| index 0c30622..dbb6f7b 100644 |
| --- a/implementation/compatibility-checker/proposal.json |
| +++ b/implementation/compatibility-checker/proposal.json |
| @@ -1,6 +1,6 @@ |
| { |
| - "version": 2, |
| - "status": "UNAPPROVED amended design after Fable REQUEST CHANGES on2214be1; no runtime authority conferred", |
| + "version": 3, |
| + "status": "UNAPPROVED revision3 after Fable R2; all original blockers resolved, replication schema correction pending rereview", |
| "home_revision": "7e282e2a363b9cc90cd74dd97809e6613a699af8", |
| "audit": "audit.json", |
| "audit_sha256": "0625d33bb795c1cf415e1e213d8e572e65f8ae4ebcf71ab52adf264c076e8b60", |
| @@ -42,7 +42,7 @@ |
| "browser_assertion": "Exact Runtime.keys accepted set, current bound1..8; no active private signer.", |
| "roster": "Directory.keys exact accepted roster key set (1..8) plus runtime active roster signer only when mode=serve. Disabled means no active signer, not missing accepted provisioning pins." |
| }, |
| - "separation": "Preserve all NewCredential/NewDirectory checks. Command-authorizer, owner-seed, directory provisioning, browser assertion and roster role key bytes must be pairwise distinct across roles. Same roster key may be both active-sign and accepted-verify in that one role. Directory runtime active roster signer must appear in Directory.keys with same fingerprint and configured ID; credential active assertion must appear in its accepted set. These cross-runtime consistency checks are proposed additions needed for truthful complete facts.", |
| + "separation": "Preserve all NewCredential/NewDirectory checks. Command-authorizer, owner-seed, directory provisioning, browser assertion and roster role key bytes must be pairwise distinct across roles. Same roster key may be both active-sign and accepted-verify in that one role. Directory runtime active roster signer must appear in Directory.keys with same fingerprint and configured ID; credential active assertion must appear in its accepted set. These cross-runtime consistency checks are proposed additions needed for truthful complete facts. Distinctness means different key-family labels WITHIN one configured runtime, not different processes. Provisioner comparison must require credential browser_assertion active key among directory browser_assertion accepted keys and credential owner_seed active key equal directory owner_seed accepted key. Those intentional same-label cross-runtime equalities do not violate separation; their absence refuses integrated compatibility. No new global uniqueness rule across runtime roles.", |
| "key_id": "Report configured verification key IDs separately only if required by private result comparator; compare exact ID+bytes in expected config even when facts use fingerprint. Key IDs are not proof of public bytes.", |
| "source_of_operator_configuration": "Typed configuration shared with actual fixed operator adapter. Current code has constructors but no runtime loader for these pins; do not invent environment variables in collector. Command remains unavailable until the operator adapter and checker consume the same reviewed role configuration.", |
| "bounds": "At most8 keys per set, six fixed role labels, no arbitrary role names; result bound below still applies." |
| @@ -53,8 +53,8 @@ |
| "matrix": [ |
| { |
| "key": "HOME_DEK", |
| - "credential_database_proof": "Authenticate every existing signin_links.sealed_address with signin.address and every credential operator sealed result with operator.result/v1/<origin>/<operation>/<action>. Discard plaintext immediately; no echo or persistence. This proves those stored ciphertexts, not key history when none remain.", |
| - "directory_database_proof": "Authenticate every teams.sealed_name with directory.team-name/<id>, every directory operator sealed result with operator.result/v1/<origin>/<operation>/<action>, every oficina_handoff_pending.sealed_path with handoff.path.<stored secret_hash>, and every oficina_handoff_inbox.sealed_token with handoff.token.<stored handle_hash>. Read-only scan includes expired rows too; no sweep/Finish/Verify that consumes replay. Validate stored purpose/hash shape and bounded path representation using shared current fresh-prefix/SafePath rules; token decryption proves at-rest authentication, not current token validity or authority (expired tokens do not fail solely on expiry). Never emit plaintext or invoke handoff.Finish; discard per-row plaintext. Roster cursors and assertion intent are client-held, not persisted witnesses.", |
| + "credential_database_proof": "Authenticate every existing signin_links.sealed_address with signin.address and every credential operator sealed result with operator.result/v1/<origin>/<operation>/<action>. Discard plaintext immediately; no echo or persistence. This proves those stored ciphertexts, not key history when none remain. For operator sealed_result, rows contain no origin: derive the purpose origin from the corresponding stored operator_state.origin, first require equality with trusted expected origin. Missing/mismatched state with results present refuses; never derive origin from caller request or guess another origin until decryption works.", |
