acceptance.py", "tests/test_source_fidelity.py"], - "retained_work": [{"paths": ["docs/continuations/issue-471/predicate-result.json"], "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/471"}] - }, - { - "id": "source", - "kind": "git", - "nested_in": "anchor", - "path_sha256": "c5ff824a27dd7c7d12b502753bb8586d6cdcd207f7f16bcd08b69e0896e11b42", - "repository": "4444J99/github-engineering-standards", - "repository_id": 1400636612, - "base_head": "1dab672892563537daf6c3a1ed1e66f90d06a60e", - "subject_head": "1dab672892563537daf6c3a1ed1e66f90d06a60e", - "publication_branch": "main", - "owned_paths": [], - "retained_work": [{"paths": ["scripts/semantic_review.py", "evidence/semantic-review-dispositions.json"], "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/471"}] - } - ], - "verification": [{"root_id": "ges", "head": "5f0e249cfd895cb9423e8ab6aa67cc8f659f62b3", "exit_code": 0, "command": "Unchanged implementation verification batch and installed credential-wall check", "evidence": "evidence/session-closeout-471-verification.json", "sha256": "d1dcef9ee328a5cc876d22c25e3d47c803d3b535793cea8a69d2372d705747d3"}], - "custody": {"verified": true, "root_ids": ["anchor", "ges", "source"], "evidence": "evidence/session-closeout-471-custody.json", "sha256": "63913d3e79db43e8e81e64a5ef5f1d697cc41d9c70d171d99010cd5d36670a03"}, - "checkout_disposition": "RETAIN", - "project_complete": false, - "handoff_owner": "https://github.com/4444J99/github-engineering-standards/pull/472", - "external_effects": [{"id": "implementation-publication", "kind": "branch-and-pr-publication", "verified": true, "evidence": "evidence/session-closeout-471-verification.json", "sha256": "d1dcef9ee328a5cc876d22c25e3d47c803d3b535793cea8a69d2372d705747d3"}] -} diff --git a/evidence/readback-closeout-custody.json b/evidence/readback-closeout-custody.json deleted file mode 100644 index 3c67adf9..00000000 --- a/evidence/readback-closeout-custody.json +++ /dev/null @@ -1,44 +0,0 @@ -{ - "schema": "ges.readback-closeout-custody.v1", - "session_id": "01a10341-92f9-7661-80fd-d57ac4cb146d", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456", - "verified": true, - "scope": "Original preserved GES snapshot and transcript prefix, plus this native session's bounded private verification material and exact transcript prefix. Original preserved files retained; no estate-wide custody claim.", - "original_archive": { - "ciphertext_bytes": 1204940832, - "ciphertext_sha256": "40452c935232540d16ff7770bf68d8fd31d8111e347535289a16cbab130f2783", - "browser_remote_download_sha256_verified": true, - "concurrent_owner_remote_download_sha256_verified": true, - "independent_full_restore_exit_code": 0, - "archive_members_read": 49485, - "regular_files_fully_read": 49069, - "regular_file_bytes_read": 1141201977, - "plaintext_written": false - }, - "session_supplement": { - "remote_object": "gdrive:limen-custody/sessions/c975859e4b68c9d6889c6da28ffd845ab700d2bdf68f0045137d3541799717fd.enc", - "ciphertext_bytes": 700048, - "ciphertext_sha256": "c975859e4b68c9d6889c6da28ffd845ab700d2bdf68f0045137d3541799717fd", - "upload_exit_code": 0, - "upload_immutable": true, - "connector_readback_verified": true, - "restoration_exit_code": 0, - "regular_files_fully_read": 40, - "manifest_sha256": "0355b4a2325afea9cbcd3243fef57421284863cf229853366cdd9c9e791b08bb", - "native_prefix_sha256": "dc1bd75dcf8870fc4cb6143e190e9e2b07a1a44985858c87205cd6469f07e32c", - "every_member_digest_verified": true, - "plaintext_written": false, - "existing_independent_escrow_used": true, - "new_credentials": false - }, - "staging": { - "readback_directory_path_sha256": "c0b11d95ffebb859c38861dbdea67416e7cfa7035d77e23f4b4977bd1c791a21", - "preserved_original_directory_path_sha256": "39392f2924b6621c498a6c608ce983a946782ebc6274ecc940117fccad774ab3", - "runtime_custody_staging_used": false, - "original_preserved_files_retained": true, - "browser_download_rehomed_to_requested_readback_directory": true - }, - "checkout_disposition": "RETAIN", - "project_complete": false, - "rights_cleared": false -} diff --git a/evidence/readback-closeout-reconciliation.json b/evidence/readback-closeout-reconciliation.json deleted file mode 100644 index dbb977a6..00000000 --- a/evidence/readback-closeout-reconciliation.