| 1 | { |
| 2 | "status": "Implemented for review; no deploy, merge or live invocation", |
| 3 | "parents": [ |
| 4 | "startup6289db0", |
| 5 | "binding790208e", |
| 6 | "seed898fe219", |
| 7 | "opened database4770bc6" |
| 8 | ], |
| 9 | "command": "home operator-v1 --db <existing absolute path>, dispatched before framework serving startup; fixed exit0/2/3; panic maps to3 without printing", |
| 10 | "material": "Closed HOME_OPERATOR_MATERIAL JSON (or existing mutually exclusive _BASE64), maximum16384 bytes. Required version1, role matching HOME_ROLE and pinned command scope, independently provisioned nonzero canonical32-byte std-base64 mac_key. Credential additionally requires owner_seed_key family keypair. Directory additionally requires owner_seed_public canonical rawurl P256 public, provisioning_key family keypair, 1-8 roster_keys with exact derived IDs. Unknown, missing, duplicate and cross-role fields refuse.", |
| 11 | "reuse": "Existing HOME_DEK, HOME_PEPPER credential only, assertion key/public-key map, directory roster runtime and shared family decoder. No SMTP, sign-in session, preview-origin loading, key generation or migration on command path. Existing NewOperatorPersonResolver and compiled canonical directory policy unchanged.", |
| 12 | "key_separation": "MAC distinct from DEK and credential pepper. Pairwise public-key separation across authorizer/owner/provisioner/browser/roster roles before opening DB. Current roster serving key must be in provisioning roster-key set.", |
| 13 | "binding": "Protected role/origin and signing-key separation checked before private startup/signature/database binding. Database exposed only to existing engine built on actual verified connector. Final closure precedes opaque private result release.", |
| 14 | "schema": "Reuse checker exact schema, ledger checksums and foreign-key/replication shape on the same connection inside BEGIN IMMEDIATE before mutation or replay. Ordinary serving boot applies existing additive role-specific operator migrations through existing migrate.Apply validation; it preserves prior tolerance for unrelated historical ledger entries. Exact set equality is mandatory only for operator/checker, so ordinary serving is not blocked by legacy additive migrations. Legacy role schema unchanged. No command migrations.", |
| 15 | "inspection": "Preserve existing InspectChallenge and signature context. Explicit directory.inspect action pin permits verified read-only challenge after mutation-wrapper verification fails; both parsers validate distinct signed contexts and complete closed shapes. No unverified fallback. Existing Directory.Inspect then checks schema inside its transaction with query_only=ON. It writes no operator result/state rows. A signed mutation wrapper claiming directory.inspect reaches existing mutation dispatch and refuses.", |
| 16 | "output": "Require fixed fd1 write-only FIFO before DB open. Opaque result can write only to fd1 after successful checked DB closure, bounded by copied launch deadline and caller cancellation. Nonblocking writes handle backpressure; output/close/expiry errors return3. Partial bytes may exist only in dedicated private pipe and are not a successful result; worker must discard incomplete/nonzero-exit output. No empty-stdout claim after a partial pipe failure.", |
| 17 | "review_changes_from_fable_draft": "Kept existing inspection wire instead of replacing its protocol; no breaking NewEngine signature. Private schema callback is set only by RunCommand. Used full schema verification rather than ledger-only. Corrected impossible empty-stdout guarantee after partial output failure. Explicitly validate stdout pipe and honor launch deadline during publication.", |
| 18 | "remaining": [ |
| 19 | "Expanded integrated role/key/schema/refusal/output tests and actual binary dispatch", |
| 20 | "Fable review of final implementation and config alignment", |
| 21 | "Full local and exact CI gates", |
| 22 | "Native platform worker authentication, owner workflow and checkpoint/resume integration", |
| 23 | "Deployed canary review before merge; concrete approved live maintenance request before provisioning" |
| 24 | ], |
| 25 | "canary_failure": "946a24a credential preview succeeded; directory failed at wire-app startup and both previews rolled back to verifiedeab0719. New ordinary-serving exact ledger gate suspected; test reproduces historical additive ledger refusal. Remove that new gate while keeping strict operator/checker gate; no changes to live keys/data or destructive migration. Re-review and canary required." |
| 26 | } |
| 27 | |
amadan