TORCH/reports/protocol/candidate-source-phase-b-proposal-2026-10-01.md

Proposed Phase B: authenticated candidate context and receipt adapter

Status: broad Phase B remains proposed. Narrow B0 is independently source accepted; actual corrected QAc3e0241 and ownerb819ecbc now authorize the exact B1 contribution below. No broader parent/consumer/protocol or operational activation authority. Earlier no-code reviews remain chronological history, superseded only for the specified B0/B1 paths and scenarios by these actual decisions. This is a phase of existing TASK-6e4ff870-a386-4a11-a59c-444ebc23732e; no new assignment, identity, queue or full-task closure is requested here. Current authoritative brief is d7e6d69. Kernel's proposed sections18/20 and ADR026 at 6fdb88ea supply design context, not normative gate changes.

Current B2 implementation phase, 18:54 UTC

Actual owner7f3ff1a9 authorizes EXISTING Workfull6e4 bounded B2 implementation. Fresh briefd7/native nextresumeTHISverification18 and six live Work-owned source paths were checked; supported transition to in_progress19 preserves owner, old316 candidate/landed request, every prior evidence/history entry and all seven criteria. Exact instruction9e61c2d9: five NEW checks modules (bootstrap/input-snapshot/source- execution/fence/private-fence-init) and ONLY the existing service admission hunk from e243/c106. Work must read actual own QAaebbf/f67b/e48 six-test-path allowlist before test edits; no invented paths. Actual QAe48 consents bound append-only TIN. No new assignment/session start, .torch policy registration, live DDL/schema, legacy receipt/consumer behavior change, native acceptance or full-task closure. Named Kernel parser/opaque parent contribution is coordinated directly3af802bb; no extra context-module hunk without exact agreement. Arbiter controls re-entry.

Kernel f1eab31b now supplies complete missing package_json_path=package.json and package_script_name=vector plus executable fixture bytes. Manager independently reproduces all11 frame lengths, positive1347/SHAa1f4b211ddf04d499d1c68c2a872f2b58e6a64bf9b93edb7f3d845a6d81c5f4b and raw-script trailing-space negative1348/SHA035487e603fbefa2e6cdac4dc343d9bf5fefc58afd1f30ff2c10fb8335f8624f; Node60/npm59/package104 literal hashes match. Omitted-vector-fields hold is resolved; the prior932 proposal remains history. This is framing fixture evidence only.

Owner74c3c3f2 resolves A as the actual registered receipt ADAPTER identity/content/ interface/schema; call Phase-A output manifest M/artifactManifest. Frozen B2 execution cannot claim receipt-adapter or native qualification before owned B2c composition. Owner metadata measurements (no browser launch) Node124835376bytes and Chromium executablePath269778136bytes exceed productS64MiB/file; E is separate. Preserve S64MiB/file512MiBtotal. Narrow E cap proposal to Work/QA/Kernel: streaming 64KiB chunks,512MiB/file,4GiBtotal,32768records,4096UTF8path,16MiB canonicalmanifest; FD3 admission64KiB remains digests only. These quantitative E caps require actual QA decision/ratification before becoming implementation policy, not a blanket code halt. Exact-cap/+1, streaming actual >64MiB binary, tree/manifest/drift and real headless-shell selection scenarios must remain strict. Browser metadata path does not prove consumed binary/runtime/transitive identity. No unbounded read, PATH/cache fallback, S relaxation or permanent all-real-gates refusal endpoint.

Current B2 owned decisions and remaining registration seam, 17:53 UTC

Addressed native admission and policy delta, 18:40 UTC

The original packet remains pinned at Manager commit683e9f8, SHA256 84d062c358310a1428085b2287f3afbdb62fdbfac2f8554f3b113f1375f77a7b. Read complete addressed Workc10696f6 and e2435195, plus Kernel2565351a. These are read-only agreements, not B2 source or config permission.

Work specifies the exact future existing checks/service.mjs admission hunk: after identity/definition/resource/clean-subject validation and before captureCheckSnapshot/executeConditionedCheck, issueCandidateNativeAdmissionV2 from the authenticated registered plan, policy and E preflight. Missing policy refuses CHECK_CANDIDATE_NATIVE_POLICY_UNREGISTERED before channel/spawn/state transition. No live writer, receipt, migration or legacy consumer change. The private capability binds project/area/check/plan/commit/definition/cleanGuard, lease generations/policy/E/run/nonce/expiry (at most60s); no caller selectors, ControlPlane, writer, DB or adapter handle. Bootstrap consumes it once, rejecting replay, closure, expiry and cross-generation. Private inherited FD3 carries one framed record at most64KiB; FD4 observes acknowledgement. Fixed private init validates nonce/generation and closes both before candidate spawn; the child inherits neither. Internal provenance does not authenticate hostile same-UID host processes. The earlier1MiB general descriptor limit does not enlarge this admission transport limit.

Kernel agrees to the proposed named .torch/torch.yaml applier role. Exact future registration is ONLY optional strict checks[].candidate_execution_policy on the four existing test/check/test-dashboard/lint definitions, parsed in EXISTING src/kernel/config.mjs; old configs remain valid. Parent parses/verifies and returns an opaque binding/resolved policy without opening CP. Node/npm raw package+lock, script/dependency bytes and actual Chromium/runtime/transitive dependencies remain required. In-root .bin link text, lexical/resolved target and target bytes are bound; product links refuse. Absolute pinned unshare/private PID1 init require actual namespace/run/generation and tested close/reap barriers: direct exit, empty PGID or namespace creation is not proof of escaped-descendant closure. Unknown coverage cannot mint TerminalProof/PASS.

Precise remaining recipient decisions, without another generic design cycle:

• Kernel52502f15: addressed full executable canonical vector, including required literal package_json_path/package_script_name, framing bytes/length/hash. Owner12657cf8 and Worke243 identify those omitted frames in the prior932-byte proposal; its hash alone is not an independently reproducible oracle.
• Kernel/Work52502f15/e4fe45de: distinguish c106's Phase-A sealed artifact manifest from the pinned adapter-admission A tuple with explicit separate schema fields; no silent reinterpretation of compatibility evidence.
• QA8e7bea6a: addressed exact aebbf six test paths/scenarios and separate exact append-only Test Integrity Note consent. Owner reports consent exists; Manager does not invent its allowlist from a delivery summary.
• Actual reviewed policy registration remains distinct from source implementation and the separate approved b103 QA-record ownership amendment. No .torch edit, live DDL, source receipt, installation or operational acceptance is granted here.

Existing Workfull6e4 remains verification with all seven criteria. Positive actual registered issuance, frozen-file consumption by all four real gates, observed descendant fencing, compatible native adapter and eventual real consumers remain required. B1 fixture acceptance, legacy2 receipts and current3/2 refusal are retained. The supported revision-checked classify API records this current phase in existing task classificationHistory; it does not alter lifecycle, ownership or native gates.

Owner784c788c identifies a concrete related planning boundary, independently read on canonical0c2: src/cli.mjs1714 opens normal mutable ControlPlane for converge plan/guards; service initialization creates schema/inserts identities, and identity assertion refreshes roster with writes. Future SAME6e4 native planning composition must read compatible already-initialized state without any schema/identity/roster writes, refuse precisely when missing/incompatible, and prove immutable schema, data, identities, tasks, messages and resource guards before/after. Release owns the CLI use, Kernel the read-only interface, Work convergence guards, QA boundary scenarios (routed e92a36f1/9f012d8d). This is a source requirement, not permission to open/migrate live state or substitute an older checker. Immediate convergence still uses supported guarded tools with legitimate scoped tool approval and exact QA conflict consent. Current external SQLite refusal and all earlier failures stay.