| + "directory_database_proof": "Authenticate every teams.sealed_name with directory.team-name/<id>, every directory operator sealed result with operator.result/v1/<origin>/<operation>/<action>, every oficina_handoff_pending.sealed_path with handoff.path.<stored secret_hash>, and every oficina_handoff_inbox.sealed_token with handoff.token.<stored handle_hash>. Read-only scan includes expired rows too; no sweep/Finish/Verify that consumes replay. Validate stored purpose/hash shape and bounded path representation using shared current fresh-prefix/SafePath rules; token decryption proves at-rest authentication, not current token validity or authority (expired tokens do not fail solely on expiry). Never emit plaintext or invoke handoff.Finish; discard per-row plaintext. Roster cursors and assertion intent are client-held, not persisted witnesses. For operator sealed_result, rows contain no origin: derive the purpose origin from the corresponding stored operator_state.origin, first require equality with trusted expected origin. Missing/mismatched state with results present refuses; never derive origin from caller request or guess another origin until decryption works.", |
| "required_even_if_ciphertexts_exist": "Exact trusted enrolled fingerprint equality. Missing ciphertexts do not allow omission. No newly sealed self-test blob counts as compatibility evidence." |
| }, |
| { |
| @@ -91,34 +91,47 @@ |
| "directory_set": "migrate.Merge(directorySchema, directorydata.OperatorSchema, operator.DirectorySchema) from selected release. directorySchema = sessions.Schema + oficina_handoff migrations + directorydata.Schema + directorydata.RosterSchema. Operator bindings namespace oficina_directory_operator_bindings; DirectorySchema namespace oficina_directory_operator with0001_operator,0002_owner_receipts,0003_operator_key_identity.", |
| "current_gap": "Runtime.Schema currently omits operator.CredentialSchema/operator.DirectorySchema and directorydata.OperatorSchema. Checker never fixes that. Separately reviewed additive deployment must install required sets before the checker can succeed.", |
| "ledger": "Use Set.All plus migrate.Checksum of exact embedded SQL. Read rastrillo_migrations through pinned connection; every expected ID and checksum must match and no extra ID is accepted. Go migrations, if introduced, require explicit release profile rather than empty-checksum inference. Never call Apply.", |
| - "structure": "Build expected normalized sqlite_schema/table/index/FK/trigger/view shape at build/test time by replaying exact reviewed migration sets into a scratch DB; freeze expected descriptor in release. Compare actual structure read-only, including constraints/index expressions/triggers/views; migrate.Read alone lacks complete CHECK/FK/trigger semantics and is insufficient. Normalize only SQLite-stable metadata/formatting defined by fixture generation, not SQL semantics through regex. Generated internal sqlite tables and ledger are explicitly included or excluded by fixed rule. Exact expected sqlite_schema SQL from the same migration execution is acceptable conservative first profile; harmless divergent DDL may refuse.", |
| - "credential_identity": "No directory/team/roster namespace; people refs and blind indexes retain their current shape. If operator_state exists, exact origin/installation/registry/device/key identity must match trusted enrollment and sequence/head/completion must match approved expected state constraints. Do not infer app identity from table names alone.", |
| - "directory_identity": "No people/signin/passkey credential namespace; exact operator origin/installation/registry/device/key identity when initialized; generation and existing owner/team memberships agree with trusted baseline expectations. Validate team sqid/label, purpose-bound name, bounded epochs, and existing registry/provisioning references using current pure validators. No new generation, team or owner creation.", |
| + "structure": "Build expected normalized sqlite_schema/table/index/FK/trigger/view shape at build/test time by replaying exact reviewed migration sets into a scratch DB; freeze expected descriptor in release. Compare actual structure read-only, including constraints/index expressions/triggers/views; migrate.Read alone lacks complete CHECK/FK/trigger semantics and is insufficient. Normalize only SQLite-stable metadata/formatting defined by fixture generation, not SQL semantics through regex. Generated internal sqlite tables and ledger are explicitly included or excluded by fixed rule. Exact expected sqlite_schema SQL from the same migration execution is acceptable conservative first profile; harmless divergent DDL may refuse. The frozen descriptor includes exactly the pinned replication-owned objects specified below, generated by executing their exact upstream DDL in the scratch build/test fixture; this does not create or repair objects on the real DB.", |
