oficina / memoria Public

Initial dependency review REQUEST_CHANGES from canonical claude-fable-5-1, full verdict below. Runtime dependency itself verified correct; stale internal spec pin/CI-blocker prose fixed6a1e05b and obsolete duplicated code-comment paragraphs removed. AHEAD remains unmerged, no new wire-value claim. Full gate/review follow-up running; no merge/deploy.

Verdict: REQUEST_CHANGES, narrowly. The dependency change itself is correct and verified. What blocks is that the branch retires 60b01a8 and leaves six places in the repo saying it is still the pin, plus a stated reason for the AHEAD lag that the upstream merge has removed.

Verified on the fetched module, not the worktree

• The go.sum h1: line matches the module cache ziphash for v0.0.0-20260907203125-1ac4323a7317, and the cache .info records origin hash 1ac4323a7317a2bf…. The /go.mod hash is unchanged, so suite's own dependency set did not move.
• Diff between the two cached module versions: s1.go, s3.go, subject.go, fixtures.go, strictjson.go are byte-identical. s2.go gains pointer wire fields and the nil check. transport.go gains the scheme check ahead of the host guard. New: two test files, conformance/, and .amadan/ci.d/10-gate (gofmt, vet, build, test -count=1). Exported API is unchanged, so memoria compiles against it without edits, which the gate log confirms.
• The scheme check and the S2 nil check in the module match the source in the suite worktree line for line.

S2 fail-closed, from memoria's side

A row missing or null in any of item_id, revision, result now voids the whole response to UNKNOWN. Decide maps UNKNOWN to Withhold, which Notices() and renders as "did not answer; N results withheld". Nothing reaches OmitSilently. Previously a row with no revision decoded as revision 0 and could match an asked pair at revision 0 and answer VISIBLE. That was a real, if narrow, false-authorisation path and it is now closed. Memoria's Authorize has no error return, so no consumer branch changes shape.

HTTPS before dial, from memoria's side

LoadSiblings already refuses a non-https base at boot at config_siblings.go:108, so production never reaches the new check. NewForTest uses a plain client, so loopback tests are untouched. If it were reached, Feed and Content wrap it as "S1/S3 unreachable: sibling broke the contract" after bare() strips the URL, and Authorize returns all UNKNOWN. No log or error string carries content. No existing consumer leaked, and none is claimed to.

AHEAD lag still holds: the module has four constants, and TestAheadIsStillAShippingLag stays green as the gate log shows.

Required before merge (prose only, same commit):

1. docs/superpowers/specs/2026-09-03-memoria-design.md:16 and :1025 name 60b01a8 as the pinned module. Update to 1ac4323.
2. Lines 17-19 and 1031 of the same spec, sibling/policy.go:120, and sibling/policy_test.go:215 say the AHEAD branch is held because suite CI is unconfigured. The pinned commit carries .amadan/ci.d/10-gate and merged under it. The lag is now "AHEAD has not been merged upstream", not "CI is unconfigured". AGENTS.md's own rule applies: when you retire something, grep for it by name.

Non-blocking: nothing else. Do not deploy or promote past this until memoria's own CI, review record and canary are done, as you stated.

Dependency-only branch6a1e05b now explicitly APPROVE by canonical claude-fable-5-1; actual CI passed. Full verdict below. Fresh deployed-source comparison found substantial existing main work since production9b55ab8:59 files, including new sibling authorization/sync and circuit breaker. Root has started a separate complete release-diff review; dependency approval does not certify inherited main for deployment. Original owner constraints and existing key/data boundaries remain intact. No candidate or main promotion yet.

Verdict: APPROVE for 6a1e05b on fix/suite-contract-pin.

All required findings are closed.

