amadan
Integrated fixed operator-v1 entrypoint is implemented locally, not deployed. Actual binary test successfully creates a credential owner and private receipt without serving/SMTP startup. Subprocess tests pass directory inspect/init/seed and exact replay, plaintext-at-rest checks, signature/material refusal before DB open, schema drift refusal inside transaction, and closed-output-pipe recovery without duplicate identity. Runtime now prepares existing additive role-specific operator schemas; shared ledger check refuses role contamination. Preserved signed InspectChallenge format with explicit directory.inspect config allowlist, instead of Fable draft's proposed envelope replacement. Fixed output semantics: partial pipe failure is unavailable, not an impossible promise of empty output; worker must discard nonzero/incomplete results. Broader race validation is running, then exact freeze for independent Fable review and full CI. No new deployment or live operator invocation.
Integrate the verified Home operator command open
On branch feat-operator-command
Complete the fixed operator-v1 command on top of verified launch/binding790208e, with role-specific protected configuration, existing person resolver and engine, exact opened-database schema checks, private bounded output only after checked closure, and fixed refusal/unavailable exits. Existing NewOperatorPersonResolver and atomic identity/privacy tests already implement identity resolution; reuse them unchanged. Fable is drafting an integration design against frozen source. No live invocation or authority inferred from helpers. Fable final review, exact CI and deployed native canary remain required before merge/live provisioning. Parent startup/binding reviews and refusals are in54/55. Copy review remains waived by Paul for this round.
Actual Fable claude-fable-5-1 APPROVE exact946a24ab82aa68c9d7bc2526770f8bc3deff29ee, no required fixes. Full local make test and exact Amadan CI passed. Review home-command-review/result.json and CI home-command-ci.json retained. Advisory followups: schema row budget before non-pilot, roster-public-only loading, stray-secret env alignment, inspect wrong-signer/mutation-wrapper subprocess gaps, query_only persistence (one operation per process today). Deploying only normal-serving/additive-schema preparation to existing Home preview channel from exact frozen reviewed source, CGO0 ARM64, explicit build946a24a. Go VCS stamping from nested worktree picked parent checkout462df84 despite correct source; rebuilt from frozen archive with -buildvcs=false and exact explicit BuildVersion to avoid false provenance. No operator material changes or live maintenance invocation. Whole native worker/checker/canary remains unproven; no merge claimed.
Canary refusal surfaced: credential Home946a24a served correctly; directory adopted946a24a but initial old process masked startup until scoped restart. Actual new directory logs: ERROR wire app err="home: invalid assertion configuration", then health failure. Rolled preview channel back and verified BOTH body+header eab0719 on both hosts. No operator invocation or data/key replacement. Candidate is not merged and this failed canary blocks it despite source approval/local+remote gates. New ordinary-serving exact-ledger check is the likely regression; reproducing historical additive ledger behavior, preserving strict exact schema checks for operator/checker. Will get Fable re-review of correction and repeat canary. All evidence home-preparation-deploy.log; source review remains946a24a only.
Corrected candidate c1f26bbd3f39be835d342bc9e1b3b3be438f631b: actual Fable claude-fable-5-1 APPROVE source/approach, full local make test and exact CI success observed. New regression fails946a24a and passesc1f26bb while strict operator ledger refusal remains. Correction restores existing serving tolerance for unrelated historical additive ledger entries; no weakening of operator/checker schema gate. Retrying normal-serving preparation canary, preserving both role configs, accounts, keys and data. Exact live directory foreign IDs remain unobserved; Fable explicitly requires adoption/diagnostic path before any live maintenance if present. No ready/merge/provisioning claim.