oficina / home Public

Candidate caa16b5 is pushed on feat-provisioner-prepare, based on frozen382858f. CLI provision prepare accepts a closed OperationPlan on private --plan-fd and writes its exact saved signed Home request to --request-fd. Standard output contains only PreparationInfo with state=local-request. It never marks in-flight, approves an owner, dispatches or advances an accepted head.

The request descriptor must be an anonymous write pipe, distinct by actual device/inode from stdin/stdout/stderr and the plan/password descriptors. Regular files, sockets, named pipes, read ends and descriptor aliases are refused before unlocking. The validated handle is an internal opaque type. Private output failure returns a fixed error without public success metadata; the already durable request remains prepared and exact retries return the original bytes.

Supported types are initialize, owner-seed, seed-team and provision-consumer. Public owner-seed requires existing_only=true, matching the approved synthetic pilot; sealed queue ingestion is not implemented. Verification-window and activation preparation are refused until checked records/evidence can be assembled by their coordinator. No CLI fields can stand in for collected evidence or worker completion.

Focused actual native subprocess tests pass: stdout/stderr/stdin/input aliases and unsafe output types; broken-pipe recovery; exact cross-process replay; wrong role/installation; 64KiB local-plan boundary and oversized refusal; output bounds/short writes; unknown/duplicate fields; no standard-stream private request; and no in-flight/accepted movement. Full make test is running with a private filesystem TMPDIR at /home/paulca/.cache/oficina-provisioner-prepare-test-tmp/gate.log. Exact CI is newly triggered. No Fable invocation, merge or deployment.

Root code audit found a real gap in caa16b5: prepareRequest accepted context but a non-draining private pipe could block indefinitely while holding the journal lock. The old full gate and exact CI had passed; they did not cover that condition and are preserved as pre-fix evidence, not approval of the correction.

Correction 7e282e2 makes the owned anonymous output descriptor nonblocking/pollable before constructing its File, then interrupts its write by closing it on cancellation or a 30-second output timeout. Fixed errors and exact saved-request recovery remain. Real full-pipe tests pass both for the output writer and through prepareRequest: observe the finalized request, cancel blocked output, reacquire the registry lock and verify the same request with no accepted-head movement. A test-only overlay reconnecting the legacy cancellation-ignoring call is running as a negative control. Corrected full make test and exact CI are running; local log gate-output-context.log under /home/paulca/.cache/oficina-provisioner-prepare-test-tmp. No dispatch or review substitution.

Corrected candidate 7e282e2a363b9cc90cd74dd97809e6613a699af8 is clean and pushed. Full make test passed, including all race stages; exact remote Amadan CI passed for this SHA. Local receipt: /home/paulca/.cache/oficina-provisioner-prepare-test-tmp/gate-output-context.log.

Compiled native CLI rehearsal at the same SHA passed private preparation, broken-output recovery, exact replay, encrypted backup/restore and exact replay after restore. Receipt: rehearsal/receipt-7e282e2.json beneath that directory; no private request/password retained. The cancellation negative-control overlay fails at prepareRequest ignored cancellation, proving the new integrated full-pipe test catches the audited defect; cancellation-control/result.txt retains it.

No Fable review invocation, merge, remote enrollment, owner approval, in-flight marking, dispatch or deployment occurred. The prior382858f CI failure caused by shared /tmp capacity remains recorded on Home42; it is not relabeled as a successful rerun. Whole-code review and the real authenticated maintenance outcome/collector integration remain required before activation.

Paul reports Fable availability and requests queued reviews. Whole Home operator/provisioner candidate7e282e2 independent subscription review is now running via installed Claude CLI, requested claude-fable-5-1, readonly Read/Glob/Grep, max50. Exact source and baseline archives/full diff/prompt in /home/paulca/.cache/oficina-fable-resumed/home; unified exec69464. No verdict yet. This differs from Command Code, which still returned weekly quota with no verdict; no retry of that provider. Final actual model and verdict will be recorded here. Copy review waived; runtime dispatch and deployment remain incomplete.

Fable 5.1 requested changes on 7e282e2: stale head.tmp prevents next-operation self-healing. Isolated fix branch reproduces process death after scratch create before rename; baseline regression fails at next append. Fix retains signed immutable authority and private no-follow validation; stale scratch unlink uses retained directory and checked sync before exclusive recreate. Full gate and race underway. No merge or deployment.

Independent subscription reviewer claude-fable-5-1 (actual modelUsage, exit 0, is_error false) APPROVE exact f20f83e627cae1572fdf1c8b03b089617f7f0d9a. Original blocking stale marker finding resolved; no findings above low. Private scratch validation, retained-directory unlink/sync/exclusive recreate, signed chain invariants and process-death negative/positive evidence reviewed. Original low backup.snapshot cleanup and stale approval prose remain deferred; untracked synthetic test residue noted. Full gate and exact CI still running; not merged/deployed. Evidence /home/paulca/.cache/oficina-home-floor-fix/review.json.

Final Home f20f83e627cae1572fdf1c8b03b089617f7f0d9a validation: full make test exit 0, including provisioner race 283.939s and all other required race modules. Exact remote CI success at same SHA (all five steps passed). Five repeated crash-boundary race tests pass; pre-fix compiled negative fails marker-created next operation. Fable 5.1 APPROVE exact final branch, no findings above low; worktree clean. Task47 bounded fix/review complete. No merge/deploy; root owns merge queue. Evidence /home/paulca/.cache/oficina-home-floor-fix/candidate.json and review.json.

Fable-approved f20f83e floor scratch crash-recovery correction merged through Amadan as main302e6e3f1d517996153e6ee1ee693691e1c5f0d0. Exact candidate CI and full local race gate passed; merged-main CI queued at verification. Foundation only: no Home deployment, worker mount, team provisioning or live state operation. Receipt: /home/paulca/.cache/oficina-home-floor-fix.

Post-merge verification: Home main302e6e3f1d517996153e6ee1ee693691e1c5f0d0 exact CI success confirmed. Receipt /home/paulca/.cache/oficina-home-floor-fix/main-ci.json; candidate updated. No deployment.