OneSay Platform
Changelog
Private local M1 candidate. Hosting and external acceptance remain open.
2026-10-22 — Agent realtime binding is a configuration switch; agent-policy-config dry run reads back
The Agent Worker accepts two realtime bindings, selected by the model-policy stage and the deployment binding: onesay-qwen-realtime 1.0.0 with qwen-audio-3.1-realtime-plus on a workspace host https://ws-<id>.<region>.maas.aliyuncs.com/api-ws/v1/realtime (ap-southeast-1 by default, cn-beijing, cn-hongkong), or the official livekit-plugins-openai 1.8.2 with gpt-realtime-2025-08-28 on https://api.openai.com/v1; see the switch table in deploy/agent-worker (../../deploy/agent-worker/README.md). cmd/agent-policy-config dry run now connects to the target database, performs the writes in its transaction, prints the read-back and rolls back; apply prints the same read-back after commit, and both report target_environment and production_override. Development and Staging targets follow the Worker database rule (numeric loopback with sslmode=disable, otherwise verify-full). No public API, SDK or event change.
2026-10-22 — The RTC Agent realtime voice uses the Qwen-Audio realtime model
The Agent Worker's realtime stage now binds qwen-audio-3.1-realtime-plus (policy plugin onesay-qwen-realtime 1.0.0) through an in-package adapter that implements the official LiveKit Agents 1.8.2 RealtimeModel interface; the official OpenAI realtime binding is gone and the OpenAI pipeline stays for development only. The deployment binding endpoint is the workspace host https://{workspace}.ap-southeast-1.maas.aliyuncs.com/api-ws/v1/realtime (Singapore, Staging) or the cn-beijing host, with a matching data_region and one of the documented voices; see deploy/agent-worker (../../deploy/agent-worker/README.md). cmd/agent-policy-config accepts the realtime policy and a staging target (sslmode=verify-full); its private target gains the required key production_authorization_record (empty outside Production; Production stays refused). No public API, SDK or event change. See GX07_AGENT_QWEN_REALTIME_BINDING.md (../architecture/GX07_AGENT_QWEN_REALTIME_BINDING.md).
2026-10-22 — Task speech defaults to the Qwen-Audio streaming model
The Task Worker's live speech adapter now defaults to the Alibaba Cloud Model Studio model qwen-audio-3.1-asr-flash-streaming on its workspace-scoped endpoint wss://ws-<id>.<region>.maas.aliyuncs.com/api-ws/v1/inference: Singapore ap-southeast-1 by default (Staging), cn-beijing or cn-hongkong, the only hosts it may dial. The general dashscope.aliyuncs.com and dashscope-intl.aliyuncs.com domains are no longer accepted. The private configuration object provider.python.aliyun of cmd/task-worker gains the operator settings vad_model, vocabulary_id, hotwords ([{text, weight 1-5}], at most 128) and context (at most 400 characters), which apply to that model only. The private shape is strict, so every configuration must carry the four keys; Paraformer and deterministic configurations set them empty ("", and [] for hotwords). paraformer-realtime-v2 stays selectable on the Beijing workspace host only (Singapore and Hong Kong do not serve it). The operator probe node tools/providers/qwen-probe.mjs --key-file <path> --workspace ws-<id> --region <region> reports model availability per workspace (events only). No public API, SDK, event or error change; provider names stay out of public fields. See E5_QWEN_AUDIO_ASR_STREAMING_ADAPTER.md (../architecture/E5_QWEN_AUDIO_ASR_STREAMING_ADAPTER.md).
2026-10-22 — Platform names move to onesay.com
Every OneSay Platform public name now uses onesay.com, following OWNER_DOMAIN_ONESAY_COM_2026-10-22 (../architecture/OWNER_DOMAIN_ONESAY_COM_2026-10-22.md). The Control API is https://api.onesay.com/v1 (Staging https://api.staging.onesay.com/v1), Task Voice WSS is wss://realtime.onesay.com/v1 (Staging wss://realtime.staging.onesay.com/v1), MCP is https://mcp.onesay.com/mcp (Staging https://mcp.staging.onesay.com/mcp), the Console, Developer Portal and Docs hosts are console, developers and docs under onesay.com, and every JSON Schema $id is under https://specs.onesay.com/. The contracts are unpublished, so there are no aliases. The generated SDK environment tables, ESP32 headers and references are regenerated. Legacy hosts stay on onesay.io. npm run -s v13:forbidden-check now fails on a Platform onesay.io name outside Legacy, Owner decision originals and historical records.
2026-10-22 — Operator provisioning writes Human Grants
cmd/platform-provision (../../cmd/platform-provision/README.md) gains a grants section: allow Grants for a Human who has logged in once, selected by usr_ ID or ZITADEL issuer and subject, with app.session.* on the declared Application and other permissions environment-wide; state: revoked revokes them. Same guards, dry-run and read-back. The Staging seed grants two test users. No public API, SDK, contract or schema change.
2026-10-22 — Operator provisioning command for deployed environments
New operator-only command cmd/platform-provision (../../cmd/platform-provision/README.md) applies, from one declarative YAML or JSON document, the server facts a deployed environment needs before a Human can use it: Application OIDC client bindings, the current Consent policy of each Action (bound to the compiled registry digest the server compares) and a Project Environment Quota policy. It is idempotent, runs in one SERIALIZABLE transaction with -dry-run and a secret-free read-back, takes its database URL only from a private file, and refuses production without -allow-production. Example: deploy/aliyun/provisioning/staging-m1-smoke.yaml (../../deploy/aliyun/provisioning/staging-m1-smoke.yaml). No public API, SDK, contract or schema change.
2026-10-22 — Staging preparation for Alibaba Cloud Hong Kong (not run)
A Staging overlay for one Alibaba Cloud ECS host in cn-hongkong, its render and preflight tools (node tools/deploy/staging-aliyun.mjs --check, tools/deploy/staging-aliyun-preflight.mjs), host bootstrap and deploy scripts, a Yunxiao Flow pipeline and an optional ECS instance-role policy are in deploy/aliyun/; the procedure is the Staging runbook (../deploy/STAGING_ALIYUN_HK_RUNBOOK.md). Nothing has been deployed: no Staging endpoint exists yet, and the SDK staging environment still names the registered staging-platform-* authorities. No SDK API, contract or runtime change.
The host generates its own private configuration and its self-hosted ZITADEL at auth.staging.onesay.com (stage 1). Stage 2 adds the Task WSS Gateway, the Task worker and the RTC native host once the Staging project exists. The Task worker's Provider stays disabled until credentials are bound, so a Staging Task fails with Provider unavailable. The JavaScript RTC example is to be served at https://rtc-demo.staging.onesay.com/. All of this is NOT-RUN until the first deployment (../deploy/STAGING_ALIYUN_HK_FIRST_DEPLOY.md).
2026-10-21 — RTC native-connect failure contract in the SDK READMEs
The JavaScript (../../sdks/javascript/README.md) and ESP32 (../../sdks/esp32/README.md) SDK READMEs now state what a native connect failure looks like: the native host answers an untyped HTTP 500 for a OneSay admission denial (including a revoked identity), capacity, backpressure and an unavailable admission callback alike, so a client reads the Control resource (client.rtc.get(error.resourceId) or a new connect; on ESP32 getRTCConnection), revokes or lets the durable admission expire, and connects again with a new idempotency key; the official SDK retry counts are listed. Documentation only; no SDK API, contract or runtime change.
2026-10-20 — Evidence guard reads failure counts and -skip deselections
node tools/development/evidence-bindings.mjs --check now requires a row skip review to name the evidence that ran the skipped tests (or the helper-root limitation), treats a recorded go test -skip deselection like a skip, and requires a credited row that records failures to carry a fail_review naming its passing evidence. Only linux-go-race-remaining may be split into row parts. Governance only; no SDK API, contract or runtime change.
2026-10-20 — Skip counts taint evidence rows
node tools/development/evidence-bindings.mjs --check now treats a registry row as skip-tainted when any recorded skip count is above zero, unless the row carries a skip_review; a milestone that cites tainted rows must name a clean cited row in its skip_taint_review. Governance only; no SDK API, contract or runtime change.
2026-10-20 — JavaScript RTC example needs no native SDK configuration
The JavaScript RTC example (../../examples/javascript-rtc/README.md) server now builds its browser import map from the installed package manifests, so the example names no SDK dependency and needs no configuration of its own. node tools/rtc/run-public-example.mjs check is the automated, non-interactive form of the example.
2026-10-20 — Precloud coverage checks, host prerequisites, receipt bindings and ci:local:quick
node tools/ci/check-m1-precloud-contract.mjs --check now requires every hosted job to be covered exactly once, every runner outside the families to be classified, the native SDK row to match the runner allowlist, every row to sit in one OS × runtime cell, and every required package script to do work. New precloud rows: linux-go-race-*, rtc-livekit-gated-go-tests, task-*, usage-metering-dimensions, observability-*, gx12-fault-*, esp32-idf-component-*, and BLOCKED macos-safari and electron-renderer. Rows declare host prerequisites that the row driver reads back (BLOCKED_PREREQUISITE_MISSING, nothing installed) and may start the composed runner's fixtures (fixtures: hosted_ci); row receipts carry lock_hash and image_or_fixture_digest. node tools/development/evidence-bindings.mjs --check validates evidence bindings and refuses credit resting only on skipped tests. corepack pnpm ci:local:quick [--plan] [--base <ref> | --paths <file>] runs the ci:local units a change can affect, expanding to everything for shared changes; it never replaces the complete ci:local.
No SDK API, contract or runtime change.
2026-10-20 — Official Agents Worker metrics listener (off by default)
The Agent Worker command's private configuration gains official.prometheus_port (required key; 0 keeps it off). A non-zero port turns on the official LiveKit Agents Worker's own Prometheus listener on 127.0.0.1 (WorkerOptions.prometheus_port); it must differ from health_port. OneSay neither re-exports nor relabels the Worker's lk_agents_* families. Existing configurations must add "prometheus_port": 0. The SDK distribution matrix's Agent row now cites the server-side product dispatch. See cmd/agent-worker (../../cmd/agent-worker/README.md) and the GX10 observability boundary (../development/GX10_OBSERVABILITY_BOUNDARY.md).
2026-10-20 — Local observability lanes load the product alert mappings and scrape the patched native host
node tools/observability/run-local-observability.mjs now loads the alert mappings of deploy/readiness/ccr-a-pre-cloud.yaml and deploy/readiness/data-sync-local-capacity.yaml as aggregated Prometheus rules, checks them with the official promtool before starting any service, refuses to run outside the repository root and mounts the repository read-only. The new node tools/observability/run-native-observability.mjs scrapes the patched OneSay native host's own Prometheus listener unchanged with the same pinned Prometheus and Alertmanager. Revoke latency stays a value derived from durable records, not a metric. No public API, SDK or runtime change. See GX10 observability boundary (../development/GX10_OBSERVABILITY_BOUNDARY.md).
2026-10-20 — RTC connection on a Room that is still being prepared answers 202
POST /v1/rtc/connections (createRTCConnection) on a Room whose native runtime is not ready now answers 202 with {"data":{"room_id":…,"state":"preparing","retry_after_ms":1000}} instead of 409 resource_state_invalid. The durable Room intent and this result commit in one transaction, and the same Idempotency-Key keeps returning the same 202; it never turns into a connection. Request the connection with a new key after retry_after_ms; it returns 201 with material once the Room is ready. A request with a new key while the Room is still being prepared also gets 202 and adds no second intent. Nothing is reserved, consumed or minted by a 202. The JavaScript SDK's rtc.connect waits and retries with a derived key inside its own deadline; a delegated request is returned as a retryable resource_state_invalid error, because its next key needs its own Consent. The ESP32 SDK's onesay_esp32_rtc_prepare returns ONESAY_ERR_RESOURCE_BUSY for a 202; call it again later with a new key (a Device needs a new owner Consent for that key). The contract change is in specs/ with regenerated outputs. See durable Room work (../development/RTC_DURABLE_ROOM_WORK.md#accepted-versus-ready-rtc-20-v2-63---2026-10-20).
2026-10-20 — RTC credential rotation overlap; ESP32 RTC smoke scope check
Control's private config field rtc_native_observation[0] gains the required overlap_keys list. It is [] outside a credential rotation and holds exactly one more official LiveKit API key pair during the overlap. The webhook and observation receiver then verifies both pairs with the official multi-key provider; after the overlap the retired pair is refused. Existing Control configs must add "overlap_keys": []. The upgrade contract (deploy/stack/m1-v3-upgrade-contract.yaml) gains a credential_rotation section, checked by node tools/deploy/check-m1-upgrade-contract.mjs, and the operator runbook a rotation procedure. The packaged rotation rehearsal has not run yet. In the ESP32 rtc_smoke project, Device-credential mode now fails with ONESAY_ERR_AUTH before loading the Device secret unless the RTC Control configuration names the same environment, Device, Project and Environment as the Task one. See RTC credential rotation (../development/RTC_CREDENTIAL_ROTATION.md).
2026-10-20 — ESP32 RTC refuses any selected media encryption; two-SDK capability matrix
onesay_esp32_rtc_prepare now also refuses media_encryption set to none, with ONESAY_ERR_INVALID_ARG before any request. The canonical contract accepts only e2ee, and an absent field selects none, so leave the field unset on ESP32. The SDK distribution (../runbooks/SDK_DISTRIBUTION.md#declared-capability-matrix) page now maps each JavaScript capability to its API, permission, native call, test and example. It gives each ESP32 capability its public entry or its documented limitation, and it corrects the ESP32 RPC row: the ESP32 SDK answers RPC calls but cannot make them.
2026-10-20 — RTC admission reports the configured capabilities
POST /v1/rtc/connections (createRTCConnection) now returns truthful capabilities instead of four false values: audio is true, e2ee is true only when the deployment has a media key root and never for a Device connection, and data_packets and data_tracks stay false because public packet traffic and DataTracks are not enabled. An idempotent replay returns the same bytes. The bits are discovery only: the native grant, the publication and subscription policy and the session's own mediaEncryption choice still decide what a connection may do, and the JavaScript SDK still reports session.capabilities.e2ee as true only in the selected E2EE mode. The ESP32 SDK, which refuses audio when audio is false, now sees audio: true. No request, schema or SDK API change.
2026-10-20 — ESP32 and Device RTC refuse E2EE explicitly
onesay_esp32_rtc_prepare now returns ONESAY_ERR_INVALID_ARG when media_encryption is set to e2ee or to a malformed value, before it allocates or sends any Control request. Before this change the ESP32 SDK silently dropped the field and admitted a transport-only connection. none or an absent field behave as before; the request body is unchanged. The public headers and ABI are unchanged. The server's existing refusal of media_encryption: "e2ee" for a Device connection (409 resource_state_invalid, nothing reserved or consumed) is now covered by an executed PostgreSQL test. The JavaScript package test also checks that the packaged E2EE worker and its LICENSE equal the locked livekit-client files byte for byte. See ESP32 RTC data (../runbooks/ESP32_RTC_DATA.md) and the selected-mode design (../development/GX10_PRIVACY_E2EE_DESIGN.md).
2026-10-20 — ESP32 RTC smoke: Device credential to RTC bearer
The board-agnostic OEM project sdks/esp32/examples/rtc_smoke can now take its RTC bearer from the Device credential, using public calls only. Set rtc_bearer_from_device_credential = true. The smoke loads the Device secret once through the existing task.credentials store, sends it only as the Authorization of one exchangeDeviceAccessToken request (POST /v1/device-access-tokens) through onesay_esp32_control_request, erases it on every path and gives the RTC owner only the short-lived Device access token. The OEM load_rtc_bearer callback remains; exactly one of the two sources is accepted. The owner's Delegation and Consent and the Device's AppSession must already exist. The ESP32 Quickstart now points to this runnable project and documents the chain. No SDK public API change. Real-device results are not yet available.
2026-10-20 — Precloud rows for every committed RTC runner
deploy/ci/m1-v3-precloud-ci-contract.yaml gains the mandatory rows rtc-gx05-reuse, rtc-gx05-rooms, rtc-native-lifecycle-hold-bound-live, rtc-rtc03-identity, rtc-rtc03-native-facets, rtc-room-preparation, rtc-rtc-capabilities, rtc-webhook-observation and rtc-sdk-network-quality (added at the main-session merge), and the BLOCKED row gateway-native-roots (tools/rtc/run-gateway-native-roots.mjs needs the candidate build from tools/deploy/build-m1-candidate.mjs), so node tools/ci/check-m1-precloud-contract.mjs --check again finds every tools/rtc/run-*.mjs runner in a row. The owned native test host opens one opt-in Prometheus listener on port + 9 for both of its metric readers. The rtc-sdk-native-integration row now runs all eleven allowlisted formal native SDK roots in three commands.
No SDK API, contract or runtime change.
2026-10-18 — Network qualification work directory; supply currency reads pyproject dependencies
node tools/deploy/qualify-m1-network-template.mjs --work <dir> now refuses a --work path that already exists or lies inside the checkout, and removes only a directory it created. It writes its work directory 0700 and the files inside 0644, so the capability-less LiveKit container can read them on a Linux host as well as on Docker Desktop. The supply SBOM candidate's currency check reads only the [project] name, version and dependencies and [project.optional-dependencies] of pyproject.toml; editing a tool table such as [tool.onesay] no longer requires regenerating the candidate. See M1 network template (../runbooks/M1_NETWORK_TEMPLATE.md).
2026-10-17 — ESP32 SDK pins the reviewed RTC transitive components
With CONFIG_ONESAY_RTC_ENABLED, the ESP32 SDK's Component Manager manifest (sdks/esp32/idf_component.yml) now pins espressif/esp_peer ==1.5.6 and espressif/usb ==1.5.0 as overrides, next to the existing espressif/media_lib_sal ==1.0.2. An OEM project that resolves the SDK without a lock gets the same RTC dependency graph as the reviewed lock, instead of newer esp_peer/usb releases. Task-only builds are unchanged (the overrides are inactive). See ESP32 RTC SDK delivery (../development/ESP32_RTC_SDK_DELIVERY.md).
2026-10-17 — Operator runbook receiver CA input; singlehost network ports
The operator runbook's deploy section now lists the native host's third read-only private file, livekit-receiver-ca (/run/secrets/onesay-control-receiver-ca.pem, mode 0400), and the SSL_CERT_FILE path reference, per instance in the two-node overlay. SSL_CERT_FILE replaces the process's system root store, so in Staging the file must hold the issuing chain of Control's receiver certificate. The network template (../runbooks/M1_NETWORK_TEMPLATE.md)'s local singlehost layout now uses the real stack's native ports 17880/17881/17882.
2026-10-17 — Operator and developer runbooks; external-action handoff
New M1 operator runbook (../runbooks/M1_OPERATOR_RUNBOOK.md) (deployment, upgrade/drain/rollback, data, maintenance entry points and fault diagnosis for Task Voice and LiveKit RTC) and M1 developer runbook (../runbooks/M1_DEVELOPER_RUNBOOK.md) (Docs site, Developer Portal, release packages and quick starts). The JavaScript Quickstart now names the release tarball build (corepack pnpm sdk:package:check) and its file: install; the ESP32 Quickstart no longer documents the retired physical command. Every remaining cloud, Provider, hardware and publication action is listed in the generated external-action handoff (../development/GX13_EXTERNAL_ACTION_HANDOFF.md). No public API, SDK or runtime change.
2026-10-17 — Device environment for the formal RTC integration entry
node tools/rtc/run-sdk-native-integration.mjs --roots <roots> gives each root
that declares the opt-in Device environment two more owned containers: a
business Redis for the rate limiter and Signal tickets, and the lock-pinned
unpatched LiveKit Server as the outer Room API. The two Device roots of the
GX12.security matrix and the new requirement-family root
TestRTCDeviceNativeSameOwnerHumanInPostgres (RTC-03 same-owner self-Device)
use it. The shared runner finalizer takes an optional owned-role list. The
repository's ci:local does not run these roots.
No SDK API, contract or runtime change.
2026-10-18 — Usage: RTC DataTrack byte observations
The Usage UsageMetric enum gains four values: rtc_observed_upstream_datatrack_bytes, rtc_observed_upstream_datatrack_messages, rtc_observed_downstream_datatrack_bytes and rtc_observed_downstream_datatrack_messages. They are nonbillable, unpriced observations with UNKNOWN completeness of the payload a participant sends on its own DataTrack publication (upstream) or receives on a subscribed DataTrack (downstream), taken from the official LiveKit per-DataTrack byte statistics and attributed to the participant who sent or received it. Each observation is bound to the DataTrack's original data.rtc.v1 publication; bytes on a DataTrack the platform did not publish are not recorded. They are not IP or TURN egress, connection duration or cost. Deploy Control before native hosts so the new observations are accepted (same rollout order as LIM-GX10-USAGE-BYTE-CAPTURE-ROLLOUT-ORDER).
2026-10-17 — Local CI rows and frozen Linux installation
ci:local now uses only the hosted workflow's fixtures (PostgreSQL and two Redis); LiveKit, native-host, packed RTC SDK and browser tests are qualified by the mandatory rows of deploy/ci/m1-v3-precloud-ci-contract.yaml, run with tools/ci/wsl-local-ci.sh <commit> --rows <run> <row>... (docs/development/M1_LOCAL_CI_RUNBOOK.md section 2). node tools/ci/linux-frozen-install.mjs --asset <dir> --previous <dir> produces the frozen Linux Node installation those runs bind; make a new one whenever package.json, the lockfile, the workspace file or a pnpm patch changes. node tools/capacity/local-rtc-metrics.mjs compares two unchanged GX12.fault runs of the same input. No API or SDK change.
2026-10-17 — Usage: RTC participant data-channel and signal byte observations
The Usage UsageMetric enum gains eight values: rtc_observed_upstream_data_bytes, rtc_observed_upstream_data_messages, rtc_observed_downstream_data_bytes, rtc_observed_downstream_data_messages, rtc_observed_upstream_signal_bytes, rtc_observed_upstream_signal_messages, rtc_observed_downstream_signal_bytes and rtc_observed_downstream_signal_messages. They are nonbillable, unpriced observations with UNKNOWN completeness of a participant's own data-channel and signal-connection payload deltas, taken from the official LiveKit byte statistics. They are not IP or TURN egress, connection duration or cost, and DataTrack bytes are not included. Deploy Control before native hosts so the new observations are accepted (rollout order recorded as LIM-GX10-USAGE-BYTE-CAPTURE-ROLLOUT-ORDER).
2026-10-17 — Usage metering dimension registry
The Usage specification now states, for every Usage metric, its unit, whether it is a delta or a final cumulative total, how duplicates and generations are recognized, which time it carries, how complete it is, and whether it can be billable, priced or reserved. It also lists the dimensions that are deliberately not reported, such as RTC connection duration, network and TURN egress, and Agent or infrastructure cost, and why. This registry increment itself changes no metric, value or API.
2026-10-17 — RTC connection admissions of one Environment queue instead of conflicting
Concurrent rtc.connection.create requests and native admission checks of the
same Environment now wait for each other before their database snapshot, so a
burst ends in admitted connections and explicit quota_exceeded refusals
instead of 409 resource_state_invalid contention refusals. The database
session used for that wait returns to the pool as soon as its transaction
ends, so an immediate retry or the next authority step finds it free. A
native node whose consumer closes after a failed native participant close now
leaves its registration open instead of closing it unsealed, so it drops out
of later revocation checks after the freshness window and cannot hold every
later revocation of the Environment pending. A revoked connection's
effectiveness proof now waits for the native node's policy feed reads and
applied reports of the same Environment instead of conflicting with them, so
the revocation becomes effective without the repeated 2 s retries that
could delay it by tens of seconds. Authorization checks, budgets, retries and
error codes are unchanged. No public API or contract change.
2026-10-17 — Task cancel while the worker is writing
A Task cancel (POST /v1/tasks/{task_id}/cancel or the realtime task.cancel message) no longer fails because the task worker is committing progress for the same Task at the same moment. Previously the realtime connection could answer error with provider_unavailable, although no Provider was involved; the HTTP path shares the same code and could answer 500 resource_state_invalid. The cancel now waits for the worker's current write, within the request's existing deadline. The same holds for a Task cancel that an Agent requests through its Task cancel Action. A cancel can still fail on an unrelated serialization conflict; it then uses the existing error mapping. No API, error code or SDK change.
2026-10-17 — Formal entry for the gateway Task+RTC roots
node tools/rtc/run-gateway-native-roots.mjs --build <dir> --build-sha256 <sha256>
runs the realtime-gateway Task+RTC process roots against one
tools/deploy/build-m1-candidate.mjs build of the same clean commit. Each
root runs once in the candidate Task image with the candidate native host,
owned PostgreSQL and two distinct Redis. The repository's ci:local does not
run these roots.
No SDK API, contract or runtime change.
2026-10-17 — Formal RTC integration entry and JavaScript data guide
node tools/rtc/run-sdk-native-integration.mjs --roots <roots> qualifies the
allowlisted packed-SDK RTC roots against a OneSay native host and RTC
authority host freshly built from a clean commit, with owned PostgreSQL,
native Redis and Chromium. The repository's ci:local does not run these
roots.
New roots cover:
- the content-comparable audio slice;
- the JavaScript security boundary on that path.
A new guide, docs/runbooks/RTC_JAVASCRIPT_DATA.md, covers the package's
declared packet, stream, RPC, DataTrack and Agent surfaces.
No SDK API, contract or runtime change.
2026-10-17 — Context-bearing Tasks over the realtime connection
POST /v1/realtime/connections accepts context_snapshot.read in requested_grants (up to seven grants). A Task created with task.create on that connection can then carry a ContextSnapshot input; without the grant such a create is still refused. A dictation Task whose ContextSnapshot the speech Provider cannot use (anything other than at most one locale item of the form {"language": "..."}) is now refused when it is created, with task_profile_input_unsupported (HTTP 422, or an error event on the realtime connection, which stays open), instead of expiring after admission. The SDK default grant lists are unchanged: request the grant explicitly, and give the device or service credential context_snapshot.read.
2026-10-17 — ESP32 RTC data, RPC and Agent Control guide
New developer handoff ESP32_RTC_DATA.md (../runbooks/ESP32_RTC_DATA.md) for the ESP32 SDK's packet send, stream receive, RPC callee and Agent Control: call order, the Grants and Consent the server enforces, handler and callback rules, limits, failures and what the pinned official SDK cannot do (packet receive, targeted stream send, outbound RPC, RPC v2). node tools/sdk/build-esp32-idf-component.mjs --rtc-smoke now expects the 15 OneSay RTC translation units of the current SDK, including the RPC callee. No API change.
2026-10-17 — ESP32 RPC callee with caller-addressed replies
The ESP32 SDK can now answer RTC RPC calls. After onesay_esp32_rtc_prepare and before onesay_esp32_rtc_connect_audio, onesay_esp32_rtc_prepare_rpc_receive registers one to four app.* methods with one synchronous handler each; once connected, onesay_esp32_rtc_configure_rpc_receive installs a receive-only RPC packet policy (at most four original callers). Each accepted request gets exactly one reply; any policy, peer, deadline or bound failure returns one fixed application error without details, and a repeated request ID is never executed twice. The pinned official LiveKit ESP32 runtime (v0.3.11) sent RPC acknowledgements and results without a destination, which the platform refuses; a reviewed build-tree correction of one official source file now addresses every acknowledgement and result to the original caller only. It changes no public header or ABI and is removed once an upstream release carries the same fix. ESP32 remains callee-only: the pinned runtime has no outbound invoke, and no transport is substituted. Server authorization is unchanged. Local host and ESP32-S3 compile/link evidence only; native network delivery, device and hardware runs remain NOT-RUN. See the design record (../development/GX09_ESP32_RPC_REPLY_DESTINATION.md).
2026-10-17 — One Room for Task voice and RTC
New guide docs/runbooks/ROOM_SHARED_SERVICES.md. A Room created with POST /v1/rooms has no service type, so Task voice and RTC can use it at the same time. POST /v1/rooms/{room_id}/close ends both: Participants disconnect, Task-voice signals end, RTC connections are revoked and SDK sessions report closed. A closed Room cannot be joined, reconnected or reopened. A Task that is still running when its Room closes keeps its own lifetime and is not given a result by the close: it ends as task.expired with its quota released after the idle timeout (20 minutes by default), or after its 75-minute execution lease if the process running it is gone. End or cancel Tasks first when you need a prompt terminal. No API or contract change.
2026-10-17 — ContextSnapshot locale reaches the speech Provider
A dictation Task's ContextSnapshot locale (the only Provider-projectable context item, {"kind":"locale","value":{"language":...}}) is now delivered to the speech Provider as a recognition hint after the Task's own language; for the Paraformer streaming adapter it becomes an additional language_hints entry. Routing, model, region, price and the result language stay bound to the Task language. A ContextSnapshot input may now precede the primary SignalStream in the Task inputs. GET /v1/context-snapshots/{id} returns created_at in UTC, as create does, regardless of the server's time zone. A ContextSnapshot input still cannot be attached to a Task created over the realtime connection: the connection grants do not include context_snapshot.read.
2026-10-17 — ESP32 RTC SDK delivery guide
New developer handoff for the ESP32 RTC component graph, PCM capture/render bridge, admission and lifecycle owners: what to reuse, caller duties, evidence bindings, reproduction entries and the device-only gates that remain. No SDK or API change.
2026-10-17 — ESP32 RTC SDK smoke project
New board-agnostic OEM project sdks/esp32/examples/rtc_smoke runs one minimal real-device sequence through public OneSay APIs only: Task connect, stream and release, then RTC prepare, audio connect, capture, one packet and release. It prints a single content-free ONESAY_RTC_SMOKE summary line. Export it with node tools/sdk/export-esp32-oem-example.mjs --example rtc_smoke <dir> and build it without hardware with node tools/sdk/build-esp32-idf-component.mjs --rtc-smoke. A refused capture start or render open, such as ONESAY_ERR_RESOURCE_BUSY, is reported with its unchanged error. The RTC bearer comes from an OEM callback because the SDK has no public Device-token exchange for RTC. Real-device results are not yet available.
2026-10-15 — Early return of unused RTC connection quota
When an RTC connection ends before its current quota segment does, the unused part of that segment can now return to the project's weekly connection-time budget. This happens only after every native session of the connection is proven finished, and the returned amount is limited by the platform's own native lifecycle reports. Anything unknown stays reserved. Only available capacity changes: no usage, billing, refund or reversal record is created. No public API change.
2026-10-17 — ContextSnapshot timestamps on read
GET /v1/context-snapshots/{id} now returns created_at in UTC, exactly as the create response does. A server running in a non-UTC time zone previously returned the same instant with its local offset, so the read did not match the create response byte for byte. No contract change.
2026-10-17 — Complete local CI on the Linux lane
tools/ci/wsl-local-ci.sh <commit> runs the equivalent ci:local composition (tools/ci/run-local-ci-composed.mjs) on one exact clean commit with owned fixtures; see docs/development/M1_LOCAL_CI_RUNBOOK.md. Local CI now splits the Control repository package into twelve test shards; budgets are unchanged. Current-source CCR evidence readers accept clean re-executions selected in the execution ledger. No runtime or contract change.
2026-10-15 — Explicit resource_busy for held audio devices
New error code resource_busy (retryable, client-side). The JavaScript SDK raises it from publishMicrophone when the browser reports the microphone held by another capture (NotReadableError, or TrackStartError in older Chrome); other start failures stay client_audio_capture_failed. The ESP32 SDK adds ONESAY_ERR_RESOURCE_BUSY for OEM capture start and render open callbacks, and onesay_esp32_rtc_read_media_status returns the first such failure unchanged, because media starts after onesay_esp32_rtc_connect_audio returns. Neither SDK retries, preempts or cancels the other Task/RTC owner.
2026-10-15 — Agents and selected-mode encryption
An Agent execution can no longer use an end-to-end encrypted audio publication as input; the request is refused with resource_state_invalid. Agents cannot decrypt selected-mode media, so choose transport encryption when an Agent must process the audio.
2026-10-15 — JavaScript selected-mode RTC media encryption
rtc.connect({ mediaEncryption: "e2ee" }) encrypts audio frames end to end with server-issued per-participant keys that rotate every 30 seconds; unsupported browsers fail before admission and never join unencrypted. session.capabilities.e2ee is true only in this mode. The platform issues the keys and can decrypt. A transport-only connection can no longer subscribe to an encrypted publication.
2026-10-15 — Fewer database round trips in Device quota renewal
A complete Device media quota renewal issues about 21% fewer SQL statements (for example 904 to 726 in the local fixture) by reusing clocks and checks that are already taken at the same point in the same transaction. Authority, locks, expiry checks and the 500 ms limit are unchanged. No public API or contract change.
2026-10-15 — Selected-mode RTC media encryption keys (server)
POST /v1/rtc/connections accepts optional media_encryption: "e2ee"; the mode is fixed for the connection. New GET /v1/rtc/connections/{connection_id}/media-keys (rtc.media_key.read) returns the caller's current per-sender audio keys under fresh authority. The platform derives these keys and can decrypt; this is not zero-knowledge encryption. SDK support is not yet available.
2026-10-15 — Local Go test units
Local CI runs each serial Go package as its own bounded unit and splits the Control repository package into four complete test shards. Scope, flags and budgets are unchanged.
2026-10-15 — Latent test repairs
Align RTC contract, SDK and native fixture tests with the delegated RTC Actions delivered on 2026-10-14, refresh the Device conformance lock, ship the official E2EE worker in the portable Mock kit, and bind nine historical receipts to the commit that last wrote them. No runtime or contract change.
2026-10-15 — Local CI work units
Local CI runs each Node test file and each Go command as its own bounded work unit instead of one 900s unit per suite; scope, order and budgets are unchanged. CCR readiness tests exercise focused validation parts, and the offline CCR-B runner case has its own file.
2026-10-15 — Developer Portal next security fix
Upgrade the private Developer Portal from next@16.3.6 to next@16.3.8 for six OSV advisories, including a high-severity Image Optimization SSRF. Dependency-only change; no OneSay runtime or public contract change.
2026-10-15 — Observer R8 and preparation check repairs
Re-run the CCR observer suites after the reader profile change. Account for the packed-SDK RTC example in the dependency audit by its exact manifest, allowlist reviewed native LiveKit Track references, and treat appended Usage metrics as additive public-surface changes. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
2026-10-15 — Current-byte BOOT and Generated requalification
Re-execute the original BOOT and Generated qualification lanes on current working bytes and let the existing CCR readers select them through a profile table. Historical executions keep their original checks and are tested against the exact bytes they ran. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
2026-10-15 — Failed local CI r5 archive and execution handoff
Archive the complete local CI attempt at 4d323d1b, which fails acceptance on evidence digests after line endings in two working-tree files changed with unchanged Git content. Execution moves from Codex to Claude Code; the Owner-approved termination evidence for this run is the on-disk collector receipt and watchdog record. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
2026-10-15 — Current native ticket-erasure evidence
The E8 acceptance reader now consumes the actual current TLS constructor results with complete source, compiler-input, raw-output and cleanup validation. Earlier failed and successful executions keep their original source identity. Six additional tampering cases cover the new evidence representation. Restore the historical raw-log whitespace rule precedence without changing original logs; remaining format and complete-CI results are recorded separately.
2026-10-15 — Format and Task memory coverage closure
Preserve one exact historical failed-reader syntax capture through its original source and terminal provenance. The full format check now passes on the current candidate. The Task-native memory coverage reader derives its scope from the CMake graph and leaves the conditional RTC graph to its separate qualification; the seven prior native memory phase results remain source-bound and their old aggregate failure is retained.
2026-10-15 — Full M1 scope continuation and current local evidence
Record the Owner's decision to complete the original M1 v3 scope without adopting the proposed staged reductions. Preserve the completed34-stage CCR result, subsequent E8 source-binding failure and separately successful current native TLS/Gateway execution. Correct one missing quote in a historical GX11 handoff receipt through a separately documented sibling; retain the original source and test result. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
2026-10-14 — GX progress and first-Staging scope audit
Document the actual implementation, existing evidence, remaining qualification and possible staged delivery for every GX00–GX19 package at source e7d08573. Distinguish the existing complete G_PRE contract from a proposed restricted internal Staging scope. This report changes no runtime, active scope, progress credit, deployment authorization or historical test result.
2026-10-14 — Deliver original validation logs
Include referenced raw evidence logs in Git and preserve their original bytes. A tracked-only Linux source copy exposed logs that existed locally but were omitted by the general log ignore rule. Historical source identities and results remain unchanged. The current full CI timeout, separate source-copy diagnostic and native dispatch test results remain individually recorded in the M1 implementation log.
2026-10-14 — Current AppSession contract compatibility
Refresh the OS-PLATFORM-0009 current compatibility readback and regenerate its shared fixture against the current canonical specification. AppSession actions and authorization semantics remain unchanged. Preserve the frozen contract and previous readback; current local contract validation is recorded separately from the earlier full CI failure.
2026-10-14 — Current Linux Observer validation
The existing local Observer checks now have a separately recorded current Linux execution with116 passing cases and no failures or skips. The original preparation failure remains visible. Current evidence selection and the generated-limits test follow the frozen Linux profiles; this does not qualify full local CI or any external deployment.
2026-10-14 — Linux local validation provenance
The existing local validation readers now distinguish newly executed Linux BOOT and public Node checks from historical routing results. Generated-scope failures and incomplete capture remain visible alongside separately verified input readback. This changes validation tooling only; actual regression status is recorded in the M1 implementation log.
2026-10-14 — Native-input Console Agent qualification
Added an opt-in Linux fixture reusing the existing patched native host, authority worker and official publisher to qualify current Console Agent controls. Ephemeral connection material stays in the private child pipe. Public creation precedes reviewed explicit stop and readback; desired and observed stopping remain distinct. No model or Provider execution is included. Actual local results and remaining gates are in the GX10 Web local release report.
2026-10-14 — Reviewed Device credential rotation
Active Device details now offer the existing Human-authorized credential rotation API through review and a separate Execute action. The server immediately revokes previous Device credentials and returns a replacement secret with public credential metadata; there is no overlap period or automatic deployment to hardware. The Console distinguishes Device secrets from Service API keys and provisioning codes, reusing masked disclosure, explicit copy/clear and same-key retry. Mock writes remain disabled. Actual local qualification and unexecuted hardware/cloud limits are recorded separately in GX10 Web release report section R.
2026-10-14 — Credential and Device secret operations
Console now reviews and explicitly executes the existing Credential creation/rotation and Device creation/provisioning-code APIs. API key rotation immediately revokes the previous key; a new provisioning code supersedes prior unconsumed sessions and does not activate hardware. Returned secrets stay in the current disclosure state, masked by default, with explicit reveal/copy and clear controls. Scope, navigation and session changes clear that display; provisioning expiry follows the server timestamp. Ordinary reads return metadata only, while an uncertain request can explicitly retry its original key to recover the protected response. Mock writes remain disabled. Actual source-bound local checks and external limits are recorded in the GX10 Web release report.
2026-10-14 — Reviewed resource creation and terminal operations
Console now prepares explicit reviews for Organization, Project and Application creation and for Project archive or Application, Credential and Device revocation. The existing public API remains authoritative; no new Consent or administrative endpoint is introduced. Unknown outcomes retain the same immutable request key for explicit retry. Project creation refreshes its choice locally; archiving the selected Project clears that scope. Mock writes stay disabled. Secret creation, credential rotation and Device provisioning remain separate workflows. Actual affected local results and external limits are recorded in the GX10 Web release report.
2026-10-14 — Resource details and reviewed metadata updates
Console now reads complete public Organization, Project, Application, Credential and Device details. Four existing metadata PATCH operations use explicit review and the canonical Idempotency-Key; credential metadata remains read-only. Scope changes and denied responses clear stale details, and uncertain outcomes retain the reviewed request for an explicit same-key retry or independent refresh. Mock Mode stays read-only. The ESP32 RTC Quickstart now follows the implemented prepare, connect, binding-read and close lifecycle. Local evidence and unexecuted native/hardware/cloud limits are recorded separately in the GX10 Web local release report.
2026-10-13 — Request diagnostics and dimensional Usage
Developer Logs can open a request timeline through the existing scoped public API. The Console separates the queried request from the response request ID and preserves safe metadata and recorded timestamps. The HTTP authorization adapter now includes this existing operation and resolves its scope from durable logs, retaining current membership, credential and grant checks. Usage summary now lists each metric and billable flag separately; event details retain null resource links and reversal facts. Currency, prices, remaining quota and final bills are not inferred. Local Mock examples now follow the actual public Usage and log contracts. Actual local validation and external limits are recorded in the GX10 Web local release report.
2026-10-13 — Agent execution details and confirmed stop
Console can read a Room's Agent execution and prepare an explicit Human confirmation before requesting stop through the existing public API. It preserves desired state, observed state, playback and effective stop time separately, and retains the same operation key only for an uncertain transport/server outcome. Mock Mode remains read-only. Local UI and controller evidence is separate from real native-input, Agent runtime and Provider qualification; the GX10 Web local release report records actual results and remaining gates.
2026-10-13 — Separate service and SDK Quickstart entries
The Developer Portal now links directly to JavaScript/ESP32 × Task Voice/RTC sections in the two existing Quickstarts. The guides reuse the installed Task sample, browser RTC example, Task-only OEM export and existing RTC component contracts; their local, native and hardware limits stay explicit. The synthetic WSS/OSAF playground is named as a Task protocol playground. Direct section navigation also keeps the Docs table of contents aligned with the combined page scroll padding and heading margin. No route, SDK, backend or design-system replacement is introduced. Current local interaction evidence is recorded separately in the GX10 Web local release report.
2026-10-13 — Bound credential query-plan diagnostics
Add an opt-in, redacted execution-plan probe to two existing real PostgreSQL credential cases. The plan and one default-rate CPU diagnostic do not establish a performance fix: the original500ms race path still fails in initial complete-media setup. Preserve actual source-bound diagnostics and leave the runtime query and qualification status unchanged; details are in M1_IMPLEMENTATION_LOG.
2026-10-13 — Reuse complete owner history in Device target Service checks
Use the existing read-only phase's complete owner history while keeping each original Service interval, capture, currentness and expiry checks. Real PostgreSQL affected tests pass48 events in nonrace mode. Race Service regressions pass15, but initial complete Device refresh still exceeds500ms; full qualification remains open. Source-bound results are recorded in M1_IMPLEMENTATION_LOG.
2026-10-13 — Reuse selected Device receipt JSONB values
Materialize seven selected snapshot payloads inside the existing Device facet guard without changing its full validation algorithm or500ms bound. Migration static/consistency checks pass. Actual PostgreSQL nonrace qualification passes59 events; race passes34 but the complete receipt fault still times out, so later race/native qualification remains unpassed. Exact source evidence and unchanged progress are in M1_IMPLEMENTATION_LOG.
2026-10-13 — Make extra quota SQL recording explicitly diagnostic
Enable the extra first-eight-call SQL failure recorder only with the existing diagnostic environment opt-in. Retain normal production metrics/failure observation, request/origin fault hooks, all assertions and 500ms. Same-source nonrace passes 63 events; race passes 38 with four failures because receipt_omits_packet still times out at 500308 microseconds instead of reaching its required constraint rejection. Later race positives/public media remain NOT_RUN. This corrects test instrumentation, not a proven latency cure; exact source, actual exits, cleanup and the next bounded duplicate-read inspection are in M1_IMPLEMENTATION_LOG. No progress credit.
2026-10-13 — Avoid unused fresh Grant expiry clocks
Skip an unused expiry-time query only after a successful fresh read with no finite Grant deadlines. Preserve finite and retained-row clocks and cancellation. Thirteen new real PostgreSQL cases pass in nonrace and race. Nonrace affected tests pass 326 events; race passes 301 but receipt_omits_packet still times out instead of producing its required constraint rejection. Later race checks are NOT_RUN. Exact evidence and the next bounded test-diagnostic correction are in M1_IMPLEMENTATION_LOG; no new credit.
2026-10-13 — Batch eligible initial Grant histories
Reuse the complete-history batch reader when both principals have already-read empty denial candidates for every reference, preserving original initial lock order, scalar validation and fresh final authority. Ten PostgreSQL regressions cover history, fallback, shared memory and observed lock order. Nonrace affected tests pass 313 events; race passes 282 but full Device renewal still exceeds 500ms. Later race positives/public media are NOT_RUN. No progress credit or cloud qualification; exact source, exits and cleanup are in M1_IMPLEMENTATION_LOG.
2026-10-13 — Project immutable snapshot JSONB once per exact read
Keep the complete snapshot/audit consistency predicate and strict parser while avoiding repeated extraction of the large stored payload. Actual PostgreSQL equivalence probes preserve NULL, casts, exact audit and complete facts; existing storage/role checks remain. Same-source nonrace passes171 events including complete Device Rolling. Race passes151 but fails the first full Device quota call at500ms; later positives are NOT_RUN. The blocker remains open, with no latency guarantee or progress credit. Exact source, receipts and cleanup are recorded in M1_IMPLEMENTATION_LOG.
2026-10-13 — Preserve quota completion cancellation and deadline errors
Keep original context errors at both quota completion returns instead of replacing them with permanent policy denial. Expired material still denies; commit/retry behavior and 500ms remain unchanged. Ten selected Linux race unit roots pass 66 events. This repairs a confirmed classification risk but does not identify the prior full-path failure branch or close the Device race/500ms blocker; integration results remain bound to their earlier source. See M1_IMPLEMENTATION_LOG for exact evidence.
2026-10-13 — Reuse verified subscription first-bind provenance
Reuse first snapshot, original attachment and verified inbox facts only within the same initial quota subscription function; keep current route reads, exact tuple matching, original fallback and all post-reservation authority checks. Same-source nonrace passes 74 test events. Race passes 54 events but fails the first complete Device quota call at 500ms with a denial and observed SQL deadline; later mandatory positives remain NOT_RUN. Exact source and terminal results are recorded in M1_IMPLEMENTATION_LOG. No latency, full CI, native/cloud qualification or progress credit is claimed.
2026-10-13 — Reuse the same Delegation batch's locked fence union
Remove repeated principal fence reads only inside the existing read-only Delegation batch; preserve complete Grant/deny/history checks and fresh expiry/transaction observations. Extend existing PostgreSQL tests for the lexical handoff, including actual blocked deny writer and elapsed expiry. Final selected race Grant tests pass 270 events; same-source nonrace Grant plus complete media Rolling pass 292. Preserve the original-source complete Rolling race/500ms failure; no latency, native/cloud qualification or progress credit follows. Exact inputs and terminal results are recorded in M1_IMPLEMENTATION_LOG.
2026-10-13 — Device publication fence and clock read
Reuse the existing locked publication Consent fence with a conditional post-lock clock in one SQL call. Complete Rolling nonrace passes 22 test events; race retains two withdrawal-negative passes and fails the first full-facet quota at original 500ms. Exact source and terminal receipts are recorded in M1_IMPLEMENTATION_LOG; no capacity, external qualification or progress credit follows.
2026-10-13 — Complete Device quota phase measurement and fixed-count non-race validation
- Preserve the initial race/2s Consent-setup failure, then record the actual r2 and non-race diagnostic successes: each complete Rolling root passes 22 test events. Race's three named full-facet positives take 619.984–633.927ms; these 2s snapshot results do not qualify the unchanged production 500ms path.
- Add elapsed/result observation only to the existing two Rolling test files. Under original 500ms, one non-race ELF passes three fixed complete iterations / 66 events, with named positive times 358.391–415.436ms. No retry or assertion relaxation; three iterations do not prove stable tail latency, full CI or race qualification.
- Full-phase evidence identifies initial subscription and fresh final checks as substantial cumulative costs. Continue reducing existing-owner duplicate work with all authority/history/lock/expiry guarantees intact. Preserve prior race/500ms failure, external NOT_RUN gates and unchanged progress. See the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Deduplicate complete current-deny selectors in the existing locked Grant batch
- Preserve exact selectors, original rows/history, false-only fallback, fresh clocks and 500ms while evaluating each complete deny tuple once. Three new real-PG cases pass, including actual two-versus-ten function evaluations; no end-to-end latency improvement is claimed.
- Same-source non-race passes two roots / 292 test events. Race passes Grant 270 and two Rolling negatives, then the first full quota request expires at 500ms: 272 PASS / three FAIL events, with later three named positives NOT_RUN. Preserve that failure and unchanged progress; one non-race pass is not stable performance qualification.
- Reuse the existing complete-phase diagnostic observer on the exact current baseline before choosing the next reduction; retain formal 500ms, full final authorization and external NOT_RUN gates. See the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Consolidate fresh native route reads from bounded diagnostic evidence
- Add test-only bounded clock/isolation callsite attribution; its Linux/race unit passes 12 events. A separate race/2s diagnostic passes 22 events with six actual complete media calls, but 26–32 dropped stack observations per complete call and diagnostic-only timing prevent qualification or complete attribution claims.
- Preserve the old-ELF CPU diagnostic failure: receipt SQLSTATE 23514, context OK, rather than timeout. Combine current native connection/publication route SQL, retaining isolation, exact predicates, least privilege, owner/recheck order and original budgets; the observed request shape supports 34 fewer statement round trips, not a measured latency result.
- Preserve the first formal failure: three native roots pass, while the old least-privilege premise fails before lookup because migration 137 intentionally expanded the shared role. Restore only the test's two-column privilege restriction inside its owned transaction, retaining negative assertions and rollback; Rolling was NOT_RUN in that failed attempt.
- The corrected exact-source non-race selection passes five roots / 75 events (native 53 plus complete Rolling 22); the four native roots also pass race / 53 events. The complete Rolling race root was not rerun. Keep the complete-media race/500ms blocker, historical failures, external qualifications and progress unchanged; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Batch existing external quota snapshots
- Reuse existing multi-capture storage for the original facet union, preserving locks, authority, rollback/receipt guards and 500ms. The static full-facet path removes 24 client SQL round trips; numeric latency improvement is NOT_ESTIMATED.
- Non-race affected suite passes 12 roots / 79 events, including two new real-PG rollback cases and original media positives. Same-source race records 1 PASS / 2 FAIL roots and 11 PASS / 6 FAIL events; first full quota calls still expire, so batching is insufficient. Storage and later race cases are NOT_RUN; eight Human race roots remain unselected and the frozen twelve-root race configuration unexecuted. Preserve credit and historical/external evidence; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Preserve the exact-source race failure after fixture ordering
- The same three-root affected race run finishes with 1 PASS / 2 FAIL roots and 11 PASS / 6 FAIL test events; package failure is separate. PublicMedia and Rolling fail their first full quota request at observed 501ms / 500ms; preparation retry passes. Same-source non-race 40 PASS events remain separate, and two native roots remain NOT_RUN.
- Continue structural reduction of duplicate initial subscription and snapshot/receipt database work while preserving authority, locks, fresh final checks and 500ms; do not add another small fence cache. Preserve all failures and progress; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Validate the existing media fixture's connection preparation order
- Reorder one test fixture so both original connections are created before per-endpoint close operations and Grants; preserve public requests, clocks, expiry, 500ms owner limit, refresh window and every existing assertion.
- The three selected real PostgreSQL non-race roots pass 40 test events, including all 20 Rolling events and its three named positives. This source's race and two native roots remain NOT_RUN; earlier race/diagnostic failures are preserved, and no claim of stable latency or guaranteed window alignment follows. Progress is unchanged; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Preserve setup-window failure and exact full-path measurements
- Preserve a zero-test image-validation failure, then correct one digest in a fresh diagnostic runner. The corrected race/2s diagnostic still fails: 0 PASS / 1 FAIL roots, 2 PASS / 3 FAIL test events, package FAIL separate. Its actual assertion is an out-of-window completed baseline after natural waiting, not a quota deadline.
- Two prior full-facet setup receipts succeed at 614.579ms / 660.887ms with 1056 / 1039 SQL calls. Preserve all 38 phase records per request, zero observer drops and bounded top-SQL rankings. All three named positives are NOT_RUN, so their current-versus-historical timing comparison is unavailable. Formal race FAIL, non-race companion PASS, qualification limits and progress remain unchanged; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Reuse checked AppSession history and retain separate race/non-race results
- Reuse complete checked AppSession history only inside its original active read-only phase, preserving fresh database time, full fallback, authority/locks and original observation boundaries. Add 15 mechanism cases under the existing real PostgreSQL Grant root; correct setup refresh-window prediction without changing formal same-coverage assertions or the 500ms owner limit.
- Execute the identical five-root affected suite on the same frozen source in both modes. Race: 4 PASS / 1 FAIL roots, 454 PASS / 3 FAIL test events. Non-race companion: 5 PASS roots / 472 PASS test events, including all 20 full Rolling events. Package results are separate. Race still fails its first complete quota request on an observed internal SQL-context deadline; exact SQL/cumulative stage remains unknown.
- Keep the non-race companion's actual PASS distinct from full CI, repeatable latency qualification and required race qualification. Preserve historical diagnostic eligibility, all gates and progress; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Separate transaction-function evidence from business qualification
- Execute the prepared owned PostgreSQL function-statistics diagnostic once. Both setup quota requests succeed with receipts, but the existing dependent-followup coverage assertion fails: 0 PASS / 1 FAIL roots, 2 PASS / 3 FAIL test events, plus one package FAIL. Preserve the failure without retrying for green results.
- Statistics coverage independently passes two samples / 53 function rows / zero drops. Receipt validation is the largest self-time row (31.912024ms / 29.135003ms); receipt encoding is 0.206ms / 0.055ms. These are transaction-scoped diagnostic observations with measurement overhead, not isolated receipt CPU, a source fix or formal500ms qualification. Continue existing SQL-body inspection without score/state changes; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Reuse bounded decoded history and verify the full quota path
- Reuse decoded Grant/resource-owner representations inside existing read-only phases, preserving raw-byte binding, independent copies, complete interval validation, retention bounds and full fallback. Existing real PostgreSQL Grant/owner/session/runtime roots pass 437 events; formal Rolling passes two authority negatives then fails its first full request at 500ms. Combined formal result: 4 PASS / 1 FAIL roots, 439 PASS / 3 FAIL test events; packages separate. This run observes no failing SQL, so no previous generation's SQL cause is transferred.
- Execute the changed existing phase-boundaries unit with the same compiled Linux race ELF: 1 root / 91 events PASS, no rebuild or services. Keep its receipt separate from formal PostgreSQL results.
- Exact new-source race/2s and non-race/500ms diagnostics each pass 20 events with real full-facet positives and zero observer drops. They are qualification-ineligible. Matched historical requests use 49 fewer SQL calls, but combined source/history changes prevent typed-only or precise race-cost claims; formal race/500ms remains FAIL. Preserve score and external gates; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-13 — Measure complete Device quota phases and reduce existing-owner round trips
- Learn from the supplied full-path analysis without changing architecture authority: classify stable representations separately from live authority, retain Serializable/final rechecks and the formal 500ms limit, and reuse the existing owned fixture/observer.
- Four pre-P1 diagnostic cells are sealed separately: both non-race cells pass 20 events with required full-facet positives; race/500ms ends at subscription_final, while race/2s completes positives but exposes attachment-error mapping. Snapshot/receipt tail is now observed. No exact race-cost ratio, formal qualification or credit follows.
- P1 phase-local isolation reuse passes 238 real PostgreSQL events. Fresh post-Reserve Grant-history batch hydration and exact attachment mismatch mapping then pass 252 Grant plus 10 runtime-quota events; full Rolling still fails after two authority negatives. Current total is 2 PASS / 1 FAIL roots, 264 PASS / 3 FAIL test events, package results separate. Its Consent SQL deadline observation is not a proven cumulative root cause.
- Existing-phase typed/raw decode reuse is IN_PROGRESS / NOT_RUN. Preserve all source generations and external gates; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Observe existing quota SQL failures in the owned PG fixture
- Connect the existing bounded error observer through two test files, preserving production behavior, SQL, deadlines and assertions. The synthetic observer unit passes 10 test events; its fabricated errors are excluded from real PostgreSQL diagnosis.
- The real Rolling root passes two authority negatives then fails complete quota at observed 500ms. Its own SQL observer records an internal context deadline at sql_other, with one record and zero drops. Exact SQL and business stage remain unknown; the previous run's mapped failure retains its UNKNOWN cause. Combined 1 PASS / 1 FAIL roots, 12 PASS / 3 FAIL test events, package FAIL separate. Continue unclassified SQL and accumulated authority rechecks with no new CPU profile or credit; see the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Reuse complete Device quota roots after reservation
- Reuse the existing original-root batch in a fresh post-Reserve final phase, preserving route order, original owner/Service/attachment checks, clocks and the unchanged 500ms limit.
- Formal Linux/race checks pass 83 local-unit events and 10 real PostgreSQL runtime-quota events. The separate complete-media Rolling root passes two post-audit authority negatives, then fails its first full-facet quota call at observed 500ms with applicationruntime.Error / capability_authority_unavailable. Combined result: 4 PASS / 1 FAIL roots; 95 PASS / 3 FAIL test events; one package failure counted separately.
- Current original cause remains UNKNOWN and SQL is UNOBSERVED; elapsed time does not prove a raw deadline cause. Next reuse the existing bounded SQL failure recorder in the PG fixture before application error mapping, with a separate future source/run binding. No progress credit or complete-media PASS. See the source-bound implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Execute the existing Rolling diagnostic's mandatory positive cases
- Reuse the existing Rolling root with all original limits and assertions. Non-race diagnostic passes 18 events, explicitly exercising both peers' complete quota advancement, exact receipts, no-extra-reservation followup and existing rollback/revocation cases.
- Race diagnostic fails earlier in subscription preparation/dependency registration at 500ms, before positive quota cases. Its different exercised workload prevents a race-cost estimate; the non-race result remains qualification-ineligible.
- Preserve prior formal failures and the original public-media pair's coverage gap. Continue the observed 500ms preparation path without new gates or progress credit. Exact source, actual terminal evidence and cleanup are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Require comparable quota work before interpreting race diagnostics
- Preserve the source-matched diagnostic outcomes: race full-quota failure, and non-race media-root 11-event PASS with zero recorded quota calls. Both profiles remain qualification-ineligible; no non-race 500ms quota PASS or race-cost conclusion follows.
- The non-race fixture finished without entering a refresh window. Next reuse TestRTCDeviceMediaRollingInPostgres, with its existing real-window wait, mandatory full-facet advancement and exact receipt assertions. Keep all original time bounds and race qualification; no new test source or acceptance gate.
- The separate 236-event real PostgreSQL PASS and formal full-media failure remain unchanged. Same-source evidence, differing workload coverage, cleanup and unchanged progress are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Reuse same-call Consent facts and combine Delegation reference discovery
- Copy dependency facts immediately after existing consumed-Consent verification; later checks still reread storage. Combine bounded immutable Delegation reference discovery while preserving full validation, fresh authority and the original 500ms quota budget.
- Preserve the first run's SQLSTATE 55006 fixture failure and its two later NOT_RUN lanes. Correct only premature trigger-restoration DDL; the rerun passes four real PostgreSQL roots / 236 events, including Consent, Delegation and subscription recovery.
- Complete Device media remains failed: 501ms observed, capability_authority_unavailable, with no exact internal cause or SQL timing established. A bounded diagnostic may distinguish race cost, but cannot replace race qualification or grant credit. Exact deltas, both source-bound runs, cleanup and external limits are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Combine Device media audit with its adjacent fresh clock
- Preserve every original audit predicate, authority, expiry and error boundary in one conditional SQL read; no clock cache, omitted check or 500ms budget change. Expand only the opt-in diagnostic fingerprint capacity from 64 to 128.
- Linux/race affected checks pass 2 roots / 18 events: one diagnostic unit root and one real PostgreSQL subscription-recovery root. Full Device media still fails its first 500ms quota refresh; SQL timing remains unobserved in that formal run.
- The separate ineligible diagnostic fails with 1039 queries / 355732us cumulative SQL, 113 fingerprints / zero drops, reservation complete and no snapshot/receipt INSERT observed. Its last failed query is SHOW transaction_isolation, not rollback or an identified unique cause. Continue removing proven duplicate authority reads within existing boundaries; no complete performance PASS or progress credit. Source, cleanup and external limits are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Reuse current Device Grant rows across already-locked roots
- Use one bounded lexical raw read after original Grant locks and the full principal fence union. Preserve Device dual-subject/pair semantics, original root-slot parsing, fresh expiry checks and final fences; negative or malformed roots return to the original reader. No phase authority cache or Human reader substitution is introduced.
- Linux/race Grant regression passes 235 events, including nine new cross-root/expiry/fallback scenarios. The original full-media root still fails its first 500ms quota refresh; current SQL timing remains unobserved, so no measured end-to-end improvement is claimed.
- The separate changed-source SQL diagnostic also fails: 1083 queries / 355886us cumulative SQL, reservation complete and no snapshot/receipt write observed. Retained fingerprints are incomplete and the final failure is rollback cleanup; deadline-truncated counts do not prove full-workload gains. Next examine adjacent SQL/fresh-clock reuse. No further implementation has been made; this candidate remains unverified. Source, cleanup, unchanged progress and native NOT_RUN are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Combine the Device batch's adjacent isolation and clock reads
- Restrict the 17-line addition / 4-line removal to the existing original-record handoff after Application union locks. Keep a live Serializable check, fresh clock, complete authority and unchanged nil-original path; introduce no time cache or omitted locks.
- Linux/race Grant regression passes 226 events, including three real invalid-transaction cases. The original full-media root still fails its 500ms quota budget with pgconn.errTimeout; current SQL timings and the exact failing stage remain unobserved. This is not complete performance qualification.
- Continue reviewing compatible same-phase Device current-Grant reads, preserving dual-subject/pair semantics, per-root clocks and error order. Do not substitute the Human reader or repeat diagnostics solely for this small change. Exact source, cleanup and unchanged progress are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Batch Device denial-candidate discovery within the existing phase
- Reuse the existing bounded phase map for one unlocked candidate batch; preserve full authority/history/selector checks, original lock order and the shared 256 KiB limit. Invalid results or insufficient space retain no partial batch. Actual SQL errors fail closed through the original classifier and may be reported earlier.
- Linux/race Grant correctness passes 223 test events, including 13 new scenarios; the original full media regression still fails its 500ms quota owner. A separate changed-source sql-only-v1 diagnostic also fails: 1063 queries / 357556us cumulative SQL, reservation completed but snapshot/receipt not reached. Deadline-truncated counts do not establish complete performance gains; rollback remains cleanup evidence.
- Continue a narrow review of repeated isolation reads while retaining live-transaction/error boundaries, clocks, locks and final freshness. No progress credit or native qualification is claimed. Both source-bound runs, prior evidence and owned cleanup are retained in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Attribute the remaining Device full-quota deadline
- One existing sql-only-v1 PostgreSQL diagnostic retains the original race/500ms assertions and fails the public media root:1020 queries,357412us SQL total, longest3044us. Reservation completes; snapshot/receipt writes are not reached. The last failed query is cleanup rollback, and the bounded query mix cannot identify a lock holder or unique cause.
- Preserve DIAGNOSTIC_FAIL/qualification ineligible, previous six recovery-case PASS and separate unit/native evidence. Next inspect same-phase repeated owner reads without removing final freshness, widening budgets or claiming a fix. Source, cleanup and unchanged progress are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Recover confirmed Device public subscription preparation rollback
- Rebuild Device public subscription preparation once only after a successful raw pre-Atomic40001 rollback, preserving the original5000ms deadline and full authority. Keep Authorize, Human, Packet, replay and Commit recovery unchanged. Six real PostgreSQL fault-injection scenarios pass; separate Linux/race boundary units pass2 roots/20 events.
- The original full media regression still fails its500ms quota refresh, so the combined PostgreSQL run is1 root PASS/1 FAIL with9/3/0 test events. Native is NOT_RUN for this correction; preserve the previous native failure at its original source. Continue with the existing sql-only-v1 diagnostic, without relaxed limits or progress credit. Exact source, cleanup and both outcomes are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Attribute native owner SQL failures and first disconnect
- Reuse the installed fixture tracer for bounded lifecycle/quota SQL attribution and retain the first original Room disconnect. Preserve authority, deadlines and runtime behavior. Linux/race diagnostic checks pass4 roots/38 events; synthetic Node VM checks pass7. These are not native or new PostgreSQL qualification.
- The actual native run fails both roots differently: parent subscription HTTP500 with a same-request40001; and first JOIN_FAILURE during publish, followed by an install-precondition failure. Observed lifecycle lock/deadline and quota cancellation records do not identify the conflicting transaction or prove the close cause. Preserve exact evidence, cleanup and unchanged progress in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md). Continue the existing subscription/upstream-close investigation; no fix is claimed.
2026-10-12 — Recover confirmed publication projection rollbacks
- Rebuild the complete signed-publication projection once after a confirmed pre-commit serialization rollback, inside the original500ms budget. Preserve original authority, atomic inbox/projection and both Commit no-retry boundaries. Actual Linux race PostgreSQL passes3 roots/35 events with real fault injection; the replay Commit witness is explicitly not natural read-only SSI.
- Both subsequent native roots pass exact publication readiness, then fail before media installation because the SDK session is closed. Lifecycle deadlines and quota cancellation/40001 remain unresolved; no media or progress credit follows. Source-bound results, owned cleanup and the next narrow attribution step are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Check each original publication and expose lifecycle failures
- Correct Device native readiness to require each of the four original publications and its exact signed receipt, while accepting legitimate repeated deliveries for the same tuple. Keep the six-second deadline and add bounded failure-only state readback.
- A transparent test-only lifecycle observer and existing diagnostics pass3 Linux/race roots/30 events. Native evidence confirms publication preparation can recover a serialization failure, but later lifecycle deadline/conflict and connection-close failures still prevent complete media qualification. Preserve both distinct outcomes, source bindings and cleanup in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md); the next projection recovery change requires separate validation.
2026-10-12 — Bound signed join setup and identify publication SQL failure
- Reuse the original Room setup deadline to verify both exact signed joins before publishing; enforce it on setup SQL and preserve all original media/authority assertions. Add bounded request-correlated publication SQL and public Packet-policy diagnostics through existing observers. Linux race diagnostics pass39 events and Node transparency checks pass13; no production authority, SDK runtime or upstream patch change.
- Both actual native roots remain failed: RootRevoke reaches an audit INSERT40001 at82ms; Exhaustion publishes both peers, then records quota cancellation and a closed session before Packet install. Preserve distinct historical outcomes, original deadlines, source-bound evidence and cleanup in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md). Complete native continuity remains open; no new qualification credit.
2026-10-12 — Isolate known local AdGuard injection in browser proofs
- Reuse the existing browser route guard to block and separately record exact local AdGuard injection. Other unexpected external requests still fail; AdGuard and OS settings remain unchanged. Windows Mock passes90 checks with148 known requests blocked and0 unexpected external requests; focused Node checks pass45/0/0. Preserve separate revision6 real Local API22-check evidence, historical failures and pending complete Web RC/Owner visual acceptance in the Web report (
../web/GX10_WEB_LOCAL_RELEASE_REPORT.md). - Preserve exact clipboard content with Windows-only CRLF/LF equivalence and raw evidence; downloads remain byte-exact and hydration errors fail the browser proof. Full-page Room captures retain actual UI rather than hiding navigation.
- Move an existing Device fixture Room-readiness wait before the second original client replay. Both peers now replay and join in both native roots; later audio/data publication still fails, so complete native qualification remains open. Focused Linux race checks pass12/0/0. Exact source, retained failures, unchanged security assertions and owned cleanup are in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Correct paid-Agent multi-party retirement verification
- Replace a single-participant empty-Room assertion in the existing paid-Agent test with exact withdrawn identity/SID absence, retaining the real RoomService, original time limit and independent publisher checks. No runtime or upstream patch change.
- Bounded retirement diagnostics pass two real Linux/race roots. Native v6 exposed the helper mismatch; native v7 fails earlier at Human subscription delivery after receiver-to-owner budget consumption. The corrected final check has not yet been exercised; native qualification remains open. Preserve all exact-source failures and next steps in the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md). - Same-request prefix diagnostics and actual PostgreSQL Service verification pass2/0/0; the subsequent bounded-output check passes1/0/0. Native v8 passes paid media but still fails the Agent retirement predicate. It proves an existing expiry owner requested revocation; original Grant ordering and the diagnostic's historical-versus-effective policy-version relation still need exact proof. No runtime relaxation or complete native PASS is claimed.
- Add the locked live Grant-withdrawal boundary and strict Agent-only Release/expiry/effective-receipt evidence. Focused v2/v3 failures are retained; v4 passes3/0/0 after reusing the original publisher's own Service/session report and real effectiveness owner. The unchanged full native v9 root now passes3/0/0, including actual paid media, original Grant withdrawal, precise closed-peer absence, preserved independent publisher and unchanged liability. Historical intermittent failures remain unresolved; Device media and admitted-tail settlement remain open. Exact sources and cleanup are recorded in the implementation checkpoint; no additional milestone credit or external qualification is claimed.
2026-10-12 — Preserve retryable subscription conflicts after confirmed rollback
- Correct failed Human subscription preparation so a confirmed SQLSTATE40001 rollback returns the existing retryable500/resource_state_invalid response instead of a misleading403. Genuine authorization denial, rollback uncertainty and commit failures are not promoted or automatically retried.
- The targeted Linux/race unit and real PostgreSQL concurrency roots pass13/0/0, including single-effect retry/replay and denial after original Grant revoke. Bounded test-only public-stage/SQL-fingerprint diagnostics separately pass13/0/0. Native v5 crosses the real paid segment and verifies expired material denial plus original Grant withdrawal, but fails its final compound Agent/recipient retirement assertion. The earlier intermittent public409 remains unexplained; no complete native/cloud qualification is claimed. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-12 — Qualify existing Console writes through local development
- Reuse the existing Consent/Room and Delegation proofs through the real Local API development URL, preserving explicit confirmation, protected replay, revocation and no Mock fallback.
- The new local browser run passes15checks/7screenshots; the separately rerun full Gecko/WebKit Console proof and42artifact/source checks pass. Preserve earlier evidence and the remaining full CRUD, Web RC, Owner visual and external qualification limits in the Web report (
../web/GX10_WEB_LOCAL_RELEASE_REPORT.md). - No business runtime, SDK, migration or LiveKit patch change is introduced by this test-helper reuse.
2026-10-12 — Adopt the OneSay Web dual-theme design system
- Archive the Owner's exact dual-theme specification. Share semantic tokens across Marketing Purple and Developer Orange-Blue; Portal, Docs and Console select Developer Theme at server render.
- Reuse the existing official OneSay logo, Next.js application, canonical routes, API client and session authority. Add local directory search, responsive documentation navigation, accessible code controls and source-backed API reference views.
- Preserve explicit Mock/Local API boundaries. Browser, source-bound build and visual qualification are recorded separately in the Web release report; no cloud or Production release follows this change.
2026-10-12 — Add isolated local Web development modes
- Reuse the existing Next Portal/Docs/Console, public API client and signed local API fixture for explicit Mock and real Local API development commands.
- Keep mock data labelled, development configuration out of production builds, and local browser evidence separate from cloud, real ZITADEL and Owner visual acceptance.
- Render existing canonical Portal/Docs sources as readable text, code and tables with registered local navigation and source provenance; preserve the standalone Console host boundary.
- Add an owned Linux full Console session proof using the existing Consent, Delegation and session tests; retain source-bound receipts separately from Mock/read-only smoke evidence.
- Adopt the additive GX10 Web requirements without changing the active M1 denominator. See the local development guide (
../web/WEB_LOCAL_DEVELOPMENT.md) and capability matrix (../web/GX_WEB_TRACEABILITY_MATRIX.md). Local qualification is in progress; these changes do not announce UI release readiness.
2026-10-11 — Validate Agent recipient current-receipt storage rejection
- Complete Linux race PostgreSQL root passed 31/0/0, including five exact storage rejections at both media refresh and quota advance; rejected requests leave no authorization or payment side effects.
- Reuse the existing paid lifecycle and fix only second-Agent fixture Consent, original snapshot order and the optional already-entered-window wait. Preserve prior failures and the original 500ms budget.
- Actual native Grant revoke/later preparation, Device media and admitted-tail settlement remain open. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Qualify actual Agent media across a paid boundary
- The complete native paid-media root now passes3/0/0: actual advancing media crosses the original paid segment, uses its exact successor receipt, and completes public Stop plus original joined cleanup/release.
- Replace only the PaidMedia fixture's stale short-run count with exact per-request validation: three initial admissions and every actual quota refresh, verified again after native drain. Current run observed seven successful refreshes; denied/deferred branches are not credited by this run.
- Preserve the500ms budget, earlier failed receipts and all external NOT-RUN gates. Current-Agent storage/revoke negatives, Device media and admitted-tail settlement remain open. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Retain exact Stop cleanup after transport input failure
- Reuse original joined-failure cleanup for transport-only jobs; only an exact Stop and actual joined close produce ACK, with no Usage and the original error preserved. No cleanup-budget reset or native500ms change.
- Full Linux Python regression passes289/0/0. Native v21 crosses the paid boundary and completes Stop/close/release assertions, but remains FAIL2/1/0 at the stale final foreground-request count; the additional refresh requests require exact receipt validation before correcting that fixture.
- Preserve all prior source-bound results and external NOT-RUN gates. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Reuse early dependency locks across Agent preparations
- Ordinary admission and standalone Agent input preparation now reuse the publication path's early base/input selector locking; complete final authority and post-reservation refresh behavior remain.
- Seven complete PostgreSQL/race roots pass64/0/0, including actual conflict/rollback/retry and final Source/Worker Grant withdrawal. Source integrity and owned cleanup pass.
- Native paid-media v19 remains2/1/0: complete Agent refresh loses budget after claim conflict and Room wait. Preserve the failure and its exact source; no paid continuity, external qualification or progress credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Human recipient pre-reserve target projection
- Reuse the existing target pass before quota reservation; retain complete final authority for both paid and deferred results, exact transaction binding and the 500ms budget.