| + "credential_identity": "No directory/team/roster namespace; people refs and blind indexes retain their current shape. If operator_state exists, exact origin/installation/registry/device/key identity must match trusted enrollment and sequence/head/completion must match approved expected state constraints. Do not infer app identity from table names alone. The exact two replication-owned tables are shared infrastructure and explicitly allowed; they do not establish Home role identity.", |
| + "directory_identity": "No people/signin/passkey credential namespace; exact operator origin/installation/registry/device/key identity when initialized; generation and existing owner/team memberships agree with trusted baseline expectations. Validate team sqid/label, purpose-bound name, bounded epochs, and existing registry/provisioning references using current pure validators. No new generation, team or owner creation. The exact two replication-owned tables are shared infrastructure and explicitly allowed; they do not establish Home role identity.", |
| "empty_policy": "No default empty DB success. Missing file, empty schema, missing ledger or untrusted role binding always refuse. A schema-complete but authority-empty initial role is accepted ONLY with a separately enrolled explicit baseline profile binding exact DB identity, role/origins, required schema, expected absence of operator state/generation/teams/people and key fingerprints. This permits planned first initialization without inventing ownership, but that baseline profile must be reviewed/enrolled; a caller boolean or just current count=0 is insufficient. Initialized profile requires exact expected state presence and at least its enrolled durable identity witnesses; zero rows unexpectedly refuses.", |
| "bounded_scan": "Single read transaction over all compatibility-relevant rows; proposed deadline min(launch deadline,30seconds), at most100000 rows and64MiB authenticated ciphertext cumulatively, per-value bounds from schema. Exceeding limits returns unavailable, never success from sampling. Do not allocate plaintext corpus; scan/discard one value at a time. Larger deployments need separately reviewed limits. Main byte hashing has separate256MiB per-pass cap and shared30second invocation deadline; these limits are conservative refusal limits, not a completeness claim for larger deployments.", |
| - "concurrent_state": "No serving/replication writer is allowed during checker under platform fence/retained lease. Read snapshot is not a substitute for that ownership proof." |
| + "concurrent_state": "No serving/replication writer is allowed during checker under platform fence/retained lease. Read snapshot is not a substitute for that ownership proof.", |
| + "replication_owned_objects": { |
| + "profile": "Fixed benbjohnson/litestream v0.5.14 DB schema profile (also requires exact selected replication artifact compatibility; never infer from name prefix).", |
| + "ddl": [ |
| + "CREATE TABLE IF NOT EXISTS _litestream_seq (id INTEGER PRIMARY KEY, seq INTEGER);", |
| + "CREATE TABLE IF NOT EXISTS _litestream_lock (id INTEGER);" |
| + ], |
| + "required": "Both tables must exist after the required checkpoint handoff. Compare exact frozen SQLite structural/DDL descriptor generated by pinned driver replay of these statements. Reject extra columns, indexes, triggers, views, conflicting type or any other _litestream_* object. This is a fixed two-object admission rule, not a namespace wildcard. Neither table belongs in rastrillo_migrations; expected app migration ledger remains exact.", |
| + "contents": "_litestream_seq has zero or one row, and if present typeof(id)=integer,id=1,typeof(seq)=integer,1<=seq<=9223372036854775807. _litestream_lock must have zero rows. Query bounded LIMIT2 for seq and LIMIT1 for lock; refuse any row/value outside this shape. Checkpoint-written replication metadata is included in pre/post byte hash; checker never writes it.", |
| + "source": "github.com/benbjohnson/litestream@v0.5.14/db.go:1025-1034 fixed DDL;1395-1397 and2231 seq upsert; lock write transaction rolls back per source comment.", |
| + "compatibility": "A changed replication library schema requires reviewed profile update before using checker; no dynamic table learning or automatic whitelist expansion." |
| + } |
| }, |
| "database_opening": { |
| "decision": "A checker-only actual-descriptor connector using mode=ro&immutable=1 is proposed exclusively for a verified closed-checkpoint handoff. No generic readonly fallback or mutable operator change. Absent handoff proof refuses before database opening.", |