This section supersedes the 17:02 proposed map only by the specific deltas below. Actual Work acc1d43e and Kernel 9752d155, with owner 7921552a correcting two factual errors, are read-only protocol decisions. No B2 implementation, policy registration, DDL, source receipt or consumer permission follows. B1 exact955 fixture-source acceptance remains resolved; full6e4 stays Work-owned verification with seven unchanged criteria. Legacy schema2 evidence and current3/2 refusal stay.

Live ownership confirms existing src/kernel/config.mjs, not a new file. Actual registered test-dashboard invokes npm run test:dashboard; scripts/test-dashboard-demo.mjs imports Chromium at line3 and launches it at line49. A Node entry does not remove the browser/runtime/transitive dependency requirement. Browser-using test scenarios also require the relevant pinned dependencies. All four current check declarations lack a V2 snapshot policy; current undeclared-policy refusal is correct.

Exact additions to the owned map

Recipient	Exact proposed path and decision	Scope boundary
Kernel	NEW src/kernel/candidate-source-parent.mjs; additive V2 src/kernel/check-subject-context.mjs; additive existing src/kernel/config.mjs	Derive and validate ParentSubjectBindingV2, policy schema/bytes and E/S/A admission; preserve fixtureV1 and existing config compatibility. Parent does not open ControlPlane.
Work	NEW src/checks/candidate-source-bootstrap.mjs	Trusted installed native entry, bound registered plan and private one-shot parent transport. Requires the positive issuer protocol below, not a caller-selectable issuer.
Work	NEW src/checks/candidate-input-snapshot.mjs; NEW src/checks/candidate-source-execution.mjs	Actual bounded frozen files and real npm/Node/browser consumption under the issued binding. No PhaseA fixture promotion.
Work	NEW src/checks/candidate-execution-fence.mjs; NEW private src/checks/candidate-execution-fence-init.mjs	Fixed Linux user/PID namespace backend and independently proved init/descendant/closure observations. Private init is not a public executor selector.
Kernel, proposed named config applier	.torch/torch.yaml	Manager names Project Kernel as task-scoped proposed applier of the reviewed four-check policy declaration. Native ownership still reports this file unowned; no permanent ownership-map change or present edit authority. Require Kernel agreement, exact QA policy consent and arbiter's bounded registration scope before applying anything.
Work later native plan seam	Existing src/checks/service.mjs	Precisely reviewed registered-plan/private-bootstrap admission only, separate from eventual result consumer integration. It remains excluded from current authority; return exact needed hunk/API before code.
Kernel later native adapter	src/control-plane/candidate-attempt-store.mjs; candidate-attempt-store-provisioner.mjs; NEW check-receipt-adapter.mjs	Compatibility, issuer/attempt transport and atomic finalization must be qualified without a migrating initializer. Existing writer edits, live DDL or schema repair are not implied.
Work / Release later consumers	Existing src/integration/service.mjs / src/cli.mjs, with later CheckService result wiring	Independent exact-path consent and native compatibility precede real consumption. No default installed-engine equivalence.

Work ratifies V2-only snapshot exports capture/verify/describe/disposeCandidateInputSnapshotV2 and execution exports create/run/cancel/closeCandidateSourceExecutionV2, with schema and limits constants. Their only state arguments are genuinely issued opaque parentBinding/snapshot/execution handles, plus a bounded cancel reason. No caller cwd/root/commit/definition/argv/env/manifest/DB/adapter/token/executor selector. Private paths never serialize. Kernel must return the exact zero-argument parent export name/version and canonical V2 bytes; the earlier proposed V1 parent name is not a ratified V2 API. Work must return exact bootstrap/fence-init entry contracts.

Snapshot limits ratified by Work:8192 records,64MiB/file,512MiB total,4096 UTF8 path, 1MiB descriptor/policy/manifest frame; enforce before allocation, bytewise canonical relative records, regular files/directories only. Stream-copy into unique owned scratch outside source and verify source/frozen manifests before and after. No atomic-directory or same-user filesystem containment claim. Proposed execution limits remain QA decisions:300s wall,1MiB each stdout/stderr; artifact limits retain actual ARTIFACT_MANIFEST_LIMITS(64 files,1MiB/file,8MiB total,4096 path,64KiB frame). No exit0 override for timeout/error/signal/ENOBUFS/overflow/artifact or input drift.

E must bind registered definition bytes, fixed Node executable, npm CLI entry, raw package scripts/package metadata/lock, dependency-tree and necessary browser binary/runtime/transitive manifests. Frozen S plus separately pinned dependency domain is the sole execution root; explicit scrubbed env, no live cwd/PATH/HOME/cache fallback, install or network. Product links refuse. Dependency .bin links require both lexical and resolved targets inside the pinned domain with target bytes in its manifest. Missing real dependencies refuse, not an echo or all-refusal substitute. Kernel's policy canonicalization proposal is fixed UTF8/LF/noBOM length framing over schema/version/checkId/definition/raw-script/input rules/env/dependencies/limits; exact executable framing vectors and the YAML field name still need its decision. Preserve existing snapshot and source-definition semantics rather than silently reinterpreting them. Config changes are declarations for reviewed qualification, not automatic registered provisioning or runtime activation.

Positive native issuance decision to ratify

The trust boundary is a trusted installed native coordinator/registered actor and an untrusted candidate child/caller. Candidate output, branch labels, JSON, same UID, WeakMap presence or namespace availability cannot assert native identity. A private capability is an in-process admission mechanism, not OS authentication. This bounded proposal excludes hostile same-user host processes/ptrace or privileged host interference; it does not claim containment against them. If that stronger threat model is required or the supported execution boundary cannot be established, refuse qualification explicitly. Do not conceal that limitation behind TerminalProof.

Proposed actual positive path for Work/Kernel agreement: the fixed installed native plan seam authenticates the existing identity/project/check/lease/guard context through the supported compatible native authority, resolves a registered V2 policy, and creates a nonce/run/generation-bound one-shot private parent channel. The fixed bootstrap consumes that channel exactly once, verifies origin/tuple/policy/expiry, and issues the opaque V2 binding. The candidate receives only frozen input and bounded output/artifact channels; never the admission channel, nonce, writer/DB, receipt adapter or binding capability. Parent-only descriptor setup closes admission handles before candidate spawn. No public caller token/selector or copied fixture can enter this path. Work owns native plan/transport/bootstrap; Kernel owns policy, parent admission and native adapter compatibility. Name actual identity source, channel creation/closure, replay handling and exact additional shared paths before implementation. A pipe by itself is not proof of origin; the trusted native creation and validation boundary must be independently tested. This is the next concrete decision, not an implemented/authenticated seam or permission to open a migrating CP.

Required positive qualification includes a real registered plan issuing an unchanged binding and invoking all four actual npm gate definitions with their dependencies, before landing any candidate that needs this protocol. Candidate/caller attempts to forge/replay/spread/cross-project/cross-generation or inherit the admission channel must refuse. Missing registration and current incompatible schema must still refuse. Real receipt issuance remains a separate adapter/CAS qualification; fixture tests and an all-refusal parent cannot complete full6e4 or satisfy native landing gates.

