oficina / suite Public

Record roster transport gap and approved provisioning implementation

Paul Campbell pushed by paul@keymail.dev 1 month ago c8ef1d43e4ef7760cbc7140d9afa542485b6aed4 parent ad6790d

1 file changed, +9 −0

implementation/overnight-2026-09-07.md +9 −0

No CI script — run details

CI log

amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile

diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md

index 82b1b1e..aa6835f 100644

--- a/implementation/overnight-2026-09-07.md

+++ b/implementation/overnight-2026-09-07.md

@@ -814,3 +814,12 @@ Home consumer manifest was changed only in credential environment overnight-home

- Narrow local SQLite proof /tmp/oficina-maintenance-vacuum-proof/results.json uses the same modernc.org/sqlite v1.55.0 as Docs87662f5 and its checkpoint/VACUUM/checkpoint SQL sequence: retained device/inode/10 rows, integrity ok, file4.6MB ->57KB. Not full Docs command, crash, restore or deployed-fence evidence. Added to pending reviewer context without changing source.

- Home HTTP/signing design5fbfdf0 approved; author continues implementation from mechanical stack4b0048a with new roster pin, serving remains disabled live. Home operator combined core/companion design898fe21 pending reset/review: local native Linux encrypted registry plus independent signed floor, actual trusted fresh-owner baseline attestation, concrete evidence collectors and no unsupported config revision claims. Typed external proof cannot be fabricated from a platform receipt string; actual maintenance environment binding/app checker and current alias State=live/TLS/version are required.

- Provisioning design found an activation cycle: pending instances need actual roster standing to test TeamMode, but producer currently serves only live instances. A proposed audited exact-consumer preflight window (immutable600s plus residual60s cached lease ceiling, no retry extension, no chooser visibility, retained history) requires explicit review/schema amendment; it grants real temporary app standing and is not described as a harmless read-only exception. Agents coordinate this contract. No temporary relaxation or live bootstrap has been implemented.

+## Home HTTP verification and provisioning implementation — 2026-09-08

+- Home HTTP candidate fd1194da0e0843be60690310b2fad149a65bae63 is frozen on feat-roster-http with full gate/race and actual exact-SHA CI green. Actual archived171/newfd119/new-old-new compatibility passed at /tmp/oficina-roster-http-compat: directory and populated roster row digests, sessions, chooser, pending/inbox handoffs and replay refusals preserved. Whole-code Fable review remains active; no approval inferred. Root prebuilt /tmp/oficina-roster-http-release/home-arm64 but did not deploy it.

+- Root found an edge contract gap: roster_http.go supplies only Cache-Control:no-store while the approved HTTP design promises uncompressed responses regardless of Accept-Encoding. Actual platform internal/edge/compress.go compresses eligible large JSON unless no-transform is present. Author owns the roster-only no-store,no-transform correction, updated header assertions and actual archived platform compressor proof after frozen review terminates. Candidate must be re-reviewed/rebuilt before deployment. Root prepared unsigned GET/HEAD real-edge checker /tmp/oficina-roster-http-release/check_disabled_roster.py; old171 negative control correctly failed on absent/roster404. This is no positive signed-feed evidence.

+- Home operator/provisioner combined design898fe219f4da5092b2cc28210b344ede6a478e50 received explicit configured Fable APPROVE, end_turn/exit0 at /tmp/oficina-home-operator-design-review-r3/verdict.txt. Approval annotation tip3945a343a7e82c2850279e67fde0093ca6e1effe pushed; Home37/task36Done. Agent docs_link_store proceeds with approved core implementation; temporary pending-consumer standing remains a separate unapproved producer amendment. Additive verify/activate audit tables preserve the existing CHECK enum; seed privacy gate and pinned Sqids vectors are implementation requirements. No operator command or team provisioned live.

+- Platform maintenance R2 ended permission_denied after outside-directory SDK inspection, with no verdict despite exit0. R3 uses identical frozen0c59 git-archive source under /tmp/oficina-maintenance-design-review/r3-source, exact SDK DeleteObject source, infra2599130 and synthetic VACUUM receipts copied within its allowed directory. Same configured Fable5/plan permissions, no bypass. Active service oficina-maintenance-design-review-r3-20260908; r3-review.ndjson/r3-exit.json are authoritative. No maintenance implementation. Source-consumer-inventory.json records overinclusive24 record mutation,39 raw-delete,168 decode and20 replica-lifecycle callsites; it is preparation, not proof the inventory is closed.

+- Docs checkpointdd1f126 adds unified permission scope, transactional write/commit guards, buffered response guards and TeamMode status handling; full local gate passed, remains unmounted. Actual SQLite queue revocation and post-insert expiry rollback tests pass; removing final guard is killed. Stream implementation found legacy Rastrillo Sessions.From has uncancellable QueryRow. Consumer agent now implements canonical Sessions.FromContext in isolated framework feat-session-context (discussion23/task22), preserving old API. Focused tests/race and actual writer-blocked cancellation/deadline proof pass; QueryRowContext-to-QueryRow mutation is killed, full framework make ci running. Docs will use one private direct struct conversion over canonical validation, with legacy-reader parity, not copy session parsing. Publication/focused Fable and whole Docs review still required.

+- Live previews remain Home171, Docs1e and Sheets20c; production aliases unchanged. Current supported Home route listing confirms exact overnight-home/overnight-directory environments and ready/Asleep, which is not proof of the proposed maintenance preflight capability. No new deployment this phase. Next stage remains corrected Home HTTP with serving disabled, exact body/header/transport/browser verification and independent canary review, while approved operator and Docs runtime work proceeds.