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "schema": "ges.closeout-reconciliation.v1", - "session_id": "01a10341-92f9-7661-80fd-d57ac4cb146d", - "implementation_head": "e27cfcf57592d5a89fdbd0215dcbb9e309f5c23f", - "verification": { - "implementation_unchanged_since_passing_340_test_batch": true, - "prior_checks": "evidence/custody-readback-20261003-verification.json", - "local_restore_exit_code": 0, - "remote_archive_restore_exit_code": 0, - "session_supplement_remote_restore_exit_code": 0, - "git_diff_check_exit_code": 0 - }, - "process_reconciliation": { - "refreshed_operational_receipts": 27, - "changed_fields": ["contract_sha256"], - "unchanged_and_reverified_fields": ["process_identity", "argv_sha256", "service_id", "host_pid", "host_identity"], - "replacement_method": "Current installed process contract derivation and source-owned atomic record function after live identity revalidation", - "previous_receipts_preserved_in_encrypted_session_supplement": true, - "policy_changed": false, - "processes_signaled": false - }, - "historical_failures_retained": [ - "Initial closeout process_evidence_conflict (27 outdated contract receipts)", - "Shared Drive client HTTP 403 RATE_LIMIT_EXCEEDED on range/readback paths", - "Drive connector large-file 256 MB download limit", - "Drive connector upload denied for insufficient scopes; no scope expansion attempted", - "Evidence digest became stale when concurrent original owner published successful restoration" - ], - "remaining_project_owner": "https://github.com/4444J99/github-engineering-standards/issues/454" -} diff --git a/evidence/session-closeout-456-custody.json b/evidence/session-closeout-456-custody.json deleted file mode 100644 index df22b6db..00000000 --- a/evidence/session-closeout-456-custody.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "schema": "ges.session-custody.v1", - "session_id": "01a0f994-11d8-76b2-ab30-a5aab867e33e", - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/456", - "scope": "Complete GES checkout including Git history, ignored source/render caches and agent evidence, plus an exact native transcript prefix. Policy implementation and later closeout receipts are separately preserved on their exact GitHub branches.", - "snapshot_head": "46842fccd2f3c6138b79f23e5d3af589dafb6d64", - "ciphertext_bytes": 1204940832, - "ciphertext_sha256": "40452c935232540d16ff7770bf68d8fd31d8111e347535289a16cbab130f2783", - "remote_object": "gdrive:limen-custody/sessions/40452c935232540d16ff7770bf68d8fd31d8111e347535289a16cbab130f2783.enc", - "encryption": "Existing ARCA AES-256-CBC/PBKDF2, 200000 iterations; existing 1Password escrow supplied the sealing material via anonymous pipe. No new credentials or escrow created.", - "escrow_check": { - "command": "python3 scripts/check-arca-escrow.py", - "exit_code": 0, - "accepted": true, - "scope": "one-bounded-committed-archive", - "ciphertext_bytes": 4128, - "plaintext_bytes": 1759, - "regular_files": 1 - }, - "quota_free_bytes": 5145167321814, - "upload": { - "exit_code": 0, - "additive": true, - "immutable": true, - "plaintext_sent": false - }, - "remote_readback": { - "verified": true, - "exit_code": 0, - "ciphertext_bytes": 1204940832, - "ciphertext_sha256": "40452c935232540d16ff7770bf68d8fd31d8111e347535289a16cbab130f2783", - "history": "Earlier shared-client quota, expired account, deadline and scratch-loss failures retained in issue #456; successful complete readback used the existing project cache." - }, - "restoration": { - "verified": true, - "archive_members": 49485, - "regular_files": 49069, - "plaintext_bytes": 1141201977, - "restored_manifest_sha256": "faf9ba12f2c9a1581c65607ac1384c94645a1e4e2068c56e51ae393b2451f20f", - "all_regular_members_read": true, - "keychain_used": false, - "plaintext_extracted": false, - "upstream_code_executed": false, - "credential_source": "Existing