Fence and QA decisions still attributable to recipients

Owner e137 observed unprivileged user/PID namespace creation available on util-linux 2.39.3. That is a precondition only. Work proposes fixed absolute unshare with --user --map-current-user --pid --fork and pinned private init. Pin exact init API, argv/version/content digests, host PID and namespace identity/generation, PID1 admission, child barriers, reaping and independently observed closure. Process-group emptiness, direct-parent exit or a successful kill is insufficient. Timeout/cancel ambiguity, changed/unreadable namespace or absent closure yields UNKNOWN with no TerminalProof/PASS. Positive setsid/double-fork descendants must remain covered beyond direct-parent exit; include actual browser subprocess lifetimes. No host services/cgroup setup, provider launches or automatic wakes.

QA decisions requested on exact NEW candidate-source-parent.test.mjs, candidate-input-consumption.test.mjs and candidate-execution-fence.test.mjs under test/fleet, additive V2-only check-subject-context.test.mjs, proposed NEW test/fleet/candidate-source-bootstrap.test.mjs and NEW test/fleet/candidate-snapshot-policy.test.mjs, plus append-only docs/TEST_INTEGRITY.md. The last two paths are proposed additions requiring actual QA consent, not an invented approved scope. Positive scenarios: registered one-shot issuance; fixed Node/npm/browser dependency consumption; actual nested and >1MiB frozen-file reads after source mutation barrier; supported escaped-descendant closure; compatible native single-receipt CAS. Negatives include policy/frame/preimage drift, authority inheritance/replay, frozen mutation, E/A substitution, false group-only coverage, timeout/cancellation ambiguity and schema incompatibility. Independent literals/ preimages and boundary outcomes must kill trivial echoes or production-helper oracles.

Immediate recipient decisions are narrow: Kernel ratifies existing parser/four-policy canonical bytes, proposed config-applier role and parent admission; Work ratifies native positive issuer/private-channel and fixed init protocol, with exact existing service scope; QA grants the concrete source/test/policy/limit scenario list or names exact corrections. Arbiter can then review one bounded implementation scope. Until those decisions, this is pinned read-only progress, not a new assignment, source authority, live DDL/registration, gate waiver or full-task acceptance.

Current B1 acceptance and concrete B2 implementation packet, 17:02 UTC

Actual QA a13b5c37-12a3-4757-832c-1938b392f962 ACCEPTS only clean exact 955672c1db B1 fixture source:10/10 strict scenarios, 156398-byte c08 document prefix unchanged, three B1 source/test blobs unchanged, allocation correction body unchanged and physically final. Preserve9b pre-copy failure and b375 placement rejection. Owner29e verifies the prefix/blob proof only after a legitimate retry of initial child-git spawnSync EPERM; the earlier9982 claim preceded completed verification and is not retrospective PASS evidence. No native/whole-branch/integration/full-task acceptance follows. Full6e4 remains Work-owned verification at landed316/a178; B1 acceptance closes this source review.

The following is a concrete proposed implementation packet on SAME task, with named peer decisions requested82157432/6797e181/239ebf46. It grants no code authority. It advances real composition; fixtures and blanket refusals are not the endpoint. Each row requires exact contributor/scenario consent and separate arbiter scope authorization. No new assignment, registered DDL or host activation is requested.

Phase	Exact proposed source paths	Owner and deliverable	Exact proposed QA paths
B2a parent and input composition	NEW src/kernel/candidate-source-parent.mjs; additive explicitly V2 surface in src/kernel/check-subject-context.mjs; NEW src/checks/candidate-input-snapshot.mjs; NEW src/checks/candidate-source-execution.mjs	Kernel fixed no-args parent/binding; Work bounded file snapshot and real child consumption. Do not change existing fixtureV1 or existing CheckService/CLI consumers.	NEW test/fleet/candidate-source-parent.test.mjs; NEW test/fleet/candidate-input-consumption.test.mjs; additive V2-only cases in test/fleet/check-subject-context.test.mjs; append docs/TEST_INTEGRITY.md
B2b attributable terminal coverage	NEW src/checks/candidate-execution-fence.mjs; only its reviewed integration seam in new candidate-source-execution.mjs	Work fixed fence backend, parent-only observed exit/coverage proof and strict UNKNOWN handling. No resource/lease policy edits.	NEW test/fleet/candidate-execution-fence.test.mjs; append docs/TEST_INTEGRITY.md
B2c store/adapter and native transport	src/control-plane/candidate-attempt-store.mjs; src/control-plane/candidate-attempt-store-provisioner.mjs; NEW src/control-plane/check-receipt-adapter.mjs	Kernel exact versioned no-DDL finalizer/adapter and compatibility/provisioner qualification. B0 fixture issuance is not registered authority.	additive test/fleet/candidate-attempt-store.test.mjs; NEW test/fleet/check-receipt-adapter.test.mjs; append docs/TEST_INTEGRITY.md
B2d actual consumers and release qualification	later separately scoped src/checks/service.mjs, src/integration/service.mjs and src/cli.mjs	Work existing consumer/gate semantics; Release fixed CLI-to-parent binding, only after actual compatible native transport proves exact receipts.	QA independently pins actual service/CLI/integration scenarios before any edits

Ownership queries confirm Kernel src/kernel/** and src/control-plane/, Work src/checks/, Console src/observability//src/console/, QA test/**. The specific future check-receipt-adapter name preserves the existing reviewed map, not the alternative candidate-receipt-adapter sketch. Existing files outside the listed later rows remain excluded; no implicit permission to wire a consumer.

B2a contract to pin before source: openCandidateSourceParentV1() has zero caller arguments; derives its fixed installed module and actual startup working directory, validates install/project/managed common-dir/registered branch/clean source, and retains opaque parent state. A registered identity issuer must be an actual reviewed bound native seam; branch labels, caller JSON, private WeakMaps and same-user access are not authentication. CanonicalCheckSubjectEsaBytesV2 or explicitly named successor binds E interface/module plus fixed entry and dependency-manifest length/SHA; A declaration bytes/schema/interface plus actual adapter entry/dependency length/SHA; S project/commit/clean tree, snapshot-policy and frozen-manifest digests, total input bytes/count. Inputs include definition/args/allowlisted env and run/guard generations at admission. private inputRoot never crosses caller serialization. Pre/post fixed E/A reads detect substitution; disk re-read is not loaded-memory attestation.

Work's snapshot is a NEW bounded stream/copy seam, not a declaration that existing snapshot.mjs or PhaseA input.directory is qualified. Proposed concrete maxima to ratify:8192 input records,64MiB per regular file,512MiB aggregate,4096 UTF8 path bytes, 1MiB descriptor/manifest frame. Enforce original lengths/counters before allocation, no symlink/special/traversal, owned unique scratch outside source, explicit canonical relative-path/byte/mode records and policy-version digest. Streaming copies and pre/post source/frozen manifests detect drift; they do not prove an atomic directory snapshot or same-user filesystem containment. Worker cwd is ONLY private snapshot inputRoot, never caller input.directory. Fixed trusted command/dependencies come from reviewed parent E binding; candidate child receives no writer/DB/adapter token. Do not reuse copied-byte descriptor truth as proof that real files were consumed.

