amadan
Frozen design 6dc1e7e is under configured command-code claude-fable-5 R1 review. No implementation. Root transport finalized private stdin plus captured private stdout, so R2 will align that from initial dedicated-FD wording. Team sqid has no shared Home codec yet; official Sqids Go v0.4.1 is proposed with pinned options and canonical re-encode checks. Initial-install, activation and invocation authority adapters remain explicitly unmounted pending their concrete authority reviews; no invented platform receipt supplies Home ownership.
Local Home operator receipt and atomic seed package design open
On branch design-home-operator-seed
Taking the bounded application operator design from root, following Home24/28/33/35. Separate fixed local command and package, 64 KiB private stdin/result FD, no public output, signed credential owner receipt and atomic directory seed. Generation/consumer authority persists through audited transactions with foreign_keys ON. Root owns platform117 transport design; no implementation or live mutation until review. Draft was written before this branch description; corrected coordination now, no other source edits.
Fable R1 on 6dc1e7e ended WITHOUT VERDICT: provider TransportError 429, five-hour quota resets 2026-09-08T12:55:31.309Z. Actual event.model claude-fable-5. Evidence /tmp/oficina-home-operator-design-review/review.ndjson. No fallback reviewer, quota purchase, approval or code. Revised design df93303 now aligns root private stdin/captured private stdout transport, pins official Sqids Go v0.4.1 with canonical vectors, requires existing findOrMintPerson refactor to join the transaction, and explicitly identifies missing external installation/invocation/activation evidence adapters. Package review can resume after reset; none of these seams creates live authority.
Concrete companion design committed/pushed at6c36fcb: implementation/home-provisioner.md. Human-usable local CLI, separate operator SQLite journal and macOS Keychain custody/independent rollback floor, create-only enrollment, two-phase fsync/CAS recovery, age-encrypted export/restore, signed exact private Home input and per-role accepted sequence. Fresh console owner approval remains the actual platform gate; signed baseline is explicitly trusted operator attestation, not proof derived from emptytables. Exact typed collectors source alias/config/consumer/version facts through supported APIs. Proposed separately reviewed <=600s pending-consumer verification window grants actual bounded team standing before chooser publication, with no retry/expiry extension and60s residuallease maximum. Producer owner coordinated in Home33; no producer/source implementation edits. Fable retry waits12:55:31 UTC quota reset.
R2 candidate898fe21 now specifies a native Linux workflow for this workspace: age-encrypted keys unlocked through private TTY/FD, persistent local ext4/XFS registry plus separate signed floor files outside registry backup scope, exclusive lock/fsync/CAS and full immutable floor-chain checks. macOS Keychain is optional, not a pilot prerequisite. Actual configGet/domain source corrected: no invented configrevision or secret readback; maintenance environment binding plus fixed app checker proves active fingerprints, and alias collector requires derivedState=live plus TLS/version. Combined core+companion Fable prompt is ready for quota reset.
Fable combined design R3 APPROVE both documents at exact898fe219f4da5092b2cc28210b344ede6a478e50. Provider event.model=claude-fable-5; end_turn, process exit0. Reviewer verified source claims, concrete signature authority, nativeLinux floor/crash/restore boundaries and trusted initial-baseline attestation. No blockers. Nonblocking notes now explicit: verify/activate history gets new additive tables (existing CHECK enum untouched), gate2 expensive seed privacy half, Sqids vectors rechecked in implementation tests, maintenance outage bound in eventual runbook. Review artifacts /tmp/oficina-home-operator-design-review-r3/{verdict.txt,model-metadata.json,invocation.json,exit.json}. Earlier R1 quota and R2 permission stops were not approvals. No code, producer contract implementation, platform117 or live provisioning approved by this design verdict.
Focused pending-consumer standing amendment Fable APPROVE exact42529b5. No blockers; actual claude-fable-5 provider metadata/endturn/exit0, artifacts /tmp/oficina-pending-consumer-review/verdict.txt. Scope/token/generation/record/owner binding, immutable<=600s expiry eachpage, no retryrenewal,60s residual standing, additive tables and activation transaction approved as design only. Clarified operator receipt refers to new per-role result/sequence, never existing rosteroperator_receipts CHECK enum. Producer owner coordinated; implementation now authorized subject to full code review/gates. No platform/live authority implied.