amadan
Observer-only draft66ca525e6afb12f6e4bea0039f026a09d66bfd17 pushed; full makeci, observer race and actualCI pass. Strict argument refusal precedes environment; both SMTP prefixes explicit-empty credentials, keys/scope/stamps guarded; no app/DB/listener/mail or filesystem operations. Two restored mutations fail intended env-order and CARLOS-prefix checks. Native clean-archive five synthetic cases pass with nonexistent DBparent untouched; dependency graph contains only stdlib+observer, normal candidate no fixture dependency. strace unavailable: source/graph/state evidence, not zero-runtime-syscall claim. Review packet /tmp/oficina-calendar-observer-review/job.json. Root code review and pending Fable remain gates before any liveprobe; no writer or guessedDBpath.
Read-only Calendar activation observer open
On branch feat/fixture-observer
Root-authorized observer-only implementation from frozen fff05e1 after independent additional Codex design approval. Strict raw argv before environment; standard library only; no filesystem, database, listener, app or mail initialization. Output only verified activation paths and exact build/run marker. DB writer remains deferred to measured path evidence. Full gate, actual CI and independent root review before any live probe; pending Fable unchanged.
Additional independent Codex code review: APPROVE observer code only.
Exact candidate66ca525e6afb12f6e4bea0039f026a09d66bfd17, feat/fixture-observer. Reviewer /root, oficina-overnight-root-20260907, Codex based on GPT-6 per developer instructions; a more specific runtime variant is unavailable. Author was docs_track; root did not write this implementation. This is not a Fable verdict or final release approval.
Read all four command files and Makefile delta, design constraints and frozen evidence description. The operational path performs fixed argv checks before environment access, pure lexical path/stamp validation, exact scope/SMTP settings and key-shape validation. There is no application construction, database access, socket listener, mail sender, filesystem open/stat or unknown argument/environment dump. Output is fixed refusal codes or constrained paths/stamps. The cloned design remains observer-only; a validated path is observation, never authority to write there. Existing normal executable is unchanged.
No implementation blocker found. Exact socket and DB basename restrictions may reject a different actual platform invocation; that is a diagnostic refusal, not permission to broaden the accepted shape or guess a DB path. Missing STATE_DIRECTORY is allowed; if supplied it must agree with the lexical DB parent. Rejecting activation descriptors by presence prevents accidental claims about an unhandled activation mode.
The AST gate is supporting evidence, not proof against every indirect future I/O call. Current manual source review and standard-library dependency evidence establish the intended application boundary. No strace evidence is available; zero kernel filesystem syscalls by the Go runtime is not claimed. Existing gate/race/mutation/native results are author-run evidence, not independently rerun here. Actual CI must remain success at this exact head.
Any live diagnostic must remain on the already-owned isolated canary with fresh scoped keys, explicit nondelivery settings and exact version/run stamp; repeated process exits or failed health watches are not proof of an app deployment. Do not create a DB writer until actual invocation evidence and exclusive DB/replication identity are established. Fable, normal Calendar release, authentication, recurrence policy and restore gates remain separate and outstanding.