B2b backend decision must cover escaped sessions/descendants. A proposed concrete candidate is an ephemeral Linux PID namespace with fixed reviewed namespace-init wrapper lifetime: every descendant stays in that namespace, init termination ends its population; parent holds namespace identity/generation and observes closure. This mechanism must first be supported and independently qualified in the approved execution environment, with bounded output/time/signal cancellation; no host-service, cgroup/timer setup or provider launch is authorized. Work must accept this backend or name a precise already available enforceable alternative and ownership. No fallback to process-group emptiness, kill-command exit, process name or fake fence. If namespace creation/coverage/lifetime is denied or unknown, return UNKNOWN with no TerminalProof/PASS and retain attributable run evidence. This is descendant lifetime coverage, not protection from a malicious same-user outside process.

Positive black-box scenarios, not only forged-input refusal:

1. Actual child reads known captured files via relative paths from snapshot cwd and emits their contents/digest. Alter original worktree after capture via deterministic barrier; child still emits original captured bytes. Include nested files and a file larger than1MiB so descriptor size cannot substitute for product consumption.
2. Alter frozen snapshot before or during execution: manifest verification yields UNKNOWN/refusal and no eligible result/receipt; no source-policy relaxation.
3. Fixed parent captures E/A, then same-ID entry/dependency bytes change before import or after execution: substitution refuses. Positive unchanged pre/post tuple passes context admission only with an actual issued binding; JSON/spread clones do not.
4. Real child creates a setsid/double-fork descendant that waits beyond its direct parent's exit. Supported fence observes containment/termination; parent cannot finalize while coverage is open. Unknown coverage and PGID-only fake each refuse.
5. Known-good confined run with unchanged files and sealed artifact produces one attributable terminal proof. Timeout/signal/error/ENOBUFS/overflow, zero-exit drift, stale generation and cancellation ambiguity cannot yield eligible PASS.
6. Actual supported adapter on exact compatible schema/tuple finalizes one sealed attempt/result/eligible receipt atomically; duplicate/replay and interrupted CAS preserve history without second receipt or ambiguous retry. Wrong adapter/schema and fixture authority refuse. Fixture positive transaction is separately labelled.

B2c has additional executable prerequisites, not a prose waiver: exact DDL bytes and canonical semantic schema digest; compatible existing receipt-table/writer matrix; authenticated native identity/attempt transport; issued->executing->sealed ->finalized CAS; result and eligible receipt in one short transaction; ambiguous commit/read-only reconcile policy; writer/lease/fence generation evidence. Inspect and independently qualify actual compatible registered adapter state without opening a migrating initializer. Current required3/schema2 refusal remains intact; any missing registered store or DDL recovery is a separate genuine decision with exact state/risk evidence. Never copy fixture receipts, assume old installed engine equivalence or alter exactPasses to land. Native receipts can qualify an unlanded clean candidate only through that supported protocol; post-landing-only receipts would recreate the circular gate. Full four exact source checks/current definitions, immutable artifacts, independent QA and native serialized landing remain required.

Immediate peer decisions are concrete: Work ratifies snapshot/execution APIs, quotas and one supported fence backend; Kernel pins V2 bytes and real bound issuer/ adapter transport compatibility; QA grants exact listed test/contribution scopes and positive barrier/descendant/CAS scenarios; Release pins later fixed parent CLI invocation. Source code remains unauthorized pending those decisions and the arbiter's bounded scope choice. This packet retains the complete real native path.

Actual B1 four-path authorization and real composition roadmap, 16:29 UTC

Latest16:39 QAc73fb0f6 REJECTS b375 narrowly for append-only TIN placement: move exact23-line allocation correction block from line48 to document end, unchanged. Independent10/10 focused/syntax/clean and zero-copy direct probe pass technically, not source acceptance. Routine same-scope correction routed existing Kernel/Work; new exact candidate requires QA. Preserve all source/test assertions and histories.

Current16:34 implementation evidence: initial9b4 localPASS claim did not establish bounded parsing; owner465 independently instruments1MiB+1 input and observes copy before refusal. Corrected b375037a9c checks original byteLength before each public copy/hash/parse and adds zero-copy regression without changing old assertions. Exact Kernel clean four-path c08 delta/diffcheck observed; focused/eslint/syntax PASS is implementer evidence. Existing QAbec5581a and Work5c0378fa must independently classify the corrected exact candidate and mutation scenario; no source/native/operational acceptance is inferred. SAME task verification11 preserves9b failure and all prior history; legacy2/current3vs2 guards unchanged.

Corrected QAc3e0241 replaces only erroneous src/control-plane path consent with NEW src/kernel/managed-subject-metadata.mjs, NEW src/kernel/check-subject-context.mjs, NEW test/fleet/check-subject-context.test.mjs and append-only docs/TEST_INTEGRITY.md. Actual Work4a3c8ab6 agreement pins the reserved parent bindings. Actual ownerb819ecbc authorizes implementation only on those four paths, SAME6e4 Work ownership and named Kernel contribution. Existing Kernel active3473803 is owner-reported; Manager starts none. Current task verification10 retains landed316/a178 and all seven full criteria. Kernel returns exact clean task-named candidate with focused/syntax/diff checks and TIN; existing QA independently reviews exact source. Native gates and current required3/current2 refusal remain, no installed old checker equivalence.

Implement V1 bounded data-only fixture/untrusted-observation parsing and genuinely issued opaque fixtures, with exact public namespace/input allowlists, clone/foreign issuer/expiry/reuse/selectors-before-parsing refusals, independent frame/digest mutations and dirty/stale/unknown/mixed/version-drift negatives. Schema2 remains legacy-readable; required3/current2 refuses with zero mutation. Missing native issuer is CHECK_SUBJECT_CONTEXT_MISSING_COMPOSITION. Metadata frame is <=1MiB; product bytes are represented by observed length/SHA, not copied into or inferred from it. V1 explicitly refuses parent/native/loaded-engine claims and V2-shaped fields; fixture positives never become native candidates or receipts.

Reserve explicitly named V2/successor canonical E/S/A bytes: E module/interface ID, fixed entry length/SHA and dependency-manifest length/SHA; A compatibility declaration bytes/schema tuple plus adapter entry/dependency manifest length/SHA; S project ID, commit, clean-tree digest, snapshot-policy digest, frozen-input-manifest digest, total bytes/file count. private inputRoot stays nonserializable parent state, never a caller selector/frame value. Do not silently reinterpret V1 or implement the parent/adapter/receipt/consumer/CLI under B1 authority.

The next real-composition scope remains Kernel fixed no-args parent and pre/post E/A byte binding, Work child execution only in frozen snapshot.inputRoot and enforceable fence admission, later compatible adapter/native consumers and Release CLI composition, independently QA-qualified. Future separate scenarios require same-ID E/A byte substitution refusal, original-source mutation after capture with unchanged child-observed snapshot bytes, snapshot mutation UNKNOWN/refusal, descriptor-versus-product-size separation and no enforced fence/PGID-only => no PASS. No same-user OS containment or loaded-memory proof is claimed. Unknown terminal descendant coverage refuses TerminalProof. This mandatory roadmap avoids a permanent fixture-only/all-refusal substitute for full6e4. No live DDL/schema, registered provisioning, existing consumer wiring, runtime75, host/provider/wakes or publication permission is granted by these source decisions.