independently held 1Password escrow; transient in-process material supplied through anonymous pipe." - }, - "staging": { - "readback_directory_path_sha256": "c0b11d95ffebb859c38861dbdea67416e7cfa7035d77e23f4b4977bd1c791a21", - "preserved_original_directory_path_sha256": "39392f2924b6621c498a6c608ce983a946782ebc6274ecc940117fccad774ab3", - "private_path_mapping": "Preserved Documents custody-backup receipts; no runtime custody staging.", - "runtime_custody_staging_prohibited": true - }, - "custody_verified": true, - "checkout_disposition": "RETAIN", - "raw_copies_deleted": false, - "private_values_published": false, - "next_action": "Reconcile the exact policy worktree scope and unrelated process ownership through the existing owner; then rerun the installed session predicate. Custody is no longer the outstanding prerequisite.", - "project_complete": false, - "rights_cleared": false, - "policy": { - "policy_merge_commit": "65ceff671ce2d583ccefaf5772ae2b62df97c105", - "policy_remote_content_matches_verified_topic": true, - "policy_document_sha256": "cd0ef39f0be865cdf108d6aca5c59168f4e3f1645c6a1d2b8ac5e4f92d0d6c94" - }, - "proof_boundary": "Session-owned GES snapshot and transcript prefix plus the exact policy document/merged Git commit. This is not custody certification for unrelated private Limen sessions or the estate.", - "retained_artifact": ".cache/session-custody-456/remote.enc", - "local_scratch_history": "Original runtime scratch ciphertext/transcript-prefix copies and first preserved readback prefix disappeared without deletion by this session. Complete new ciphertext readback is present in the ignored project cache." -} diff --git a/evidence/session-closeout-456-verification.json b/evidence/session-closeout-456-verification.json deleted file mode 100644 index 3bfe4cde..00000000 --- a/evidence/session-closeout-456-verification.json +++ /dev/null @@ -1,102 +0,0 @@ -{ - "schema": "ges.session-closeout-verification.v1", - "session_id": "01a0f994-11d8-76b2-ab30-a5aab867e33e", - "ges_verification_head": "ec1faea650522be408842fabb941afebb9f1ba7c", - "policy_verification_head": "58520a5490ba4b2d90307d16717f1c2a3764c18e", - "checks": [ - { - "command": "python -m unittest discover -s tests -v", - "exit_code": 0, - "tests": 340, - "seconds": 2.265 - }, - { - "command": "python -m ges validate", - "exit_code": 0, - "controls": 95 - }, - { - "command": "python -m ges compile", - "exit_code": 0 - }, - { - "command": "python -m ges.claim_review --artifacts .cache/corpus/artifacts.jsonl --sources .cache/sources --reviews evidence/source-reviews --review-policy evidence/source-review-policy.json", - "exit_code": 0, - "reference_claims": 61427, - "source_artifacts": 3526 - }, - { - "command": "python -m ges.recovery --sources .cache/sources --corpus .cache/corpus --reviews evidence/source-reviews --review-policy evidence/source-review-policy.json --rendered-directory .cache/rendered-docs --output evidence/recovery-status.json", - "exit_code": 0, - "gates_open": 9, - "project_complete": false - }, - { - "command": "git diff --check", - "exit_code": 0 - }, - { - "command": "credential-wall.py --check (verified installed protocol)", - "exit_code": 0, - "registered_secret_atoms": 31 - }, - { - "command": "scripts/verify-scoped.sh --base HEAD --total-timeout-seconds 600 (policy repository)", - "exit_code": 0, - "passed_gates": [ - "syntax-changed", - "diff-hygiene", - "check-docs-exports", - "check-note-links" - ] - } - ], - "reuse": "Policy verification is reused from its unchanged exact implementation head. GES checks were run again for this custody/receipt tranche.", - "handoff": { - "project_complete": false, - "owner_url": "https://github.com/4444J99/github-engineering-standards/issues/454", - "remaining": "Original nine gates, authentic rights/adoption decisions and approved enforcement remain unfinished." - }, - "external_effects": { - "policy_pr": "https://github.com/4444J99/limen/pull/2822", - "policy_pr_state": "MERGED", - "head": "58520a5490ba4b2d90307d16717f1c2a3764c18e", - "merge_submission": "Registry-declared