- Six complete PostgreSQL roots passed in the initial 32/3/0 run; a narrowly corrected claim-release assertion passes the affected complete root separately at 5/0/0. Preserve both source receipts and the initial failure.
- Native v18 remains 2/1/0: earlier Agent input selector registration hits two serialization conflicts and fails at 349ms before recipient refresh. No native performance, paid-boundary or progress credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Reuse original-Grant batch in Human connection proof
- Reuse the existing bounded Grant batch for initial/final connection checks; preserve exact original Grants, denial histories, Consent, quota and the500ms deadline.
- Five actual PostgreSQL roots passed; correct the new observer's pgx option handling and the affected Agent root passes separately. Preserve both source-bound receipts and the initial313/2/0 failure.
- Actual native paid audio remains2/1/0: recipient refresh reaches1126 queries and494ms before cancellation. No paid-boundary, cloud or progress credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Early complete Agent refresh dependency rendezvous
- Reuse existing selector locks before final proofs, then independently recheck the complete final union and all generations. Keep actual payments, all authorization/storage guards and the500ms deadline unchanged.
- PostgreSQL follow-up passes48/0/0 across five complete affected roots after correcting test audit classification. Preserve the original116/4/0 run and its own source. Actual native paid media still fails2/1/0: Room lock wait and claim conflict consume the retry budget. No weighted credit or external qualification. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent output lifetime after paid continuation
- Keep first-use binding expiry distinct from admitted output's original hard ceiling. Expired first publication and late ACK still fail; native authority and Stop can still close earlier.
- Local component regression:284 passes with3 missing-fixture failures, then corrected focused PASS3/0/0 on the same Python source. Native paid-media result:FAIL 2/1/0. Preserve all source bindings and remaining gates; no added credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent paid-media owned supervisor correction
- Select the existing fixed two-segment supervision duration for the long Agent paid-media fixture, so native host and authority child outlive its original paid boundary. Production500ms and all authority/RTP/receipt assertions remain unchanged.
- Source-bound actual native result: FAIL 2/1/0; preserve the previous90s-supervisor failure and prior source bindings. No score increase, model/cloud/hardware or settlement credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent snapshot batching and recipient receipt correction
- Batch complete Agent authority snapshots under the existing canonical selector lock, preserving individual provenance and deadline/storage guards; batch-only PostgreSQL race regression passed45/0/0. Recipient capture uses the explicitly receipted current snapshot while retaining the first attachment.
- Complete the original Agent audio recipient receipt guard in migration165. Latest source authority units35/0/0 and migration safety34/0/0 pass; actual native continuity remains FAIL2/1/0 because concurrent Agent output preparation exhausted its unchanged500ms budget. Preserve the preceding initialization and runtime failures and exact source bindings; no progress credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent recipient rolling coverage
- Reuse original Agent authority and complete paid input/output receipts for Human recipients, keeping immutable business hard deadlines separate from charged coverage and short first-use material. Migration165 preserves old rows and exact native attachment/claim ownership.
- Current authority units29/0/0 and migration safety34/0/0 pass. Real cross-segment native qualification remains FAIL2/1/0: latest initial recipient audio succeeds, but Agent refresh_receipt exhausts the unchanged500ms budget. All prior failures and source bindings remain recorded; no progress credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Native terminal funding tail correction
- Preserve original paid media until its exact expiry when less than a whole billing second remains under the existing hard ceiling; do not schedule an impossible renewal that closes the attachment early. No new payment, grace or authority.
- Current source:436/0/0 Linux race events across99 roots and3/0/0 real official Worker audio/stop events. Preserve the preceding native failures, bounded Consent rollback recovery and exact source manifests. Multi-segment continuity, Device media and settlement remain open. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent native quota enrollment (in progress)
- Enroll original Agent execution/claim authority through the existing native quota coordinator and audio runtime leases. Revoke now closes the owned quota and child media clocks before native invalidation. No upstream patch growth.
- Source-bound component regression: 423/0/0 across 99 rtcpolicy roots; current adapter regression: 163/0/0 across 16 roots. Prior failures are retained. Real initial native audio qualification ended FAIL (2/1/0): output was published, but the Worker stopped before recipient delivery while quota remained live. Preserve the failed receipt and diagnose the actual admission/refresh phase; paid media continuity, effective revoke, Device deadlines and settlement remain open. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent complete durable media renewal (in progress)
- Commit complete original Agent input/output/base quota snapshots atomically through the existing owner and migration164. Retain exact predecessor/attachment/claim and current authority checks; reject missing, stale and crosswired media without partial payment.
- Separate new output business hard from original short first-use material; keep historical rows and old deadlines immutable. Actual paid renewal now passes without extending the500ms bound, and expired material remains denied. Current Agent regression passes32/0/0 and same-source Human/material compatibility passes11/0/0; both earlier failures remain preserved. Migration safety tests pass34/0/0. Native Agent enrollment/continuity, Device media and settlement remain open with no weighted credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent media clock correlation and source processing (in progress)
- Preserve exact Agent execution/claim correlation through the existing private quota/media clock coordinator, including all-or-nothing updates and original snapshot/marker checks. Source-bound unit regression passes414/0/0 across98 roots; native Agent rolling remains disabled.
- Reuse the source-change processor for exact paid Agent successor captures and select the latest receipt before matching the current snapshot. Real PostgreSQL/race regression passes22/0/0 across four complete roots, including no spurious revoke after old quota expiry, original Grant revoke, replay rejection and unchanged paid liability. Durable media receipts, native continuity, Device media and settlement remain open. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent own paid renewal owner (in progress)
- Reuse private Agent admission and quota/receipt owners for actual paid quota_advance and same-reservation current-input refresh; add migration163. Preserve original authority, independently renewed Worker claims, exact attachment lineage, immutable prior liability and all operation bounds.
- The complete affected native-admission PostgreSQL/race root passes13/0/0 after correcting SQL generation and fixture scheduling. Preserve the previous eight passing roots within their failed source-bound run, plus both failed attempts; do not claim a current nine-root PASS. Complete native input/output renewal, media activation, Device media and settlement remain open, with no weighted credit. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent current input and publisher renewal (in progress)
- Capture an exact paid publisher receipt at new Agent native admission while retaining immutable first provenance and original hard limits; add migration161. Three separately source-bound local suites pass 56/0/0, 40/0/0 and 173/0/0. These qualify the 350-file increment, not later changes or native media delivery.
- Allow Human publisher renewal while an Agent exists through the existing refresh owner and migration162. Preserve captured Agent authority and expired-claim rejection; current 352-file runtime qualification passes 57/0/0 across nine complete roots. The first adapter attempt timed out before tests and remains failed; affected Human publication regression passes 8/0/0, and the adapter run with actual compiler-output forwarding passes 4/0/0 with unchanged Linux ELF hashes. Current Agent core regression passes 75/0/0; all four current lanes are separately recorded against the same 352-file source snapshot, with the earlier failed adapter attempt retained. Keep Device protections, all deadlines and historical failures. Agent-own rolling and settlement remain open; no weighted credit is added. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md).
2026-10-11 — Agent hard and funded input coverage (in progress)
- Separate new Agent execution hard limits from current funded input coverage; reuse existing receipt/quota authority and cap Worker leases and native use without widening execution/model ceilings. Add migration160 origin/claim guards, including an actual lock-wait expiry recheck.
- Complete both affected PostgreSQL/race roots: 75 passed, zero failed/skipped. Exercise genuine receipt adoption, real funding expiry, strict receipt negatives and lease rollback. Preserve the earlier source-bound 70/0/0 result and both later failures instead of rebinding them.
- Correct an old signed-observation fixture SID and forward genuine child-test progress to the bounded runner, preserving every timeout and assertion. Native current-input integration, Agent rolling and admitted-tail settlement remain open; no weighted credit or cloud/native-media qualification. See the implementation checkpoint (
../development/M1_IMPLEMENTATION_LOG.md) for exact hashes and evidence limits.
2026-10-10 — Original self-Device connection rolling quota
- Existing self-Device connections retain original identity-token, credential, Delegation, Grant, Consent, attachment and hard-lifetime authority across finite operational quota renewal. Expired material cannot create a new attachment. Device media and Agent rolling remain closed.
- Original Linux race 200/0/0; original PostgreSQL 316/0/0; current PostgreSQL 325/0/0; corrected adapter race 194/0/0; actual native 6/0/0; migration 41/0/0. See source-bound evidence (
../development/evidence/m1-v3-gx10-device-rolling-abeb73fa/index.json). Preserve all original formal failures, diagnostic-only evidence and per-lane source bindings; no weighted credit, billing settlement or external acceptance inferred.
2026-10-10 — Human Packet, Streams and RPC rolling quota
- Original Human Packet, Streams and RPC retain complete server authority and one native guard across operational quota renewal; immutable first-use material and historical NULL bounds remain. Device/Agent modes and admitted-tail settlement remain open.
- Local race 601/0/0; PostgreSQL 112/0/0; adapter 33/0/0; actual native 3/0/0; JS units 215/0/0; ESP32 host 272/0/0; migration 37/0/0. See source-bound evidence (
../development/evidence/m1-v3-gx10-packet-rolling-5df8635c/index.json). Preserve original failures and per-lane bindings; no weighted credit or external acceptance inferred.
2026-10-10 — Human DataTrack rolling quota
- Human DataTrack and mixed audio/DataTrack reuse the original rolling quota owner and server authority. Keep immutable original target/material boundaries, native limiter/replay state, and finite revoke/exhaustion behavior; Packet/Device/Agent rolling modes remain open.
- Local race 303/0/0, owned PostgreSQL 58/0/0, native adapter 42/0/0, actual installed-SDK/native 2/0/0, SDK unit 161/0/0, and contract/migration 39/0/0 passed. Preserve both SDK failure diagnostics and the generator correction. See evidence (
../development/evidence/m1-v3-gx10-datatrack-rolling-11356c0c/index.json). Historical populated upgrade and external qualification remain NOT_RUN; no new weighted credit.
2026-10-09 — Proven unused initial RTC allowance
- Release only the original unused operational reservation for newly enrolled Human/self-Device connections with no native admission history and an exact same-transaction effective proof. Preserve original quantities and all admitted, unknown, historical and Agent liabilities; bind the release audit by primary key. No Usage, monetary refund or settlement is inferred.
- Local affected race 18/0/0, owned PostgreSQL 389/0/0 and contract/migration 39/0/0 passed; generated Go compilation, TypeScript and Linux C syntax passed. See evidence (
../development/evidence/m1-v3-gx10-rtc-unused-allowance-7a1ff87e/index.json). Historical populated 154-to-155 upgrade, native media, paid Provider and external qualification remain NOT_RUN.
2026-10-09 — Remaining Agent observed Usage dimensions
- Add seven original STT/TTS token, model-connection and request metrics to the single Usage ledger, preserving prior source identities, bounded shared work, exact quantities, replay and Owner reversal. UNKNOWN/nonbillable; no inferred duration, cost or hold release.
- Local affected race120/0/0, owned PostgreSQL19/0/0 and contract/migration45/0/0 passed; generated Go compilation, TypeScript and Linux C syntax passed. See evidence (
../development/evidence/m1-v3-gx10-agent-remaining-6cf229ab/index.json). Actual historical populated upgrade, paid Provider and external qualification remain unexecuted.
2026-10-09 — Native RTP observed Usage projection
- Project original upstream/downstream RTP categories once through the existing Usage ledger/outbox, with exact counters, shared Agent/native batch limits, atomic rollback and Owner reversal. Observations remain UNKNOWN/nonbillable; no quota or liability is released.
- Local affected race122/0/0, owned PostgreSQL14/0/0 and contract/migration39/0/0 passed. Generated Go compilation, TypeScript and Linux C syntax passed; earlier validator/C failures remain archived. See evidence (
../development/evidence/m1-v3-gx10-native-usage-65544ea5/index.json). Financial settlement and external qualification remain open.
2026-10-09 — Native audio statistics delivery
- Activated official native composition and bounded authenticated media transfer to immutable original-identity receipts. Added fixed operational metrics and finite retry/shutdown loss accounting; no upstream patch growth.
- Fixed advisory media's next-poll budget reservation. Final affected race371/0/0 and actual SDK/native audio1/0/0 passed; original owner26/0/0 and native104/0/0 evidence retains its source. Receipts remain UNKNOWN/nonbillable; Usage projection and settlement are open. See evidence (
../development/evidence/m1-v3-gx10-native-media-transfer-a42fea92/index.json).
2026-10-09 — Durable native media observation receipts
- Added private signed media ingestion and immutable original consumer/publisher receipts with exact counters, nanosecond clocks, conflict fencing and historical post-revoke attribution. Observations remain UNKNOWN/nonbillable; no current permission is restored.
- Local protocol race 200/0/0, corrected owned PostgreSQL 21/0/0 and migration33/0/0; initial fixture skips remain a recorded failure. Host delivery, Usage projection and financial settlement are still open. See evidence (
../development/evidence/m1-v3-gx10-native-media-owner-da31e42b/index.json).
2026-10-09 — Native analytics capture preparation
- Added a bounded private audio/Opus RTP statistics adapter with exact counters, immutable scalar capture, explicit loss and UNKNOWN/nonbillable semantics. Reused the actual official telemetry worker; no upstream patch or public SDK change.
- Added deterministic pinned host-composition generation and separate self-contained artifact / real-source regeneration checks. Startup still uses the existing initializer until durable authenticated ingestion is ready.
- Local source-bound Linux race101/0/0 and Node9/0/0; tenant attribution, durable Usage ingestion, complete settlement and external qualification remain open. See evidence (
../development/evidence/m1-v3-gx10-native-analytics-85acf3e2/index.json).
Unknown Provider money remains unknown — 2026-10-09
Preserve missing Provider costs as null and stop generating zero-money Usage facts from unpriced observations. Keep Task quantities, replay and quota settlement intact. Evidence and limits (../development/M1_STATUS.md#unknown-provider-money-remains-unknown--2026-10-09).
Human duplex audio across original quota expiry — 2026-10-09
Refresh complete Human audio publisher/receiver proofs on the original native attachment while preserving first-use expiry, original authority and held liability. Verify both installed SDK consumers continue simultaneous decoded audio beyond their original quota windows; old connection material still cannot rejoin. Separate receiver material expiry from active-policy lifetime in the canonical SDK contract. Evidence and remaining scope (../development/M1_STATUS.md#human-duplex-audio-across-original-quota-expiry--2026-10-09).
Current RTC SDK actual media qualification — 2026-10-09
Verify the publication-lifetime SDK package through the formal two-consumer audio and signal-recovery path. Original authorization and expiry limits remain enforced. Source-bound result and limitations (../development/M1_STATUS.md#current-publication-lifetime-sdk-media-qualification--2026-10-09).
Formal RTC connection state and audio recovery — 2026-10-09
Display the existing public SDK connection state separately from operation results. Verify explicit subscription reauthorization after signal recovery produces fresh decoded audio while retaining original authority. Evidence and limits (../development/M1_STATUS.md#formal-audio-recovery-through-public-session-state--2026-10-09).
Existing Linux native contract gaps closed — 2026-10-09
Run the existing actor-chain and Go/C/C++ selector checks in Linux: original suite34/0/0. The two Windows-skipped scopes now have actual execution evidence; delegated runtime remains inactive. Qualification (../development/M1_STATUS.md#existing-linux-native-contract-gaps-closed--2026-10-09).
Original Human attachment quota refresh — 2026-10-09
Keep an authorized empty Human native connection alive across its old quota/JWT deadline using a separately committed finite quota receipt. Old reconnect material remains expired; existing media deadlines and unknown liabilities remain intact. Qualification and limits (../development/M1_STATUS.md#original-human-attachment-runtime-quota-refresh--2026-10-09).
Exact media-key receiver membership inputs — 2026-10-09
Reuse the complete subscription authority owner to bind one Human receiver to an exact audio publication and original expiry. Cross-scope, stale and revoked inputs deny; key issuance and public E2EE remain unavailable. Evidence and limits (../development/M1_STATUS.md#exact-media-key-receiver-membership-inputs--2026-10-09).
Agent state recovery and product handoff — 2026-10-09
Complete local selected-Agent state recovery qualification and document the advisory state/quality API. Original Signal recovery and later Selection replacement retain distinct native receipts; old connection restoration stays forbidden. Evidence and limits (../development/M1_STATUS.md#agent-state-recovery-integration-and-handoff--2026-10-09).
Consent original-owner preparation recovery — 2026-10-09
Check the original pending request owner before returning a prepared Consent committer. Recover one confirmed preparation serialization rollback within the original deadline while retaining current authority and caller cancellation. Completion and Commit are never retried. Evidence and limits (../development/M1_STATUS.md#consent-original-owner-preparation-recovery--2026-10-09).
Human quota conflict recovery — 2026-10-09
Recover one confirmed preparation rollback within the original request deadline. Concurrent next-segment requests both succeed while committing one new reservation; protected replay still checks current Grant/Consent. Atomic completion/commit is never retried. Evidence and limits (../development/M1_STATUS.md#human-quota-preparation-conflict-recovery--2026-10-09).
Explicit Human quota continuation — 2026-10-09
Fresh Human admission can append a bounded quota segment after natural expiry while preserving old liabilities, identity and original proof deadlines. Real PostgreSQL concurrency and storage guards pass. Automatic native renewal and settlement remain separate. Evidence and migration boundary (../development/M1_STATUS.md#explicit-human-next-quota-segment--2026-10-09).
Consent preparation conflict recovery — 2026-10-09
Retry one confirmed pre-commit serialization rollback within the original Consent deadline, rechecking all authority. Preserve exactly-once receipt/audit/cache and deny revoked Grants. Current SDK strict and reproducible package builds also pass. Evidence and remaining scope (../development/M1_STATUS.md#consent-preparation-recovery-and-combined-sdk-build--2026-10-09).
Agent observed TTS characters and audio duration — 2026-10-09
Project original TTS character/audio observations once into the existing nonbillable Usage ledger; preserve old terminal cursors, original authorized reversal and unsettled liability. Evidence and remaining scope (../development/M1_STATUS.md#agent-observed-tts-characters-and-audio-duration--2026-10-09).
Private official RTC encryption component — 2026-10-09
Add a private pinned KeyProvider/worker preparer and package the exact official worker with its license under the sole stack lock. Public E2EE stays unsupported until server key membership, rotation and authorized decryptor integration are complete. Actual component evidence and limits (../development/M1_STATUS.md#private-official-rtc-encryption-component--2026-10-09).
RTC RPC developer and operator handoff — 2026-10-09
Document explicit RPC policy and lifecycle, fixed Action authority, uncertain-effect reconciliation and original Signal recovery limits. Retain the known first-call availability risk and original source-bound qualification. Runbook (../runbooks/RTC_RPC.md).
Agent observed STT duration projection — 2026-10-09
Project original final STT audio duration once into the existing nonbillable Usage ledger with exact decimal conversion, bounded durable cursor, backfill and authorized reversal. Preserve completed token projection and unsettled liability. Evidence and remaining scope (../development/M1_STATUS.md#agent-observed-stt-duration-projection--2026-10-09).
Example developer/operator handoff — 2026-10-09
Connect the existing Task, RTC and Agent consumer instructions from the canonical examples directory. Clarify credentials, explicit lifecycle, original-source evidence and external limits. Documentation only; no native rerun or publication. Evidence and scope (../development/M1_STATUS.md#example-developeroperator-handoff--2026-10-09).
Formal example Streams and DataTrack integration — 2026-10-09
Qualify the unchanged browser example with actual text/byte Streams and original DataTrack operations. The successes come from separate source-bound runs; historical failures remain preserved. Correct only fixture listener order and existing room-version readiness, with product permissions and deadlines intact. Evidence and limits (../development/M1_STATUS.md#formal-example-streams-and-datatrack-integration--2026-10-09).
Playback developer/operator handoff — 2026-10-09
Add the playback operations guide (../runbooks/AGENT_PLAYBACK.md) and correct stale adapter/command notes. Cover public owner/receiver flow, honest graceful and failed cleanup, secrets, validated entries and fault diagnosis. Local contracts pass 75/0/0; existing native evidence is reused without rebinding. External qualifications remain NOT-RUN.
Native SDK playback and formal Agent closeout — 2026-10-09
Qualify installed SDK original Agent output, advisory state, stale-policy rejection and joined stop, together with unchanged formal Agent create/get/stop/get UI: 6/0/0 actual native tests. Match the exact official metadata profile, forward original first-frame lifecycle and join original Room EOS without extending deadlines or changing upstream code. Failure cleanup retains the execution error and emits no final Usage observation. Local 208/37/18/18/23 and historical failures remain source-bound. Evidence and remaining scope (../development/M1_STATUS.md#native-sdk-playback-and-formal-agent-closeout--2026-10-09).
Native subscription conflict detection — 2026-10-09
Moved existing selector rendezvous ahead of final rechecks while preserving original lock order and complete authority. Real PostgreSQL tests pass and SDK audio now decodes; joined Agent stop remains a recorded failure. Evidence and limits (../development/M1_STATUS.md#subscription-conflict-detection-and-actual-sdk-audio--2026-10-09).
Formal RTC example audio validation — 2026-10-09
The existing browser example now has actual authorized publication/subscription, decoded audio, mute/unmute and clean-close evidence. Agent example operations remain open. Results and limits (../development/M1_STATUS.md#formal-example-audio-integration--2026-10-09).
Formal RTC example network validation — 2026-10-09
Verified the unchanged browser example with actual authorized packet and echo-RPC exchanges, plus clean close. The current Agent-state SDK package also passes independent consumer checks. Audio/Agent example flows remain open. Evidence (../development/M1_STATUS.md#formal-example-packetrpc-and-current-state-package--2026-10-09).
Subscribed Agent UI state — 2026-10-09
Added session.audio.agentStates and bounded onAgentStatesChanged notifications for currently authorized audio subscriptions. The Agent producer reuses official native state attributes while retaining custom I/O and server authority. Validation and limits (../development/M1_STATUS.md#bound-agent-ui-state--2026-10-09).
SDK delivery and migration regression — 2026-10-09
Verified the latest public SDK lifecycle and unsupported-encryption behavior from its independently installed package. Repaired seven stale migration compatibility expectations; all33 existing static migration tests pass with safety checks intact. Source-bound results (../development/M1_STATUS.md#sdk-package-and-migration-regression--2026-10-09).
Explicit RTC encryption support and Agent result limits — 2026-10-09
The JavaScript SDK rejects unsupported connection options before network or authentication and reports its own E2EE support accurately. Agent Task result limits now have real PostgreSQL64/65, replay and generation-fence regression evidence. Evidence and incomplete scope (../development/GX10_PRIVACY_LOCAL_QUALIFICATION.md).
RTC lifecycle observation — 2026-10-09
RTCSession.onStateChanged adds bounded, asynchronous observation of the existing local connection state. It adds no polling, automatic reconnect or authority. The SDK README records coalescing and terminal cleanup. Strict SDK build and23 affected cases pass with substituted native I/O. Evidence and scope (../development/RTC_JAVASCRIPT_LIFECYCLE.md#advisory-rtc-lifecycle-subscriptions--2026-10-09).
RTC Action and signal recovery — 2026-10-09
Installed SDK/native RPC now has actual Task Action authority and signal-recovery tests. Prior intermittent failures remain documented; no transport or permission retry is introduced. Agent observed Usage migration143 now explicitly documents its old-binary upgrade/rollback boundary. Evidence and remaining scope (../development/M1_V3_RTC_PACKET_POLICY.md#native-rpc-task-action-and-signal-recovery--2026-10-09).
Agent observed token totals in Usage — 2026-10-09
The existing Usage worker now records original cumulative LLM input/output totals once as nonbillable agent_observed_input_tokens and agent_observed_output_tokens. These are observed quantities, not prices, customer Quota or settled liabilities. Missing data stays unknown; breakdown and plugin totals are not added. Migration143 and generated contracts accompany the change. Local PostgreSQL4, quota1 and Node14 tests pass. Evidence and remaining scope (../development/GX10_AGENTS_USAGE_LOCAL_QUALIFICATION.md#agent-observed-token-totals-in-canonical-usage--2026-10-09).
Advisory RTC local connection quality — 2026-10-09
Expose a read-only local quality value and bounded change subscriptions on the existing JS RTCSession. Reuse official native quality; reconnect/close shows unknown, cleanup is idempotent, and nested notifications cannot replay an old round. Actual SDK build and13 local cases pass with substituted I/O; no native network or cloud claim. Usage and limits (../../sdks/javascript/README.md#advisory-rtc-connection-quality).
Agent Usage owner observation readback — 2026-10-09
Add a bounded internal read of the original final Agent observation with exact tenant, execution, generation and hold binding. Actual PostgreSQL qualification passes6/0/0; duplicate reads preserve cumulative quantities and unresolved liability without billing, release or new worker loops. Scope and evidence (../development/GX10_AGENTS_USAGE_LOCAL_QUALIFICATION.md#agent-observation-readback-by-the-usage-owner--2026-10-09).
Native RPC in-flight timeout and revoke — 2026-10-09
Add one real installed-SDK/native regression for already-entered handlers, timeout, original Grant withdrawal and late replies. Actual result 1/0/0; no implicit retry or policy restoration. Production SDK/server/upstream bytes are unchanged. Action composition and reconnect remain separate existing obligations. Evidence and limits (../development/M1_V3_RTC_PACKET_POLICY.md#native-rpc-in-flight-timeout-and-revoke--2026-10-09).
ESP32 bounded stream receive — 2026-10-09
Add receive-only Streams preparation/configuration/callbacks and local poll to
the existing RTC owner. Fix up to four topics before connect, one original
peer/SID and 64 lifetime tombstones; preserve server authority, bounded borrowed
memory and cleanup. No new upstream patch, transport, timer or network polling.
Current owner90 and affected Packet41/audio29/native15 host cases pass; actual ESP32-S3 target compile/link and eight readback stages pass. Native traffic, hardware and cloud remain NOT-RUN. Targeted send and OneSay RPC callee adaptation remain unfinished.
Acceptance and limits (../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-bounded-stream-receive--2026-10-09).
Native RPC finite first-call observation — 2026-10-09
Add fixed-enum and bounded-counter diagnostics to the existing native RPC test. One actual source-bound local root passed 1/0/0 at 6c2ac189 plus the exact test overlay; the original first-call failure remains UNKNOWN. Preserve all business assertions, operation timeouts, retries and production behavior. No new milestone credit or cloud/hardware qualification. Evidence and limits (../development/M1_V3_RTC_PACKET_POLICY.md#native-rpc-finite-first-call-observation--2026-10-09).
ESP32 explicit Agent Control — 2026-10-09
Add typed create/get/stop through the existing canonical Control owner, independent
of an active RTC connection. Preserve exact input/scope, nanosecond duration,
complete playback observations, server Grant/Consent and honest stop state.
Add bodyless/keyless GET to the shared adapter while preserving POST/PUT behavior.
Actual shared Control client/path/HTTP adapter: selection 44, original public 19, Agent GET 20, mutation 8 and original idempotency-key 546 checks, all with zero failures/skips in one Linux ASan/UBSan execution. HTTP is a recorder; no server, socket or Agent runtime is exercised.
Agent facade: PASS — 175/0/0 with the maintained --agents Linux GCC13 ASan/UBSan leaf, actual OneSay serialization/closed decoder and Control recorder. Complete playback, original request scope, nanosecond bounds, callback mutation and failure-output erasure are covered; no HTTP, server or native Agent execution is inferred.
Target: PASS for the exact current Agent/Control source union: 8 stages, 144 SDK files, 36 locked dependencies/33 managed components, 11 OneSay RTC TUs and 15 official TUs; all three public Agent calls compiled, linked and read back. Shared Control compiles with the existing Task namespace isolation inside the RTC joint target (8 Task TUs, 445 symbols, 40 objects). The 1279 Ninja steps and independent readbacks completed in 84.390 seconds. No separate current Task-only rebuild, target execution, Agent inference, native network, Device, hardware or cloud validation is claimed.
No upstream pin/patch or Agent runtime change. Real ESP32/server, Provider,
hardware and cloud qualification remain open.
Acceptance (../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-explicit-agent-control--2026-10-09).
ESP32 packet policy and bounded native send — 2026-10-09
Add OneSay-only packet policy configure, send and readback on the original RTC
owner. Keep peer routing private, invalidate expired/replaced native mappings,
and hand packets directly to the pinned official sender. Full replacement
omits/disables Streams/RPC; receive remains unavailable because the pinned
callback lacks reliability mode. Separate host 131/41/29/15 runs passed;
Packet target qualification: PASS for this exact source union: eight stages, 141 SDK files, 36 resolved dependencies with 33 managed source hashes, 10 OneSay RTC translation units and 15 official units, all eight Task units with 445 symbols/40 objects, and all three public packet functions retained. Ninja compile/link performed 1278 steps; the complete eight-stage qualification took 82.146 seconds. This is target/source/include qualification, not native network or hardware execution.
Real native traffic, hardware and cloud qualification remain open. No upstream
pin or patch growth. Acceptance (../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-packet-policy-and-bounded-native-send--2026-10-09).
ESP32 public audio owner and exact component graph — 2026-10-09
Connect the public original-authority audio owner to official ESP32 capture/render and Room lifecycle; preserve exact publication name, bounded ownership and failure cleanup. Close the native delayed-media teardown use-after-free with bounded completion and retained-owner semantics; Room disposal failures preserve resources for explicit retry. Actual host and final component target checks passed in separately bound runs; native runtime/Device/hardware/cloud qualification remains open. Acceptance (../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-public-audio-owner-and-exact-component-graph--2026-10-09).
ESP32 RTC admission and private official boundary — 2026-10-08
Add bounded RTC admission preparation and a private official ESP32 lifecycle binding. Keep credentials/native objects private, preserve Task behavior and record separate host qualifications with original failure. Public capture/Source/connect and target/media/hardware qualification remain incomplete; no progress credit added. Acceptance and evidence (../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-rtc-admission-and-private-official-boundary--2026-10-08).
SDK pair fixture Room readback and RPC diagnostics — 2026-10-08
The native pair tests wait for actual native Room SID and completed owner version readback between their single SDK admissions, preserving all production guards and deadlines. Packet and Streams passed; the original RPC first-call failure remains unresolved despite a separate diagnostic-only passing run. Finite canonical RPC diagnostics and all failed evidence are retained. Formal example serve separately passed 3/0/0. No new progress credit. Qualification and remaining scope (../development/M1_V3_RTC_PACKET_POLICY.md).
Public JavaScript RTC example — 2026-10-08
Add a plain browser example using only the OneSay SDK for explicit audio, declared data/RPC and Agent operations. Reuse the packed consumer tooling and existing Task quickstart. Composition and actual-browser pretransport checks passed; successful network/media flows and the formal startup path remain open. Qualification (../development/GX08_JS_RTC_EXAMPLE_QUALIFICATION.md).
JavaScript Agent control real-server qualification — 2026-10-08
Add an installed SDK/real HTTP/SQL test for existing Agent create/get/stop with Grant, Consent and replay semantics. Fix local PostgreSQL readiness to exclude the initialization temporary server; preserve safe Docker diagnostics. No runtime authorization change or additional progress credit.
JavaScript Agent control facade — 2026-10-08
Add OneSay-only Agent create/read/stop with original server authority, strict
resource projection and bounded cancellation. Preserve pending stop and UNKNOWN
playback facts. Reuse existing packet/stream/RPC/DataTrack owners.
Local qualification and retained failures (../development/evidence/m1-v3-gx08-agent-facade-8bb8e794/index.json).
Optional Agent playback observation — 2026-10-08
Project actual official speech/native-source stages through the existing
authorized AgentExecution GET. Optional telemetry cannot renew authority or
turn cache failure into claim failure; stale/replaced/expired output is absent.
Remote hearing stays UNKNOWN. Local functionality passed; integration,
handoff and earlier SSI risks remain open.
Qualification and limits (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#optional-native-playback-observation--2026-10-08).
RTC result lineage and native realtime speech — 2026-10-08
Add explicit pipeline-only rtc.transcription.v1 result intent with its current
server Grant/Consent and immutable typed Task/Artifact receipts. Enable the
locked official native realtime model under original finite execution budgets
and joined lifecycle. Unknown timeline/duration and absent transcripts remain
unknown. Local functions passed in separate source-bound runs; intermittent SSI
availability remains unresolved and integration/handoff are incomplete.
Local qualification and remaining gates (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#rtc-transcript-results-and-native-realtime-speech--2026-10-08).
Fixed official Agent Task cancellation — 2026-10-08
Connect the one registered task_cancel tool through the original private job
callback to the existing signed server Action. Preserve current authority,
Consent, finite model budgets, joined Stop and durable replay protection.
Local native qualification and remaining scope (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#fixed-official-task-cancellation-through-the-native-pipeline--2026-10-08).
Original Agent Task cancellation owner — 2026-10-08
Reuse canonical cancellation and protected idempotency under the original Agent
claim and current Task Grant/Consent. Correct full-result replay across Artifact
timezone JSON representations; late authority changes roll back atomically.
Local PG14/0/0 evidence (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-agent-task-cancellation-owner--2026-10-08).
Official tool callback remains open.
Durable final Agent observation — 2026-10-08
Preserve one final cumulative Agent observation atomically with original claim
Release. Original instance checks, explicit gaps, immutable replay and nil-worker
compatibility are covered locally. All observations remain UNKNOWN/nonbillable;
no Usage settlement or hold release is inferred.
Qualification (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#durable-final-agent-observation--2026-10-08).
Honest internal playback observations — 2026-10-08
Separate official speech and native-source phases, protect newer observations
from old handles/epochs and retain UNKNOWN remote hearing/correlation. Formal
local pipeline202/0/0; public UI delivery remains open.
Original qualification (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#honest-internal-playback-observations--2026-10-08).
Complete local voice turns — 2026-10-08
Support official 200ms TTS frames and joined barge-in; retain original budget
and isolate late audio. Add local private policy configuration using existing
store owners, remove redundant authority reads, and reuse the graph lock.
Qualification and remaining limits (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#complete-local-voice-turns-and-native-pipeline-qualification--2026-10-08).
Original Agent budget across LLM turns — 2026-10-08
Divide the original finite output allowance across official LLM requests without
refund. Add opt-in locked pipeline qualification to the existing Linux test
entrypoint:186/0/0.
Evidence and external limits (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-budget-across-llm-turns-and-repeatable-qualification--2026-10-08).
Active official Agent pipeline — 2026-10-08
Connected effects-admitted Worker to the selected official STT/LLM/TTS graph,
original budget and protected IO with joined shutdown. Integrated Linux
qualification95/0/0 uses deterministic Provider responses; external canary and
full native model graph remain open.
Evidence and limits (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#active-official-pipeline-and-worker-lifecycle--2026-10-08).
Original Agent native output — 2026-10-08
Connected native publication and independent recipient authority to original Agent execution/claim/source dependencies in migration139. Removed lease-only fanout and duplicate route reads while retaining revocation and original deadlines. Actual protected official PROCESS Worker output reaches an independent Human native receiver, with advancing RTP and joined stop/release. gx07-connected-native-66639280981dd411 passes 14/0/0; this is bounded test-audio loopback, not model output or hearing proof.
Evidence and limits (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-agent-publication-and-independent-human-receiver--2026-10-08).
Agent output preparation — 2026-10-08
Bound the original Agent output Source/Publication/Signal to its live business
claim and effects response. Added signed private output projection and official
publication lifecycle consumer. Native permission and model activation continue.
Validation and limits (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-agent-output-preparation-and-effects-handoff--2026-10-08).
Agent pipeline I/O preparation — 2026-10-08
Added bounded official input/mixer and output/source adapters, single-segment
operational budget consumption, and the Service-generated audio Source contract.
Provider activation and native Agent output authority remain under implementation.
Validation and limitations (../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md).
Official Agent protected audio input — 2026-10-08
Connected the official named Worker to original business claims and exact
server-authorized audio inputs. Added actual joined stop/release and retained
default-dispatch/direct-client restrictions. Migration137 reuses existing
admission snapshots and invalidation; native changes retain five hook families.
Active model execution, output, Action/Usage and full recovery remain open.
Scope and evidence (../development/GX07_AGENT_CONNECTED_INPUT_LOCAL_QUALIFICATION.md).
Native DataTrack product — 2026-10-08
Added data Source/publication authority with independent Grants, original
Consent and migration136; bounded server-side native enforcement and official
JavaScript publish/read/end facade. Actual installed browser and PostgreSQL
paths pass locally. Audio history is retained and locked ESP32 support remains
explicitly unavailable. Scope and evidence (../development/M1_V3_RTC_DATA_TRACKS.md).
RTC text and byte streams — 2026-10-08
Added explicit stream policies and the OneSay JavaScript text/byte stream facade
using the official native runtime, with independent send/receive Grants and
bounded cancellation. Real local packed-SDK delivery and original receive-Grant
withdrawal are verified. Full adversarial/recovery qualification remains open.
Evidence and limits (../development/M1_V3_RTC_PACKET_POLICY.md#public-stream-policy-and-sdk-integration--2026-10-08).
RTC stream permission foundation — 2026-10-08
Added bounded server stream permissions, shared packet rate budgets and terminal
metadata cleanup using existing native policy boundaries. Current/next-version
component checks pass; public stream integration remains in progress.
Evidence and limits (../development/M1_V3_RTC_PACKET_POLICY.md#stream-guard-and-existing-native-policy-seam--2026-10-08).
RTC native Room recreation — 2026-10-08
Fixed stale durable SID after actual empty Room expiry. Verified mismatch hints
schedule the existing fenced worker; official signed configuration preserves
capacity on recreation. Fresh public connections and separately authorized
packet policies restore reliable/lossy delivery. Selected native/PG/material88
and separate host profile87 pass; external and final qualification remain open.
Details (../development/M1_V3_RTC_PACKET_POLICY.md#empty-native-room-recovery-and-public-packet-restoration--2026-10-08).
RTC revocation proof recovery — 2026-10-08
After a confirmed pre-commit serialization rollback, release only the current
exact proof lease for existing worker scheduling. Unknown commit still preserves
the lease. Selected PostgreSQL7 passes; full reconnect remains failed on native
Room SID recovery, tracked for the next existing lifecycle fix.
Details (../development/M1_V3_RTC_PACKET_POLICY.md#revocation-proof-recovery-and-native-room-gap--2026-10-08).
RTC packet signal recovery — 2026-10-07
Fixed public RTC session state during upstream signal recovery and retained
explicit packet reauthorization after recovery. Actual installed browsers pass
old-mapping rejection, protected policy replay and recovered reliable delivery;
selected native checks add resume/dedup, envelope bounds and revoke denial.
Final selected SDK159, native16 and browser1 pass in separate source-bound lanes;
earlier failures remain recorded. Full reconnect and final qualification stay open.
Details and limits (../development/M1_V3_RTC_PACKET_POLICY.md#packet-signal-recovery-and-native-adversarial-behavior--2026-10-07).
JavaScript RTC packet send and receive — 2026-10-07
Added session.packets.updatePolicy/send/onPacket over the official LiveKit data
transport, with bounded sends/listeners and private original-peer routing material.
Policy replay preserves its original material deadline and protected response.
Actual independently installed SDKs passed bidirectional reliable/lossy delivery
in two Linux browsers with original authority and full owned-fixture cleanup.
Selected SDK145 and PostgreSQL74 checks also passed. Earlier native failures,
including the unresolved receive stability risk, retain their own evidence;
reconnect, complete RTC-13, full CI and external qualification remain open.
No upstream patch growth, new migration, permission widening or network retry.
Scope and receipts (../development/M1_V3_RTC_PACKET_POLICY.md#javascript-packet-session-and-original-peer-material--2026-10-07).
RTC packet observed enforcement and policy control — 2026-10-07
Added trusted first-guard observations with immutable original snapshot, consumer
and source-cut provenance; preparation and control ACK still cannot claim effect.
Migration132 does not backfill historical policies. Same-transaction retained
authority avoids duplicate construction while keeping final Grant/Consent,
Service, lifecycle and clock checks. JavaScript adds rtc.packets.updatePolicy
with existing public Consent/idempotency/deadline semantics; send/receive remains
incomplete. Selected backend51 and real native10 pass with fixture cleanup;
component receipts and earlier failures preserve their own source bindings.
No upstream patch growth, timeout extension, network retry or cloud qualification.
Scope and evidence (../development/M1_V3_RTC_PACKET_POLICY.md#observed-enforcement-and-javascript-policy-control--2026-10-07).
RTC packet durable dispatch — 2026-10-07
Added same-transaction packet dispatch enqueue, exact joined-readiness checks,
one attempt per original connection across policy versions, and a bounded lane
in the existing authority worker. Lost responses and expired claims are not
retried; control acknowledgement does not prove native effect. Migration 131
does not backfill historical policies. Private preparation remains at 500 ms
with no upstream patch growth. Fixed artificial quota-fence writes during
existing Human validation and the effectiveness source-cut Agent-claim scan.
Final selected local lanes passed native9 and PostgreSQL15 with owned fixture
cleanup; the archive retains earlier separately bound passes and failures.
SDK, effective projection, reconnect and full qualification remain open. The
pre-131 pinned test seam does not qualify a complete historical binary.
Scope and limitations (../development/M1_V3_RTC_PACKET_POLICY.md#durable-accepted-intent-dispatch--2026-10-07).
RTC packet native enforcement checkpoint — 2026-10-07
Added a bounded native packet permission hook and external OneSay adapter over the existing LiveKit transport and attachment watch. Sender ingress and each receiver's delivery/replay enforce independent original authority; data grants remain false and RPC/unknown payloads remain closed. Migration 130 permits accepted joining intent without fabricating native presence or losing terminal lifecycle history. Generated contracts only refresh the canonical spec digest after the policy source moved into its isolated guard package.
Selected local evidence: 333 Go seam/adapter events, 119 PostgreSQL events
including nonempty upgrade, 8 actual native-client events, 130 next-version
resolved-patch events, 39 migration Node tests and 12 boundary Python tests;
each lane has zero failures/skips and its own source binding. Historical failed
attempts remain archived, including a post-join Consent 500 whose cause remains
unresolved despite the later passing diagnostic run. Public durable dispatch,
SDK packet exposure, complete RTC-13, full CI and external qualification remain
open; no milestone points are added.
Evidence (../development/evidence/m1-v3-rtc-native-packets-6798f9e3-raw/index.json).
RTC packet private preparation and attachment watch — 2026-10-07
Private signed packet preparation, same-snapshot projection, existing attachment watch and restricted version selection are implemented. Linux private-protocol/watch race: 127 roots, 759 pass/0 fail/0 skip; real PostgreSQL preparation and nonempty upgrades: 29 pass/0 fail/0 skip. Prior unit receipt retains its original manifest before the additional PostgreSQL HTTPS test and test-only fixture correction; runtime sources are unchanged. Native packet enforcement, SDK, full CI and external gates remain incomplete. No points or denominator change.
Reuses existing signed Service and attachment/freshness authority; migration 129
adds only the two non-authorizing version columns to the native role. Real
restricted-login HTTPS/PG preparation refuses stale versions and withdrawn
Grants. The failed immutable-generation fixture is preserved separately.
Native forwarding and SDK exposure remain disabled, with no upstream patch
change or new public transport.
Evidence (../development/evidence/m1-v3-rtc-packet-preparation-be23885b/index.json).
RTC packet dependency capture and reevaluation — 2026-10-07
Accepted packet policies now retain immutable original authority snapshots and
use existing RTC source capture/export/reevaluation for current lifecycle and
authority changes. Terminal peer lifecycle changes cannot be hidden by restoring
the same current state. Historical pre-capture policy is not retroactively trusted.
Local race qualification passed 12 roots (8 PostgreSQL, 4 parser/selector) / 117 pass events including subtests, zero failures/skips,
with owned fixture cleanup. Native forwarding, effective permission and SDK
packet exposure remain closed; no upstream patch expansion or progress credit.
Historical 111/114 upgrade runs remain FAIL; their public-connection HTTP 500
occurred before upgrade, and the historical comparison fixes remain unverified.
Prior failed attempts remain in the evidence index; current-schema PASS does not
qualify these upgrades or establish an SQLSTATE diagnosis.
Separately, actual nonempty 127-to-128 upgrade passed 4/0/0,
preserving original rows and requiring fresh public Consent/CAS after the new
capture epoch. Its receipt retains its pre-optimization source binding.
Same-operation subscription publisher/client/session reuse keeps final per-publication
authority checks and the 500 ms budget; its independent race lane passed
50/0/0 across 2 roots, including after-audit
Grant, client and session withdrawal rejection/rollback. These are separate
source-bound lanes, not qualification of one later exact committed SHA.
The independent publication Grant batch regression passed 137/0/0
across three PostgreSQL roots and one unit root; current evidence, historical
denial, original publisher and Consent checks remain covered. SQL diagnostics
are separate, include fixture setup and do not count as qualification evidence.
Preparation and actorless reevaluation independently passed 12/0/0
within the existing preparation root and unchanged 500 ms product budget. Its
receipt, the new bounded Grant regression (143/0/0) and the
current main lane cover the later source; earlier Grant and Observe receipts
retain their original manifests without rebinding. The fixed four-reference
publication wrapper is retained above a maximum-ten exact-original batch core;
subscription nil-original selection is unchanged. For eight targets, the origin
and final Grant SQL calls each decrease from 30 to 2 (56 fewer round trips in
total), preserving history semantics without promising measured latency.
The earlier 12/0/0 preparation/reevaluation, 49/0/0 retained Observe/origin and 143/0/0 bounded Grant results remain immutable PASS in index.prior_passes with their own original receipt and source-manifest hashes. They are neither failures nor qualification of the later private final-facts implementation. The 137/0/0 publication Grant and 4/0/0 actual upgrade results remain separately scoped component history.
Subscription observation and actorless reevaluation now pass private typed final connection facts between their own final-check compositions. Each fact is created only after a full connection owner recheck, copied from that refreshed owner and restricted to the exact same operation context, SQL transaction and original endpoint tuple. No identity/client/session authority write or external callback may occur between construction and the publisher checks. Each publication still performs its own original Grant/history, Source, Consent, quota and current-clock checks. General/public rechecks and Agent paths retain their existing full checks; this is not a cross-request cache or portable authorization permit. The current retained lane exercises zero/foreign operation/transaction and wrong-endpoint misuse using real original owners, while the current actorless and main lanes cover the two affected compositions.
Remaining latency risk: current-source eight-target actorless samples are final-facts-reevaluation-pass: 495 ms (reported margin about 5 ms); current-pass: 463 ms (reported margin about 37 ms), against the unchanged 500 ms product budget. The prior pre-final-facts sample remains separately recorded as subscription-reevaluation-pass: 498 ms (reported margin about 2 ms); its narrow margin is historical evidence, not a current-source timing claim. All integer-millisecond samples retain their original lane/log hashes. These samples do not establish robust tail-latency headroom, load capacity or repeated-run stability. The risk remains explicit without adding an acceptance gate, changing budgets or awarding credit.
Scope and source-bound evidence (../development/M1_V3_RTC_PACKET_POLICY.md).
RTC packet durable Consent and API — 2026-10-07
Connected the packet policy endpoint to immutable PostgreSQL policy CAS, the
existing encrypted Consent lifecycle, retained original Grant/peer authority,
audit and protected idempotency. Replay cannot renew authority or restore a
revoked policy. Migrations 126/127 retain original locators without a plaintext
Consent Action mirror. Linux Go race checks passed 7 real PostgreSQL roots /
138 events and 15 affected API/bootstrap roots / 108 events, with no failure or
skip and confirmed fixture cleanup. Accepted intent still grants no native data
permission; native delivery, receiver enforcement and SDK packet exposure remain
unfinished. Scope and evidence (../development/M1_V3_RTC_PACKET_POLICY.md).
RTC packet permission and overload predicate — 2026-10-07
Added an immutable external server predicate for native application data packets:
original sender/recipient attachments, explicit destinations, topic allowlists,
whole-envelope bounds, expiry/revocation, and concurrency-safe packet/byte limits.
It reuses LiveKit protocol and the existing pinned Go rate limiter. Linux race
qualification passed 14 top-level tests with no failures or skips, including
closed signing-material regressions. This is preparatory implementation: the
business issuer and native interception point are still missing, the SDK packet
API is not exposed, and CanPublishData stays false. No upstream patch changed.
Scope and evidence (../development/M1_V3_RTC_PACKET_POLICY.md).
Task/RTC continuous media window correction — 2026-10-07
The owned Task/RTC fixture now reuses the native duplex test's 1200 ms media window, with decoded audio checked on each observation and packet, byte and sample-duration growth required across each complete window. Regressing counters, stream replacement, sustained frozen counters and an unobserved complete tail window still fail. No public SDK/runtime behavior or upstream patch changed.
Seventeen real-process regression tests and the three Task/RTC integration roots
passed with cleanup and no input drift. The evidence binds the committed parent
plus explicit working-file hashes; it does not replace historical failed runs or
qualify native policy, same-tenant authority, cloud or hardware.
Evidence (../development/evidence/m1-v3-task-rtc-media-window-edc4bb3f/index.json).
Task/RTC failure diagnostics and relay opt-in — 2026-10-07
The Task/RTC supervisor now retains one bounded, numeric-only failed media
observation without changing its RTP/audio assertions or deadlines. Eight local
process tests passed, including failure cleanup and sensitive-field exclusion.
One owned integration diagnostic failed at RTP_ADVANCE: counters did not advance
across about 103 ms although decoded audio remained valid. Cleanup passed; the
root cause and integrated qualification remain open, with no new credit.
Diagnostic evidence (../development/evidence/m1-v3-task-rtc-media-diagnostic-300eeedc/index.json).
Linux ephemeral-port selection now requires an explicit fixture option, preserving the relay's existing default rejection contract. Four Linux ingress/TLS tests passed, including a real trusted TLS handshake and invalid option rejection. The earlier standalone Task receipt retains its original hashes and is not rebound to this additional opt-in change.
Unprivileged WSL Task fixture and native build preparation — 2026-10-07
The owned Task TLS fixture now uses a kernel-assigned loopback port on Linux,
preserving canonical SNI/Host checks and Windows port selection. Its standalone
Task/Usage test passed 1/0/0, including TLS rejection cases and cleanup; the
receipt explicitly records post-run hashes rather than a pre-run source freeze.
The existing repository Go cache also built fresh Linux LiveKit and authority
executables. These are fixture preparation results, with no additional ledger
credit; intermittent Task/RTC media failure and external gates remain open.
Task evidence (../development/evidence/m1-v3-wsl-task-tls-usage-only-300eeedc.json)
and build preparation (../development/evidence/m1-v3-wsl-native-build-preparation-300eeedc.json).
GX17 exact WSL SDK lifecycle evidence — 2026-10-07
The exact committed source c0d3425639f26963c68fa56be8113ae619d99918 ran the independent packed SDK and passed 59 selected lifecycle, admission, capacity, bounded-material, permission and quota/aggregate tests with 0 failures and 0 skips. The owned PostgreSQL/Redis/LiveKit fixture and consumer cleanup passed. This is local SDK/browser and HTTP evidence only; patched policy authority, Agent/Usage, real Provider, Staging, Production, cloud, hardware, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. Evidence (../development/evidence/m1-v3-gx17-sdk-lifecycle-c0d34256.json).
GX17 exact WSL SDK subscription evidence — 2026-10-07
The exact committed source 709bc51a980293b27d7e0042e1364928b00c664a ran two independent packed OneSay SDK browser contexts and passed TestPostgresRTCBrowserSDKSubscription 1/0/0 with offline installation and owned PostgreSQL/Redis/LiveKit cleanup. This is local SDK/browser subscription evidence only; patched LiveKit policy authority, Agent/Usage, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. Evidence (../development/evidence/m1-v3-gx17-sdk-subscription-709bc51a.json).
GX17 exact WSL SDK publication evidence — 2026-10-07
The exact committed source 07c76d4395fef8a9c6ce7057e6dace23bf2d6e50 installed the packed JavaScript SDK in an independent offline consumer using the Linux pnpm store and passed TestPostgresRTCBrowserSDKPublication 1/0/0. Consumer cleanup and the owned PostgreSQL/Redis/LiveKit fixture passed. This is local SDK/browser publication evidence only; production admission/policy, patched LiveKit, Agent/Usage, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. Evidence (../development/evidence/m1-v3-gx17-sdk-publication-07c76d43.json).
GX03 exact policy invalidation fixture evidence — 2026-10-07
The exact committed source 542f0635a2f293c176d5651cda085017c60ddf8f was run in the WSL/Linux Docker-owned PostgreSQL, Redis and LiveKit fixture. Policy-feed storage, invalidation ordering/idempotency, durable revocation, migration and worker scope passed 100/0/0 across five packages with exact roots/packages, zero source drift and owned cleanup. Runtime push invalidation, effective native enforcement, long-lived authorization, native policy host, full local CI, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. Evidence (../development/evidence/m1-v3-gx03-policy-invalidations-542f0635.json).
GX03 exact revocation fixture evidence — 2026-10-07
The exact committed source b793a400a848f692f3fbda7b01b7e7ad9fad94d4 was rerun with the WSL/Linux Docker-owned PostgreSQL, Redis and LiveKit fixture. The durable revocation, absence-readback, migration and worker scope passed 91/0/0 across five packages; exact roots/packages and zero source drift were confirmed, and owned fixture cleanup passed. This closes the local fixture rerun only; native OneSay admission/media/Agent, full local CI, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. Evidence (../development/evidence/m1-v3-gx03-connection-revocation-b793a400.json).
GX17 client implementation build evidence - 2026-09-28
A clean exact-source Node build and Task contract capture now records 310 pass, 0 fail, 4 explicit Windows-native NOT-RUN skips. GX17.client implementation_build adds 6 points only; total 454.15/1200 (37.8%). Evidence (../development/evidence/m1-v3-gx17-client-93b24e97/index.json). No runtime/API redesign or external qualification.
Post-commit readback: commit 906c6fc4182356a8f97dfd39d75ee2cd0dd2bca5 contains this evidence/docs closeout and the tracked working tree is clean. The build evidence remains bound to the tested product source ab2e5a460cf29a7ee38b60a6b19019bef31be1f4; the docs commit is not a new product test.
GX17 client local behavior evidence - 2026-09-28
An isolated tarball-only public Task consumer bound to 5a5600aa163246c95df2890b396ee49616d7f5c9 covered 43 scenarios, 6 successful requests, 29 pretransport rejections, 6 no-retry error cases and zero forbidden global accesses. GX17.client local_behavior adds 3 points only; total 457.15/1200 (38.0%). Evidence (../development/evidence/m1-v3-gx17-client-behavior-5a5600aa/index.json). No external qualification or runtime redesign.
GX17 package implementation build evidence - 2026-09-28
Two independent clean JavaScript package builds bound to d484419140bd2c1fec7f3a8833f0cd7bfb938bd3 produced byte-identical deterministic @onesay/sdk archives with 87 entries and no workspace/native leakage. GX17.package implementation_build adds 4 points only; total 461.15/1200 (38.4%). Evidence (../development/evidence/m1-v3-gx17-package-build-d4844191/index.json). No external qualification or runtime redesign.
GX17 recovery implementation build evidence - 2026-09-28
The Node-only TypeScript draft SDK build bound to 24faca39cb1318030da8e4b0bf247099e08268fa emitted 44 JavaScript files including the realtime recovery path and confirmed no duplicate Task state machine. GX17.recovery implementation_build adds 5 points only; total 466.15/1200 (38.8%). Evidence (../development/evidence/m1-v3-gx17-recovery-build-24faca39/index.json). No external qualification or runtime redesign.
GX17 client loopback integration evidence - 2026-09-28
An installed tarball-only Task client bound to ed7946fb6c5c1b5c2e633b9445d891f548d0a43f completed create/list/get/cancel against a real loopback HTTP Control service with four request assertions and short-lived bearer/idempotency verification. GX17.client integration adds 1.2 points only; total 467.35/1200 (38.9%). Evidence (../development/evidence/m1-v3-gx17-client-integration-ed7946fb/index.json). No external qualification or runtime redesign.
GX17 package handoff evidence - 2026-09-28
A fresh consumer directory outside the repository received the deterministic 87-entry JavaScript tarball bound to be8451b7d6a84c374cf393f3f89253d4df3272ca, imported the public package and exposed Task methods without workspace paths or native RTC exports. GX17.package handoff adds 0.8 points only; total 468.15/1200 (39.0%). Evidence (../development/evidence/m1-v3-gx17-package-handoff-be8451b7/index.json). No external qualification or runtime redesign.
GX17 client handoff evidence - 2026-09-28
A fresh external consumer compiled the public Task TypeScript contract from the installed tarball bound to c6d538f53524817d31168d33239c1b88a9fb891b and imported three Task methods with zero native exports. GX17.client handoff adds 1.2 points and completes its local milestones; total 469.35/1200 (39.1%). Evidence (../development/evidence/m1-v3-gx17-client-handoff-c6d538f5/index.json). No external qualification or runtime redesign.
GX17 recovery handoff evidence - 2026-09-28
A fresh external consumer compiled and imported the public RealtimeClient resume/replay/bounded-audio/close contract and canonical connect-plan builder from the tarball bound to 113cdb3f7417e53c9624b2708f78d1eb85e9fa70. GX17.recovery handoff adds 1 point; total 470.35/1200 (39.1%). Evidence (../development/evidence/m1-v3-gx17-recovery-handoff-113cdb3f/index.json). No external qualification or runtime redesign.
GX17 selected Browser evidence after Consent correction — 2026-09-28
Fresh installed Gecko/WebKit Task execution at clean 93b24e97 passed 11/0/0 with zero source drift and confirmed cleanup. The first run had incomplete runner provenance and remains diagnostic; the corrected run is archived separately. Evidence (../development/evidence/m1-v3-gx17-browser-current-93b24e97/index.json). No product changes or new credit; total 448.15/1200 (37.3%). Remaining endpoint and external gates stay open.
GX17 failure-history archive correction - 2026-09-28
Preserve the omitted fifth native attempt (1 pass, 1 fail, Usage NOT-RUN) with its original runner, raw receipt and Go events. The successful source-bound qualification and 448.15/1200 (37.3%) progress are unchanged. Archive (../development/evidence/m1-v3-gx17-authorized-task-41a45efb/native-staging-collision/linux-index.json).
Public Task Quickstart using the installed SDK - 2026-09-28
A Node fixed-PCM sample now composes the existing public SDK and observers with explicit authorized application ports, bounded waits and checked cleanup. Two real local PostgreSQL/Redis roots and 18 selected Node tests passed; prior assertion/parser failures remain archived. Evidence (../development/evidence/m1-v3-gx17-public-task-8c00deb7.json) preserves working-source hashes and qualification limits. Only GX17.sample integration adds0.5 points:443.65/1200 (36.9%). No runtime/SDK/Provider/LiveKit patch changed; cloud/hardware/real Provider remain NOT-RUN.
Exact Node pin and selected installed Browser verification - 2026-09-28
An isolated official Node 24.19.0 Linux runtime now matches the repository pin. Fresh installed Gecko/WebKit execution on exact caa51304 passed ten existing Task scenes (11 Go pass events, no failures/skips), with matching package hashes and confirmed fixture cleanup. Receipt (../development/evidence/m1-v3-gx17-node2419-browser-caa51304.json) preserves source, tooling and qualification limits; old Node 24.18.1 results are unchanged. This adds no milestone credit: total 443.15/1200 (36.9%). No runtime/SDK or public contract changed.
Task client boundary and installed WebKit qualification - 2026-09-28
The source-bound static boundary review (../development/evidence/m1-v3-gx17-client-boundary-20355440.json) confirms caller-owned Task PCM acquisition, existing public APIs, server-owned Task authority and lazy RTC initialization. No Task capture API or new runtime is introduced. Five installed WebKit26.5 scenarios passed locally (6 Go events, no failures/skips), extending the existing bounded client evidence with no duplicate credit; WebKit receipt (../development/evidence/m1-v3-gx17-webkit-installed-20355440.json) preserves TLS, Provider, permission and endpoint limits. Only the existing client boundary milestone adds 0.6 points: total 443.15/1200 (36.9%).
Installed Gecko Task recovery qualification - 2026-09-28
Four existing installed Firefox153.0 Task recovery scenes passed on exact source 874a149a (5 Go events, zero failures/skips/source drift). Cancellation-after-ACK, lost ACK, active-audio revocation and bounded buffers retain distinct scope; nonzero PCM replay keeps the older Node evidence binding. Receipt (../development/evidence/m1-v3-gx17-browser-recovery-874a149a.json) records cleanup, shared package hashes and client/TLS/Provider limits. Only GX17.recovery integration adds 1 point; total 442.55/1200 (36.8%). Historical E7 notes gain Task Voice boundary prefaces with original bodies preserved; RTC microphone publication is unchanged.
Installed Browser Task SDK verification - 2026-09-28
The existing Browser Device fixture can serve verified installed OneSay SDK assets and records Task isolation observations after successful cleanup. Selected real Firefox package/source checks passed locally. Evidence (../development/evidence/m1-v3-gx17-browser-installed-15f54fea.json) records exact source inputs, limits and zero additional credit; complete client and cloud qualification remains open.
Installed Task SDK recovery integration - 2026-09-28
Actual installed Node SDK recovery and Task/Artifact/Usage have current-source local evidence. The existing migration transaction now retries exactly once, with the original context, only after an artifact statement reports 23505 at pg_authid_rolname_index and the first attempt has rolled back. Commit uncertainty, other errors and unsafe role attributes remain failures. Existing SQL, manifest, SDK behavior and LiveKit patch are unchanged. Existing Task scenario fixtures now accept an explicitly selected verified installed SDK and emit success only after cleanup and package verification; startup diagnostics retain fixed classifications without credentials. Selected Linux suites only; this increment is not full ci:local or the complete SDK/client/platform qualification matrix. Browser/Electron and the remaining client matrix plus Quickstart, real Provider and cloud remain open.
Task recovery local qualification — 2026-09-28
Seven existing public SDK recovery scenarios now have current-source local PostgreSQL/Redis evidence: cancellation resume, Device revocation, lost ACK, write-failure replay and bounded buffers. Product behavior is unchanged. Source-portable Node evidence does not qualify installed packages, other client runtimes, real Provider or cloud deployment.
Initial Task and SignalStream binding — 2026-09-28
task.created now includes the server-confirmed signal_stream_id with its
existing Task ID, waiting-input status and profile. The JavaScript SDK uses
this association on the first connection, so confirmed Task termination stops
only that stream's audio send/replay. Duplicate creation cannot reopen a
terminal Task, and genuine contiguous ACKs still own PCM release.
ESP32's strict decoder and current-stream binding check are updated together. Its existing strict event-sequence rejection remains unchanged. This local candidate requires matching generated contracts and SDKs; it is not a cloud rollout or qualification of older installed clients. No new Task authority, permission or LiveKit patch is introduced.
The Delegation test file now guards both native test roots and its executable helper on Windows, preserving the isolated Linux qualification route.
Task terminal checkpoint observation — 2026-09-28
For a Task already bound to a SignalStream by a server resume checkpoint, the
JavaScript SDK now observes task.completed, task.failed and task.cancelled
on the current connection. The matching stream stops local send/replay while
other streams remain usable. Unacknowledged PCM still requires a genuine ACK;
duplicate terminals are safe and conflicting terminals fail closed. A cancel
request alone does not imply cancellation. No new stream binding is inferred.
Task audio replay error projection — 2026-09-28
Audio replay now reports transport write failures as retryable
client_network_unavailable, matching ordinary audio sends. It stops at the
first failed write and retains every unacknowledged frame for explicit retry;
transport error messages and causes are not exposed. No retry loop or alternate
Task state machine is added. The installed-package consumer reuses the existing
PCM and Usage observers with injected responses; this is local package evidence.
Task SDK isolated package consumer — 2026-09-28
The packed JavaScript Task Control facade now executes create/list/get/cancel
and error/credential cases in a consumer outside the repository with injected
Fetch fixtures and no LiveKit installation. Get/cancel locally reject ULIDs
whose first character exceeds the canonical 0..7 range. The error remains
TypeError; server authority and audio lifecycle behavior are unchanged.
This local package proof does not qualify real audio, Usage, Staging or release.
E9 bounded agent-readable corpus — 2026-09-28
The local Docs and Developer Platform builds now share a deterministic
256 KiB llms-full.txt policy. Oversized public sources retain a source-bound
head/tail excerpt with their original byte count and SHA-256, while the human
route remains complete and the artifact stays draft/unpublished. The local
E9 contract suite and two-clean-build proof cover the bound and provenance.
The shared corpus generator is now included in Portal build-source digests. Missing selected content fails generation instead of silently producing an empty section; UTF-8 boundaries and changes to omitted bytes are regression-tested.
GX03 durable revocation effectiveness and four-lane worker — 2026-09-26
Added the durable RTC effectiveness finalizer and wired the existing four authority-worker lanes without upstream patch growth. Fixed zero-prefix reporting during a pending source cut; controlled regression, full policy race and a fresh six-root native run pass, with all earlier failures preserved. Actual authority child-process validation awaits the productive fair-drain scheduling correction; current-source CCR requalification remains pending; this is not final architecture qualification. Source-bound effectiveness checkpoint (../development/evidence/m1-native-revocation-effectiveness-2026-09-26.json).
GX03 actual Control native application process verification — 2026-09-26
The actual Control executable now has regression coverage for its signed application receiver: closed empty-incarnation read/seal, exact digest and durable audit, tenant isolation, one-use token/audience rejection and current producer Grant withdrawal. The isolated local race harness passed 12 events across two actual-command roots, with no failures, skips or source drift and confirmed owned cleanup. Runtime and native patch bytes are unchanged; these tests do not prove native drain, source freshness or effective revocation. GX03 and the current correction Goal continue; no final review or completion credit is added. Exact-source process evidence (../development/evidence/m1-control-native-application-process-2026-09-26.json).
GX03 signed native application producer and durable terminal storage — 2026-09-26
Added signed native application reporting, migration 105 terminal storage and ACK-based local record retirement. Preserved original-instance completion and bounded freshness/shutdown semantics, including completion wakeups and safe empty-startup cleanup. All-incarnation effective ACK/finalizer, quota settlement, P2–P4, rolling quota and final clean exact-SHA qualification remain unfinished. No final review, M1 v3.0, completion credit, Staging, hardware or Production qualification is added. Source-bound application checkpoint (../development/evidence/m1-native-application-progress-2026-09-26.json).
GX03 exact native completion handoff and definite-abort recovery — 2026-09-26
Added exact native completion enrollment and error-result forwarding while preserving the existing hook and file boundaries. Corrected definite transaction-abort propagation and bounded whole-consumer retry; fresh formal/native, database, host and rtcpolicy regressions passed. Completion records are process-local and retained within a fixed capacity; disposal is not drain, and durable acceptance/retirement, all-incarnation effective ACK, quota settlement and final exact-SHA qualification remain unfinished. Exact-source handoff evidence (../development/evidence/m1-native-completion-handoff-2026-09-26.json).
GX03 current P1 consumer and long-lived runtime checkpoint — 2026-09-26
Added native consumer registration, signed invalidation-feed integration, complete-prefix/source-cut freshness and bounded cleanup, while removing the unused Control notification listener and preventing retry waits from exceeding the original freshness deadline. Latest native and full rtcpolicy race regressions passed; earlier Device/Control/forward evidence retains its exact scope, and the unreproduced normal-close failure remains an unresolved documented risk. Durable native completion/effective ACK, rolling quota and final exact-SHA qualification remain pending; this is not a final architecture review. Source-bound checkpoint and archived attempts (../development/evidence/m1-native-policy-current-checkpoint-2026-09-26.json).
GX03 generic native close completion — 2026-09-26
The generic native lifecycle increment adds exact-instance close completion for the retained Participant and its existing native transports. It adds WaitClosed observations, callback/reader enrollment and join, first Pion/GracefulClose error retention, and cancellation that fails closed. Existing permission denial and Close remain the caller's operations; no policy, business, transport, room registry, quota, effective receipt, or durable consumer integration is added. The barrier covers admitted effect-capable callbacks/readers and native peer transport closure; it does not claim buffered network media, remote decoder drain, every SFU maintenance goroutine, or application-spawned work has stopped.
Fresh source-bound metrics against the committed base show 21→25 patched files, 12→15 runtime files, 17→26 modified named runtime functions, 35→41 added runtime functions, 3,966→4,332 changed patch lines, 29→29 distinct OneSay runtime identifiers, 2→2 external hook families, and adapter lexical LOC 121→121. The exact summary is .build/native-close-completion-metrics/summary.json; the corrected source inventory is .build/rtc-native-close-completion-corrected-proposal/source-hashes.json.
The focused native run passed 35 events across 12 roots. Full candidate native phases passed 99/37 service, 32/20 RTC/signalling, and 13/3 Room events/roots. The candidate host build and 215-event/27-root host tests passed, followed by the formal registered-path build and 215-event/27-root host tests. All runs were bounded single attempts on Linux/amd64 with no published ports and owned cleanup. Earlier network-none and redundant-writer-close failures remain archived and are not rebound. Boundary tests now explicitly allow only the four audited lifecycle paths while retaining SFU, routing, store, Protocol, alias, and undeclared-target rejection.
This is local validation of a generic lifecycle foundation. GX03 remains IN_PROGRESS; completion credit is 0, final candidate is null, effective revocation, long-lived authorization, freshness, P1/P5, cloud and staging remain unqualified or not run. No upstream submission is claimed. The draft contribution/removal records preserve best-effort writer-close semantics after SCTP shutdown while retaining real Pion errors.
Exact native close-completion evidence (../development/evidence/m1-native-close-completion-2026-09-26.json).
GX03 private policy-consumer lifetime owner — 2026-09-26
Migration104 and the private RTCPolicyConsumerLifetimes owner add durable process-incarnation correlation for the existing configured Service, Project, Environment, infrastructure, cluster and native NodeID. Open and Close reuse the existing signed Service provenance, current room.read selection, Grant fence/deny history, bounded SERIALIZABLE transaction and audit owner. No new authentication or public Resource/Grant is introduced. A server-random session ID, boot nonce and exact positive generation are correlation values, never credentials or native permits.
Same active Open and matching terminal Close are audited idempotent observations. A new boot cannot replace an open incarnation; a replacement must name the exact closed predecessor and use a never-used nonce. An old session cannot close its replacement. SQL guards preserve identity and terminal history, reject erase/reopen, and bind state changes to the same transaction's exact current-Service audit and full ActorChain. Every operation rechecks current authority before commit; failures return zero observations. A lost post-commit response can be recovered only through a newly authenticated same-incarnation operation.
Actual isolated Linux PostgreSQL race validation passed97 parent/subtest events across12 roots in one package, with zero failures/skips/source drift, one attempt and verified owned container/network cleanup. The three new roots cover real signed provenance, durable JTI replay rejection, configured/current authority, exact lifecycle/nonce/generation constraints, concurrent replacement, audit insertion and deferred COMMIT faults, selected Grant ABA rollback, native PG role isolation and canceled lock waits. Existing source-cut, reader and route-dispatch regressions passed in the same frozen source copy. An actual admitted Connection and its held quota remain unchanged. Migration validation, generated no-diff and30 migration E2 tests also passed. Counts are test events, not additional product capabilities.
Evidence is bound to parent2dc50c8d2d47f1af0b84301cc0a95d3b8cad92be plus the exact seven tested source files. The archived PostgreSQL receipt is not represented as a rerun of the later documentation/commit SHA. The fixtures use the existing real feed-audience JWT/JTI path only to test repository provenance; consumer HTTP endpoints and their operation-specific audiences are not implemented by this increment.
The external delta is225 Go runtime lines,86 SQL lines and397 test lines. Native patch metrics remain21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay identifiers,2 hook families and adapter121 lexical/182 physical lines. The seven reuse alternatives require no upstream patch growth here: existing configuration, Server API, SDK/protocol, local hook/state and native permission operations do not own durable OneSay process history; the external configured Service/PG/audit owners provide the required seam.
Open means registered only. Native host/process binding, safe retirement of abandoned open incarnations, consumer transport, applied prefix, pushed invalidation, measured node freshness, native drain/effective ACK and normal long-lived authorization remain unfinished. The temporary at-most-two-second native ceiling and held quota are unchanged. No force-replacement, heartbeat, per-connection renewal, capacity qualification or cloud validation is added. GX03 remains IN_PROGRESS, final candidate null, completion credit added0; no final architecture review or M1 v3.0 is generated. Staging remains NOT-RUN — requires authorized Staging environment.
The additional global readiness command remains nonzero for eleven existing invalid historical evidence entries. Its generated view exactly matches the committed parent, and work packages, items, evidence, gates and weights are unchanged. This readiness limitation is preserved explicitly; it does not turn the focused owner test result into final M1 qualification.
Exact-source consumer-lifetime evidence (../development/evidence/m1-policy-consumer-lifetime-2026-09-26.json).
GX03 actual Control feed bootstrap and committed source cut — 2026-09-26
The existing Control API bootstrap now mounts the fixed private policy feed beside admission on the same TLS listener, origin, configured Service routes and internal JWT owner. The unchanged rtc_native_policy configuration enables both; [] disables both. Capacity is bounded separately per operation by the configured value. An immutable Service-to-reader dispatch table adds no authority cache: each selected reader still checks verified provenance, exact tenant, current room.read and durable audit. Public paths, SDK contracts and native runtime remain unchanged.
Migration103 adds two partial indexes covering ALL unfinished export and reevaluation work, including held leases, delayed attempts and dead letters. The existing reader computes an optional source cut in its same SERIALIZABLE authority/page transaction, requires the exact page head, and returns it only after final authority checks and successful commit. Its clock anchor precedes lock waits. Reversed IDs and later commits are not inferred from max IDs or queue metrics. Ordinary feed pages remain available without a cut. The cut is a captured-source observation, not a permit, applied ACK, node freshness or native drain. Unrelated global pending exports conservatively prevent a positive cut; sustained traffic and vacuum/index maintenance remain availability/capacity risks requiring measurement.