Current narrow B0 acceptance and proposed B1, 15:47 UTC

Current16:19 actual Work4a3c8ab6 accepts B1 fixture parsing surfaces and pins future ParentSubjectBindingV1, not code authority. Kernel a6b009c4 completes read-only byte/API pin; complete addressed contract requested d46b954d. QA f246 grants strict scenario contribution but says src/control-plane modules; current Kernel/report scope is src/kernel modules. Exact correction requested e68791be, not silently reinterpreted. Work's actual full parent agreement was forwarded c05d2769 to resolve QA's missing-copy race. No stale Work agreement hold remains; exact path consent/complete tuple pin/arbiter decision still matter.

Mandatory later real composition, owned by Kernel in src/kernel/candidate-source-parent.mjs: openCandidateSourceParentV1() takes noargs, derives fixed installed module location and validates actual startupcwd against install/project/managed common-dir+registered branch/clean tree before issuing private opaque binding. Caller JSON/callbacks/selectors never issue authority. E/A fixed entry/dependency bytes are hashed before import, imported at fixed path, then re-read/re-hashed with interface/module-ID checks; mismatch refuses, never an in-memory byte proof. S separately captures snapshot-policy/frozen-input manifest/tree digests, byte count/file count and privateinputRoot. Descriptor1MiB cannot replace product bytes. E/S/A canonical version must explicitly include dependencies and snapshotmanifest; incomplete fixture v1 cannot silently acquire native meaning. Future Work seam runs the child ONLY at snapshotinputRoot; mutate original source after capture: black-box command still sees original snapshot bytes; mutate snapshot: pre/postmanifest check UNKNOWN/refusal. Current PhaseA capture is unbounded/non-atomic/same-user-writable, not final qualification. No viable fence means noTerminalProof; PGID emptiness alone never permits PASS.

These future parent/consumption/fencing/receipt-adapter/native-consumer phases need exact contributor scenarios and separate arbiter authorization. B1 private API plus fixture metadata positives are useful bounded progress, not a permanent all-refusal/fixture-only substitute for full6e4. Legacy2 remains valid and current required3/current2 refusal is unchanged. No registered provisioning/DB/liveDDL/ MCP/CLI/host/install/provider/wake or publication action follows from agreement.

Actual QA3cf79613 independently ACCEPTS exact clean c08ca349c8, fixture-only cumulative four-path B0 source. Namespace allowlists, issued clones, foreign selectors/zero DB calls, semantic and lexical corruption and exact focused syntax/scenarios PASS; TIN is append-only without relaxation. This supersedes the pending c08 review below, not the old613 raw-DB and197 denylist rejections. No whole316..c08 branch acceptance, native receipt, integration eligibility or operational qualification. Native required3/current2 still refuses, full6e4 remains verification9 at landed316 after metadata-only evidence reconciliation preserving its state/owner/full criteria.

The next B1 proposal, after this actual B0 verdict, is a named Kernel contribution on SAME6e4, with Work retaining full-task ownership. It is not code permission, an assignment, or a generic design review. Four proposed paths only:

Path	Contributor	Bounded behavior
src/kernel/managed-subject-metadata.mjs	Project Kernel	Read-only metadata validation and immutable observation: project/config/install/worktree relationships, exact version/source/artifact bytes and explicit missing/mixed/unknown state; no ControlPlane construction or DB initialization.
src/kernel/check-subject-context.mjs	Project Kernel	Versioned immutable context descriptor and strict admission at an independently reviewed binding interface. Caller claims may verify a captured binding, never issue authority or redirect roots/DB/schema/engine/area. Missing genuine issuer/composition refuses native admission.
test/fleet/check-subject-context.test.mjs, NEW	QA-named contribution required	Additive deterministic boundary and mutation scenarios below; existing tests remain unchanged.
docs/TEST_INTEGRITY.md, append-only	QA-named contribution required	new_tests scenarios, fixed data, no retries or relaxed expectations; disclose fixture-only positive proof.

Real composition must be pinned before code. Current canonical MCPserver opens ControlPlane before assertIdentity; claimedIdentity depends on that already initialized instance. ControlPlane constructor validates manifest/config/local project metadata but then opens state.db and initializes schema. This is not a side-effect-free authenticator to reuse. Kernel must specify a reachable private issuer/reader composition and exact allowed public surface, with Work agreeing on the trusted parent binding input. Matching JSON, cwd/env, copied capabilities, or a caller-supplied verifier are not authority. If current installed parent cannot issue the reviewed binding without initialization, B1 must return a specific missing-composition refusal; no registered/native eligibility may be claimed. An isolated synthetic composition can exercise descriptor validation but remains tagged fixture-only/nonpromotable. Module capabilities protect the API surface; they do not prove same-user filesystem/process isolation.

Candidate versus installed/served identity stays separate: E denotes actually loaded engine bytes/interface, S exact clean product subject, A actual adapter bytes/interface/observed schema. No E/A digest is inferred from repository HEAD, package label or a copied attestation. B1 may expose unknown observations and strict mismatch refusal; receipts, worker launch, leases, CAS/results, input execution/consumption and terminal coverage are outside this phase. Later real parent/consumer wiring requires separately owned implementation, independent native qualification and untouched existing gates. B0 fixture DDL is not a registered-store provisioner, and schema2 metadata is not a schema3 receipt.

Requested strict B1 scenarios:

1. Given captured synthetic managed metadata, reading/validating preserves every input file byte and produces immutable versioned observations; malformed, missing, foreign or contradictory project/install/area/worktree relationships produce bounded refusal before DB constructor/schema/writer/worker calls.
2. Given a genuine issued test capability, spread/JSON clones, wrong issuer, expired binding and every caller root/DB/DDL/engine/adapter/area selector are rejected; exact Object.keys export allowlists reject renamed authority seams.
3. Given exact separate E/S/A observations, candidate/engine/adapter mutation, stale commit, dirty candidate, mismatched digest/interface/schema or unknown required field fails closed. Fixed framed preimages and independent expected digests prevent deriving the expected value from the implementation.
4. Given repository316 but servedalpha2 or immutablealpha3 source28c, metadata observations preserve mismatch/unknown; repositoryHEAD or pointer relabel cannot claim loaded/served equivalence or repair omitted blockedReason. This is a metadata contract scenario, not active Console source expansion or live UI PASS.
5. Given no independently qualified native parent issuer, context admission explicitly refuses; fixture positives never return native eligibility/receipt. Current3/current2 refusal, legacy2 receipt meaning and no-live-DDL remain intact.

Entry decisions: QA exact path/scenario consent, Kernel precise reachable issuer composition and Work parent/engine protocol agreement; Release consulted for loaded-versus-immutable metadata semantics. Only after these actual decisions may the arbiter authorize B1. No current consumer/CLI/MCP/self-host edits, registered provisioning/live state reads or DDL, installation75/service restart, source landing, provider start, wake/host change or publication in this proposal.

Current complete contract review: Kernel b681, 15:04 UTC

Current QA489 verdict rejects197 for scenario protection only; independent 197 caller DB zero-exec checks pass. Preserve old613 bypass separately. Kernelccca corrective c08ca349c8 supplies exact Object.keys allowlists, actual issued-capability clones and lexical malformed metadata while retaining fixed preimages/zero-digest drift and strict assertions. Local five PASS are contributor evidence; owner26d confirms existing QA resumed for exact verdict, Manager e812/Work7f191 route current evidence. B1 concrete metadata/context scope follows actual B0 acceptance and requires its own named QA contribution consent, Work protocol agreement and arbiter implementation decision. No new assignment or broad branch/native/operational acceptance is inferred. Current3/current2 guard and full6e4 actual immutable inputs/lease fencing/consumer criteria remain intact.

