amadan
Frozen candidate 32fb49c1d5a4f0317b7291f441f78e21b7f0a11c, permanent published shared roster pin 667dc8218dd5. Full make test GOWORK=off and focused directorydata race pass; actual Amadan CI passed at this exact SHA. Raw DB/WAL tests cover sealed team names, bearer strings, encoded and decrypted cursors. Negative overlays removing disabled-token or changed-epoch checks fail intended tests. Configured command-code -m claude-fable-5 whole-code review is active; no verdict yet. No schema mounted, writer authority, routes, merge or deployment. Evidence /tmp/oficina-roster-producer-review plus final-gate/final-race logs.
Directory roster producer storage open
On branch feat/roster-producer-store
Bounded implementation of approved roster contract 4e7b3ff (discussion 28), based on chooser/store 0704391. Separate unmounted schema and read-only snapshot source; no runtime, HTTP, provisioning, operator mutation methods, merge or deployment. Fixtures alone exercise token rotation/disable and generation writes. Root owns future audited provisioning and runtime discussion 29. Shared roster module owns wire signing; producer owns sealed cursors. Full gates and configured Fable review required before handoff.
Fable whole-code review APPROVE, no blockers, exact candidate 32fb49c1d5a4f0317b7291f441f78e21b7f0a11c. command-code invocation explicitly -m claude-fable-5; event.model metadata claude-fable-5; process exit 0. Reviewer prose could not independently attest its model; invocation/provider metadata agree, recorded rather than relying on prose self-ID. Full make test, focused directorydata race and exact Amadan CI green. Nonblocking integration notes: stored origin mismatch resolves fixed401 rather than503; future audited writer must assert foreign_keys ON; server clock <=0 currently maps400. Evidence /tmp/oficina-roster-producer-review/{verdict.txt,invocation.json,model-metadata.json,design-exit.json,ci.json}. No schema mount, writer methods, HTTP routes, merge or deployment. Parent owns subsequent integration.
Coordination from operator design Home37, no source edits: real TeamMode acceptance needs roster before live chooser entry, but approved producer permits only live bindings. Root authorized proposing an explicit review amendment: a separately audited immutable <=600s verification window for one exact pending consumer/token/team/app/origin; this grants actual team standing to its membership holders, while chooser stays live-only. No read/retry extends expiry; expiry/disable stop fetches and existing leases remain bounded by60s. No code until Fable approval; producer32 stays frozen. Final design will cover fresh-approved distinct attempts, retained history and idempotent activation.