| - "explicit_upstream_amendment": "home-operator-open.md line21 fixes mutable operator DSN to mode=rw/default VFS. This revision REQUESTS a separately reviewed checker-only exception mode=ro&immutable=1; it does not amend the mutable operator connector or claim its existing approval covers this path. The previously proposed checker no-immutable rule is replaced only under the preconditions below.", |
| + "explicit_upstream_amendment": "home-operator-open.md line27 fixes mutable operator DSN to mode=rw/default VFS. This revision REQUESTS a separately reviewed checker-only exception mode=ro&immutable=1; it does not amend the mutable operator connector or claim its existing approval covers this path. The previously proposed checker no-immutable rule is replaced only under the preconditions below.", |
| "worker_order": [ |
| "Verify exact approved resume operation, exclusive operation execution and same primary/artifact/environment/DB identities. Install durable/local admission fence. Obtain checked old main+sidecar death, cgroup emptiness and old replication Close evidence BEFORE acquiring the maintenance Held lease.", |
| - "Under the same retained healthy Held lease and exclusive worker execution, invoke the existing reviewed Held.Checkpoint protocol: temporary replica store SyncAndWait then checked Close; final lease health check. No Release or second owner. All store/SQLite handles used by checkpoint must be closed. Failure or uncertain close refuses handoff.", |
| + "Under the same retained healthy Held lease and exclusive worker execution, invoke the separately proposed Held.Checkpoint protocol: temporary replica store SyncAndWait then checked Close; final lease health check. No Release or second owner. All store/SQLite handles used by checkpoint must be closed. Failure or uncertain close refuses handoff.", |
| "Checkpoint receipt alone does not prove filesystem state. Verify main exists, one link and exact pinned identity, and WAL/SHM/rollback-journal are ABSENT by nofollow relative inspection of pinned parent directory. Any sidecar including zero-length WAL/SHM refuses; never delete sidecars to make the check pass. Normal closed checkpoint is the supported positive state. If actual checkpoint leaves sidecars, remain fenced/unavailable until a separately reviewed preparation path exists.", |
| + "Run the platform non-serving integrity check against the exact closed DB under the same retained lease before the prelaunch byte-hash step; check/close its handle and recheck all sidecars absent afterward. Bind its fresh successful result into handoff evidence. This ordering is an explicit proposed refinement of maintenance-exec P1, not an assertion that an integrity receipt obtained only after the checker already exists. Failure or sidecar creation leaves handoff unavailable; no checker repair.", |
| "After closure and before checker launch, bind main length and SHA256 from an exact bounded scan to fresh attempt-specific private handoff evidence, alongside checkpoint receipt, old-writer/replica stop evidence, retained lease identity and current guard generation. Recheck absence/identity and healthy lease before dispatch.", |
| "Launch only the exact selected checker artifact under immutable protected environment and reviewed read-only data namespace. Verify fresh handoff evidence through the platform launch verifier. The checker cannot mint evidence from a path, env flag, lease timestamp or its own observation.", |
| "No writer, checkpoint, replication reopen, adoption or other checker may overlap this handoff interval. Worker retains lease/exclusive execution through checker closure, final evidence and resume transition. Any failure remains fenced. Existing ResumeFenced still owns subsequent compatible serving/replication handoff; checker never releases ownership." |
| ], |
| "executor_recovery": "A fresh lease, empty app cgroup or RecoverClaim alone does not prove an earlier maintenance executor is dead. Paused workerA could later checkpoint/reopen/publish while B checks immutable state. Takeover unavailable unless independently reviewed exclusive operation execution and predecessor executor quiescence/death/exclusion proof hold. No automatic timeout-based recovery or reuse of old handoff receipt.", |
| - "identity": "Retain existing nofollow ancestor walk, pinned parent and one-hardlink main device/inode, actual driver-open descriptor inventory, checks before/after every query/row and close. Expected driver main descriptor must be O_RDONLY and match the retained main identity. URI built by code with only fixed mode=ro,immutable=1,defaultVFS; no caller query params/hooks/extensions. Refuse O_RDWR/O_WRONLY, extra database, unexpected file descriptor, reconnect overlap, changed path or unlinked main. Immutable is safe only because separately proved ownership excludes ALL writers; it is not evidence that no writers exist.", |