Current corrective handoff cf842edc, 15:26:54, names exact 1976208bfa. Manager read its four-path diff: old raw initializer/verifier exports removed, fixture initialization private in the provisioner, foreign caller DB and forged authority negative asserts zero exec/prepare calls. Kernel's five focused PASS are contributor evidence only; independent QA 0d6e0a88 and broader Work protocol ef5bfda3 remain distinct handoffs. Owner e8436ed6's instrumented old613 PRAGMA/CREATE bypass is retained as falsifying evidence, not repaired retroactively by the newer commit. No native receipt, registered provisioning, consumer wiring or operational acceptance.

Current owner8bf confirms existing QA resumed for exact197 independent public allowlist/renamed-export and arbitrary-DB mutation review. Next metadata/context phase is a bounded proposal after that actual verdict, with exact QA contributor consent and Work engine/parent agreement before arbiter implementation decision. No broader permission is inferred from current fixture PASS.

Current B0 implementation handoff Kernela678 reports exact clean613f62af, four authorized paths and five local scenario PASS/syntax/lint. Ownerbbbd identifies exported raw-DB initializer bypass; Manager independently confirms public initializeCandidateAttemptStoreV1(database,metadata) and provisioner call. B0 source exists but is not accepted from those local passes. Same-scope Kernel correction and independent QA must reject arbitrary DB DDL through the public export surface. Preserve613/evidence; no native receipt, source integration or full-task acceptance.

Manager read the complete durable message b6818413-798a-450c-ad20-dfca25f45f77 (14:54 UTC), including all six paths, CandidateStore/v1 table definitions, issuer/reader/parent composition, lifecycle CAS and proof admission. The earlier 959 shape discussion below is historical; current technical decisions target b681. Current task is Work verification7 at exact316/a178 landed; native QA and permitted development-ref source synchronization are resolved, not whole-task completion. No code, source/test edit, registered provisioning or activation is authorized.

The new contract specifies candidate_store_meta, candidate_attempts, candidate_results, candidate_source_receipts and a reconciliation index; independent E/S/A and attempt/guard/lease/fence digests; busy_timeout=0 and short BEGIN IMMEDIATE mutations; issued -> executing -> sealed -> finalized one-row CAS; result plus eligible receipt in one transaction; SELECT-only reconciliation. UNKNOWN retains the open attempt and guards, never a terminal result or replay. Definition/input/ output and artifact bounds are named. Module-private fixture authority, pure managed metadata reader and parent-only engine composition replace the previously unnamed seams. These are concrete progress, subject to the exact issues below.

Boundary	Manager review decision	Exact unresolved evidence/contract
Executable DDL and digests	Not yet executable or uniquely canonical	Supply exact ordered CREATE TABLE/INDEX/PRAGMA statements, UTF-8/LF byte representation and a versioned length-framed or canonical envelope. Define which bytes/digests are inputs; exclude self-referential stored digest values. Pin schema_digest separately from ddl_digest, logical-state ordering and SQLite configuration.
SQL invariants and byte limits	Application assertions alone are insufficient evidence	SQL length(TEXT) measures characters, while stated limits are bytes. Pin enforced UTF-8 limits and null/hex/type pairing for optional schema/proof fields; cross-row result/attempt/PASS-only receipt linkage must reject forged combinations at the declared boundary.
Reachable private fixture issuer	Private WeakMap verification is useful, but issuance is undefined	An external harness cannot call a module-private issuer as stated. Specify a supported composition that creates its own fresh synthetic mkdtemp target, retains the private issuer, returns only bounded nonpromotable operations/attestation and rejects caller paths/registered selectors. No exported issue-from-path escape hatch.
Fixture positive CAS evidence	Current blanket fixture rejection leaves a positive test gap	Define a separate nonpromotable fixture-result transaction surface for valid issue/start/seal/finalize/crash scenarios, while the registered receipt adapter always refuses fixtures. No fixture native PASS or copied registered-looking fixture receipt.
Input read versus execution use	Wrapper hash attests byte receipt only	Pin a versioned consumer/dataflow that uses the bound immutable representation for the declared check, attempt/channel/direct-child identity binding and replay limits. An untrusted child statement, token echo or copied-byte digest cannot prove arbitrary executor use.
Descendant terminal coverage	Process-group emptiness is insufficient	A child can leave the group. Name an enforceable supervised execution boundary and its verifier/coverage limits; if escape prevention or complete terminal coverage is unavailable, retain UNKNOWN and refuse PASS. PID/group sampling alone cannot discharge this requirement. No same-user OS containment claim.
Trusted metadata composition	Initialized MCP seam cannot substitute pure reader	Actual server opens ControlPlane before assertIdentity; claimedIdentity uses that initialized instance. Pin pure launch binding validation, reader/verifier dependencies and refusal of unavailable/incompatible state without open/DDL. cwd/env are inputs to validate, not sufficient authority by themselves.

Manager routed exact decisions to current resumed QA 7fd57562, Work 5638f592 and Kernel 8446d2bb. These are bounded decisions on b681, not a new generic design loop or implementation assignment. QA contributor/scenario consent and Work parent/engine protocol agreement are distinct required decisions. Until their actual current replies, no bounded next implementation scope is recorded as agreed. Legacy compatible schema2 receipts retain meaning and current required3/current2 native refusal stays intact. Host/provider/wake/installation/approval75, live DDL, CLI and existing native consumers remain excluded. Full56 backlog remains open; idempotencyc178 is proposed and both original/duplicate integration records remain.

Actual QA 78cdac6d-0546-472d-b8c6-de1619f9e27e at15:04 grants conditional scenario/path consent only for six Kernel paths, three tests and append-only TIN; it is not actionable consent or code authority until byte-canonical DDL with per-connection FK verification/no caller schema, reachable private fixture harness, framed E/S/A, attempt/child/full-pipe proof, PGID-only UNKNOWN and closure-only nonpromotable fixture finalization are pinned. QA excludes OS and semantic-use claims and says current Phase A cannot PASS under the proposed protocol. Work's current protocol agreement is separately pending. Manager requests confirmation that QA's peer-addressed Kernel7992 copy is the same concrete b681 revision. Byte receipt must stay visibly narrower than actual arbitrary-check input use; the full task's frozen-input/native consumption criterion remains unproved, not weakened by relabelling this bounded prototype. No next code scope is agreed yet.

Entry conditions and scope decision

Current arbitercc6c43ab (15:10:28) authorizes B0 after actual usable QA03e2, within SAME6e4 named Kernel contribution: only the two new store/provisioner modules, new store test and append-only TIN under five strict scenarios. Arbiter reports existing Kernel clean6fdb88ea/no prior active handle and controls resume; Manager launches nothing and creates no second assignment. Work stays full-task owner; current metadata-only verification8 preserves all criteria/history/exact316. Manager50d/d1e routes actual scope and independent QA follow-up. There is no stale conditional QA/owner wait for B0. Broader Work parent/engine protocol agreement, real immutable-check input consumption and enforceable descendant coverage remain separate future gates; B0 does not implement or claim them. No context/parent/ adapter/lifecycle/CAS/result/receipt/consumer/CLI/registeredDDL/schema/installation/ host/wake change. Actual clean task-named candidate and independent QA must precede any source qualification; fixture provision is never a native receipt or full-task completion. This records authorization, not observed implementation or acceptance.