• No occurrence of 60b01a8, "CI is unconfigured", or "CI being unconfigured" remains anywhere in the tree outside the retained old line in go.sum, which is expected and harmless.
• Spec line 16 now names 1ac4323 and describes what it carries. Lines 18-20 and 1032-1033 give the correct reason for the remaining lag: suite CI is configured and green, and the AHEAD branch is unmerged. Line 1026 states the pinned module still has four constants, which I verified against the cached module source on the first pass.
• The stale paragraph in policy.go is gone. policy_test.go no longer cites CI as the blocker. TestAheadIsStillAShippingLag is unchanged in substance and still exercises the module directly.
• go.mod and go.sum are byte-identical to the state I verified at 41cab05: same pseudo-version, same h1: hash matching the module cache ziphash, same unchanged suite /go.mod hash.

One cosmetic note, not blocking. The comment on aheadNotYetOnTheWire in policy.go still says the file "owes the paragraph above a deletion", and that paragraph is the one this commit deleted. The sentence now refers to nothing. Fix whenever the file is next touched.

No deploy or merge until memoria's own CI rerun, review record and canary complete, as you stated.

Private release review followup: docstrack now owns fix/suite-contract-pin at6a1e05b exclusively. Full release remains REQUESTCHANGES. Focused §4.1 route-coverage correction submitted to Fable before implementation: list and document snapshots must receive current typed-person rulings; manual sibling deletion has no authority from read permission. Reviewer chooses adversarial mutations independently. Test fixtures will ingest sibling ItemID and revision and retain local controls. No deployment or public disclosure. S1 ingest deadline, key-preserving safe rollback before sibling activation, inherited copy evidence, retention discrepancy and unreachable methods remain pending; upstream owner-side SSRF remains unfiled as directed.

Design review terminal result: quota failure, no approval, actual claude-fable-5-1 session34533dce-3ed6-451a-ba8c-a67a57c6f7c3, resets01:50 Europe/Dublin. Preserved exact prompt/result; no production implementation started. Authorized regression-only evidence now reproduces all three route gaps on current6a1e05b: index with and without query discloses sibling title under NOTVISIBLE/STALE/UNKNOWN; document route discloses title/heading/body without ruling; direct deletion redirects303 and actually removes stored sibling row and index entry (count2→1). Fixtures ingest real ItemID=sibling-item-route and SiblingRevision19; local document read/delete controls remain functional. These are synthetic local fixtures only, no production data. Test file internal/memoriatest/custodyroutes_test.go is intentionally red pending approved implementation; evidence /tmp/oficina-memoria-custody-fix/baseline-http.log. Other release findings remain pending.

Regression-only evidence committed and pushed privately as e4b178f on fix/suite-contract-pin. KNOWN RED: TestSiblingDocumentHTTPRequiresCustody fails list/full-document routes; TestSiblingDocumentHTTPManualDeleteHasNoAuthority fails because the stored sibling row/index actually disappear. This is deliberately not a release candidate or green branch. Positive control: all four disposition fixtures PASS through existing /search fragment (NOT_VISIBLE, STALE, UNKNOWN, VISIBLE), exact asker and ItemID/revision assertions hold, local read/delete controls remain functional. No implementation files changed. Design review had no verdict due quota; resume session34533dce-3ed6-451a-ba8c-a67a57c6f7c3 after reset with prompt/result in /tmp/oficina-memoria-custody-fix/. Full release re-review, mutation selections, S1 deadline, safe rollback and inherited copy evidence remain pending.

Draft custody implementation a012c8f committed/pushed privately on fix/suite-contract-pin. Root clarified review is required before approval/merge, and authorized draft code under existing §4.1; design is NOT approved. Exact AmadanCI passed. ReaderSummaries and ReadDocument rule exact typed asker+sealed sibling coordinate on stored snapshots; no newer chunks reopened after ruling. NOT_VISIBLE omitted/404; UNKNOWN/STALE/nil/unresolved loud via existing copy; malformed coordinates never local. Manual sibling deletion refused even with VISIBLE, guarded by SQL write lock before index removal; local/lone behavior preserved.