Final source-bound Linux validation passed351 parent/subtest events across46 roots in cmd/control-api and rtcpolicy, plus80 events across13 real PostgreSQL roots. Both lanes have zero failures/skips/source drift and verified owned cleanup, use isolated internal Docker networks and publish no host ports. The real Control executable covers disabled/private routing, two tenants, correlated JWT/audit, replay, Grant withdrawal, readiness failure and successful shutdown. Its build is an actual child build; the outer Go suites use race instrumentation. The source-cut lane covers same-snapshot head, pending/leased/delayed/dead-letter work, lower-ID late commit, actual deferred COMMIT failure, Grant ABA rollback and PostgreSQL index plans with2048 genuine source mutations. Counts are test events, not distinct product capabilities. The six source/static checks passed, including35 architecture and55 migration tests; document/archive checks follow separately.
All earlier attempts remain archived as their actual results. Corrections include isolated Redis fixture databases, use of the pinned upstream logging.Disable before command clients/goroutines (metrics/readiness/error returns remain), the correct upstream logging package, permanent Grant revocation instead of forbidden deletion, and acknowledging the real Consent capture created by the revocation fixture before draining export. No assertion was weakened or failed result rebound.
Native patch metrics remain21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay identifiers,2 hooks and adapter121 lexical/182 physical lines. Consumer lifetime, pushed invalidation, measured node freshness, normal long-lived RTC and effective native revocation remain unfinished. The old PostICE timeout cause remains NOT_PROVEN; native and forward replay were not rerun by these lanes. GX03 stays IN_PROGRESS, final candidate null and added completion credit0. No final architecture review or M1 v3.0 is generated. Staging remains NOT-RUN — requires authorized Staging environment.
Source-bound bootstrap and source-cut evidence (../development/evidence/m1-policy-feed-source-cut-2026-09-26.json).
GX03 bounded local invalidation state — 2026-09-26
A denial-only local state component now reuses the committed private feed's exact scope, contiguous-page and opaque-binding checks. Page installation and watch registration share one bounded critical section. Retained maximum policy versions prevent a delayed original admission from escaping an already installed invalidation. The exact durable/native pair and Room/Connection generation key keeps an old-generation event from closing a different generation. A malformed later event, scope mismatch, gap, replay or exhausted history limit fails the whole state closed without advancing its cursor; no eviction or reset restores prior authority.
Active watches and retained binding history have separate explicit limits. Denied is a pure O(1) atomic observation; nil/zero/released handles fail closed. Release removes only its exact handle and never deletes denial history. No callback, I/O, timer, goroutine, native membership/routing or transport logic runs in this component. A nil Denied result is not authentication, a permit, renewal, freshness or quota authority. This component is not yet wired into the native host; existing original authority and the <=2s join-only ceiling remain unchanged.
Actual isolated Linux race execution on transport parent246e76af3d9ab9f127f64233b6f8ea556280b3bb plus two new Go files passed228 parent/subtest events across38 exact roots in the complete rtcpolicy package, zero failures/skips/source drift and confirmed owned container cleanup. The new five roots include32 actual install/attach race rounds, late/equal-version denial, replacement-generation isolation, partial cursor progress, whole-page failure, permanent terminal state and exact release/capacity behavior. Docker network was none, with no published host ports; HTTP fixtures use container loopback only. No PostgreSQL, patched native runtime or cloud lane is claimed. Ten source/static checks passed including35 architecture and55 migration tests; final archive/document checks follow before commit.
The continued native completion inspection also found that concurrent Close calls can return before a first close completes, subscription close launches asynchronous flushes, and transport close logs rather than returns peer-close errors. Existing onClose/Release/absence and a new notification merely placed after these calls would not prove native drain. No patch-growth approval or upstream change follows from this source-only finding. Node consumer lifetime, source-cut freshness, push wiring, normal long-lived authorization, native completion and effective quota release remain unfinished. Native metrics stay21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay identifiers,2 hooks and adapter121 lexical/182 physical lines. GX03 remains IN_PROGRESS, final candidate null and completion credit added0. No final review or M1 v3.0 is generated; Staging remains NOT-RUN — requires authorized Staging environment.
Local invalidation state evidence (../development/evidence/m1-policy-local-state-2026-09-26.json).
GX03 publish captured source changes and discover reevaluation work — 2026-09-26
Migration 101 appends one private export-work row atomically with each immutable source pending event. The runner drains pending appenders before its first snapshot, backfills earlier committed pending rows once and installs the constant AFTER INSERT enqueue trigger; verified applied 101 returns before that barrier. Original journal/pending bytes and both capture epochs remain unchanged. The source transaction takes no Room, admission-registration or policy-stream lock and does no dependent fanout.
Discovery ranges over indexed due unfinished work. Claim fences and database-clock leases keep retries bounded and leave explicit dead-letter state. Event identities never become a commit cursor: a lower identity that commits later remains discoverable independently. Publication inserts every sorted selector before incrementing each generation, including zero-dependent events, and records its immutable READ COMMITTED MVCC cut in a separate statement after key waits. A Consent receipt publishes both its source ID and complete fourteen-coordinate binding alias. Publication holds no Room/binding locks and performs no dependent scan while holding registration keys.
After publication releases its keys, fanout initializes a finite audit-ID traversal maximum. This only bounds traversal; fixed-cut admission visibility and original source visibility still decide eligibility. The reverse/forward C-collation index supports at most 129 candidates from each of at most two selectors before visibility classification. A bounded deduplicated page advances over excluded candidates as well as affected ones, so a zero-output nonfinal page is valid. Required immutable event/admission reevaluation rows and fenced cursor progress commit together. SQL checks prevent skipped affected members and incomplete completion. This is an index-aligned design and logical page bound, not a measured production-capacity result; physical query cost still depends on plans, MVCC tuples and index/storage maintenance.
Actual isolated Linux race regression on committed snapshot100 parent 0b97fdbe9ed8e4222302c7f7e2a57d5e4190b364 plus nine integrated files: 36 passing parent/subtest events, 14 exact roots, 2 packages, zero failures/skips, no source drift and verified owned cleanup. The five new repository roots check fixed-cut matching and exclusions, finite empty pages, cut/output rollback, stale/reclaimed leases, dead-letter bounds, reversed allocation/commit order, Consent alias matching, real admission/export waits and the mixed existing-alias/new-key registration primitive. Three real upgrade roots check earlier/later appenders across installation, preserved capture/migration history, verified no-op and source rollback. Six focused storage, native-admission owner, Service-capture and migration regression roots also pass. The existing-key-first actual admission waits remain under the original admission bound; the zero-dependent exporter-first case requires exact serialization SQLSTATE 40001. Ten source/static checks pass, including 35 architecture and 55 E2/specialized migration tests, version-101 validation and generated no-diff. Counts are test events, not unique business cases; final archive/document checks follow separately.
This increment stops at durable source publication and discovery of original admissions that require reevaluation. It installs no runtime worker, owner reevaluation result, ordered native-feed delivery, pushed invalidation, node freshness, effective revocation or quota release. Normal long-lived authorization remains unqualified. The native at-most-two-second join-only ceiling and existing 500 ms admission deadline are unchanged; no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Snapshot100 and preceding evidence remain bound to their original source; prior native/replay evidence is not rebound and the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
Source-bound authority export evidence (../development/evidence/m1-authority-export-2026-09-26.json).
GX03 retain checked admission graph and durable selectors — 2026-09-26
The original Human/Device and independent Service checks now assemble a private typed admission graph from their actual checked proof objects in the same serializable owner transaction. It retains exact original roots and intervals, resource observations, Grant fences, current Service detail, consumed Consent binding, capability/requirements facts and quota coverage. No token, credential verifier, signing key or mutable native participant is retained. Exact source selectors include the full fourteen-coordinate Consent binding as well as the original receipt ID.
Migration 100 stores immutable admission snapshots tied to the actual same-transaction audit and native connection binding. The database derives capture epochs, XID, fixed authority snapshot and clock. Normalized dependency rows must match every distinct selector; SHA256 limits index size and full coordinates remain part of lookup validation. Sorted selector INSERTs and SHARE locks form a registration rendezvous. Deferred checks reject missing dependencies and own-transaction source mutations, and expiry is checked after waits and at commit. Existing public/native backend privileges do not grant this storage. The private owner records the graph after the final original and Service rechecks and commits before returning.
Actual isolated Linux race regression on committed Service99 parent c680f74706d20235966bcf496052f6b469c43d51 plus fourteen exact integrated files: 675 passing parent/subtest events, 8 exact roots, 3 packages, zero failures/skips, no source drift and verified owned cleanup. Actual Human and public Device admission fixtures check graph/selector storage. Storage tests cover immutable evidence, native-role exclusion, source/audit/selector rollback, deferred rejection of a source mutation after registration, an existing-key serialization primitive and a real stale admission against a newly inserted publication key that must fail with exact SQLSTATE 40001. The latter invokes the rendezvous directly; no source exporter or zero-dependent publication job ran. Successful checked report absence remains copy-only coverage, not a new successful real absent-report fixture. Existing PolicyCallerWithdrawal, embedded digests, fresh-schema and concurrent migration application also pass. Ten source checks pass, including 35 architecture tests, 55 E2/specialized migration tests, version-100 validation and generated no-diff. Counts are test events, not unique business cases; final archive/document checks follow separately.
This increment stores the graph and registration foundation only. It does not run an exporter, publish a complete invalidation feed, reevaluate an admission, push invalidations, prove node freshness or effective revocation, or qualify normal long-lived authorization. The at-most-two-second join-only ceiling and existing 500 ms admission deadline are unchanged; no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Service99 evidence remains bound to its own source and commit; prior native/replay evidence is not rebound and the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
Source-bound admission snapshot evidence (../development/evidence/m1-admission-snapshot-2026-09-26.json).
GX03 capture current Service detail presence — 2026-09-26
The existing Service checker requires its current detail row. Migration 99 adds that missing durable source to the private authority journal without changing the checker or prohibiting previously legal detail deletion/restoration. Exact INSERT/DELETE facts use the Service ID, SQL-null source revision and ID-only projection. BEFORE TRUNCATE captures every removed ID under the existing source lock; empty truncation, no-op and metadata updates fabricate no presence change. Journal and pending work commit or roll back with the original mutation. No Principal/Grant generation or connection event is invented.
The runner drains existing capture writers and then the new detail source before its first serializable snapshot and journal constraint DDL. The independent immutable Service capture epoch preserves epoch 98, earlier migration records and owner history; pre-installation state is not backfilled as fictional events. A verified applied 99 returns before source locks. Source writers acquire no shared stream head, registration lock or connection fanout. Event IDs remain work identities, not commit cursors.
Actual isolated Linux race regression on committed parent de91872e6adbdba93f6989779d3a2753d0d0adda plus eleven exact integrated files: 27 passing parent/subtest events, 8 exact roots, 2 packages, zero failures/skips, no source drift and verified owned cleanup. The signed Service fixture checks current denial, rollback, committed ABA and unchanged Principal/Grant versions; actual version-98 upgrade fixtures check the installation boundary, writer handoff, per-ID truncation/rollback and verified no-op. Existing PolicyCallerWithdrawal, embedded digests, fresh-schema verification and concurrent application also pass. Ten source checks pass, including 35 architecture tests, 55 E2/specialized migration tests, version-99 validation and generated no-diff. Counts are test events, not unique business cases. Final archive/document checks follow separately.
The exact version/path/SQL-hash tooling exception permits only this reviewed source-kind CHECK expansion while preserving destructive DROP/TRUNCATE rejection. The manifest uses destructive:false and data-preserving-rtc-capture-source-expansion; this explicit tooling supplement supersedes the original four-file proposal README's earlier expand-only wording. The separately reviewed E2 correction appends explicit versions 93–99 and exact version-99 classification, retaining earlier assertions and frozen inventories.
This increment captures Service presence only. The latest committed Human/Device retained facts remain separately source-bound. It does not install admission-vector storage, an exporter, publication barrier, runtime push, freshness or effective revocation. The at-most-two-second join-only ceiling is unchanged and no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior native/replay evidence is not rebound; the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
Source-bound Service capture evidence (../development/evidence/m1-service-detail-capture-2026-09-26.json).
GX03 retain checked Human and Device owner facts — 2026-09-26
The existing Human RTC owner now retains its checked Application client, original stored AppSession and selected AppSession/Room Grant evidence, including nullable expiries. Existing Device Room and connection owners retain the exact original AppSession, final successfully checked stored Delegation roots and binding/reference fields, current requirements, explicit report presence with complete checked report metadata, and the actual compatibility assessment. Distinct Human roots remain separate. Existing Grant fences and original resource intervals retain their own observations.
Private copy helpers isolate optional pointers, stored reference slices, nested capability/profile slices, report contents and assessment values. The shared AppSession copy owner serves both increments. Full successful rechecks replace retained facts only at the existing successful assignment; a failed recheck leaves earlier observations with no authority, and failed acquisition returns no retained facts. Thin time/credential checks do not pretend to refresh dependencies. No additional SQL, lock, authorization predicate, generation-equality denial, native hook or deadline is introduced. All 23 existing runtime raw literals are unchanged. Stored original ObservedAt, current root observation time and HistoryThrough remain distinct; none becomes a capture epoch or publication watermark.
Actual local Linux race regression on clean Resource parent ba4607ca44eb47932711dd5e56bf8f247bd02820 plus the reviewed 12-file composition: 1022 passing parent/subtest events, 7 exact roots in 3 packages, zero failures/skips, no source drift and verified owned-container/network cleanup. The suite includes the separate synthetic copy-ownership root (3 passing event(s)); those values are not actual authority acquisition. Real existing Human and signed public Device fixtures compare retained values with independent database/repository evidence, cover nullable and finite Human Grant expiry, successful recheck, denied fresh acquisition and failure preserving only prior observations, and preserve the complete distinct-Human root facts. The handler root uses stock LiveKit Room API and separate Redis; no patched native host is run. Source gates (35 tests), authority, native boundary, format, docs, secrets and diff passed. Final archive/document checks follow separately. Counts are test events, not unique business cases.
Optional expired report bytes remain present when the existing evaluator accepts that state. Successful acquisition without a report is NOT_NEWLY_TESTED by this fixture; synthetic absence-copy coverage cannot supply that proof. The normal public Device fixture already has report history, so deleting it is a denied case. Required native capability enforcement and extra Application/Device binding shapes are not newly qualified.
The original combined manifest keeps parent_resource_commit null. Separate evidence binds it to the actual Resource commit and all 13 parent source blobs, preserves Human4/Device8 manifests and all three reviews, and proves the five new files were absent at that parent. These are latest successfully checked facts, not an immutable published dependency vector, portable permit, publication/capture barrier, push path or longer-lived authority. The at-most-two-second join-only ceiling is unchanged. Native patch metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior native/replay evidence stays separately source-bound; the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS; complete vectors, freshness, effective revocation and long-lived RTC remain unqualified. Final candidate stays null and completion/G_PRE credit added is 0.
Source-bound owner facts evidence (../development/evidence/m1-connection-dependency-facts-2026-09-26.json).
GX03 propagate complete original resource intervals through checked owners — 2026-09-26
Existing AppSession lifecycle and final Delegation checks now return their already-read resource facts alongside the same results. Checked Human AppSession, Human RTC, Device Room and Device RTC owners retain copied outer graphs and nested change revisions only after their original checks succeed. Every original admission interval remains distinct, including repeated resource keys from lifecycle and different roots. The batch keeps the final successful root observations, not superseded prepass copies. HistoryThrough is an observation timestamp, never a semantic generation, publication watermark or recheck-equality rule. No Service resource graph is invented for paths that do not read one.
The nine runtime files preserve all 58 raw literals and the existing queries, authorization predicates, lock ordering and deadlines. Full successful origin rechecks replace observations; failed rechecks leave only prior nonauthoritative observations. Failed acquisition returns no partial graph. Existing time/credential-only final checks remain unchanged. These retained facts do not authorize use after a failed check or ended transaction and do not form an immutable publisher snapshot.
Actual local Linux PostgreSQL race regression on clean parent 8849c1798876bd10517a7663af917d5922dc8d3d plus the 13 reviewed overlays: 1017 passing parent/subtest events across 6 exact roots in 3 packages, zero failures/skips, no source drift and confirmed owned-container/network cleanup. Existing real Human fixtures check exact admission/head/change coordinates, terminal/restoration history, successful changed-head rechecks with unchanged deadlines, and copied nested slices. The signed distinct-Human Device fixture checks complete multisets of 25 Room and 34 origin observations, including the separate AppSession/RTC anchors and repeated Device observations. Additional distinct Application/Device targets are not newly exercised. The handler root uses stock LiveKit Room API and separated Redis; the patched native host is not executed. Counts are parent/subtest events, not unique business cases. Source gates (35 tests), authority, native boundary, format, docs, secrets and diff passed; final archive/document checks are a separate step.
The frozen proposal retains its original null parent_grant_commit. The evidence separately proves the actual committed Grant parent, all 17 corrected Grant source blobs, and the 13-file bridge: eight Grant-layer parents and five unchanged earlier committed owners. The corrected permanent-membership revocation cleanup remains intact; the preceding Grant failed attempt and corrected PASS retain their separate source-bound archive.
The at-most-two-second join-only ceiling and native patch are unchanged. Seven unchanged metrics: 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior PostICE and forward replay evidence is not rerun or rebound. The old PostICE timeout cause remains NOT_PROVEN and stability unresolved. Complete dependency vectors, publication/capture barriers, normal long-lived RTC, export/push, freshness and effective revocation remain unfinished and unqualified. GX03 stays IN_PROGRESS; final candidate is null; completion/G_PRE credit added: 0.
Source-bound Resource evidence (../development/evidence/m1-resource-owner-propagation-2026-09-26.json).
GX03 retain checked Grant-set fence observations — 2026-09-26
The existing Grant authority owner now retains copied exact PrincipalID/generation facts from its successful checks. Human application clients and original RTC authority, current Human AppSession authority, the independently checked executing Service, and the complete Device original AppSession-plus-RTC-root union keep their own checked observations. Distinct Human delegators remain separate keys; a shared Device principal is deduplicated. No ActorChain inference or caller-provided proof is introduced.
These are latest-successful checked observations, not an immutable publication snapshot or portable permission. A full successful recheck replaces them; a failed recheck leaves only the previous observation, which cannot authorize anything after failure or transaction completion. Existing time/credential-only final rechecks remain time/credential-only and do not reread Grant fences. The 33 raw SQL literals in eight runtime files are unchanged. No extra query, lock order, authorization predicate, generation-equality refusal or deadline is added; unrelated same-transaction Grant changes can advance retained observations after a successful full recheck.
Actual corrected local Linux PostgreSQL race regression on source base 17e8a6bab37d2a98d03d9488ff7190ebbc92e8df plus the 17 reviewed overlays: 994 passing parent/subtest events, 14 exact affected roots in 2 packages, zero failures/skips, no source drift and verified owned-container/network cleanup. The real signed Device fixture exercises separate original AppSession and RTC Human delegators, exact database generations and the shared Device. The existing handler root uses stock LiveKit Room API with separated Redis; this lane does not run the patched native host. Counts are not unique business cases. Source gates (35 tests), authority, native boundary, format, docs, secrets and diff checks passed; archive/document checks are a separate subsequent step.
The first actual run remains a FAIL: 986 pass events, 9 failure events from one cleanup leaf and its parent/package propagation, 13 of 14 root passes, zero skips/drift and verified container cleanup. Its deferred membership DELETE correctly hit the permanent-identity guard (P0001). The explicit one-file test correction revokes the exact created membership and verifies row/head/history parity; it preserves permanent identity and prior active history. It supersedes only the original proposal/review expectation of deleting the row or restoring absence. All 16 other proposal files, including all runtime code, are byte-identical. Both original and corrected source/static/result evidence are retained separately.
The at-most-two-second join-only admission ceiling and native patch are unchanged. Seven unchanged patch metrics: 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. The archived historical PostICE comparison identified no concrete old resume-race repair from the lifetime extraction. Prior PostICE diagnostic/contextual results retain their original source binding; they are not rerun or rebound to this Grant increment. The older timeout cause remains NOT_PROVEN and stability unresolved. Complete dependency vectors, publication/capture barriers, normal long-lived RTC, export/push, freshness and effective revocation remain unfinished and unqualified. GX03 stays IN_PROGRESS; final architecture candidate remains null, and this increment adds zero completion/G_PRE credit.
Source-bound Grant evidence (../development/evidence/m1-grant-dependency-2026-09-26.json); historical PostICE comparison (../development/evidence/m1-grant-dependency-2026-09-26-raw/postice-original-failure-comparison.md.txt).
GX03 actual forward replay of current local-validity patch — 2026-09-26
Official untagged LiveKit source f7ec53ca73dc895c447a7bd110b71c6de32e3b43 and Protocol 26af364d03193a0d4902588e980d896f15a8ea12 were actually replayed against patch 81abe7215d8310e4c52460e6d243e0c4c9be0d6a6b7120fea110d6c4d434863c, using the immutable Platform 4ca259fc1796e0692df5bcf5c3e0f90026a7b852 snapshot. This is a forward source candidate, not a new release. Production pins and Platform host adapter bytes are unchanged. Later Platform authority changes are outside this replay snapshot.
The initial apply recorded two conflicted files and four rejected hunks in NewRoom and RoomManager.StartSession. Seven recorded patch-text replacements preserve the candidate's clone helper and telemetry SDK arguments; this is not a unique output-source LOC count. Original rejects, resolution patch and apply logs are retained.
All eight fresh phases passed: Wire, offline host dependency preparation, native service, RTC/signalling, selected upstream Room, Platform host build, host tests and binary module readback. Native suites recorded 144 passing parent/subtest events across 60 exact roots; host suites recorded 215 events across 27 exact roots. Counts are events, not unique business cases. The selected race suites had zero failures/skips; input hashes stayed unchanged and owned-container cleanup passed.
The current-patch result is PASS_FOCUSED_FORWARD_PATCH_REPLAY_WITH_DOCUMENTED_MECHANICAL_REBASE. Historical patch 17ee9858... evidence remains separate and is not rebound. This lane did not run native-host E2E or post-ICE recovery. P1/P5, normal long-lived authorization, freshness, effective revocation, full upstream regression, full local CI, G_PRE, final architecture review, Staging, hardware and Production remain unqualified by this evidence. Completion credit added: 0.
Source-bound replay evidence (../development/evidence/m1-local-validity-forward-2026-09-26.json).
GX03 retain checked resource history dependency evidence — 2026-09-26
The existing resource-history owner now retains exact owner keys, original admission revisions, independently checked head revisions and every interval change revision. Delegation history exposes copied repository evidence for its already-traversed owner graph, including membership and Device owners. Terminal and restored revisions stay distinct. HistoryThrough is read-observation time, never a semantic generation or publication watermark and never a strict equality requirement across rechecks. No extra SQL, lock, authority predicate or deadline change is added.
Actual isolated Linux PostgreSQL race regression: 448 passing parent/subtest events, 11 exact affected roots in 2 packages, zero failures/skips, no source drift and owned-container/network cleanup confirmed. Counts are not unique business cases. Real signed Device and Service Delegation fixtures compare independent exact owner sets and SQL admission/head/change coordinates, including membership withdrawal/restoration and copied graph isolation. Additional binding-target graph shapes are not newly tested. Source architecture/ledger gates (35 tests), authority binding, native boundary, format, docs and secrets passed; final archive/docs checks are recorded separately at the commit checkpoint. Source-bound evidence (../development/evidence/m1-resource-dependency-2026-09-26.json).
This remains a partial owner projection. Grant-fence retention, top-level RTC origin propagation, complete vectors, capture/publication barriers, export/push, node freshness, long-lived sessions, P2-P4 and effective revoke remain unfinished. The native Post-ICE failure is NOT_RERUN by this increment; forward replay is tracked by a separate source-bound lane. Native patch and all seven metrics are unchanged. No final architecture review, completion credit, M1 v3.0, cloud or hardware qualification is added.
GX03 retain complete checked Consent dependency facts — 2026-09-26
Human and Device RTC origin owners now retain the complete checked Consent binding, selected receipt ID and receipt expiry by value. The projection requires the exact owning transaction and reuses the existing current check without extra SQL. Failed final rechecks cannot replace retained facts. Receipt expiry remains distinct from the possibly shorter policy Deadline; no authority/native lifetime is extended.
Actual isolated Linux PostgreSQL race regression: 903 passing parent/subtest events, 69 exact roots in 4 packages, zero failures/skips, no input drift and owned-container/network cleanup confirmed. Event counts are not unique business cases. Architecture/ledger gates (35 tests), authority binding, native file boundary, format, docs and secret checks passed. Source-bound evidence (../development/evidence/m1-consent-dependency-2026-09-26.json).
This is a partial dependency-retention increment, not a complete immutable vector or runtime authorization. Long-lived sessions, publication barrier, export/push, node freshness, P2-P4 and effective revoke remain unfinished. The prior native Post-ICE failure is NOT_RERUN here; current-patch forward replay is NOT_RUN. Native patch and all seven metrics remain unchanged. No final review, completion credit, M1 v3.0, cloud or hardware qualification is added.
GX03 external local-validity ownership extraction — 2026-09-26
The external Platform adapter now owns the unchanged admission lifetime and terminal policy state. Native LiveKit retains pure local checks, original-capability attachment, exact-SID cleanup and existing join/resume boundaries. Fresh unused admission capabilities are released, and Release never signals policy loss.
Candidate Linux race results: service 99 passing parent/subtest events / 37 exact roots; RTC/signalling 32 passing parent/subtest events / 20 exact roots; selected upstream Room 13 passing parent/subtest events / 3 exact roots; Platform host 215 passing parent/subtest events / 27 exact roots. Wire and the actual Platform host build also completed.
Formal registered-path host build and 215 passing parent/subtest events / 27 roots completed independently. This repeats the host requirements under the registered source paths; it is not additional unique product coverage.
Counts are real parent/subtest events, not unique business cases. All selected phases recorded zero failures/skips, no source drift and owned-container cleanup. Incremental changed-source physical LOC: runtime +40, tests +223; 3 runtime and 4 test files changed, 0 newly added upstream files in this extraction. These physical source deltas include comments/blanks and are distinct from full-patch additions/deletions.
Source-bound evidence (../development/evidence/m1-local-validity-2026-09-26.json) and growth/metrics review (../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md). Migration98 source-capture evidence remains valid against unchanged inputs; it was not re-executed by this checkpoint.
The <=2s join-only ceiling is unchanged. Normal long-lived authorization, immutable dependency vectors/publication barrier, authenticated export/push, node freshness, P2-P4 enforcement and effective revocation remain unimplemented/unqualified. TestPostgresRTCNativeHostPostICERecovery retains its previous failure and is NOT_RERUN here; current-patch forward replay is NOT_RUN. No completion credit, final architecture review, M1 v3.0 or architecture-finalized claim is added.
GX03 complete resource terminal history — 2026-09-26
Fixed an existing authority-history gap: independently setting deleted_at, revoked_at or archived_at while status stayed active previously did not advance resource history. Clearing the marker could conceal original authority loss. Migration97 extends the existing owner snapshots and retains the actual write time. AppSession and Delegation history consumers reject that loss even after restoration; RTC original-authority checks reuse those consumers.
Actual isolated Linux PostgreSQL race regression: 858 passing parent/subtest events, 59 exact required roots in 4 packages, zero failures/skips. These are event counts, not unique business cases. Source drift was absent and owned cleanup passed.
Source-bound evidence (../development/evidence/m1-owner-timestamps-2026-09-26.json)
and implementation/limits (../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md).
This is control-plane history correction only. Long-lived authorization, complete
dependency capture/push, freshness and effective revocation remain unfinished.
The prior native post-ICE recovery failure remains open, not requalified here.
No patch/adapter/public API change, no milestone credit and no final-review handoff.
GX03 durable policy invalidation storage — 2026-09-26
Added transaction-owned ordered explicit/Room-close invalidations, commit-only empty notification hints and bounded snapshot replay. Fixed standalone/middle prefix gaps and migration backfill's concurrent-snapshot/DDL lock order. Existing revoke work, immutable bindings and Data Sync transaction patterns are reused. No LiveKit patch, native adapter, SDK contract or two-second join lifetime changed.
Actual final isolated Linux race: 100 events / 22 roots / 5 packages,
zero failures/skips; includes real PostgreSQL upgrade/lock wait, concurrent Apply,
rollback, ordering, pagination, notifications and existing official native API
regressions. Source-bound evidence (../development/evidence/m1-policy-invalidation-storage-2026-09-26.json)
and implementation/limits (../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md).
Only storage is qualified: complete dependency capture, authenticated feed,
runtime push, node freshness/effect barrier and long-lived sessions remain open.
G_PRE 1.8%, zero new credit, eleven previous invalid receipts; full local CI
incomplete. External review CORRECTIONS_IN_PROGRESS; no cloud/hardware PASS.
GX03 Room operation policy extraction — 2026-09-26
Moved managed Room naming/configuration and closed Agent execution decisions to the existing host adapter, using one pure-local typed callback at existing pre-side-effect boundaries. Native preset merge, default dispatch/job machinery, checked join, scheduler and media ownership stay upstream. Two native function bodies are restored; modified runtime functions 19 -> 17, added functions 34 -> 34, files 21 (12 runtime) unchanged. Runtime changed lines grow 49 and tests 231; the seven-alternative reuse/growth justification is explicit.
Actual local Linux race: native 133/0/0, host 199/0/0; same formal-path host rerun
199/0/0 and both host builds passed. Both Go AST inventories passed. See
implementation and limits (../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md)
and source-bound evidence (../development/evidence/m1-policy-hook-room-policy-2026-09-26.json).
No completion credit is added. Long-lived authorization, pushed invalidation,
all-node effective revocation, current-patch replay and final exact-SHA review
remain open; independent Egress/worker execution is not qualified by this slice.
G_PRE remains 1.8% with eleven prior invalid receipts, full CI is not complete,
and external review stays CORRECTIONS_IN_PROGRESS. No cloud/hardware PASS.
GX03 participant-admission business extraction — 2026-09-26
Moved five business-ID validations and the complete closed join-only claim profile from native admission to the existing Platform adapter. Native keeps verified claims, bounded capacity/deadlines and immutable opaque binding/version checks; official ClaimGrants.Clone isolates the adapter snapshot. All 34 signed privilege-expansion cases migrated with zero-backend-call assertions.
Actual Linux race results: 121 native pass events and 160 host pass events, zero failures/skips; formal-path host rerun 160/0/0, both host builds passed. Authority/progress/review gate tests passed 35/0/0. Source-bound AST measurement: 21 files / 12 runtime unchanged; added runtime functions 35 to 34; patch physical lines 3880 to 3856; native OneSay identifiers 41 to 33 (225 to 185 occurrences).
Implementation, seven metrics and remaining limits (../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md)
and exact evidence (../development/evidence/m1-policy-hook-neutral-admission-2026-09-26.json)
belong to the existing Goal. Managed-room/Agent/Egress policy convergence,
long-lived invalidation and honest effective-revocation barriers remain open.
The new patch's next-version replay is NOT_RUN; previous replay was not rebound.
G_PRE remains 1.8%, no credit added, eleven prior invalid receipts remain, and
full CI is NOT_COMPLETED. External review stays CORRECTIONS_IN_PROGRESS;
no v3, final architecture or unexecuted cloud/hardware qualification is claimed.
GX03 policy convergence and external review gate — 2026-09-26
Adopted both Owner amendments in the existing Goal, feature branch, GX order and complexity baseline. Completed the current 21-file policy-patch classification: 12 runtime files, 35 added / 19 modified runtime functions, +3399/-56 patch lines. This is the before-convergence snapshot; it identifies embedded business rules, duplicated native control, scattered side-effect checks and the temporary 2s permit. It is not a long-lived authorization PASS.
The progress validator now requires all fourteen GX03 exit evidence mappings and preserves the seven-alternative patch-growth review inventory. External review requires a clean exact source SHA, later actual architecture/security/native/adapter/replay runs, and a new source-bound report. Old working-tree receipts cannot be relabeled. V3 consolidation and retiring existing amendments require explicit source-bound Owner review approval. Focused progress/gate validation passed 30/0/0.
The first Room convergence is implemented: checked and ordinary joins now share their local state insertion, retaining native call/lock ordering. The isolated candidate passed 160 Linux race tests (147 OneSay + 13 selected native Room); this is focused regression, not complete upstream or long-lived qualification. Patch files remain 21; patch text 3886 to 3880 lines, +3393/-54 after convergence. The parser-based measurement tool passed 40 Linux race cases with no failures or skips. Its metrics do not certify semantic neutrality or hot-path safety.
Local upstream proposal and durable/local-state reuse mapping are retained. The actual forward source candidate is 27 commits after the locked Server pin. Initial replay found two function-context conflicts; seven mechanical patch-line changes preserved upstream behavior. The new patch then passed 160 focused tests, actual OneSay host compilation and 73 additional host tests. This is focused forward replay evidence, not the final complete GX03 qualification. No pin promotion, posting, cloud or hardware operation follows this checkpoint. Long-lived authorization and the final external handoff remain in progress.
The evidence index is docs/development/evidence/m1-policy-hook-convergence-2026-09-26.json.
Weighted G_PRE remains 1.8%; no new completion credit. Eleven prior invalid
receipts still make the progress check exit 1; full local CI is not complete.
GX03 durable connection revoke — 2026-09-26
Migration 95 transactionally enqueues committed whole-connection revocation. The new bounded worker reuses Room-work leases/fencing and official LiveKit RemoveParticipant plus exact absence readback. It preserves revoking state, effective_at NULL, held seats and unsettled quota; no upstream patch changed.
Linux race regression passed 91/0/0, 19 roots across five packages, including
real PostgreSQL concurrency/crash/retry and actual official client removal.
The first test-fixture compilation failure is retained, not overwritten.
Implementation and CCR-A boundaries (../development/RTC_CONNECTION_REVOCATION_WORK.md) and
source-bound evidence (../development/evidence/m1-gx03-connection-revocation-2026-09-26.json).
No GX completion credit is added. Continuous authority, invalidation, effective barrier, host assembly and G_PRE remain open. The newly supplied policy-hook amendment is the immediate next checkpoint before expanding P2–P5; this increment does not treat the temporary two-second join window as a final design.
ESP32 internalization — current checkpoint, 2026-09-25
Adopted official LiveKit ESP32 as the future internal RTC runtime through one private adapter, retaining the separate OneSay Task WSS/OSAF path. The targeted ten-item audit found no existing RTC core duplication, native public-type leak or board implementation. The candidate stays at v0.3.11 / fbf09edf27a504d82119f730a35bf00fa287f7c1, with 0 LiveKit ESP32 patches.
Added a canonical-lock-backed compatibility matrix, read-only upstream checker and candidate upgrade requirements. Adapter/runtime remains NOT_IMPLEMENTED; exact media dependencies remain NOT_RESOLVED. Eight existing Task native source substitutions require future combined dependency/RTC regression because their CMake targets may be shared with LiveKit.
Final Authority/tracking/acceptance tests passed 30/30 with no failures or skips. Official immutable Git blob reads now verify source-body hashes within bounded request/operation limits. Final live discovery returned NO_UPDATE, exit 0, verifying release/tag/registry, manifest/license and all public headers without changing the pin. The earlier timeout and raw LICENSE fetch failure remain CHECK_FAILED receipts; discovery does not qualify RTC/device runtime. The latest Owner correction makes real-device SDK smoke required for GX09 / PRE-SDK and currently NOT_RUN, replacing the earlier optional status. Board BSP, codec/AEC tuning, audio quality and soak remain OS/OEM-owned.
GX09 and G_PRE are not complete, no completion credit was added, and the existing
GX03 sequence continues. Current results and preserved discovery receipts
are centralized in the
correction report (../development/ARCHITECTURE_BOUNDARY_CORRECTION_REPORT_2026-09-25.md)
and ESP32 evidence index (../development/evidence/m1-esp32-internalization-2026-09-25.json).
No board, cloud, purchase, publish, push or merge operation is included.
Architecture boundary correction — current checkpoint, 2026-09-25
Integrated the targeted GX01 foundation audit, corrected stale qualification notes and source-scan handling of ignored upstream build caches. Added a local Linux-only two-Server official LiveKit RTP/reliable-data smoke with separate Platform/native Redis and verified fixture cleanup; no product or cloud qualification is inferred from this upstream foundation test.
The native integration now contains 1 patch / 21 files. Removed duplicated room allocation, Redis routing, room fences, custom retirement and continuous 500 ms remote authorization polling. LiveKit retains runtime ownership; OneSay retains bounded business-policy hooks and local immutable expiry. A native file-boundary gate rejects runtime-kernel patch targets without claiming that an allowlist alone proves the remaining control hooks safe.
Admission is currently join-only and limited to at most 2 seconds, with no renewal or resume extension. The external durable revocation consumer is not implemented, so sustained authorization and full P1/P5 remain unqualified. The next existing GX03 task uses durable connection revocation, official native RemoveParticipant and absence readback; old participant SID events cannot authorize identity-level removal of a valid replacement.
Signed lifecycle observations are thin, nonbillable GX05 facts. They are not precise connected duration, native runtime replicas or effective revocation proof. Full rolling settlement remains GX10. Current progress is GX03 0 / 100, active scope 983.75 against the original 1000 baseline, with 18.565 earned (provisional 1.8%); deferred scope earns no credit.
Final runtime status and source-bound evidence are maintained in the
correction report (../development/ARCHITECTURE_BOUNDARY_CORRECTION_REPORT_2026-09-25.md)
and evidence index (../development/evidence/m1-boundary-correction-2026-09-25.json).
Full local CI is incomplete; G_PRE is NOT_READY. CCR-B remains
NOT-RUN — requires authorized Staging environment. Earlier entries below retain
their historical scope and evidence; polling-based behavior is superseded by
this correction. No push, merge, cloud change, purchase or hardware
qualification is included.
Device required-capability expiry — 2026-09-25
RTC unsettled quota liability — 2026-09-25
The existing quota owner now retains RTC budget after permission expiry. Generic expiration, reserve replay, commit and release cannot adopt or settle an RTC reservation. Unresolved holds remain scoped to ProjectEnvironment, metric and UTC week and survive quota-policy replacement exactly once. Historical expired, released and committed rows remain immutable; an unrelated generic UsageEvent is not native settlement proof. Existing billable facts still count, so historical unresolved commits may conservatively over-hold budget until trusted reconciliation. No billable duration is invented from a reservation.
Forward migration 93 adds a non-RTC expiration partial index and a scoped RTC liability covering index. Canonical Usage semantics and all generated consumers were regenerated normally; no historical migration or terminal row was rewritten.
Local PostgreSQL race regression: 472/0/0 across 26 roots and 3 packages. This includes original Human authority, actual native SDK ICE and active-lease withdrawal, Device authority, ordinary quota and Task settlement. After assertion-only strengthening in the new test, its final focused race run passed 11/0/0, including ten liability cases. Production, migration, canonical and generated inputs are identical between those runs; raw receipts preserve both test checkpoints. Real short-segment expiry, policy replacement, historical terminal states, generic mutation denial and ordinary positive controls are exercised against PostgreSQL. Generated Go/TypeScript/C consumer compilation passes; generated Go packages contain no tests, so that compile lane earns no test passes. All network tests ran inside owned Linux Docker with no published host ports, and owned resources were removed.
This closes an actual budget-release gap while continuing GX03. Native interval measurement, rolling segment reservation/settlement, crash reconciliation and settlement backlog visibility remain required. The original token and native authority ceilings are unchanged. Full P1/P5, full local CI and G_PRE remain unqualified; this increment earns no complete milestone credit. Package order and the fixed 1000-point denominator are unchanged. CCR-B remains NOT-RUN — requires authorized Staging environment. No cloud, purchase, hardware, Desktop, Production, remote push or main merge was performed.
Local evidence (../development/evidence/m1-gx03-rtc-quota-liability-2026-09-25.json).
2026-09-25 — Device native signaling admission
Connect actual public Device RTC origins to the existing compiled admission hook. Use one private ConnectionAdmission path, closed Human/self-Device durable profiles and original authority checks without constructing a Device login. Direct native clients exercise join, pre-ICE resume and full reconnect; original root and credential-generation withdrawal reject new admission. Keep join-only permissions, unique Service routing, TLS/JTI bounds and restricted database roles.
Local evidence (../development/evidence/m1-gx03-rtc-device-native-2026-09-25.json).
Actual Linux PostgreSQL, shared Redis, private TLS admission and compiled native host signaling regression: 1711 / 0 / 0 across 100 roots, including 11 Device native case events. Native host race checks: 73 / 0 / 0 across 13 roots. Counts include parents/subtests and retained regression cases, not feature totals. The isolated stack publishes no host ports, records no source drift and proves owned container/network cleanup. These are local signaling results, not media quality, load measurements or a Staging capacity baseline.
The archive preserves 3 failed attempt(s) separately from the final passing lanes. They are not rewritten as passing runtime evidence.
| Attempt | Pass / fail / skip | Recorded reason |
|---|---|---|
| invalid-schema-selectors | 1393 / 119 / 0 | New predicates incorrectly referred to participant user_id/device_id columns absent from the canonical schema. Real PostgreSQL rejected the normal creation flow. Fixed to the existing principal_id/principal_kind plus connection self-Device mapping; malformed-profile tests now exercise those actual fields. |
| stale-role-test-schema-ceiling | 1674 / 2 / 0 | The expanded regression reached the old native-role test, whose prerequisite still required max migration 89 despite the current schema being 92. Updated only that test to require the complete current embedded schema through VerifyCurrentSchema, while independently retaining exact migration 89 digest and original role withdrawal/restore checks. |
| mixed-native-test-cluster | 286 / 8 / 0 | The unpatched upstream Room API fixture and compiled policy host shared native Redis node discovery. The second Device join lacked the required private callback. The strict call/audit assertion caught this invalid fixture: each native cluster now has its own owned Redis process, distinct from Platform Redis. |
Compilation/setup failure without test events is not a runtime rejection result. A launcher-generation syntax failure was also retained separately; it started no test or container and earns no runtime credit.
Continue GX03 with required-capability report expiry using a genuinely admitted Device AppSession whose Application requires that capability. The existing empty- capability fixture does not qualify this condition. Then complete continuous Quota/Usage and native enforcement for active sessions. Agent execution retains its existing GX07 position. Package order, weights and the single ledger remain.
Device native admission: LOCAL_DIRECT_SIGNAL_JOIN_RESUME_RECONNECT_ONLY. Media, active-session removal and P1/P5 remain NOT_QUALIFIED. Full local CI is NOT_RUN and G_PRE is NOT_READY. New milestone credit is zero. CCR-A remains in progress; unrelated historical receipts are not rebound to current sources. CCR-B: NOT-RUN — requires authorized Staging environment. Production, Desktop and physical-device acceptance were not executed by this checkpoint.
2026-09-25 — Device RTC HTTP execution and immutable origin
Add actual Device RTC create/read/revoke with independent public Delegation and Human Consent, migration 92 immutable original authority, atomic Device seat and initial Quota, protected replay and cache-loss rejection. Preserve held capacity while revoking. Direct HTTP rejects stale credential generations, revoked roots/ Grants and lost original AppSession authority without relying on SDK integrity.
Local evidence (../development/evidence/m1-gx03-rtc-device-execution-2026-09-25.json):
Linux PostgreSQL, shared Redis and the retained upstream Room API Go race:
1058 / 0 / 0 across 55 roots. Migration safety/static checks:
53 / 0 / 0; migration manifest/generated consistency passes. Counts
include parents/subtests and retained regressions, not additional feature totals.
The isolated Linux stack publishes no host ports, has no source drift and passes
owned container/network cleanup. The unpatched upstream fixture proves Room API
setup only, not Device native policy, join, media or cloud behavior.
The archive retains 2 failed attempt(s) separately from the final passing lane; earlier receipts remain historical.
Continue GX03 with native Device admission, required-capability report expiry qualification and continuous RTC Usage/Quota renewal. Agent execution stays in the existing GX07 sequence. No new infrastructure or competing plan is introduced.
Device native admission is NOT_IMPLEMENTED and Device media is NOT_QUALIFIED. P1/P5 remain NOT_QUALIFIED, full local CI is NOT_RUN and G_PRE is NOT_READY. New milestone credit is zero; package order and complexity weights are unchanged. CCR-A remains in progress; this checkpoint does not refresh unrelated historical aggregate receipts. CCR-B: NOT-RUN — requires authorized Staging environment.
2026-09-25 — Device credential generation and RTC seat/Quota prerequisites
Bind signed Device access tokens to monotonic credential authority generations; reject missing/noncanonical generations and prevent revoked/restored credentials from reviving old JWTs or stale opaque authentication snapshots. Existing JWTs without the generation claim require a fresh credential exchange. Migration 91 keeps only credential IDs and generations in append-only history, without secrets. Recheck held Device Room authority in its original transaction before commit.
Add separate Device seat/initial Quota entry points with exact durable projection,
replay/expiry checks, quota-denial rollback and retained revoking capacity.
Local evidence (../development/evidence/m1-gx03-rtc-device-generation-2026-09-25.json): Linux PostgreSQL/Redis
race 1034 / 0 / 0 across 55 roots; migration/static checks 46 / 0 / 0;
manifest/generated consistency, source stability and owned cleanup pass.
The isolated fixtures publish no host ports. Counts include parents/regressions.
Actual Device RTC Consent consumption, immutable connection origin and native admission are still incomplete. P1/P5 remain NOT_QUALIFIED, full CI NOT_RUN and new milestone credit zero. Cloud: NOT-RUN — requires authorized Staging environment.
2026-09-25 — Device RTC delegated Consent preparation
Add migration 90 and public Device RTC Delegation/Consent preparation using existing identity, AppSession, Grant and Human confirmation owners. Enforce exact Room/session/operation bindings, immutable observation/replay and revoked-root denial. Fix multi-binding Grant/fence lock ordering with a real concurrent writer.
Local evidence (../development/evidence/m1-gx03-rtc-delegated-consent-2026-09-25.json):
Linux PostgreSQL/Redis/upstream Room API race 653/0/0, migration static tests
40/0/0, generated schema consistency and owned cleanup pass. Retained
Human RTC tests pass. Initial failed/skip evidence is preserved. Actual Device RTC
execution, quota/native admission, P1/P5, full CI and Staging remain incomplete.
2026-09-25 — Device RTC prerequisites and delegated contracts
Adds a server-owned, transaction-bound Device/Room/AppSession prerequisite using existing signed identity, original admission, Grant and Consent history owners. Adds canonical bounded RTC create/revoke Delegation and Consent operation bindings with generated SDK projections. This does not enable Device RTC native admission or replace a new RTC operation's Consent with AppSession Consent.
Local evidence (../development/evidence/m1-gx03-device-room-authority-2026-09-25.json):
PostgreSQL/Redis race 586/0/0, canonical 364/0/0, generated/native contracts
1368/0/0; Go/TS/C compilation and regeneration pass. Counts include parents and
retained regressions. A C++ test now explicitly selects its source language;
strict warnings and C ABI tests remain. Initial failures are archived.
Full CI, complete Device RTC and P1/P5 remain incomplete; Staging is NOT-RUN.
2026-09-25 — Actual native refresh and independent scope isolation
Adds direct-client tests for actual LiveKit refresh material, original/refreshed
token rejection after Grant withdrawal, same-project cross-environment isolation
and same-environment cross-Room isolation. Shared fixture helpers reuse existing
identity, Consent and Room-worker initialization; no production code changes.
Local evidence (../development/evidence/m1-gx03-native-refresh-isolation-2026-09-25.json)
passes 31/0/0 across five roots, including retained actual ICE recovery, with
no drift and confirmed owned cleanup. Counts include parents/subtests.
Test/client race instrumentation does not imply the reused static native ELF is race-instrumented. P1/P5, active-session removal, media and Device/Agent remain incomplete; public Rate/Usage sinks are substitutes. Full CI is NOT_RUN and cloud is NOT-RUN — requires authorized Staging environment. Earlier entries are historical.
2026-09-25 — Native client recovery and callback lifetime
Fixes retained Room/Participant callbacks inheriting an ended request context, preserving 500 ms persistence budgets, generation fencing and cancellable admission. The 29-file policy reconstructs with real Wire; Linux build passes. Service race tests pass 178/0/0 (32 roots), host 73/0/0 (13 roots) and actual-client tests 25/0/0 (3 roots) including 22 negative subcases, with source stability and owned cleanup. Counts include parents/subtests and overlap.
Public Go SDK 2.18.1 APIs prove ICE/ACTIVE state, actual signal-loss recovery with
the same SID, full reconnect with a new SID and revoked unexpired-material denial.
Adversarial coverage adds source-list claims and a valid admission after the
negative sequence. Evidence (../development/evidence/m1-gx03-native-client-recovery-2026-09-25.json)
retains first-run ACTIVE-readback failure and the next helper-classification
failure; coarse wire refusals require durable/no-insertion/positive controls.
Distinct-scope pairs are not the independent Project/Environment/Room matrix.
Refresh-token replay and media delivery remain NOT_RUN; public Rate/Usage sinks
are substitutes. P1/P5 NOT_QUALIFIED, full CI NOT_RUN, zero milestone
credit, public traffic disabled; cloud
NOT-RUN — requires authorized Staging environment. Earlier entries are historical.
2026-09-25 — Managed Room and actual native host signalling
The existing authenticated management path now prepares protected Rooms without granting Human admission authority. The 28-file policy series and real Wire generation reproduce the tested source exactly. Local race tests pass 172/0/0 (30 service roots) and 73/0/0 (13 host roots); Linux build and owned cleanup pass. Actual host/PostgreSQL/private TLS/direct WebSocket signalling passes 1/0/0 (1 root): join/readback, checked resume preserving SID, full reconnect with a new SID, unexpired-token denial after Grant withdrawal without new allow audit, and anonymous denial. Counts include parents/subtests and overlap.
The archive (../development/evidence/m1-gx03-native-managed-host-2026-09-25.json)
retains compile/cache failures, old host join HTTP 500 and the incorrect pre-ICE
resume expectation. The passing resume keeps the old signalling source live;
no ICE/media or real network-loss recovery is qualified. Public Rate/Usage sinks
remain substitutes. P1/P5 NOT_QUALIFIED, full CI NOT_RUN, no milestone
credit, public traffic disabled; cloud
NOT-RUN — requires authorized Staging environment. Earlier entries retain
their historical scope.
2026-09-25 — Native Room generation fencing
The current GX03 increment fences ordinary/protected Room callbacks by exact instance, shared SID/node and serialized state. Participant callbacks are update-only; deleted children cannot be resurrected. Closed local Rooms remain tombstones until shared cleanup is confirmed. Real Redis cleanup checks the exact multi-key command ACL before any mutation. Existing management authority and native media/reconnect engines are preserved.
Actual affected Linux race results: service 148/0/0 (25 roots) and rebuilt
host 73/0/0 (13 roots), with owned cleanup PASS. Counts include parents and
subtests; the 7 local and 15 Redis fence events are included in 148, not added.
Pinned-source extraction, formal patch application and real Wire generation
reproduce the tested native/protocol bytes; Linux host compilation passes.
The first ACL-fixture failure is retained, and corrected fixtures prove their
actual Redis identity and ACL denial response. See current evidence (../development/evidence/m1-gx03-native-room-fence-2026-09-25.json) and state ownership and limits (../development/RTC_NATIVE_ROOM_GENERATION_FENCE.md).
This closes the identified local generation-fencing gap only. Native P1/P5 and real host/PostgreSQL/direct-client admission remain NOT_QUALIFIED; full local CI is NOT_RUN, G_PRE is NOT_READY, and this increment earns no GX03 milestone credit. CCR-B: NOT-RUN — requires authorized Staging environment. Earlier sections retain their historical scope and evidence.
2026-09-25 — Native host and locked session boundaries
Adds the Platform-owned LiveKit host, pinned source/patch preparation tools and
minimal native admission hooks for protected allocator, manager, Room and resume
transitions. Existing Platform identity and private admission remain authority;
Human admission cannot authorize automatic Agent/Egress execution. Real Wire
generation and a bounded Linux host build pass. Separate local race scopes pass
126/0/0 (19 roots), 52/0/0 (23 roots) and 73/0/0 (13 roots), including
an owned real Redis allocator case; counts include parent/subtest events.
The original archive (../development/evidence/m1-gx03-native-lock-session-2026-09-25.json)
retains its historical 62-event host result. The
signing-policy archive (../development/evidence/m1-gx03-native-signing-2026-09-25.json)
supersedes only host tests/build; unchanged service and Room native/root Go
inputs reuse their previous results without rerunning. Removes default
devkey/secret, requires every effective signing secret (including key-file
overrides) to be at least 32 bytes, and rejects native development mode in
Staging/Production before database access. Five actual CLI rejection cases
observe zero database connections; host source stability and cleanup pass.
Cross-generation cleanup fencing is under repair. P1/P5 NOT_QUALIFIED,
public traffic disabled, no new progress credit, full CI NOT_RUN and cloud
capacity validation NOT-RUN — requires authorized Staging environment.
See host boundaries (../../cmd/livekit-server/README.md).
2026-09-25 — Restricted native database startup
SQL formatting follow-up: removed only the extra terminal blank lines in migration 89 and its owned withdrawal fixture, regenerated immutable digests, and reran the same 12-suite scope: 113/0/0, cleanup PASS. The original role receipt remains historical. No milestone, full-CI or cloud credit is added.
Adds forward migration 89 and mandatory restricted-LOGIN startup validation for
the native admission backend. Exact column privileges cover 11 application
tables plus three migration-ledger columns. Catalog and existing exact-schema
checks share two seconds; per-admission work remains bounded to 500 ms.
The unchanged schema verifier moves to a leaf package to avoid a test import
cycle, preserving the existing migration API. Local race-enabled validation
passes 113/0/0, 12 required suites, cleanup PASS; two earlier failures remain
archived. This startup snapshot does not continuously attest owner-controlled
database state. Native host/StartSession/P1/P5 remain unfinished. Current bound
progress is 2.8%; aggregate CCR/progress and existing E6 checks remain FAIL,
full CI is NOT_RUN and cloud capacity validation requires authorized Staging.
See scope and evidence (../development/RTC_PRIVATE_ADMISSION_CLIENT.md).
2026-09-25 — Native Human admission backend
Composes shared-cluster native-pair routing with the existing durable Service
issuer and private HTTPS client. The read-only route transaction ends before
issuance; one 500 ms budget bounds pool waits and cleanup. No cached allow,
Service fallback or sent-request replay is added; existing bounded identity
transaction retries remain. Focused race-enabled validation passes 70/0/0,
cleanup PASS. Native host/StartSession and database-role guard remain pending;
P1/P5 and full CI are not qualified, progress receives no new credit.
See scope and evidence (../development/RTC_PRIVATE_ADMISSION_CLIENT.md#native-backend-composition-increment--2026-09-25).
2026-09-25 — Private Human admission client
Adds fresh Service-token issuance and strict private Human admission calls,
with no sent-request replay, independent scope/expiry checks and a 500 ms
absolute budget through per-call TCP/HTTP/2 cleanup. Local race-enabled unit
and actual PostgreSQL/TLS composition pass 72/0/0, cleanup PASS. Native
backend/StartSession integration and P1/P5 remain unfinished. Last sealed
progress stays 10.0%; shared-source regression awaits the combined checkpoint.
Global E6 remains FAIL; final local CI, hardware and cloud acceptance remain
NOT_RUN. See implementation and evidence (../development/RTC_PRIVATE_ADMISSION_CLIENT.md).
2026-09-25 — Private Human and Service RTC admission
The additional Scope/public-control and bootstrap startup regression passes 20/0/0 with owned PostgreSQL cleanup. Historical Data Sync receipts are kept byte-exact; the reviewed optional private receiver mount needs separate current source and actual case validation. This does not qualify full StartRuntime assembly. The final checker also exposes a preexisting E6 Usage-spec evidence mismatch, assigned to existing GX10.usage; global acceptance remains FAIL.
Adds the private HTTPS receiver and transactional SQL owner for original Human connection admission. Exact native routing, independent current Service Grant, original Human authority, final rechecks and actor audit must commit before a short-lived decision is returned. Existing Service authentication and the Control API TLS listener are reused; strict configuration explicitly disables or completely configures the receiver.
Local focused validation passes 283/0/0 after preserving and fixing the first
262/4/0 attempt. Native caller/StartSession/P1 enforcement, Device/Agent
admission and effective revocation remain incomplete. The ledger stays 10.0%,
G_PRE NOT_READY. Affected regressions are archived; the interrupted Task/RTC
harness attempt remains a failure, followed by its single passing timeout retry. Work
stays on the local feature without push, merge or GitHub Actions. CCR-B remains
NOT-RUN — requires authorized Staging environment.
See implementation and evidence (../development/RTC_NATIVE_HUMAN_ADMISSION.md).
2026-09-25 — Exact native RTC connection mapping
Native Room/identity routing now selects only the exact current Human connection in its configured cluster. It is non-authorizing and composes with durable original authority and final transaction rechecks. Race-enabled SQL tests cover positive paths, invalid pairs, lifecycle/generation drift and withdrawn authority; native admission enforcement remains open.
2026-09-25 — Local Task WSS and RTC regression
Existing Task PCM/ACK/replay and Task/Usage now have a reproducible local TLS-verified regression during RTC audio and after publisher leave. The Device conformance version lock is regenerated, process failure cleanup is bounded, and real negative TLS cases are checked. This is early separate-namespace local evidence; native server enforcement, same-tenant composition and cloud qualification remain open.
2026-09-25 — JavaScript RTC receiving facade
The public OneSay audio session now replaces an exact server-authorized subscription set, enables playback from a user gesture, and releases local resources on expiry, cancellation, reconnect or close. Independent packaged OneSay publisher/receiver browsers pass known-audio decoding, mute/unmute, fresh-authority full reconnect and leave cleanup. This is isolated local media evidence; final native enforcement and deployed metering remain incomplete.
2026-09-25 — Durable RTC subscription policy storage
Adds forward migration 85, immutable bounded subscription versions, exact generation targets, CAS, private mappings and separate trusted-observation storage. Shared lifecycle fencing prevents stale snapshot writes. This private prerequisite does not enable subscription authorization or native enforcement.
2026-09-25 — RTC subscription upper-bound contract
Adds the draft canonical subscription update Action, exact bounded publication selectors, version and observed-effect separation, generated contracts and protected HTTP/ESP32 Control transport boundaries. Runtime subscription authority and native policy are not enabled. Existing Platform SDK and OS/OEM hardware ownership remains unchanged.
2026-09-25 — JavaScript RTC microphone lifecycle
The draft OneSay session adds Source-bound microphone publication, mute/unmute and local-first end cleanup through internal LiveKit reuse. Public types stay independent of native objects. Validation is an isolated local experiment; full OneSay media and native server policy qualification remain open.
2026-09-25 — RTC publication execution
Local publication creation and ending now compose current server permissions, Consent, held connection quota and atomic protected replay. Ending records a stop request without claiming media has stopped. Public deployment remains disabled until native enforcement and SDK media qualification are complete.
2026-09-25 — RTC publication confirmation
Publication creation and ending now use the existing durable Consent flow with original resource/session bindings and current server permissions on every read, decision and replay. A confirmation cannot itself start or stop native media. Public publication execution remains under development.
2026-09-25 — RTC publication API contracts
Define canonical RTC publication create/end inputs and responses with exact resource binding and honest requested-versus-observed stop state. Extend the ESP32 Control client to nested Room/publication resource paths. Both APIs remain disabled pending their owning authority/Consent/quota service and native policy.
2026-09-25 — RTC publication end prerequisite
Add the internal authorized desired-stop transaction for owned RTC publications. Repeated stops preserve original request history; media remains pending/active until actual termination is confirmed. Current server permissions still apply after Source withdrawal or prepare expiry. Public publication APIs remain under development.
2026-09-25 — RTC publication preparation
Add an internal durable RTC audio publication intent using existing Source, SignalPublication and SignalStream resources. Bound concurrent preparation, preserve immutable resource generations and keep unknown capture timing explicit. Closing a Room requests native RTC stop; it does not report effective media end until confirmed. Public media publication remains under development.
2026-09-25 — ESP32 SDK integration responsibility
Clarify that OneSay ESP32 SDK supports independent OEM integration without OneSay OS. Platform validates its complete SDK, component delivery and media port contract; OS/OEM validate concrete boards, drivers, tuning and hardware quality. Reference conformance and optional real-device portability evidence remain separately labeled. Existing SDK functionality is unchanged.
2026-09-25 — Installed JavaScript RTC candidate validation
Validate the RTC connection lifecycle from an independently installed OneSay package in a real local browser against Control API, PostgreSQL and LiveKit. SDK and transitive dependency bytes are verified against the package and pinned lock. This remains a private local candidate; full media, native policy and release qualification remain open.
2026-09-24 — JavaScript RTC connection lifecycle
Add OneSayClient.rtc.connect/get/revoke and session refresh/close using existing OneSay authentication and server admission. Sessions expose scoped OneSay resources and observed capabilities; native objects and connection tokens remain internal. Close disconnects locally before requesting revocation, preserves its retry key and reports pending server revocation accurately. Initial local validation supports join-only connections; media and continuous native policy remain under development. This is not a published SDK or cloud release.
2026-09-24 — Neutral Room and separate task/RTC operations
Remove the unpublished Room service selector from creation and resource contracts. Task voice and RTC keep separate operations and connections within the same Room. Their admissions share the Room capacity limit; RTC accounting counts only RTC connections. A forward migration retains existing Rooms, Tasks, Participants and runtime bindings. The old selector is rejected rather than retained as an alias. SDK composition and native policy remain in progress.
2026-09-24 — Initial RTC connection runtime under local validation
Compose connection create/query/revoke with current identity and confirmation, atomic capacity/quota reservations and protected retries. Management queries return no connection credentials; pending revocation keeps its reserved capacity. The implementation is restricted to local validation while native policy and SDK integration continue. Local Windows RTC tests now execute from stable paths to reduce repeated firewall prompts without changing system permissions.
2026-09-24 — RTC connection contracts and capacity reservations
Add connection create/read/revoke contracts and durable internal reservations. Concurrent requests cannot exceed the Room seat limit; reconnects retain one seat per current AppSession generation. Requested revocation is distinct from effective revocation. The public API and SDK implementation remain in progress. Server authority applies equally to compatible third-party clients; hiding native SDK objects is a product boundary, not a security mechanism.
2026-09-24 — Durable internal RTC Room lifecycle
RTC Room preparation now has persistent retry and stale-worker protection. Closing a Room records native cleanup in the same database transaction; native completion requires readback. Existing task Room behavior is retained. Public RTC admission and the OneSay SDK facade remain under implementation, and this internal change does not enable cloud deployment.
2026-09-24 — Internal native RTC compatibility
The existing JavaScript SDK package now carries an exact internal LiveKit client dependency. Local engineering tests exercise native Room APIs and decoded audio between independent browser contexts. The public OneSay RTC facade, current authorization bridge and reconnect remain under implementation; this change does not expose RTC service or qualify cloud deployment. Existing task APIs remain.
2026-09-24 — ContextSnapshot durable value bound
Added a forward PostgreSQL constraint for the existing 4096-byte context value limit. Invalid historical content blocks migration without rewriting it; valid snapshots retain their content and immutable behavior. Explicit context create/read and privacy classification remain incomplete. Snapshot storage regression also fixes repeated RLS scope scans at maximum namespace size; the 20-second build budget and authorization checks remain.
2026-09-24 — Dual voice implementation foundation
Adopted the Owner's complete task-voice/RTC/two-SDK precloud scope and local-only CI policy. Added a checked, complexity-weighted execution ledger, owned PostgreSQL/Redis baseline tests, pinned official LiveKit sources/image and executable isolated Server readiness. This release does not yet expose OneSay RTC operations or qualify media, Agents, hardware, real providers or cloud deployment. Existing task and Data Sync APIs are preserved; their historical evidence is not reset or promoted to cloud acceptance.
Changelog
Data Sync W08 TypeScript SDK and reference Runtime — 2026-09-24
Added generated strict TypeScript Data Sync protocol types, a bounded
Host-transport client, an instance-scoped Sync Runtime, explicit
Storage/Projection ports and a durable file-journal reference backend. Local
qualification covers atomic History/intent persistence, torn-tail recovery,
byte-identical unknown-result retry, pull/cursor rollback, snapshot staging,
bounded Outbox and storage exhaustion, identity fencing and inert rich-text/URL
data. Priority delete intent and explicit conflict resolution use Host ports
without inventing public routes. The JavaScript package remains
byte-reproducible, and all four repository-local W08 units are complete. Public
data-plane HTTP composition remains in W04/W06/W09; Desktop encryption and
Staging remain open. CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync W07 fleet backlog and alert acceptance — 2026-09-24
Added a fixed, content-free PostgreSQL observation for all six durable Data
Sync worker kinds and exposed it through the existing GC supervisor's private
backlog command. The observer has a 400 ms read deadline, a 10,001 lower-bound
cap and no scheduling authority; alerts derive only from age or durable stall
facts. Actual PostgreSQL 17.6, upgrade and combined Go race qualification pass
with owned cleanup. W07 repository-local acceptance is 4/4 (100%). Deployed
multi-replica capacity remains
NOT-RUN — requires authorized Staging environment.
Data Sync backup-retention completion gate — 2026-09-24
Added migration 69, a durable backup-inventory evidence projection and the
least-privilege onesay_sync_backup_retention role. Online purge now enters a
durable pending state atomically; the ordinary privacy worker cannot assert
backup expiry. Completion requires source-bound evidence that the earliest
retained restore point is strictly newer than the purge boundary. Real
PostgreSQL 17.6 race, fresh-schema and v68 upgrade tests pass. Actual Aliyun
backup readback and OSS Writer/Recovery/provider qualification remain
NOT-RUN — requires authorized Staging environment, so W05 stays 5/6 (83%).
Data Sync public Scope control runtime candidate — 2026-09-24
Implemented the canonical enableDataSyncScope and
disableDataSyncScopeRetainingData Control API paths as a local runtime
candidate. The handlers reuse the generated Action parser, current signed
Human/AppSession/Grant/Consent authority, the existing versioned Scope
activation/deactivation participants, atomic transport idempotency and
semantic replay validation. Real PostgreSQL 17.6 tests cover cross-server
replay, malformed original wire input, stale Scope results, Grant revocation,
retained-data disable and the constrained onesay_sync_control role. W05
remains 5/6 (83%): backup-retention completion and independent OSS
Writer/Recovery/provider qualification remain open. The canonical OpenAPI
keeps x-onesay-runtime-implemented: false until authorized Staging
deployment and verification; CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync scope.disable_retain control participant — 2026-09-24
Added migration 68 and a restricted, Consent-bound PostgreSQL control
participant for non-erasing Scope disable. It advances participation,
epoch/control/privacy barriers atomically while retaining records, ciphertext,
keys, quota and stream history. Real PostgreSQL 17.6 race and migration tests
cover rollback, stale/duplicate intent, least privilege, commit binding and
explicit re-enable preservation. W05 remains 5/6 (83%); the public Scope
control runtime, backup retention and independent OSS Writer/Recovery/provider
qualification remain open. CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync exact record.delete privacy barrier — 2026-09-24
Added migration 67 and an exact-key reservation, Apply, Finalize and purge path
for record.delete. Pending targets are blocked from ordinary writes and
redacted from Change Reader/snapshot publication while the Scope remains live.
Real PostgreSQL 17.6 race and migration suites prove known/unknown key handling,
atomic quota and stream updates, exact ciphertext purge and preservation of an
unrelated record. W05 remains 5/6 (83%); migration 68 later closes the local
scope.disable_retain primitive. Public Scope control, backup retention and
independent OSS Writer/Recovery/provider qualification remain open. CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync bounded online privacy purge — 2026-09-24
Added the durable LEDGER_CONFIRMED to ONLINE_PURGED worker stage for Scope
clear and disable-purge. Bounded PostgreSQL batches terminate stale snapshots,
remove pins, purge online ciphertext and tombstone old identities without
selecting ciphertext or touching a new epoch. Real PostgreSQL 17.6 race and
migration suites prove expired-lease recovery, multi-batch completion and
new-epoch isolation. W05 advances to 5/6 (83%). Migration 67 later closes exact
record.delete; independent OSS fencing, provider qualification, backup
retention and scope.disable_retain remain open. CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync durable privacy stage worker — 2026-09-23
Added PostgreSQL-owned scheduling and a bounded dispatcher for separately
committed Ledger Prepare, atomic main-store Apply and Ledger Finalize stages.
Monotonic claim fences, durable retry deadlines and immutable Apply-outbox
confirmation data remove process-local completion authority. Actual PostgreSQL
17.6 tests cover retry/reclaim and the three-cycle orchestration path. Actual
OSS writer/recovery fencing, provider behavior and online payload purge remain
unqualified; CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync atomic main-store privacy Apply — 2026-09-23
Added a restricted, bounded PostgreSQL Apply transaction for scope.clear and
scope.disable_purge. It atomically advances the durable privacy barrier and
Scope epoch/control state, releases active quota, records the cutoff Change and
persists notification and immutable Finalize facts. Real PostgreSQL race and
migration tests cover commit isolation, idempotent/concurrent Apply, durable
alignment and least privilege. This advances W05 to 4/6 (67%); independent
Ledger provider/fencing, Finalize confirmation, physical purge, Staging,
Desktop and Production remain unqualified. CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync final snapshot response fence — 2026-09-23
Added the restricted data-read authority role and private snapshot publication
composition. It decrypts and encodes before a short final transaction, then
rechecks current AppSession/Grant/Consent and exact durable data authority;
failed checks release no body, while a committed response is marked no-store.
Real PostgreSQL race/migration tests cover concurrent Replica, privacy and Grant
changes. The complete local CI gate passes 5,008 Node tests with two existing
platform skips, 22 Python tests, complete Go/vet, generated compilation, OSV
and Redis-loss proof. Fresh WSL2 Gecko/WebKit Console regression against owned
PostgreSQL 17.6 also passes; native browser TLS remains NOT_EXECUTED. The
Canonical Registry has no public Snapshot route, so public API,
real KMS, Staging, Desktop and Production remain unqualified; CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync canonical snapshot page — 2026-09-23
Added a closed canonical snapshot response, exact signed continuation binding,
bounded plaintext page construction and original-record-AAD AES-GCM open. The
private PostgreSQL read paths now also carry the current Scope Consent receipt
ID for the eventual final authority fence. Focused race/wire tests and a real
local PostgreSQL writer-to-reader composition pass. Public route authorization,
real KMS, Staging, Desktop and Production remain unqualified; CCR-B is
NOT-RUN — requires authorized Staging environment.
Migration provenance reconciliation — 2026-09-23
The bounded local CI gate detected that the recorded migration 61 SHA-256 no longer matched the committed SQL bytes. The manifest was corrected to the actual migration, generated embed/schema artifacts were regenerated, and all source-bound Data Sync receipts were refreshed. This is provenance repair for the existing migration, not a new schema or cloud mutation.
Data Sync private snapshot completion storage — 2026-09-23
Added migration 62 and a dedicated forced-RLS CompleteSnapshot storage
participant. It binds every durable READY manifest axis, atomically commits
the terminal status with GC-pin removal, and supports exact terminal replay;
real PostgreSQL 17.6/race and migration suites pass with owned cleanup. This
is local CCR-A evidence only. Public API/canonical authority, Staging,
Desktop, cloud and Production acceptance remain unqualified; CCR-B is
NOT-RUN — requires authorized Staging environment.
Data Sync notification metrics host readback — 2026-09-23
The private notification process now retains its bounded Dispatcher counters
and publishes a fixed, content-free notification snapshot through the
existing workerhost metrics pipe. Local host/race/vet checks pass. This adds
CCR-A process observability only; PostgreSQL remains the durable queue and
lease authority, and W07, Staging and Production acceptance remain open.
Data Sync privacy reservation lineage binding — 2026-09-23
The durable privacy reservation adapter now compares Environment, ProjectEnvironment, Application and Owner against the canonical Namespace lineage while the Scope row is locked, before inserting the immutable operation and raising the Scope fence. A real PostgreSQL regression rejects forged context and retains the least-privilege privacy role; the existing target/fence and immutable-row checks remain covered. Main-store Apply, Worker Finalize, Staging and Production remain unqualified.
Data Sync privacy lifecycle primitive — 2026-09-23
Added a local, fence-bound PrivacyOperation state machine for the accepted
Prepare → Apply → Finalize flow. It rejects target expansion and stage skips,
keeps privacy safety facts separate, supports exact terminal replay, and
serializes concurrent local readers/transitions, and adds a strict
snapshot/restore projection for future durable adapters. Main store,
independent Ledger, Worker, Staging and Production integration remain
unqualified.
Current local CI and Mock Device delivery evidence — 2026-09-23
Recorded the current main Mock Device protocol delivery manifest/receipt and
the bounded local ci:local receipt. The local lane completed 5,004 Node tests
with 5,002 passes and two explicit platform skips, 22 Python tests, 104 Go
packages, generated compilation and Redis-loss proof. This is development
evidence only; E11, CCR-B, Staging, Desktop, Production and publication remain
unqualified.
Data Sync local boundary fencing — 2026-09-23
Closed three local Data Sync boundary gaps: StateBinding selectors are checked
against owner payload bindings before private page and durable operations,
notification quota arithmetic fails closed at signed 64-bit limits, and
snapshot retirement discovery rejects duplicate or stale keyset hints. The
builder token guard also rejects the all-zero UUID. Focused PostgreSQL/race,
Go vet and full bounded local CI evidence pass; CCR-B remains
NOT-RUN — requires authorized Staging environment.