Owner 08f9a5f0 supplies a narrower next review target: B0 only, same6e4 named Kernel contribution, two new store/provisioner modules, one store test and append-only TIN. It excludes context/parent/adapter/Work protocol implementation and registered lifecycle/result/receipt activation. Manager b0f9e319 requests explicit actionable QA consent for exactly that slice, 478265ba routes the corrected byte-defined internal DDL/private fixture composition requirements to Kernel, and 4ec215f9 requests Work's actual current protocol decision/source references. Conditional QA78cd does not authorize it; the arbiter will decide implementation only after actual consent. This is a review target, not an agreed next implementation scope or code assignment. Owner's two existing snapshot tests PASS are narrow reusable evidence, not new parent/input/descendant qualification.

Actual QA03e2b4ed-0735-4de6-b599-5a5a5633bf9b at15:08:48 grants usable B0 contributor/scenario consent, subject to the corrected narrow contract, for exactly the two store/provisioner source modules, new store test and append-only TIN. Manager 152ce665 relays that exact permission to Kernel without code authority. The granted five observable scenarios are:

1. Only internally fixed ordered UTF-8/LF executable CREATE/INDEX bytes execute in the synthetic fixture; independently asserted version-framed DDL/schema digest preimages exclude metadata self-reference. Order/CRLF/version/digest/ schema drift refuses; expected values are not generated by the implementation.
2. Every fixture connection enables and verifies foreign_keys=ON/user_version=1; disabled/unverifiable FK and malformed digest/metadata fields refuse.
3. The closure factory alone creates mkdtemp and synthetic identity/private WeakMap capability, exposes no raw root/DB and accepts no caller DDL/root/DB/ path/manifest/registered selector. Corruption is enumerated, bounded test input.
4. Expired/closed/reused/foreign/nonempty/drifted/registered-related targets refuse with bounded reason before registered DDL.
5. Fixture attestation stays permanently nonpromotable; no registered store, lifecycle/CAS/result/receipt/native consumer/CLI or native PASS follows.

TIN is new_tests, five scenarios, hermetic controlled corruption/no retries, no assertion relaxation and explicit B0 exclusions. Later CAS/input/fence scopes are not silently included. Work's current direct protocol agreement and Kernel's exact corrected executable contract are still open handoffs. Usable QA consent alone does not approve next implementation; arbiter authorization is separate. No code assignment, source/test edit or full-task acceptance is recorded here.

Work Phase A corrected candidate b1c4c26b is implemented and currently clean. QA1b804 narrowly accepts 13 focused hermetic scenarios and classifies the separate five-PNG incident without an archive/dirty-byte claim. Local full checks remain development evidence. Guarded convergence to canonicale8c4c424 produced clean316d8b74. Four fresh native PASS receipts and independent QAc841 exact source/native-gate acceptance now exist; native originala178 landed that exact source at14:44:26. Source entry evidence is resolved; full task and operational proof remain open. Narrow acceptance excludes actual child input consumption, OS containment and a concurrent-writer atomic directory snapshot; those are explicit future proof gaps. Preserve 9946 rejection, all current/old receipts, actual restoration command history and old cce needs_convergence. No archive is claimed without actual evidence.

Recommendation: approve only a Kernel-owned hermetic implementation trial after those entry conditions and the exact interfaces/tests below are accepted. Review B0, B1 and B2 separately; decline or revise any unresolved contract before code. Manager must reread current brief and next-task selection before an actual assignment. Kernel's reservation125, inbox565 and inventory1e688 histories stay blocked and intact. A later Kernel implementation needs explicit sequencing; this proposal does not activate it or silently transfer the Work-led item.

Historical 959 interface shape review

Kernel959d proposes protocolVersion1 APIs:

• provisionFixtureCandidateAttemptStoreV1({fixtureAuthority,fixtureIdentity,canonicalSchemaDefinition}) resolves one fresh synthetic temporary store through trusted fixture authority, never a caller path. Immutable FixtureStoreAttestation includes fixtureIdentity, protocolVersion, schemaVersion, schemaDigest, ddlDigest, preStateDigest, postStateDigest and nonpromotable:true. Registered/preexisting/drift stores refuse.
• deriveCheckSubjectContextV1({parentAuthority}) returns immutable E/S/A, with no caller area/check/root/commit/manifest/DB/adapter selector. Existing resolveInstalledProjectRoot/readInstallManifest are only read primitives.
• FinalizeV1({finalizerAuthority,attemptRef,expectedTupleDigest,terminalProof,artifactManifest}) derives its compatible store internally and performs sealed-to-finalized CAS, ResultRecord and eligible receipt in one transaction; no caller writer/store.

These are proposed shapes, not implementation-ready authority contracts. The RegisteredSubjectAuthorityV1 issuer/verifier and pure managed-worktree/clean-source binding reader do not exist and must be concretely pinned in the proposed Kernel check-subject-context module, or name an additional owned path before code. Owner27 identifies current MCP server actorId/ControlPlane.assertIdentity and tools claimedIdentity as the initialized-parent boundary; they depend on ControlPlane and cannot substitute the new side-effect-free seam or prove same-user OS containment. Kernel must pin full CandidateStorev1 DDL, lifecycle/CAS states, bounded envelopes, single-use finalizer authority and issue/start/seal/finalize/read-only reconcile APIs.

QA c841 explicitly grants no Phase B contributor/code/test consent. Kernel, Work, Release and QA resolve these routine interface/scenario details directly; no additional owner product decision is required merely to name pure interfaces. Admission must reject absent actual child immutable-input consumption, attributable parent terminal/descendant fence or artifact seal proof. Fixture attestations never produce native PASS. Exact contracts and named QA consent precede any later code scope decision; this report grants none.

Exact contributor map proposed for review

Live ownership queries on 2026-10-01 confirm Kernel owns src/control-plane/** and src/kernel/, QA owns test/. Proposed new paths are:

Proposed responsibility	Primary implementer	Exact new path
Fixture-only provisioner, schema compatibility inspection	Project Kernel	src/control-plane/candidate-attempt-store-provisioner.mjs
Attempt/result store and transaction boundary	Project Kernel	src/control-plane/candidate-attempt-store.mjs
Authenticated E/S/A context derivation and refusal	Project Kernel	src/kernel/check-subject-context.mjs
No-DDL result finalizer/receipt adapter	Project Kernel	src/control-plane/check-receipt-adapter.mjs
Pure managed-install/worktree metadata reader	Project Kernel	src/kernel/managed-subject-metadata.mjs
Parent authority and engine composition	Project Kernel	src/kernel/candidate-source-parent.mjs
Store/provisioner/transaction scenarios	Independent QA	test/fleet/candidate-attempt-store.test.mjs
Subject/engine/adapter binding scenarios	Independent QA	test/fleet/check-subject-context.test.mjs
Finalization/replay/artifact/outcome scenarios	Independent QA	test/fleet/check-receipt-adapter.test.mjs

QA must name any contributor exception before Kernel touches tests and must approve an append-only docs/TEST_INTEGRITY.md destination. Existing source files, ControlPlane initializer/schema guard, CLI/bin, Work CheckService/conditions, resources, Integration exactPasses, Backlog, Delivery, config and native receipt consumers are excluded. Work reviews the actual Phase A engine/collector API; Release reviews the future CLI/parent transport boundary without current wiring. Any newly necessary path returns for named ownership/contributor review first.

