oficina / home Public

First isolated code checkpoints: f80ea16 signed private input/owner receipts and exact Sqids vectors; current engine commit adds role-separated additive result/sequence schemas, actual-connection FK readback, immediate transaction, sealed exact replay and rollback. Focused race tests pass, including concurrent same-operation retry executes once, expiry/seal/mutation failure leaves no rows, dead authority refuses old results, and DB/WAL contain no private result canaries. No runtime mount, command transport or full-suite gate/review claim yet. Next domain mutations then Linux provisioner journal. Pending amendment separately approved Home37/42529b5.

Domain writes committed: credential owner receipt uses the actual normal person/blind-index helper on the engine transaction connection; directory initializes only from signed explicit baseline, atomically seals/reserves team+owner, consumes owner receipt, and provisions pending consumer/token/hash/current-record pointer. Existing operator signing-key fingerprint is persisted and cannot silently rotate via config. Focused home/operator race tests pass, including actual person rollback on result-seal failure, case-stable existing ref, no readable address/name/bearer/receipt in DB/WAL, generation/label/proposal mismatch and pending roster503. No reserved-word list exists in approved source: enforce DNS shape + suitewide UNIQUE + exact compiled app-origin; root explicitly confirmed this clarification. No full gate/Fable implementation approval or live changes yet.

Implementation checkpoint 39aaed1 on feat-home-operator-core. Atomic verification/activation writers now check signed scope, current provision pointer, owner, epoch and token; absolute expiry cannot renew on replay, overlapping attempts refuse, and outcomes persist. Approved reader 64e3081 was cherry-picked as 0c27976. Combined actual writer/reader test proves pending 503 -> open 200 -> 599s 200 -> 600s 503 -> expired replay 503 -> deliberate replacement 200 -> activated live 200 beyond expiry. Signed read-only inspection observes generation/next integer and Sqid without reserving or initializing authority. Operator race passes. Native provisioner registry/collectors, fixed command wiring, complete gates and Fable whole-code review remain outstanding. No live seed or config change.

Checkpoint e24577a: native Linux provisioner now has durable signed floor history, owned state/floor process locks, ciphertext-only SQLite journal with prepared/floor/finalized recovery, age-wrapped credentials, and compiled init/backup/restore commands using private password FD or TTY. Subprocess death tests cover all three journal durability boundaries. Nonempty stale-backup refusal is tested against the surviving floor. Restore rejects truncated encrypted streams and archive links; credentials are not published before authenticated archive completion. Actual compiled CLI rehearsal passed init -> encrypted backup -> restore -> same-identity reopen with private FD; receipt /tmp/oficina-provisioner-native-rehearsal/backup-restore.json explicitly scopes this to an empty synthetic registry. Full gate is running again. No Home command dispatch, enrollment, deployment, or live config change. Actual SQLite-open proof now has separate proposed design4770bc6 (Home41/task42), under Fable review; platform launch descriptor contract remains separately reviewed and unwired. Typed installation/evidence collectors and transport integration are still outstanding.

Approved opened-database connector implementation is committed at a6057b1 on feat-home-operator-core, still unmounted. Actual subprocess coverage includes main replacement/restore, symlinked ancestor and final file, ambiguous writable candidates, inherited OWRONLY/ORDWR, missing/hardlinked files, WAL replacement, SHM symlink, unlinked writable temporary file, deadline, reconnect, transaction locks and post-commit ambiguity. The actual operator Engine now executes and recovers an expired exact result through the connector without a second mutation.

Implementation clarification for whole-code review: boundary checks use nofollow directory traversal plus fstatat, without opening/closing regular files. A second descriptor close for the same SQLite inode releases POSIX locks. A test-only overlay restoring that approach let a competing process acquire BEGIN IMMEDIATE during the owner's transaction; the fixed connector requires SQLITE_BUSY. Failing control is preserved at /tmp/oficina-home-open-lock-control/result.txt. The initial read-only pin remains open until SQLite closes.

Focused subprocess tests and operator race tests pass; full make test for a6057b1 is running. Source call-graph audit finds the existing global SQLite hook only in the serving-path secure-delete setup; the eventual operator startup must bypass it and undergo whole-code review. The command launch contract and runtime dispatch remain unwired. Fable quota prevents new code review until the recorded reset; no approval inferred from quota failures.

Full make test completed successfully for a6057b1, including CGO-disabled builds, ordinary/privacy guards, Home/operator/native-provisioner/directory race tests, and shared handoff/roster race tests. Receipt: /tmp/oficina-operator-core-gate-a6057b1.log. Exact-branch remote CI is still running.

The compiled native Linux CLI also passed init, encrypted backup, restore into an empty directory, and reopen with the same registry identity at this SHA. Receipt: /tmp/oficina-provisioner-native-rehearsal/a6057b1-backup-restore.json. This is a synthetic empty-registry custody drill, not enrollment, Home maintenance execution or live team acceptance.

Exact remote Amadan CI now passed for a6057b12132ce352b925c1058bf72c51c32ac6da on feat-home-operator-core. Whole-code Fable review and actual launch integration remain outstanding; no merge, deployment, enrollment or seeding occurred.