E9 current-source evidence binding refresh — 2026-09-22
Refreshed existing E9 manual/Console evidence bindings to the current source digests after local CI detected documentation drift. The targeted binding suite passes; no new browser or deployment acceptance is claimed.
Data Sync explicit notification host composition — 2026-09-22
Added the private cmd/data-sync-notification process entry. It composes the
restricted PostgreSQL lease worker, bounded dispatcher and environment-bound
HTTPS sender only from an explicit pipe configuration; there is no default
external endpoint. Local configuration and package tests pass. A process-boundary
regression also proves invalid private-pipe configuration fails before database
startup. Staging and Production delivery remain unqualified.
Added local W11 guard coverage for notification counter saturation and fixed batch-budget rejection; no durable queue or cloud capacity result is claimed. The guard coverage now also rejects duplicate/foreign discovery and preserves bounded storage failure observability before claim.
M1 local-first CI qualification policy — 2026-09-22
Adopted a cost-controlled M1 development loop: complete bounded local
ci:local is the hard iteration gate, while GitHub Actions is deferred until
the final integrated M1 candidate. Merge still requires the complete hosted
Linux, Windows, browser and native matrix to finish green. Documented the
self-hosted runner baseline, explicit non-pass states and the current PR #241
cancelled run; no hosted qualification is inferred.
Data Sync bounded HTTPS notification sender — 2026-09-22
Added a concrete, content-free HTTPS sender for the existing notification dispatcher port. It enforces environment transport boundaries, disables redirects, bounds response inspection and fails closed on malformed or non-success delivery responses. Local race/TLS tests pass; no default host, external recipient or Staging/Production delivery is claimed.
Data Sync private READY storage guard — 2026-09-20
The deferred snapshot READY constraint now locks and rechecks current Namespace, Scope, Replica and Stream state and refuses an expired builder. Local PostgreSQL race and migration tests cover stale-view rollback; canonical authorization, public snapshots and Staging capacity remain pending.
Data Sync private snapshot retirement worker — 2026-09-20
Added a bounded Task Worker cleanup cycle over restricted PostgreSQL discovery and retirement. Local race and real PostgreSQL tests pass; deployed host wiring and Staging capacity remain pending. Stabilized the unrelated Python invalid-close test fixture deadline on loaded Windows CI runners.
Data Sync private snapshot retirement discovery — 2026-09-20
Added restricted, environment-bound due-snapshot discovery with a 32-hint limit and stable cursor. Local PostgreSQL race and migration tests pass; operational scheduling, public completion and Staging capacity remain pending.
Data Sync bounded private snapshot retirement — 2026-09-20
Added a restricted PostgreSQL role and restartable fixed-expiry cleanup that releases expired pins and deletes at most 32 encrypted items per transaction. Local PostgreSQL race and upgrade tests pass; public complete and Staging capacity remain pending.
Data Sync private encrypted snapshot page — 2026-09-20
Added a restricted read-only PostgreSQL role and bounded READY/pin page reader that returns ciphertext only. Local PostgreSQL race and migration tests pass; current public authority, decryption and Staging capacity remain pending.
Data Sync private snapshot manifest binding — 2026-09-20
The private materialization result now carries the Scope control version and binds it, Collection and Replica to the encrypted manifest digest. An actual PostgreSQL regression proves a control-only revision changes that digest. Public READY publication and Staging capacity remain pending.
Data Sync snapshot race regression — 2026-09-20
Added isolated PostgreSQL interleaving tests for a concurrent write during MVCC materialization and GC advancing before a READY pin commits. Both reject mixed baselines or a stale READY manifest; public snapshot publication and Staging capacity remain pending.
Data Sync private snapshot materialization — 2026-09-20
Added a bounded PostgreSQL REPEATABLE READ primitive that copies encrypted current records and hashes their fixed ordinal manifest in one view. It leaves the session BUILDING; current authority, READY publication, paging and cloud capacity remain pending.
Data Sync snapshot storage model — 2026-09-20
Added bounded durable snapshot sessions, encrypted ordinal items and GC pins that protect a READY baseline across processes, including against premature builder completion. Local PostgreSQL/Go race and migration tests pass; public snapshot creation, paging and Staging capacity remain pending.
Data Sync private incremental storage scan — 2026-09-20
Added a restricted, bounded PostgreSQL reader for committed encrypted Changes with exact owner/Scope isolation, durable resume bounds and body-free privacy redaction. Local storage tests pass; public read responses and cloud capacity remain unqualified.
Data Sync cross-process write admission — 2026-09-20
The private Writer now holds a PostgreSQL session permit across preparation and commit, enforcing at most two in-flight batches per Namespace across processes. Bounded pool and overload checks fail before Seal or business effects. Real local PostgreSQL process-loss and writer tests pass; public API and Staging capacity remain unqualified.
Data Sync notification dead-letter maintenance — 2026-09-20
Added private, bounded, environment-bound dead-letter listing and restricted server-time seven-day retirement to the existing notification outbox. Expiry releases quota without claiming delivery; local PostgreSQL role, race and upgrade tests pass. Other Worker job kinds and cloud validation remain open.
Data Sync restartable notification dispatch — 2026-09-20
Added a restricted, bounded database discovery function and a private two-concurrent-send notification dispatcher on the existing durable lease. Local PostgreSQL tests cover cross-replica claim, retry and deadline ACK safety. No default delivery transport, other job kind or cloud acceptance is implied.
Data Sync private notification lease storage — 2026-09-20
Reused the existing content-free outbox with a restricted PostgreSQL Worker role, durable revision-scoped lease/fence, bounded retries and conditional acknowledgement. Local PostgreSQL concurrency and upgrade tests pass. Public Data Sync, other Worker job kinds and cloud capacity remain incomplete.
Planned Scope Action catalog qualification — 2026-09-20
Catalog regression now recognizes the two canonical Data Sync Scope Actions
and verifies their planned status. Full local Go, Python, Node and generated
consumer checks have passed; public Scope execution and cloud acceptance are
still pending.
Current-source Data Sync storage evidence — 2026-09-20
Local schema-48 PostgreSQL storage and upgrade regression, domain/adapter race tests, page wire checks and CCR evidence were rerun and rebound to current sources. The E10 optional error outlet also passed its 11 focused local tests with actual loopback. Public Data Sync execution, cloud capacity, Desktop and Production remain unqualified.
Local evidence refresh for current Data Sync candidate — 2026-09-20
The deterministic Portal export, owned PostgreSQL Gecko/WebKit Console session, Device conformance bundle, and isolated OS-PLATFORM-0009 fixture were rerun for the current canonical spec. Historical OS readback remains intact; a new current compatibility readback and governed fixture bind this source. The full Node regression still fails on stale source-bound evidence and missing public Scope handler bindings, so this does not qualify Staging or the complete M1 release.
Data Sync private Scope activation — 2026-09-20
Applied enable facts now commit with exact Consent/session/Scope state and audit under a restricted SQL role. Shared session checks allow parallel requests while retaining close/revoke fences; independent Collections avoid a Namespace mutex. Local SQL, isolation, rollback and upgrade regression pass. Public Scope execution, business idempotency, adapter health and complete Data Sync qualification remain in progress; Staging, Desktop and Production are not validated by these results.
Data Sync Scope Consent integration — 2026-09-20
Scope confirmation now reuses Consent creation, explicit decisions, reads and cross-server replay with current authority. Original session identity survives content erasure; preparation contexts remain valid through atomic completion while explicit cancellation still rolls back. Local PostgreSQL regression and upgrade tests pass. Scope business execution and full Sync qualification remain incomplete; no default public Scope runtime or cloud acceptance is enabled.
Data Sync Scope control observation — 2026-09-19
A restricted metadata reader now supports exact or absent Scope baselines in bounded transactions, without creating data or exposing payloads/keys. Local PostgreSQL checks cover isolation, stale state, deadlines and privilege drift. Current authority composition and public control mutations remain unavailable.
Data Sync Scope Consent storage — 2026-09-19
A forward migration adds the two Scope control Actions to existing Consent storage, with direct Human Application-profile checks and preserved history. Actual local PostgreSQL upgrade and existing Consent regression pass. Scope business execution and current full authority remain unavailable.
Data Sync Scope control contract — 2026-09-19
Explicit enable/import choice and disable-retain now have canonical Actions, Consent inputs and unpublished public API projections. Cross-language consumers reject inconsistent lifecycle baselines and bind the complete control intent. Targeted contract conformance passes; complete package qualification remains open. Collection names now have one strict validator across registration, encryption, cursors and recovery. Scope Consent create/pending presentation fixtures cover the generated Console client; these unit checks do not qualify cloud runtime. The AppSession deadline fixture now proves transaction lock release independently of a closed driver connection; repeated maximum-length registration fixtures remain unique. Real local SQL regression passes. Current SQL authority and public business runtime remain incomplete; this does not qualify Staging or enable data access.
Data Sync final transaction checks — 2026-09-19
Private writes and receipt reads now recheck retained transaction authority before commit/result release. Final expiry rolls back; serialization retries reacquire authority. Actual local PostgreSQL regression passes; full public Sync admission and Staging qualification remain pending.
AppSession/Consent transaction deadlines retain the expiry error even when a retained-context callback races the query timer; explicit cancellation from either caller still propagates. CI evidence refreshes preserve failed runs.
CI package-manager cache — 2026-09-19
Required CI reuses the pinned pnpm tool through a platform/version-separated Corepack cache after an observed registry connection reset. Frozen dependency installation and all required proof jobs remain mandatory. Warm offline startup and cold offline rejection pass locally; hosted cache validation remains pending.
CCR Room idempotency workload - 2026-09-19
The control-api-idempotency-replay capacity entry now verifies canonical Room replay snapshots and changed-body conflicts instead of HTTP counts. Requests, responses and deadlines are bounded; failures cancel peers, and execution requires scoped Room mutation authorization. Reports keep durable effects, replica validation and capacity acceptance explicitly unverified.
E9 hosted binding refresh - 2026-09-18
The current manual accessibility and Console receipts are rebound to the
portal export produced by this tree (648c0462… for the manual export and
ede5d217… for the Console export). The hosted run's native-memory failure
was an Ubuntu snapshot 502/503 and remains an external qualification failure.
Native Device relay close-boundary hardening - 2026-09-18
The native HTTP relay now waits within a bounded five-second deadline for forwarded control sockets and fault request bodies to close before the final receipt assertion. Existing request, mutation and failure checks remain unchanged; a relay failure or an unresolved close still fails the proof.
Native qualification tool diagnostics - 2026-09-18
Native source-selection qualification now reports whether a tool was missing, timed out, denied execution, exceeded its output limit or exited unsuccessfully. Diagnostics omit child output and executable paths. The existing five-second probe deadline and single attempt remain in force.
E10 bounded Redis recovery observations - 2026-09-18
The capacity runner can observe a completed Task before, during and after an operator-managed dependency fault using the canonical Staging SDK route. Consecutive healthy readback is bounded by request and recovery deadlines; authorization failures stop observation. Results retain unresolved causality, data-loss and acceptance states. The runner never changes cloud resources.
E10 bounded durable backlog observations - 2026-09-18
Private process supervision can request Task, Usage and Trace outbox depth and oldest pending age. Capped counts are explicit lower bounds; failed or overly frequent samples expose no numeric data. Sampling has read-only transactions, query deadlines and one in-flight request per process. Usage aggregate shutdown also preserves cancellation when database/sql has already rolled back its transaction. Ordinary business failures remain failures.
E10 Task/Provider metrics and reliable close results - 2026-09-18
Task bootstrap can now expose bounded claim outcomes and Provider API activity through the existing private sampler. No resource IDs, customer content or Provider error text are retained. Completed Tasks still wait for bounded Provider cleanup; concurrent and repeated cleanup preserves the first close result. Unconfirmed closure remains visible instead of becoming a successful shutdown.
E10 bounded Redis operational metrics - 2026-09-18
Control rate limiting, Realtime authority and the ephemeral transcript cache can observe Redis client operation counts, latency and fixed outcomes without retaining keys, payloads, addresses or error text. Control/Gateway private samples include these observations. Missing keys and normal script-cache fallback are separate from failures; policy denial remains a successful Redis operation. No command, retry, TLS or authorization behavior changes.
E10 HTTP and Realtime operational metrics - 2026-09-17
Control API now measures every handler, including authentication denial, rate limiting and request-ID failure, with final status classes and fixed latency bins. Realtime counts accepted active sockets, upgrade/ticket denials, resume outcomes and protocol errors. Closed sockets leave the active gauge before durable disconnect projection; timer and reader closure count once. Commands expose these fixed numeric observations through the existing private supervisor pipe. No resource labels, request content or public API are added. Cloud collection and measured Staging capacity remain unexecuted.
E10 private process and PostgreSQL pool metrics - 2026-09-17
The shared command host accepts an explicit metrics request on its existing private supervisor pipe. Each fixed-schema record contains Go runtime memory, goroutine and CPU estimates plus actual PostgreSQL pool size/use/wait counters. Records are bounded to 4096 bytes with a one-second write deadline. Sampling performs no database query, retains no history and exports no credentials, content, resource IDs or arbitrary labels. Normal stop/cancellation and failed reader cleanup are tested; actual isolated PostgreSQL contention is observed. Full component metrics, OS RSS/CPU, dashboards and Staging remain unqualified.
E10 public Task/Usage capacity readback - 2026-09-17
The PCM runner now optionally verifies completed Tasks, finalized Artifact metadata and exactly one task/audio Usage event through canonical public SDK APIs. The observer has an independent credential, explicit Project/Environment scope, bounded full pagination and a shared run deadline. Missing, duplicate, foreign, truncated or denied observations remain failures; output contains counts and fixed categories only. Local real PostgreSQL/Redis proof confirms one completion/settlement and 80 ms after two unique frames plus one replay. Real Staging capacity and broad durable-effect acceptance remain unqualified.
E10 PCM disconnect and resume observations - 2026-09-17
The existing PCM capacity driver can now disconnect after its first frame, mint one fresh Staging resume ticket through the public SDK, validate retained Participant/Signal/Task bindings and replay only unacknowledged audio. Missing ACK and unreceived-frame fixtures both complete without silent frame loss. Authorization denial stops later sessions, including malformed denial bodies. Thirty-four local capacity tests pass. Cross-replica recovery, durable effects and actual Staging capacity remain unqualified.
E10 PCM protocol capacity observations - 2026-09-17
CCR-B now has a PCM observation driver using the existing JavaScript SDK for
frames, ACK release and exact replay. It sends paced synthetic audio with a
bounded window, probes client backpressure and correlates terminal Task and
Artifact events. Twenty-four local capacity tests pass. Driver output remains
NOT_EVALUATED for acceptance: connection resume, durable duplicate effects,
server saturation, actual cloud metrics and capacity still require evidence.
E10 bounded capacity connection observations - 2026-09-17
The existing CCR-B runner now measures sustained WebSocket connections, handshake latency, active/peak connections, throughput and received bytes. Reconnects and cleanup are bounded; authorization/policy denial stops new attempts and independent ticket URLs avoid accidental reuse. Fifteen local tests pass. Transport observations never imply protocol or capacity acceptance. The twelve scenarios remain planned and unexecuted; canonical PCM/replay, Data Sync, cloud-fault orchestration and runtime metric export still require preparation within E10. No cloud or procurement gate changed.
E10 official public contract refresh - 2026-09-17
Added a machine-bound snapshot of current official GitHub Actions, Cloudflare
WAF, ZITADEL and Alibaba Cloud public contract facts. The E10 validator now
fails if those facts are treated as account entitlements, quotes, readbacks or
cost decisions. No account-specific readback, BOM value, external state or
authorization changed; E10 remains procurement-not-ready with 9/3/10 pending.
Focused governance tests pass 67/67 and complete ci:prepare passes.
The first PR CI preserves one ordinary Windows failure caused by the changed
public Changelog invalidating the current Console export digest. The correction
refreshes derived portal bindings only; runtime, driver and specification
inputs are unchanged.
Evidence: docs/development/evidence/e10-public-contract-refresh-2026-09-17.json.
E10 CCR-A concurrency and capacity readiness - 2026-09-17
Added the integrated CCR-A horizontal-scale audit and CCR-B Staging harness.
Control, Realtime, Worker, PostgreSQL, Redis, quota and backpressure paths have
no found scale blocker; disposable PostgreSQL/Redis race and loss testing
passes. The result is PASS WITH DOCUMENTED RISKS because Data Sync is not an
adopted authority and real capacity, metric export and alert delivery need
authorized Staging. All 12 CCR-B scenarios remain explicitly NOT-RUN.
Review: docs/infrastructure/E10_EXECUTION_READINESS.md. Evidence: docs/development/evidence/ccr-a-pre-cloud-readiness-2026-09-17.json.
E3 local PostgreSQL qualification - 2026-09-17
Qualified the existing E3 identity and Control API persistence paths against a disposable loopback-only PostgreSQL 17.6 fixture. The fresh-schema migration proof and all four affected Go packages pass under race detection with the repository-required serial package execution on watchdog attempt 1. The first parallel characterization failure remains recorded and was not retried unchanged. This adds local evidence only; live E2 identity and external Control API acceptance remain open, so E3 and formal M1 stay incomplete.
Evidence: docs/development/evidence/e3-local-postgres-qualification-2026-09-17.json.
E10 ten-item repository readiness review - 2026-09-17
Added a machine-validated ten-item E10 readiness record. It reuses current ingress, quota, secret, telemetry, Outbox, site-build, Provider and artifact assets; retains seven conditional directions; and revises the edge-plan, Sentry-plan and Provider-capacity selection logic. Data Sync authority and all cloud validation remain explicitly absent. The canonical BOM still carries 9/3/10 pending inputs, a null exact total and no purchase or deployment authority. Focused validation passes 64/64.
Review: docs/infrastructure/E10_EXECUTION_READINESS.md.
E8 WebSocket ticket downstream-copy reconciliation - 2026-09-17
The E8 acceptance ledger now matches the canonical ESP32 SDK contract for the delivered adapted component. Exact source replacement and compile provenance prove that the reviewed adaptation is compiled, and existing dual-TLS constructor execution proves its ticket-bearing URI and parsed path copies are erased before release on success and all allocation failures. The selected native-memory blocker is closed. Broader library internals, OS buffers and physical RAM remain excluded; E8, Protocol Ready, Staging and publication stay open.
Review: docs/architecture/E8_WEBSOCKET_TICKET_COPY_RECONCILIATION_REVIEW_2026-09-17.md. Evidence: docs/development/evidence/e8-websocket-ticket-copy-reconciliation-2026-09-17.json.
E4 native Device scenario lifecycle seal - 2026-09-17
The eleven native Device scenario-family entries that still carried historical
hosted-pending labels are lifecycle sealed. Merged-main run 35130742892
passed 23/23 on attempt 1; native Device job 104914150554 executed four
isolated dual-TLS partitions and passed all 152 cases. Watchdog run
35132800754 returned NO_STALL_TIMEOUT without a rerun. Later main changes
through 5c55edc6 do not touch the qualified native runtime, scenario, spec or
workflow paths. Historical receipts remain immutable and hash-bound. E4,
Protocol Ready, external Staging and publication remain open, so formal M1
stays 2/14 (14%).
Current-source local qualification is also recorded without overstating a single aggregate pass. The first aggregate attempt passed the 63-package audit and found two stale portal bindings; fresh isolated PostgreSQL and WSL2 Firefox/WebKit evidence corrected them. The second attempt stopped at an external OSV request failure after all pre-audit gates passed. The corrected downstream workload passes 4,491/4,493 Node tests with two platform skips, 22 Python tests, all 104 Go packages plus vet, and generated consumer compilation.
Review: docs/architecture/E4_NATIVE_SCENARIO_LIFECYCLE_SEAL_REVIEW_2026-09-17.md. Evidence: docs/development/evidence/e4-native-scenario-lifecycle-seal-2026-09-17.json.
E8 C-host lifecycle seal - 2026-09-17
The three C-host Device packages that still carried hosted-pending labels are
now lifecycle sealed on current main. Run 35138623173 passed all 23 required
jobs on attempt 1; Linux Mock job 104937207903 executed and passed the exact
c-task-cancel, c-write-failure-replay and c-capability-withdrawal
product subtests. The matching Mock race, Windows Go and aggregate jobs passed.
Watchdog run 35139890787 returned NO_STALL_TIMEOUT without a rerun. The
three implementation commits are current-main ancestors, exact commit/tree
readback passes, and their original local and remote branches are absent. The
SDK applicability package was already lifecycle sealed; its older hosted-pending
summary is historical rather than current state. E8, Protocol Ready, external
Staging and publication remain open, so formal M1 stays 2/14 (14%).
Review: docs/architecture/E8_C_HOST_LIFECYCLE_SEAL_REVIEW_2026-09-17.md. Evidence: docs/development/evidence/e8-c-host-lifecycle-seal-2026-09-17.json.
E8 Node normal Device flow - 2026-09-17
The shared Device network matrix now includes an explicit no-fault Node path through the public JavaScript SDK. It proves a single connection can publish deterministic PCM, observe the canonical ACK, complete the downstream Task and Artifact, end the Signal and settle Usage without reconnect or replay. The focused checks and all 67 portable Node/C product scenarios pass locally. Exact-head and merged-main CI each pass 23/23 after diagnosis and one controlled rerun of the initial PR native assertion; main watchdog, exact-tree readback and implementation-branch cleanup pass. Protocol Ready, deployed integration, publication and external Staging remain open. Ignored local build-directory cleanup remains blocked by automatic execution policy.
Review: docs/architecture/E8_NODE_NORMAL_FLOW_REVIEW_2026-09-17.md. Evidence: docs/development/evidence/e8-node-normal-flow-2026-09-17.json.
E8 selected native memory ownership completeness - 2026-09-16
The ESP32 SDK now has an exact selected native memory ownership inventory. It proves the caller-owned SDK core remains heap-free, binds all eight reviewed native adaptations, and requires the existing lifecycle, HTTP, constructor, fault, certificate and TLS-session proof phases. Broader library internals, caller storage, OS buffers and physical memory remain explicitly outside the claim. Publication, external Staging, Protocol Ready and E8/M1 acceptance remain open. The complete local Node, Python, Go/vet, generated-consumer and Redis-loss workload passes in bounded segments, and fresh Firefox/WebKit Console evidence is bound to the corrected source. Exact-head and merged-main CI each pass 23/23, including both exact-source TLS native memory profiles; the lifecycle watchdog, tree readback and cleanup also pass.
Review: docs/architecture/E8_NATIVE_MEMORY_OWNERSHIP_COMPLETENESS_REVIEW_2026-09-16.md. Evidence: docs/development/evidence/e8-native-memory-ownership-completeness-2026-09-16.json.
E8 SDK fixture applicability reconciliation - 2026-09-16
The version-locked Device bundle now has a fail-closed applicability inventory for all eleven shared fixture families, both public SDK contracts and the five executable network profiles. Missing consumers, fixtures, profiles or evidence, unsafe paths and unexplained exclusions reject before network I/O. Focused validation passes 38/38 and all 66 portable product scenarios pass locally. External Staging, publication, Protocol Ready and E8/M1 acceptance remain open.
Review: docs/architecture/E8_SDK_APPLICABILITY_RECONCILIATION_REVIEW_2026-09-16.md. Evidence: docs/development/evidence/e8-sdk-applicability-reconciliation-2026-09-16.json.
E8 C-host capability withdrawal - 2026-09-16
The C-host matrix now exercises the existing capability-withdrawal contract.
The compiled C runtime keeps the admitted Signal active after capability removal,
continues to 1280 acknowledged samples, completes its Task and resumes the exact
terminal checkpoint. Two separately delegated new-stream probes receive
nonretryable grant_missing before and after resume. Public contracts are
unchanged. The focused case and all 66 portable product scenarios pass locally;
hosted qualification is pending.
Review: docs/architecture/E8_C_HOST_CAPABILITY_WITHDRAWAL_REVIEW_2026-09-16.md. Evidence: docs/development/evidence/e8-c-host-capability-withdrawal-2026-09-16.json.
E8 C-host synchronous write-failure replay - 2026-09-16
The C-host matrix now exercises the existing synchronous write-failure replay
contract. The C SDK retains the exact frame when its host transport returns
client_network_unavailable, then replays it after a real resume checkpoint
and completes the Task. Public contracts are unchanged. The focused case and
all 65 portable product scenarios pass locally; hosted qualification is pending.
Review: docs/architecture/E8_C_HOST_WRITE_FAILURE_REPLAY_REVIEW_2026-09-16.md. Evidence: docs/development/evidence/e8-c-host-write-failure-replay-2026-09-16.json.
E8 C-host running-Task cancellation - 2026-09-16
The portable C host now selects the existing task-cancel Device scenario. It
uses the generated C action input and public delegated control path after one
acknowledged 640-sample frame, requires the real Gateway task.cancelled event,
and proves the C runtime rejects subsequent connection, Signal, audio and replay
operations in its terminal state. Server readback requires the durable cancelled
Task and delegated Consent/audit join with no completion, settlement or billed
audio. Public contracts and wire formats are unchanged; the private package is
unpublished. Local product qualification passes all 64 isolated scenarios;
hosted exact-head qualification remains pending.
Review: docs/architecture/E8_C_HOST_TASK_CANCELLATION_REVIEW_2026-09-16.md. Evidence: docs/development/evidence/e8-c-host-task-cancellation-2026-09-16.json.
Browser Device complete-corpus CI budget - 2026-09-16
The required Gecko/WebKit Device suite now has a bounded 660-second Go test budget within its existing 900-second job ceiling. Merged-main evidence showed the former 540-second limit expiring only after the final WebKit case started; all completed cases passed. Scenario behavior, per-case deadlines and the single-attempt policy are unchanged.
Linux validation preparation order - 2026-09-15
Required Linux validation now completes browser system dependency installation before complete repository preparation. This preserves every validation step while preventing package installation from starving the native CMake proof. The Python Provider interruption fixture also separates its bounded child startup window from the unchanged 20-second blocked-operation deadline. No public API, runtime behavior, production timeout or retry policy changes.
Review: docs/architecture/M1_LINUX_PREPARATION_ORDER_REVIEW_2026-09-15.md. Evidence: docs/development/evidence/m1-linux-preparation-order-2026-09-15.json.
E7 SignalStream sample continuity - 2026-09-15
The unpublished JavaScript SDK now rejects a new audio frame whose sample start is not contiguous with its SignalStream's retained frame or validated ACK checkpoint. Rejection leaves the backlog unchanged and occurs before Realtime network I/O. Stateless frame bytes and exact duplicates are unchanged.
Review: docs/architecture/E7_SIGNAL_SAMPLE_CONTINUITY_REVIEW_2026-09-15.md. Evidence: docs/development/evidence/e7-signal-sample-continuity-2026-09-15.json.
E8 native binary flag validation - 2026-09-15
The unpublished ESP32 SDK now rejects unknown OSAF audio flag bits at the native WebSocket transport boundary, including direct calls that bypass its encoder. Both paths share the mask generated from the unchanged canonical binary-frame spec. Valid frames and the public wire format are unchanged.
Review: docs/architecture/E8_NATIVE_BINARY_FLAGS_REVIEW_2026-09-15.md. Evidence: docs/development/evidence/e8-native-binary-flags-2026-09-15.json.
E8 Device secret contract consistency - 2026-09-14
The ESP32 SDK credential metadata now references the canonical display-once Device secret schema. Its generated Control bounds and client capacity continue to follow the public 32–512 character contract. This removes a stale 64-byte SDK declaration without changing issuance, authorization or secure-storage ownership. Generated projections and the shared Device bundle lock are updated from the canonical specs. The component remains unpublished.
Review: docs/architecture/E8_DEVICE_SECRET_SCHEMA_SOURCE_REVIEW_2026-09-14.md.
E8 native HTTP initialization failure correction - 2026-09-14
The native HTTP constructor now guards partially initialized request/response headers and uses existing complete transport/foundation destructors when allocation or transport-list insertion fails. This corrects one null-header cleanup crash and two ownership leak classes without changing public API, credentials, authorization, certificate validation or transport semantics.
The shared native allocation observer retains transient allocation ordinals. Both TLS profiles require all 34 HTTP constructor failures and successful recovery after each, alongside the existing 14-point WebSocket sweep. The regular memory qualification requires both constructors and preserves baseline allocation uncertainty. HTTP constructor inputs contain no credential.
The component remains unpublished. Current execution results and remaining qualification gates are recorded in the development evidence, independently of this exported product change description. E8/E11/E12/E13 and external/final acceptance remain open.
Review: docs/architecture/E8_NATIVE_HTTP_INIT_FAILURE_REVIEW_2026-09-14.md. Evidence: docs/development/evidence/e8-native-http-init-failure-2026-09-14.json.
Native JSON grammar — 2026-09-09
Reject malformed native Realtime/Control JSON separators and primitive spellings. Actual-client regressions retain PCM and the ACK cursor after malformed ACKs. Selected host suites pass; complete candidate and rebuilt native qualification remain pending. Public payload fields and resource semantics are unchanged.
Realtime speech and Task receipt completion — 2026-09-08
Fix an HTTP/1 Task transfer race that could cancel the final response after successful callback completion. Keep cancellation and unfinished-reader cleanup. Reuse Control audio assertions to exercise the actual Realtime executable through signed Task HTTPS, Artifact completion, terminal replay and joined shutdown. The local speech fixture uses deterministic Provider output. Evidence: docs/development/evidence/realtime-speech-receipt-2026-09-08.json.
2026-09-08 — Control API service command
Add the private-configured HTTPS service entry point with real product bootstrap, explicit OIDC/Redis policy and joined resource ownership. Selected command and CI contract checks pass; complete current qualification remains pending.
Native fault memory — 2026-09-08
- Serialize Linux native fixture logs using the FreeRTOS primitive required by the pinned scheduler.
- Add actual dual-TLS fault/recovery memory cycles to required native qualification, preserving existing phases and deadlines.
- Keep the unresolved parent Task HTTP/1 CI failure and incomplete SDK scope explicit.
E8 Platform SDK acceptance scope — 2026-09-08
- Align SDK acceptance with Platform protocol/connectivity ownership and the Owner decision assigning physical implementation and testing to onesay-os.
- Retain open protocol, memory, runtime-integration and publication gates, and preserve historical evidence.
- Give the complete browser Device suite an independent required CI job after the combined job exceeded its time limit; preserve every proof and timeout.
Authenticated Task HTTPS service — 2026-09-08
- Compose the durable Task runtime with a private TLS listener and existing internal service authentication.
- Join HTTP requests, Task runtime and maintenance before cache closure; retain explicit shutdown failure.
Worker process resource shutdown — 2026-09-08
- Join Worker runtime and resource cleanup before database closure; preserve explicit shutdown failure.
- Separate browser TLS certificate setup from the bounded CONNECT behavior proof.
Task runtime shutdown — 2026-09-08
- Reject new Task operations during owner shutdown and join existing work before dependency closure.
- Stop idle Provider sessions and preserve one bounded cleanup result across concurrent stop paths.
Task realtime bootstrap — 2026-09-08
- Assemble durable Task creation, execution, Usage and final-cache components with live Provider policy.
- Reject configuration before database access and preserve independently migrated schema ownership.
Portable protocol delivery — 2026-09-08
- Verify all 53 portable Device cases against exact copied prebuilt files outside the checkout.
- Reject changed manifests, payloads, inventory, traversal and redirected artifact paths before execution.
Browser public Device recovery — 2026-09-08
- Verify actual Gecko/WebKit Device setup, Task completion and audio replay through public SDK networking.
- Add required Linux browser qualification and preserve TLS shutdown through the isolated fixture proxy.
Task peer failure isolation — 2026-09-08
- Verify fresh Tasks execute and settle on the surviving service after another Task process exits.
- Preserve explicit failures for requests assigned to the unavailable service and prevent automatic replay.
Fixed Task owner routing — 2026-09-08
- Keep a Participant's complete Task group on one configured private execution service.
- Preserve grouping across Gateway replacement and differently ordered target configurations.
- Verify two-stream audio continuity, exact Task settlement and explicit recovery rejection after owner loss.
Mock server shutdown verification — 2026-09-08
- Verify the original listener handles are closed before reporting successful shutdown.
- Preserve cleanup checks when another fixture reuses a released port.
Task restart and response lifetime — 2026-09-08
- Finish private service cancellation callbacks before releasing HTTP responses.
- Verify authenticated Task service reconnection after process replacement while preserving Gateway configuration.
- Reject unavailable old executions after restart without inventing acknowledgements or replaying retained audio.
Independent Task owner failure — 2026-09-08
- Verify Task service failure with Control and Gateway still running.
- Preserve retained audio and reject recovery when the original Task execution is unavailable.
- Cover lost transfer confirmations with the real Task runtime over both HTTP versions.
- Keep abandoned execution recovery, deployment and external acceptance explicitly open.
Private Task network transport — 2026-09-08
- Add private authenticated HTTPS transport for the existing Task application interface.
- Preserve original actor attribution, exact audio counters and bounded cancellation across service calls.
- Verify same-Task continuity across Gateway process replacement and replica switching with real service authentication.
- Keep Task-owner failure, deployment and full candidate qualification explicitly open.
Portal export source provenance — 2026-09-08
- Bind Portal exports to rendered documentation, frontend and SDK sources, generated contracts and dependency locks.
- Reject stale build inputs or changed output bytes before browser or manual accessibility evidence is recorded.
- Verify source inputs around both clean builds; finalize site documentation before qualification.
Internal Service request cancellation — 2026-09-08
- Propagate internal Service request cancellation and deadlines through authentication and audit transactions.
- Roll back canceled replay/audit writes and suppress authentication outputs.
- Require context on unpublished internal Go token methods; update all callers.
In progress — Dedicated native memory qualification
- Run both memory profiles serially on a separate required CI runner.
- Transfer the exact qualified binaries with workflow, source and digest checks.
- Record TLS handshake and open timings while preserving all cases and limits.
- Pass 124 focused checks, fresh native runtimes, isolated artifact import, both memory matrices, Gateway and 148 Device cases; hosted qualification remains pending.
In progress — Memory qualification before Device workloads
- Complete both TLS memory profiles before starting Gateway and Device workloads.
- Observe memory cleanup and reject later workloads on failure; preserve every case and timeout.
- Pass changed local execution; retain hosted connection assertion failures until new hosted qualification succeeds.
In progress — Prepared native memory tool image
- Prepare the pinned memory tool alongside IDF and Go construction, before runtime consumers start.
- Bound tool construction independently and verify exact image, recipe and builder identity before both profiles.
- Pass both actual local memory matrices, Gateway and all 148 Device cases using the prepared image; retain hosted download cancellation and pending hosted slow-header verification.
In progress — Native artifact construction before memory checks
- Build Gateway and Device Go executables before native runtime and memory checks, alongside the independent IDF preparation lane.
- Require complete build success and exact prepared source, spec and executable bindings; preserve all request and CI deadlines.
- Retain the prior hosted slow-header assertion failure pending qualification of the changed schedule.
In progress — HTTP fault-path memory qualification
- Repeat the existing 20 HTTP scenarios under Valgrind with baseline, warm and repeated observations.
- Keep request deadlines and canonical error checks intact; observe DNS and task cleanup between requests.
- Reject incomplete evidence, invalid access, leaks, unexplained retention and repeated allocation growth.
- Build the shared memory tool image once, then observe both isolated TLS profile checks through cleanup under unchanged time limits.
In progress — Native HTTP pressure and quota scenarios
- Keep primary Device admission in native C while a separately credentialed Mock Device consumes the same Project Environment capacity.
- Preserve actual pressure rejection, retained-frame replay, quota rejection and settlement assertions across both TLS profiles.
- Require distinct Device/Source identities and two actual claim records; pass all 148 cases locally in 133 seconds with complete owned-resource cleanup.
In progress — Independent Device qualification groups
- Run native HTTP and historical Control scenarios in separate owned namespaces for each TLS profile.
- Require all four groups, exact source and ELF bindings, complete case inventory and successful cleanup before publishing combined evidence.
- Preserve all four real heartbeat deadlines. All 144 cases pass locally in 132 seconds, compared with 229 seconds before grouping; hosted timing remains unverified.
In progress — Native capability Control
- Move capability withdrawal, original-report replay and completed-result resume into the native Control facade.
- Keep credentials and connection tickets in C, with fresh token keys and the original capability idempotency key.
- Reuse the shared admitted-audio and new-stream denial checks and preserve historical scenarios.
- Pass all 144 actual Device cases locally, including 70 native HTTP cases, with both updated TLS runtimes and complete owned-resource cleanup.
In progress — Native runtime qualification stages
- Qualify independent Linux TLS runtimes concurrently after the target builds finish.
- Require both runtime results before memory, Gateway and Device validation; preserve failure propagation and owned-resource cleanup.
- Keep shared memory-image construction sequential and retain every CI deadline.
In progress — Native expiry and negotiation conformance
- Exercise credential expiry and resume expiry through the native Control facade and existing server-owned transitions.
- Extend native ticket admission to upgrade rejection and locked HTTP protocol-version rejection vectors.
- Preserve exact canonical errors, cleared failed tickets and retained unacknowledged audio; require actual-service qualification.
- Pass all 142 actual Device cases locally across both TLS profiles, including 68 native HTTP cases and complete owned-resource cleanup.
- Qualify both updated Linux runtimes, Gateway and selected WebSocket memory lifecycles; full native conformance and HTTP fault-path memory remain open.
In progress — Native Device CI scheduling
- Run TLS 1.2 and TLS 1.3 Device qualification concurrently with independent isolated dependencies.
- Preserve all scenarios and deadlines; reject incomplete or stale combined evidence.
- Pass all 122 Device cases locally in parallel in 3 minutes 23 seconds, including 48 native HTTP cases and complete owned-resource cleanup.
- Retain the previous hosted timeout as failed qualification evidence; complete candidate and hosted validation are pending.
In progress — Native Control HTTP
- Bound synchronous TLS DNS work with four owned slots, late-result reaping and preserved hostname verification/SNI.
- Block FreeRTOS scheduler signals before Linux DNS worker entry; the original Valgrind and revoked-device hangs no longer reproduce.
- Verify 20 HTTP and 22 facade cases per TLS profile, all 122 Device cases, both target builds and selected WebSocket memory lifecycles.
- Prevent occupied global event queues from blocking private HTTP requests; retain synchronous metadata callbacks.
- Verify busy-queue requests and slow/stalled TLS handshakes on both native TLS profiles.
- Validate 24 selected native HTTP modes against actual local Go services on both TLS profiles, including replay, revocation, heartbeat and invalid frames.
- Preserve all 74 historical Device cases; 48 native HTTP cases bring the matrix to 122.
- Retain exact revoked-request errors and erased tickets while the native client remains terminal.
- Qualify both ESP32-S3 TLS target builds and selected existing memory lifecycles with current source/ELF bindings.
- Add native provisioning exchange with scope validation and an explicitly erasable credential handoff.
- Generate the 512-byte secret capacity and preserve caller-owned storage.
- Pass 45 provisioning host/sanitizer cases and seven new native cases per TLS profile.
- Add native bootstrap/resume control callbacks and Device capability publication using fresh short tokens.
- Preserve canonical HTTP error metadata and erase transient request/credential workspace.
- Reuse strict bounded JSON helpers across Realtime events and Control responses.
- Decode Device token and Realtime ticket responses with cleared failure outputs.
- Generate C operation metadata and token limits from the canonical public API.
- Adapt the pinned native HTTP client for bounded replies, shrinking I/O deadlines and sensitive-copy erasure.
- Prove 15 native HTTP TLS cases per profile; Device flow integration and full conformance remain in progress.
In progress — Device access token exchange
- Exchange per-device secrets for short-lived Control API tokens through one public operation.
- Reject Device secrets on ordinary API calls; preserve service keys and human OIDC isolation.
- Apply ingress limits before secret authentication and protect idempotent token responses.
- Revalidate credential expiry, Device, Principal, Organization, Project Environment and grants on token use and exchange replay.
- Validate token expiry as an RFC 3339 calendar date and reject extra response fields.
In progress — Assigned Usage aggregate scheduling
- Run bounded aggregation for explicit Project Environment Service assignments.
- Revalidate current execution authority; preserve historical Usage attribution.
- Include scoped backlog in readiness and join both Worker loops on shutdown.
- Qualify process restart, revocation and in-flight aggregate rollback locally.
In progress — Native canonical Gateway errors
- Decode exact signal_not_found, message_id_conflict and quota_exceeded errors.
- Preserve queued rejections across all three exact protocol-policy closes.
- Qualify six real dual-TLS errors, retained PCM and actual quota admission.
In progress — Native capability withdrawal
- Reuse the shared capability-withdrawal scenario on both native TLS profiles.
- Verify current capability admission, idempotent report replay, admitted audio completion and completed-result resume using public SDK protocol primitives.
- Expand the selected matrix to 68 cases, with protocol-layer scope explicit.
In progress — Native sequence recovery
- Decode canonical sequence_gap and preserve original PCM for exact retryable gaps; replay remains an explicit caller action and conflicts stay terminal.
- Deliver queued canonical conflict errors before a known policy close.
- Qualify omitted-frame resume, gap recovery and identical/conflicting duplicates over both native TLS profiles; expand selected coverage to 66 cases.
In progress — Native upgrade negotiation
- Exercise all three shared WebSocket upgrade rejection vectors over both native TLS profiles, including no subprotocol, unsupported version and wrong case.
- Verify actual 403, zero probe WebSocket events, cleanup and unchanged-ticket reuse by the formal SDK through one completed Task and settlement.
- Expand selected qualification to 60 client cases with 52 native WebSocket cases.
In progress — Native invalid audio rejection
- Preserve queued canonical errors for exact audio-policy closes while keeping parser/decoder failures and unknown close reasons immediately terminal.
- Exercise all ten shared invalid audio vectors over both native TLS profiles; prove wire bytes, original-frame retention, no retry and no admitted usage.
- Expand selected qualification to 54 client cases, including 46 actual native WebSocket cases; retain bounded execution and the private-only fault port.
In progress — Native heartbeat recovery
- Exercise actual45-second heartbeat timeouts on both native TLS profiles.
- Verify offline frame retention, same-participant/Task recovery, exact replay and single settlement after the real Gateway heartbeat close.
- Expand the selected suite to34 native client cases, including26 actual WebSocket cases; preserve protocol timeout and bounded execution policies.
In progress — Native admission and resume rejection
- Preserve queued rejection events when a peer closes immediately after the native handshake, preventing resume retries before the rejection is processed.
- Stop and join terminal native connections before destruction, retaining ownership on cleanup failure; skip private-driver close before any connection.
- Expand selected native client qualification to32 cases:24 actual WebSocket cases and8 pretransport rejections, including credentials, versions and expiry.
- Verify retained PCM, terminal operation rejection and zero Task/audio usage.
In progress — Native Device revocation
- Preserve queued canonical rejection events when native TLS closes with the exact grant policy reason; keep malformed and unknown closes rejected.
- Deliver decoded client events alongside terminal poll results without turning a revoked credential into a retryable condition.
- Verify native signal/audio revocation on both TLS profiles, terminal client behavior, original unacknowledged PCM, rejected resume and zero Task/audio usage.
- Expand the required selected native Device suite from twelve to sixteen cases.
In progress — Native terminal overflow and server pressure
- Verify terminal overflow after a real native disconnect, retained PCM and rejection of further operations without creating Tasks or audio usage.
- Verify two real capacity denials, unchanged ACK/PCM and exact native replay after capacity release, with two completed Tasks and 120 ms total settlement.
- Expand required dual-TLS native Device qualification to twelve cases and distinguish private-driver exit failures from native resource cleanup failures.
- Complete native HTTP, shared conformance and external acceptance separately.
In progress — Native replay and buffer recovery
- Return the canonical retryable network error when a valid native audio write encounters a closed connection; retain malformed-frame rejection.
- Verify byte-identical replay after write failure and ACK-driven reuse of a two-slot C buffer through real native TLS, public APIs and Task/Usage services.
- Preserve complete private fixture receipts across interrupted and partial writes; add a non-root Linux signal regression for the reproduced truncation.
- Expand required native Device qualification to eight selected cases. Full native HTTP, conformance and external acceptance remain open.
In progress — Native Device task recovery
- Exercise actual C native WebSocket transport through public Device setup, Task completion and lost-ACK resume on TLS1.2 and TLS1.3.
- Verify one80 ms settlement, original Task identity, no duplicate replay and native cleanup against isolated PostgreSQL/Redis-backed services.
- Reuse the shared C driver with private native ports; handle interrupted pipe reads and explicitly disconnect before deinitialization.
- Add source-bound native Device qualification to required CI. Native HTTP, full conformance, external runtime and publication remain unqualified.
In progress — Native Realtime Origin interoperability
- Permit Origin omission for ticket-authenticated native WebSocket clients. Keep exact validation for every supplied Origin and reject invalid/reused tickets independently of cookies.
- Verify actual native TLS1.2/TLS1.3 welcome decoding and cleanup against the Gateway; remove the host C fixture's injected browser Origin.
- Regenerate unpublished contract/SDK pins. No endpoint or wire-message alias, migration, publication or deployment is introduced.
In progress — ESP32 protocol qualification alignment
- Record executed protocol-only component builds, selected native Linux FreeRTOS/TLS paths and partial erasure of SDK/adapted native owned buffers.
- Regenerate metadata and SDK/fixture locks without changing the public protocol, PCM, ABI or retry policy. No migration or deprecation is required.
- Keep complete protocol conformance, hardware and publication unqualified.
In progress — Live Gateway round trips and native CI ownership
- Verify one Task across two live Gateway processes and back, preserving ACK checkpoints, execution identity and a single settlement in the private fixture.
- Use distinct idempotency keys for separate Mock resume operations.
- Run native memory containers as the Linux caller so receipt writeback succeeds.
- Public contracts and spec digest remain unchanged; no migration or deprecation is required. Production discovery, service auth and acceptance remain pending.
In progress — Native memory lifecycle qualification
- Run actual native TLS1.2/TLS1.3 ELFs under pinned Valgrind across baseline, three reconnects and twelve reconnects; preserve retained allocations and reject invalid accesses, leaks, suppressions and unexplained growth.
In progress — Native connection fault recovery
- Verify real TLS drop/stall, interrupted WebSocket upgrade and partial-message disconnect under both TLS profiles, with bounded cleanup and fresh reconnect.
In progress — Native TLS session lifetime and reuse
- Install cached sessions once before handshake retries; preserve cached tickets on failed SAVE, update selected references on replacement and clear them on FREE.
- Verify real TLS1.3 resumption, full handshake after release, server key rotation and replacement using the peer's actual session-reuse result.
In progress — Usage in-flight process recovery evidence
- Verify actual Worker termination while an expiry update is uncommitted.
- Cover server completion and rollback, then replacement-process recovery, unchanged settled timestamps and preserved future reservations.
- Keep deployed recovery and aggregate scope assignment pending.
In progress — Usage executable specification alignment
- Record the existing local Usage Worker executable and post-settlement process restart proof in the canonical Usage specification and generated projections.
- Keep aggregate scope assignment and deployed recovery explicitly pending; no public API, Usage quantity or deployment behavior changes.
In progress — Usage Worker executable
- Run existing quota expiration and private health probes in an OS process with strict stdin configuration, bounded shutdown and fixed diagnostics.
- Share the proven Task maintenance pipe lifecycle and PostgreSQL configuration checks between both commands; retain domain-specific composition.
- Qualify stop/EOF, crash recovery, durable expiration and terminal query errors on isolated PostgreSQL; emit real Go test progress within existing budgets.
In progress — Usage Worker database-loss qualification
- Separate clean process cancellation from database-loss qualification.
- Hold the first real PostgreSQL expiry query until readiness has observed database loss, then require terminal process failure without retry.
- Runtime behavior and public contracts are unchanged.
In progress — Native opening-handshake validation
- Reject malformed status, upgrade headers, challenge responses, subprotocols and unrequested extensions while accepting legal header casing/whitespace.
- Initialize native error events and capture TLS failures before abort so HTTP ticket/grant rejection retains its correct SDK error category.
- Execute both TLS profiles through real certificate and handshake matrices, verifying cleanup and zero application messages after rejection.
In progress — Native certificate validity enforcement
- Require TLS certificate time/date checks and reject insecure build settings. The host supplies valid system time before connecting.
- Reject expired, future, wrong-host and untrusted certificates before the WebSocket upgrade in actual TLS1.2/TLS1.3 client tests, with cleanup verified.
- Bind complete certificate matrices and compiled configuration to native receipts. Preserve pending broader fault, heap and full acceptance gates.
In progress — TLS1.3 native client lifecycle
- Run the actual native WebSocket/FreeRTOS lifecycle under TLS1.2 and TLS1.3, with exact peer negotiation and separate compiled/executed receipts.
- Verify blocked-close ownership, explicit cleanup and three fresh connections under both protocols. Preserve pending expiry, trust/fault and heap coverage.
- Require both profiles in the native CI job. Full candidate and hosted qualification remain distinct from selected local lifecycle evidence.
In progress — Native runtime receipts and independent CI qualification
- Add pinned native Linux build and isolated execution with exact source, compilation and ELF readback; reject stale or mismatched proof records.
- Verify actual blocked-close cleanup and three reconnect cycles, then compile both updated SDK TLS configurations. These are selected local proofs.
- Separate complete Linux/browser, Go race and native SDK checks into required dependencies, preserving the existing aggregate check and per-job limits. Forward explicit browser environments to bounded child processes.
- Retain all hosted failures and pending full candidate qualification. No protocol-ready, release, deployment or publication status is advanced.
In progress — Full native Linux lifecycle qualification
- Execute the actual SDK, TLS/WebSocket dependencies and Linux FreeRTOS port through blocked-callback close, retained-resource retry, queue erasure and three fresh connections. These selected TLS1.2 scenarios pass locally.
- Preserve native tick width in the worker lock timeout and explicitly select Ninja for the compilation-database proof on Windows. Hosted failure logs are retained; full follow-up regression and required-CI integration remain open.
In progress — Native dependency lifecycle adaptation
- Retain native handle and callback storage when stop/close/destroy fails; require explicit successful cleanup before reuse.
- Bind reviewed Apache-2.0 native source substitutions to exact original hashes and actual compile-source verification on pinned ESP-IDF 6.0.2.
- Bound close waits/sends, erase owned credential copies before release, remove raw request diagnostics and reject ticket endpoint redirects.
- Make established sockets nonblocking and share each I/O deadline across TLS WANT direction changes, EINTR and transient TCP errors. Preserve signed backend error returns and partial progress.
- Actual TCP and pinned TLS 1.2 backpressure/deadline tests and wrong-hostname/ untrusted-certificate rejection pass; four native sources compile/link in pinned esp32s3. TLS 1.3 reads now yield on ticket progress, process buffered handshake work, preserve old tickets on save failure and erase owned copies. Real save/discard-mode TLS 1.3 and both IDF configurations pass. Full local CI passes with 646 Node tests, 22 Python tests and all 67 Go packages/vet. Actual Gecko/WebKit pass. Full WebSocket/RTOS lifecycle and exact hosted qualification remain pending; this is not a published SDK.
In progress — Native connection receive cleanup
- Erase unread control messages, lengths and queue cursors after native transport destruction so a reused context cannot deliver previous-connection content.
- Fence native callbacks with atomic closing state during cleanup.
- Record upstream stop/close and ticket-copy lifetime gaps separately from the SDK-owned receive-buffer fix.
In progress — Gateway restart with surviving Task execution
- Extend the standalone Mock with an actual parent-owned Task runtime and a bounded private pipe to its independently replaceable Gateway child.
- Verify hidden/observed-ACK Gateway restarts continue the same Task, accept the next PCM frame and settle once; retain explicit rejection for execution loss.
- Preserve the existing transfer reservation and reject missing final receipts.
In progress — Complete Go qualification scheduling
- Execute isolated HTTP authority alongside Mock and the serial Go remainder, retaining every discovered package and every lane outcome.
- Run race instrumentation over the same complete package inventory, with fresh results and no scope overrides, instead of a handwritten package list.
- Reuse bounded owned-database cleanup for HTTP authority fixtures.
In progress — Protocol delivery evidence
- Assemble existing specs, generated contracts, SDKs, shared fixtures and Mock Server into an unpublished local candidate with exact file hashes.
- Verify the same artifact bytes outside the checkout through JavaScript replay and C lost-ACK completion, with independent database/listener cleanup checks.
- Record actual process-continuity and native transport gaps before Protocol Ready acceptance; preserve current contract and release boundaries.
In progress — Isolated fixture cleanup
- Allow twenty seconds for an owned test database DROP after an observed PostgreSQL checkpoint exceeded the former ten-second allowance.
- Verify cleanup survives owner cancellation, closes an abandoned connection and preserves the input database; retain ordinary cleanup failures.
- Refresh Mock delivery documentation to the current shared 53-scenario matrix.
In progress — Provider timeout qualification
- Separate dial timeout from start-response timeout in the existing provider regression tests while preserving the configured 30-ms limits.
- Require a real run-task message and observed client connection cleanup after response timeout, including deliberately delayed connection setup.
In progress — Watchdog failure evidence
- Reject automatic retries when cancelled jobs or steps hide ordinary failures; require complete step records and bounded, complete job-log evidence.
- Read candidate logs using exact job IDs, bounded requests and no shell; missing logs or explicit test/command failures cannot authorize a retry.
- Replay actual incident metadata and failure lines, retaining synthetic positive stall coverage and rejecting malformed evidence or mixed outcomes.
- Keep the trusted-main workflow and existing job, permission and retry limits.
In progress — Owned Realtime Task maintenance
- Observe idle canonical terminals and reconcile expired local Task resources without waiting for another client request, using bounded batches and reads.
- Preserve foreground and resume ownership across maintenance observations; retry terminal settlement without restarting a Provider or losing receipts.
- Give the shared product host an owned maintenance loop that stops and joins before dependencies close, with one deadline shared by Provider Cancel/Close.
- Verify public cancellation cleans up a real idle Python worker and releases quota through the existing HTTP, WebSocket, PostgreSQL and Redis composition.
In progress — Realtime cancellation qualification
- Qualify public cancellation while actual WebSocket PCM, receive or Finish is blocked in a Python Provider, using canonical Task and Usage services.
- Verify rejected audio receives no ACK, cancelled Finish replays no duplicate terminal, Redis checkpoints remain truthful and quota is released once.
- Reuse the shared product fixture with Task-scoped Provider fault injection.
- Give cancellation, authority and Mock Device matrices separate owned databases and fixture lifetimes, preserving their existing deadlines and all scenarios.
In progress — Cancellation during Provider execution
- Observe canonical Task authority while Provider PCM, receive or Finish is blocked; stop the owned Provider and suppress interrupted output after cancel.
- Bound authority reads and retries to the active operation, joining the observer before consuming results or returning to the caller.
- Qualify real public cancellation with PostgreSQL and blocked Python workers, including idempotent replay and exactly one terminal release decision.
In progress — Public Task cancellation execution boundary
- Re-read canonical Task authority before Provider PCM and Finish, stopping an externally cancelled session without adding terminal output or Usage decisions.
- Reject unaccepted audio without a receipt; reconcile terminal quota and retain bounded recovery metadata when settlement is unavailable.
- Qualify public cancellation and idempotent replay against isolated PostgreSQL, plus authority-read failures and Realtime receipt/settlement recovery.
In progress — Python Provider interruption
- Interrupt blocked PCM, receive and finish operations by stopping their owned Python child; preserve normal private-protocol cancellation when idle.
- Fence interrupted responses and retain canonical Task cancellation without final delivery, Provider cost or a second terminal Usage decision.
- Qualify actual worker cancellation and process reaping through shared fixtures.
In progress — Native WebSocket callbacks
- Assemble native receive chunks and fragmented text within the existing queue limits; accept interleaved Ping/Pong without passing controls to JSON parsing.
- Decode exact heartbeat timeout closes, drain pending canonical events before reporting network loss, and preserve terminal rejection and audio cursors.
- Replace failed native handles for caller-driven, fresh-ticket reconnect.
- Allow bounded cold Mock fixture compilation without changing scenario or CI deadlines, and report preparation expiry explicitly.
In progress — Complete Go test scheduling
- Run the isolated Mock package beside the serial remainder of the discovered Go package set, retaining fresh test execution, all outcomes and bounded CI.
- Include private cmd sources in the formal formatting gate.
- Bound race-executable test compilation separately from process lifecycle deadlines, with explicit preparation-timeout diagnostics.
- Reject automatic run-wide retries when a timeout has an ordinary-failure peer.
In progress — Task maintenance executable
- Compose canonical Task expiry and terminal Usage reconciliation in a private Go executable with protected configuration input and bounded shutdown.
- Reject ambiguous policies, ambient database overrides and unsafe connections; verify existing schema without DDL and expose only fixed process status.
- Qualify actual expiry, stop, restart, EOF and dependency failure using owned software fixtures and canonical Task/Usage admission.
In progress — Bounded Mock scenario concurrency
- Run at most two independently isolated Device conformance scenarios at once, retaining actual processes, deterministic PCM and complete Task/Usage readback.
- Hold the concurrency slot through database and listener cleanup; preserve real heartbeat timers, all failure assertions and required CI time limits.
In progress — Windows scheduler proof startup budget
- Allow bounded Windows process startup in the real concurrent-lane proof, preserving its peer handshake and predecessor ordering assertions.
- Keep one attempt, all required checks and the 15-minute CI job limits.
In progress — Task maintenance process-loss qualification
- Kill real isolated maintenance processes after cleanup claim, Task expiry, Usage projection and quota release; recover against the same durable authority.
- Preserve real cleanup lease timing, immutable Usage identity and terminal deduplication. Verify abandoned generation fencing, unstarted Task protection and clean replacement shutdown through the existing Task bootstrap.
In progress — Linux validation phase scheduling
- Overlap full local validation with browser installation, then overlap native qualification with the complete serial Gecko/WebKit browser proof sequence.
- Preserve all checks, exact toolchain pins, both 15-minute required jobs and bounded failure handling. Qualify dependency ordering with real subprocesses; exact remote timing remains a separate requirement.
- Isolate the Task atomicity test database so unrelated pending outbox history cannot fill its bounded read page across repeated local runs.
In progress — Durable terminal Task Usage reconciliation
- Scan persisted Task terminal decisions for missing Usage projection or quota settlement, including work left after execution claims have been released.
- Reuse canonical settlement transactions and Task-correlated identities; preserve expired quota rather than attempting to reactivate or release it.
- Integrate bounded reconciliation into every Task maintenance cycle, with explicit Usage configuration and failure propagation. Qualify concurrent readers, interrupted projection/settlement and real scheduled PostgreSQL work.
In progress — Scheduled Task execution expiry
- Add an explicit Task maintenance bootstrap that verifies the existing schema and composes a caller-controlled runner without migrations or Provider I/O.
- Run bounded serial passes, including when batches are full. Reject overlapping or repeated runner invocation; cancellation stops cleanly and failures exit without implicit retry or private dependency details.
- Prove real PostgreSQL expiry across scheduled batches while preserving unstarted Tasks. Usage settlement and successful audio recovery remain open.
In progress — Abandoned Task execution expiry
- Add bounded discovery and expiry of abandoned dictation execution claims. Recheck lease ownership under existing locks and reuse the canonical terminal transaction for Task state, outbox and Usage decision.
- Qualify concurrent cleanup, stale discovery, live-worker protection and old generation fencing with isolated PostgreSQL and race detection. Scheduler, settlement integration and successful audio recovery remain open.
In progress — Mock Gateway process-loss qualification
- Add a separate software Gateway/Task child with bounded startup, observed abnormal exit and replacement against the same isolated database and Redis.
- Ship a deterministic Device process-loss client. The retained-process control resumes and settles once; both lost and observed ACK crash cases expose an explicit resume rejection with no false Task completion or extra settlement.
- Successful recovery after losing the Task execution process remains open.
In progress — Linux native proof scheduling
- Overlap Go race qualification with the scoped ESP-IDF software compilation after full local CI. Browser proofs wait for both results.
- Preserve both required jobs, every check, exact toolchain pins and the 15-minute job limit. Each native lane uses the existing bounded process supervisor without an internal retry; failures remain blocking.
In progress — ACK sample checkpoint integrity
- Require the JavaScript ACK sample and duration to match their exact integer representation and the transmitted frame end before releasing retained PCM. AudioSignalBacklog acknowledgement now requires an explicit bigint sample.
- Validate all retained resume samples before applying any stream checkpoint; verify duplicate ACKs against the last accepted sample even after PCM release.
- Reuse the C resume checkpoint lookup for ordinary ACK admission. Invalid samples fail the receive path without releasing PCM or enabling retry.
- Add 17 shared software vectors, ordinary/duplicate C and JavaScript execution, and multi-stream resume atomicity cases; package nine conformance payloads.
In progress — C active-session and negotiation refusal
- Wait for actual WebSocket admission inside the C transport callback. Reuse all shared upgrade and resume-version negatives with terminal-state checks.
- Verify an independent observer can use a ticket after rejected upgrade, while the failed C client performs no retry or fallback.
- Exercise public Device revocation before open and after queuing deterministic PCM; preserve original audio/bindings and reject further work without ACK or Task.
- Keep Node port error projection explicit and retain native networking and broader cross-SDK qualification as separate incomplete work.
In progress — C software bootstrap admission
- Request the actual public HTTP bootstrap result from inside the C runtime's control-plane callback; preserve failed clients for terminal-state inspection.
- Cover revoked/expired credentials and two shared create-negotiation vectors, asserting cleared bindings, zero transport connects and refusal of subsequent connect, reconnect, open, replay, end and deterministic PCM writes.
- Keep Node HTTP/WebSocket ports explicit: this qualifies C failure handling, without claiming native C HTTP or ESP-IDF TLS network implementation.
- Correct the conformance bundle guide to enumerate all seven current payloads.
In progress — JavaScript server event admission
- Generate the canonical control envelope and server-only event registry into the JavaScript contract. Validate envelopes before ACK, resume or transcript state changes, including Trace IDs, message IDs and timestamp calendar values.
- Reject unknown fields/types, client/audit messages and invalid sequence numbers; expose optional trace_id and event_sequence in the existing RealtimeEvent type.
- Reuse shared trace fixtures for ACK and resume rejection with unchanged backlog/ACK state, terminal retry refusal and late-event fencing.
- Execute the formal Go suites with test-result caching disabled so child JavaScript/C fixture changes cannot inherit old Mock qualification results.
In progress — Canonical control envelope and Trace IDs
- Accept all registered control types, including ping/pong/error, and require canonical uppercase ULIDs for optional trace_id. Bound message IDs to the existing 128-character limit and reject trailing newlines.
- Reject explicitly empty/null Trace IDs in Gateway admission. Reuse canonical resource validation in the C decoder and exclude the invalid ULID letter L.
- Share 17 Trace ID vectors across schema validation, Gateway sockets and native C decoding; include them in the regenerated, version-locked conformance kit.
In progress — Gateway canonical error projection
- Map internal protocol/lifecycle/authority failures to registered public codes; take error-event retryability from generated canonical metadata.
- Use canonical ticket, lost-lease and Usage failure close reasons.
- Verify error events, policy closes, unchanged ACK/replay checkpoints and recoverable gap delivery through actual Gateway sockets and isolated Redis.
In progress — Canonical server pressure and C replay recovery
- Map internal Task/SignalStream capacity pressure to registered retryable rate_limited; remove the unregistered C backpressure alias.
- Preserve retryability in decoded C error events. A retryable rate_limited during audio keeps retained PCM and leaves bounded retry to the caller.
- Verify two actual capacity refusals, unchanged ACK and PCM, blocker completion, exact C replay, Task/Artifact completion and one settlement per Task.
In progress — C client replay-buffer capacity
- Verify terminal client_buffer_overflow preserves both queued frames and rejects further writes, replay, reconnect, open and end operations without transport I/O.
- Verify caller pause at capacity, exact release after real ACKs and ring-slot reuse through 160 ms of audio, completed Task/Artifact and one settlement.
- Give the client-pressure fixture a separate four-frame Task limit; the actual server-pressure fixture continues to exercise its two-frame limit.
In progress — C SDK canonical audio-frame errors
- Decode canonical frame_invalid and frame_too_large errors into the existing protocol-error category while preserving the exact server code in the event.
- Run all ten shared malformed audio vectors through the product Gateway and C runtime, requiring one error callback, terminal rejection and retained PCM.
- Verify no Task, settlement or audio checkpoint is created for rejected frames.
In progress — Realtime mutation ordering qualification
- Exercise Source revocation and Device capability withdrawal before/after open and resume with observed database locks and deferred commit barriers.
- Require stale admission rejection, unchanged ownership, zero rejected resources and terminal cleanup for already admitted streams. Product runtime is unchanged.
- Source revocation uses fixture state; this does not introduce a mutation API.
In progress — Room close sees committed lifecycle changes
- Give closure its own Read Committed transaction, locking Room before reading authority and projecting children. Room creation remains Serializable.
- Reproduce and correct admission-first closure leaving active children; verify both lock orders and recheck membership changed during the wait.
- Preserve atomic response/idempotency/audit handling through the existing close service and public API lifecycle tests.
In progress — Room closure fences Realtime lifecycle
- Acquire a shared Room lock before Participant and Signal mutations, matching the Room-first ordering of closure without upgrading competing admissions.
- Verify closure-first join/open/resume/finish for Service and Device with observed database barriers, canonical rejection and no active/orphan resources.
- Admission-first closure and broader mutation concurrency remain unqualified.
In progress — Signal-open and resume lock ordering
- Lock the current Participant before Source during signal registration, matching resume's order and preventing a reproduced PostgreSQL deadlock.
- Verify Service and Device takeover against a concurrent old-owner open with observed database locks, canonical rejection and no orphan resources.
In progress — C SDK retained replay and atomic resume validation
- Run the native C protocol client through real reconnect with an omitted frame or lost ACK; require exact replay bytes or release from the server checkpoint.
- Validate the complete resume ACK before moving the C client to finalizing. Invalid checkpoints preserve state and retained PCM.
In progress — C SDK server-allocated lifecycle bindings
- Bootstrap the C protocol runtime with Source and Room only; learn Participant, SignalStream, Task and Artifact identities from validated server events.
- Exercise actual C framing, ACK and event handling against the independent product server through Node HTTP/WebSocket ports.
- Wait for server handler cleanup before fixture readback, with a finite deadline.
In progress — Independent Mock Server and provisioning Usage
- Start isolated Control API, Gateway and deterministic downstream processing as a separate local executable for portable Device clients.
- Attribute anonymous code-exchange Usage to the authorized Device while keeping the application request anonymous; preserve actual durable Usage/stage checks.
In progress — Portable software Mock Device
- Package the compiled SDK, unchanged Mock scenarios, pinned WebSocket runtime and locked PCM fixtures for execution outside the checkout without installation.
- Run product Device conformance from an independent temporary kit, retaining server-side authority, audio, Task and Usage readback.
In progress — Version-locked Device conformance fixtures
- Package shared Device fixtures and deterministic PCM with canonical-spec and content digests. Verify the lock before Mock network I/O and record it in receipts.
- Provide an offline verifier that works outside the repository without dependencies.
In progress — Public capability withdrawal lifecycle
- Verify Device capability withdrawal blocks new streams, preserves an admitted stream's completion, and permits replay of completed results without granting new audio admission. Replaying the old publication response cannot restore it.
In progress — Mock Device sequence recovery
- Verify an out-of-order frame produces sequence_gap without closing the socket, retained replay restores contiguous ACK, and exact/retransmit duplicates return the current ACK without repeating Task progress or usage settlement.
In progress — Duplicate audio final-flag identity
- Fix JavaScript SDK duplicate detection to reject changes to the final flag, matching SignalStream identity. Preserve exact duplicates and unACKed bytes.
- Extend shared Go/JavaScript/C ACK-state fixtures with final-flag add/remove conflicts and byte-preservation checks.
In progress — Expired Device credential
- Verify expired Device credentials reject connection-result replay and previously issued tickets. The isolated server fixture expires the exact credential after ticket issuance; the independent client uses only public HTTP/WebSocket APIs.
In progress — Active Device revocation
- Verify public Device revocation on an already joined socket. Subsequent Signal admission fails with grant_missing, the socket closes, and resume minting fails with token_invalid. No SignalStream or Task is created after revocation.
In progress — Revoked Mock Device admission
- Exercise public Device revocation after ticket issuance. The same Device cannot replay its prior connection-creation response, and the issued ticket receives authentication rejection before Room admission or audio processing.
In progress — Task backpressure retry
- Fix pending audio retries after Task admission pressure. An identical frame accepted on retry now advances the ACK and persisted resume checkpoint and delivers Task progress. Already acknowledged duplicates continue to re-ACK.
In progress — Device buffer-pressure conformance
- Fill the actual SDK audio backlog with deterministic PCM, verify explicit overflow without a network send or buffer mutation, and retry the rejected sequence after resume releases the acknowledged frame. Check final audio duration, Task completion and one usage settlement through the local product.
In progress — Product lost-ACK conformance
- Extend the independent Mock Device with a server-processed frame whose ACK is suppressed before SDK delivery. Resume releases retained PCM without replay; product Task completion and single usage settlement pass the local race test.
- Preserve the separate undelivered-frame replay scenario. Full qualification for this extension remains pending.
In progress — Retained SDK resume
- Add explicit same-client resume with retained PCM, atomic ACK checkpoint reconciliation, stale-socket isolation and fail-closed stream/Participant binding.
- Extend the independent Mock Device with deterministic disconnect/replay. This now completes through product Task/Usage processing with explicit Task connection-authority transfer, failed-transfer rollback and old-writer fencing. Full qualification and further recovery conformance remain pending.
In progress — Software Mock Device preparation
- Add the SDK's fixed anonymous provisioning exchange and compose registration, Device capability publication, Source binding and connection-ticket issuance.
- Pin software execution to an explicit loopback server. Validate response scope, separate Owner and Device credentials, and support disposal without secret output.
- Full product-backed Mock Device Realtime qualification remains incomplete.
- The independent Node client now completes the normal audio path against the product HTTP/Gateway/PostgreSQL/Redis fixture, with deterministic transcription, correlated terminal events and one durable quota settlement. Recovery and negative conformance are still pending.
In progress — Public Source provisioning
- Add Source creation, scoped reads and cursor lists with server-derived ownership, Device binding, exact credential revalidation and atomic audit/idempotency.
- Product software tests now register Source through the public API before deterministic PCM reaches Gateway and downstream processing. Capability publication and complete Mock Device qualification remain incomplete.
In progress — Repository ownership correction
- Update JavaScript contracts and generated references to supplied PCM. Treat historical hardware receipts as provenance and guard against restoring deleted acquisition/storage code or physical test commands.
- Remove public JavaScript AudioWorklet capture APIs and packaged worklet. Generic synthetic graph support is test-only; SDK audio transport accepts supplied PCM.
- Remove browser physical-microphone and controlled-media acquisition runners. Keep synthetic proof routes and deny microphone permission at the test server.
- Revise the canonical SDK contract and generated reference to require caller- supplied PCM and abstract secure-store access. Physical validation belongs to onesay-os; the protocol-only ESP-IDF component awaits fresh qualification.
- Establish shared deterministic PCM for the software Device path and reuse the canonical OSAF encoder in Gateway/Task/Usage integration tests. Full Mock Device protocol readiness remains under development.
- Remove SDK audio acquisition callbacks. Audio submission starts at caller- supplied PCM; retain transport replay and ACK behavior with deterministic data.
- Remove Platform I2S/GPIO/DMA capture, concrete NVS storage and the board firmware test runner. Hardware implementations belong to onesay-os. Retain protocol, credential interfaces, caller-supplied PCM transport and TLS/WebSocket.
- Replace the board-test plan with Platform Device identity, semantic capability contracts and deterministic mock-device conformance. Contract and evidence cleanup is ongoing; this change is not deployment or acceptance evidence.
In progress — Realtime product runtime
- Extract read-only create/resume authorization from ticket issuance, allowing resource checks before HTTP idempotency without minting or consuming tickets. Product bootstrap uses the same service for preflight and issuance.
- Resolve every requested Realtime Grant from current resource authority, including credential scopes and role templates, before ticket issuance.
- Reject cancellation after authority lookup and preserve Resume denial audit ownership while keeping preflight free of ticket and audit writes.
- Add the HTTP preflight adapter for canonical Realtime create/resume operations; HTTP tests verify revoked authority blocks idempotent replay before handler and Usage.
- Require explicit environment-matched Redis configuration and bind Realtime handlers/preflight in product bootstrap. Product tests now verify real Redis issuance, single consumption, durable replay and membership-revoked replay denial.
- Verify Resume protected replay and outstanding-ticket fencing with real Redis; reject missing Redis and mismatched environment bindings during startup.
- Verify Service/Device public credential flows through actual Redis ticket issuance; deny cross-project access, revoked-Grant replay and suspended-parent replay before Usage.
- Verify scoped Resume principal binding, protected replay and single-use claims; reject test credentials accessing a live Room in the same Project.
In progress — Catalog product runtime
- Propagate request context through all four Catalog operations and reject canceled requests before projection.
- Bind Catalog discovery to current OneSay membership, credential and Grant state in the product HTTP runtime. Filter Actions again at service execution; discovery grants never confer resource execution authority.
In progress — Principal runtime integration
- Pass request cancellation and deadlines through credential authentication database work, including transactions, grant lookup and audit.
- Authenticate Service/Device opaque credentials through current database state with explicit environment prefixes and no OIDC fallback.
- Authorize scoped resource reads against current credential, Grant and parent state. Further resource operations and remaining product assembly are pending.
- Enable scoped Service/Device Room and Task management through existing resource lookups, requiring current credential scopes and Grants before execution/replay. Actual PostgreSQL HTTP lifecycle and denial tests pass; full CI remains pending.
In progress — Control API product serving
- Separate startup schema verification from explicit database migration.