| - "os_boundary": "OS-readonly main and data namespace, including parent directory, are mandatory in addition to immutable mode. No writable regular inherited descriptors, application globals or SQLite hooks. App stdout is private anonymous pipe. This restricts this checker only; exclusion of other processes comes from verified fence/lease/executor protocol, never the mount alone.", |
| + "identity": "Retain existing nofollow ancestor walk, pinned parent and one-hardlink main device/inode, actual driver-open descriptor inventory, checks before/after every query/row and close. Expected driver main descriptor must be O_RDONLY and match the retained main identity. URI built by code with only fixed mode=ro,immutable=1,defaultVFS; no caller query params/hooks/extensions. Refuse O_RDWR/O_WRONLY, extra database, unexpected file descriptor, reconnect overlap, changed path or unlinked main. Immutable is safe only because separately proved ownership excludes ALL writers; it is not evidence that no writers exist. After pin acquisition and before driver open, freeze FD baseline. Require exactly ONE new O_RDONLY descriptor matching main device/inode in post-open FD delta; retained pin is already in baseline and cannot satisfy this test. Refuse no delta, multiple matching new FDs, writable/unlinked/temp regular descriptors or loss/reuse of a baseline FD. Apply same identity/descriptor checks across operation lifetime. Do not reuse mutable connector writable-only classification.", |
| + "os_boundary": "OS-readonly main and data namespace, including parent directory, are mandatory in addition to immutable mode. No writable regular inherited descriptors, application globals or SQLite hooks. App stdout is private anonymous pipe. This restricts this checker only; exclusion of other processes comes from verified fence/lease/executor protocol, never the mount alone. Before any query that may spill, apply only fixed connection-local PRAGMA temp_store=MEMORY and read it back. No request-controlled pragma, temp file, persistent journal or global SQLite hook. Memory remains bounded by platform tier and scan limits; allocation/limit failure refuses rather than spilling to disk.", |
| "wal_shm": "Require WAL, SHM and rollback journal absent throughout before/during/after open; their appearance is refusal even if zero bytes. No SHM is opened or written, so there are no reader read-marks to classify as allowed changes. No sidecar creation/deletion, recovery, checkpoint, journal mode changes or writer repair in checker. Do not admit hot WAL or manufacture absent-sidecar state by removing files.", |
| "byte_evidence": "Max main size256MiB, positive file length; bound exact each-pass byte count before reading and recheck EOF/length. SHA256 before SQLite open and after successful SQLite close, each at most256MiB, plus identity/size/sidecar absence checks. Worker prelaunch hash is also max256MiB; total required hash IO across worker+checker is at most768MiB. Use fixed64KiB streaming buffers, never os.ReadFile or full-file allocation. No stat-only equality claim: device/inode/size detect identity, cryptographic byte equality detects content.", |
| "descriptor_lifetime": "Checker acquires and retains read-only pinned main descriptor before driver construction; prehash via that descriptor before SQL open and posthash via the SAME descriptor only after all SQLite connections close. Never open/close a second main-file descriptor while SQLite locks may exist. Use ReadAt/Seek on retained descriptor rather than reopening path. Keep it until hash/identity/sidecar checks finish. Close failure, partial scan, unexpected EOF/growth, deadline or mismatch prevents success. Worker independent observer holds its own stable descriptor and closes outside any local SQLite active connection.", |
| "deadline": "Entire invocation including both checker hashes and SQL scan is bounded by min(verified launch deadline,30seconds) and conservative retained-lease deadline. Check context between64KiB reads; blocking kernel IO is supervised by platform containment/deadline and failure cannot be reported as checked stop. No success emitted if cleanup/posthash cannot finish within deadline. Larger/slower DB refuses, never sampling or extending lease authority.", |
| "postcondition": "Before emitting any success bytes, verify driver close succeeded, exact pre/post main hashes match the fresh worker handoff hash, identity/size still match and all three sidecars remain absent. Worker accepts result only for exact live attempt with retained healthy lease and exclusive ownership, and independently rechecks identity/absence before resume. A hash is byte evidence under the no-writer protocol, not proof against a hostile trusted worker that changes and restores bytes.", |