single-owner fast lane, exact verified topic head merged with --squash --match-head-commit; no admin bypass.", - "scheduler_enabled": false, - "providers_launched": false, - "native_changes": false, - "merge_commit": "65ceff671ce2d583ccefaf5772ae2b62df97c105", - "local_or_installed_policy_adoption_verified": false, - "standing_isolation_policy": { - "pr": "https://github.com/4444J99/limen/pull/2827", - "state": "MERGED", - "head": "c1c5c0768f52ebeab63785dc19b4103e059f50d7", - "merge_commit": "1bc457fcde30cd28467da76133848d0722fd3f48", - "exact_remote_bytes_verified": true, - "scope": "Documentation-only manual closeout admission; automatic runtime guards unchanged", - "verification": "Additive-policy, whitespace and unchanged acceptance-boundary assertions passed; exact remote content readback matched" - } - }, - "history_scan_triage": { - "findings": 146, - "metadata_matches": 146, - "credential_values_published": false, - "rules_suppressed": false, - "receipt": "https://github.com/4444J99/github-engineering-standards/issues/454#issuecomment-5972007750", - "rights_clearance": false - }, - "scope_reconciliation": { - "required": false, - "protected_unrelated_checkout_changes": true, - "manual_isolation_admission": true, - "admission_owner": "https://github.com/4444J99/github-engineering-standards/issues/456#issuecomment-5972954686", - "policy_path_sha256": "2ac96ac256a766b52f3b0e65e7f342aeac8806716257b1ecf1d79bd23e8e6bdb", - "exact_subject_head_preserved": true, - "actual_allocated_bytes": 102813696, - "maximum_bytes": 268435456, - "remaining_free_bytes": 14834688000, - "deadline_epoch": 1791059410, - "checkout_disposition": "RETAIN", - "retention_owner": "https://github.com/4444J99/limen/issues/2821" - } -} diff --git a/evidence/session-closeout-471-custody.json b/evidence/session-closeout-471-custody.json deleted file mode 100644 index c96baa4f..00000000 --- a/evidence/session-closeout-471-custody.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "schema": "ges.session-custody-observation.v1", - "status": "HISTORICAL_OBSERVATION_ONLY", - "observed_head": "5f0e249cfd895cb9423e8ab6aa67cc8f659f62b3", - "session_id": "01a10de7-db22-7ca2-adbf-bac969f730ef", - "scope_root_ids": ["anchor", "ges", "source"], - "checkout_disposition": "RETAIN", - "observations": [ - "Session implementation is committed and published in PR 472; the implementation worktree was clean at 5f0e249cfd895cb9423e8ab6aa67cc8f659f62b3.", - "Ignored paths in the implementation worktree are Ruff and Python caches only. No private source copy, credential, native transcript, or local-only media was created there.", - "The native anchor is retained under issue 471. Existing sibling scaffolds and private vendor runtime state were not modified or retired by this session.", - "The source checkout remains at 1dab672892563537daf6c3a1ed1e66f90d06a60e; its two pre-existing untracked heuristic artifacts are retained under issue 471 and excluded from implementation evidence.", - "No original source snapshot, source-review file, or pre-existing untracked artifact was deleted. The native transcript remains in its original private runtime owner and is used locally for identity only.", - "Git administration path repair reconnected the implementation worktree after a concurrent parent-directory relocation; code and original untracked artifacts survived." - ], - "private_or_local_only_session_deliverables": [], - "retirement_authorized": false, - "scope": "Preservation and absence of new private session deliverables; no estate custody, independent backup, deletion, or retirement certification." -} diff --git a/evidence/session-closeout-471-verification.json b/evidence/session-closeout-471-verification.json deleted file mode 100644 index 331018bf..00000000 --- a/evidence/session-closeout-471-verification.