- Reuse a bounded Control API serving lifecycle in the Console acceptance tool, with request deadlines and connection cleanup on cancellation or drain failure.
- Product service assembly and cross-origin integration remain in development.
2026-09-05 — Cross-browser Console authentication proof
- Exercise actual redirects and cookies through an exact-authority local HTTPS proxy with CA-verified upstream connections. Native browser TLS trust remains unexecuted; no deployed acceptance is claimed.
- Track concurrent provisional WebKit targets in a pinned Playwright driver patch, retaining target identity checks. Bind the dependency patch, lock and actual installed driver bytes to the authentication receipt.
- Cross-browser validation and independent patch review must finish before merge; prior failed runs remain recorded in the implementation log.
2026-09-05 — Console static preview error handling
- Missing session endpoints and assets return 404 without crashing the Docs preview server. Browser-proof cleanup handles prior process exit and has a five-second wait bound, preserving the actual browser assertion failure.
- Record PR #131's first CI failures and focused regression evidence; corrected cross-engine validation remains pending.
2026-09-04 — E7 Windows Gecko synthetic activation hardening
- Preserve the ordinary PR #121 Windows failure where Playwright's Gecko pointer action timed out after the named control was visible and stable.
- Wait for explicit proof-module readiness, schedule page-owned DOM activation and require bounded running-or-terminal acknowledgement before awaiting the existing terminal result.
- Keep physical microphone trusted-click gates, public contracts, external traffic, user audio, deployment, Legacy and Production unchanged.
- Seal PR #121 through final and merged-main Ubuntu/Windows CI with exact tree, ancestry, watchdog and branch-cleanup readback.
2026-09-04 — E5 local Task Worker composition root candidate
- Connected the configured-version credential source, live Python process factory, privacy-gated Resolver, specialized executor, exact v1.3 PostgreSQL Task repository, pipeline and mandatory Runtime-stage reporter behind one private bootstrap entry point.
- Invalid configuration fails before database migration. Bootstrap itself does not read a secret, start Python, perform DNS or call a Provider.
- No public API or canonical domain changed. The Worker is not deployed and all external E5 gates remain open.
Every public contract, SDK, Docs or behavior change must update the canonical spec, generated projections, migration impact and release changelog together. This preview renders repository change entries; it does not announce a release.
2026-09-04 — E5 Provider privacy-policy enforcement
- Fixed M1 Provider Route semantics to require
ephemeral_onlyretention,forbiddentraining use and membership in an explicit immutable data-region authority before dispatch. - Validate all Routes, including disabled and trailing entries, before exact credential binding or any health/factory/backend path; runtime resolution repeats the fail-closed check before health or backend I/O.
- Kept the public contract unchanged and external Provider declaration, Staging and full retention/privacy acceptance explicitly open.
2026-09-04 — Provider native-failure race proof
- Removed a test-only scheduler-order assumption exposed by merged-main Go race execution after PR #112.
- Kept both legal runtime outcomes fail-fast and normalized: an immediate Provider failure can surface from the PCM write or the following finish.
- Added repeated focused race evidence without external traffic, credentials, deployment, Legacy or Production changes.
2026-09-04 — E5 Resolver exact-binding startup gate
- Added a private, no-I/O exact binding membership contract to the existing configured-version credential source.
- Made Resolver construction fail closed when any credential-bearing Route, including a disabled Route, lacks its exact configured binding.
- Preserved one runtime backend read, fixed safe errors and provider-neutral public contracts; deployed Worker composition and all external gates remain open.
2026-09-04 — Production dependency audit resilience
- Replaced the unreliable npm advisory request with a fixed-endpoint, fail-closed OSV batch query over the exact lock-verified production closure.
- Added deterministic lock/install equality, SHA-512 integrity, unsupported-source, response-bound, schema and unresolved-pagination gates.
- Added focused cross-platform tests and documented the Quickstart fixture's private non-production boundary. This changes no runtime or public contract.
2026-09-04 — E5 external Secret Manager boundary
- Added a private vendor-neutral configured-version credential source behind the existing resolver, with one context-bound read, fixed safe errors, defensive copy and zeroing on every result path.
- Kept real-backend immutable-selector/cancellation proof and startup cross-validation explicitly open.
- Unified the private Go/Python credential ceiling at 4096 bytes and extended the offline raw-OSPP vertical and concurrent race coverage.
- Moved shared credential-byte validation out of the vendor-specific adapter into the common Provider credential boundary without changing behavior.
- Kept vendor selection/SDK, workload identity, real secrets, Provider traffic, Staging and deployment explicitly open. No public contract changed.
2026-09-04 — bounded command post-exit settlement
- Stop timeout monitoring as soon as the child emits its authoritative exit.
- Bound the remaining close/output-drain handoff to five seconds; destroy only lingering local streams and preserve the actual exit code when it expires.
- Prove that neither successful nor failed completed commands can be reclassified as timeouts or trigger a second process tree. Required Ubuntu/Windows CI and the exact-run watchdog both pass without a rerun.
2026-09-04 — E5 Python live process lifecycle seal
- PR #110 and merged-main Ubuntu/Windows CI passed on attempt 1; exact feature head, tree, merge, watchdog decisions, ancestry and branch cleanup are now machine-bound in the M1 ledger.
- Sealed the current unpublished 166,433-byte JavaScript package at archive
SHA-256
bea68a8a…674band closed its required-CI reseal gate. - Kept external secret manager, real Provider canary, Staging, publication and all Production/Legacy state open and unchanged.
- Retained both npm advisory endpoint failures from the initial required run and its only same-head retry. A later bounded HTTP 200 probe and successful local dependency audit now justify fresh required CI on a substantive head.
2026-09-04 — E5 Python live streaming Provider adapter
- Added the internal Python Paraformer streaming adapter required by ADR-016, with exact WSS/TLS/handshake/frame/session bounds and no external dependency.
- Preserved one provider-neutral partial/final/usage/error contract, bounded partial coalescing, lossless terminal results, credential zeroing and no PCM retention.
- Added local socket-pair fake-WSS coverage. OSPP live wiring, secret-manager integration, real Provider traffic, Staging and deployment remain open.
- PR #107 required Ubuntu/Windows CI passed on attempt 1 and the exact tree was merged. The current private SDK bytes are sealed by that run.
2026-09-04 — E5 private Go/Python Provider process bootstrap
- Added an internal OSPP v1 process boundary from the Go Task Worker to the deterministic Python Provider runtime, with one isolated child per stream.
- Added bounded binary framing, exact duplicate-key-safe JSON, minimal child environment, timeout termination, fixed error exposure and zero retained PCM.
- Wired the existing capability resolver and specialized speech executor to the process adapter and added shared-fixture, lifecycle, rejection and race coverage. PR #105 required and merged-main Ubuntu/Windows CI passed; exact tree readback and local/remote branch cleanup are sealed.
- Kept the empty-repository Quickstart cold Go build bounded while allowing up to 120 seconds on Windows; Linux and macOS retain the 60-second ceiling.
- No public contract, live Provider, credential, deployment, publication or external state is changed.
2026-09-04 — E5 Python Provider runtime foundation
- Began the accepted ADR-016 Python Provider boundary with a dependency-free provider-neutral contract and deterministic incremental runtime.
- Added a shared Go/Python conformance fixture and exact Python 3.14.7 checks on Ubuntu and Windows. The Go fake-WSS adapter is transition conformance evidence, not deployment authority.
- Regenerated private consumers from the same registry. The current unpublished JavaScript SDK package is byte-reproducible and was sealed by PR #103 required Ubuntu/Windows CI; prior package proof remains historical.
- The live Python adapter, external secret manager, Provider traffic and Staging remain open. Nothing is deployed or published.
2026-09-03 — E5 provider documentation readback
- Rebound the active capability and live-adapter documents to the already merged PR #46, #95 and #96 lifecycle evidence.
- Removed stale claims that the repository-local live adapter and its required lifecycle were still pending. External secret-manager/bootstrap integration, real Provider traffic and Staging remain explicitly open; no contract, runtime, external state or Epic status changed.
- PR #101 and its merged-main run passed Ubuntu/Windows CI on attempt 1; exact tree, watchdog, ancestry, readback and branch-cleanup evidence is sealed.
2026-09-03 — E9 static-route readiness lifecycle seal
- Sealed PR #99 required Ubuntu/Windows browser CI, exact merge-tree and remote-main readback, merged-main CI, watchdog decisions and local/remote branch cleanup.
- Both required and merged-main watchdogs observed no stall and performed no rerun. The package changes no canonical API, external state or E9 status.
2026-09-03 — E9 deterministic static-route readiness
- Replaced Playwright
networkidlewaits on the Console and three static Playgrounds with deterministic pageloadplus a named visible control. - Added a regression test that covers the exact navigation contract and rejects reintroduction of the flaky heuristic. PR #99 and its merged-main run passed the complete Ubuntu/Windows browser matrix. This changes no canonical API, external request policy, publication state or Epic status.
2026-09-03 — E9 Quickstart fail-closed network evidence
- Upgraded the local Quickstart receipt to closed schema v2 and bound exact offline package/build policy plus numeric IPv4 loopback application traffic.
- Bound the Quickstart and input-policy source digests while preserving the existing private SDK, fixture and transport-archive digests.
- Local proof and full local CI passed on attempt 1 without retry, including
249/249 Node tests. PR #98 required Ubuntu/Windows CI passed; a merged-main
Windows static-route readiness timeout is being corrected separately.
OS-level traffic observation, Staging and publication remain unexecuted;
E9 remains
PARTIAL.
2026-09-03 — PostgreSQL Cancel/Pipeline lifecycle seal
- Sealed PR #97 required Ubuntu/Windows CI, exact merge/tree readback, merged-main CI and local/remote feature-branch cleanup evidence.
- Both required and merged-main watchdog observations completed on attempt 1
with no retry. E5 remains
IN PROGRESS; external Provider, Staging and TAC evidence remain unclaimed.
2026-09-03 — PostgreSQL Cancel/Pipeline concurrency proof
- Added a deterministic real-PostgreSQL integration matrix covering all six directions between authorized Task cancellation and claimed partial, completion or Provider-usage persistence.
- Bound every observed loser to the exact winner backend with
pg_stat_activityandpg_blocking_pids, then verified exact terminal, outbox, usage, claim and receipt invariants with zero durable customer text. - Ten digest-pinned PostgreSQL 17.6-alpine repetitions, focused Go race and the
full taskrepo package pass locally on watchdog attempt 1 without retry.
PR #97 subsequently sealed required and merged-main CI; external/live
Provider, Staging and TAC work is not claimed, and E5 remains
IN PROGRESS.
2026-09-03 — Incremental Provider progress lifecycle seal
- Sealed PR #95 required Ubuntu/Windows CI, exact merge-tree and remote-main readback, merged-main CI and local/remote feature-branch cleanup evidence.
- PR #96 then sealed the exact lifecycle note through required run
33748184806, merge2d2afb45…, merged-main run33749020839, identical tree/readback and bounded watchdog attempt 1 with no retry. - Preserved E5 as
IN PROGRESS; live Provider canary, external secret manager, Staging, deployment, publication, Production and Legacy remain unexecuted.
2026-09-03 — Incremental Provider pre-end Task progress
- Replaced the private batch-shaped speech execution path with one bounded incremental Provider stream across deterministic, Paraformer, canary, pipeline and Realtime Task adapter implementations.
- Emit canonical
artifact.deltaprogress during Audio ingestion while preserving final/usage terminal ordering, exactly-once recovery, quota settlement and zero retained PCM. - Added no-Provider expiry reconciliation for admitted Tasks without an owned session and limited each request-triggered expiry sweep to one candidate.
- Kept E5
IN PROGRESS; live Provider, secret manager, Staging and deployment remain unexecuted.
2026-09-03 — E9 JavaScript Quickstart lifecycle seal
- Sealed PR #93 required Ubuntu/Windows CI, exact merge/tree readback, merged-main CI and local/remote feature-branch cleanup evidence.
- Sealed the current unpublished private JavaScript SDK archive on Ubuntu and Windows without publishing a package or changing an external authority.
- Preserved live Provider streaming, Staging, external five-minute acceptance, manual accessibility and publication as incomplete external gates.
2026-09-03 — E9 empty-repository JavaScript Quickstart hardening
- Corrected the local Realtime proof so
audio.ack,artifact.delta, the clientsignal.end,signal.ended,artifact.finalizedandtask.completedpreserve v1.3 authority order. The Gateway now accepts and binds progress events during Audio ingestion; live provider streaming remains explicitlyPARTIAL / RUNTIME MISSING. - Replaced ambient pnpm-store dependence with two exact local archives and a
fresh isolated store. The example pins pnpm
11.23.0; installation remains offline with lifecycle scripts disabled. - Added second-client server ticket-reuse proof, exact receipt validation, bounded child output/time, raw-output-safe failures and confirmed process-tree termination. This is private local evidence and authorizes no publication, Staging, Production or Legacy change.
2026-09-03 — Windows CI toolchain and browser hygiene
- Removed the unused Node-20-based MSVC environment action from the required
Windows job and added an explicit fail-closed
clang.exeversion preflight. - Limited Windows Playwright installation to Firefox, matching its two Gecko lanes. Ubuntu continues to install and execute Firefox/Gecko plus WebKit.
- Preserved required job identities, timeouts, Node/Go versions and bounded watchdog behavior. This changes CI setup only and advances no Epic or external approval gate.
- PR #86 and merged-main required CI passed Windows and Ubuntu on attempt 1; both watchdog runs observed no stall and did not rerun. Exact tree/ancestry readback and local/remote branch cleanup pass. Windows emitted zero check annotations and both browser lanes remained Gecko-only.
2026-09-03 — Fail-closed ESP-IDF CI impact scope
- Added an explicit base/head evaluator for the expensive ESP-IDF proof lane. Changes to the ESP32 contract, generated C, SDK, fixtures, builder, workflow, evaluator or lockfile run the pinned component compile; uncertain evaluation also runs it.
- Limited
package.jsonimpact to the ESP-IDF command and its actual Node/pnpm/YAML toolchain fields. The unrelated physical-browser script from PR #83 now proves a safe skip instead of consuming a second ESP-IDF build. - Corrected E8's stale required-CI label from candidate to proven without claiming physical hardware, Staging, publication or Epic completion.
- PR #85 and merged-main run
33661122431now close this package. Windows required one bounded timeout retry; the second watchdog skipped and no third attempt occurred.
2026-09-03 — E7 physical harness lifecycle evidence seal
- Bound PR #83 head
a465c35a…, mergef2f0fc9…, exact treec96dcfcc…, required run33648949210and exact-range zero-finding scan5a05336b-0772-46d6-b425-fefd93e3c170into the acceptance ledger. - Retained merged-main run
33650359034asNOT PASS: the first Ubuntu attempt timed out during slow Playwright system-package downloads; watchdog33652088221reran only that job; the second attempt timed out during pinned ESP-IDF compilation after Playwright and complete local CI passed. Watchdog33653760084skipped, proving there was no third attempt. - Added fail-closed lifecycle validation and corrected two stale E8 decoder-CI descriptions. No contract, runtime, physical-device, Staging, publication, cloud, Production or Legacy state changed.
2026-09-02 — E7 physical microphone acceptance harness
- Added a default-inert manual acceptance runner with explicit CLI opt-in, dedicated-device consent, two trusted human gestures and a random one-use loopback session.
- Added coarse streaming liveness proof with immediate transient-buffer zeroing and strict evidence allowlisting. Raw PCM, exact audio metrics and device labels/identifiers are never persisted.
- Added fail-closed token, Host, Origin, method, body-size, schema, replay and process-tree cleanup tests; the physical runner is excluded from CI.
- Closed async teardown, one-use reservation and browser cleanup races, including a POSIX regression where the browser leader exits while descendants remain in its process group. Manifest schema v2 binds static inputs, every served compiled SDK file and executable harness inputs; acceptance recomputes its digest and each server uses a unique disposable build root before committing that exact build into the receipt. Each new attempt invalidates the prior fixed-path receipt, and a PASS receipt binds its run and manifest. Windows leader-only exit no longer authorizes profile deletion.
- Post-remediation focused tests pass 29/29. Full bounded local CI passes
210/210 Node tests plus all Go, generated compile, Docs, dependency, secret
and Redis-loss gates on watchdog attempt 1. Post-remediation working-tree
security scan
0e3c2f08-da97-42df-a516-86e1dae256b8closes all 6/6 changed source files and eight threat surfaces with zero findings/deferred. The later lifecycle seal binds exact-range scan5a05336b-0772-46d6-b425-fefd93e3c170, PR #83 required CI, merge/tree readback, bounded merged-main timeout evidence and branch cleanup without upgrading the physical acceptance state. - Kept physical execution
NOT EXECUTED, E7PARTIAL, and all Staging, publication, cloud, DNS, Production and Legacy boundaries unchanged.
2026-09-02 — E10 supporting-cost Owner decision proposal
- Added official-source-backed recommendations, bounded alternatives, billing components and account-readback requirements for all ten E10 supporting-cost decisions.
- Added deterministic validation that the proposal remains byte-bound to the unchanged BOM and cannot claim Owner selection, numeric cost, approval or an external mutation.
- Six focused tests, full bounded local CI and Codex Security scan
46049d47-c56b-41b1-94f8-466c0f978c5dpass; the scan closed five changed items and six threat surfaces with zero findings and zero deferred work. - Final exact-range scan
f797c50b-0698-421f-a81a-138a046270ffbindsa5c0294..ca297fdand closes five changed items and seven threat surfaces with zero findings or deferred work. - PR #80 required run
33623767497passed exact evidence headc354ea2on Ubuntu and Windows; watchdog run33624577575observed no stall and did not rerun either job. - E10 stays blocked with pending counts
9/3/10, a null exact total and no purchase, provisioning, DNS, deployment, Production or Legacy authority.
2026-09-02 — Bounded local watchdog termination handoff
- Added a fixed five-second cleanup reserve inside the existing fifteen-minute
attempt ceiling for Windows process-tree termination and child
close. - A confirmed tree kill can now settle after a missing close handoff by destroying local pipes; late close events cannot settle twice.
- Retry requires positive termination confirmation. A stalled or unconfirmed
kill exits
124without starting an overlapping second attempt. - This is repository tooling only; public contracts and deployed behavior are unchanged.
2026-09-02 — OS Contract Request canonicalization gate
- Added a strict governance registry for byte-exact
OS-PLATFORM-XXXXrequests originating fromonesay-os; request snapshots remain proposal evidence and never become Platform authority by ingestion. - Enforced Code-Learning-First, Architecture Authority Review, canonical contract, runtime and exact Staging-readback stages without skip, rollback or implicit PASS transitions.
- Added deterministic generated conformance fixtures and fail-closed gates for temporary APIs, compatibility aliases, duplicate domains, rejected-symbol leakage and unauthorized external mutations.
- The registry is initially empty. No public contract, runtime, deployment, publication, DNS, Production or Legacy behavior changed.
- The combined Node suite now schedules files deterministically at concurrency 1 and passes 179/179; no assertion or acceptance requirement was removed.
2026-09-02 — E9 automated accessibility required-CI proof
- Sealed the private synthetic accessibility proof at exact head
6deac5c0220cdae818ddbba9565c32639bb3af44in required run33596362618on Ubuntu Gecko 153/WebKit 26.5 and Windows Gecko 153. - Proved all eleven resource views at 320 CSS pixels and 200% root text, exact
skip-link focus transfer, canonical 3-pixel focus indicators, 44-pixel minimum
targets, no root horizontal overflow and zero external requests. All engines
produced ARIA SHA-256
5ac82c97021b5ef10f2a1f25c9ba29649537c8f42eb8f37fe12201a8d6ada948. - Reproduced the current private 166,433-byte JavaScript archive at SHA-256
4033e241fa66075b78b984c37b92d0babd8f0ece7b32e59dc6a05a05497ade0fon both required runners. Nothing was published or deployed. - Manual screen-reader/browser-zoom acceptance, hosted preview, Staging,
community enablement and publication remain open or unauthorized; E9 remains
PARTIAL. - PR #77 merged the exact evidence head as
efda38d…; final PR run33598307565and merged-main run33599264913passed Ubuntu and Windows, followed by exact readback and local/remote branch cleanup.
2026-09-02 — E8 bounded reconnect and resume application candidate
- Added a five-attempt OneSay-owned reconnect loop with bounded jitter waits and a newly exchanged single-use Realtime ticket for every attempt; native WebSocket auto-reconnect remains disabled.
- Retain the opaque resume token only in bounded client memory, scrub it from application event callbacks, and keep authentication, grant, ticket-expiry and explicit resume rejection non-retryable.
- Apply
connection.resumedonly after exact SignalStream, sequence and sample cursor reconciliation, release only authoritative ACKed frames, replay the remaining caller-owned backlog and deduplicate terminal Artifact/Task callbacks. - This remains an unpublished local candidate. Required CI, real network, credentials, Staging, physical hardware and publication are not claimed.
2026-09-02 — E8 canonical Dictation event decoder candidate
- Added a fixed 96-token, depth-8 C JSON decoder that performs no dynamic allocation and maps the supported canonical Dictation server-event subset into the bounded ESP32 runtime.
- Enforced exact envelope fields, unique data fields, strict IDs and integer ranges, UTF-8/JSON unescaping, binding equality, contiguous event sequence and increasing Artifact revision.
- Directly reused MIT
jsmncommit25647e692c7906b96ffd2b05ca54c097948e879cas a tokenizer, with upstream and normalized vendored digests pinned. No parser, hardware or network behavior was inferred from the dependency. - Kept full connection/resume/room decoding, physical execution, Staging and component publication open or unauthorized.
2026-09-01 — E8 I2S and TLS/WebSocket required-CI proof
- Align the I2S adapter with ESP-IDF
v6.0.2's integer channel identifier and currentI2S_NUM_AUTOthroughI2S_NUM_2constants; remove the obsoletei2s_port_tandI2S_NUM_MAXassumptions from both source and host fakes. - Post-hardening required run
33524504934passed Ubuntu and Windows once without a watchdog rerun. Ubuntu compiled the exact managed WebSocket dependency and OneSay component for ESP32-S3; its 7,680,892-byte ELF SHA-256 is438ffabdf0c1c6e16ff3cc9bde6a74b756ab746c02d373e96d1108af8e3e005a. - Seal component hash
fcae4861dfd70361565d18fbe34525d859d1d26ffc4d2deb9ce95f36abb8f5c9and reproduce the same private 166,433-byte JavaScript archive on both runners. No hardware, external network, publication or Production claim is added.
2026-09-01 — E9 local Next.js runtime candidate
- Replaced the static-only E9 runtime placeholder with a private Next.js 16.3.3, React 19.2.8 and TypeScript 5.9.3 static-export application.
- All 13 canonical human routes plus
llms.txt,llms-full.txt, AI manifest and route manifest are rendered from the generated route authority. - CI performs two clean builds and requires every output byte to match; the local proof emits 86 files with no hosting or publication authority.
- Kept interactive Console/session behavior, manual accessibility, hosted preview, community enablement and publication explicitly open.
- Added
pnpm audit --prod --audit-level lowto local and required CI, then upgraded root spec tooling toajv@8.18.0andyaml@2.8.3to close the two Moderate registry advisories discovered during this work package.
2026-09-01 — E7 WebKit AudioWorklet required-CI proof
- Required Ubuntu job
99680882295of run33451076839passes Firefox 153 and WebKit 26.5 on Node 24.19.0 using the same canonical processor, SDK bridge and loopback-only harness. - Each engine proves 441 messages, 56,448 input samples, 18,816 output samples and 37,632 bytes with zero pending samples, external requests, microphone permissions or raw PCM persistence.
- Windows WebKit exposes no Web Audio API and is explicitly not claimed. Physical microphone, Staging and publication remain open.
- Final evidence head
fcdf455dpassed Ubuntu and Windows required CI; exact security scana0674a5a-7f01-4270-9f44-2939a01d9045completed 7/7 changed source items with zero findings and zero deferred items.
2026-09-01 — E7 Gecko AudioWorklet required-CI proof
- Pinned a repository-local Playwright Firefox/Gecko runner that uses deterministic offline rendering and the canonical AudioWorklet processor plus SDK bridge without depending on runner audio hardware.
- Added exact 441-message, sample/byte, continuous-resample and lifecycle validation in both required CI lanes.
- Required Ubuntu and Windows run
33446489484passed Firefox153.0with exact 441-message, 56,448-input-sample, 18,816-output-sample and 37,632-byte accounting. No microphone permission, user audio, raw PCM persistence or external request was involved. - Current-host execution remains
NOT EXECUTEDbecause Windows SideBySide event 33 blocks the isolated Firefox runtime. The later WebKit required-CI proof above supersedes the earlier open WebKit gate; physical microphone remainsNOT EXECUTED.
2026-09-01 — E7 controlled media browser proof
- Added a loopback-only browser harness that exercises
getUserMediawith a deterministic fake audio device and never reads ambient user audio. - Chrome 152 and Edge 152 each passed canonical AudioWorklet permission, lifecycle, sample/byte accounting, MediaStream teardown and content-derived 440 Hz fixture-signature checks without retaining raw PCM.
- Initial security review found one Low self-attestation gap; it was remediated
and final scan
041bc5bc-ee65-499e-83b4-36c958c50a27completed 10/10 reviews with zero findings and zero deferred items. - Physical microphone, Staging and npm publication acceptance remain explicitly open; Firefox/Gecko and WebKit are covered by the required-CI proofs above.
2026-09-01 — onesay-voice-key retirement internalization
- Record that
onesay-voice-keyand all known local clones were fully deleted and the project no longer exists. - Exclude it from canonical siblings, reuse provenance, M1 dependencies, backlog, sync/discovery and hardware acceptance prerequisites.
- Add a machine-readable tombstone and a fail-closed Docs gate so the name can appear only in explicit retirement evidence, never as a current project.
2026-09-01 — E7 actual-browser AudioWorklet candidate
- Added an actual
AudioWorkletProcessor, bounded stateful resampling and an application-owned browser capture controller withoutgetUserMedia. - The controller remains inert after
create()and connects only through single-flightstart(), including stop-during-resume and partial-connect fences.stop()invalidates retained handlers before guarded graph cleanup. - The local in-app browser passed a synthetic Web Audio execution with 441/441
messages delivered, exact 48 kHz to 16 kHz sample conversion, no PCM before
start or after stop and no
ScriptProcessorNodefallback. - Final security scan
141ffa1d-9915-4838-a4a4-ba29da2d1e1acompleted 16/16 reviews with zero findings and zero deferred items. - A later controlled fake-media Chrome/Edge proof exercises browser permission; physical microphone, cross-engine, Staging and publication remain explicitly unexecuted or unauthorized.
2026-09-01 — E7 JavaScript SDK reproducible package candidate
- Added a deterministic release-shaped
@onesay/sdk@0.0.0-e7-localpackage build with ESM JavaScript, declarations, README and Apache-2.0 license. - Fixed archive path order, uid/gid, mode, mtime and gzip metadata; CI compares two independent builds and pins both archive and full content-manifest digests on Ubuntu and Windows.
- The candidate remains private and non-publishable. No npm request or public namespace reservation is performed; actual-browser, Staging and publication acceptance remain open.
2026-08-30 — C5 Provider cost ingestion local candidate
- Added a durable, content-free Provider usage receipt fenced by the exact Task execution claim generation and immutable routing snapshot.
- Added exact replay/conflict and database immutability controls, with receipt persistence before Task terminal state.
- Added immutable claim-generation history so a durable preterminal receipt cannot block expired-claim recovery, and applied the same per-invocation arithmetic-safety ceiling in the canonical provider contract and database.
- Projected Provider cost as a separate internal, non-customer-billable
provider_cost_minorUsageEvent for completed and Provider-consumed failed Tasks while excluding Provider metadata from public readback. - Provider cost remains outside customer quota. Other access-plane producers, Staging, deployment and publication remain incomplete or unauthorized.
- Sealed security review found and remediated the arithmetic overflow path, immutable-claim recovery issue and a fail-open acceptance-evidence gate. The gate now requires exact final scan evidence. Final hardened review covers 23/23 source-like items with zero findings and zero deferred items.
2026-08-30 — C5 Quota action admission local candidate
- Bound
dictation.v1execution to one ProjectEnvironment-authoritativedictation_tasksreservation before Provider execution. - Added deterministic Task-scoped reservation and terminal correlation,
canonical non-retryable
quota_exceeded, and exact commit/release against the terminal Usage projection. - Added ordering, denial-before-Provider, replay, cross-scope and real PostgreSQL commit/release proofs. Provider cost, other access planes, Staging, deployment and publication remain incomplete or unauthorized.
- Added terminal-only recovery for committed/released reservation replay so an ambiguous settlement result cannot restart the Provider or strand the same Task retry; expired and conflicting replay remains fail closed.
2026-08-30 — C5 Quota reservation local candidate
- Added immutable versioned ProjectEnvironment quota-policy authority and a local reserve/commit/release/expire state machine.
- Added exact replay/conflict, explicit denial, revoke-immediate new admission, bounded expiry and 16-way no-over-admission proof.
- Commit links an existing UsageEvent and counts it once; customer quota and Provider cost remain separate. Runtime and schema controls reject settlement above the admitted reserved quantity.
- Public endpoints, other access-plane admission, deployment and publication remain unimplemented or unauthorized.
2026-08-30 — C4 capability/provider boundary candidate
- Replaced Task Core's direct provider adapter dependency with the canonical capability resolver and specialized streaming speech executor chain.
- Added fail-closed versioned credential resolution, deterministic health-aware routing and a durable content-free routing snapshot recorded before provider start.
- Added a synthetic SHA-256-only canary. Live provider, external secret manager and Staging execution remain unavailable or unexecuted.
2026-08-30 — C2 Control API parity candidate
- Added typed Service Principal Credential create/list/get/rotate/revoke with display-once secrets, encrypted idempotency and immediate invalidation.
- Added Capability and principal-filtered Action discovery generated from the canonical registries.
- Added a 52-operation handler parity gate plus unit, contract and PostgreSQL integration coverage. External deployment and Staging remain not executed.
2026-08-30 — C1 identity/auth matrix candidate
- Added a bounded exact-origin HTTPS JWKS resolver with rotation, expiry, redirect rejection and refresh-amplification protection.
- Bound the 13-case external-ready authorization fixture to the canonical Go policy authority and canonical failure reasons.
- Codex Security reviewed all four changed source surfaces with complete
coverage and zero findings; TAC remained an
unknown/no grantsadvisory. - Live ZITADEL/JWKS, deployed external matrix execution and Staging readback
remain
NOT EXECUTED; no external system was contacted or changed.
2026-08-30 — v1.3 Cognitive Foundation reset candidate
- Replaced the unpublished prior ownership/output model with Source, SignalPublication, SignalStream, TaskInput, ContextSnapshot and Artifact.
- Retained proven Audio sequence, duplicate, acknowledgement, backpressure, replay, resume and terminal-exactly-once behavior under the new boundaries.
- Added exact pre-release spec/schema reset gates and generated Go, TypeScript, JavaScript, ESP32 C and Docs projections with no compatibility aliases.
- Full database-backed local CI, Windows GCC/CGO race, required PR/main Ubuntu+Windows CI and merge lifecycle proof pass. TAC-dependent scanning, deployment, publication and all external-state actions remain explicitly unexecuted or unauthorized.
2026-08-29 — E5 durable Realtime application and cache replay candidate
- Bound Realtime Task create/cancel to the canonical Task application service and PostgreSQL idempotency authority with strict scoped replay validation.
- Unified Control API and Realtime create/cancel on atomic Task snapshot, receipt, metadata-only outbox, audit and terminal usage-decision facts.
- Added deterministic post-resume delivery of an unexpired cached
transcript.finalfollowed bytask.completed; expiry resumes metadata-only and neither successful nor ambiguous delivery extends the cache TTL. - Added real PostgreSQL and actual WebSocket Host coverage. Live Provider, external Staging, cloud, DNS, deployment, publication and Production remain incomplete, not executed or not authorized.
- Added current active Grant row locking for Service/Device Task create/cancel, with immediate revoke denial and same-key regrant retry tests. The initial Low/P3 CWE-863 result is remediated and the post-remediation Codex Security scan closed all 18 reviewed source files with zero findings.
2026-08-29 — E5 Realtime Task wiring candidate
- Connected canonical Dictation Task create, PCM input, finish and cancel to the Realtime Gateway through a provider-neutral typed application boundary.
- Added Track-owned Task grants, acceptance-before-ACK, validated canonical partial/final/terminal delivery and metadata-only resume bindings.
- Added a Project/Environment/Task-scoped Redis final-text cache with immutable content, exact replay, no TTL extension and a ten-minute maximum lifetime.
- Added pre-side-effect Track fencing plus global and Project/Environment Task, PCM and frame admission; idle/absolute expiry and terminal paths zeroize and delete buffered state, while transient executor PCM is cleared on return.
- Remediated both Medium/P2 findings from the initial 21-surface security scan; post-remediation review closed all 21 surfaces with zero findings.
- Proved the adapter against the real canonical Task pipeline and a disposable Redis instance; durable application wiring, cache-backed resumed delivery, live Provider and external Staging remain incomplete or not executed.
2026-08-29 — E5 Task and Provider local runtime candidate
- Added a Platform-owned Dictation Task state machine with monotonic partial revisions, absorbing terminal results and exactly-one usage decision.
- Added the provider-neutral Go contract and deterministic no-PCM-retention adapter with canonical partial/final/usage events and safe error mapping.
- Added synthetic E2E, content-boundary and 32-way terminal race proofs.
- Kept PostgreSQL outbox, Realtime wiring, live Provider, Staging, deployment, publication, Production and all Legacy behavior unimplemented or unchanged.
2026-08-29 — E5 Task PostgreSQL snapshot/outbox candidate
- Added expand-only schema 9 and an atomic PostgreSQL Task runtime repository.
- Persisted typed metadata-only snapshots, source-event receipts and outbox events with one terminal usage handoff and no transcript or PCM fields.
- Proved cross-replica replay/conflict, crash retry, 32-way terminal exactly-once, delivery replay and prior-application compatibility locally.
- Fenced provider execution with a durable hashed-owner lease and generation; concurrent replicas start one provider, and ambiguous recovery never starts another provider invocation.
- Kept Realtime, live Provider, Staging, deployment, publication, Production and all Legacy behavior unimplemented or unchanged.
2026-08-29 — E3 Usage and Developer Log read candidate
- Added typed, Project/Environment-scoped Usage summary/event and Developer Log list/timeline reads backed by one repeatable-read PostgreSQL authority.
- Added immutable UsageEvent, reversal, attribution, reservation/aggregate/ outbox scaffolding, append-only Developer Logs and separate internal traces.
- Enforced a closed Developer Log safe-field projection at OpenAPI, Go and database boundaries, including value types, bounds and restricted diagnostic characters.
- Bound reversal, quota-commit, principal attribution and Task-to-Room edges at the PostgreSQL authority after two pre-remediation Low/P3 Codex Security findings; added exact negative and legitimate-path regression proof.
- Kept reservation/commit/release producers, outbox/aggregate workers, Console dogfood and all external acceptance unimplemented or not executed. The API remains local, draft and unpublished.
2026-08-29 — E3 migration compatibility and Console dogfood candidate
- Added explicit application/schema compatibility groups and a fail-closed startup sequence without adding destructive down migrations.
- Proved exact prior application revision
6ccad6652…and its complete Control Handler PostgreSQL suite remain valid on schema v8 across five fresh databases. - Added the private canonical Console Public API client with fixed authorities, cookie omission, browser credential fencing and exact operation policies.
- Kept the Next.js UI, Staging, deployment, DNS, publication, Production and Legacy boundaries unexecuted or unauthorized.
2026-08-28 — Identity serializable retry hardening
- Expanded the bounded PostgreSQL identity transaction retry budget for recognized serialization and deadlock conflicts from 30ms to 635ms.
- Preserved fail-closed handling for all other database errors and immediate canonical reread after a competing identity insert wins its unique key.
- This is a Platform-only CI/runtime hardening change; no external or Legacy environment is modified.
2026-08-28 — E3 Task metadata lifecycle candidate
- Added typed Task create/list/get/cancel operations for one-Track dictation.
- Bound Task Project/Environment/Room/Track ownership with composite database constraints and fail-closed exact grants.
- Added atomic absorbing cancel, audit/idempotency replay and bounded config/ locale metadata without Provider, raw audio or Transcript content.
- Hardened the Device lifecycle integration fixture to exercise the documented same-idempotency-key retry path only for a server-declared retryable failure.
- Kept Realtime execution, Provider/Transcript processing, Usage and all external acceptance unimplemented.
2026-08-28 — E3 Room lifecycle candidate
- Added typed Room create/list/get/close and Room-scoped Participant/Track list operations with exact Project/Environment authority.
- Added one-participant and TTL bounds, fail-closed Live behavior, atomic close terminalization, audit and exact cross-replica idempotent replay.
- Added expand-only Room/Participant/Publication/Track persistence with composite ownership foreign keys that reject cross-Room child graphs.
- Kept the API local and unpublished; Task, Usage, Logs and external acceptance remain incomplete.
2026-08-28 — E3 Device lifecycle candidate
- Added all eight typed Device operations with PostgreSQL-backed lifecycle, exact ownership and Environment fences, and atomic audit/idempotency commits.
- Added a generated Device grant ceiling plus nonhuman actor subset checks.
- Protected display-once provisioning and credential responses with AES-256-GCM idempotency storage; stored secrets remain HMAC digests.
- Added immediate reprovision/rotate/revoke behavior and linked Application-to-Device invalidation.
- Kept the API local and unpublished; Room, Task, Usage, Logs and external acceptance remain incomplete.
2026-08-28 — E3 Organization lifecycle candidate
- Added exact safe Current User (including memberships and accessible Projects), Organization create/list/detail/update and Organization Membership list/create contracts. Current User embeds at most 100 Memberships and 100 Projects and reports explicit truncation flags.
- Added centralized owner/developer/viewer Grant templates, PostgreSQL keyset reads, serializable mutations and response-aware atomic audit/idempotency commits.
- Added an expand-only Organization audit scope migration and five repeated disposable PostgreSQL proofs for cross-replica replay, isolation, developer Project creation and over-limit Current User behavior.
- Replaced per-Project Environment reads with one bounded set-based query after a Low/P3 CWE-400 security-diff finding.
- Kept the API local and unpublished; remaining E3 resource families and all external gates remain incomplete.
2026-08-28 — E3 Project lifecycle candidate
- Added exact Project list, detail, update, archive and Environment-list contracts from the same canonical OpenAPI source.
- Added owner-scoped repeatable reads and serializable update/archive services; every mutation commits its audit and replay result atomically.
- Added soft archive semantics that preserve facts while deleting/disabling the Project and its test/live Environments at the resource-state layer.
- Kept the API local and unpublished; the other E3 resource families and all external gates remain incomplete.
2026-08-28 — E3 atomic Project commit candidate
- Added a response-aware Project application service that commits Project, test/live Environments, allow audit and exact idempotent HTTP result in one serializable PostgreSQL transaction.
- Made both memory and PostgreSQL completion idempotent only for an exact stored response, so post-commit readback cannot rewrite or diverge from wire bytes.
- Added unit and real PostgreSQL proofs for commit ordering, byte-identical cross-replica replay and rollback without leaked domain/audit rows.
- Kept the API local and unpublished; remaining E3 CRUD and all external gates remain incomplete.
2026-08-28 — E3 HTTP kernel candidate
- Added generated Go metadata for all canonical Control API route policies and Error Envelope definitions.
- Added the local fail-closed Control API kernel with request IDs, policy hooks, bounded JSON, deterministic in-process idempotency and encrypted opaque cursors.
- Kept every public operation draft and unpublished. Domain handlers, durable idempotency, deployment and public availability are not part of this entry.
2026-08-28 — E3 durable Project creation candidate
- Added exact canonical schemas and a local HTTP binding for Project creation.
- Reused the E2 membership, serializable Project/test/live and append-only audit authority behind the handler.
- Added hashed PostgreSQL idempotency with cross-replica replay, conflict, abort, lease takeover and fencing semantics.
- Kept the API unpublished; remaining resource handlers and all external-state acceptance are still incomplete.
2026-09-03 — Empty-repository JavaScript Quickstart local proof
- Added an executable local JavaScript Quickstart that installs the private SDK candidate plus pinned WebSocket transport into a fresh repository and runs canonical dictation against an ephemeral loopback fixture.
- The proof persists no PCM, transcript, ticket or user content and makes no external request. Staging, hosting and public package publication remain unexecuted or unauthorized.
Data Sync independent writer/recovery boundary controller — 2026-09-24
Added a concrete DurableBoundary over an external durable authority port.
Writes now bind generation, object key and content digest before OSS I/O and
persist committed, rejected or unknown outcomes; an unknown result or missing
settlement keeps recovery closed. Recovery cuts bind writer fence, in-flight
drain, storage evidence and distinct normal/recovery principal digests. The OSS
adapter now uses separate writer and recovery clients, and recovery checkpoints
preserve the new evidence. Cross-instance Go race tests pass. The authority
adapter, real credential revocation/drain and OSS provider behavior remain
NOT-RUN — requires authorized Staging environment, so W05 remains 5/6 (83%).
2026-09-24 — Immutable Room service identity
Room creation now accepts service_kind=task_voice|rtc. The task default keeps
its existing single-participant and Consent semantics; RTC permits 1 through
100 participants. Generated Go/TS/C contracts bind the service and capacity.
Migration 77 preserves old rows and prevents changing a Room's service type.
Task WSS issue/resume and Gateway admission reject RTC Rooms. RTC connections,
media and Agents remain unavailable pending their implementation and validation.
2026-09-24 — Neutral Room contract correction (unpublished)
Room creation and resources no longer use service_kind to choose task voice
or RTC. Both services retain separate operations and credentials on a neutral
logical Room; capacity is shared, RTC quota attribution follows RTC bindings.
Obsolete selectors are rejected rather than aliased. Generated contracts follow
the canonical schema. Local validation is in progress; see ADR-059 and the active
M1 ledger for evidence and remaining gates. No SDK or cloud readiness is implied.
2026-09-25 — LiveKit upstream-native architecture amendment
- Adopt the full-stack authority, exact component-role mapping, candidate matrix, bounded read-only checker and existing PRE-PACKET qualification requirements.
- Isolate JavaScript RTC native operations behind one private adapter and version signed participant observations before durable business projection.
- Add the mandatory self-contained architecture review and preserve original failure/source-bound test evidence. No product-completeness, Staging, device or Production claim; continue the existing GX03 sequence.
M1 v3 GX15 terminal runtime local qualification — 2026-09-27
Bound the current codex/m1-v3-execution source at 3c014b542484ddedf03aa4f29d3c0239e7223975 and qualified the existing Task terminal, receipt replay, late-input fencing, bounded recovery and Usage settlement paths with 278 pass / 0 fail / 2 required skip under offline race tests. The two PostgreSQL-backed application tests remain required skips without ONESAY_TEST_POSTGRES_DSN; durable Artifact/receipt/outbox integration, Provider canary, Staging, Production, cloud and hardware remain unqualified. No architecture boundary or LiveKit patch surface changed. Source-bound terminal evidence (../development/evidence/m1-v3-gx15-terminal-runtime-3c014b54.json).
JavaScript Quickstart offline installation — 2026-09-28
The isolated Quickstart installer now supplies the SDK's complete pinned dependency closure from local archives, including required peers. A new empty store no longer relies on an already warmed LiveKit cache. Package lifecycle scripts remain disabled, product pins are unchanged, and missing or conflicting local lock inputs fail closed. This does not publish a package or qualify cloud execution.
Installed Task/Usage qualification mode — 2026-09-28
The local Task/Usage fixture can select an independently installed OneSay candidate. Installed files, package provenance and cleanup are verified before and after execution; invalid or missing installed inputs fail without falling back to a source build. The default source SDK fixture remains available. This changes qualification tooling only, not a public SDK API or Task protocol.
2026-09-28 — GX17 package/recovery boundary qualification
Closed the remaining local GX17 package and recovery boundary weights with exact-source static evidence at cc2aedaec696979bfb70f7eb3a9c912ca2e33a2b. The package boundary preserves the private, nonpublishable Control-backed Task product surface and excludes native/RTC exports; the recovery boundary preserves one checkpoint owner, scope-fenced resume/replay, bounded audio overflow and single-use connection material. No runtime or upstream patch surface changed.
2026-09-29 - GX18 target build diagnostics
Recorded the task-only ESP32-S3 OEM build with cached local dependency resolution and the separate original-project offline git-fetch failure. No joint Task/RTC, hardware, live Provider or cloud qualification and no progress credit is claimed.
The pinned IDF build runner now skips optional update probes, verifies complete
managed-source checksums, uses the bounded watchdog and preserves raw logs.
A TLS12-only --oem mode builds the original OEM project with its exact Git lock.
No SDK runtime, LiveKit patch or progress denominator changed.
2026-09-29 — GX18 C cancellation and pinned target qualification
Verified the repaired original OEM build at exact source 30a307c7. Added real C regressions for late partial/final/completed results after cancellation with unacknowledged audio, legal positive controls and explicit zeroized release. Existing runtime semantics remain unchanged; native backend, joint RTC and hardware qualification stay separate.
2026-09-29 — Task PCM and result ownership
Clarified the existing ESP32 Task caller/SDK buffer and transport lifetimes. Added C tests for admitted PCM copy after send failure, exact replay, ACK erasure, bounded result dispatch and independent caller result copies. Runtime and ABI remain unchanged; real backend and hardware qualification stay separate.
2026-09-29 — Native Task integration readback
Recorded 152 actual local native Task integration cases at exact source713b5143, including both TLS profiles and native HTTP/JS Control paths. Updated stale SDK qualification wording and retained explicit Provider, hardware, joint-build and cloud limits. Application result callback observation remains a separate gap.
2026-09-29 — Native Task application callback proof
The private C peer now observes actual SDK result callbacks after queue delivery, retains bounded caller copies and proves their explicit release. The native runner verifies partial/final and cancelled paths across both TLS and Control profiles. SDK and runtime behavior remain unchanged.
2026-09-29 — ESP32 Task SDK delivery
Added a consolidated Task SDK integration and qualification guide covering borrowed/copied buffers, application result callbacks, sample/UTC clocks and resource release. Recovered and verified the existing source-bound build and native evidence assets; no native test rerun or runtime change is claimed. The scoped core/port delivery milestones are complete. Joint Task+RTC build, OEM example, RTC media, real Provider, hardware and cloud qualification remain separate; the next execution cursor is GX18.build.
2026-09-29 — Task-private native dependency isolation
Moved the existing Task native dependency adaptations into five private targets with a verified complete symbol namespace, preserving shared upstream targets and the single IDF PSA startup. Requalified both target TLS configurations, both native TLS profiles and the 152-case local Task regression; affected Node and real Linux ELF build-tool tests also passed. Public Task behavior is unchanged. GX18.build remains open with no progress credit: joint LiveKit/IDF crypto compatibility is separately unresolved, and no replacement candidate is activated.
The source-packaging supplement records two build files normalized to LF, fresh scoped Node/ELF checks and unchanged original native qualification bytes. Eight explicitly attributed historical empty stderr logs retain the existing raw-evidence format exemption without editing their bytes or weakening source and prose checks. No target/native rerun or progress credit follows.
2026-09-29 — Exploratory joint audio build evidence
Archived an audio-only ESP32-S3 candidate compile/link with real Task and
LiveKit symbols, bound to ea622336 plus explicit scratch overlays. The current
5cf1308b Task-private product implementation is a separate source checkpoint.
Original joint/video failures and offline second-configure failure remain
preserved. No product pins or configuration changed, no runtime qualification
is claimed, and no progress credit is added. Existing GX18.build work continues
with canonical Component Manager configuration and current-product integration.
Source-bound candidate evidence (../development/evidence/m1-v3-gx18-joint-audio-candidate-ea622336/index.json).
2026-09-29 — ESP-IDF WebSocket dependency identity checks
The target build checker supports both observed short and canonical dependency names while retaining the exact upstream Git pin. It rejects duplicate aliases, substituted sources and lock/build path mismatches. Forty-two affected tests and real configuration readback passed. SDK behavior, pins and CLI defaults are unchanged; this does not qualify the pending joint RTC product build.
2026-09-29 — Conditional ESP32 Task / RTC component builds
The local OneSay component owns conditional RTC dependencies, an explicit audio/security profile and resolved-configuration rejection checks. Task-only and the internal RTC audio candidate both compile/link in independent consumers; private Task native adaptations leave the upstream targets intact. Fresh selected Linux Task TLS12/TLS13 regression also passes after canonical dependency identity support. Evidence and scope (../development/ESP32_TASK_NATIVE_ISOLATION.md). GX18.build closes its local build scope; RTC API/runtime, candidate promotion, hardware and cloud acceptance remain separate and unclaimed.
2026-09-29 — Independent ESP32 OEM Task example
The standalone Task example now uses public Control and typed room/task WebSocket operations, bounded PCM/result ownership and explicit cleanup. A local-component exporter removes repository-private paths. Actual ESP32-S3 compilation and Linux native normal/cancel/network-failure checks passed; physical hardware and cloud qualification remain open. Evidence and integration (../development/ESP32_OEM_TASK_EXAMPLE.md).
2026-09-29 — Local Task / Python composition qualification
- Added a fixture-only installed OneSay SDK → actual Python worker → durable Artifact/Usage regression, with process reaping and no-fallback observations.
- Preserved default fixture behavior and external qualification boundaries; see local scope (
../development/TASK_END_TO_END_LOCAL_QUALIFICATION.md).
2026-09-29 — Task Python cancellation and socket recovery qualification
- Verified the actual installed SDK and existing Python worker across cancellation/resume, lost ACK and replay of one omitted frame with durable single-result/Usage checks.
- Retained the normal 80 ms regression and explicit synthetic Provider, WS/WSS and external-qualification boundaries; see local qualification (
../development/TASK_END_TO_END_LOCAL_QUALIFICATION.md).
2026-09-29 — Task cancelled-cost concurrency qualification
- Connected an existing Provider-receipt/cancel lock-order test to the actual Usage projection and settlement services, proving internal cost retention, zero customer billing and concurrent replay uniqueness.
- Reused existing terminal/fee regressions with explicit PostgreSQL versus memory evidence boundaries; see qualification (
../development/TASK_TERMINAL_COST_CONCURRENCY.md).
2026-09-29 — Private Task HTTPS process entrypoint
- Added
cmd/task-workeraround the existing authenticated Task runtime, with bounded explicit configuration and existing joined shutdown. - Qualified the actual Linux pre-Provider lifecycle, TLS/service authority, canonical Consent cancellation and durable zero-billing result.
- Documented exact private credential projection and static route enablement limits in the command contract (
../development/TASK_WORKER_COMMAND.md); complete stack and external gates remain open.
2026-09-29 — Actual five-process Task qualification
- Exercised public Control/Consent and WSS against the actual Task HTTPS executable, alongside real maintenance and Usage work.
- Preserved the existing synthetic-Task regression and explicit no-PCM/Provider/cloud limits in local qualification (
../development/TASK_FIVE_PROCESS_LOCAL_QUALIFICATION.md).
GX11 packaged Task image local qualification - 2026-09-29
The Task image now has a source-bound local qualification using the pinned
Python 3.14.7 base, packaged static Linux binaries and the private stdin
entrypoint. The final image passed 14 Python launcher tests and 24 Go events,
including five-process lifecycle, manifest rejection, malformed configuration,
SIGTERM join and cleanup. The run stayed non-root with a read-only root and
/tmp:noexec; the qualification harness used a separate disposable exec
tmpfs. Provider, RTC/Agents, cloud, Staging, Production and hardware remain
NOT-RUN. This prerequisite adds zero M1 v3 credit. Evidence (../development/evidence/m1-v3-gx11-task-image-3fc9c64b/).
GX11 local network contract qualification - 2026-09-29
Added a read-only source-bound audit for the canonical LiveKit lock/matrix and
local deployment boundary. The isolated loopback fixture, digest-pinned images,
two authenticated Redis processes, owned cleanup and focused 13-case test set
all passed. GX11.network receives 9.6/12 local points; DNS/TLS/UDP/TURN,
Staging, Production and hardware remain NOT-RUN. Evidence (../development/evidence/m1-v3-gx11-network-cdf7be03/index.json).
GX11.data current-source migration and recovery qualification - 2026-09-29
The current migration receipt validates 108 ordered migrations, generated
artifacts and 31 migration contract tests. Owned PostgreSQL 17.6 durable-state
and recovery-reconciliation profiles passed and cleaned up. Historical backup
receipts remain source-bound and are not rebound; cloud backup inventory, PITR,
OSS/KMS fencing, Staging, Production and hardware remain NOT-RUN. Evidence (../development/evidence/m1-v3-gx11-data-50e3624b/index.json).
2026-09-29
- GX12 local security/metrics qualification is now recorded against source
6ee2869b2420c8f37603aa9eb7497d737be16b99. Security contracts pass 35/0/0; bounded observations retain HTTP 5/0/0, rate 20/1/0, WebSocket 10/1/0 and auth/revocation 10/1/0. Stale source-bound dispatch guards remain explicit failures, so no full CCR-B or cloud qualification is claimed. Ledger progress is 551.7/1200 = 45.9%; see
docs/development/GX12_SECURITY_METRICS_LOCAL_QUALIFICATION.md.
2026-09-29
- GX13.external now records a current-source local handoff packet check.
E10 BOM, execution-readiness and specification checks pass; modeled cost is
USD 30.6 with pending quotes/readbacks/decisions,
purchase_authorized=falseand zero cloud validations. CCR readiness remains fail-closed on stale historical source digests; no external qualification is claimed. Ledger is 556.1/1200 = 46.3%. Seedocs/development/GX13_EXTERNAL_LOCAL_QUALIFICATION.md.
2026-09-29
- GX13.runbook now records the local deployment, rollback, service maintenance,
fault-evidence and external handoff procedure using existing pinned assets.
Candidate replay and all cloud/Staging/Production/Provider/hardware gates
remain
NOT-RUN; no deployment mutation was attempted. Ledger progress is 558.85/1200 = 46.5%. Seedocs/development/GX13_DEPLOYMENT_RUNBOOK.md.
2026-09-29
- GX13.replay now records current-source bounded Linux stack readiness and
official native two-node foundation evidence. The full candidate
install/upgrade/drain/rollback replay and OneSay admission/media,
Provider/Agent, cloud and hardware gates remain
NOT-RUN. Ledger progress is 565.45/1200 = 47.1%. See
docs/development/GX13_REPLAY_LOCAL_QUALIFICATION.md.
2026-09-29
- GX14.candidate now records an exact clean source/content snapshot bound to
0d8b6652fd78cffe61307411f2c5dd9265cf4bd3: 10,900 tracked paths, 10,900 content hashes, docs/secrets/authority/diff/spec checks PASS and no raw-audio pattern. GX13 complete candidate replay, GX14 gates and all external gates remainNOT-RUN; Ledger progress is 568.75/1200 = 47.3%. Seedocs/development/GX14_CANDIDATE_LOCAL_SNAPSHOT.md.
2026-09-29
- GX11.stack now has a source-bound single-host non-HA profile and fail-closed
checker covering the five Task commands, Platform LiveKit policy host,
PostgreSQL and two isolated Redis roles. Public traffic and external networks
remain disabled; Agents and Provider are explicit
NOT-RUN. The profile receipt adds 8.25/15 local boundary and implementation-build points, moving Ledger progress to 577.0/1200 = 48.0%. Seedocs/development/GX11_STACK_LOCAL_PROFILE.md.
2026-09-30
- ESP32 offline tracking now rejects SDK dependencies that diverge from the canonical LiveKit pin, private visibility or RTC condition, including source overrides and mixed-case aliases. Dependency pins are unchanged.
- Added durable RTC effectiveness worker replacement regression and corrected
healthy-history test heartbeat ordering before immutable cohort capture.
Final local race suite: 23 pass, zero failure/skip. No production timing or
native patch change; cloud/hardware qualification is not claimed. See
evidence (
../development/evidence/m1-v3-local-recovery-pin-binding-24c1ba90/).
- Repaired the historical evidence storage/format mismatch while preserving
original digests and authentic empty command outputs. The full format gate
and five targeted regressions pass; runtime/source qualification is unchanged.
Proof (
../development/evidence/m1-v3-historical-bytes-c93a0fd4/repair.json).
2026-09-30 — Explicit ContextSnapshot public delivery
- Added immutable scoped ContextSnapshot create/read operations, closed bounded input, server-derived ownership and atomic encrypted idempotency completion.
- Unified current read authority for direct reads, private replay and typed Task inputs, including Human explicit denies and nonhuman partial resource denies.
- Preserved historical item JSON and null unknown event times; documented shared HTTP structural limits and regenerated canonical consumers.
- Local selected checks: 126 context race events, 201 HTTP events, 19 Node tests,
all zero failure/skip; TypeScript SDK compilation passes. Historical failed
attempts and exact source bindings are preserved in
evidence (
../development/evidence/m1-v3-context-snapshot-public-8e67b34a/index.json). Provider semantic consumption, terminal composition, full CI and external qualification remain separate. Guide (../guides/CONTEXT_SNAPSHOTS.md).
2026-09-30 — Context-bound cancellation composition evidence
Added one real PostgreSQL integration scenario joining public context/Task
creation, existing deterministic Provider PCM, public cancellation/replay,
late-input and replacement-worker absorption, and durable Usage release replay.
Linux race: 2 pass events (parent + one subtest), zero failure/skip; owned cleanup
verified. No production behavior or new progress credit.
Source-bound evidence (../development/evidence/m1-v3-context-pipeline-d3a6b005/index.json).
The context guide now explicitly distinguishes durable binding from unfinished
Provider content projection. Full CI and external qualification remain separate.
2026-09-30 — Exact local stack role/configuration mapping
Replaced the unusable common private config reference with explicit Task,
native-policy, PostgreSQL and Redis launch/file bindings. Existing profile
validation now consumes the same mapping and rejects unsafe role/source/env
substitution. Binding/upgrade regression: 45 pass, zero fail/skip; no service
startup or new progress credit claimed.
Runbook (../development/GX11_STACK_LOCAL_PROFILE.md) and
source-bound evidence (../development/evidence/m1-v3-stack-private-bindings-9362a6cd/index.json).
2026-09-30 — Real Linux private files and enabled stack startup
Added strict Linux private-file checks and reused existing Control/Task/native
fixtures for actual nine-container startup and normal shutdown. File tests:
23 pass, zero fail/skip. One actual stack fixture verified all nine normal
exit-zero stops and durable native consumer close; owned cleanup left no
containers or volumes. Earlier failed attempts remain archived. Scope excludes
full Task/RTC, continuous revocation, Agents/Provider, upgrade and external gates.
Runbook (../development/GX11_STACK_LOCAL_PROFILE.md) and
source-bound evidence (../development/evidence/m1-v3-stack-owned-runtime-f98e7c23/index.json).
2026-09-30 — Fixed two-native-node local stack
Added a narrow overlay reusing the singlehost launch bindings and file checker.
Ten actual containers passed startup and normal shutdown; two independent
native consumer lifetimes and the surviving node's fresh reporting were read
back from the actual Control/PG authority. All thirteen private files remained
unchanged and no owned container/volume remained. Static mapping: 67 pass;
Linux file checks: 30 pass; actual fixture: one pass, all zero fail/skip.
Empty-node drain only; full upgrade, active-participant/media, Provider and
external qualification remain open. Runbook (../development/GX11_STACK_LOCAL_PROFILE.md)
and exact receipts (../development/evidence/m1-v3-stack-twonode-runtime-8e808251/index.json).
2026-09-30 — Scoped active-participant native drain
Added test-only graceful-signal observation and a real two-native-process fixture.
The original A participant remains ACTIVE during upstream drain; A exits normally
after voluntary departure while B preserves its original ACTIVE SID and signed
fresh reporting. Exact participant terminal outcomes and owned cleanup were read
back. Four roots plus three ActiveLease cases passed (7/0/0); the deliberate
receiver-outage case retains its required native exit-1 negative-control result.
The actual authority-child lane and isolated export/processing lane stay separate.
Both earlier failed attempts are preserved; the Consent setup ordering correction
does not claim a production concurrency fix or a proven SQLSTATE.
No production runtime or LiveKit patch change. No new progress credit; complete
stack integration, restart/upgrade/rollback, media, Provider and external gates
remain open. Drain runbook (../development/GX11_UPGRADE_LOCAL_CONTRACT.md) and
exact receipts (../development/evidence/m1-v3-stack-active-drain-d04e854e/index.json).
2026-09-30 — Native restart and forward-source rollback fixture
Added a real Linux two-artifact, four-process native lifecycle test with existing
public admission, official SDK, persistent authority and unchanged migration ledger.
Original revoked material remains denied after rollback. Initial test quota is
selected at creation; immutable policies remain enforced. All three failed
attempts are retained. Intermittent rollback admission HTTP 500 remains OPEN;
the diagnostic PASS does not establish its cause or a fix. Scoped test passed
1/0/0; clean committed replay is pending.
No runtime/upstream patch changes, complete profile claim or new progress credit.
Scope and evidence (../development/GX11_UPGRADE_LOCAL_CONTRACT.md).
2026-09-30 — Clean source native replay 340b425b
Fresh Linux builds and actual runtime tests against clean committed source
340b425bd316b3d8b3d7295729ba4b9e909eff5a passed the scoped four-phase native test (1/0/0)
and default fixture regressions (2/0/0). Five preflight checks passed. No runtime
changes or new progress credit. Historical intermittent admission HTTP 500
remains OPEN; complete profile and external gates remain unqualified.
Exact-source receipt (../development/evidence/m1-v3-native-upgrade-clean-340b425b/index.json).
2026-09-30 — Native admission diagnostic observations 3100c2f6
Transparent test-only wrappers preserve existing service, transaction and HTTP
cache ownership; unit tests passed 6/0/0 and default native regressions 2/0/0.
Five predeclared lifecycle samples produced 3 PASS and 2 FAIL, observing
prepare_create/sqlstate_40001 and atomic_commit/sqlstate_40001. Two forced cleanup
failures remain explicit with zero residual resources. No production fix, HTTP
retry or progress credit; the prior unclassified HTTP 500 remains OPEN/UNPROVEN.
Exact diagnostic evidence (../development/evidence/m1-v3-native-upgrade-diagnostics-3100c2f6/index.json).
2026-09-30 — RTC HTTP serialization recovery regression
Added six real PostgreSQL conflict/recovery cases at preparation and atomic
completion. Failed transactions leave no RTC business/protected-cache facts;
one explicit same-key request rereads current Grant/Consent. All 13 named tests
passed including diagnostic regressions. No runtime behavior or progress changes;
original native failures remain open.
Exact receipt (../development/evidence/m1-v3-rtc-serialization-recovery-7e6f7790/index.json).
2026-09-30 — Actual Control mutation lifecycle regression
Added a Linux process test for public Project mutation, normal stop, refused
mutation with no durable effects, same-config restart and exact idempotency replay.
The process root and existing manifest/ELF guards pass 20/0/0. Original production
artifacts and source provenance remain unchanged after full non-test input equality.
No production behavior or progress changes; native failures and historical 500
remain open. Exact receipt (../development/evidence/m1-v3-control-mutation-restart-69676367/index.json).
2026-09-30 — RTC deployment constructor configuration
Added explicit trusted deployment scope, private management and independent client
signaling configuration by composing the existing RTC scope, official management
client and protected cache owners. The restricted local constructor delegates to
this shared composition. Constructor and adapter unit checks pass 29/0/0; the first
protocol-fixture failure remains preserved. Actual Control RTC bootstrap, durable
Room preparation and hosted worker are still pending. No upstream patch or added
progress credit. Exact receipt (../development/evidence/m1-v3-rtc-deployment-config-805f2dd1/index.json).
2026-09-30 — Explicit Control RTC configuration
Added strict rtc_connections disabled/singleton configuration and connected one
existing RTC owner to actual Control handlers, authorizer and protected replay.
Private policy/environment/cluster checks remain required; an optional observer
uses matching native credentials. Existing private JSON producers must include
rtc_connections: [] to retain disabled behavior. Fresh local checks: 155 unit and 25
actual-command named PASS (180/0/0 total). This is negative HTTP/configuration
qualification; durable first-Room preparation and Room worker remain pending.
No native positive path, public deployment or old failure repair is claimed.
No added credit. Exact receipt (../development/evidence/m1-v3-control-rtc-binding-cd6dfa58/index.json).
2026-09-30 — Hosted durable Room worker
Composed the existing Room worker as a fixed fifth lane in the RTC authority
command, retaining the original four-lane order and six-second per-turn cap.
Added fixed content-free counters and deadline/cancellation/fairness tests.
Fresh local units56 plus actual-host2 pass58/0/0, including real native Room API,
normal restart and authorized repository close of fixture-created durable intent.
Public HTTP close is not qualified. Public first-Room intent/admission and whole-profile
integration remain pending; nativejoin/cloud are NOT-RUN. Prior native failures
remain preserved; no added progress credit.
Exact receipt (../development/evidence/m1-v3-rtc-room-host-9deb87ae/index.json).
2026-09-30 — First RTC Room durable preparation
Added bounded preparation to existing fresh RTC create execution after current
authority and pending idempotency ownership. Worker readiness enables a new
fully authorized admission; preparation cannot consume Device Consent or create
a success response, connection or quota reservation. Local selected validation: 81/0/0.
Human actual-worker and signed Device in-process worker evidence remain distinct;
synthetic storage completion is storage-only. Deployed Control positive path,
full profile and nativejoin/cloud remain pending. Historical native failures and
zero progress delta are preserved.
Exact receipt (../development/evidence/m1-v3-rtc-room-preparation-62d901ea/index.json).
2026-09-30 — Actual Control RTC and ordinary-user Usage attribution
Fixed real API Usage attribution for authorized ordinary Application Humans without target organization membership using exact historical Grant and registered-client interval evidence. Added a real Control TLS/OIDC journey through public AppSession/Consent, cold409 Room intent, actual worker readiness, same-key201/encrypted replay and revoked original Grant denial. Selected Linux qualification: 76 PASS, zero FAIL/SKIP, including 46 Usage regressions and three migration checks; all 6 original failures remain separately preserved, including mandatory Control shutdown failure corrected only in the test lifecycle. Native join/media, complete-profile and cloud acceptance remain pending. Historical native five-sample FAIL and unclassified500 remain OPEN.
Exact receipt (../development/evidence/m1-v3-control-rtc-positive-b49e8b61/index.json).
2026-09-30 — Scoped native lifecycle diagnostic qualification
Added test-only upstream pgx SQL-stage tracing and phase-local Room intents processed
by the actual authority child. Parent11a3b9ef plus four exact test files passed four
diagnostic tests and five native lifecycle samples, each with four phases: 9 named
PASS, zero FAIL/SKIP, normal dependency stops and zero owned residuals. Earlier unit
and failed native attempts remain separate; the original eight-second shutdown
failure and historical40001/unclassified500 risks are not resolved by this PASS.
No production fix, retry, native patch, full-profile/cloud qualification or progress
credit is claimed.
Exact receipt (../development/evidence/m1-v3-native-sqlstage-11a3b9ef/index.json).
2026-09-30 — Actual Control/native signal admission
Added real Control-to-native integration using the original public JWT, actual
Room authority worker, official participant readback and exact identity/Consent/
quota audits. Selected local Linux tests passed27/0/0 with normal service stops
and zero owned residuals. The native ELF has explicit current source-equivalence
provenance. Only tests changed; full ten-role business integration, media and
external qualification remain open. No progress credit or historical-failure
resolution is claimed.
Exact receipt (../development/evidence/m1-v3-control-native-41660f66/index.json).
2026-09-30 — Ten-role profile Task/RTC business qualification
The actual enabled profile now covers public Task cancellation and RTC signal
admission using the same final Control, Room and Environment, with separate Task
owner and ordinary-Human principals. Profile1 plus same-build regressions28
passed29/0/0; ten normal stops, twelve stable read-only private files and zero
owned residuals passed. PCM/Provider execution remains unqualified. Source binds
parent ebf9d2b8 plus six test overlays; native source-equivalent reuse does not
rebind historical results. Only existing stack.integration earns1.5 points:
stack90%, GX11 72.3%, total610.8/1200 (50.9%). Profile upgrade/rollback, stack
handoff, full media and cloud remain open; historical40001/500 risks stay OPEN.
Exact receipt (../development/evidence/m1-v3-profile-business-ebf9d2b8/index.json).
2026-09-30 — Same-profile native signal drain and restart
Added an opt-in test-only seven-application restart journey to the existing
ten-role profile. One actual fixture passed1/0/0: retained original RTC signal
participant through native wait and official DeleteRoom, real stopped Control
mutation refusal with no durable effect, exact original-key replay, and successful
previously refused mutation after restart. The same containers/images and twelve
private files were retained; all seventeen lifetimes exited normally, both
consumers closed and owned residuals were zero. Parent2eb6d13a plus three exact
test files is not clean-SHA replay. Both pre-fixture Docker metadata FAIL attempts
remain preserved after independently proven runner-only projection corrections.
No runtime/upstream patch or points changed: upgrade55%, total610.8/1200=50.9%.
Forward upgrade/rollback and complete business admission stopping remain unverified;
prior GX03/revocation evidence is unchanged. Media and external qualification are
outside this receipt; historical40001/500 risks remain OPEN/UNPROVEN.
Exact receipt (../development/evidence/m1-v3-profile-restart-2eb6d13a/index.json).
Profile forward/rollback failure evidence — 2026-10-01
Added an opt-in actual ten-role A/B/A Task/RTC signaling qualification with unchanged
default helpers. Current run fails at fresh rollback admission (HTTP500); same-build
default regressions pass28/0/0. The failed profile, incomplete normal stop and zero
owned-resource residuals are preserved in the source-bound receipt (../development/evidence/m1-v3-profile-upgrade-failure-cf9796c4/index.json).
No runtime, migration, SDK, Provider or native patch changed; no points added.
Next fix fixture failure-lifetime supervision and obtain request-correlated diagnostics.
Request-scoped PostgreSQL diagnostics — 2026-10-01
Added an optional bounded pgx request-failure observer and existing-private-command readback; Control supplies its trusted context RequestID. SQL, parameters, raw errors and credentials are not retained. The connector, transactions, retries and business authority remain unchanged. A test fixture barrier preserves real services until normal shutdown after failure.
Actual PG diagnostics pass19/0/0. The real upgrade/rollback profile still fails
at admission; its request has a correlated40001 read/write dependency under
sql_other, with exact statement and primary/secondary propagation unresolved.
All24 lifetimes stop normally and owned cleanup is complete. Source-bound evidence (../development/evidence/m1-v3-profile-requestdiag-a697afde/index.json)
preserves the separate outcomes. No concurrency fix, historical root-cause
attribution, new credit or external qualification is claimed.
PostgreSQL statement failure classification — 2026-10-01
Expanded the existing closed PostgreSQL statement labels to53, at most26 bytes,
with unknown statements still mapped to sql_other. No SQL content, transaction,
retry or authorization change. Diagnostic tests pass19/0/0; the current signal
upgrade/rollback profile remains0PASS/1FAIL/0SKIP. Its exact request identifies
the authority-origin INSERT40001 and direct PrepareCreate-to-HTTP500 propagation.
Trigger-internal SQL, conflicting writer and SSI graph remain unknown; no fix or
historical cause is claimed. All24 lifetimes stop normally with zero residuals.
Source-bound receipt (../development/evidence/m1-v3-profile-stmtdiag-c2c7aa32/index.json)
preserves both outcomes. Next reproduce that conflict and identify the writer
within the existing GX11 work; zero new credit or external qualification.
Controlled RTC origin SSI reproduction — 2026-10-01
Added one real-PostgreSQL test using the actual Effectiveness owner and signed
admission in a second Room. The corrected run passes1/0/0 by requiring B's
committed effective receipt and A's exact origin INSERT40001 plus full rollback.
The initial whole-relation-lock assumption failed and remains separately
NOT_REPRODUCED; finite tuple/index observations replace only that assumption.
Source-bound evidence (../development/evidence/m1-v3-origin-ssi-ce31f234/index.json)
preserves both attempts. Production, authorization, retries and LiveKit patches
are unchanged. No historical writer attribution, upgrade pass or new credit is
claimed; the production correction and actual profile rerun remain next.
Bounded Human RTC origin recovery — 2026-10-01
Added one fresh authority attempt after Human origin INSERT40001 and confirmed
rollback, preserving the original deadline, idempotency owner and current checks.
ActualPG26/0/0 verifies recovery, revoked Grant/denied Consent/cancellation and
existing serialization/cold Room behavior. No Device, cold-intent, atomic-commit
or HTTP retry. Evidence (../development/evidence/m1-v3-origin-retry-f78d80c4/index.json)
does not qualify full profile upgrade/rollback; clean committed-source replay is
next. Zero points, unchanged upstream patch and no historical failure rebinding.
Upgrade fixture terminal context — 2026-10-01
Fixed final consumer cardinality readback to use its caller context after the business child ends. The narrow realPG/strict artifact suite passes24/0/0; evidence (../development/evidence/m1-v3-stack-terminal-context-73f321f4/index.json). The clean73 profile reached three business phases but failed final readback; both failed attempts (../development/evidence/m1-v3-profile-artifactbinding-73f321f4/index.json) remain preserved. Complete profile rerun on the fixture repair is pending. No new credit, production runtime change or external qualification.
Ready admission transaction recovery — 2026-10-01
Extended confirmed-abort Human admission recovery to the ready preparation body, preserving one fresh authority transaction and its original deadline. Actual PostgreSQL/regression evidence (../development/evidence/m1-v3-ready-retry-827f4a7f/index.json):31PASS/0FAIL/0SKIP, with prior failed fixture retained. The clean827 full profile (../development/evidence/m1-v3-profile-terminalcontext-827f4a7f/index.json) failed rollback at held-seat40001 and remains FAIL. Complete clean-source replay on this correction is pending. No HTTP retry, native patch growth, new credit or external qualification.