B0: qualify the provisioner in an isolated fixture

First pin CandidateAttemptStore/v1 DDL, protocol/schema version, lifecycle, compatibility matrix and migration/refusal behavior in a reviewed contract. Product schema metadata is independent of registered receipt schema authority. The existing currentControlPlane2/required3 refusal remains unchanged; declaring a compatible adapter cannot make be1ae951's initializing schema3 CLI compatible. Valid legacy schema2 receipts retain their existing contract and meaning.

Proposed provisioner inputs are a trusted fixture authority, a fresh fixture storage handle and reviewed immutable schema definition. It can create only a unique synthetic fixture store in a test-owned temporary root. It refuses a registered project/root, arbitrary caller DB path/selector, missing identity, unsupported schema, drift or unexpected preexisting data. No candidate module creates storage. Idempotent repeat provisioning compares exact schema/digests; it never relabels, drops or silently migrates an incompatible store.

Output records fixture identity, schema version/digest, pre/post logical state and DDL evidence; it is always a nonpromotable fixture attestation. There is no current registered-store DDL, live migration or native receipt. A future actual provisioner requires a separate owner decision with exact registered subject, compatible schema/code, writer/process-fence evidence, pre/post state and risk qualification. This proposal cannot satisfy that decision or approval75.

B1: derive context without initializing live state

Proposed Context/v1 is derived by a trusted parent from authenticated registered project/area binding and its clean managed candidate; caller arguments can only verify a binding, never select foreign area, commit, root, manifest, database, engine, adapter, schema or expected subject. Pin the existing authenticator seam and a side-effect-free reader before code; do not construct ControlPlane as a shortcut if its constructor initializes schema. If current APIs cannot derive this safely, return the precise missing seam for review rather than bypass it.

The derived immutable tuple binds independently:

• E: exact engine commit/module bytes, dependency/tree/runtime digests and versioned interface.
• S: tagged candidate-source or operational-runtime, authenticated identity/root, exact clean product commit and product-schema digest or explicit null.
• A: registered adapter bytes/identity/interface, receipt schema and observed compatible control-plane schema under the reviewed compatibility matrix.
• Frozen check definition, verified immutable input digest, attempt ID/generation, exact guards and lease IDs/fence generations, and sealed artifact manifest.

A candidate-source subject never becomes operational-runtime through landing or caller labels. Fixture identities are permanently nonpromotable. Missing or incompatible store/context refuses before worker, lease acquisition or writes; no fallback checker, root redirect, DB copy, schema relabel or new identity.

B2: hermetic attempt store and atomic result finalizer

Pin issue/start/seal/finalize/read-only reconciliation APIs and exact bounded serialized envelopes before implementation. Trusted parent owns attempt authority, terminal observation and result transport. Candidate code receives no writer handle/token/socket/DB/root/manifest; withholding these is an API authority boundary, not proven same-user OS filesystem containment.

AttemptRecord progresses issued -> executing -> sealed -> finalized; binds the full tuple, immutable inputs/definitions, guard and lease generations, process identity/group observation, manifest seal and timestamps. FinalizeV1 performs one BEGIN IMMEDIATE compare-and-swap for the exact sealed open attempt: finalize plus ResultRecord PASS/FAIL/INCOMPLETE; eligible PASS additionally creates one receipt in the same transaction. No consumed PASS without its receipt or consumed non-PASS without its result. Preserve existing check_receipts/exactPasses semantics; initial prototype rows are fixture-only and never gate native Integration/Backlog/Delivery.

Before any native receipt eligibility, independently prove actual child consumption of the bound immutable input and attributable parent terminal/fence evidence; Phase A copied-byte attestation alone cannot supply that proof. Verify/seal does not claim an atomic snapshot against concurrent writers or OS containment.

Validate manifest path/length/hash/canonical order and actual bounded regular-file bytes with link/special/traversal/overwrite/replacement/post-seal drift rejection. Error/signal/timeout/overflow and zero-exit mutation never become PASS. Live or unobservable descendants, cancellation-only proof and ambiguous commit are UNKNOWN: retain durable AttemptRecord, seals/guards/leases, no final ResultRecord or replay. Reconcile only the exact attempt/tuple read-only; never rerun a writer to repair uncertainty. Proven FAIL/INCOMPLETE may use only existing-policy attempt scratch cleanup; no new lease-release authority or receipt eligibility is implied.

Proposed independent scenarios and integrity gates

QA decides exact additions and expected behavior before contributor permission. Use synthetic fixture identity/temp root, fixed clock/IDs, deterministic terminal and filesystem boundary inputs. Control transaction interruptions at declared persistence boundaries; no sleeps/retries, weakened assertions or mutable goldens.

Scenario	Given / When	Required observable outcome
SCN-store-fixture-isolation	Fixture provisioner receives a registered/foreign root or incompatible existing schema	Refuse before DDL; schema and logical rows unchanged; no native receipt
SCN-context-authenticated-tuple	Caller supplies foreign selector, dirty source, digest/schema/adapter mismatch	Refuse before execution; registered state/guards/messages unchanged
SCN-atomic-result	Exact sealed attempt finalizes PASS or proven non-PASS; interrupt each persistence boundary	One atomic result/eligible receipt or retained UNKNOWN, never partial consumption
SCN-finalize-replay-fence	Duplicate/wrong tuple, stale guard/lease generation or nonsealed attempt	No extra result/receipt or release; exact prior evidence preserved
SCN-artifact-seal	Root/manifest/file link, special file, traversal, cap overflow, replacement or seal drift	Explicit refusal, bounded retained evidence, zero qualifying receipt
SCN-terminal-unknown	Cancellation, descendant uncertainty, timeout/error/overflow, ambiguous commit	No false PASS; attributable proven result or guarded UNKNOWN with read-only reconciliation
SCN-fixture-nonpromotion	Attempt fixture result is presented to any current native receipt consumer	Reject; no integration/closure/delivery/operational acceptance
SCN-schema-legacy-boundary	Legacy schema2 tuple remains valid while schema3 initializing candidate targets current2	Legacy behavior retained; original native downgrade refusal preserved

Required evidence: equally strict additive Test Integrity Note, original valid scenario passes and deliberately corrupting/replay/partial-write variants fail for the intended reason, independently reviewed exact candidate and hashes. Focused fixture success remains a fixture result. After approved code and clean guarded convergence, native exact required checks on the resulting commit, independent QA and serialized authority-gated integration still apply. Tool/schema refusals remain blockers; prose does not qualify native receipts or waive existing landing gates.

Arbiter decision and later boundaries

For review: accept/revise/defer the exact hermetic B0-B2 trial after entry evidence, Kernel/Work/Release interface review and named QA path/scenario consent. Recommended choice is the isolated trial, with no native/live store provisioning. Record any accepted scope on one existing continuity-preserving assignment only; provider start remains a separate arbiter act. Store/context native activation, live DDL, CLI Phase C wiring, source-requirement allowlist Phase D, resource policy changes, installed alpha3 switch and operational/browser qualification each retain their separate approval/verification requirements. No automatic wakes, extra identity, installation/host change, release/deployment or full55-roadmap completion.