oficina / home Public

Candidate 382858f on feat-provisioner-state implements local installation-plan enrollment and immutable authorization state on the existing encrypted signed journal and independent floor. The prior a6057b1 candidate remains untouched and reviewable.

Public API: InstallationPlan, InstallationTarget, EnrollmentInfo and EnrollPlan. Native CLI provision enroll takes a bounded private --plan-fd separate from --password-fd. It returns state=local-plan and does not claim remote enrollment or owner approval. Internal enroll/prepare/markInFlight/transition APIs replay finalized signed events to derive current generation, independent credential/directory accepted heads, pending slots and exact saved requests/results. Preparing or recording an orphan result never advances a role. Ambiguity retains its slot; a refused outcome releases an unaccepted slot only after expiry. No CLI or completion adapter can manufacture accepted/stopped facts.

Exact signed request bytes are stored directly as encrypted payload. A valid 64KiB result is stored separately without JSON/base64 expansion; acceptance references its signed record digest. Journal recovery finalizes and persists the independent floor before any accepted head is derived. Typed result decoding uses the actual operator encoder, preserving its bytes rather than applying the native registry canonical encoding. State events preserve the timestamp checked by their transition validator so a second clock read cannot create an unreplayable event.

Focused tests pass: exact replay after expiry, changed-input refusal, independent role streams, no automatic replacement of ambiguity, expired refused-slot reuse, full 64KiB result, missing/tampered result reference, crash between result and acceptance at prepared/floor/finalized boundaries, older-registry refusal against the surviving floor, privacy scans, and actual native CLI/subprocess enrollment replay, process-lock exclusion and process death during signed preparation. Full make test is running at /tmp/oficina-provisioner-state-gate.log. No Fable invocation, merge, dispatch, deployment or live seeding occurred.

The compiled native CLI at 382858f passed private local-plan enrollment, exact replay, encrypted backup, restore and post-restore enrollment replay. Receipt: /tmp/oficina-provisioner-state-rehearsal/receipt.json. No remote authority is claimed.

The full gate hit SQLITE_FULL in Home race tests because shared /tmp tmpfs is 99% full (32GiB volume; root filesystem has about 2.8TiB free). Failed receipt is retained at /tmp/oficina-provisioner-state-gate.log. Root independently confirmed capacity, not inode exhaustion. No shared artifacts were deleted. The same immutable candidate is rerunning with task-owned TMPDIR=/home/paulca/.cache/oficina-provisioner-state-test-tmp; log gate.log there. This is not recorded as a passing gate until that run finishes. Remote CI is still running.

Same immutable 382858f0058c973ddabf5e0db838b6d30de0111d completed full make test successfully with the task-owned filesystem TMPDIR, including every race stage. Receipt: /home/paulca/.cache/oficina-provisioner-state-test-tmp/gate.log. Exact remote CI remains failed from shared /tmp capacity; that failure is preserved separately, not reported as green. Supported authenticated writer UI retry is https://amadan.net/oficina/home/-/ci/382858f0058c973ddabf5e0db838b6d30de0111d (its Re-run form). No empty commit or internal-token bypass will be used. Whole-code Fable review still awaits quota reset.

Parent approved continuing local preparation/resume on a separate branch after this gate. The current candidate remains frozen and reviewable; no dispatch, remote enrollment or completion adapter is enabled.