Local stack upgrade and rollback handoff — 2026-10-01
Clean ed8 evidence (../development/evidence/m1-v3-profile-readyadmission-ed8b0e4c/index.json):23 artifact checks plus1 complete ten-role signal upgrade/rollback fixture PASS,24 normal lifetimes,0owned residuals. Operator runbooks (../development/GX11_STACK_LOCAL_PROFILE.md#current-exact-source-operator-handoff) bind exact artifacts and recoverable runners; existing local upgrade and stack handoff milestones are complete. Prior failures remain unchanged. Media/Provider/Agents and external qualification are not provided; complete artifact dependencies/NOTICE/SBOM remain open.
Exact Go artifact metadata — 2026-10-01
Added Linux-only read-only ELF/build-info and actual package-import-graph tooling. Local evidence (../development/evidence/m1-v3-artifact-metadata-3f25ac4a/index.json):37Go/9Node tests PASS and eight exact prior-ed8 artifact graphs; no service runtime rerun. Preserved earlier failures and repaired absent same-version toolchain license metadata. Complete license/NOTICE/SBOM and multi-language image closure remain open, with no new progress credit or external qualification.
2026-10-01 — Selected Go notice collection
Added bounded Linux selected-Go-notice collection with 13 passing filesystem tests and eight actual source-bound artifact inventories. Evidence (../development/evidence/m1-v3-selected-go-notices-93a4fce0/index.json). First-party license gaps remain explicit; upstream attribution cannot count as a OneSay declaration. No complete SBOM/legal clearance, runtime rerun or progress credit.
2026-10-01 — Selected Go module cache integrity
Added Linux selected-module integrity tooling using the existing pinned Go/xmod context. 37 named unit events passed; 179 actual module zip/tree/go.mod records matched original source-bound go.sum. Evidence (../development/evidence/m1-v3-module-integrity-d0ddc6d6/index.json). No application dependency changes, cache repair, product runtime rerun, complete SBOM claim or added milestone credit.
2026-10-01 — Existing Task image Python inventory
Added source-bound Linux Python inventory tooling and 22 passing synthetic tests. Actual immutable Task image collection records pip/CPython metadata and notices; missing generated bytecode remains PARTIAL. Evidence (../development/evidence/m1-v3-task-python-inventory-a11d62d5/index.json). No image rebuild, Provider/runtime change or extra progress credit.
2026-10-01 — Offline image catalogs and disabled Agents disposition
Recorded three existing image SPDX catalogs and disabled Agents source/selection evidence using official/existing tools. Image evidence (../development/evidence/m1-v3-image-catalogs-2586b470/index.json); Agents evidence (../development/evidence/m1-v3-agents-selection-2586b470/index.json). Preserved first coordinator/reader failures and blocked temporary-file cleanup. No runtime changes, complete SBOM/license claim or progress credit.
2026-10-01 — Current JS package and ESP32 source artifacts
Preserved the current reproducible JS candidate and15-package installed byte/notice inventory, plus the current103-file ESP32 source export. JS evidence (../development/evidence/m1-v3-js-artifacts-2be4c943/index.json); ESP32 evidence (../development/evidence/m1-v3-esp32-source-artifact-2be4c943/index.json). Kept the original JS cleanup assertion failure and PARTIAL license/integrity coverage explicit. No runtime changes or new qualification credit.
2026-10-01 — Model/configuration references and Bufbuild notice metadata
Required model/configuration source references and reused static launch projections in the artifact checker; eight targeted tests pass. Preserved version-bound Bufbuild external license bytes with prior reader failures; no package mutation, full integrity or legal qualification claim. Reference evidence (../development/evidence/m1-v3-artifactrefs-587ecac5/index.json); notice evidence (../development/evidence/m1-v3-bufbuild-notice-587ecac5/index.json). No runtime changes or new progress credit.
2026-10-01 — Current SDK integrity, target artifacts and selected provenance closure
Preserved current JS original-tarball/installed-payload integrity and actual ESP32 Task/RTC build, native boundary and selected NOTICE readback with earlier failed attempts intact. Joined existing source-bound artifact evidence and awarded the existing GX11.artifacts local_behavior 25 milestone (+3.5 points); integration/distribution and external qualifications remain open. Corrected the manifest-checker description to distinguish policy/path checking from secret-content scanning. No product source changes. JS evidence (../development/evidence/m1-v3-js-integrity-2294ec7c/index.json); ESP32 evidence (../development/evidence/m1-v3-esp32-current-build-2294ec7c/index.json).
GX11 Debian notices and selected artifact delivery — 2026-10-01
Added bounded Debian notice collection and create-only candidate delivery/readback tools. Parent e9d53a565da31df39fd73ef7f2254310b4d3c6a3 plus exact source overlay:24 Linux collector tests and15 delivery tests pass; three existing images each87 installed packages/17 common-license paths/85 catalog hashes, and266 delivery members (38,731,360 bytes) independently read back. The original Node reporter parser failure remains preserved and was reconciled from logs without test reexecution. Source/status/partial coverage remain original; no complete OCI distribution, SDK runtime/hardware, legal clearance or cloud qualification follows. Debian evidence (../development/evidence/m1-v3-debian-notices-e9d53a56/index.json); delivery evidence (../development/evidence/m1-v3-artifact-delivery-e9d53a56/index.json).
GX11.artifacts reaches90%, GX11 90.4%, total622.6/1200=51.8%; the existing integration milestone adds1.4 points once and handoff stays open. Corrected the stale external Go metadata-access blocker using already verified179-module/eight-artifact evidence. No runtime/migration/SDK/Provider/LiveKit patch changes. Git Transition Status: current branch codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; local continuation only.
GX11 canonical artifact operator and durable restore — 2026-10-01
Added verify/restore CLI entries and an operator catalog (../development/GX11_ARTIFACT_CANDIDATE_HANDOFF.md).14 restore tests passed; three CLI cases observed the intended success/rejection exits. Actual restoration from persistent evidence produced the original266 members (38,731,360 bytes) and manifest byte-identically; independent CLI readback passed. Evidence (../development/evidence/m1-v3-artifact-operator-fda4866d/index.json), SHA-256 5b6064d9593590436ce3b5d3a86afb6fed9316a7aa26108377189d8da5f14d36, retains parent fda4866dd964d0d54ca48bb9be4663ae50c3aa1c plus exact source overlay. No rebuild, runtime or historical evidence rebinding.
Narrowed ESP32's144 observations:139 IDF metadata absences already have license references,2 first-party metadata absences and3 NO_NOTICE items. Remaining first-party and exact dl_fft supplement scope stays visible. Full product handoff remains open; GX11.artifacts90%, overall622.6/1200=51.8%, zero extra points. Staging/hardware/Production remain NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; local continuation only.
GX11 dl_fft notice supplement and GX01 source reuse — 2026-10-01
Exact upstream notice evidence (../development/evidence/m1-v3-dlfft-notice-fda4866d/index.json), SHA-256 a19933b51e6bc75c81a8ee4b2ce1b8df25e07014c1608969e88c7dd2e9fa201e, preserves seven verified files at esp-dl commit1ab1e264d4270bfad6a45760ea19273dca0cedfc under the original fda4866d collector parent. The MIT component/root declarations and Apache-2.0 selected source headers remain distinct. Removed installed-volume bytes and original NO_NOTICE are not requalified; the supplement stays separate from the immutable266-file carrier. No named tests/build/package execution or legal completeness claim.
Corrected GX01.supply's stale proxy/cache next action: eight actual package graphs,179 effective module checks and selected multi-language/image notices already exist and are reusable. No duplicate credit is awarded. Owner first-party declarations and explicit partial inventory limits remain recorded; continue independent ready local work. Overall622.6/1200=51.8%,GX11.artifacts90%,GX01.supply17.5% unchanged. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED. External Staging/Production/hardware remain NOT-RUN.
GX11 local logical backup and independent restore — 2026-10-01
Source-bound evidence (../development/evidence/m1-v3-local-backup-7c401d81/index.json), SHA-256 07669ee12a260d488c58a5cca16d6fcefe036e81e8f8c9c64ac62911bc649143, records parent 7c401d81eecb511cd412a81e612a6128ae27d23c plus its exact frozen test/coordinator overlay. Actual PostgreSQL17.6 dump/restore between independent owned clusters passed1/0/0: all109 migrations,140 tables,5 sequences, logical schema/ACL/native role restrictions, post-backup write exclusion, and16-byte truncated-header rejection. Counts of database objects are not tests. Owned databases were removed; four containers exited normally and container/volume/network residuals were0/0/0. Migration registry/generated consistency checks also passed.
The first failed run remains0/1/0: native CHECK deparse grouping and explicit-default versus NULL ACL representation differed. The comparison now uses PostgreSQL-native precedence/ACL projections and retains raw observations. The first SQL diagnostic's uppercase sequence type was invalid; its original receipt remains and a new lowercase-s sequence diagnostic verifies added-grant/grant-option detection. No old result was rebound or converted to PASS.
The fixed operator runbook (../development/GX11_DATA_LOCAL_QUALIFICATION.md) documents inputs, source binding, verification and owned cleanup. Existing GX11.data integration/handoff each add1.2 points once; data100% local, GX11 61.2/65=94.15%, overall625/1200=52.0%. Physical volume/PITR/offsite, arbitrary owner remapping, OSS/KMS/independent Privacy Ledger recovery and business cutover are not qualified. Staging remains NOT-RUN — requires authorized Staging environment; Production/hardware remain NOT-RUN. No production runtime, applied migration, SDK, Provider or LiveKit patch changed.
Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED. Continue existing dependency-ready local work without push, merge, new branch or CURRENT_HANDOFF refresh.
GX13 selected Task image missing-config rejection — 2026-10-01
Actual selected-image evidence (../development/evidence/m1-v3-task-missing-secret-9bd1ec9e/index.json), SHA-256 fbd91a26b916a400a0fbd824810ab4e8406658d321fb8d09116f6a7a45417c67, records six role argv selections rejecting absent private configuration at the real packaged launcher before starting Go children. All six naturally exited1 with the fixed sanitized diagnostic; one separate metadata probe verified absent config/public hashes. Seven containers were removed normally, residual0. These are six process observations,0 named tests/0 new points. The original ed8 image producer remains unchanged while the coordinator binds clean9bd1ec9e. An independent813-input byte comparison supports reuse without a rebuild or historical evidence rebinding.
GX13.replay stays55%, overall625/1200=52.0%. Full candidate replay, native/media/Provider and external qualification remain open. No product code changed. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push, merge, new branch or handoff refresh.
Selected offline candidate import and isolated readiness — 2026-10-01
Actual offline candidate evidence (../development/evidence/m1-v3-offline-candidate-a3d2416d/index.json), SHA-256 321620eb5f4bf75948903f1329240d91079adbb6c58a100a0cf75341f109b6db: five product/state images plus one qualification-only Node image were exported/imported through the 1,595,003,904-byte exact Docker archive. One default precompiled fixture passed1/0/0; ten role lifetimes stopped normally, with three TLS handshakes, native health, Usage readiness and zero owned residuals. This used a fresh namespace on an existing image store, not an empty daemon or business A/B/A replay. Coordinator a3d2416d and producer ed8b0e4c remain distinct. Original export/reader failures are preserved; required local tar/ELF bytes are hash-only in Git and must be retained. No runtime code changed.
GX13.replay stays55%; total625/1200=52.0%, points delta0. Continue complete candidate business cold-start/upgrade/drain/rollback using the delivered same artifacts. Full candidate/media/Provider/external qualification remains open. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Delivered offline Task/RTC business upgrade and rollback — 2026-10-01
Source-bound replay (../development/evidence/m1-v3-offline-business-acac7ba3/index.json), SHA-256 e51fd6f4b4d873cd37435a1fff4c5447e8d4ac9488ed33fea9d0ab2dc3977d4f: original delivered artifacts passed Task-cancel/RTC-signaling A→B→A, one named test / zero failures / zero skips, 24 normal service lifetimes, three native consumers normally closed and zero owned residuals. Original revoked B material was rejected after rollback without refresh. Coordinator acac7ba3 and producer ed8b0e4c remain distinct. No product code or patch change; zero PCM/Provider execution and no full candidate/external qualification claim.
GX13.replay55%; overall625/1200=52.0%, zero new points. Continue existing GX12 prerequisites. Staging NOT-RUN — requires authorized Staging environment; Production/hardware NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Same-scope Task completion through native process failure — 2026-10-01
Joint qualification (../development/GX12_JOINT_LOCAL_QUALIFICATION.md) and source-bound evidence (../development/evidence/m1-v3-joint-native-failure-f37041bf/index.json) (d807fe78c7c6c63d54cfe0cf9a20bfbd399ef1acec425e7318cc49bffd28e20a): current Linux qualification with unchanged original product artifacts passed two named tests, zero failures/skips. Same-Room Task audio completed after exact owned native SIGKILL, with one Task settlement/terminal outbox and unchanged end replay. The original native-join normal-close regression also passed. Zero owned runtime/build leftovers and no published ports. The deterministic Provider fixture makes no external model calls.
GX12.joint boundary/build earns8.25/15=55%; GX12=49.375%; overall633.25/1200=52.7%. Complete RTC terminal settlement is still pending; an RTC reservation is not completed billing. No new gate or denominator; Staging NOT-RUN — requires authorized Staging environment, Production/hardware NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Public revoke after native failure preserves original liability — 2026-10-01
Joint report (../development/GX12_JOINT_LOCAL_QUALIFICATION.md) / source-bound evidence (../development/evidence/m1-v3-joint-native-revoke-9eb8efa7/index.json) (bf6810c3d40f4c71c67c788ecf13c8ade01d27cd41e619382d507a03069256fb): corrected actual local run2 pass/0 fail/0 skip; initial omitted-policy failure1 pass/1 fail/0 skip is preserved separately. Public Human Consent/revoke and same-key replay after native crash retain the exact RTC hold and single Task settlement; no billable RTC quantity or native effective-revocation claim. Only two test files changed, no product/runtime/patch changes. Zero owned leftovers.
Additional credit0; overall633.25/1200=52.7%. Trusted native measurement/RTC settlement remains pending. Staging NOT-RUN — requires authorized Staging environment; Production/hardware NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Actual Control RTC intent owners; prior Consent failure remains open — 2026-10-01
RTC reuse and intent report (../development/RTC_GX05_REUSE_INDEX.md) / source-bound evidence (../development/evidence/m1-v3-control-rtc-intents-b0157d50/index.json), SHA-256 d9ec059a48e44f21be16788e5314a49408c7e413f3c78f2a83ce950a3b4cdf40: parentb0157d50f857f3bf122159be8d62c09f7e1e9fd1 plus nine files; six fresh command ELFs and four qualification tools, original ed8 native provenance separate. Production bootstrap wires publication/subscription intent handlers, Authorizer and ReplayValidators to the existing RTCConnections owner. Actual Control/PG intent, protected replay and deny-all subscription CAS passed in the diagnostic26/0/0 run with zero owned leftovers.
Two25/1/0 failures remain archived: missing-Consent403 expectation corrected to canonical409; the later Task signal.open Consent decision500 remains UNKNOWN and was not reproduced, so joint stability is not closed and no fix is claimed. Public intent is not native media enforcement. GX05.publications80% and overall633.25/1200=52.7% remain unchanged, additional credit0. Native mapping/current subscription upper bound and real audio qualification remain unfinished; no cloud/scope/patch/migration/SDK change. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Bounded actual Control Consent failure diagnostics — 2026-10-01
Diagnostic report (../development/RTC_GX05_REUSE_INDEX.md) / evidence (../development/evidence/m1-v3-control-consent-diagnostics-7dbb4938/index.json), SHA-256 2a86b75f19a35a2d90db57639ec8d3d59f059559e2934c27ea8b71a4337fa623: parent7dbb493889be2f30240da7b50411ea15fc61758a plus two test files. Local20/0/0 qualification covers bounded request-correlated private diagnostics, an expected fixture-injected40001 and rollback, plus the three existing regressions; no owned runtime leftovers. Existing production telemetry is reused; only the Gateway test ELF was rebuilt, with six prior commands/test2json and separate original native provenance preserved.
The historical Consent500 remains UNKNOWN/UNRESOLVED: injected failure and a passing regression do not establish its cause or repair. Runtime/migration/SDK/Provider/native patch are unchanged. No new gate, score or external qualification;633.25/1200=52.7%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
The first diagnostic attempt is preserved separately:16 unit passes, one actual-test failure, no skips, one package failure; the three gateway regressions were NOT-RUN. The test incorrectly reused the ordinary RTC rejection helper, which requires retryable=false, for an internal HTTP500 whose existing contract requires retryable=true. Only that new-test assertion was corrected to the exact safe internal error envelope; no production response or retry behavior changed. Both attempt sources, runners and receipts remain immutable.
Complete native subscription route — 2026-10-01
Route reuse report (../development/RTC_GX05_REUSE_INDEX.md) / evidence (../development/evidence/m1-v3-native-subscription-route-19d21010/index.json), SHA-256 4b8b0b20d4a3d668e96d04fabfdb1c4e904b026e27820f12f9c1faff8f8ed725: parent19d21010eb2a8dd122bc56c006a1477018ed9b7b plus two source files. Latest accepted subscription policy and the entire ordered target mapping now resolve through exact native identities and current generations; missing targets cannot become an implicit allow or empty success. Local70/0/0 tests passed with the existing subscription HTTP/authority regressions. This is non-authorizing SQL routing; original subscriber Consent/Grant and actual native enforcement remain separate.
No new completion credit; GX05.publications80%, overall633.25/1200=52.7%. Historical Consent500 remains unresolved; external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Public Control and two actual Gateway processes — 2026-10-01
Task transport report (../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) / evidence (../development/evidence/m1-v3-cross-gateway-resume-8dd023b9/index.json), SHA-256 b6baa6a67cfb2618d7147b26f471833a97d28615934069c07d8e8317cddfe54c: parent8dd023b9d0ccbe9555267b3ac3d561af5acc216d plus one actual-process fixture. Public Control admission/resume, two Gateway processes and the original live durable Task owner verify checkpoint transfer, old-connection fencing, duplicate audio handling and single terminal settlement. Both selected roots passed2/0/0; the separate five-process regression retains its narrower existing scope.
Runtime/protocol/SDK/Provider/native patch unchanged. Full transport fault qualification remains open; no new credit, overall633.25/1200=52.7%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Public resume-state loss and original Task continuity — 2026-10-01
Task transport report (../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) / evidence (../development/evidence/m1-v3-cross-gateway-resume-loss-32a6b869/index.json), SHA-256 f89003d9975d03de6ccf0de23dda4937c6829af6ddb9ef57597491c5611d9a4f: parent32a6b8690b9c682389283a71b90499a43afcc32e plus one loss fixture. Publicly issued resume material cannot recover a missing Redis record; the second real Gateway rejects it and preserves the original connection/Task owner. The original Gateway then completes that Task exactly once. The loss scenario and positive resume regression passed 2/0/0.
No production runtime/protocol changes. The existing transport integration 10% earns 1.2 points; GX15.transport 90%, GX15 81.6%, overall 634.45/1200=52.8%. Handoff remains open. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Subscription Consent policy history and forward upgrade — 2026-10-01
RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md) / evidence (../development/evidence/m1-v3-subscription-consent-fence-cdd66716/index.json), SHA-256 75d51fabb8f26f997ae966d14016f87ef0c6b547a025b523c242cb7e3a5d68c8: parent cdd6671644c6c1ef7b68923e67fc763cd2502c3f plus eleven reviewed source files. Migration 110 closes subscription Consent policy restoration for the local retained original-owner proof and protected public replay. A genuine 109 upgrade retains old NULL generations and rejects them without invented history; fresh authorized acceptance remains possible. Local 93/0/0 includes 8 fence, 1 upgrade, 14 origin and 70 affected regression events. Prior 84 evidence remains unchanged.
Additional credit 0; GX05.publications 80%, overall 634.45/1200=52.8%. Native consumers/upper bounds, authority-change propagation, actual media and RTC settlement remain unqualified; historical Consent HTTP 500 unresolved and external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Publication dependency preparation and original native close — 2026-10-01
RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md) / evidence (../development/evidence/m1-v3-publication-preparation-53d543aa/index.json), SHA-256 7fd1c7cb74b5a55a7ffd104893dcdcb714dada7ba1cad5b1b19531f6b3d724fc: parent53d543aa6a7281f30b22a19289e579d8e5ad24f4 plus27 reviewed source files. Explicit signed preparation now commits original publisher dependencies; migration112 reuses existing capture/export/processing and preserves old NULL epochs. Real Source withdrawal/restoration closes the original join-only native SID through the actual authority process and terminal ACK. Local runtime77/0/0 and separate static36/0/0; five fresh Linux ELFs, control-api compile-only. Media and native operation permissions remain unqualified.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Historical evidence remains source-bound, historical Consent HTTP500 unresolved, external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Signed publication preparation client — 2026-10-01
RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md) / evidence (../development/evidence/m1-v3-publication-preparation-client-a5680d1a/index.json), SHA-256 5bff05ea845f7c2df142a0657817c8701f50a05352e3d9340f6f817d5834491a: parenta5680d1a8f69145937654a3c3336a571cff0a3e1 plus3 reviewed source files. The closed signed client now consumes the real publication dependency owner through fixed TLS and one-use Service JWTs. Strict original binding/time checks, no automatic registration retry and bounded raw TCP cleanup are verified. Real publisher withdrawal/restoration cannot register new authority. Local runtime31/0/0; control-api compile-only. Native publish rights and media remain unqualified.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Prior native-close evidence remains bound to its original source; external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Original attached-lease publication preparation — 2026-10-01
RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md) / evidence (../development/evidence/m1-v3-native-publication-preparation-6a12c810/index.json), SHA-256 a043d5dde0a402758287749f7a71c6e6e213ff2c491bc548012c4a02eecc0fb2: parent6a12c810a7bbf7e77ae422d30cb45771139121e8 plus7 reviewed source files. Original attached-lease preparation now consumes the closed signed client with exact instance/version/deadline checks and in-flight invalidation/cancellation rejection. Real restricted PostgreSQL/TLS tests verify committed publisher dependencies and one retained consumer/ordinal. Local47/0/0 across13 roots; control-api compile-only. Fixture SID/completion are explicit substitutes, not native presence/media or WaitClosed evidence. Existing upstream reuse limits and the required remaining publication guard are recorded without a new audit or patch change.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Native publication/permission/media remain unqualified; old evidence is not rebound and external qualification remains NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Native publication guard, restricted Human profile and actual media — 2026-10-01
Source-bound evidence (../development/evidence/m1-v3-native-publication-guard-0aae78c4/index.json), SHA-256 50391c3176b6bed0ae06dc041810cbf6d756be2fea773ed7f9db20a6b2102a7f, binds parent0aae78c4cc91eb560ab8d1a20a2094e362d8c4ff plus the exact corrected3 overlay and 851-file native source snapshot. Restricted Human microphone signaling now requires original-lease publication preparation before native mutation; Device and broader rights remain denied. Actual official-client track/RTP readback and Source-revoke/native-completion proof pass. Separate local vectors: native217/0/0, current race322/0/0, actual next-version replay423/0/0. Original corrected2 Consent-setup failure168/1/0 is retained; aggregate40001 is uncorrelated and general Consent-concurrency availability remains unqualified. The narrow fixture drain adds no retry or extended deadline.
The registered30-file patch reuses LiveKit media/runtime; its seven before/after metrics, exact candidate conflicts/resolutions, source cuts and limits are in the RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md). Durable TrackSID/subscription/subscriber media/RTC settlement and external qualification remain open. Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. This is affected local qualification, not full ci:local or cloud acceptance. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Public Task ticket consumed once across actual Gateways — 2026-10-01
Evidence (../development/evidence/m1-v3-public-ticket-once-ac069618/index.json), SHA-256 ac6a74755cba02bbfba27b4ec74117bb0f3f33e00dfce891d983a463d3a62b07, binds ac069618 plus one test file. One public Control ticket raced through two actual Gateway processes yields exactly one welcome; PostgreSQL confirms one original-scope participant. Old-ticket replay is denied on both nodes while the admitted connection remains usable. New initial admission plus existing positive/lost-state resume regressions pass 3/0/0 with fresh Linux artifacts and verified owned cleanup. Protocol/runtime/SDK/Provider/LiveKit patch are unchanged.
The existing GX15.admission integration 10% adds 1 point after combining this proof with separately source-bound prior public API, identity and Device entry evidence; no inherited result is rebound or credited twice. Admission 90%, GX15 83.6%, overall 635.45/1200=52.9%; handoff, other Task/RTC product scopes and external qualification stay open. See Task transport report (../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) for exact limits. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Claimed PostgreSQL completion response loss and terminal readback — 2026-10-01
Evidence (../development/evidence/m1-v3-ambiguous-completion-8997e805/index.json), SHA-256 a5770663b2e4112a7a5e7adbe6125c9d0eafa939d7ebf78bbc965677f410dbb9, binds parent 8997e805 plus one test file. Actual PostgreSQL Complete commits before a wrapper loses its return; the production pipeline reads the terminal through a second independent connection, preserves its live final and invokes Provider once. Fresh pipeline and Usage compositions replay without duplicating Artifact, receipt, outbox, usage or quota commit. Current Linux race qualification: 23 named pass, 0 fail, 0 skip, six roots/two packages; the existing memory regression is separately labelled. Runtime/protocol/migration/SDK/Provider/LiveKit patch are unchanged.
The existing GX15.terminal local_behavior remainder and integration add 1.2 points: terminal 90%, GX15 86%, overall 636.65/1200=53.0%. Prior ca2fd7f/f63db12c/fd4a4d7b evidence retains its original SHA; no GX19/GX16 duplicate credit. See terminal qualification (../development/TASK_TERMINAL_COST_CONCURRENCY.md) for exact scope. Handoff, broader Task/profile/Context scope, actual process/network faults and external qualification remain open. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Signed native publication producer facts and precise observation limits — 2026-10-01
Evidence (../development/evidence/m1-v3-native-publication-webhook-c7e2180/index.json), SHA-256 c88503e335e6c8704497f434957a9c7a5e2c671e043d00f694e4d606b954af9b, binds parent c7e2180 plus two test files. Fresh Linux controlrepo.test and separately provenance-bound unchanged native artifacts run three affected roots: 3 named pass/0 fail/0 skip. Official signed track_published facts match the original Room/Participant/Track SID, prepared handle, Opus microphone and microsecond publication version. Original revoke/ACK and participant lifecycle regressions pass with verified owned cleanup. Durable publication remains prepared; no production runtime, migration, SDK, Provider or LiveKit patch changes.
Audio metadata can be SDP-fired before first RTP. The bounded sender is exercised, but metadata is not packet-arrival, capture-clock or quality proof. Exact-pin normalized negotiated format and native logical-time limits are recorded in the RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md). Older receipts keep their original hashes/results. Durable projection/inbox, subscription/subscriber media and external qualification remain open. Additional credit0; overall636.65/1200=53.0%, GX05 61.8%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Finite signed publication adapter with preserved participant verification — 2026-10-01
Evidence (../development/evidence/m1-v3-publication-observer-84132322/index.json), SHA-256 4c2df150fba8e762166df89d1b38bba8804691925b5a2f6cd83b08c0337c1433, binds parent84132322 plus four observer files. One official raw-body verification now supports opaque finite publication dispatch while retaining the existing participant entry point. The publication contract binds native producer/Pion pins, precise publication time and normalized Opus semantics; invalid ticks/time/shape are rejected and client metadata grants no authority. Current Linux race selection: 122 pass/0 fail/0 skip across observer, owned-TLS receiver and two pure receipt-value regressions, with exact source and normal cleanup checks.
The new publication path is not yet mounted; no database/native media or durable projection runs in this lane. Existing producer proof keeps its original SHA. See RTC reuse report (../development/RTC_GX05_REUSE_INDEX.md) for scope and remaining original-attachment/inbox/projection work. Additional credit0; overall636.65/1200=53.0%, GX05 61.8%; external qualification remains NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
Bounded signed subscription preparation client — 2026-10-02
SubscriptionPreparationClient reuses the existing owned private RTC HTTP transport, fixed TLS endpoint/Service route and one-use internal token manager. Prepare sends one native room/identity pair and an explicit positive accepted policy version to the already committed subscription preparation owner. It performs one bounded500ms call with finite capacity, a16KiB response ceiling and strict complete flat/nested decoding; it never retries a sent one-use registration or substitutes a newer policy.
Source-bound evidence (../development/evidence/m1-v3-subscription-client-d8bf6159/index.json), SHA-256 b9bd8b8a82d499e0db9086b4bef7eae7f87a0d86df4c4c317497d1d3b3b4fd8f, binds parentd8bf6159083b2605f5de26fc3cea6dfa64f25b18 plus exactly three new files: the finite private client, its transport tests and the PostgreSQL HTTPS integration test. The affected Linux race regression completed 508 pass / 0 fail / 0 skip / 0 package fail, with bootstrap compile-only (zero runtime tests), frozen-source match before/after and all owned resources removed. The full current policy package executed503 named tests (495 existing names rerun on this source plus8 new client names); the new PostgreSQL selection is TestPostgresRTCSubscriptionPreparationHTTPS, with its final leaf vector 5 named (the root plus independent_publishers_commit_complete_union_with_fresh_requests, explicit_empty_policy_commits_complete_deny_all, eight_targets_over_actual_tls_remain_complete, and wrong_and_superseded_versions_write_nothing).
The dependency registration, original source/Grant/Consent/MVCC authority and actorless invalidation owner remain the implementation committed at d8bf6159. Their previous evidence (../development/evidence/m1-v3-subscription-dependencies-7000688c/index.json) retains its own source and625 affected regression, separate focused37 and Node39 results; none is added to this increment's current counts or progress. No migration, upstream patch, runtime wiring, SDK, Provider or deployment change is introduced by these three new files.
Continue the existing GX05.publications cursor with native consumption of the registered dependency result, selective-subscription permission upper bounds, pushed withdrawal/freshness and actual subscriber media. The client is not yet wired to a native permission consumer. No native host/permission installation, effective subscription/revoke/ACK, received RTP, media quality, Usage/settlement, current full CI or cloud acceptance is qualified by this increment. Staging/cloud: NOT-RUN — requires authorized Staging environment; Production, hardware and real Provider qualification remain NOT-RUN.
Additional credit0; GX05.publications12/15=80%, GX05 61.8%, overall636.65/1200=53.0%. Existing milestone weights, integration/handoff credit, denominator and package order remain unchanged. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue locally without push, merge, new branch or CURRENT_HANDOFF refresh.
Native subscription preparation on the original joined lease — 2026-10-02
The existing OneSay native admission backend now supplies a bounded PrepareSubscription callback on the original joined-connection watch. It reuses the committed signed subscription client and durable original publisher dependency graph, checks the same consumer/session/ordinal/native SIDs and current freshness before and after unlocked HTTPS, and preserves the complete ordered zero-to-eight target set. Every target must belong to the originally attached native Room. Preparation neither reenrolls a watch nor renews admission, authority, quota or freshness; it does not install native permissions.
Source-bound evidence (../development/evidence/m1-v3-native-subscription-preparation-1592d75f/index.json), SHA-256 b4a5a6e17bcea500e9f31fb88df6dd0b406bb2da3f568e88f0f26c8fedee6648, binds parent1592d75fe0e5262d8a62d0f3f86ee1181cec3d37 plus exactly seven reviewed source files. The affected Linux race qualification completed530 pass/0 fail/0 skip/0 package fail: full current policy511 (503 existing names rerun plus8 new callback names) and real PostgreSQL19. Bootstrap completed compile-only with zero runtime tests; frozen source matched before/after, and normal cleanup removed all owned containers, volumes, anonymous data volumes and networks.. All530 current named outcomes and source/cleanup bindings are retained in the archive; bootstrap adds no runtime-test count. The previous d8bf6159 client508 remains historical source-bound evidence. Actual native subscription installation, selective media delivery, all-node subscription revoke/freshness timing, Usage/settlement and current full CI remain NOT-RUN for this increment; Staging requires an authorized environment. Additional credit0; GX05.publications12/15=80%, overall636.65/1200=53.0%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue the existing reviewed cursor without push, merge, branch creation or handoff refresh.
Task admission technical delivery — 2026-10-02
Completed the existing GX15.admission delivery mapping in Task transport qualification (../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md#task-admission-technical-delivery--2026-10-02): public Control API, original one-use Task ticket, actual two-Gateway consumption, original identity/Grant scope and diagnostic entry points. The delivery readback (../development/evidence/m1-v3-task-admission-delivery-10c58f7a.json) binds source parent 10c58f7acf4227bb80a9ef6bceefe0b423fb822d, original receipt hashes and twelve selected unchanged entry/runtime/test files. Historical results keep their original source boundaries; this documentation/readback increment executes zero runtime tests and does not establish current full transitive qualification.
The existing 10% admission handoff milestone is accepted for1 point: GX15.admission100%, GX15 88%, overall637.65/1200=53.1%. No new gate, weight or denominator is introduced. Other Task profiles/Context/terminal, joint RTC, paid Provider, hardware and full CI work remain separate. Staging/cloud: NOT-RUN — requires authorized Staging environment. Production/hardware: NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue local work without push, merge, branch creation or CURRENT_HANDOFF refresh.
Task transport technical delivery - 2026-10-02
Completed the existing GX15.transport handoff using the unchanged local qualification (../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) and private transport (../development/TASK_NETWORK_TRANSPORT.md) documentation. The original ACK, sequence, duplicate conflict, bounded backpressure, replay/resume and lease/fence behavior maps to its source-bound receipts; operational bounds, failure behavior and cleanup remain explicit. No new delivery checklist or runtime implementation is introduced.
The delivery readback (../development/evidence/m1-v3-task-transport-delivery-70bd11d7.json) binds parent 70bd11d7d24808bcc9561e5f95fcb7e0dc409a92, two existing documents, eighteen selected source files and six original logs. Sixteen files still match ca2fd7f; the two known gateway response/test changes are explicit, and all eighteen match ac069618. The historical430 and separate2-test process results retain their original sources and scopes. This increment executes zero runtime tests and makes no current full transitive CI claim. Existing handoff10% adds1.2 points only: transport100%, GX15 90.4%, overall638.85/1200=53.2%.
Task-owner process loss, wider Task profiles/Context, terminal and SDK delivery, joint Task+RTC and full local CI remain with their existing work items. Paid Provider, cloud, hardware and Production are NOT-RUN; Staging is NOT-RUN - requires authorized Staging environment. Git Transition Status: merge_main_ready: NOT_READY; new_feature_branch_ready: NOT_NEEDED; continue the current branch locally without push or merge. CURRENT_HANDOFF is unchanged.
Original subscription version selection - 2026-10-02
The original subscription watch now selects the latest accepted version through its exact durable native Human connection, then invokes the existing signed exact-version preparation. Lookup is read-only SERIALIZABLE, takes no row locks, closes before HTTP and shares the original500ms deadline. Revoke, replacement and expiry are checked before/after selection and after HTTPS; a changed version never triggers an automatic newer-version retry. Migration116 adds SELECT on only connection_id/policy_version; prior migrations and strict ACL denial remain intact.
Actual source-bound Linux race result:581 pass/0 fail/0 skip/0 package fail, comprising full policy518 and real PostgreSQL63. The restricted LOGIN-to-HTTPS case commits explicit empty-set preparation and verifies policy replacement through the existing exporter/worker/feed invalidates the original fixture watch. Bootstrap is compile-only with0 runtime tests. All2598 frozen source files match before/after; one235516ms attempt and five normal container exits leave0 owned resources. Official LiveKit is Room setup only, and explicit fixture SIDs/completion do not prove actual native installation, media or drain. Exact-source archive (../development/evidence/m1-v3-native-subscription-version-c4d656bc/index.json), SHA-256 a8a1d758e221b969ae816110c9a9d8572067925d784b083c63db176f1a77191b, binds parent c4d656bcc9262019be3457b60797aed47dc58ad6 plus exactly16 reviewed source/test/migration files. Historical receipts retain their original sources.
Native media-only capability installation, actual selected media receipt and native client races remain the next existing GX05 step. No LiveKit patch, media/data permissions, SDK, Provider or new public protocol changes. Additional credit0; overall638.85/1200=53.2%, GX05 61.8%, GX15 90.4%. Cloud/Production/hardware remain NOT-RUN; Staging is NOT-RUN - requires authorized Staging environment. Git Transition Status: merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue current local branch, no push or merge. CURRENT_HANDOFF is unchanged.
Task terminal technical delivery - 2026-10-02
Completed the existing GX15.terminal technical handoff using unchanged terminal/cost qualification (../development/TASK_TERMINAL_COST_CONCURRENCY.md) and installed Task local qualification (../development/TASK_END_TO_END_LOCAL_QUALIFICATION.md) documentation. The original three acceptance criteria map to single Artifact publication, terminal absorption and unique Usage/settlement facts. Existing owners, commands, failure boundaries and cleanup evidence remain explicit; no new gate or runtime implementation is introduced.
The delivery readback (../development/evidence/m1-v3-task-terminal-delivery-8ba68541.json) binds parent 8ba68541e1b2c019683f6d5698117b0e3240ef42, two documents, six selected source files and the original lossless logs. The six files match the8997 frozen snapshot and current committed bytes. Historical23,35,5 pass results remain separate original scopes and SHAs; the original import-cycle setup failure and two required skips are preserved. This increment executes zero runtime tests and makes no current full dependency-closure claim. Existing handoff10% adds0.8 point only: terminal100%, GX15 92%, overall639.65/1200=53.3%.
GX15.task/profile/Context and GX19 integration obligations remain open. Repository-return response loss is not database/network failure; installed socket recovery is not Worker/Task-owner process-loss recovery. Full local CI, paid Provider, cloud, hardware and Production are NOT-RUN for this increment; Staging is NOT-RUN - requires authorized Staging environment. Git Transition Status: merge_main_ready: NOT_READY; new_feature_branch_ready: NOT_NEEDED; continue the current branch locally without push or merge. CURRENT_HANDOFF is unchanged.
Original selective native media subscription - 2026-10-02
The original connection watch now installs one immutable media-only permission before checked native Join, using the existing signed Service owner and at most eight exact publication/track targets. One foreground attempt retains the500ms deadline; native publisher permission remains an additional restriction. Client intent cannot expand authority. Native CanSubscribe stays false. Pure local checks and exact-object rollback reuse TrackResolver/AddSubscriber; actual Close callback replay fixes the registration race without treating DownTrack.IsClosed as completion. The existing original lease/close pipeline owns preparation, synchronous additions and invalidation. No remote business I/O enters RTP/frame forwarding, and no media algorithm, routing, Redis coupling, scheduler or generic transport is added.
Source-bound results remain separate: current candidate race370/0/0; first real native attempt overall FAIL3/1 because its singleton fixture rejected the two actual participants; corrected focused native1/0/0; actual next-version f7ec53ca replay370/0/0; formal generator/host build and observation race91/0/0. The first forward attempt failed offline module-graph export after host build, with0 tests. Its missing29 exact module versions were acquired through official Go proxy/checksum verification; actual offline graph recheck passed. Both failures remain archived. All completed lanes retain exact source vectors and normal owned cleanup, without rebinding old tests to the later commit.
The real restricted native host/HTTPS/PostgreSQL/worker fixture receives selected Opus RTP and rejects another real unselected track despite receive Grants for both. Public policy replacement closes the original subscriber; effective acceptance waits for its real terminal ACK. Publisher remains active and old resume/full-reconnect material cannot revive authority. This is packet receipt, not decoded audio, audible quality or settlement.
Actual seven-metric before/after: files30→36(runtime18→22, tests12→14); runtime functions modified31→39 and added50→59; total LOC+5388/-73→+6455/-91 (runtime+1652/-73→+2067/-91; tests+3736/-0→+4388/-0); OneSay AST identifier occurrences194→206; hook families3→4; external adapter physical LOC346→510(nonblank331→490). Reuse the original seven-alternative proof. A supported upstream immutable target authorization seam with equivalent async/sync and close-race guarantees can replace this hook.
Formal registration applies the exact tested patch into a fresh owned source
tree and actually regenerates Wire. Its447 native/408 protocol bytes match the
tested candidate. The two host module replacement paths and corresponding
publication-contract provenance hash have a separate fresh build/contract
qualification; the earlier RTP result is not relabeled as a whole-platform
rerun. Exact-source evidence (../development/evidence/m1-v3-native-selective-subscription-3db05f93/index.json), SHA-256 cf6939f651252736ebfa8b9e60bcffd1c41aa147caf2c699f6982ff447c31884, retains parent
3db05f938f707d3a3651d94f1f3592a75f836253 and every declared overlay.
Existing GX05.publications integration10% adds1.5 points only: publications90%, GX05 44.75/70=63.9%, overall641.15/1200=53.4%; handoff remains open. Full local CI, SDK product workflows, decoded quality, all-node subscription timing/soak, Usage/financial settlement and universal legacy data-packet/RPC receiver isolation are not qualified here. Staging is NOT-RUN - requires authorized Staging environment; Production/cloud/hardware remain NOT-RUN. Git Transition Status: merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally without push or merge. CURRENT_HANDOFF is unchanged.
Selective native subscription technical delivery - 2026-10-02
Completed the existing GX05.publications technical delivery using the current host/policy reproduction instructions, subscription contract and source-bound reuse index. Corrected the host README to the actual Linux CGO_ENABLED=1 lane and tested build flags; no runtime, module, migration, SDK or patch bytes changed.
The delivery readback (../development/evidence/m1-v3-subscription-delivery-adca021f.json) binds parent
adca021fcabd6193da9d557892f83db93d11984f, three delivery documents, eleven unchanged selected
formal/fixture files and original archives. It maps the existing binding/upper
bound, reproduction, lifecycle, patch/upgrade and qualification boundaries.
Runtime tests executed0; prior current370, focused native1, forward370 and
formal91 remain separate original source cuts. Governance11 command exits0,
original discover36PASS/1SKIP and separate supplied-archive1PASS are retained.
No old result is rebound to this documentation commit or presented as a full
current dependency-closure rerun.
Existing handoff10% adds1.5 points only: GX05.publications100%, GX05 66.1%, overall642.65/1200=53.5%. Continue the existing GX06 product audio and remaining GX05 Room/convergence obligations. Decoded quality, SDK workflows, multi-node timing/soak and Usage settlement retain their separate work items. Staging is NOT-RUN - requires authorized Staging environment; cloud/Production/hardware remain NOT-RUN. Git Transition Status: merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally. No push, merge, new branch or CURRENT_HANDOFF refresh.
GX08 initial subscription and Opus adapter wiring — 2026-10-02
The existing SDK connect accepts initialSubscriptions before native join, using the existing strict Action/decoder and controller. Inputs are copied before I/O; connection and policy mutations have independent keys and one total deadline. Denied, mismatched, cancelled or expired policy cannot start join. The private controller reconciles the initial native participant snapshot after join without resubmitting policy or relying on TrackPublished. Microphone publishing selects upstream red:false for the current audio/opus profile; no new codec or patch.
Local units and independent deterministic package/type consumers:90PASS/0FAIL/ 0SKIP, including18 initial-policy tests. All71 frozen inputs matched. The initial Windows preload invocation failed before product tests (6file failures); its raw receipt and the file-URL launcher correction are preserved separately. No Windows native test executable was built or launched.
Exact-source SDK evidence (../development/evidence/m1-v3-sdk-prejoin-0f519f29/index.json).
No new milestone credit:643.65/1200=53.6%,GX08=42.1%. Next is the existing real
public-package/native-browser integration without fixture permission overrides;
bidirectional/multiparty/quality, full local CI and remaining Task profile/Context
work retain their scopes. Staging: NOT-RUN — requires authorized Staging environment.
Production/cloud/hardware: NOT-RUN. Git Transition Status:merge_main_ready NOT_READY;
new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally.
No push, merge, new branch or CURRENT_HANDOFF refresh.
GX08 public SDK and current native one-way audio — 2026-10-02
One independently installed OneSay tarball is consumed by two isolated browser contexts. Its public HTTP calls use the real Human identity, PostgreSQL Grant/Consent, current native policy and signed publication observation; the receiver submits its exact initial policy before joining. No fixture grants native media permissions or pre-accepts that policy. The browser uses only the OneSay public API, with standard browser capture/playback/statistics observations.
The fresh Linux run built the test, authority worker and native host from parent 40e8cb5a4dd59e60422e69061a7bfed5959d1d60 plus the three exact test overlays. All 3,733 frozen inputs matched. Actual result: 1 PASS / 0 FAIL / 0 SKIP. Decoded 4,096 samples measured 878.91 Hz for the 880 Hz source before and after mute; silence, original signed subscription snapshot, one preparation, exact public request counts and all three accepted end/revoke operations were verified. Capture/playback/peers closed, and owned containers, volumes and networks were all zero.
The initial run remains 0 PASS / 1 FAIL / 0 SKIP. Its strict child decoder hid a cleanup failure behind an unavailable-phase message. The correction only adds finite safe diagnostics; the later run did not reproduce the underlying failure. The original cleanup cause is unconfirmed, not fixed or erased. Both runs contain an uncorrelated PostgreSQL 40001 count; that is insufficient to attribute cleanup failure. No retry, timeout increase or authority weakening was used.
Exact-source evidence (../development/evidence/m1-v3-sdk-native-public-40e8cb5a/index.json), SHA256 3cf48464a091f05f6f9f18a54d1e6cdbb235974fbb01f582064b0684f9a7bebc. This earns only the existing GX08.adapter integration milestone (+2 points); adapter90%, GX08=44.8%, overall645.65/1200=53.8%. Broader lifecycle stability and handoff remain open. This is one-way audio, not duplex, multiparty, media quality, Usage settlement, full local CI, hardware or cloud qualification. Staging: NOT-RUN — requires authorized Staging environment. Production/hardware/cloud: NOT-RUN.
Current two-session duplex remains an existing GX06 product gap: initial subscription preparation requires an already observed target, while publication starts after join; changing a prepared policy invalidates its original snapshot. A separate third connection would consume a real AppSession/seat and cannot be represented as ordinary two-session duplex. No new architecture, patch surface, denominator or audit gate is introduced. Continue existing Task profile delivery alongside remaining RTC product work.
Git Transition Status: merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally. No push, merge, new branch or CURRENT_HANDOFF refresh.
GX15 approved profile technical delivery — 2026-10-02
The existing dictation.v1 profile inventory now has a technical delivery section in Task voice reuse and gaps (../development/TASK_VOICE_REUSE_AND_GAPS.md#gx15-profile-technical-delivery--2026-10-02). It documents the approved typed inputs/transcript output, finite lifecycle and shared Control/WSS ownership, exact existing Linux reproduction entries, owned cleanup and remaining Context/Provider/external scope. No new profile, DAG, Context compiler, SDK, runtime, migration or upstream patch is added.
Delivery readback (../development/evidence/m1-v3-gx15-profile-delivery-ff1aac82/index.json), SHA256 38237c98b01a23d35ec8d5a3fdbb6c697823aef531eea2241831344ca5d48432, is bound to parent ff1aac824413883260bef8ea9aff96aac5c1c304 and the exact delivery document. Eleven selected profile/input/service files equal both committed current bytes and original2f8b817e source. This is a limited comparison, not a full transitive-source qualification. Original61 Control,430 transport,17 installed Python composition and5 recovery results retain their own SHA/overlays and separate counts; historical failures/skips remain unchanged. Runtime tests executed this increment:0. Synthetic Provider content and cost do not prove a paid Provider call.
Only the existing GX15.profiles handoff milestone advances (+1 point): profile90%,GX15=94%,overall646.65/1200=53.8% rounded down. Current full integration remains uncredited. GX15.task Context kinds/field mapping/locale/priority/duplicates/egress policy, broader product composition and real Provider qualification remain existing work. This delivery does not reopen completed admission, transport or terminal work. Staging: NOT-RUN — requires authorized Staging environment. Production/cloud/hardware/paid Provider/full local CI: NOT-RUN.
Git Transition Status: remain on codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED. No push, merge, branch creation or CURRENT_HANDOFF refresh.
GX06/GX08 formal deferred subscription registration — 2026-10-02
Registered the existing bounded first-subscription seam against the reviewed 36-target LiveKit policy patch. The Linux formal lane generated Wire, built the registered host and passed 91 observation-contract tests (91/0/0); generated native/protocol bytes matched the tested candidate. Historical FAIL results and the UNKNOWN publication-end cause remain preserved. This adds no progress points and does not claim Staging, Production, hardware, Usage or cloud qualification.
2026-10-03 — GX19 joint ten-role local composition
The joint Task+RTC fixture now provisions the Task quota in the same immutable policy as the RTC quota, and business-failure cleanup waits for the external runner before removing its database and support files. Exact source 5aa421e7403d44bd355ebbc1ad8882012bc534bc built and passed the ten-role Linux Docker runtime: 10/10 services started, private readiness passed, one joint PCM event passed, native RTC participant and independent RTC hold survived Task completion, PostgreSQL facts were projected, and owned cleanup removed all resources. The deterministic Provider fixture made zero external calls; this is local composition evidence only.
Source-bound evidence: docs/development/evidence/m1-v3-gx19-joint-runtime-5aa421e7/index.json. GX19.joint advances by 8.5 points (build 50%, local behavior 25%, integration 10%); total 682.45/1200 = 56.8%. Task-without-RTC, same-device busy/switch, paid Provider, Staging, Production, cloud and hardware remain NOT-RUN. Windows native executables remain disabled after the Defender quarantine event.
Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push, merge, branch creation or CURRENT_HANDOFF refresh.
2026-10-03 - GX19 Task-only no-RTC qualification
Added current-source Linux Docker evidence for
TestCapacityPublicTaskUsageReadback at
eb9c8989c18114fa1d921fc4b21201cca8d2e179: 1 pass / 0 fail / 0 skip.
The bounded Task Gateway/worker -> PCM -> Artifact/Usage path used owned
PostgreSQL/Redis, no LiveKit or RTC, zero external Provider calls and passed
owned-resource cleanup. The device conformance version lock and its 40/0/0
Node consistency suite were refreshed together.
Credit is limited to the existing GX19.joint no-RTC boundary (+0.1 point; GX19.joint 86%; total 682.55/1200 = 56.8%). Same-device busy/switch, handoff, paid Provider, Staging, Production, cloud and hardware remain NOT-RUN. Windows native test executables remain prohibited after the Defender quarantine event.
Evidence: docs/development/evidence/m1-v3-gx19-task-only-eb9c8989/index.json.
Git Transition Status: remain on codex/m1-v3-execution; merge_main_ready
NOT_READY; new_feature_branch_ready NOT_NEEDED; no push, merge, branch
creation or CURRENT_HANDOFF refresh.
2026-10-03 - GX10 governance current-source refresh
Reran the selected governance suite from exact source
331ad0c7cb8db9872569ae107132c43d12e3c841: Linux Docker Go tests 10/10
and current Node suites 96/96, with zero failures or skips. The previously
missing go-cleanhttp@v0.5.2 module was resolved from the offline local cache.
This is corroboration only and adds no points; durable multi-replica settlement,
deployed alerts, live Provider, Staging, Production, cloud and hardware remain
NOT-RUN. Windows native executables were not built or launched.
Evidence: docs/development/evidence/m1-v3-gx10-governance-current-331ad0c7/index.json.
Git Transition Status: remain on codex/m1-v3-execution; merge_main_ready
NOT_READY; new_feature_branch_ready NOT_NEEDED; no push, merge, branch
creation or CURRENT_HANDOFF refresh.
2026-10-03 — GX06 current-source duplex audio evidence
- Added source-bound Linux Docker evidence for
TestPostgresRTCSDKNativeDuplexat clean parent8a07147c8bfa01b8a02ecc4d5091a70eda60a207(1 pass / 0 fail / 0 skip). - Recorded three fresh native ELF builds, two-session signed public SDK duplex, immutable authorization snapshots, packet arrival and simultaneous 880Hz / 1320Hz decoded tones with Docker cleanup.
- Credited only the existing
GX06.audiopartial milestones: 80% / 16 points; overall 697.55/1200 = 58.1%. Multiparty, mute, quality, constrained network/ICE/TURN, recovery, Usage, hardware and external environments remain unqualified. - No Windows native executable was built or launched, and no GX08/GX05/GX03 duplicate credit was added.
2026-10-03 — GX06 current-source mute/unmute evidence
- Added source-bound Linux Docker evidence for
TestPostgresRTCSDKNativeAudioat clean parent1fed00805868973103489046020e86459aebe793(1 pass / 0 fail / 0 skip). - Recorded three fresh native ELF builds, signed public SDK one-way 880Hz decode, mute-to-silence, unmute-to-resumed-audio, authority snapshots and Docker cleanup.
- Added only the existing
GX06.audiolocal_behavior slice: 85% / 17 points; overall 698.55/1200 = 58.2%. The transient SQLSTATE 40001 failed attempt is retained without credit; bidirectional, multiparty, quality, constrained network/ICE/TURN, recovery, Usage, hardware and external environments remain unqualified. - No Windows native executable was built or launched, and no GX08/GX05/GX03 duplicate credit was added.
GX10 independent-pool quota regression - 2026-10-04
Added four-pool capacity and idempotent settlement-after-revocation regressions,
corrected deterministic test-ID collisions, and verified 23/0/0 in Linux Docker.
Runtime contracts are unchanged. Evidence and limits (../development/GX10_QUOTA_LOCAL_QUALIFICATION.md).
No new progress credit or external qualification.
GX10 quota arithmetic correction - 2026-10-04
Fixed remaining-quota integer wraparound while preserving legitimate negative
Usage from cross-week corrections. An unrepresentable positive balance now
fails without a new reservation; exhausted capacity cannot become available
through overflow. Actual Linux PostgreSQL/LiveKit-management race regression:
38 pass / 0 fail / 0 skip. Prior failure and missing-fixture skips are preserved.
Source evidence and limits (../development/GX10_QUOTA_LOCAL_QUALIFICATION.md).
No additional points, native media, rolling settlement or external qualification.
Internal Agents usage capture - 2026-10-04
Added a private adapter for the pinned official Agents cumulative session event.
It preserves model units and unknown completeness, bounds capture memory, and
rejects discontinuities without inventing a new generation or billing result.
Linux official-core qualification passed 28/0/0 with synthetic metrics.
Dispatch/claim/durable Usage integration and external qualification remain open.
See qualification (../development/GX10_AGENTS_USAGE_LOCAL_QUALIFICATION.md).
No public SDK/API or upstream patch change; no new progress credit.
Private native Agent dispatch adapter - 2026-10-04
Reused official SDK create/list/delete with exact generation correlation,
explicit unknown mutation outcomes and duplicate conflict detection. Linux race
qualification passed 86/0/0, including real native management response loss.
This enables no public Agent permission or worker/model execution; durable
business authorization and dispatch wiring remain open.
See qualification (../development/GX07_AGENT_DISPATCH_LOCAL_QUALIFICATION.md).
GX07 durable Agent dispatch intent — 2026-10-04
Added private PostgreSQL dispatch intent/fencing and migration117. A lost or absent native reply never permits automatic recreation; cancellation preserves attempt/native facts and does not prove effective Agent stop. Actual local race qualification:105/0/0; migration contracts:31/0/0. No Agent public API, paid execution, native permission or upstream patch is enabled.
Source-bound qualification (../development/GX07_AGENT_DISPATCH_PERSISTENCE_LOCAL_QUALIFICATION.md). No whole milestone credit; overall59.9%.
GX07 bounded AgentExecution contracts — 2026-10-04
Added canonical create/read/stop resource, grants, Consent and generated Go/TypeScript/C projections without enabling public runtime or paid inference. Reused exact authority timestamp arithmetic and corrected nanosecond ordering rejection. Linux contract/consumer regression: 2337 pass, 0 fail, 0 skip; generated Go/SDK/portal/C compilation passed. Failed setup/old compile-count attempts remain evidence.
Local qualification (../development/GX07_AGENT_EXECUTION_CONTRACT_LOCAL_QUALIFICATION.md). Business authority, model budget, claim and official worker integration continue; no whole milestone credit, overall59.9%.
GX07 durable requested AgentExecution lifecycle — 2026-10-04
Added migration118 and private transaction-owned prepare/read/desired-stop storage. Original Human/AppSession, Room/native generation, ordered input associations and expiry are immutable; expiry floors to PostgreSQL microseconds. Desired stop is absorbing and never fabricates effective stop; observed state remains pending. Existing protected idempotency, current Consent/budget and business claim remain future owning-service duties. No public activation, worker or upstream patch.
Linux race qualification: 215/0/0, ten roots/four packages, including real
PostgreSQL, concurrent duplicate creation, expired-input historical read/stop,
unchanged nonempty117→118 upgrade and existing Room/dispatch regressions. Migration
static tests: 32/0/0, with generated no-diff. Initial104/10/0 failure is preserved:
the canonical aexec_ prefix was absent from the runtime ID validator; corrected with
generated-prefix and AgentPrincipal-separation regression. Evidence and limits (../development/GX07_AGENT_EXECUTION_LIFECYCLE_LOCAL_QUALIFICATION.md).
Source parent0304028e plus declared overlay; not a clean exact-SHA full execution qualification. No additional complete-bridge credit: 719.55/1200=59.9%. Continue current read/stop authority, then Consent/model budget/claim and official worker. Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED. No push/merge/handoff refresh; unrelated pre-cloud plan edit preserved.
GX07 Agent create/stop Consent lifecycle — 2026-10-04
Connected the existing typed Consent HTTP lifecycle to current Agent create/stop authority. Added only create original-AppSession observation metadata in migration119; stop reuses the immutable execution. Historical reads use current independent read Grants, while pending decisions recheck their original complete mutation input. Receipts remain current-bound; no Consume, Agent dispatch, execution or effective stop.
Linux PostgreSQL race: 423/0/0, eighteen roots/four packages. Exact
nonempty118 upgrade and existing RTC/Agent regressions pass; migration static and
generated no-diff 33/0/0. Evidence and limits (../development/GX07_AGENT_CONSENT_LOCAL_QUALIFICATION.md).
Sourceparent2f91475f plus declared overlay, not full execution qualification.
Progress unchanged 719.55/1200=59.9%. Next: server model/region/privacy/budget,
atomic dispatch/audit/protected idempotency and business claim, then official worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push, cloud deployment or handoff refresh; unrelated plan edit retained.
GX07 current Agent model policy — 2026-10-04
Added private current server model/plugin/region/privacy policy selection, exact versioned Secret membership without reads, monotone publication generations and immutable policy versions. Existing AgentExecution storage consumes the selected snapshot with a nonrenewable, narrowed lifetime. Migration120 preserves all old Agent/Consent history with no selection backfill. Task routing reuses extracted identifier/region validation with its prior behavior retained.
Linux race qualification: 568/0/0, 53 Go roots/six packages,
including populated119 upgrade and original Agent/RTC/Provider regressions.
Migration static and generated no-diff: 33/0/0. Evidence and limits (../development/GX07_AGENT_MODEL_POLICY_LOCAL_QUALIFICATION.md).
Parentba3e2dce plus declared overlay, not full Agent execution qualification.
No paid budget, dispatch activation, claim, worker or Provider call follows.
Progress unchanged 719.55/1200=59.9%. Continue bounded operational hold,
atomic dispatch/audit/protected idempotency and business claim, then official worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push/cloud/handoff refresh; unrelated plan edit retained.
GX07 initial Agent operational envelope — 2026-10-04
Private fixed stage/unit cumulative caps and immutable holds extend the existing
RTCQuota/QuotaPolicy owner. One initial hold per real execution; exact replay,
current model/assignment recheck and all-policy/all-period conservative exposure.
No new customer metric, purchased funds, fake business generation, expiry refund,
paid execution or dispatch activation. Migration121 preserves nonempty120 history.
Linux race 188/0/0, 21 roots/three packages; static 40/0/0.
Evidence and explicit limits (../development/GX07_AGENT_OPERATIONAL_BUDGET_LOCAL_QUALIFICATION.md); source parent7c9b9fc5 plus tested overlay,
not complete Agent bridge qualification. Generated outputs differ only by spec
digest and corresponding manifest hashes.
Progress unchanged 719.55/1200=59.9%. Continue the atomic current-authority
execution/dispatch/audit/protected-idempotency owner, then business claim and worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push, cloud change or handoff refresh; unrelated plan edit retained.
GX07 exact Agent dispatch association and initial deadline — 2026-10-04
Extended the existing durable dispatch intent with an immutable optional exact
aexec association; old NULL history remains unassociated. New selection checks
the actual execution/native/model tuple; historical lookup/stop never guesses by
Room or Agent name. Existing RTCQuota supplies a read-only pre-create envelope
deadline so the stored resource does not outlive its initial hold. No new
scheduler, upstream patch, media path, public activation or business claim.
Linux race 328/0/0, 31 roots/four packages, plus separate modified schema117
upgrade 1/0/0; static 40/0/0.
Evidence and limits (../development/GX07_AGENT_ATOMIC_PREPARATION_LOCAL_QUALIFICATION.md); parent7b0eb506 plus tested overlay. Migration122
preserves populated121 history and the original117 upgrade regression.
Progress unchanged 719.55/1200=59.9%. Continue complete current-authority
Control create/read/stop/replay with audit/protected idempotency, then business
claim and official worker. Git Transition Status: codex/m1-v3-execution; merge
main NOT_READY; new feature branch NOT_NEEDED. No push/cloud/handoff refresh;
unrelated pre-cloud plan edit preserved.
GX07 atomic Agent Control owner and current replay — 2026-10-04
Composed existing current Human/input/Grant/Consent/model/quota/budget owners,
one exact execution/hold/dispatch, audit and protected HTTP idempotency in the
original bounded transaction. Historical read/stop survives original create
authority loss; current replay preserves original response without renewal or
redispatch. Explicit fixture route injection only; no production bootstrap,
new migration, native Agent execution or upstream change. Linux race
658/0/0, 83 roots/four packages; static 40/0/0.
Evidence and limits (../development/GX07_AGENT_CONTROL_LOCAL_QUALIFICATION.md); source parent f5949498 plus tested overlay.
Progress remains 719.55/1200=59.9%. Continue original-authority origin and
business claim, then official worker/plugin enforcement. Git Transition Status:
branch codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED.
No push/cloud/handoff refresh; unrelated pre-cloud plan edit preserved.
GX07 Agent business claim and exact native job readback — 2026-10-04
Added a private authenticated owner combining original Human authority, current
model/credential membership, original operational hold and sealed official job
readback. Migration124 retains immutable generations, single-owner fences,
bounded renewal and a one-shot durable possible-effects marker. Release is
not effective stop or refund; no public/native Agent/Provider activation.
Linux race 571/0/0, 52 roots/two packages; static 40/0/0.
Evidence and limits (../development/GX07_AGENT_BUSINESS_CLAIM_LOCAL_QUALIFICATION.md); source parent950d4bd3 plus tested overlay.
Overall remains 719.55/1200=59.9%; continue official Worker/private receiver
and plugin envelope integration, with no complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push, cloud changes or handoff refresh; unrelated plan preserved.
GX07 private Agent claim HTTPS — 2026-10-04
Reused the strict private RTC TLS/JWT/JTI receiver with five closed Agent claim
operations and the existing durable owner. Claims work across receiver instances
without process-local authority; effects are never retried after uncertain response.
No production bootstrap, native Worker, paid Provider or cloud activation.
Linux race 612/0/0, 114 roots/two packages.
Evidence and limits (../development/GX07_AGENT_CLAIM_HTTPS_LOCAL_QUALIFICATION.md); source parentbb78daef plus declared overlay.
Overall remains 719.55/1200=59.9%; continue official Worker/trusted process
credentials and selected plugin envelope. No complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push, cloud change or handoff refresh; unrelated plan preserved.
GX07 trusted Agent claim client — 2026-10-04
Added the bounded trusted Go caller to the existing private receiver and durable
claim owner. Every call uses a fresh signed Service JWT; uncertain effects responses
produce no executable result and are never automatically retried. Strict TLS,
exact scope/owner/lease and retirement shape are verified before returning.
Linux race 636/0/0, 120 roots/two packages; actual TLS and PostgreSQL
lifecycle/revocation/lost-response checks. Evidence and limits (../development/GX07_AGENT_CLAIM_CLIENT_LOCAL_QUALIFICATION.md).
Source parent b5ce5493 plus declared client/test overlay; no runtime bootstrap,
official Worker, paid Provider or cloud qualification. Overall stays
719.55/1200=59.9%; complete GX07.bridge is still unearned.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push or handoff refresh; unrelated plan preserved.
GX07 atomic Agent Worker bootstrap owner — 2026-10-04
Reused the durable dispatch association and signed Service boundary to resolve
closed native job metadata. The existing claim transaction now returns its
final authorized input/model/operational envelope after successful commit.
No extra state store, schema, dispatch, hold refill, effects or upstream patch.
Linux race 751/0/0, 139 roots/three packages.
Evidence and limits (../development/GX07_AGENT_WORKER_BOOTSTRAP_LOCAL_QUALIFICATION.md); parent d6059a7e plus declared overlay.
Actual official Worker/private bootstrap wire/plugin execution remains incomplete;
overall stays 719.55/1200=59.9%, no complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push/handoff refresh; unrelated plan preserved.
GX07 trusted Agent bootstrap HTTPS — 2026-10-04
Reused private RTC HTTPS and signed Service/JTI with the existing atomic
bootstrap owner. Closed configuration delivery now has a trusted bounded caller,
precommit representation validation and committed-response-loss no-replay.
Linux race 886/0/0, 155 roots/three packages.
Evidence and limits (../development/GX07_AGENT_BOOTSTRAP_HTTPS_LOCAL_QUALIFICATION.md); parent 0015640a plus declared overlay.
Official Worker, process credentials and selected plugin execution remain
incomplete; overall 719.55/1200=59.9%, no complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push/handoff refresh; unrelated plan preserved.
E6 current-source aggregate qualification - 2026-10-04
The existing E6 acceptance gate now verifies historical evidence against its
original Git commit/tree and separately verifies fresh local execution against
current dependency bytes. The new isolated PostgreSQL 17.6 race run passed
414 / 0 / 0 across eight selected packages, on parent
7c7f334a35d7798b68650e9530c3906bcb1957a2 plus the exact Consent upgrade test
overlay. This is not clean-SHA or full-CI qualification. All 1,237 captured
repository inputs, 95 package inventories and migration SQL inventory are checked;
eight generated test mains are archived separately from repository source.
The initial 377 / 16 / 0 failure remains archived. Migration 119 adds a nullable Agent create selector; the old snapshot comparison treated its added null key as changed history. The correction independently asserts historical selectors remain null and retains the full old-row/ciphertext/audit/namespace comparison. A version-118 upgrade regression was added; runtime and migrations were unchanged. Failure logs and all declared execution artifacts are authenticated.
Four named exclusions are explicit: the subprocess helper is exercised by its included parent tests; the separate backup and two pristine-cluster role-conflict fixtures remain NOT-RUN in this lane. All owned containers, the source volume and test databases were removed. Linux-only execution published no host ports. The acceptance command no longer reports E6; it still fails E8 ticket-copy, CCR readiness and E10 readiness/CCR-A source evidence. Full CI, Staging, Production, hardware, cloud and real Provider qualification remain incomplete.
Execution evidence (../development/evidence/m1-v3-e6-aggregate-current-7c7f334a/index.json).
This is zero-credit repair within GX12.supply; 721.95/1200 = 60.1%.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED. Unrelated pre-cloud plan changes preserved;
no push, merge, branch creation or handoff refresh.
E8 current-source constructor ticket erasure - 2026-10-04
Two fresh Linux native builds from committed source
79a9ad31907720315a7e6df35ff4b436c384c41c passed the existing constructor
failure sweep for TLS12 and TLS13. Each observed 14 allocations, 14 recoveries,
29 attempt rows and both ticket copies erased before real free. Socket start,
TLS handshake, full native lifecycle, hardware and cloud acceptance are outside
this narrow run; no runtime, SDK or upstream patch changed.
Both initial attempts failed before behavior at CMake dependency resolution: the runner selected an older cache without the current namespace. Correcting the helper to use the already resolved canonical dependency cache preserved the exact upstream component bytes. Those failures remain archived; they are not counted as passing tests. All four runs removed their owned resources.
Current execution and preserved failures (../development/evidence/m1-v3-e8-ticket-current-79a9ad31-raw/index.json).
Historical E8 evidence remains bound to its original SHA. This supplements the
existing GX12.supply acceptance gate without new work items, gates or credit;
total remains 721.95/1200 = 60.1%. Full CI remains unqualified; CCR/E10 and
external Staging, Production, cloud, hardware and Provider gates remain open.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED. Unrelated pre-cloud plan changes preserved;
no push, merge, branch creation or handoff refresh.
CCR current storage and migration compilation evidence - 2026-10-04
The existing CCR scopes now compose independently verified executions: DataSync
235/0/0 at 79a9ad31907720315a7e6df35ff4b436c384c41c, TaskInput 36/0/0 at
858c5d0b3b688494124511ff0c7969ee879df563, and the original E6 migration
parent plus declared test overlay. Complete baseline case identities are retained,
including all 58 migration cases in the latest 94-case Context receipt. Each
run keeps its original source and dependency inventory; no historical result is rebound.
The initial DataSync/TaskInput parent remains FAIL 235/4/0. TaskInput refused the
runner's non-test database name; a separately owned _ci fixture passed all 36
cases and read back all 124 migration versions and digests. BOOT at exact
858c5d0b3b688494124511ff0c7969ee879df563 passed 33 static migration tests,
migration generation and Go/TypeScript/C compilation. Its first compilation
failure from an omitted SDK dependency mount is preserved; the fixed runner
uses the existing read-only SDK cache. All owned fixtures were removed.
Current execution records (../development/evidence/m1-v3-ccr-storage-current-858c5d0b-raw/index.json)
and BOOT provenance (../development/evidence/m1-v3-ccr-storage-current-858c5d0b-raw/boot/index.json)
support only these selected local scopes. Current input checks use actual
compiled dependencies and membership, not unrelated governance files. The existing
four-file migration metadata bridge remains bounded; nonmetadata runtime,
Control API, RTC, capacity and E10 qualification still require their own evidence.
Malformed active v3 ledgers now fail closed instead of falling back to legacy.
No additional credit: 721.95/1200 = 60.1%. Full local CI remains unqualified;
Staging, Production, cloud, hardware and real Provider gates remain NOT-RUN.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new
feature branch NOT_NEEDED. The unrelated pre-cloud plan modification is preserved.
M1 v3 GX12.supply — current public Data Sync PostgreSQL evidence — 2026-10-04
The existing public Control fixtures ran at exact source
558a15a89dd291d7a91539a4d3269c51ad442e60 in isolated Linux with
PostgreSQL17.6 and the existing offline Go cache: 35 PASS / 0 FAIL / 0 SKIP,
one uncached race attempt. This is18 supplemental cases and17 public Scope
cases from the same actual Control package run. The separate migration74 case
reuses the authenticated E6 parent7c7f334a plus its recorded Consent test
overlay; it is not relabeled as execution at558a15a8 or a new19-case run.
The verifier authenticates raw lifecycles, exact case identities,1321 repository dependency inputs,93 package inventories, embedded SQL membership, the generated test main, executed runner files and cleanup. Existing per-case PostgreSQL databases and login roles were removed; the administrative database remained empty before its own deletion. Both owned containers and the source volume were removed with no published host ports. No runtime, migration, SDK or LiveKit patch changed in this increment.
The existing migration matcher composes this scoped proof with current storage/BOOT only for its original four metadata paths. Immutable old receipts and their hashes stay unchanged. Current public Scope17 is independently reported; bootstrap runtime, native admission, changed nonmetadata sources and the historical10000-record/100MiB/20-second capacity assertion remain separate qualification work. Full CCR-A and full local CI are still unqualified.
Staging, Production, hardware, cloud, Provider and hosted CI remain NOT-RUN.
Progress remains721.95/1200=60.1%, with0 new points and no denominator change.
Git Transition Status: codex/m1-v3-execution; no push; merge main NOT_READY;
new feature branch NOT_NEEDED. Preserve the unrelated precloud-plan edit.
Current public execution and distinct migration provenance (../development/evidence/m1-v3-ccr-public-current-558a15a8-raw/index.json).
M1 v3 GX12.supply — current bootstrap and private dispatcher — 2026-10-04
The existing Control bootstrap and private dispatcher tests ran at exact source
95c3d857eb386889ccbb23af3adc8d5a78e05777: 10 PASS / 0 FAIL / 0 SKIP
in two packages, one uncached Linux PostgreSQL race attempt. The three startup
cases cover successful migration verification before runtime construction,
schema verification failure and a missing runtime builder. The seven dispatcher
cases preserve the public handler and reject private-route aliases.
The successful startup test applies the current schema to the explicitly owned database. Raw PostgreSQL stdout preserves all 124 installed migration versions and digests, compared against the exact source manifest. The verifier reuses the existing shared source-closure checker for 1185 repository inputs, 77 package inventories and two generated test mains, and authenticates raw cases, archive bytes, SQL readback and owned cleanup. The database, two containers and source volume were removed; no host ports were published.
This is the existing startup and dispatch scope, not full StartRuntime E2E. The original HTTPS admission fixture requires a real owned LiveKit Room worker; its eight events remain NOT-RUN in this receipt and will join the next existing RTC lane. The old reviewed-bootstrap matcher and its runtime digest stay unchanged; neither public runtime drift nor native admission is bypassed. Full CCR-A, full local CI and capacity qualification remain incomplete.
No runtime, migration, SDK, Provider or LiveKit patch changed. Progress remains
721.95/1200=60.1%, with zero added points. Staging, Production, hardware, cloud,
Provider and hosted CI remain NOT-RUN.