| "actual_driver_gate": "Required empirical positive: exact pinned modernc/native Linux, WAL-mode header but cleanly checkpointed/closed main with no sidecars, actual mode=ro&immutable=1 O_RDONLY inode descriptor, byte preservation and no sidecar creation. Negative: current mode=rw+query_only housekeeping probe, missing handoff, hot/empty WAL, SHM, journal, stale lease/worker, inode replacement and >256MiB all refuse. No VFS/unsafe introspection/dependency fork; failure means unsupported, not fallback.", |
| - "root_probe": "Historical probe/observation.json demonstrates current mutable connector changes main/removes WAL+SHM despite only SELECT/query_only. It remains a negative control; it does not prove the proposed immutable connector or worker handoff exists." |
| + "root_probe": "Historical probe/observation.json demonstrates current mutable connector changes main/removes WAL+SHM despite only SELECT/query_only. It remains a negative control; it does not prove the proposed immutable connector or worker handoff exists.", |
| + "approval_provenance": "maintenance-exec.md P1 names the desired retained-lease checkpoint/stop protocol, but its file retains pending-approval status text. Treat those dependencies as separately proposed/reviewed artifacts whose exact approval and implementation receipts must be verified at integration. Neither this checker design nor references to parent work approve or supply checkpoint/launch/executor capability. Explicit immutable exception and integrity-before-hash ordering are requests for this dependency contract." |
| }, |
| "launch_and_result": { |
| "required_input_binding": "Verified platform launch pins request/attempt/guard generation, account/app/primary host, selected immutable executable digest, immutable config snapshot binding, existing DB device/inode, role/origin and enrolled expected-state digest. Exact fields/API come from reviewed launch contract; application cannot self-authorize or accept raw env equivalents. Additionally require fresh verified closed-checkpoint handoff evidence binding main identity/length/SHA256, absent WAL/SHM/journal, old writer/replica stop proof and same retained lease/exclusive executor. Evidence format belongs to reviewed platform launch adapter; this checker design requests required semantics, not a new self-signed authorization.", |
| @@ -165,7 +178,10 @@ |
| "Interleave paused previous executorA with attempted fresh takeoverB: B cannot launch even with empty app cgroup/new lease until A is independently excluded. Interleave rogue reopen between checkpoint/launch: guard/executor enforcement prevents it, not hash timing alone.", |
| "Handoff rows: wrong key, purpose or moved ciphertext refuses; legitimate expired token still decrypts without mint/consume/sweep; raw DB/session/replay/authority rows unchanged.", |
| "Main256MiB exact-bound scans, over-bound refusal, short read, file growth, same-size mutation, inode swap, close/posthash failure and deadline cancellation all prevent any success bytes. Demonstrate no second main-descriptor open/close while SQL active.", |
| - "Remove immutable restriction-to-verified-handoff, sidecar absence, final byte comparison or handoff ciphertext checks in meaningful mutations: each must be killed." |
| + "Remove immutable restriction-to-verified-handoff, sidecar absence, final byte comparison or handoff ciphertext checks in meaningful mutations: each must be killed.", |
| + "Actual replicated synthetic Home fixture after pinned Litestream open/checkpoint/close passes exact2-table profile; application ledger remains unchanged and no repair writes occur. Missing table, extra prefix object, added trigger/index, seq id!=1/NULL/noninteger/out-of-range/second row and nonempty lock all refuse.", |
| + "Mutations skipping replication row checks, excluding replication metadata from byte hashes, accepting retained pin as driver FD, omitting temp_store=MEMORY, or allowing wrong cross-runtime expected key equality must fail tests.", |
| + "Platform integrity must complete and close before hash/handoff. A stale/after-checker integrity receipt cannot satisfy prelaunch requirement." |
| ], |
| "unresolved_review_dependencies": [ |
| "Checker-only exception to approved mutable operator mode=rw contract, reviewed immutable readonly descriptor connector and verified closed-checkpoint launch evidence are required. No existing Checkpoint receipt alone asserts absent sidecars or exclusive predecessor executor death; integrations must implement and prove those facts. Unsupported state remains unavailable.", |
| @@ -400,5 +416,5 @@ |
| "sha256": "6ab9ea1dd6c63916f8d1984cf4a7c3a7cdf05e4705e807a34c58f7da5e537824" |
| } |
| ], |
| - "review_note": "Revision2 addresses Fable2214be1 findings; all changed semantics await explicit rereview. Closed-checkpoint and immutable exception are proposed dependencies, not claimed current platform/runtime authority." |
| + "review_note": "R3 resolves concrete replication-owned schema blocker and clarifies R2 nonblocking findings. No runtime implementation or dependency approval inferred." |
| } |
amadan