Six independently selected root mutations each red and restored: forced list inclusion disclosed title atHTTP200; ignored document ruling disclosed body; fresh chunk reload after blockedS2/concurrent ingest exposed unrulednewrevision; removed deletion predicate caused storedrow+index loss with303; malformed coordinate treatedlocal disclosed; sibling Delete affordance appeared while directguard remained. Logs /tmp/oficina-memoria-custody-fix/mutations.log and mutation-*.log. Failed-local-delete fixture confirms retainedDB/no livecitation; explicit Rebuild restores discoverability, preserving existing temporary index-gap limitation.

makeci, pureGo build, focusedHTTP race suite passed. Real browser320/1280 scripts on/off passed, existing notice styled, sibling rowhidden, local document link/delete controls intact. Drive fixture reuses existing content and blocks network. Testserver stopped. No productionactions. Existing aggregate corpus-count policy unchanged and flagged for Fable design assessment. Design/full-release reviews remain pending quota reset; S1 timeout remains separatehome_track branch; rollback, inherited copy evidence and other release findings still pending. Exact resume prompts and complete release/fixdiffs saved in /tmp/oficina-memoria-custody-fix/.

Combined Memoria release-review candidate is stable at ad41d91c3fa7b47354f51cb9d1b7b6d70b44fbe2, branch fix/stale-refetch, isolated worktree /home/paulca/amadan.net/oficina/memoria/.claude/worktrees/overnight-stale-refetch. Original custody/S1/empty branches preserved. Contains custody a012c8f, S1 budgets c449aae as80f813b, empty replacement465a74b asb22c65d, STALE refresh1365bcb and final test-strengthening ad41d91.

Actual CI passed on exact ad41d91. Combined makeci, pureGo build, and full internal/memoria + internal/memoriatest race suites passed. Earlier broad race run found inherited test strings.Builder read/write race; only test log capture now synchronizes and waits for final sync log. No production Notion logic changed.

STALE baseline reproduced through real S2 HTTP and reader handler: notice promised refetch but no S1 began. Draft starts one asynchronous S1 catch-up per source, using existing finite45s-per-request/2min-wholePoll budgets; S1 supplies opaque replacement19→73 before S3. Existing request remains withheld and next read requires new S2. Warm and repeated requests share one in-flight source poll. Six root-selected mutations red/restored: absent trigger; reader cancellation inherited; every ruling triggers; bypass join; completed entry retained; reader waits on poll. Warm-first cancellation also verified: withholding safe, cursor unchanged, next request retries. No notice strings changed or human-copy waiver inferred.

Review prompt /tmp/oficina-memoria-combined-review/review.txt; immutable SHA/CI /tmp/oficina-memoria-combined-review/candidate.json; full source delta against deployed9b55ab8 /tmp/oficina-memoria-combined-review/full-release.diff. Evidence and mutation logs in same private directory. Root serial Fable queue owns next review after reset. Design and full release remain UNAPPROVED; no merge/deploy. Rollback after sibling ingestion, inherited copy evidence, aggregate-count assessment, retention discrepancy, producer/reset limitations and remaining product rulings remain explicit in review prompt.

Root serial Fable queue now targets final4d2d84fc1daa46d0c26815eb23b1fc12e1a22966 on fix/eight-day-tally-retention (parent combinedad41d91 preserved). Includes custody, ingest budgets, empty replacement, STALE refetch, and eight-day retention repair. Exact final CI green; review prompt /tmp/oficina-memoria-combined-review/review-with-retention.txt and full-release-with-retention.diff cover entire delta from production9b55ab8. Scheduled timer starts 2026-09-08 01:51 Europe/Dublin after Docs and Home, requires exact clean HEAD. No approval/merge/deploy inference.

Copy remains separate and unshipped: six reader notices at http://docs-t1.tail5fd3ba.ts.net:43633 and ten owner source-health strings at http://docs-t1.tail5fd3ba.ts.net:39883. Actual Luna drafts and plain/humane passes saved under overnight-source-copy/writing; no appstrings changed. Owner status removes misleading no-check-since-wake claim (timestamp is durable), distinguishes missing baseline/current history and avoids asserting every possible document was tested when refusal anomaly fires. User has been given the URLs and explicit skill gate explanation. No result files yet. These reviews do not waive other inherited release constraints.