Git Transition Status: codex/m1-v3-execution; no push; merge main NOT_READY;
new feature branch NOT_NEEDED. Preserve the unrelated precloud-plan edit.
Actual startup, dispatch and migration readback (../development/evidence/m1-v3-ccr-bootstrap-current-95c3d857-raw/index.json).
M1 v3 GX12.supply — current RTC scope composition — 2026-10-04
The existing selected RTC union ran at exact source
63c01d2018d5aa2c5d85473200d396b47ef38e3e: 355 PASS / 0 FAIL / 0 SKIP
in three packages with uncached Linux race testing. These are 347 distinct
historical RTC identities plus eight real HTTPS admission identities. There
were no additional current children. The four old scopes total 425 pass events
but 404 distinct identities: 57 are separately reused from verified E6 (22) and
public Control (35), retaining their original source SHA and declared overlays.
They are not counted as executions in the new 355-case run.
The initial attempt at the same source remains 353 PASS / 2 FAIL / 0 SKIP. The native join child and its parent failed because the network-none fixture provided no non-loopback ICE interface. The corrected fixture reuses the existing owned internal bridge, without host ports or external egress; no runtime, SDK, migration, Provider or LiveKit patch changed. Raw logs, source closures, runners and cleanup from both attempts are archived unchanged. The corrected database, containers, volumes and internal network were removed with zero owned residual resources.
The verifier authenticates 1321 repository inputs, 93 package inventories, three generated test mains, actual test lifecycles, raw hashes, fixture isolation and the original evidence sources. Only the four already pinned RTC reference scopes may use this composition. The separately executed bootstrap3/private dispatcher7 and this HTTPS8 also satisfy the existing narrow runtime.go matcher for two immutable Data Sync public receipts, together with the authenticated public and storage proofs. The old reviewed f7cc branch remains intact; no generic runtime/source-hash exception is introduced. The old bootstrap receipt continues to say HTTPS NOT-RUN for its own execution.
This does not qualify full StartRuntime E2E, cmd/control-api/main.go execution,
long-lived native media/policy, capacity, full CCR-A, E10 or the entire local CI
graph. The previous full-acceptance failure remains until its remaining inputs
are actually qualified. Staging, Production, hardware, cloud, Provider and
hosted CI remain NOT-RUN. Progress remains 721.95/1200=60.1%, zero new points.
Git Transition Status: codex/m1-v3-execution; no push; merge main NOT_READY;
new feature branch NOT_NEEDED. Preserve the unrelated precloud-plan edit.
Current RTC composition and original failed attempt (../development/evidence/m1-v3-ccr-rtc-current-63c01d20-raw/index.json).
The affected governance regression finished 82 PASS / 0 FAIL / 0 SKIP,
including the source/receipt tamper checks and bounded I/O tests. The original
active-m1-ccr-rtc-readiness command and its one serial retry both ended with
IDLE_TIMEOUT (exit124,300000ms); those failed attempts are retained. That
unchanged command lane was stopped. Independent source reads and package
inventory reads now use fixed batches of32, drain each complete batch and retain
every hash, source, membership and failure assertion. There is no result cache,
budget increase or artificial heartbeat. The corrected checker completed under
the original budget: FAIL_REMAINING_CCR_QUALIFICATION, exit1, no timeout.
All four RTC stale-reference errors and both pinned bootstrap runtime-path errors
are absent; 56 other source-digest errors remain. Their complete list and both
prior timeout logs are preserved in governance-validation.json. This is scoped
qualification progress, not a full CCR-A/E10/local-CI PASS or additional points.
M1 v3 GX12.supply — current privacy ledger unit qualification — 2026-10-04
The existing complete three-package Linux race suite at exact source
aee79a30c8c37cc628c5de74f1628e2b988fdd59 finished 128 PASS / 0 FAIL / 0 SKIP:
domain/datasync97, domain/datasync/history14 and adapters/privacyledger17.
Every original package/test identity was executed; no additional current child,
test selector, skipped case or source overlay was used. The actual dependency
capture contains66 repository inputs,12 package inventories and3 generated test
mains. Its actual empty embedded-input inventory remains empty. The owned
network-none Linux container and source volume were removed with zero leftovers.
The immutable old receipt retains its original source and local-only limits. Only its two module-lock hash mismatches may use the independently authenticated current complete three-package proof. The shared source-closure checker now accepts explicit unit runner/embed requirements; PostgreSQL callers retain the same six mandatory inputs and full migration SQL membership checks by default. Every caller still verifies actual source hashes, original Git blobs, dependency classification, generated inputs, package membership and executed runner bytes. The bounded I/O implementation is preserved.
This proves local unit semantics with the existing object/fencing probes. Actual
OSS durability, IAM/credential revocation and external in-flight drain remain
NOT-RUN; no PostgreSQL/Redis/LiveKit, Staging, Production, hardware, cloud or paid
Provider qualification is claimed. Full CCR-A/E10/ci:local remains unqualified.
The earlier aggregate56-error result remains historical, not a new aggregate
run for this increment. Points remain721.95/1200=60.1%, zero increment.
Git Transition Status: remain codex/m1-v3-execution, no push, merge main
NOT_READY, new feature branch NOT_NEEDED; unrelated precloud-plan edit preserved.
Current privacy-ledger source-bound unit evidence (../development/evidence/m1-v3-ccr-ledger-current-aee79a30-raw/index.json).
M1 v3 GX12.supply — generated Data Sync evidence repair — 2026-10-04
Authenticated actual source-bound generator/package PASS and configuration3,
Pages6, W08behavior11; the complete20/1/0 parent remains FAIL. Narrow immutable
bindings reuse ledger90/128 and independent BOOT compilation; corrected full21
rerun awaits the next committed source. No runtime or patch change, no cloud
claim and no duplicate credit:721.95/1200=60.1%. Git Transition Status: remain
codex/m1-v3-execution, merge main NOT_READY, new branch NOT_NEEDED, no push.
Evidence and preserved initial failure (../development/evidence/m1-v3-ccr-generated-current-b15335b2-raw/index.json).
M1 v3 GX12.supply — corrected exact-source Data Sync suites — 2026-10-04
The corrected configuration3, Pages6 and W08runtime12 suites actually completed
21 PASS / 0 FAIL / 0 SKIP, with no cancelled/todo cases, on committed source
da82bdd523a9f26c6251a2504157400f26f81fe1. The complete committed snapshot is provenance only;
the actual Node trace records21 repository modules,170 dependency files and40
generated JavaScript artifacts. Before/after source and dependency readback
passed; the owned container and volume were removed with zero leftovers.
The original b15335b2 parent remains 20 PASS / 1 FAIL / 0 SKIP. Its generator
and reproducible package results, the independent BOOT compilation and the
separate ledger/domain evidence keep their original source bindings. This new
run executes only the three existing Node suites; it does not rerun those
independent compiler/package checks or qualify full Data Sync/CCR-A/E10/ci:local.
Existing Ajv unknown date-time-format warnings are retained; no date-time-format
qualification is inferred. Real OSS/IAM, Desktop storage, Staging, Production,
cloud, hardware and paid Provider checks remain external NOT-RUN gates.
Continue the existing SQL qualifier-input gaps and remaining capacity/aggregate
checks. No runtime, migration, SDK behavior or LiveKit patch changed here.
Progress remains721.95/1200=60.1%, with no duplicate credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; continue locally without push. The unrelated
precloud-plan edit remains preserved.
Actual corrected suite and preserved initial failure (../development/evidence/m1-v3-ccr-generated-corrected-da82bdd5-raw/index.json).
M1 v3 GX12.supply — SQL and Consent evidence continuity — 2026-10-04
Nine immutable SQL scopes now use the existing authenticated DataSync235 and E6 migration evidence for the exact changed qualifier input. Six Consent receipts reuse only the E6-executed test correction, including the original version43 and added version118 assertions. Original receipt bytes, all other source checks, failed parent235/4, E6 source plus overlay and external gates remain unchanged. Missing old proof bytes remain explicitly missing; the subsequent overwritten FAIL observation is retained. The host qualifier CLI was not rerun and no worker/capacity scope is implied by these narrow checks.
Affected regression: 68 PASS / 0 FAIL / 0 SKIP. The complete CCR check
actually finished FAIL with34 remaining source-qualification errors,
down from the retained56-error checkpoint; it did not time out. This comparison
also includes the independently committed ledger/generated repairs. The
Authority check passed. These are checker/evidence repairs on parent
a1c8ea8fe7736d3d9490b886cd6f733cf9e0377b plus the declared22-file governance overlay,
not a new SQL runtime execution or full CCR-A/E10/ci:local qualification.
Continue the existing worker matrix and snapshot process host in isolated
Linux/PostgreSQL, including four previously unavailable DSN/process tests.
Remaining public API, generated-input, worker/host and qualifier composition
errors stay explicit. No runtime, migration, SDK behavior or LiveKit patch was
changed; Staging/Production/cloud/hardware/paid Provider/Desktop remain NOT-RUN.
Progress stays721.95/1200=60.1%, without duplicate credit.
Git Transition Status: remain codex/m1-v3-execution, merge main NOT_READY,
new feature branch NOT_NEEDED, no push; unrelated precloud-plan edit preserved.
Exact checks, retained failures and remaining34 errors (../development/evidence/m1-v3-ccr-qualifier-continuity-a1c8ea8f-raw/index.json).
M1 v3 GX12.supply — worker test repair and generated limits continuity — 2026-10-04
The original exact 2325cadb5faabb96970ccabc2df74c6f95c658fe worker run remains 117 PASS / 1 FAIL / 0 SKIP.
The snapshot-host test reported owned snapshot readback failed after 51.78
seconds. Its 10-second database context began before the independent build;
context expiry is the source-and-elapsed diagnosis, not an emitted error text.
All original raw artifacts are preserved. The test-only correction moves the existing bounded
build before that context. No runtime behavior or time budget was widened.
On that same parent plus the exact declared test overlay, the complete existing ten-package worker lane actually passed 118 / 0 / 0. All four required PostgreSQL/process cases passed. Original case identities, actual Go imports, generated testmain bytes, raw logs, isolation and owned cleanup are archived. The first failure has confirmed container/volume cleanup but no fabricated postrun database readback. The corrected run confirms per-case database/role cleanup and zero remaining owned containers/volumes.
The four immutable receipt bindings for generated Data Sync limits now reuse the exact header-only change through existing generator, BOOT compile and SQL source evidence. Other CLI/worker/capacity differences remain fail-closed. Affected governance tests actually passed 77 / 0 / 0 against the frozen read-only worktree. Its generic receipt does not capture an overlay inventory; the reviewed five governance source hashes are separately declared. The worker execution itself uses only the one test overlay, not those governance files. Four actual caller checks also retain the remaining CLI/backlog errors, and the Linux gofmt check passed; both raw runs and the caller helper are archived.
This is precommit overlay evidence. Exact committed-source worker rerun is
PENDING / NOT-RUN until the repair is committed and that execution completes.
Full CCR-A, E10 and ci:local are not newly qualified; the earlier 34-error CCR
observation remains historical, not an updated result from this increment.
Staging/Production/cloud/hardware/paid Provider/Desktop remain external NOT-RUN.
Progress stays 721.95/1200 = 60.1%, with zero new credit.
Git Transition Status: remain codex/m1-v3-execution, merge main NOT_READY,
new feature branch NOT_NEEDED, no push; unrelated precloud-plan edit preserved.
Actual runs, exact overlay hashes and retained failure (../development/evidence/m1-v3-ccr-worker-repair-2325cadb-raw/index.json).
Current Worker exact-source qualification and retained governance results#
Exact source d11c57097ddd716610020bbb1ab5099b134aeb9c passed the existing ten-package Worker lane 118 / 0 / 0.
The first composition check remains FAIL 9 / 1 / 0; corrected source-path
normalization passed 21 / 0 / 0. Actual snapshot caller errors are zero;
capacity still reports its existing qualifier CLI source difference.
The current full CCR attempt is INCOMPLETE_IDLE_TIMEOUT (watchdog exit 124;
stopped container exit 143, owned container removed). Current error count is UNKNOWN.
The previous completed 34-error observation remains historical and is not rebound.
The exact current result and historical reference (../development/evidence/m1-v3-ccr-worker-current-d11c5709-raw/governance/full-ccr/errors.json) are retained.
Generic governance receipts did not capture an overlay inventory. The five
current source byte overlays and the original failed helper are separately
declared in the governance record (../development/evidence/m1-v3-ccr-worker-current-d11c5709-raw/governance/governance-validation.json).
The immutable Worker index and historical evidence were not rebound.
Public contract evidence retains initial 16 / 1 / 0 and test-only overlay
17 / 0 / 0. Exact committed-source routing and snapshot Builder runs remain
PENDING / NOT-RUN; those independent prepared lanes continue after this commit.
No automatic CCR rerun or new gate is introduced. This increment does not promote G_PRE, full ci:local or cloud
qualification; external Staging/Production/hardware/Provider/Desktop/hosted CI
remain NOT-RUN. Progress remains 721.95/1200 = 60.1%, with zero new credit.
Git Transition Status: remain codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is preserved.
M1 v3 GX12.supply — Public and Builder exact-source evidence — 2026-10-04
Exact committed source 70d5498828274299a20d2dfe4452729ac4190b3f
completed 17/0/0 Node public contracts, 90/0/0 Go operation-routing
identities, and 15/0/0 Snapshot Builder unit/configuration identities.
The routing root substitutes business authority and proves routing coverage;
it does not qualify all current authorization behavior. Builder uses the
existing fake store and does not qualify PostgreSQL or a native Builder host.
Actual Node reads/imports, schema/handler membership, Go imports/testmain,
source snapshots and zero remaining owned resources are archived separately.
Only executed inputs are current authority; broad snapshots are provenance.
The two unchanged historical Public receipts now compose ten specified source bindings with these runs and existing P35, generated, BOOT and Pages evidence. Whole original receipts remain immutable. Missing old proof bytes, the unexecuted historical qualifier CLI and unselected full package profiles remain unqualified. The Builder supplement is registered for subsequent existing component checks, without adding a new gate or runtime requirement.
Affected evidence regressions passed 33/0/0 (Public plus the reused generated helper) and 14/0/0 (Builder). The initial Builder checker run 13/1/0 is retained: its negative fixture removed only one duplicate Go input record, leaving the real input union intact. The corrected fixture removes all occurrences; the production verifier was not weakened.
CCR now emits one optional event after each real validation stage completes. Validator order, error collection, result and watchdog budgets are unchanged; there is no timer-based heartbeat. The actual full run completed all 34 stages in about315 seconds with 25 remaining errors, FAIL, and no timeout. This observation predates the Public source composition. It is not rebound to the subsequent edits. The full acceptance entry point opts into the same observer; its complete execution is NOT-RUN in this increment. The previous idle-timeout attempt and historical34 errors remain unchanged.
Actual post-registration Public Scope and Public Read caller checks now each report only their existing qualifier-tool difference: all14 reviewed non-CLI source-difference occurrences are resolved across the two receipts. The registered Builder loader also validates all15 identities. This is an affected caller observation, not a rerun or relabeling of the earlier full CCR25 result.
Continue the eleven existing qualifier-tool component bindings using their independently executed semantics, affected capacity contracts and then the remaining E10/full local CI work. Current CLI invocation, complete old profiles, Staging, Production, cloud, hardware, paid Provider and Desktop qualification remain explicit NOT-RUN. No runtime, migration, SDK or LiveKit patch changes were made in this increment.
Progress remains 721.95/1200 = 60.1%, with zero duplicate credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit
is preserved.
Public raw source proof (../development/evidence/m1-v3-ccr-public-contracts-current-70d54988-raw/index.json); Builder raw source proof (../development/evidence/m1-v3-ccr-builder-current-70d54988-raw/index.json); Completed CCR failure and stage output (../development/evidence/m1-v3-ccr-stage-observation-70d54988-raw/index.json).
M1 v3 GX12.supply — component qualification and complete CCR readback — 2026-10-04
The eleven existing component receipts now authenticate the exact reviewed qualifier-tool change using independently executed SQL, migration, Public, Worker, domain, generated and Builder evidence. Existing nine-SQL eligibility remains separate. The complete original receipt, selected root and descendant identities, source SHA/overlay, previous failed parents and external limits remain enforced. No raw log is reconstructed and no current CLI run is claimed. The shared matcher remains per invocation; it cannot cache a global PASS.
Actual bounded Linux checks on parent
4afbfbc70fdccf5a14fee9ecd64ababd2329247f plus the declared eight-file overlay:
- Component, retained SQL and migration regressions: 39/0/0.
- All nine actual SQL callers plus integration counterexamples: 14/0/0.
- Existing capacity reference-model and qualification contracts: 3/0/0.
- Complete CCR checker: 34 completed stages, zero errors, normal exit0 and zero owned containers remaining. The prior completed25-error failure is retained unchanged with its original source and observer overlay.
This establishes current local checker consistency. The authoritative CCR-A
manifest still says IN PROGRESS — Data Sync implementation and local
qualification. It does not promote full CCR-A, G_PRE, complete historical
CLI profiles or full ci:local. Original runtime test sources remain their
respective committed SHAs; this checker overlay is not a replacement runtime
execution. Full acceptance and the remaining exact-candidate local CI continue
at the existing execution cursor.
Builder coverage remains unit/configuration only; routing coverage retains its substituted authority; the capacity reference model establishes no real capacity number or multi-replica/cloud result. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No runtime, migration, SDK or LiveKit patch changes are included.
Progress remains 721.95/1200 = 60.1%, with zero duplicate credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit
is preserved.
Exact source overlay, actual checks and retained prior failure (../development/evidence/m1-v3-ccr-component-continuity-4afbfbc7-raw/index.json).
M1 v3 GX12.supply — E10 historical and current acceptance binding — 2026-10-05
The existing acceptance checker now verifies the immutable E10 record hashes
against commit 1259c542f33036bb943530a416f0c2af713762a2, independently pins
the two reviewed current documents, and still runs every existing current E10
and CCR validator. The old ledger and its evidence have not been rewritten.
The reviewed document changes retain twelve historical GX03 summaries, six
current source-bound references and the 4608-byte private metric record limit.
Their document hashes do not qualify those historical summaries as new runs.
On parent e3dc59b3de01980910377f889b3b679c815bfa55 plus the declared
three-file governance overlay, the ten E10 regression tests passed with zero
failures/skips. The complete M1 acceptance checker passed; all34 CCR stages
completed with zero errors. The earlier two-error acceptance failure remains
archived unchanged. Both runs exited normally and removed their owned containers.
This is local acceptance-checker consistency, with m1_completion_proven:false.
Full ci:local, full CCR-A, G_PRE and external qualification remain unfinished.
No runtime, migration, SDK, Provider or LiveKit patch changed. Continue the existing
full local CI cursor; no new audit gate or denominator is introduced.
Progress remains 721.95/1200 = 60.1%. Git Transition Status:
codex/m1-v3-execution; merge main NOT_READY; new branch NOT_NEEDED;
no push. The unrelated precloud-plan edit is preserved. Staging, Production,
cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN.
Actual checks, original failure and exact source bindings (../development/evidence/m1-v3-e10-acceptance-provenance-e3dc59b3-raw/index.json).
M1 v3 GX12.supply — Redis loss proof in the owned Linux CI namespace — 2026-10-05
The existing Redis loss proof now accepts an explicit Linux CI runner ID and ownership marker, verifies its label and actual network namespace, and creates only its own Redis fixture in that namespace on a free loopback port. It does not publish a host port in this mode. The default Linux host-published mode is preserved; Windows native/Go execution is rejected. The original Go seed, unavailable and empty-restart commands and assertions are unchanged. Cleanup verifies the exact fixture identity and zero remaining owned containers before the final PASS. No Docker settings, Defender settings or runtime code changed.
On parent bb9fd6cb1871417ea1746099735d8fcd5521edf8 plus the declared
two-file tool/test overlay, affected Linux orchestration and existing scheduler
contracts passed 35/0/0. These include command doubles and are not35 real
Redis cases. A separate actual Redis run passed all three original phases:
seed / unavailable / missing, with normal exit0, source unchanged and
confirmed owned cleanup. Two earlier real failures remain archived unchanged:
the first could not execute from /tmp; the second completed seed but could
not execute the cached Go binary from /gocache. The ignored runner's Linux
tmpfs exec options fixed these failures; its owned child-name readback assertion
was also tightened. The tracked tool/test hashes and Go proof assertions did
not change between those attempts.
A separate empty-payload network observation found daemon-host loopback ECONNREFUSED and OSV HTTPS TLS verified / HTTP200. It sent no repository content or credentials and is neither a dependency-audit PASS nor CI evidence. The owned namespace path removes that host-networking dependency for this fixture. All original failed logs and each ignored producer revision are retained.
This increment does not qualify full ci:local, full CCR-A, G_PRE, Production
capacity or any external environment. Continue the existing full local CI
cursor using the owned Linux source-volume runner; no new gate or denominator.
No runtime, migration, SDK, Provider or LiveKit patch changed.
Progress remains 721.95/1200 = 60.1%, with zero added points.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit
is preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain NOT-RUN. Full ci:local is NOT-RUN in this increment.
Original failures, actual Redis phases and bounded regression records (../development/evidence/m1-v3-redis-container-ci-bb9fd6cb-raw/index.json).
M1 v3 GX12.supply — complete CI setup and pinned raw evidence preservation — 2026-10-05
Eight exact-source Linux CI attempts at 6dc61a0c018bc3a22701a2e148c58e2b697c2e12
remain FAIL/INCOMPLETE with their original receipts, producer bytes and logs.
The owned source-volume runner reuses existing fixed Linux tools and fixtures;
the repository's complete corepack pnpm ci:local command remains unchanged.
Cache-copy and optional build-cache-transfer timeouts, readonly module-directory
extraction, runtime path validation, pnpm configuration/patch revalidation and
missing offline public metadata failures are retained separately. Preparation
probes and Python toolchain compatibility are observations, not product tests.
The final attempt completed normal pnpm frozen-lockfile/frozen-store installation into fresh owned node_modules from the read-only repository package store. Public package metadata was allowed for the unchanged supply-chain policy; package downloads were not substituted for the frozen store. No timestamp or dependency-validation bypass, capability escalation, Docker/Defender setting change or Windows native execution was used. All owned fixtures were removed.
That actual CI command then failed OS-PLATFORM-0009's pinned raw receipt check:
the original registry already pins the 2163-byte CRLF receipt, while Git had
normalized its committed blob to 2093 LF bytes. The narrow correction preserves
that existing receipt unchanged using one path-specific -text attribute and
commits its original bytes. The registry's pinned SHA and historical result are
unchanged. Runtime, migration, SDK, Provider and LiveKit patch code did not change.
Affected checks and Git roundtrip evidence are recorded with their own actual source/overlay bindings in the index. They do not turn the failed complete CI into PASS. Resume the unchanged full CI command after committing this correction. Progress remains 721.95/1200 = 60.1%, with zero added points and no new gates.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit
is preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain NOT-RUN. Complete local CI remains FAIL/INCOMPLETE.
Original attempts and scoped correction evidence (../development/evidence/m1-v3-local-ci-setup-6dc61a0c-raw/index.json).
M1 v3 GX12.supply — installed dependency evidence portability — 2026-10-05
The complete unchanged Linux corepack pnpm ci:local command at
875a6939e8006bd7dc4a9758cdb9a25c13e61998 remains FAIL/INCOMPLETE.
Normal frozen dependency installation and preceding contract checks succeeded,
but acceptance completed 34 CCR stages with 26 source-drift errors. The original
receipt, actual producer and logs are retained; all owned resources were removed
and the exact source stayed unchanged. No runtime CI qualification is inferred.
The narrow correction preserves the original pinned Pages domain log in Git and
makes evidence comparison account for pnpm's regenerated installation timestamp.
Actual fresh installation changed only prunedAt: Generated 420 dependency
files retained their bytes and resolution; Public 169 files had only that
metadata-byte difference and no resolution difference. Lock bytes stayed exact.
Canonical JSON validation rejects duplicate keys instead of accepting a parsed
object with a discarded conflicting value. Final affected regression passed
59/0/0, and the real fresh-metadata comparison passed separately.
Original historical pins and failed results remain unchanged. Dependency content,
lock bytes, resolver paths and all non-timestamp installed metadata retain their
existing checks. The recorded readback and affected checks bind only their actual
source/overlay. Initial 58/0/0 regression and acceptance 34 stages / 0
errors belong to the pre-canonical overlay; final
canonical-parser regression and fresh-metadata checks have separate bindings.
The final standalone acceptance is not rerun: the next complete CI includes it.
This does not promote historical whole-profile results or mark
the failed complete CI as PASS. Runtime, migrations, SDK, Provider and LiveKit
patch code remain unchanged.
Progress remains 721.95/1200 = 60.1%, with zero added points and no new gates.
The unchanged complete CI must run again from the next committed candidate.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain NOT-RUN.
Actual failed CI and scoped evidence correction (../development/evidence/m1-v3-ccr-install-state-875a6939-raw/index.json).
M1 v3 GX12.supply — historical raw evidence and format preservation — 2026-10-05
The unchanged complete Linux corepack pnpm ci:local at 6d732060bec2006ba468002615a302b347e9f464 remains
FAIL/INCOMPLETE. Existing acceptance finished all 34 CCR stages with zero
errors, the lock check passed, and the real OSV dependency audit passed for 76
packages. Those are only the observed command scopes; runtime CI did not finish.
Format then rejected two prose EOFs and seven historical raw-output files.
The original failed receipt, producer, logs and source identity remain archived.
The correction adds only the missing final LF to the two prose documents. Seven exact raw paths require their original SHA-256 plus explicit Git attributes before whitespace exemptions apply; neighboring paths and changed raw content remain checked. All seven original working byte sequences and historical pins remain unchanged. One portal log had previously been normalized in Git; its original 2595-byte CRLF content is restored to match the unchanged registry pin, with the previous 2507-byte Git blob recorded separately. No historical test result is upgraded. Affected regression passed 6/0/0 at its declared source overlay. Runtime, migration, SDK, Provider and LiveKit patch are unchanged.
Progress remains 721.95/1200 = 60.1%; zero points and no new gates.
The next committed candidate still needs the unchanged complete CI.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain NOT-RUN.
Actual failed CI and scoped correction (../development/evidence/m1-v3-format-provenance-6d732060-raw/index.json).
M1 v3 GX12.supply — registry EOF correction — 2026-10-05
The unchanged complete Linux corepack pnpm ci:local at 7054d3e89bce7b6fd082410cbca4d3de56c6451e remains
FAIL/INCOMPLETE. Existing acceptance completed all 34 CCR stages with zero
errors; lock verification, the real 76-package OSV audit and full format checks
passed at that exact source. Those command results do not qualify complete CI.
The next branch-diff check found one extra final blank line in
docs/development/contract-requests/registry.yaml at line 3217.
The correction removes exactly one trailing LF from the 149037-byte committed registry. Its body, parsed meaning, nine Contract Requests and original evidence pins are unchanged. Actual contract and generated-fixture checks passed at this one-file overlay. The Linux readonly-mount branch-diff invocation failed with exit 1 and empty output; its cause remains unestablished and its raw failure is retained. The same existing branch-diff checker passed separately in bounded Windows Node/Git only, with no native test execution. That result does not prove the Linux failure repaired. The failed complete CI receipt, producer and logs retain their original source; all owned fixtures were removed. Runtime, SDK, migration, Provider and LiveKit patch code did not change.
Progress remains 721.95/1200 = 60.1%; zero points and no new gates.
The next committed candidate still needs unchanged complete CI.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain NOT-RUN.
Actual failed CI and one-LF correction (../development/evidence/m1-v3-registry-eof-7054d3e8-raw/index.json).
M1 v3 GX12.supply — native webhook field scan classification — 2026-10-05
The unchanged complete Linux corepack pnpm ci:local at 77169f7969f7d1cfcfd2b772a9eb13e61e04cebe remains
FAIL/INCOMPLETE. Existing acceptance completed all 34 CCR stages with zero
errors; lock verification, the real 76-package OSV audit, full format, branch-diff
and specification checks passed at that exact source. Those observed command
results do not qualify complete CI. The forbidden-contract scan then flagged
agent_budget_integration_test.go for one official native webhook field.
The correction adds that exact existing integration-test path to the scanner's existing native integration-test allowlist and extends its existing regression suite. The native test and Go/runtime bytes are unchanged; no directory-wide allowance, new runtime abstraction or canonical media contract is introduced. Actual affected regression passed 7/0/0, and the existing full forbidden-contract scan passed at the declared two-file overlay. Earlier receipts retain their exact source identities. All owned CI resources were removed.
Progress remains 721.95/1200 = 60.1%; zero points and no new gates.
The next committed candidate still needs unchanged complete CI.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain NOT-RUN.
Actual failed CI and scoped native webhook field classification (../development/evidence/m1-v3-native-track-provenance-77169f79-raw/index.json).
M1 v3 GX12.supply — Portal workspace root and framework provenance — 2026-10-05
The unchanged complete Linux corepack pnpm ci:local at 81a4f1495939998e2aa0766ce2217569fb9906d8 remains
FAIL/INCOMPLETE. The existing acceptance and separate CCR-readiness invocations
each completed 34 stages with zero errors. Lock/OSV, full format, branch diff,
specification/generated consistency, fresh-schema migration, selected local SDK
and Linux native proof commands, and the synthetic JavaScript quickstart passed
within their observed scopes. This is not complete CI or hardware qualification.
Actual Next.js 16.3.6 output shows that automatic root discovery ignored the
workspace because HOME was inside /workspace/.build/ci-home; resolution was
then confined to /workspace/apps/developer-portal, unable to locate Next.js.
The correction explicitly sets the existing Portal Turbopack workspace root.
The build proof and existing test now read the actual installed framework version
and compare it with the exact package pin, instead of labeling a 16.3.6 build as
16.3.3. Official root configuration (https://nextjs.org/docs/app/api-reference/config/next-config-js/turbopack#root-directory)
explains this setting. Historical E9 16.3.3 evidence remains unchanged.
The separately closed affected qualification proves two byte-identical private
static exports and 23/0/0 affected tests at the declared three-file
overlay. It does not rebind the original failed CI to corrected source, start a
public deployment, or qualify complete CI. All owned resources were removed.
docs/developer/CHANGELOG.md is itself a Portal build input and receives this
closure entry after that affected build. Therefore this export qualifies only
the recorded parent plus three-file overlay, not the final documentation or next
commit. The next complete CI must rebuild the final committed source and docs;
the archived proof is not installed into the host .build or rebound.
Progress remains 721.95/1200 = 60.1%; zero points and no new gates.
The next committed candidate still needs unchanged complete CI.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain NOT-RUN.
Actual failed CI and scoped Portal root correction (../development/evidence/m1-v3-portal-root-provenance-81a4f149-raw/index.json).
M1 v3 GX12.supply — current CI language expectations and fixture provenance — 2026-10-05
The unchanged complete Linux corepack pnpm ci:local at 47e4a910999ed25ead9ea1530d4a56f9d16bc06b remains
FAIL/INCOMPLETE. Its two existing 34-stage CCR validations completed with zero
errors and preceding lock, format, branch-diff and spec checks passed within
those commands' scopes. Actual Node and Go failures then occurred. The inner
command ended with ATTEMPT_TIMEOUT; its child command receipt and complete
suite aggregate were unavailable. The outer producer exited 1 with no outer
watchdog timeout. Source bytes remained unchanged and all owned resources were
removed. Partial output is not a complete or zero-failure test result.
The corrections update the catalog test's explicit current 26-Action expectation,
independently bind E9 harness tests to current source and generated manifests
while rejecting historical qualification, and run the existing --write-lock
generator for the current Device conformance asset. The host generator failed
on the missing yaml dependency; the isolated Linux generator succeeded.
Historical acceptance Ledger and browser/operator receipts remain unchanged.
The four HTTP fixtures obtain fresh Device authority after generation-changing
revoke/restore, retain old-token rejection, and use dedicated two-seat Rooms
so capacity cannot mask lock-order checks. Public Room limits, runtime code
and protocol semantics remain unchanged. No manual browser execution is claimed.
The isolated Python toolchain preparation preserves its first failed attempt, then demonstrates the old launcher's failure and the corrected launcher's success under the existing closed environment. That observation qualifies only toolchain compatibility; the later actual product tests carry their own scope.
The first affected batch at its original seven-file overlay recorded Node
19/0/0, Catalog 3/0/0, Providers 117/0/0, Mock 104/0/0 and Task
shutdown 19/0/0. The HTTP group recorded 194 pass / 7 failure events /
0 skip, including parent failure summaries. Those original source bindings
and failed raw logs are retained. Its two deterministic Portal builds covered
13 routes and 91 files, with export digest
56bc6838e37c17e3f62a8f0dbb566d144cda438c114fbaf933301012bf7936ae.
This export precedes the closure CHANGELOG/documentation changes and does not
qualify the final committed export. The next complete CI must rebuild it.
The separate follow-up changes only two fixture files: the capacity-lock
observer applies to the human path, and the Device probe requires old tokens
to return 401/token_invalid while a fresh authenticated token without the
read grant returns 403/grant_missing. No grant is added. The complete
TestProductRealtimeRedisIssuanceAndRevokedReplay root passed 94/0/0 with
its format and module-integrity checks. The earlier green lanes were neither
rerun nor rebound to this corrective overlay. Both runs have confirmed zero
remaining owned containers, volumes and networks. Their results do not qualify
unrelated or interrupted suites, or complete CI.
Progress remains 721.95/1200 = 60.1%; zero points and no new gates.
Complete CI still requires a successful run of the committed candidate.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain NOT-RUN.
Actual CI failures and scoped current-source corrections (../development/evidence/m1-v3-ci-language-provenance-47e4a910-raw/index.json).
M1 v3 GX07.bridge — Control API Agent Host composition prerequisite — 2026-10-05
Control API now composes the existing public AgentExecution and private Bootstrap/Claim owners behind explicit, validated operator configuration. The existing Service identity, PostgreSQL authority and exact private routes remain in force; credential membership performs no Secret backend reads.
Actual Linux qualification on 04f0088c4d52d41b845f13017b04e691cc03baf3 plus the declared 16-file Go overlay:
315 pass / 0 fail / 0 skip; the dependent Gateway fixture is separately
compile-only. Tested inputs stayed unchanged and owned resources were removed.
The preceding exact-parent complete CI remains FAIL/INCOMPLETE due to E6/CCR
source bindings; its raw failure and all historical evidence are preserved.
Reconcile affected closures before another unchanged complete CI run.
This prerequisite does not complete GX07.bridge or add points:
721.95/1200 = 60.1%, with GX07 still 0%. Actual Worker/session/plugin effects,
renew/revoke and output/Action/Usage integration remain; external qualification
is NOT-RUN. Git Transition Status: codex/m1-v3-execution, merge main NOT_READY,
new branch NOT_NEEDED, no push. Preserve the unrelated precloud document.
Actual Agent Host qualification and retained CI failure (../development/evidence/m1-v3-agent-host-composition-04f0088c-raw/index.json).
2026-10-05 — CCR current-source closure#
- Bound E6, PG5, Storage, RTC and dependent composition checks to the exact current source
dfe3651cc75ef4f331ac97680cc3678e04f41f41. - Kept historical Storage and E6 archives on explicit historical verification paths; retained the PG5 parent failure and TaskInput follow-up separately.
- Added current Storage lane assertions and updated Consent revalidation coverage to consume authenticated qualifier/Consent corrections without changing external NOT-RUN gates.
- Local evidence: 101/0/0 affected governance checks, 13/0/0 Storage boundary checks, 9/0/0 component checks and 6/6 real revalidation validators. No hosted or cloud qualification was performed.
2026-10-05 — E6 current-source fail-closed hardening#
- Required the active E6 reference to use the exact DFE3651C current archive; historical 7C7F334A evidence is now historical-only.
- Added the legacy-selection regression and reran E6 17/0/0, affected governance 101/0/0, six real Consent/Data Sync validators 6/6, and Registry hash validation.
2026-10-05 — current-source GX19 contract evidence#
- Added source-bound current commit evidence for the 44-case Node Task/RTC contract suite (44 pass, 0 fail, 0 skip).
- Kept the Windows-native execution guard and all external qualification limits explicit; no progress denominator or earned points changed.
2026-10-05 — historical acceptance test bindings#
- Corrected three legacy acceptance assertions to preserve E4 historical snapshot provenance and reuse the existing E10 historical/current document validator.
- Affected acceptance/progress/provenance tests passed 84/0/0. Historical pins, current runtime gates and external NOT-RUN states are unchanged; full local CI is still unqualified.
2026-10-05 — portable local validation evidence#
- Archived an existing governance receipt and logs so the status document works in an isolated committed checkout without the host
.buildcache. - Retained the exact
0101f590full CI failure at the documentation check; later CI lanes remain unexecuted by that attempt.
Complete-CI empty output archive correction — 2026-10-05
Preserve the original empty stderr bytes in a lossless wrapper and retain the
failed exact ff40d525 CI attempt. No runtime, CI gate or progress credit changed.
Complete local CI remains unqualified pending a successful candidate run.
Partial official Agent business lifecycle — 2026-10-05
- Reuse existing HTTPS owners for bootstrap/effects/renew/stop/release of one official job, with independent expiry and honest unconfirmed-stop reporting.
- Linux race regressions passed 88/0/0 on the declared parent plus overlay. This does not activate a production Worker or qualify native Provider effects.
- Preserve the exact-parent full-CI timeout separately; no complete-CI or bridge points, new gates, upstream patch changes or external qualification.
CCR immutable Git read reuse — 2026-10-05
- Reuse exact immutable Git objects within one evidence-check context. Current source, logs, Ledger and ancestry remain live reads; no extra PASS cache.
- The three affected suites passed 35/0/0. All original 34 CCR stages passed before and after, measured at 234.114s and 190.684s (18.6% reduction in one sequential pair). Full CI and product capacity are not qualified.
- Preserve the initial dependency-layout failure and corrected environment records. No runtime, SDK, migration, upstream patch or progress credit change.
Local CI fixture separation and immutable journal regression — 2026-10-05
- Build actual Control from current source for the diagnostic fixture when no explicit packaged artifacts are supplied. Partial/invalid explicit artifact configuration still fails. Reuse owned PG/Redis and HTTPS Consent setup; remove unrelated LiveKit/Room execution prerequisites from this SQL diagnostic.
- Separate Realtime command Redis DB6 from Control command policy DBs0–5. Include FK dependants in the journal TRUNCATE probe, preserving required immutable-guard SQLSTATE23514 and unchanged durable rows.
- Affected Linux race suites passed63/0/0. Preserve the exact-source full CI-phase failures/timeouts and a separate live-policy-window probe that did not prove its timing condition. No runtime/SDK/migration or progress change.
Official Worker process handoff — 2026-10-05
- Reuse official AgentServer PROCESS prewarm/entrypoint and the existing Go business bridge through a bounded private Unix job channel. Signing keys and claim handles remain in Go; selection uses the existing redacted private wire.
- Correct multiprocessing test entrypoint import with a main guard. Real Linux spawn/forkserver, idle prewarm and Go/Python interchange are covered.
- Exact parent af0a0fe0 plus nine source files passed139/0/0. This consumer still rejects an unavailable plugin graph before effects; host activation and active plugin/media/Usage qualification remain incomplete. No GX points.
Fixed official Agent graph construction — 2026-10-05
- Resolve selected exact-version credentials through the existing Provider credential source after business effects admission. Reuse the private job channel, fixed official OpenAI1.8.2 graph and explicit host endpoint/privacy bindings; no ambient model/credential fallback or upstream patch.
- Construct official Agent and empty AgentSession without model prewarm or active start, then actually close and join all owned prepared resources.
- Parent1c559f77 plus eleven overlays passed157/0/0. Preserve earlier failures, the rejected eager-prewarm run and the separate nonexecuting comment delta. Active input/output/envelope, host activation and Usage remain incomplete; this adds zero points and does not qualify full CI or external environments.
Official Agent Worker host and command — 2026-10-05
- Compose the existing workerhost, schema verifier, durable Service identity, signed bootstrap/claim clients and business bridge into a Linux Agent command. The official Python CLI retains registration, placement, pools and drain.
- Use fixed isolated Python arguments, an empty environment and bounded private pipes. Reuse the Task command's exact file/version/digest Secret projection through one internal package; idle startup does not fetch Provider secrets.
- Preserve cleanup ownership after partial startup. Unconfirmed process/job cleanup prevents retiring HTTPS/database dependencies; forced termination never establishes graceful business Stop, release or financial settlement.
- Original command/Task/Host qualification passed90/0/0 and separate official Python CLI qualification passed26/0/0 on their declared parent1c559f77 source overlays. These results are not rebound to later Host containment changes. Active graph execution and full local/external qualification remain open.
- Correct unexpected-leader descendant containment and revoke numeric group signalling before reap. Do not hold its lock across inherited-I/O join. Final affected Go qualification passed53/0/0; three actual official-Python Host regressions passed3/0/0 on matching runtime bytes. Earlier52-pass and Python2/1 runs retain their own snapshots and are not current qualification.
Actual native Agent bootstrap visibility — 2026-10-05
- Distinguish a matched live dispatch's unpublished/exact-pending job from terminal, missing or conflicting native facts. Only initial bootstrap observes that transient state again within the unchanged authority deadline.
- Keep current final authority checks, exact job/binding, one-shot claim/effects and no mutation while waiting. Upstream discovery remains unchanged.
- Actual registration/dispatch, signed bootstrap and preconnect stop/release pass pipeline, realtime and revoked-Grant scenarios. Final34/0/0 events retain exact parent1c559f77 plus eleven overlays and four original failed attempts. Active graph/media, production WSS, Usage and external gates remain open.
Separate local Agent artifact and bounded RECORD inventory — 2026-10-05
- Add an independent pinned Agent image/context builder, reusing the existing Task stdin supervisor and artifact tools. Agents remains disabled/unqualified; local imports and config refusal do not establish deployment readiness.
- Stream recorded payload checksums with bounded memory and I/O while preserving anchored path and mutation checks. All27 scanner tests pass; the unchanged local image verifies6108 records including its35MB native library.
- Preserve original source bindings and failed attempts, PARTIAL integrity and unresolved NOTICE/first-party/native/OS inventory. No full SBOM/legal clearance, active AgentSession, external qualification or progress-point increase.
- Reject unlisted Go/Python/embedded files, source links and changed or missing bytes in the reusable Agent builder. Separate16/0/0 Node file-closure tests preserve original image evidence; no image rebuild is inferred.
Selected Agent inputs and official assignment identity — 2026-10-05
- Use official JobRequest.accept for fresh opaque assignment identity and expose only the sealed exact identity from the existing native job reader.
- Add a bounded exact selected-input consumer with SUBSCRIBE_NONE and joined disconnect ownership. The production entrypoint still does not activate it; local selection is not server permission.
- Preserve original59, subsequent64 and separate reader58/0/0 evidence without combining overlapping cases or claiming native admission, media or full CI. No upstream patch or earned progress changed.
Agent durable Connection and RTC quota preparation — 2026-10-05
- Bind the existing claim and sealed native identity to one distinct Agent seat and original RTC reservation. Keep hard lifetime separate from renewable lease.
- Preserve external native lookup column privileges; migration125 carries only the private immutable Agent association and quota storage guard.
- Recheck lease after locks, retain idempotent seat/budget and account only for the owner's two Room lifecycle writes before full authority recheck.
- Preserve failed attempts and exact eighteen-file source binding. Local PG, original Human SDK join and Device regressions pass; native Agent media, all-node Agent authorization and complete bridge/full CI remain unqualified.
M1 v3 CCR evidence refresh at source 87526211 — 2026-10-05
- Authenticate the existing E6/PG5/RTC scopes against explicit875 execution anchors while retaining all historical receipts and failures.
- Preserve the failed PG5 parent and qualify only its independently corrected S235 scope; keep unchanged TASKINPUT36 at its original DFE source.
- Retain actual source/membership checks, verify lossless archive transport, and reject later Agent/migration125 drift.
- Record161 unique Node qualifier/regression cases without adding progress points or claiming that failed multi-suite commands passed.
These selected results do not qualify a later HEAD. Changed Agent compiled inputs or migration125 membership must still fail closed until their own affected evidence is available. Full local CI, full CCR-A and G_PRE remain unqualified; no milestone points or denominator change. Staging, Production, cloud, paid Provider, Desktop, hardware and hosted CI remain NOT-RUN for this increment.
Windows Go qualification fail-closed guard - 2026-10-06
The repository Go test and Go check entrypoints now stop before any Go command on Windows. This prevents Windows from creating or launching native test.exe artifacts after the Defender quarantine event and directs qualification to the authorized Linux/native lane. The guard is covered by the Windows CI hygiene suite. Direct Windows invocations returned the expected nonzero safety error; no Go test, native executable, Docker, cloud, Staging, Production or hardware qualification was run. The existing Owner precloud-plan edit remains separate.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED; no push.
GX16 Task context projection Linux race evidence - 2026-10-06
Bound the current provider context projection and Task Voice pipeline binding to source d750b7fe4817507e19cd2aa2bfa2693e6668dd12. WSL Ubuntu executed the four affected Go packages with the repository-owned module cache, GOPROXY=off and race instrumentation: 4 package passes, 0 failures and 0 skips. The missing go-cleanhttp report is cleared for this cache: go mod download and go mod verify both pass. Windows native Go tests were not run, and no ledger points or denominator changes were made. Staging, Production, cloud, hardware and hosted CI remain NOT-RUN.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED; no push.
GX15 Task Voice Linux race/vet corroboration — 2026-10-06
- Bound seven existing Task Voice packages to current source
a69a26f8; WSL race and vet both passed 7/0/0. - Kept the historical d750 provider-context race receipt unchanged and recorded this independent current-source receipt.
- No Windows native executable, service fixture, cloud, Staging, Production, hardware or hosted CI qualification was claimed; no ledger points or denominator changed.
Platform core Linux race/vet corroboration — 2026-10-06
- Re-ran nine existing realtime-core, Task provider and domain packages at
c0b6fea7; WSL race and vet both passed 9/0/0. - The receipt is local source-bound corroboration only; it adds no ledger points and does not qualify AgentSession, media, paid Provider, service fixtures or external environments.
E7 current JavaScript SDK contract qualification — 2026-10-06
- Current E7 package, consumer, AudioWorklet and protocol suites pass 316/0/4.
- Four real Gateway/WebSocket cases remain required NOT-RUN on the authorized Linux/native lane; no external or ledger credit was claimed.
E8 ESP32 governance and source digest qualification — 2026-10-06
- ESP32 scope, artifact, memory and Linux-lane governance tests pass 67/0/0.
- Current 106-file ESP32 source digest recorded; no native compiler, binary, hardware or external qualification was claimed.
GX16 Python Provider runtime local qualification — 2026-10-06
- Python 3.14.7 Provider runtime tests pass 22/0/0 for protocol, credential erasure, safe errors and deterministic lifecycle.
- Evidence remains offline synthetic only; no paid Provider or external canary qualification was claimed.
Data Sync current-source evidence sweep — 2026-10-06
- The full Data Sync evidence-test sweep returned 69 pass, 25 fail and 0 skip.
- Failures remain fail-closed stale source receipts/composition prerequisites; no historical result was rebound and no cloud or Staging claim was made.
M1 v3 current Linux RTC/Task/Usage unit qualification - 2026-10-06
The current source cf885a6630f5b3605ab4dca207cae20343caaa74 passed the existing
Task/Provider/Usage unit packages (21/0/0) and the RTC policy/lifecycle/LiveKit
adapter packages (4/0/0, with one package containing no test files) in WSL Ubuntu.
The same selected subset passed with GOWORK=off GOPROXY=off GOSUMDB=off, confirming
the repository-owned Go module cache contains github.com/hashicorp/go-cleanhttp@v0.5.2.
No Windows native executable, service fixture, AgentSession, paid Provider, cloud,
Staging, Production or hardware qualification is claimed; no ledger points or
denominator changed. Evidence (../development/evidence/m1-v3-rtc-task-agent-linux-unit-cf885a66.json)
GX07 official Agents Linux process qualification - 2026-10-06
The locked official livekit-agents==1.8.2 PROCESS and process-handoff suite
passed 64/0/0 against current source 53908de5b0f06e9ee685e2a17ab93c3630cb4c6f.
The run used an exact Linux ext4 source copy because the /mnt/c multiprocessing
harness timed out during executor initialization. This is local official process
qualification only; active dispatch, durable output/Usage, paid Provider, cloud,
Staging, Production and hardware remain NOT-RUN, and no ledger points changed.
Evidence: m1-v3-official-agents-process-current-53908de5.json (../development/evidence/m1-v3-official-agents-process-current-53908de5.json).
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED; no push.
GX07 Agent bridge and LiveKit Go boundary qualification - 2026-10-06
The current Agent execution bridge and LiveKit adapter packages passed WSL race
tests 3/0/0 and go vet for all three packages at source
b14a8ea3743f84b487e4d986c9f266820437bf06. The run was offline against the
repository-owned Go cache. It verifies the existing bridge/adapter boundaries;
the selected graph remains unstarted and no active dispatch, durable Usage,
Provider, cloud, Staging, Production or hardware qualification is claimed.
Evidence: m1-v3-agent-bridge-livekit-go-current-b14a8ea3.json (../development/evidence/m1-v3-agent-bridge-livekit-go-current-b14a8ea3.json).
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED; no push.
Local Agent worker owned-PostgreSQL qualification — 2026-10-06
The Linux-only Agent worker process test now gives the full ELF build a separate bounded 180-second window on WSL-mounted workspaces, disables VCS probing, and preserves build stderr on failure. Source-bound qualification at 598f0a4af375152a6bb50152d76b81cfaf2c048a passed 3/0/0 with an owned PostgreSQL fixture and verified the actual command's read-only schema, no idle provider reads, helper join, inactive worker, and argv/ambient-PostgreSQL rejection. Windows-native execution, cloud, Staging, Production and hardware qualification remain unrun. Evidence (../development/evidence/m1-v3-agent-worker-owned-postgres-current-598f0a4a.json)
Core runtime local unit qualification — 2026-10-06
Selected Task Voice, Usage, RTC worker and LiveKit adapter packages passed 10/0/0 in the offline WSL Go lane at source 2c1db563c67129a2ec53c3659f1c4bfb25342e71. This is local boundary evidence only; native Windows, cloud, Staging, Production, hardware, external Provider and hosted CI remain unrun. Evidence (../development/evidence/m1-v3-core-runtime-unit-current-2c1db563.json)
Native compatible-client P2–P5 adversarial qualification — 2026-10-06
The pinned Linux Docker lane at source f15784bf03856db07a5854484b7302cd3e9c9025 passed five focused LiveKit host test roots with zero failures or skips. Coverage includes publish, subscribe, data, RPC/Agent, mutation, terminal revocation, privilege expansion and invalid input rejection. This remains local adapter evidence; deployed media, Provider, cloud, Staging, Production and hardware qualification are not claimed. Evidence (../development/evidence/m1-v3-native-client-adversarial-current-f15784bf.json)
Gateway fixture Redis isolation — 2026-10-06
The owned realtime-gateway process fixtures now use deterministic, non-overlapping development Redis databases (7, 8 and 10); the two private stack nodes intentionally continue sharing DB 8 as one authority cohort. The current package configuration/artifact checks passed 4/0/0 in the pinned Linux Docker lane. This is fixture qualification only and adds no runtime, ledger or denominator credit. Evidence (../development/evidence/m1-v3-gateway-fixture-redis-isolation-current-d8460709.json)
Realtime gateway package checkpoint — 2026-10-06
The complete cmd/realtime-gateway package passed 8/0/16 in the pinned Linux Docker lane. The 16 skips are explicit external-fixture requirements (PostgreSQL/Redis, LiveKit management, native artifacts or private stack volume); they remain NOT-RUN and are not counted as PASS. Evidence (../development/evidence/m1-v3-realtime-gateway-package-current-57555e27.json)
Go vet checkpoint — 2026-10-06
The root go vet ./... lane now passes in the pinned Linux Docker environment. Two protobuf WebhookEvent test fixtures were changed from value copies to proto.Clone, removing copylock diagnostics without changing production code or runtime authority. Evidence (../development/evidence/m1-v3-go-vet-current-3cbd3c01.json)
Owned worker process qualification — 2026-10-06
With a pinned owned PostgreSQL container and CGO_ENABLED=1 Linux Docker lane, cmd/task-maintenance passed 9/0/0 and cmd/usage-worker passed 4/0/0, including their race builds and durable recovery cases. Native RTC, authority/browser/SDK and external environments remain NOT-RUN. Evidence (../development/evidence/m1-v3-owned-worker-processes-current-1c0ac520.json)
Agent worker owned-host qualification — 2026-10-06
The current source cmd/agent-worker package passed 5/0/0 in the pinned Linux Docker lane with an owned PostgreSQL fixture, including strict config/no-I/O, startup release, orphan exit cleanup, owned-host schema and ELF lifecycle checks. The emitted Agent ELF was read back by SHA-256; no Provider or official livekit-agents dispatch is claimed. Evidence (../development/evidence/m1-v3-agent-worker-owned-postgres-current-517cc53c.json)
Closed ContextSnapshot Provider egress contract — 2026-10-06
GX15.task now has a server-owned closed egress inventory: only typed locale.language at priority 100 is projectable, duplicate and unknown kinds reject, and raw values or item metadata cannot cross the Provider boundary. The context snapshot, Provider and Task Voice pipeline packages passed 3/0/0 in the pinned offline Linux lane. Real Provider, PostgreSQL-backed projection, cloud, Staging, Production and hardware remain unrun. Evidence (../development/evidence/m1-v3-context-provider-egress-current-b627e8df.json)
Context egress/provider abort boundary — 2026-10-06
The Task Voice pipeline test now binds the closed ContextSnapshot egress projection to Provider startup and verifies that an explicit provider abort cleans up without publishing an unauthorized durable terminal. The three affected Go packages passed 3/0/0 in the pinned offline Linux lane. Evidence (../development/evidence/m1-v3-context-provider-egress-current-2a0e10bd.json)
Context egress race qualification — 2026-10-06
The closed ContextSnapshot Provider egress and Task Voice consumer packages passed the Linux race lane 3/0/0. This remains local concurrency evidence; PostgreSQL-backed projection, real Provider and external qualification are unrun. Evidence (../development/evidence/m1-v3-context-provider-egress-race-current-dfe6577d.json)
GX15 ledger alignment — 2026-10-06
The active M1 v3 ledger now reflects the completed server-owned ContextSnapshot Provider egress mapping and provider-abort boundary evidence, while preserving the existing 90% earned progress, denominator and remaining Provider/Usage/WSS handoff work. Evidence (../development/evidence/m1-v3-context-provider-egress-current-2a0e10bd.json)
PostgreSQL ContextSnapshot projection qualification — 2026-10-06
A real owned PostgreSQL fixture exposed and then verified the JSONB whitespace correction in the closed ContextSnapshot Provider projection. The three local unit packages passed 3/0/0 and the PostgreSQL taskrepo projection roots passed 2/0/0. Evidence (../development/evidence/m1-v3-context-projection-postgres-current-29e1b225.json)
GX06 local Linux fixture evidence — 2026-10-07
On exact source b9d420a744a2b098641e870247945f3211813679, the WSL/Linux Docker fixture passed 58 RTC connection/admission events with zero failures or skips and verified owned cleanup. The durable Room/worker fixture produced 267 passing events and one explicit required skip for the fixed 127.0.0.1:7880 Agent dispatch fixture; that skip remains unqualified. A temporary owned-PostgreSQL fixture also passed the cmd/agent-worker, cmd/task-maintenance and cmd/usage-worker race suites with zero failures/skips, clearing those worker fixture gaps. The full Go gate still has seven native RTC/browser/SDK tests that require separately owned native host/authority artifacts; they remain unqualified. No completion credit is added and no Windows native binary, hosted CI, Staging, Production, cloud, Provider, hardware or Desktop qualification is claimed. Evidence (../development/evidence/m1-v3-gx06-native-fixtures-b9d420a7.json)
WSL Go evidence cache fallback — 2026-10-07
tools/ci/capture-go-evidence.mjs now selects a Linux-owned /tmp/onesay-go-build-cache when it runs from a WSL /mnt/* checkout, while preserving explicit GOCACHE overrides and the native repository cache. A WSL run of the identity fixture passed 66/0/0 through the capture tool. This only hardens local evidence execution; it does not change product runtime or qualification scope. Evidence (../development/evidence/m1-v3-gx06-native-fixtures-b9d420a7.json)
GX06 native API fixture requalification — 2026-10-07
The exact da8c971d86876fbd513e83927ff4eb87c0cf86d2 source passed 167 official LiveKit Server API/adapter race events with zero failures and verified owned Docker cleanup. The runner remains REQUIRED_SKIP because DistributedMedia/Data requires a separate dual-server fixture and Agent dispatch requires the fixed loopback fixture; neither is claimed as PASS. OneSay admission, media exchange, Agent execution, Staging, Production and cloud qualification remain outside this receipt. No completion credit is added. Evidence (../development/evidence/m1-v3-gx06-native-api-da8c971d.json)
GX01 official native foundation fixture evidence — 2026-10-07
The exact committed source f314d895092f6b7f30b3709bcc3e47db21bbdb51 was exercised in WSL/Linux with two official LiveKit servers and separately authenticated Platform/LiveKit Redis containers. TestOwnedNativeDistributedMediaAndData passed 1/0/0, confirming the shared native Room SID, three Opus RTP packets, three reliable data payloads and owned cleanup. The runner now captures the source SHA before Docker teardown so a passing Linux test cannot lose its receipt when the mounted Windows worktree is transiently unavailable. This is fixture corroboration only; GX06/GX07 product, OneSay policy, Staging, Production, cloud and hardware gates remain NOT-RUN, with no ledger credit or denominator change. Evidence (../development/evidence/m1-v3-native-foundation-f314d895.json).
GX06 upstream browser/native audio fixture evidence — 2026-10-07
The exact committed source 0a42707335bfba27dc069a3fdb31258a396757d5 passed the isolated Linux browser/native audio fixture 1/0/0. Two independent Linux Chrome contexts exchanged a synthetic 880 Hz loopback stream, asserted decoded samples and packet delivery, verified mute/unmute and participant leave, and completed owned PG/Redis/LiveKit cleanup. The fixture intentionally does not claim OneSay admission, patched-host policy, multiparty, recovery, Agent, Usage, hardware or cloud qualification; no ledger credit or denominator change was added. Evidence (../development/evidence/m1-v3-gx06-native-audio-upstream-0a427073.json).
2026-10-13 — Inspect and revoke an owned RTC connection in Console
Room details now accept an existing RTC connection ID belonging to the current identity and Application. Read its canonical state, prepare a Consent request, choose Allow or Deny, then explicitly execute an allowed revoke. Uncertain transport results retain the original request key for an explicit retry; scope/session changes clear it. Refresh shows the server's actual state. revoking and its request timestamp do not prove native media disconnection. Mock Mode supplies a labeled read-only example; an opt-in owned Linux fixture exercises real local API operations without cloud resources.
2026-10-13 — Inspect and cancel a Task in Console
Tasks now open scoped public resource details, including lifecycle timestamps and output metadata without transcript content. Cancellation uses the existing direct Human Consent flow: review, allow or deny, then explicitly execute an allowed cancellation. Refresh reads the server's current state; terminal Tasks cannot be restarted. Uncertain network responses retain the original request key for an explicit retry within the same session and scope. Mock Mode remains read-only. The optional local fixture creates a waiting-input Task through the public API; it does not execute a Provider or audio transport.
Source and provenance
View original Markdown
## 2026-10-22 — Agent realtime binding is a configuration switch; agent-policy-config dry run reads back
The Agent Worker accepts two realtime bindings, selected by the model-policy stage and the deployment binding: `onesay-qwen-realtime` 1.0.0 with `qwen-audio-3.1-realtime-plus` on a workspace host `https://ws-<id>.<region>.maas.aliyuncs.com/api-ws/v1/realtime` (`ap-southeast-1` by default, `cn-beijing`, `cn-hongkong`), or the official `livekit-plugins-openai` 1.8.2 with `gpt-realtime-2025-08-28` on `https://api.openai.com/v1`; see the switch table in [deploy/agent-worker](../../deploy/agent-worker/README.md). `cmd/agent-policy-config` dry run now connects to the target database, performs the writes in its transaction, prints the read-back and rolls back; apply prints the same read-back after commit, and both report `target_environment` and `production_override`. Development and Staging targets follow the Worker database rule (numeric loopback with `sslmode=disable`, otherwise `verify-full`). No public API, SDK or event change.
## 2026-10-22 — The RTC Agent realtime voice uses the Qwen-Audio realtime model
The Agent Worker's realtime stage now binds `qwen-audio-3.1-realtime-plus` (policy plugin `onesay-qwen-realtime` 1.0.0) through an in-package adapter that implements the official LiveKit Agents 1.8.2 `RealtimeModel` interface; the official OpenAI realtime binding is gone and the OpenAI pipeline stays for development only. The deployment binding endpoint is the workspace host `https://{workspace}.ap-southeast-1.maas.aliyuncs.com/api-ws/v1/realtime` (Singapore, Staging) or the `cn-beijing` host, with a matching `data_region` and one of the documented voices; see [deploy/agent-worker](../../deploy/agent-worker/README.md). `cmd/agent-policy-config` accepts the realtime policy and a `staging` target (`sslmode=verify-full`); its private target gains the required key `production_authorization_record` (empty outside Production; Production stays refused). No public API, SDK or event change. See [GX07_AGENT_QWEN_REALTIME_BINDING.md](../architecture/GX07_AGENT_QWEN_REALTIME_BINDING.md).
## 2026-10-22 — Task speech defaults to the Qwen-Audio streaming model
The Task Worker's live speech adapter now defaults to the Alibaba Cloud Model Studio model `qwen-audio-3.1-asr-flash-streaming` on its workspace-scoped endpoint `wss://ws-<id>.<region>.maas.aliyuncs.com/api-ws/v1/inference`: Singapore `ap-southeast-1` by default (Staging), `cn-beijing` or `cn-hongkong`, the only hosts it may dial. The general `dashscope.aliyuncs.com` and `dashscope-intl.aliyuncs.com` domains are no longer accepted. The private configuration object `provider.python.aliyun` of `cmd/task-worker` gains the operator settings `vad_model`, `vocabulary_id`, `hotwords` (`[{text, weight 1-5}]`, at most 128) and `context` (at most 400 characters), which apply to that model only. The private shape is strict, so every configuration must carry the four keys; Paraformer and deterministic configurations set them empty (`""`, and `[]` for `hotwords`). `paraformer-realtime-v2` stays selectable on the Beijing workspace host only (Singapore and Hong Kong do not serve it). The operator probe `node tools/providers/qwen-probe.mjs --key-file <path> --workspace ws-<id> --region <region>` reports model availability per workspace (events only). No public API, SDK, event or error change; provider names stay out of public fields. See [E5_QWEN_AUDIO_ASR_STREAMING_ADAPTER.md](../architecture/E5_QWEN_AUDIO_ASR_STREAMING_ADAPTER.md).
## 2026-10-22 — Platform names move to onesay.com
Every OneSay Platform public name now uses `onesay.com`, following [OWNER_DOMAIN_ONESAY_COM_2026-10-22](../architecture/OWNER_DOMAIN_ONESAY_COM_2026-10-22.md). The Control API is `https://api.onesay.com/v1` (Staging `https://api.staging.onesay.com/v1`), Task Voice WSS is `wss://realtime.onesay.com/v1` (Staging `wss://realtime.staging.onesay.com/v1`), MCP is `https://mcp.onesay.com/mcp` (Staging `https://mcp.staging.onesay.com/mcp`), the Console, Developer Portal and Docs hosts are `console`, `developers` and `docs` under `onesay.com`, and every JSON Schema `$id` is under `https://specs.onesay.com/`. The contracts are unpublished, so there are no aliases. The generated SDK environment tables, ESP32 headers and references are regenerated. Legacy hosts stay on `onesay.io`. `npm run -s v13:forbidden-check` now fails on a Platform `onesay.io` name outside Legacy, Owner decision originals and historical records.
## 2026-10-22 — Operator provisioning writes Human Grants
[`cmd/platform-provision`](../../cmd/platform-provision/README.md) gains a `grants` section: allow Grants for a Human who has logged in once, selected by `usr_` ID or ZITADEL issuer and subject, with `app.session.*` on the declared Application and other permissions environment-wide; `state: revoked` revokes them. Same guards, dry-run and read-back. The Staging seed grants two test users. No public API, SDK, contract or schema change.
## 2026-10-22 — Operator provisioning command for deployed environments
New operator-only command [`cmd/platform-provision`](../../cmd/platform-provision/README.md) applies, from one declarative YAML or JSON document, the server facts a deployed environment needs before a Human can use it: Application OIDC client bindings, the current Consent policy of each Action (bound to the compiled registry digest the server compares) and a Project Environment Quota policy. It is idempotent, runs in one SERIALIZABLE transaction with `-dry-run` and a secret-free read-back, takes its database URL only from a private file, and refuses `production` without `-allow-production`. Example: [`deploy/aliyun/provisioning/staging-m1-smoke.yaml`](../../deploy/aliyun/provisioning/staging-m1-smoke.yaml). No public API, SDK, contract or schema change.
## 2026-10-22 — Staging preparation for Alibaba Cloud Hong Kong (not run)
A Staging overlay for one Alibaba Cloud ECS host in `cn-hongkong`, its render and preflight tools (`node tools/deploy/staging-aliyun.mjs --check`, `tools/deploy/staging-aliyun-preflight.mjs`), host bootstrap and deploy scripts, a Yunxiao Flow pipeline and an optional ECS instance-role policy are in `deploy/aliyun/`; the procedure is the [Staging runbook](../deploy/STAGING_ALIYUN_HK_RUNBOOK.md). Nothing has been deployed: no Staging endpoint exists yet, and the SDK `staging` environment still names the registered `staging-platform-*` authorities. No SDK API, contract or runtime change.
The host generates its own private configuration and its self-hosted ZITADEL at `auth.staging.onesay.com` (stage 1). Stage 2 adds the Task WSS Gateway, the Task worker and the RTC native host once the Staging project exists. The Task worker's Provider stays disabled until credentials are bound, so a Staging Task fails with Provider `unavailable`. The JavaScript RTC example is to be served at `https://rtc-demo.staging.onesay.com/`. All of this is NOT-RUN until the [first deployment](../deploy/STAGING_ALIYUN_HK_FIRST_DEPLOY.md).
## 2026-10-21 — RTC native-connect failure contract in the SDK READMEs
The [JavaScript](../../sdks/javascript/README.md) and [ESP32](../../sdks/esp32/README.md) SDK READMEs now state what a native connect failure looks like: the native host answers an untyped HTTP 500 for a OneSay admission denial (including a revoked identity), capacity, backpressure and an unavailable admission callback alike, so a client reads the Control resource (`client.rtc.get(error.resourceId)` or a new `connect`; on ESP32 `getRTCConnection`), revokes or lets the durable admission expire, and connects again with a new idempotency key; the official SDK retry counts are listed. Documentation only; no SDK API, contract or runtime change.
## 2026-10-20 — Evidence guard reads failure counts and -skip deselections
`node tools/development/evidence-bindings.mjs --check` now requires a row skip review to name the evidence that ran the skipped tests (or the helper-root limitation), treats a recorded `go test -skip` deselection like a skip, and requires a credited row that records failures to carry a `fail_review` naming its passing evidence. Only `linux-go-race-remaining` may be split into row parts. Governance only; no SDK API, contract or runtime change.
## 2026-10-20 — Skip counts taint evidence rows
`node tools/development/evidence-bindings.mjs --check` now treats a registry row as skip-tainted when any recorded skip count is above zero, unless the row carries a `skip_review`; a milestone that cites tainted rows must name a clean cited row in its `skip_taint_review`. Governance only; no SDK API, contract or runtime change.
## 2026-10-20 — JavaScript RTC example needs no native SDK configuration
The [JavaScript RTC example](../../examples/javascript-rtc/README.md) server now builds its browser import map from the installed package manifests, so the example names no SDK dependency and needs no configuration of its own. `node tools/rtc/run-public-example.mjs check` is the automated, non-interactive form of the example.
## 2026-10-20 — Precloud coverage checks, host prerequisites, receipt bindings and ci:local:quick
`node tools/ci/check-m1-precloud-contract.mjs --check` now requires every hosted job to be covered exactly once, every runner outside the families to be classified, the native SDK row to match the runner allowlist, every row to sit in one OS × runtime cell, and every required package script to do work. New precloud rows: `linux-go-race-*`, `rtc-livekit-gated-go-tests`, `task-*`, `usage-metering-dimensions`, `observability-*`, `gx12-fault-*`, `esp32-idf-component-*`, and BLOCKED `macos-safari` and `electron-renderer`. Rows declare host prerequisites that the row driver reads back (`BLOCKED_PREREQUISITE_MISSING`, nothing installed) and may start the composed runner's fixtures (`fixtures: hosted_ci`); row receipts carry `lock_hash` and `image_or_fixture_digest`. `node tools/development/evidence-bindings.mjs --check` validates evidence bindings and refuses credit resting only on skipped tests. `corepack pnpm ci:local:quick [--plan] [--base <ref> | --paths <file>]` runs the `ci:local` units a change can affect, expanding to everything for shared changes; it never replaces the complete `ci:local`.
No SDK API, contract or runtime change.
## 2026-10-20 — Official Agents Worker metrics listener (off by default)
The Agent Worker command's private configuration gains `official.prometheus_port` (required key; `0` keeps it off). A non-zero port turns on the official LiveKit Agents Worker's own Prometheus listener on `127.0.0.1` (`WorkerOptions.prometheus_port`); it must differ from `health_port`. OneSay neither re-exports nor relabels the Worker's `lk_agents_*` families. Existing configurations must add `"prometheus_port": 0`. The SDK distribution matrix's Agent row now cites the server-side product dispatch. See [cmd/agent-worker](../../cmd/agent-worker/README.md) and the [GX10 observability boundary](../development/GX10_OBSERVABILITY_BOUNDARY.md).
## 2026-10-20 — Local observability lanes load the product alert mappings and scrape the patched native host
`node tools/observability/run-local-observability.mjs` now loads the alert mappings of `deploy/readiness/ccr-a-pre-cloud.yaml` and `deploy/readiness/data-sync-local-capacity.yaml` as aggregated Prometheus rules, checks them with the official promtool before starting any service, refuses to run outside the repository root and mounts the repository read-only. The new `node tools/observability/run-native-observability.mjs` scrapes the patched OneSay native host's own Prometheus listener unchanged with the same pinned Prometheus and Alertmanager. Revoke latency stays a value derived from durable records, not a metric. No public API, SDK or runtime change. See [GX10 observability boundary](../development/GX10_OBSERVABILITY_BOUNDARY.md).
## 2026-10-20 — RTC connection on a Room that is still being prepared answers 202
`POST /v1/rtc/connections` (`createRTCConnection`) on a Room whose native runtime is not ready now answers `202` with `{"data":{"room_id":…,"state":"preparing","retry_after_ms":1000}}` instead of `409 resource_state_invalid`. The durable Room intent and this result commit in one transaction, and the same `Idempotency-Key` keeps returning the same `202`; it never turns into a connection. Request the connection with a new key after `retry_after_ms`; it returns `201` with material once the Room is ready. A request with a new key while the Room is still being prepared also gets `202` and adds no second intent. Nothing is reserved, consumed or minted by a `202`. The JavaScript SDK's `rtc.connect` waits and retries with a derived key inside its own deadline; a delegated request is returned as a retryable `resource_state_invalid` error, because its next key needs its own Consent. The ESP32 SDK's `onesay_esp32_rtc_prepare` returns `ONESAY_ERR_RESOURCE_BUSY` for a `202`; call it again later with a new key (a Device needs a new owner Consent for that key). The contract change is in `specs/` with regenerated outputs. See [durable Room work](../development/RTC_DURABLE_ROOM_WORK.md#accepted-versus-ready-rtc-20-v2-63---2026-10-20).
## 2026-10-20 — RTC credential rotation overlap; ESP32 RTC smoke scope check
Control's private config field `rtc_native_observation[0]` gains the required `overlap_keys` list. It is `[]` outside a credential rotation and holds exactly one more official LiveKit API key pair during the overlap. The webhook and observation receiver then verifies both pairs with the official multi-key provider; after the overlap the retired pair is refused. Existing Control configs must add `"overlap_keys": []`. The upgrade contract (`deploy/stack/m1-v3-upgrade-contract.yaml`) gains a `credential_rotation` section, checked by `node tools/deploy/check-m1-upgrade-contract.mjs`, and the operator runbook a rotation procedure. The packaged rotation rehearsal has not run yet. In the ESP32 `rtc_smoke` project, Device-credential mode now fails with `ONESAY_ERR_AUTH` before loading the Device secret unless the RTC Control configuration names the same environment, Device, Project and Environment as the Task one. See [RTC credential rotation](../development/RTC_CREDENTIAL_ROTATION.md).
## 2026-10-20 — ESP32 RTC refuses any selected media encryption; two-SDK capability matrix
`onesay_esp32_rtc_prepare` now also refuses `media_encryption` set to `none`, with `ONESAY_ERR_INVALID_ARG` before any request. The canonical contract accepts only `e2ee`, and an absent field selects `none`, so leave the field unset on ESP32. The [SDK distribution](../runbooks/SDK_DISTRIBUTION.md#declared-capability-matrix) page now maps each JavaScript capability to its API, permission, native call, test and example. It gives each ESP32 capability its public entry or its documented limitation, and it corrects the ESP32 RPC row: the ESP32 SDK answers RPC calls but cannot make them.
