amadan
Fable claude-fable-5-1 REQUEST_CHANGES on38326fa7: single-console topology cannot be enforced; current platform explicitly supports overlapping consoles and per-box SQLite cannot serialize revocation/publication. Review preserved worker-identity-review/result.json. Its alternative suggests authoritative signed worker head plus CAS fencing active assignments, but root review must correct coverage for preflight/compatibility (not all publications can use terminal guard CAS), in-flight publication after head detach but before guard fence, and signed-object replay claims. Additional source-backed blocker: same-UID flat tenants can read proposed worker credential and private operator fd0 through host /proc; coordinated in126 with isolated-exec revision13 owner. This is a worker mount prerequisite, not a deferred unrelated issue. No worker credential or endpoint deployed.
Authenticate maintenance workers and bind result publication open
On branch feat-maintenance-worker-identity
Source-backed worker identity proposal, continuing platform117. Reuses per-box fleet credential convention while explicitly isolating ops-owned platform-kind workers from customer tunnel/store/placement authority. Shared/root single-eligible-box initial scope; no global decrypt key on customer fleet. Corrects Fable draft OwnerBox semantics to stable logical box label, and requires durable generation floor/tombstones across registry restore. Single-console serialization must be mechanically enforced before mounting; unresolved enforceability or discovery signing is a review blocker, not a supplied boolean. Proposal implementation/maintenance-worker-identity/proposal.json. Actual Fable investigations preserved under /home/paulca/.cache/oficina-provisioning-20260911/worker-identity-design{,-r2}. No runtime worker or publication implemented by this proposal.
Actual Fable claude-fable-5-1 R2 REQUEST_CHANGES on124f1464; per-assignment CAS accepted as mechanism. Required: actual IAM Deny protecting authoritative worker/assignment heads from worker-role rollback (not optional root boundary), preserve accepted terminal outcome when revocation reconciles lagging guard, explicit assignment expiry/closure reclaiming8-slot cap, precise isolation gate incl console and revert interlock. Smaller: direct signed-state status/result reads, exact +1 revisions, identical retry no re-CAS, deployment-wide ciphertext confidentiality noted, root-keyless console refuses all worker mutation doors. Full verdict worker-identity-review-r2/result.json. Applying these before implementation/mount; next Fable review queued after session-limit reset7pm Dublin. No bypass via alternate model/account.
Revision3 and the first code component are pushed at 1ad717b2. Full platform build/make test and release race tests passed locally. New typed root-signed worker-head and assignment-state codecs reject wrong roots/scoped signers, cross-type records, malformed/duplicate/unknown/missing fields, noncanonical encodings, invalid scope, oversized records, and invalid lifecycle shapes. Existing system-pointer signature helper is shared; existing release tests pass.
Proposal now requires the actual IAM write boundary, preservation of accepted outcomes during revocation, explicit expiry/slot reclamation, and observed worker+console isolation with revert interlocks. Coordination posted on126. No worker credential, API, or IAM deployment is active. Fable review remains pending its 19:00 Dublin reset; revision2 REQUEST_CHANGES is not cleared.
Storage component now f8ea228a7f7aa90c20a3d5f1ff5dd01b11fefb0f: verified signed snapshots bind identity/ETag; one conditional write publishes one immutable accepted slot or disables that same state, with no blind retry. Disabled revival, slot replacement/removal, revision overflow, incorrect step ordering, no-op rewrites, wrong signer/scope and cancelled calls refuse. Both CAS orderings and concurrent clients are tested; accepted terminal/resume references survive revocation. Full local platform gate and focused release race tests passed. Runtime enrollment, evidence validation, IAM and isolation remain unmounted/gated.
Frozen review is queued for Fable after the 19:00 Dublin reset, following Home diagnostic and Calendar reviews. The queue is read-only and stops on another quota refusal. No deployment/merge implied.
Fable5.1/claude-fable-5-1 APPROVES independent merge of bounded codec/store slice f8ea228a7f7aa90c20a3d5f1ff5dd01b11fefb0f. ExactCI rechecked success; full local build/test and release race gates previously passed. No runtime caller exists. Activation remains REQUEST_CHANGES-gated on deployed IAM writer separation, observed isolation including console host, worker enrollment/authentication, accepted-result reconciliation and closure/reclaim. Before first caller, clarify per-kind slot mapping and head transition/empty-placement limits, add enabled/no-slot-change transition coverage and bounded ETag handling; record deployment-wide input confidentiality among shared/root boxes. Review saved worker-control-final/result.json. Merging library slice does not activate or enroll a worker.
While126 owner finishes probe/migration work, I am taking a narrow prerequisite from Fable final review: bounded worker-store ETag handling and explicit enabled/no-slot-change rejection coverage on fix-worker-store-bounds from current mainc1d40ee. No runtime caller, IAM change, credentials or worker activation. Home private v2 schema primitivesf88ea26 are Fable-approved and local full gate/races green.
Worker storage bounds source b3de197 is Fable-approved and full local tests passed. Merge is held by the required remote MinIO contract job: pinned upstream arm64 artifact returns HTTP 410 before tests. Details and exact evidence in discussion 146. Runtime activation remains off; isolation and enrollment/IAM work remain prerequisites.