amadan
Record exact Fable approval and open-proof implementation obligations
1 file changed,
+8
−1
implementation/home-operator-open.md+8 −1
diff --git a/implementation/home-operator-open.md b/implementation/home-operator-open.md| index 73e1446..1a12766 100644 |
| --- a/implementation/home-operator-open.md |
| +++ b/implementation/home-operator-open.md |
| @@ -1,6 +1,6 @@ |
| # Proving the Home operator's opened database |
| -Status: proposed design amendment; no command dispatch is enabled. Parent contracts: approved home-operator-seed.md and home-provisioner.md at898fe219, approval recorded3945a34; pending-window amendment42529b5 approved and recorded806c4ad. Platform's separately reviewed launch supplement is proposed4605a54, implementation/maintenance-launch.md. This amendment resolves only the native Linux SQLite identity check. It does not claim a maintenance fence, worker implementation, or live operator proof. |
| +Status: exact design4770bc6 APPROVED by Claude Fable5 (claude-fable-5), explicit verdict with no blockers, stopReason=end_turn and process exit0. Receipt: /tmp/oficina-home-open-design-review/verdict.txt; model-metadata.json and exit.json preserve provenance. This annotation does not approve code, command dispatch or the later platform fd4 delta. Parent contracts: approved home-operator-seed.md and home-provisioner.md at898fe219, approval recorded3945a34; pending-window amendment42529b5 approved and recorded806c4ad. Platform's separately reviewed launch supplement is proposed4605a54, implementation/maintenance-launch.md. This amendment resolves only the native Linux SQLite identity check. It does not claim a maintenance fence, worker implementation, or live operator proof. |
| ## Why the pathname is insufficient |
| @@ -50,3 +50,10 @@ A path or descriptor check is not a lease extension. The worker's independent su |
| - Extend the existing privacy gate: private stdin, context digest and owner material stay out of errors/logs; current role migrations and canonical origins still apply. Run full make/CI and Fable whole worker plus consumer review. The eventual real canary must demonstrate cgroup/lease/fence behavior separately. |
| Approval of this amendment allows implementing and testing the connector. It does not authorize mounting the Home command before the concrete worker launch contract, private configuration schema and whole-code review are complete. |
| + |
| + |
| +## Recorded review obligations |
| + |
| +Fable's nonblocking implementation notes remain acceptance requirements: audit package-global registration as well as the dedicated Driver receiver; verify exact nofollow one-link WAL/SHM siblings; prove mode=rw suppresses the driver's hardwired CREATE flag; refuse unlinked temp descriptors and an unexpected temp database; fail closed on reconnect baseline overlap; and classify O_WRONLY as writable in addition to O_RDWR. The source audit after review confirms modernc vtab.go registerModules reads global d.modules. The serving-path secure-delete registration must not be mistaken for proof of a clean operator startup; the eventual command call graph and package initializers require review. |
| + |
| +Platform proposed caf47fb adds a read-only artifact fd4 and self-executable binding after this frozen review. Its delta did not obtain a verdict before provider quota exhaustion. That layout needs explicit alignment before dispatch; this document's4770bc6 approval is not approval of a silently modified launch contract. Further Fable review attempts wait for the provider reset without model substitution or extra credits. |