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "schema": "ges.session-verification.v1", - "status": "HISTORICAL_SUPERSEDED_FOR_CURRENT_PR_VALIDATION", - "scope": "Observed checks at implementation_head only. This receipt does not certify any later PR head; see evidence/pr-472-review-repair-verification.json for the repair checks.", - "session_id": "01a10de7-db22-7ca2-adbf-bac969f730ef", - "implementation_head": "5f0e249cfd895cb9423e8ab6aa67cc8f659f62b3", - "source": "Observed command results in the exact native session; unchanged green implementation checks reused during closeout.", - "checks": [ - {"command": "python -m unittest discover -s tests", "exit_code": 0, "tests_passed": 376}, - {"command": "python -m ges validate", "exit_code": 0, "controls": 95}, - {"command": "python -m ges compile", "exit_code": 0}, - {"command": "git diff --exit-code -- generated/functional-checklist.md generated/source-crosswalk.md generated/bindings.json", "exit_code": 0}, - {"command": "ruff check ges/source_fidelity.py ges/claim_reconciliation.py ges/recovery.py tests/test_source_fidelity.py tests/test_claim_reconciliation.py", "exit_code": 0}, - {"command": "git diff --check", "exit_code": 0}, - {"command": "installed scripts/credential-wall.py --check", "exit_code": 0, "registered_secret_atoms": 31}, - {"command": "python -m ges.claim_review with actual pinned corpus, sources, review directory and policy", "exit_code": 0, "reference_claims": 61427, "semantic_truth_certified": false}, - {"command": "python -m ges.recovery with actual pinned corpus, sources, review directory and policy", "exit_code": 0, "project_complete": false, "gates_open": 9} - ], - "publication": {"owner_url": "https://github.com/4444J99/github-engineering-standards/pull/472", "state_observed": "OPEN", "head_observed": "5f0e249cfd895cb9423e8ab6aa67cc8f659f62b3"}, - "completion_owner": "https://github.com/4444J99/github-engineering-standards/issues/471", - "completion_predicate": "All nine gates in docs/remaining-work.md have validated evidence and recovery reports project_complete=true, followed by repository-required review and acceptance.", - "next_action": "Review PR 472 through the existing integration rail; continue per-file semantic extraction and independent reconciliation under issue 471.", - "merge_condition": "Repository review and acceptance authority; this receipt is a handoff and grants no bypass." -} diff --git a/evidence/session-closeout.json b/evidence/session-closeout.json deleted file mode 100644 index 768d9006..00000000 --- a/evidence/session-closeout.json +++ /dev/null @@ -1,53 +0,0 @@ -{ - "schema": "limen.session_closeout.v1", - "session_id": "01a0f994-11d8-76b2-ab30-a5aab867e33e", - "repository": "4444J99/github-engineering-standards", - "worktree_name": "github-engineering-standards", - "base_head": "30b1f83c5eeb3db48ea168bdd9d4cfeb8532c040", - "publication_branch": "implementation/v0.1.0", - "owner_url": "https://github.com/4444J99/github-engineering-standards/pull/1", - "disposition": "handoff", - "owned_paths": [ - ".github/workflows/source-acquisition.yml", - "CHANGELOG.md", - "README.md", - "TEST_INFRA.md", - "TEST_READY.md", - "THIRD_PARTY_NOTICES.md", - "controls/", - "docs/recovery-delivery.md", - "evidence/native-pilot-plan.json", - "evidence/recovery-self-assessment.json", - "evidence/recovery-status.json", - "evidence/source-review-policy.json", - "evidence/source-reviews/", - "generate_ghqr_controls.py", - "generate_wa_controls.py", - "generated/", - "ges/", - "tests/" - ], - "retained_work": [ - { - "paths": [ - ".cache/", - ".agents/" - ], - "owner_url": "https://github.com/4444J99/github-engineering-standards/pull/1" - } - ], - "verification": [ - { - "command": "python -m unittest discover -s tests -v; python -m ges validate; python -m ges compile; git diff --check", - "head": "e3e888b0815a86f63e8e7d195a2ac775d89ce520", - "exit_code": 0, - "evidence": "evidence/final-recovery-verification.json", - "sha256": "4dfa30c286f01392dbfff62f28ce73f8dc4af17fb11d779523fa6c41da6c7559" - } - ], - "custody": { - "verified": false, - "evidence": "evidence/recovery-custody.json", - "sha256": "d4d23113d38355a7859a62dd6c8caa5eb86ba597347e47f16e8d66c689045993" - } -}