## 2026-10-20 — RTC admission reports the configured capabilities
`POST /v1/rtc/connections` (`createRTCConnection`) now returns truthful `capabilities` instead of four `false` values: `audio` is `true`, `e2ee` is `true` only when the deployment has a media key root and never for a Device connection, and `data_packets` and `data_tracks` stay `false` because public packet traffic and DataTracks are not enabled. An idempotent replay returns the same bytes. The bits are discovery only: the native grant, the publication and subscription policy and the session's own `mediaEncryption` choice still decide what a connection may do, and the JavaScript SDK still reports `session.capabilities.e2ee` as `true` only in the selected E2EE mode. The ESP32 SDK, which refuses audio when `audio` is `false`, now sees `audio: true`. No request, schema or SDK API change.
## 2026-10-20 — ESP32 and Device RTC refuse E2EE explicitly
`onesay_esp32_rtc_prepare` now returns `ONESAY_ERR_INVALID_ARG` when `media_encryption` is set to `e2ee` or to a malformed value, before it allocates or sends any Control request. Before this change the ESP32 SDK silently dropped the field and admitted a transport-only connection. `none` or an absent field behave as before; the request body is unchanged. The public headers and ABI are unchanged. The server's existing refusal of `media_encryption: "e2ee"` for a Device connection (`409 resource_state_invalid`, nothing reserved or consumed) is now covered by an executed PostgreSQL test. The JavaScript package test also checks that the packaged E2EE worker and its LICENSE equal the locked `livekit-client` files byte for byte. See [ESP32 RTC data](../runbooks/ESP32_RTC_DATA.md) and the [selected-mode design](../development/GX10_PRIVACY_E2EE_DESIGN.md).
## 2026-10-20 — ESP32 RTC smoke: Device credential to RTC bearer
The board-agnostic OEM project `sdks/esp32/examples/rtc_smoke` can now take its RTC bearer from the Device credential, using public calls only. Set `rtc_bearer_from_device_credential = true`. The smoke loads the Device secret once through the existing `task.credentials` store, sends it only as the `Authorization` of one `exchangeDeviceAccessToken` request (`POST /v1/device-access-tokens`) through `onesay_esp32_control_request`, erases it on every path and gives the RTC owner only the short-lived Device access token. The OEM `load_rtc_bearer` callback remains; exactly one of the two sources is accepted. The owner's Delegation and Consent and the Device's AppSession must already exist. The [ESP32 Quickstart](../guides/ESP32_QUICKSTART.md#esp32-realtime-rtc) now points to this runnable project and documents the chain. No SDK public API change. Real-device results are not yet available.
## 2026-10-20 — Precloud rows for every committed RTC runner
`deploy/ci/m1-v3-precloud-ci-contract.yaml` gains the mandatory rows `rtc-gx05-reuse`, `rtc-gx05-rooms`, `rtc-native-lifecycle-hold-bound-live`, `rtc-rtc03-identity`, `rtc-rtc03-native-facets`, `rtc-room-preparation`, `rtc-rtc-capabilities`, `rtc-webhook-observation` and `rtc-sdk-network-quality` (added at the main-session merge), and the BLOCKED row `gateway-native-roots` (`tools/rtc/run-gateway-native-roots.mjs` needs the candidate build from `tools/deploy/build-m1-candidate.mjs`), so `node tools/ci/check-m1-precloud-contract.mjs --check` again finds every `tools/rtc/run-*.mjs` runner in a row. The owned native test host opens one opt-in Prometheus listener on port + 9 for both of its metric readers. The `rtc-sdk-native-integration` row now runs all eleven allowlisted formal native SDK roots in three commands.
No SDK API, contract or runtime change.
## 2026-10-18 — Network qualification work directory; supply currency reads pyproject dependencies
`node tools/deploy/qualify-m1-network-template.mjs --work <dir>` now refuses a `--work` path that already exists or lies inside the checkout, and removes only a directory it created. It writes its work directory `0700` and the files inside `0644`, so the capability-less LiveKit container can read them on a Linux host as well as on Docker Desktop. The supply SBOM candidate's currency check reads only the `[project]` name, version and dependencies and `[project.optional-dependencies]` of `pyproject.toml`; editing a tool table such as `[tool.onesay]` no longer requires regenerating the candidate. See [M1 network template](../runbooks/M1_NETWORK_TEMPLATE.md).
## 2026-10-17 — ESP32 SDK pins the reviewed RTC transitive components
With `CONFIG_ONESAY_RTC_ENABLED`, the ESP32 SDK's Component Manager manifest (`sdks/esp32/idf_component.yml`) now pins `espressif/esp_peer ==1.5.6` and `espressif/usb ==1.5.0` as overrides, next to the existing `espressif/media_lib_sal ==1.0.2`. An OEM project that resolves the SDK without a lock gets the same RTC dependency graph as the reviewed lock, instead of newer `esp_peer`/`usb` releases. Task-only builds are unchanged (the overrides are inactive). See [ESP32 RTC SDK delivery](../development/ESP32_RTC_SDK_DELIVERY.md).
## 2026-10-17 — Operator runbook receiver CA input; singlehost network ports
The operator runbook's deploy section now lists the native host's third read-only private file, `livekit-receiver-ca` (`/run/secrets/onesay-control-receiver-ca.pem`, mode `0400`), and the `SSL_CERT_FILE` path reference, per instance in the two-node overlay. `SSL_CERT_FILE` replaces the process's system root store, so in Staging the file must hold the issuing chain of Control's receiver certificate. The [network template](../runbooks/M1_NETWORK_TEMPLATE.md)'s local singlehost layout now uses the real stack's native ports `17880/17881/17882`.
## 2026-10-17 — Operator and developer runbooks; external-action handoff
New [M1 operator runbook](../runbooks/M1_OPERATOR_RUNBOOK.md) (deployment, upgrade/drain/rollback, data, maintenance entry points and fault diagnosis for Task Voice and LiveKit RTC) and [M1 developer runbook](../runbooks/M1_DEVELOPER_RUNBOOK.md) (Docs site, Developer Portal, release packages and quick starts). The JavaScript Quickstart now names the release tarball build (`corepack pnpm sdk:package:check`) and its `file:` install; the ESP32 Quickstart no longer documents the retired physical command. Every remaining cloud, Provider, hardware and publication action is listed in the generated [external-action handoff](../development/GX13_EXTERNAL_ACTION_HANDOFF.md). No public API, SDK or runtime change.
## 2026-10-17 — Device environment for the formal RTC integration entry
`node tools/rtc/run-sdk-native-integration.mjs --roots <roots>` gives each root
that declares the opt-in Device environment two more owned containers: a
business Redis for the rate limiter and Signal tickets, and the lock-pinned
unpatched LiveKit Server as the outer Room API. The two Device roots of the
GX12.security matrix and the new requirement-family root
`TestRTCDeviceNativeSameOwnerHumanInPostgres` (RTC-03 same-owner self-Device)
use it. The shared runner finalizer takes an optional owned-role list. The
repository's `ci:local` does not run these roots.
No SDK API, contract or runtime change.
## 2026-10-18 — Usage: RTC DataTrack byte observations
The Usage `UsageMetric` enum gains four values: `rtc_observed_upstream_datatrack_bytes`, `rtc_observed_upstream_datatrack_messages`, `rtc_observed_downstream_datatrack_bytes` and `rtc_observed_downstream_datatrack_messages`. They are nonbillable, unpriced observations with UNKNOWN completeness of the payload a participant sends on its own DataTrack publication (upstream) or receives on a subscribed DataTrack (downstream), taken from the official LiveKit per-DataTrack byte statistics and attributed to the participant who sent or received it. Each observation is bound to the DataTrack's original `data.rtc.v1` publication; bytes on a DataTrack the platform did not publish are not recorded. They are not IP or TURN egress, connection duration or cost. Deploy Control before native hosts so the new observations are accepted (same rollout order as LIM-GX10-USAGE-BYTE-CAPTURE-ROLLOUT-ORDER).
## 2026-10-17 — Local CI rows and frozen Linux installation
`ci:local` now uses only the hosted workflow's fixtures (PostgreSQL and two Redis); LiveKit, native-host, packed RTC SDK and browser tests are qualified by the mandatory rows of `deploy/ci/m1-v3-precloud-ci-contract.yaml`, run with `tools/ci/wsl-local-ci.sh <commit> --rows <run> <row>...` (`docs/development/M1_LOCAL_CI_RUNBOOK.md` section 2). `node tools/ci/linux-frozen-install.mjs --asset <dir> --previous <dir>` produces the frozen Linux Node installation those runs bind; make a new one whenever `package.json`, the lockfile, the workspace file or a pnpm patch changes. `node tools/capacity/local-rtc-metrics.mjs` compares two unchanged GX12.fault runs of the same input. No API or SDK change.
## 2026-10-17 — Usage: RTC participant data-channel and signal byte observations
The Usage `UsageMetric` enum gains eight values: `rtc_observed_upstream_data_bytes`, `rtc_observed_upstream_data_messages`, `rtc_observed_downstream_data_bytes`, `rtc_observed_downstream_data_messages`, `rtc_observed_upstream_signal_bytes`, `rtc_observed_upstream_signal_messages`, `rtc_observed_downstream_signal_bytes` and `rtc_observed_downstream_signal_messages`. They are nonbillable, unpriced observations with UNKNOWN completeness of a participant's own data-channel and signal-connection payload deltas, taken from the official LiveKit byte statistics. They are not IP or TURN egress, connection duration or cost, and DataTrack bytes are not included. Deploy Control before native hosts so the new observations are accepted (rollout order recorded as LIM-GX10-USAGE-BYTE-CAPTURE-ROLLOUT-ORDER).
## 2026-10-17 — Usage metering dimension registry
The Usage specification now states, for every Usage metric, its unit, whether it is a delta or a final cumulative total, how duplicates and generations are recognized, which time it carries, how complete it is, and whether it can be billable, priced or reserved. It also lists the dimensions that are deliberately not reported, such as RTC connection duration, network and TURN egress, and Agent or infrastructure cost, and why. This registry increment itself changes no metric, value or API.
## 2026-10-17 — RTC connection admissions of one Environment queue instead of conflicting
Concurrent `rtc.connection.create` requests and native admission checks of the
same Environment now wait for each other before their database snapshot, so a
burst ends in admitted connections and explicit `quota_exceeded` refusals
instead of `409 resource_state_invalid` contention refusals. The database
session used for that wait returns to the pool as soon as its transaction
ends, so an immediate retry or the next authority step finds it free. A
native node whose consumer closes after a failed native participant close now
leaves its registration open instead of closing it unsealed, so it drops out
of later revocation checks after the freshness window and cannot hold every
later revocation of the Environment pending. A revoked connection's
effectiveness proof now waits for the native node's policy feed reads and
applied reports of the same Environment instead of conflicting with them, so
the revocation becomes `effective` without the repeated 2 s retries that
could delay it by tens of seconds. Authorization checks, budgets, retries and
error codes are unchanged. No public API or contract change.
## 2026-10-17 — Task cancel while the worker is writing
A Task cancel (`POST /v1/tasks/{task_id}/cancel` or the realtime `task.cancel` message) no longer fails because the task worker is committing progress for the same Task at the same moment. Previously the realtime connection could answer `error` with `provider_unavailable`, although no Provider was involved; the HTTP path shares the same code and could answer 500 `resource_state_invalid`. The cancel now waits for the worker's current write, within the request's existing deadline. The same holds for a Task cancel that an Agent requests through its Task cancel Action. A cancel can still fail on an unrelated serialization conflict; it then uses the existing error mapping. No API, error code or SDK change.
## 2026-10-17 — Formal entry for the gateway Task+RTC roots
`node tools/rtc/run-gateway-native-roots.mjs --build <dir> --build-sha256 <sha256>`
runs the realtime-gateway Task+RTC process roots against one
`tools/deploy/build-m1-candidate.mjs` build of the same clean commit. Each
root runs once in the candidate Task image with the candidate native host,
owned PostgreSQL and two distinct Redis. The repository's `ci:local` does not
run these roots.
No SDK API, contract or runtime change.
## 2026-10-17 — Formal RTC integration entry and JavaScript data guide
`node tools/rtc/run-sdk-native-integration.mjs --roots <roots>` qualifies the
allowlisted packed-SDK RTC roots against a OneSay native host and RTC
authority host freshly built from a clean commit, with owned PostgreSQL,
native Redis and Chromium. The repository's `ci:local` does not run these
roots.
New roots cover:
- the content-comparable audio slice;
- the JavaScript security boundary on that path.
A new guide, `docs/runbooks/RTC_JAVASCRIPT_DATA.md`, covers the package's
declared packet, stream, RPC, DataTrack and Agent surfaces.
No SDK API, contract or runtime change.
## 2026-10-17 — Context-bearing Tasks over the realtime connection
`POST /v1/realtime/connections` accepts `context_snapshot.read` in `requested_grants` (up to seven grants). A Task created with `task.create` on that connection can then carry a ContextSnapshot input; without the grant such a create is still refused. A dictation Task whose ContextSnapshot the speech Provider cannot use (anything other than at most one `locale` item of the form `{"language": "..."}`) is now refused when it is created, with `task_profile_input_unsupported` (HTTP 422, or an `error` event on the realtime connection, which stays open), instead of expiring after admission. The SDK default grant lists are unchanged: request the grant explicitly, and give the device or service credential `context_snapshot.read`.
## 2026-10-17 — ESP32 RTC data, RPC and Agent Control guide
New developer handoff [ESP32_RTC_DATA.md](../runbooks/ESP32_RTC_DATA.md) for the ESP32 SDK's packet send, stream receive, RPC callee and Agent Control: call order, the Grants and Consent the server enforces, handler and callback rules, limits, failures and what the pinned official SDK cannot do (packet receive, targeted stream send, outbound RPC, RPC v2). `node tools/sdk/build-esp32-idf-component.mjs --rtc-smoke` now expects the 15 OneSay RTC translation units of the current SDK, including the RPC callee. No API change.
## 2026-10-17 — ESP32 RPC callee with caller-addressed replies
The ESP32 SDK can now answer RTC RPC calls. After `onesay_esp32_rtc_prepare` and before `onesay_esp32_rtc_connect_audio`, `onesay_esp32_rtc_prepare_rpc_receive` registers one to four `app.*` methods with one synchronous handler each; once connected, `onesay_esp32_rtc_configure_rpc_receive` installs a receive-only RPC packet policy (at most four original callers). Each accepted request gets exactly one reply; any policy, peer, deadline or bound failure returns one fixed application error without details, and a repeated request ID is never executed twice. The pinned official LiveKit ESP32 runtime (v0.3.11) sent RPC acknowledgements and results without a destination, which the platform refuses; a reviewed build-tree correction of one official source file now addresses every acknowledgement and result to the original caller only. It changes no public header or ABI and is removed once an upstream release carries the same fix. ESP32 remains callee-only: the pinned runtime has no outbound invoke, and no transport is substituted. Server authorization is unchanged. Local host and ESP32-S3 compile/link evidence only; native network delivery, device and hardware runs remain NOT-RUN. See [the design record](../development/GX09_ESP32_RPC_REPLY_DESTINATION.md).
## 2026-10-17 — One Room for Task voice and RTC
New guide `docs/runbooks/ROOM_SHARED_SERVICES.md`. A Room created with `POST /v1/rooms` has no service type, so Task voice and RTC can use it at the same time. `POST /v1/rooms/{room_id}/close` ends both: Participants disconnect, Task-voice signals end, RTC connections are revoked and SDK sessions report `closed`. A closed Room cannot be joined, reconnected or reopened. A Task that is still running when its Room closes keeps its own lifetime and is not given a result by the close: it ends as `task.expired` with its quota released after the idle timeout (20 minutes by default), or after its 75-minute execution lease if the process running it is gone. End or cancel Tasks first when you need a prompt terminal. No API or contract change.
## 2026-10-17 — ContextSnapshot locale reaches the speech Provider
A dictation Task's ContextSnapshot locale (the only Provider-projectable context item, `{"kind":"locale","value":{"language":...}}`) is now delivered to the speech Provider as a recognition hint after the Task's own language; for the Paraformer streaming adapter it becomes an additional `language_hints` entry. Routing, model, region, price and the result language stay bound to the Task language. A ContextSnapshot input may now precede the primary SignalStream in the Task inputs. `GET /v1/context-snapshots/{id}` returns `created_at` in UTC, as create does, regardless of the server's time zone. A ContextSnapshot input still cannot be attached to a Task created over the realtime connection: the connection grants do not include `context_snapshot.read`.
## 2026-10-17 — ESP32 RTC SDK delivery guide
New developer handoff for the ESP32 RTC component graph, PCM capture/render bridge, admission and lifecycle owners: what to reuse, caller duties, evidence bindings, reproduction entries and the device-only gates that remain. No SDK or API change.
## 2026-10-17 — ESP32 RTC SDK smoke project
New board-agnostic OEM project `sdks/esp32/examples/rtc_smoke` runs one minimal real-device sequence through public OneSay APIs only: Task connect, stream and release, then RTC prepare, audio connect, capture, one packet and release. It prints a single content-free `ONESAY_RTC_SMOKE` summary line. Export it with `node tools/sdk/export-esp32-oem-example.mjs --example rtc_smoke <dir>` and build it without hardware with `node tools/sdk/build-esp32-idf-component.mjs --rtc-smoke`. A refused capture start or render open, such as `ONESAY_ERR_RESOURCE_BUSY`, is reported with its unchanged error. The RTC bearer comes from an OEM callback because the SDK has no public Device-token exchange for RTC. Real-device results are not yet available.
## 2026-10-15 — Early return of unused RTC connection quota
When an RTC connection ends before its current quota segment does, the unused part of that segment can now return to the project's weekly connection-time budget. This happens only after every native session of the connection is proven finished, and the returned amount is limited by the platform's own native lifecycle reports. Anything unknown stays reserved. Only available capacity changes: no usage, billing, refund or reversal record is created. No public API change.
## 2026-10-17 — Fewer serialization aborts for Agent media authority
Agent media preparations, Agent claim operations and Human subscription preparations for a Room now queue for each other before their database snapshot instead of aborting each other with a serialization failure, and the authority change exporter waits for an in-flight preparation of the same Agent execution. Authorization checks, retries, the 500 ms preparation limit and error codes are unchanged. No public API or contract change.
## 2026-10-17 — ContextSnapshot timestamps on read
`GET /v1/context-snapshots/{id}` now returns `created_at` in UTC, exactly as the create response does. A server running in a non-UTC time zone previously returned the same instant with its local offset, so the read did not match the create response byte for byte. No contract change.
## 2026-10-17 — Complete local CI on the Linux lane
`tools/ci/wsl-local-ci.sh <commit>` runs the equivalent `ci:local` composition (`tools/ci/run-local-ci-composed.mjs`) on one exact clean commit with owned fixtures; see `docs/development/M1_LOCAL_CI_RUNBOOK.md`. Local CI now splits the Control repository package into twelve test shards; budgets are unchanged. Current-source CCR evidence readers accept clean re-executions selected in the execution ledger. No runtime or contract change.
## 2026-10-15 — Explicit `resource_busy` for held audio devices
New error code `resource_busy` (retryable, client-side). The JavaScript SDK raises it from `publishMicrophone` when the browser reports the microphone held by another capture (`NotReadableError`, or `TrackStartError` in older Chrome); other start failures stay `client_audio_capture_failed`. The ESP32 SDK adds `ONESAY_ERR_RESOURCE_BUSY` for OEM capture `start` and render `open` callbacks, and `onesay_esp32_rtc_read_media_status` returns the first such failure unchanged, because media starts after `onesay_esp32_rtc_connect_audio` returns. Neither SDK retries, preempts or cancels the other Task/RTC owner.
## 2026-10-15 — Agents and selected-mode encryption
An Agent execution can no longer use an end-to-end encrypted audio publication as input; the request is refused with `resource_state_invalid`. Agents cannot decrypt selected-mode media, so choose transport encryption when an Agent must process the audio.
## 2026-10-15 — JavaScript selected-mode RTC media encryption
`rtc.connect({ mediaEncryption: "e2ee" })` encrypts audio frames end to end with server-issued per-participant keys that rotate every 30 seconds; unsupported browsers fail before admission and never join unencrypted. `session.capabilities.e2ee` is true only in this mode. The platform issues the keys and can decrypt. A transport-only connection can no longer subscribe to an encrypted publication.
## 2026-10-15 — Fewer database round trips in Device quota renewal
A complete Device media quota renewal issues about 21% fewer SQL statements (for example 904 to 726 in the local fixture) by reusing clocks and checks that are already taken at the same point in the same transaction. Authority, locks, expiry checks and the 500 ms limit are unchanged. No public API or contract change.
## 2026-10-15 — Selected-mode RTC media encryption keys (server)
`POST /v1/rtc/connections` accepts optional `media_encryption: "e2ee"`; the mode is fixed for the connection. New `GET /v1/rtc/connections/{connection_id}/media-keys` (`rtc.media_key.read`) returns the caller's current per-sender audio keys under fresh authority. The platform derives these keys and can decrypt; this is not zero-knowledge encryption. SDK support is not yet available.
## 2026-10-15 — Local Go test units
Local CI runs each serial Go package as its own bounded unit and splits the Control repository package into four complete test shards. Scope, flags and budgets are unchanged.
## 2026-10-15 — Latent test repairs
Align RTC contract, SDK and native fixture tests with the delegated RTC Actions delivered on 2026-10-14, refresh the Device conformance lock, ship the official E2EE worker in the portable Mock kit, and bind nine historical receipts to the commit that last wrote them. No runtime or contract change.
## 2026-10-15 — Local CI work units
Local CI runs each Node test file and each Go command as its own bounded work unit instead of one 900s unit per suite; scope, order and budgets are unchanged. CCR readiness tests exercise focused validation parts, and the offline CCR-B runner case has its own file.
## 2026-10-15 — Developer Portal next security fix
Upgrade the private Developer Portal from `next@16.3.6` to `next@16.3.8` for six OSV advisories, including a high-severity Image Optimization SSRF. Dependency-only change; no OneSay runtime or public contract change.
## 2026-10-15 — Observer R8 and preparation check repairs
Re-run the CCR observer suites after the reader profile change. Account for the packed-SDK RTC example in the dependency audit by its exact manifest, allowlist reviewed native LiveKit Track references, and treat appended Usage metrics as additive public-surface changes. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
## 2026-10-15 — Current-byte BOOT and Generated requalification
Re-execute the original BOOT and Generated qualification lanes on current working bytes and let the existing CCR readers select them through a profile table. Historical executions keep their original checks and are tested against the exact bytes they ran. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
## 2026-10-15 — Failed local CI r5 archive and execution handoff
Archive the complete local CI attempt at 4d323d1b, which fails acceptance on evidence digests after line endings in two working-tree files changed with unchanged Git content. Execution moves from Codex to Claude Code; the Owner-approved termination evidence for this run is the on-disk collector receipt and watchdog record. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
## 2026-10-15 — Current native ticket-erasure evidence
The E8 acceptance reader now consumes the actual current TLS constructor results with complete source, compiler-input, raw-output and cleanup validation. Earlier failed and successful executions keep their original source identity. Six additional tampering cases cover the new evidence representation. Restore the historical raw-log whitespace rule precedence without changing original logs; remaining format and complete-CI results are recorded separately.
## 2026-10-15 — Format and Task memory coverage closure
Preserve one exact historical failed-reader syntax capture through its original source and terminal provenance. The full format check now passes on the current candidate. The Task-native memory coverage reader derives its scope from the CMake graph and leaves the conditional RTC graph to its separate qualification; the seven prior native memory phase results remain source-bound and their old aggregate failure is retained.
## 2026-10-15 — Full M1 scope continuation and current local evidence
Record the Owner's decision to complete the original M1 v3 scope without adopting the proposed staged reductions. Preserve the completed34-stage CCR result, subsequent E8 source-binding failure and separately successful current native TLS/Gateway execution. Correct one missing quote in a historical GX11 handoff receipt through a separately documented sibling; retain the original source and test result. No runtime behavior, scope denominator, progress credit or deployment authorization changes.
## 2026-10-14 — GX progress and first-Staging scope audit
Document the actual implementation, existing evidence, remaining qualification and possible staged delivery for every GX00–GX19 package at source e7d08573. Distinguish the existing complete G_PRE contract from a proposed restricted internal Staging scope. This report changes no runtime, active scope, progress credit, deployment authorization or historical test result.
## 2026-10-14 — Deliver original validation logs
Include referenced raw evidence logs in Git and preserve their original bytes. A tracked-only Linux source copy exposed logs that existed locally but were omitted by the general log ignore rule. Historical source identities and results remain unchanged. The current full CI timeout, separate source-copy diagnostic and native dispatch test results remain individually recorded in the M1 implementation log.
## 2026-10-14 — Current AppSession contract compatibility
Refresh the OS-PLATFORM-0009 current compatibility readback and regenerate its shared fixture against the current canonical specification. AppSession actions and authorization semantics remain unchanged. Preserve the frozen contract and previous readback; current local contract validation is recorded separately from the earlier full CI failure.
## 2026-10-14 — Current Linux Observer validation
The existing local Observer checks now have a separately recorded current Linux execution with116 passing cases and no failures or skips. The original preparation failure remains visible. Current evidence selection and the generated-limits test follow the frozen Linux profiles; this does not qualify full local CI or any external deployment.
## 2026-10-14 — Linux local validation provenance
The existing local validation readers now distinguish newly executed Linux BOOT and public Node checks from historical routing results. Generated-scope failures and incomplete capture remain visible alongside separately verified input readback. This changes validation tooling only; actual regression status is recorded in the M1 implementation log.
## 2026-10-14 — Native-input Console Agent qualification
Added an opt-in Linux fixture reusing the existing patched native host, authority worker and official publisher to qualify current Console Agent controls. Ephemeral connection material stays in the private child pipe. Public creation precedes reviewed explicit stop and readback; desired and observed stopping remain distinct. No model or Provider execution is included. Actual local results and remaining gates are in the GX10 Web local release report.
## 2026-10-14 — Local Console authority qualification
The existing real Local API browser proof now exercises two signed test identities, public developer membership, foreign-owner resources and a Test-scoped Service credential. Identity selection stays inside the owned test process; browser roles and resource permissions still come from the existing public API. The same Rooms read supplies the Service scope positive and negative controls. This adds qualification tooling, not an administrative endpoint or a new authentication system. Actual results and remaining gates are recorded separately in the GX10 Web local release report.
## 2026-10-14 — Reviewed Device credential rotation
Active Device details now offer the existing Human-authorized credential rotation API through review and a separate Execute action. The server immediately revokes previous Device credentials and returns a replacement secret with public credential metadata; there is no overlap period or automatic deployment to hardware. The Console distinguishes Device secrets from Service API keys and provisioning codes, reusing masked disclosure, explicit copy/clear and same-key retry. Mock writes remain disabled. Actual local qualification and unexecuted hardware/cloud limits are recorded separately in GX10 Web release report section R.
## 2026-10-14 — Credential and Device secret operations
Console now reviews and explicitly executes the existing Credential creation/rotation and Device creation/provisioning-code APIs. API key rotation immediately revokes the previous key; a new provisioning code supersedes prior unconsumed sessions and does not activate hardware. Returned secrets stay in the current disclosure state, masked by default, with explicit reveal/copy and clear controls. Scope, navigation and session changes clear that display; provisioning expiry follows the server timestamp. Ordinary reads return metadata only, while an uncertain request can explicitly retry its original key to recover the protected response. Mock writes remain disabled. Actual source-bound local checks and external limits are recorded in the GX10 Web release report.
## 2026-10-14 — Reviewed resource creation and terminal operations
Console now prepares explicit reviews for Organization, Project and Application creation and for Project archive or Application, Credential and Device revocation. The existing public API remains authoritative; no new Consent or administrative endpoint is introduced. Unknown outcomes retain the same immutable request key for explicit retry. Project creation refreshes its choice locally; archiving the selected Project clears that scope. Mock writes stay disabled. Secret creation, credential rotation and Device provisioning remain separate workflows. Actual affected local results and external limits are recorded in the GX10 Web release report.
## 2026-10-14 — Resource details and reviewed metadata updates
Console now reads complete public Organization, Project, Application, Credential and Device details. Four existing metadata PATCH operations use explicit review and the canonical Idempotency-Key; credential metadata remains read-only. Scope changes and denied responses clear stale details, and uncertain outcomes retain the reviewed request for an explicit same-key retry or independent refresh. Mock Mode stays read-only. The ESP32 RTC Quickstart now follows the implemented prepare, connect, binding-read and close lifecycle. Local evidence and unexecuted native/hardware/cloud limits are recorded separately in the GX10 Web local release report.
## 2026-10-13 — Request diagnostics and dimensional Usage
Developer Logs can open a request timeline through the existing scoped public API. The Console separates the queried request from the response request ID and preserves safe metadata and recorded timestamps. The HTTP authorization adapter now includes this existing operation and resolves its scope from durable logs, retaining current membership, credential and grant checks. Usage summary now lists each metric and billable flag separately; event details retain null resource links and reversal facts. Currency, prices, remaining quota and final bills are not inferred. Local Mock examples now follow the actual public Usage and log contracts. Actual local validation and external limits are recorded in the GX10 Web local release report.
## 2026-10-13 — Agent execution details and confirmed stop
Console can read a Room's Agent execution and prepare an explicit Human confirmation before requesting stop through the existing public API. It preserves desired state, observed state, playback and effective stop time separately, and retains the same operation key only for an uncertain transport/server outcome. Mock Mode remains read-only. Local UI and controller evidence is separate from real native-input, Agent runtime and Provider qualification; the GX10 Web local release report records actual results and remaining gates.
## 2026-10-13 — Separate service and SDK Quickstart entries
The Developer Portal now links directly to JavaScript/ESP32 × Task Voice/RTC sections in the two existing Quickstarts. The guides reuse the installed Task sample, browser RTC example, Task-only OEM export and existing RTC component contracts; their local, native and hardware limits stay explicit. The synthetic WSS/OSAF playground is named as a Task protocol playground. Direct section navigation also keeps the Docs table of contents aligned with the combined page scroll padding and heading margin. No route, SDK, backend or design-system replacement is introduced. Current local interaction evidence is recorded separately in the GX10 Web local release report.
## 2026-10-13 — Bound credential query-plan diagnostics
Add an opt-in, redacted execution-plan probe to two existing real PostgreSQL credential cases. The plan and one default-rate CPU diagnostic do not establish a performance fix: the original500ms race path still fails in initial complete-media setup. Preserve actual source-bound diagnostics and leave the runtime query and qualification status unchanged; details are in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Reuse complete owner history in Device target Service checks
Use the existing read-only phase's complete owner history while keeping each original Service interval, capture, currentness and expiry checks. Real PostgreSQL affected tests pass48 events in nonrace mode. Race Service regressions pass15, but initial complete Device refresh still exceeds500ms; full qualification remains open. Source-bound results are recorded in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Reuse selected Device receipt JSONB values
Materialize seven selected snapshot payloads inside the existing Device facet guard without changing its full validation algorithm or500ms bound. Migration static/consistency checks pass. Actual PostgreSQL nonrace qualification passes59 events; race passes34 but the complete receipt fault still times out, so later race/native qualification remains unpassed. Exact source evidence and unchanged progress are in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Make extra quota SQL recording explicitly diagnostic
Enable the extra first-eight-call SQL failure recorder only with the existing diagnostic environment opt-in. Retain normal production metrics/failure observation, request/origin fault hooks, all assertions and 500ms. Same-source nonrace passes 63 events; race passes 38 with four failures because receipt_omits_packet still times out at 500308 microseconds instead of reaching its required constraint rejection. Later race positives/public media remain NOT_RUN. This corrects test instrumentation, not a proven latency cure; exact source, actual exits, cleanup and the next bounded duplicate-read inspection are in M1_IMPLEMENTATION_LOG. No progress credit.
## 2026-10-13 — Avoid unused fresh Grant expiry clocks
Skip an unused expiry-time query only after a successful fresh read with no finite Grant deadlines. Preserve finite and retained-row clocks and cancellation. Thirteen new real PostgreSQL cases pass in nonrace and race. Nonrace affected tests pass 326 events; race passes 301 but receipt_omits_packet still times out instead of producing its required constraint rejection. Later race checks are NOT_RUN. Exact evidence and the next bounded test-diagnostic correction are in M1_IMPLEMENTATION_LOG; no new credit.
## 2026-10-13 — Batch eligible initial Grant histories
Reuse the complete-history batch reader when both principals have already-read empty denial candidates for every reference, preserving original initial lock order, scalar validation and fresh final authority. Ten PostgreSQL regressions cover history, fallback, shared memory and observed lock order. Nonrace affected tests pass 313 events; race passes 282 but full Device renewal still exceeds 500ms. Later race positives/public media are NOT_RUN. No progress credit or cloud qualification; exact source, exits and cleanup are in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Share strict Delegation binding admission
Reuse the existing canonical decoder, owned typed materializer and snapshot digest in one generated Go helper for the actual resolver, removing repeated parsing of the same bytes. Keep standalone parsers and all owner/currentness checks unchanged. Linux race canonical parity passes; same-source nonrace affected tests pass 324 events. Race resolver/Grant checks pass 291, but public Device complete renewal still fails at 500ms and the following Rolling lane is NOT_RUN. No latency guarantee or progress credit; exact source, tests and cleanup are in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Project immutable snapshot JSONB once per exact read
Keep the complete snapshot/audit consistency predicate and strict parser while avoiding repeated extraction of the large stored payload. Actual PostgreSQL equivalence probes preserve NULL, casts, exact audit and complete facts; existing storage/role checks remain. Same-source nonrace passes171 events including complete Device Rolling. Race passes151 but fails the first full Device quota call at500ms; later positives are NOT_RUN. The blocker remains open, with no latency guarantee or progress credit. Exact source, receipts and cleanup are recorded in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Preserve quota completion cancellation and deadline errors
Keep original context errors at both quota completion returns instead of replacing them with permanent policy denial. Expired material still denies; commit/retry behavior and 500ms remain unchanged. Ten selected Linux race unit roots pass 66 events. This repairs a confirmed classification risk but does not identify the prior full-path failure branch or close the Device race/500ms blocker; integration results remain bound to their earlier source. See M1_IMPLEMENTATION_LOG for exact evidence.
## 2026-10-13 — Reuse verified subscription first-bind provenance
Reuse first snapshot, original attachment and verified inbox facts only within the same initial quota subscription function; keep current route reads, exact tuple matching, original fallback and all post-reservation authority checks. Same-source nonrace passes 74 test events. Race passes 54 events but fails the first complete Device quota call at 500ms with a denial and observed SQL deadline; later mandatory positives remain NOT_RUN. Exact source and terminal results are recorded in M1_IMPLEMENTATION_LOG. No latency, full CI, native/cloud qualification or progress credit is claimed.
## 2026-10-13 — Reuse the same Delegation batch's locked fence union
Remove repeated principal fence reads only inside the existing read-only Delegation batch; preserve complete Grant/deny/history checks and fresh expiry/transaction observations. Extend existing PostgreSQL tests for the lexical handoff, including actual blocked deny writer and elapsed expiry. Final selected race Grant tests pass 270 events; same-source nonrace Grant plus complete media Rolling pass 292. Preserve the original-source complete Rolling race/500ms failure; no latency, native/cloud qualification or progress credit follows. Exact inputs and terminal results are recorded in M1_IMPLEMENTATION_LOG.
## 2026-10-13 — Device publication fence and clock read
Reuse the existing locked publication Consent fence with a conditional post-lock clock in one SQL call. Complete Rolling nonrace passes 22 test events; race retains two withdrawal-negative passes and fails the first full-facet quota at original 500ms. Exact source and terminal receipts are recorded in M1_IMPLEMENTATION_LOG; no capacity, external qualification or progress credit follows.
## 2026-10-13 — Complete Device quota phase measurement and fixed-count non-race validation
- Preserve the initial race/2s Consent-setup failure, then record the actual r2 and non-race diagnostic successes: each complete Rolling root passes 22 test events. Race's three named full-facet positives take 619.984–633.927ms; these 2s snapshot results do not qualify the unchanged production 500ms path.
- Add elapsed/result observation only to the existing two Rolling test files. Under original 500ms, one non-race ELF passes three fixed complete iterations / 66 events, with named positive times 358.391–415.436ms. No retry or assertion relaxation; three iterations do not prove stable tail latency, full CI or race qualification.
- Full-phase evidence identifies initial subscription and fresh final checks as substantial cumulative costs. Continue reducing existing-owner duplicate work with all authority/history/lock/expiry guarantees intact. Preserve prior race/500ms failure, external NOT_RUN gates and unchanged progress. See the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Deduplicate complete current-deny selectors in the existing locked Grant batch
- Preserve exact selectors, original rows/history, false-only fallback, fresh clocks and 500ms while evaluating each complete deny tuple once. Three new real-PG cases pass, including actual two-versus-ten function evaluations; no end-to-end latency improvement is claimed.
- Same-source non-race passes two roots / 292 test events. Race passes Grant 270 and two Rolling negatives, then the first full quota request expires at 500ms: 272 PASS / three FAIL events, with later three named positives NOT_RUN. Preserve that failure and unchanged progress; one non-race pass is not stable performance qualification.
- Reuse the existing complete-phase diagnostic observer on the exact current baseline before choosing the next reduction; retain formal 500ms, full final authorization and external NOT_RUN gates. See the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Consolidate fresh native route reads from bounded diagnostic evidence
- Add test-only bounded clock/isolation callsite attribution; its Linux/race unit passes 12 events. A separate race/2s diagnostic passes 22 events with six actual complete media calls, but 26–32 dropped stack observations per complete call and diagnostic-only timing prevent qualification or complete attribution claims.
- Preserve the old-ELF CPU diagnostic failure: receipt SQLSTATE 23514, context OK, rather than timeout. Combine current native connection/publication route SQL, retaining isolation, exact predicates, least privilege, owner/recheck order and original budgets; the observed request shape supports 34 fewer statement round trips, not a measured latency result.
- Preserve the first formal failure: three native roots pass, while the old least-privilege premise fails before lookup because migration 137 intentionally expanded the shared role. Restore only the test's two-column privilege restriction inside its owned transaction, retaining negative assertions and rollback; Rolling was NOT_RUN in that failed attempt.
- The corrected exact-source non-race selection passes five roots / 75 events (native 53 plus complete Rolling 22); the four native roots also pass race / 53 events. The complete Rolling race root was not rerun. Keep the complete-media race/500ms blocker, historical failures, external qualifications and progress unchanged; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Batch existing external quota snapshots
- Reuse existing multi-capture storage for the original facet union, preserving locks, authority, rollback/receipt guards and 500ms. The static full-facet path removes 24 client SQL round trips; numeric latency improvement is NOT_ESTIMATED.
- Non-race affected suite passes 12 roots / 79 events, including two new real-PG rollback cases and original media positives. Same-source race records 1 PASS / 2 FAIL roots and 11 PASS / 6 FAIL events; first full quota calls still expire, so batching is insufficient. Storage and later race cases are NOT_RUN; eight Human race roots remain unselected and the frozen twelve-root race configuration unexecuted. Preserve credit and historical/external evidence; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Preserve the exact-source race failure after fixture ordering
- The same three-root affected race run finishes with 1 PASS / 2 FAIL roots and 11 PASS / 6 FAIL test events; package failure is separate. PublicMedia and Rolling fail their first full quota request at observed 501ms / 500ms; preparation retry passes. Same-source non-race 40 PASS events remain separate, and two native roots remain NOT_RUN.
- Continue structural reduction of duplicate initial subscription and snapshot/receipt database work while preserving authority, locks, fresh final checks and 500ms; do not add another small fence cache. Preserve all failures and progress; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Validate the existing media fixture's connection preparation order
- Reorder one test fixture so both original connections are created before per-endpoint close operations and Grants; preserve public requests, clocks, expiry, 500ms owner limit, refresh window and every existing assertion.
- The three selected real PostgreSQL non-race roots pass 40 test events, including all 20 Rolling events and its three named positives. This source's race and two native roots remain NOT_RUN; earlier race/diagnostic failures are preserved, and no claim of stable latency or guaranteed window alignment follows. Progress is unchanged; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Preserve setup-window failure and exact full-path measurements
- Preserve a zero-test image-validation failure, then correct one digest in a fresh diagnostic runner. The corrected race/2s diagnostic still fails: 0 PASS / 1 FAIL roots, 2 PASS / 3 FAIL test events, package FAIL separate. Its actual assertion is an out-of-window completed baseline after natural waiting, not a quota deadline.
- Two prior full-facet setup receipts succeed at 614.579ms / 660.887ms with 1056 / 1039 SQL calls. Preserve all 38 phase records per request, zero observer drops and bounded top-SQL rankings. All three named positives are NOT_RUN, so their current-versus-historical timing comparison is unavailable. Formal race FAIL, non-race companion PASS, qualification limits and progress remain unchanged; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Reuse checked AppSession history and retain separate race/non-race results
- Reuse complete checked AppSession history only inside its original active read-only phase, preserving fresh database time, full fallback, authority/locks and original observation boundaries. Add 15 mechanism cases under the existing real PostgreSQL Grant root; correct setup refresh-window prediction without changing formal same-coverage assertions or the 500ms owner limit.
- Execute the identical five-root affected suite on the same frozen source in both modes. Race: 4 PASS / 1 FAIL roots, 454 PASS / 3 FAIL test events. Non-race companion: 5 PASS roots / 472 PASS test events, including all 20 full Rolling events. Package results are separate. Race still fails its first complete quota request on an observed internal SQL-context deadline; exact SQL/cumulative stage remains unknown.
- Keep the non-race companion's actual PASS distinct from full CI, repeatable latency qualification and required race qualification. Preserve historical diagnostic eligibility, all gates and progress; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Separate transaction-function evidence from business qualification
- Execute the prepared owned PostgreSQL function-statistics diagnostic once. Both setup quota requests succeed with receipts, but the existing dependent-followup coverage assertion fails: 0 PASS / 1 FAIL roots, 2 PASS / 3 FAIL test events, plus one package FAIL. Preserve the failure without retrying for green results.
- Statistics coverage independently passes two samples / 53 function rows / zero drops. Receipt validation is the largest self-time row (31.912024ms / 29.135003ms); receipt encoding is 0.206ms / 0.055ms. These are transaction-scoped diagnostic observations with measurement overhead, not isolated receipt CPU, a source fix or formal500ms qualification. Continue existing SQL-body inspection without score/state changes; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Reuse bounded decoded history and verify the full quota path
- Reuse decoded Grant/resource-owner representations inside existing read-only phases, preserving raw-byte binding, independent copies, complete interval validation, retention bounds and full fallback. Existing real PostgreSQL Grant/owner/session/runtime roots pass 437 events; formal Rolling passes two authority negatives then fails its first full request at 500ms. Combined formal result: 4 PASS / 1 FAIL roots, 439 PASS / 3 FAIL test events; packages separate. This run observes no failing SQL, so no previous generation's SQL cause is transferred.
- Execute the changed existing phase-boundaries unit with the same compiled Linux race ELF: 1 root / 91 events PASS, no rebuild or services. Keep its receipt separate from formal PostgreSQL results.
- Exact new-source race/2s and non-race/500ms diagnostics each pass 20 events with real full-facet positives and zero observer drops. They are qualification-ineligible. Matched historical requests use 49 fewer SQL calls, but combined source/history changes prevent typed-only or precise race-cost claims; formal race/500ms remains FAIL. Preserve score and external gates; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-13 — Measure complete Device quota phases and reduce existing-owner round trips
- Learn from the supplied full-path analysis without changing architecture authority: classify stable representations separately from live authority, retain Serializable/final rechecks and the formal 500ms limit, and reuse the existing owned fixture/observer.
- Four pre-P1 diagnostic cells are sealed separately: both non-race cells pass 20 events with required full-facet positives; race/500ms ends at subscription_final, while race/2s completes positives but exposes attachment-error mapping. Snapshot/receipt tail is now observed. No exact race-cost ratio, formal qualification or credit follows.
- P1 phase-local isolation reuse passes 238 real PostgreSQL events. Fresh post-Reserve Grant-history batch hydration and exact attachment mismatch mapping then pass 252 Grant plus 10 runtime-quota events; full Rolling still fails after two authority negatives. Current total is 2 PASS / 1 FAIL roots, 264 PASS / 3 FAIL test events, package results separate. Its Consent SQL deadline observation is not a proven cumulative root cause.
- Existing-phase typed/raw decode reuse is IN_PROGRESS / NOT_RUN. Preserve all source generations and external gates; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Observe existing quota SQL failures in the owned PG fixture
- Connect the existing bounded error observer through two test files, preserving production behavior, SQL, deadlines and assertions. The synthetic observer unit passes 10 test events; its fabricated errors are excluded from real PostgreSQL diagnosis.
- The real Rolling root passes two authority negatives then fails complete quota at observed 500ms. Its own SQL observer records an internal context deadline at sql_other, with one record and zero drops. Exact SQL and business stage remain unknown; the previous run's mapped failure retains its UNKNOWN cause. Combined 1 PASS / 1 FAIL roots, 12 PASS / 3 FAIL test events, package FAIL separate. Continue unclassified SQL and accumulated authority rechecks with no new CPU profile or credit; see the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Reuse complete Device quota roots after reservation
- Reuse the existing original-root batch in a fresh post-Reserve final phase, preserving route order, original owner/Service/attachment checks, clocks and the unchanged 500ms limit.
- Formal Linux/race checks pass 83 local-unit events and 10 real PostgreSQL runtime-quota events. The separate complete-media Rolling root passes two post-audit authority negatives, then fails its first full-facet quota call at observed 500ms with applicationruntime.Error / capability_authority_unavailable. Combined result: 4 PASS / 1 FAIL roots; 95 PASS / 3 FAIL test events; one package failure counted separately.
- Current original cause remains UNKNOWN and SQL is UNOBSERVED; elapsed time does not prove a raw deadline cause. Next reuse the existing bounded SQL failure recorder in the PG fixture before application error mapping, with a separate future source/run binding. No progress credit or complete-media PASS. See the [source-bound implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Reuse complete subscription roots in the final authority phase
- Reuse the existing Device retained-root union in fresh post-audit preparation, keeping complete original authority, clocks, transactions and the 500ms limit. Two real PostgreSQL post-audit Grant/Consent withdrawal regressions pass.
- Formal Linux/race affected guard/owner and retry lanes pass 43 plus 9 events. Rolling passes the two new negatives, then its first full-facet quota refresh fails at 500ms with pgconn.errTimeout; Rolling has 2 PASS / 3 FAIL test events, with package failure counted separately. Current SQL timings remain UNOBSERVED.
- Preserve the preceding same-ELF CPU diagnostic separately: full quota was reached, 975 SQL calls / 354733us were observed, and only 14 sparse CPU samples match the quota coordinator. Whole-test CPU is not quota cost; this is no performance PASS or race-cost estimate. Continue the actual quota blocker without progress credit. Source, cleanup and precise evidence are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Execute the existing Rolling diagnostic's mandatory positive cases
- Reuse the existing Rolling root with all original limits and assertions. Non-race diagnostic passes 18 events, explicitly exercising both peers' complete quota advancement, exact receipts, no-extra-reservation followup and existing rollback/revocation cases.
- Race diagnostic fails earlier in subscription preparation/dependency registration at 500ms, before positive quota cases. Its different exercised workload prevents a race-cost estimate; the non-race result remains qualification-ineligible.
- Preserve prior formal failures and the original public-media pair's coverage gap. Continue the observed 500ms preparation path without new gates or progress credit. Exact source, actual terminal evidence and cleanup are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Require comparable quota work before interpreting race diagnostics
- Preserve the source-matched diagnostic outcomes: race full-quota failure, and non-race media-root 11-event PASS with zero recorded quota calls. Both profiles remain qualification-ineligible; no non-race 500ms quota PASS or race-cost conclusion follows.
- The non-race fixture finished without entering a refresh window. Next reuse TestRTCDeviceMediaRollingInPostgres, with its existing real-window wait, mandatory full-facet advancement and exact receipt assertions. Keep all original time bounds and race qualification; no new test source or acceptance gate.
- The separate 236-event real PostgreSQL PASS and formal full-media failure remain unchanged. Same-source evidence, differing workload coverage, cleanup and unchanged progress are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Reuse same-call Consent facts and combine Delegation reference discovery
- Copy dependency facts immediately after existing consumed-Consent verification; later checks still reread storage. Combine bounded immutable Delegation reference discovery while preserving full validation, fresh authority and the original 500ms quota budget.
- Preserve the first run's SQLSTATE 55006 fixture failure and its two later NOT_RUN lanes. Correct only premature trigger-restoration DDL; the rerun passes four real PostgreSQL roots / 236 events, including Consent, Delegation and subscription recovery.
- Complete Device media remains failed: 501ms observed, capability_authority_unavailable, with no exact internal cause or SQL timing established. A bounded diagnostic may distinguish race cost, but cannot replace race qualification or grant credit. Exact deltas, both source-bound runs, cleanup and external limits are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Combine Device media audit with its adjacent fresh clock
- Preserve every original audit predicate, authority, expiry and error boundary in one conditional SQL read; no clock cache, omitted check or 500ms budget change. Expand only the opt-in diagnostic fingerprint capacity from 64 to 128.
- Linux/race affected checks pass 2 roots / 18 events: one diagnostic unit root and one real PostgreSQL subscription-recovery root. Full Device media still fails its first 500ms quota refresh; SQL timing remains unobserved in that formal run.
- The separate ineligible diagnostic fails with 1039 queries / 355732us cumulative SQL, 113 fingerprints / zero drops, reservation complete and no snapshot/receipt INSERT observed. Its last failed query is SHOW transaction_isolation, not rollback or an identified unique cause. Continue removing proven duplicate authority reads within existing boundaries; no complete performance PASS or progress credit. Source, cleanup and external limits are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Reuse current Device Grant rows across already-locked roots
- Use one bounded lexical raw read after original Grant locks and the full principal fence union. Preserve Device dual-subject/pair semantics, original root-slot parsing, fresh expiry checks and final fences; negative or malformed roots return to the original reader. No phase authority cache or Human reader substitution is introduced.
- Linux/race Grant regression passes 235 events, including nine new cross-root/expiry/fallback scenarios. The original full-media root still fails its first 500ms quota refresh; current SQL timing remains unobserved, so no measured end-to-end improvement is claimed.
- The separate changed-source SQL diagnostic also fails: 1083 queries / 355886us cumulative SQL, reservation complete and no snapshot/receipt write observed. Retained fingerprints are incomplete and the final failure is rollback cleanup; deadline-truncated counts do not prove full-workload gains. Next examine adjacent SQL/fresh-clock reuse. No further implementation has been made; this candidate remains unverified. Source, cleanup, unchanged progress and native NOT_RUN are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Combine the Device batch's adjacent isolation and clock reads
- Restrict the 17-line addition / 4-line removal to the existing original-record handoff after Application union locks. Keep a live Serializable check, fresh clock, complete authority and unchanged nil-original path; introduce no time cache or omitted locks.
- Linux/race Grant regression passes 226 events, including three real invalid-transaction cases. The original full-media root still fails its 500ms quota budget with pgconn.errTimeout; current SQL timings and the exact failing stage remain unobserved. This is not complete performance qualification.
- Continue reviewing compatible same-phase Device current-Grant reads, preserving dual-subject/pair semantics, per-root clocks and error order. Do not substitute the Human reader or repeat diagnostics solely for this small change. Exact source, cleanup and unchanged progress are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Batch Device denial-candidate discovery within the existing phase
- Reuse the existing bounded phase map for one unlocked candidate batch; preserve full authority/history/selector checks, original lock order and the shared 256 KiB limit. Invalid results or insufficient space retain no partial batch. Actual SQL errors fail closed through the original classifier and may be reported earlier.
- Linux/race Grant correctness passes 223 test events, including 13 new scenarios; the original full media regression still fails its 500ms quota owner. A separate changed-source sql-only-v1 diagnostic also fails: 1063 queries / 357556us cumulative SQL, reservation completed but snapshot/receipt not reached. Deadline-truncated counts do not establish complete performance gains; rollback remains cleanup evidence.
- Continue a narrow review of repeated isolation reads while retaining live-transaction/error boundaries, clocks, locks and final freshness. No progress credit or native qualification is claimed. Both source-bound runs, prior evidence and owned cleanup are retained in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Attribute the remaining Device full-quota deadline
- One existing sql-only-v1 PostgreSQL diagnostic retains the original race/500ms assertions and fails the public media root:1020 queries,357412us SQL total, longest3044us. Reservation completes; snapshot/receipt writes are not reached. The last failed query is cleanup rollback, and the bounded query mix cannot identify a lock holder or unique cause.
- Preserve DIAGNOSTIC_FAIL/qualification ineligible, previous six recovery-case PASS and separate unit/native evidence. Next inspect same-phase repeated owner reads without removing final freshness, widening budgets or claiming a fix. Source, cleanup and unchanged progress are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Recover confirmed Device public subscription preparation rollback
- Rebuild Device public subscription preparation once only after a successful raw pre-Atomic40001 rollback, preserving the original5000ms deadline and full authority. Keep Authorize, Human, Packet, replay and Commit recovery unchanged. Six real PostgreSQL fault-injection scenarios pass; separate Linux/race boundary units pass2 roots/20 events.
- The original full media regression still fails its500ms quota refresh, so the combined PostgreSQL run is1 root PASS/1 FAIL with9/3/0 test events. Native is NOT_RUN for this correction; preserve the previous native failure at its original source. Continue with the existing sql-only-v1 diagnostic, without relaxed limits or progress credit. Exact source, cleanup and both outcomes are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Attribute native owner SQL failures and first disconnect
- Reuse the installed fixture tracer for bounded lifecycle/quota SQL attribution and retain the first original Room disconnect. Preserve authority, deadlines and runtime behavior. Linux/race diagnostic checks pass4 roots/38 events; synthetic Node VM checks pass7. These are not native or new PostgreSQL qualification.
- The actual native run fails both roots differently: parent subscription HTTP500 with a same-request40001; and first JOIN_FAILURE during publish, followed by an install-precondition failure. Observed lifecycle lock/deadline and quota cancellation records do not identify the conflicting transaction or prove the close cause. Preserve exact evidence, cleanup and unchanged progress in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md). Continue the existing subscription/upstream-close investigation; no fix is claimed.
## 2026-10-12 — Recover confirmed publication projection rollbacks
- Rebuild the complete signed-publication projection once after a confirmed pre-commit serialization rollback, inside the original500ms budget. Preserve original authority, atomic inbox/projection and both Commit no-retry boundaries. Actual Linux race PostgreSQL passes3 roots/35 events with real fault injection; the replay Commit witness is explicitly not natural read-only SSI.
- Both subsequent native roots pass exact publication readiness, then fail before media installation because the SDK session is closed. Lifecycle deadlines and quota cancellation/40001 remain unresolved; no media or progress credit follows. Source-bound results, owned cleanup and the next narrow attribution step are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Check each original publication and expose lifecycle failures
- Correct Device native readiness to require each of the four original publications and its exact signed receipt, while accepting legitimate repeated deliveries for the same tuple. Keep the six-second deadline and add bounded failure-only state readback.
- A transparent test-only lifecycle observer and existing diagnostics pass3 Linux/race roots/30 events. Native evidence confirms publication preparation can recover a serialization failure, but later lifecycle deadline/conflict and connection-close failures still prevent complete media qualification. Preserve both distinct outcomes, source bindings and cleanup in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md); the next projection recovery change requires separate validation.
## 2026-10-12 — Recover confirmed publication rollback within the original authority budget
- Reuse existing private-owner recovery for non-Agent publication preparation: rebuild the complete proof once only after a confirmed pre-commit serialization rollback, retaining the original500ms deadline and all authority/attachment checks. Observe and uncertain commit are not retried. Combine two quota count/support query pairs without changing authorization or post-Reserve checks.
- Actual Linux/race PostgreSQL verification passes6 roots/45 events, including seven new recovery and withdrawal scenarios. Both complete native roots advance through SDK publication but fail at signed-media observation readback; media continuity remains unqualified. Preserve exact source, prior failures, cleanup and the next bounded cursor in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md). No upstream patch growth, cloud qualification or progress credit.
## 2026-10-12 — Bound signed join setup and identify publication SQL failure
- Reuse the original Room setup deadline to verify both exact signed joins before publishing; enforce it on setup SQL and preserve all original media/authority assertions. Add bounded request-correlated publication SQL and public Packet-policy diagnostics through existing observers. Linux race diagnostics pass39 events and Node transparency checks pass13; no production authority, SDK runtime or upstream patch change.
- Both actual native roots remain failed: RootRevoke reaches an audit INSERT40001 at82ms; Exhaustion publishes both peers, then records quota cancellation and a closed session before Packet install. Preserve distinct historical outcomes, original deadlines, source-bound evidence and cleanup in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md). Complete native continuity remains open; no new qualification credit.
## 2026-10-12 — Isolate known local AdGuard injection in browser proofs
- Reuse the existing browser route guard to block and separately record exact local AdGuard injection. Other unexpected external requests still fail; AdGuard and OS settings remain unchanged. Windows Mock passes90 checks with148 known requests blocked and0 unexpected external requests; focused Node checks pass45/0/0. Preserve separate revision6 real Local API22-check evidence, historical failures and pending complete Web RC/Owner visual acceptance in the [Web report](../web/GX10_WEB_LOCAL_RELEASE_REPORT.md).
- Preserve exact clipboard content with Windows-only CRLF/LF equivalence and raw evidence; downloads remain byte-exact and hydration errors fail the browser proof. Full-page Room captures retain actual UI rather than hiding navigation.
- Move an existing Device fixture Room-readiness wait before the second original client replay. Both peers now replay and join in both native roots; later audio/data publication still fails, so complete native qualification remains open. Focused Linux race checks pass12/0/0. Exact source, retained failures, unchanged security assertions and owned cleanup are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Preserve current Device paid authority and add Console Room detail
- Correct connection-wide processing of expired original Device quota captures: a matching paid successor now undergoes full current authority validation, while original credential revocation still stops the connection. Original identity and deadlines remain unchanged. Linux race identity checks pass34/0/0; the real PostgreSQL root passes10/0/0. Complete mixed native qualification remains open: both roots fail at the second client's public connection replay with `grant_missing`. Exact source, retained failures and cleanup are recorded in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
- Add scoped read-only Console Room details, refresh/back, response validation and stale-data clearing through the existing public API client. Node31/0/0 and real Local API22 checks pass for their recorded sources. Screenshot coverage, historical setup/capture failures and remaining Mock/full-RC/Owner visual acceptance are recorded in the [Web report](../web/GX10_WEB_LOCAL_RELEASE_REPORT.md). No cloud or complete UI qualification is inferred.
## 2026-10-12 — Exercise current Device media-authority roots
- Add bounded private request correlation and repair owned standalone lifetime in test fixtures without production, retry or budget changes. The race unit passes 8 events; RequiredCapability and the later public-execution branch with 23 subtests pass. Raw revoke Consent remains HTTP 500 with a same-request commit 40001 read/write-dependency record, whose writer/full HTTP cause are unknown. Both mixed roots now pass two-peer audio/DataTrack publication and four signed observations, then fail installed with operation_cancelled at an unknown substep. Subscription/Packet first-create checks pass; replay/playback and complete revoke/exhaustion remain unproven. Setup quota 375/265ms does not replace the prior full PostgreSQL race failure. Source and owned cleanup match; continue finite installed-step and existing owner-timing attribution, without credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
- Reuse one exact microphone request ceiling for already-authorized Human and Device creation/replay, preserving every current Source/Grant/Consent/fence/expiry check and all other denied privileges. Move the existing AddTrack helper without changing its behavior; keep exact native permission and direct-client refusal assertions. Current Linux race units pass 11 roots / 132 events and the real Human P2 root passes 9 events. Device RequiredCapability passes, but PublicAdmission remains failed after partial raw AddTrack/resume/reconnect success because revocation Consent returns 500, with a separate standalone owned-LiveKit setup gap. Both mixed-media roots fail earlier subscription PUT 500 / Delegation POST 503 before publish. Preserve the preceding 55-event diagnostic PASS, audio-error/Consent failures and independently bound full PostgreSQL race 500ms failure; no Device media qualification or new credit follows. Continue request-bound failure attribution and the owned fixture correction without budget changes or blind retries; exact receipts and cleanup are in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
- Reuse already checked Device Room roots within their original phase and eliminate an adjacent duplicate native subscription route read, preserving current authority, expiry and error ordering. Correct the existing artificial-corruption fixture for both immutable subscription guards while keeping ordinary updates forbidden. Focused Linux race verification passes 3 roots / 315 test events with zero failures/skips; the first fixture failure remains source-bound. Actual native race qualification fails both roots (0/2/0), with 0/4/0 subtests, 0/6/0 test events and 0/1/0 package results, at published code=other/class=other. Four HTTP 200 admissions (quota=false; 261/256/278/278ms) do not establish mixed media or implicate the quota 500ms limit; publish cause was UNKNOWN at that historical source. Frozen source and owned cleanup match. The later finite diagnostic and shared-profile increment are recorded above; the separately bound full Device PostgreSQL race gate remains unresolved.
- Correct the post-Reserve trigger fixture's integer parameter encoding without changing production or assertions. Both complete non-race Device roots now pass 29 events, including real withdrawal/rollback, next-segment commit, replay rejection, independent peer advance and liability retention. The same-source formal race run still fails both first 500ms quota calls, so this diagnostic does not qualify Device race or native media. Both outcomes, exact source and verified owned cleanup are preserved.
- Read the latest exact Consent receipt and its full immutable projection with one shared-lock query, preserving newest-deny ordering, validation and later clock/consumption checks. Preserve its existing finite observation label. Three real PostgreSQL race roots pass 40 test events, and the observer unit passes. The same-source non-race Device comparison passes Public and the reference/receipt negatives, then fails constructing the post-Reserve trigger because an integer ordinal is bound as text; withdrawal and later Rolling checks are not executed. The separately bound last full Device race failure remains open. No policy/receipt snapshot fusion, expanded history cache or qualification credit is introduced.
- Reuse freshly verified Consent digests at three Device constructor mints while retaining final recomputation; retain complete compatibility output wire validation while removing redundant typed decoding. Linux race correctness passes 183 events and the existing Go wire corpus passes 539 cases. Bounded same-ELF microbenchmarks improve output processing only; both original full Device roots still fail their first 500ms quota call. Exact source, failure, scope and cleanup evidence are recorded in the implementation checkpoint; no Device/native acceptance or latency credit follows.
- Default the existing Device fixture to shared production PostgreSQL metrics/recorder; retain detailed SQL tracing only behind explicit diagnostic profiles and replace misleading zero logs with UNOBSERVED. Eight focused checks pass, but both unchanged complete Device roots still fail their first 500ms quota call. No runtime fix or Device qualification is claimed; exact source and cleanup evidence are recorded in the implementation checkpoint.
- Compare the same owned connector without the extra test SQL tracer in an ignored diagnostic overlay. The original public root passes; rolling reaches its seventh quota call but still times out before the required missing-packet receipt constraint error. The subsequent shared-observer control fails both first quota calls, so removing extra tracing is not a demonstrated complete fix. All original assertions and the 500ms limit remain. SQL counters are UNOBSERVED, not zero activity; formal Device/native qualification remains open. Preserve exact evidence and align fixture observation with production defaults next.
- Reuse the complete Delegation scanner for one locked-root/bindings query, preserving SHARE/UPDATE, the original column projection, immutable child ordering and post-row clock. The private Device history handoff also reuses its caller's already-held Application union locks. The real Delegation persistence root passes 197 events, including four actual RC/Serializable lock-wait cases; both complete Device roots still fail at the unchanged 500ms boundary, with post-Reserve withdrawal NOT_REACHED. Full source/cleanup evidence remains in the implementation checkpoint; no Device/native acceptance credit follows.
- Measure the existing Device raw-history caches with bounded ignored diagnostic overlays. Both initial phases use about 40% of 256KiB and both partial final phases about 25%; all reached misses are retained, overflow is zero and hits are observed. The two original roots still fail at final subscription validation, so do not enlarge the cache or award qualification credit. Exact diagnostic source, counts, limitations and owned cleanup are recorded in the implementation checkpoint.
- Reuse the existing pre-reservation subscription target projection for the exact initial Device phase, preserving all target checks and complete deferred/post-reservation validation. Focused compatibility passes 2 roots / 23 test events; both complete Device roots still fail at 500ms, and their post-Reserve withdrawal check is NOT_REACHED. Preserve source-bound failure/cleanup evidence and continue bounded cache-retention measurement; no full Device/native credit follows.
- Combine the existing same-owner credential aggregate and final expiry clock into one statement, preserving the scalar predicate/fallback and final authority deadlines. Two targets now benefit from the batch; single targets remain scalar. The existing Grant-evidence root passes210/0/0 with37credential scenarios, but both complete Device roots still fail at500ms. The same-ELF CPU diagnostic also fails both roots; its34 operation samples do not establish a dominant repeated CPU cost or justify a decoded-history cache. Preserve exact-source failures and continue checking the existing same-phase authority composition; no performance or native acceptance credit is claimed.
- Combine adjacent Device owner/history, Application requirement/history and Consent consumption/clock reads while preserving locks, complete history checks, fresh clocks and the original deadlines. All three affected PostgreSQL roots pass (192 root/subtest events, zero failures/skips); the two complete Device roots still fail at the 500ms owner deadline. Preserve the earlier pre-Go runner configuration failure and all source-bound receipts in the implementation checkpoint; no full Device/native qualification or extra credit follows the focused PASS.
- Reuse the existing complete-root batch at the native retained Device subscription checkpoint, preserving every final owner check. The selector-boundary root and its 30 subtests pass, but the fresh complete PostgreSQL roots both still fail at 500ms. Do not claim complete query savings or carry the older diagnostic terminal phase onto this new source; retain exact failed receipts and continue the same correction cursor.
- Extend the existing bounded test observer with complete SQL totals and fixed phase/call coordinates; its focused Linux/race root passes 1/0/0. A separately source-bound diagnostic-only run still fails both original Device roots: the first full media renewal reaches final subscription validation after an uncommitted reservation, then exhausts 500ms. Preserve original checks and all failures; ignored runtime timing overlays do not qualify production code. Exact source, phase limitations, rollback-cleanup classification and verified cleanup are in the implementation checkpoint.
- Reuse the existing DB/request observers in both original Device public/rolling media-authority roots, without changing runtime, deadline or root scope.
- The fresh Linux/race run fails both roots at the internal500ms quota-refresh limit; exact receipt/source/cleanup and bounded-query limitations are recorded in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md). Preserve this failure and the preceding separately bound native paid-Agent PASS; no Device qualification or extra credit is claimed.
## 2026-10-12 — Correct paid-Agent multi-party retirement verification
- Replace a single-participant empty-Room assertion in the existing paid-Agent test with exact withdrawn identity/SID absence, retaining the real RoomService, original time limit and independent publisher checks. No runtime or upstream patch change.
- Bounded retirement diagnostics pass two real Linux/race roots. Native v6 exposed the helper mismatch; native v7 fails earlier at Human subscription delivery after receiver-to-owner budget consumption. The corrected final check has not yet been exercised; native qualification remains open. Preserve all exact-source failures and next steps in the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
- Same-request prefix diagnostics and actual PostgreSQL Service verification pass2/0/0; the subsequent bounded-output check passes1/0/0. Native v8 passes paid media but still fails the Agent retirement predicate. It proves an existing expiry owner requested revocation; original Grant ordering and the diagnostic's historical-versus-effective policy-version relation still need exact proof. No runtime relaxation or complete native PASS is claimed.
- Add the locked live Grant-withdrawal boundary and strict Agent-only Release/expiry/effective-receipt evidence. Focused v2/v3 failures are retained; v4 passes3/0/0 after reusing the original publisher's own Service/session report and real effectiveness owner. The unchanged full native v9 root now passes3/0/0, including actual paid media, original Grant withdrawal, precise closed-peer absence, preserved independent publisher and unchanged liability. Historical intermittent failures remain unresolved; Device media and admitted-tail settlement remain open. Exact sources and cleanup are recorded in the implementation checkpoint; no additional milestone credit or external qualification is claimed.
## 2026-10-12 — Preserve retryable subscription conflicts after confirmed rollback
- Correct failed Human subscription preparation so a confirmed SQLSTATE40001 rollback returns the existing retryable500/resource_state_invalid response instead of a misleading403. Genuine authorization denial, rollback uncertainty and commit failures are not promoted or automatically retried.
- The targeted Linux/race unit and real PostgreSQL concurrency roots pass13/0/0, including single-effect retry/replay and denial after original Grant revoke. Bounded test-only public-stage/SQL-fingerprint diagnostics separately pass13/0/0. Native v5 crosses the real paid segment and verifies expired material denial plus original Grant withdrawal, but fails its final compound Agent/recipient retirement assertion. The earlier intermittent public409 remains unexplained; no complete native/cloud qualification is claimed. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-12 — Qualify existing Console writes through local development
- Reuse the existing Consent/Room and Delegation proofs through the real Local API development URL, preserving explicit confirmation, protected replay, revocation and no Mock fallback.
- The new local browser run passes15checks/7screenshots; the separately rerun full Gecko/WebKit Console proof and42artifact/source checks pass. Preserve earlier evidence and the remaining full CRUD, Web RC, Owner visual and external qualification limits in the [Web report](../web/GX10_WEB_LOCAL_RELEASE_REPORT.md).
- No business runtime, SDK, migration or LiveKit patch change is introduced by this test-helper reuse.
## 2026-10-12 — Adopt the OneSay Web dual-theme design system
- Archive the Owner's exact dual-theme specification. Share semantic tokens across Marketing Purple and Developer Orange-Blue; Portal, Docs and Console select Developer Theme at server render.
- Reuse the existing official OneSay logo, Next.js application, canonical routes, API client and session authority. Add local directory search, responsive documentation navigation, accessible code controls and source-backed API reference views.
- Preserve explicit Mock/Local API boundaries. Browser, source-bound build and visual qualification are recorded separately in the Web release report; no cloud or Production release follows this change.
## 2026-10-12 — Add isolated local Web development modes
- Reuse the existing Next Portal/Docs/Console, public API client and signed local API fixture for explicit Mock and real Local API development commands.
- Keep mock data labelled, development configuration out of production builds, and local browser evidence separate from cloud, real ZITADEL and Owner visual acceptance.
- Render existing canonical Portal/Docs sources as readable text, code and tables with registered local navigation and source provenance; preserve the standalone Console host boundary.
- Add an owned Linux full Console session proof using the existing Consent, Delegation and session tests; retain source-bound receipts separately from Mock/read-only smoke evidence.
- Adopt the additive GX10 Web requirements without changing the active M1 denominator. See the [local development guide](../web/WEB_LOCAL_DEVELOPMENT.md) and [capability matrix](../web/GX_WEB_TRACEABILITY_MATRIX.md). Local qualification is in progress; these changes do not announce UI release readiness.
## 2026-10-11 — Validate Agent recipient current-receipt storage rejection
- Complete Linux race PostgreSQL root passed 31/0/0, including five exact storage rejections at both media refresh and quota advance; rejected requests leave no authorization or payment side effects.
- Reuse the existing paid lifecycle and fix only second-Agent fixture Consent, original snapshot order and the optional already-entered-window wait. Preserve prior failures and the original 500ms budget.
- Actual native Grant revoke/later preparation, Device media and admitted-tail settlement remain open. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Qualify actual Agent media across a paid boundary
- The complete native paid-media root now passes3/0/0: actual advancing media crosses the original paid segment, uses its exact successor receipt, and completes public Stop plus original joined cleanup/release.
- Replace only the PaidMedia fixture's stale short-run count with exact per-request validation: three initial admissions and every actual quota refresh, verified again after native drain. Current run observed seven successful refreshes; denied/deferred branches are not credited by this run.
- Preserve the500ms budget, earlier failed receipts and all external NOT-RUN gates. Current-Agent storage/revoke negatives, Device media and admitted-tail settlement remain open. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Retain exact Stop cleanup after transport input failure
- Reuse original joined-failure cleanup for transport-only jobs; only an exact Stop and actual joined close produce ACK, with no Usage and the original error preserved. No cleanup-budget reset or native500ms change.
- Full Linux Python regression passes289/0/0. Native v21 crosses the paid boundary and completes Stop/close/release assertions, but remains FAIL2/1/0 at the stale final foreground-request count; the additional refresh requests require exact receipt validation before correcting that fixture.
- Preserve all prior source-bound results and external NOT-RUN gates. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Batch original Agent Grants without changing authority
- Reuse the existing bounded original-Grant query for Agent owner initial/final checks, preserving exact references, fences, history, nineteen-reference handling and final expiry validation.
- Fifteen complete Linux PostgreSQL/race roots pass125/0/0, including real maximum-selection and second-batch revoked-original replacement negatives.
- Native v20 observes media across the original paid boundary and successful complete Agent/recipient refreshes within500ms. The root remains FAIL2/1/0 at public Stop's unconfirmed joined ACK; release does not prove effective stop or settlement. No new credit or external qualification. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Reuse early dependency locks across Agent preparations
- Ordinary admission and standalone Agent input preparation now reuse the publication path's early base/input selector locking; complete final authority and post-reservation refresh behavior remain.
- Seven complete PostgreSQL/race roots pass64/0/0, including actual conflict/rollback/retry and final Source/Worker Grant withdrawal. Source integrity and owned cleanup pass.
- Native paid-media v19 remains2/1/0: complete Agent refresh loses budget after claim conflict and Room wait. Preserve the failure and its exact source; no paid continuity, external qualification or progress credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Human recipient pre-reserve target projection
- Reuse the existing target pass before quota reservation; retain complete final authority for both paid and deferred results, exact transaction binding and the 500ms budget.
- Six complete PostgreSQL roots passed in the initial 32/3/0 run; a narrowly corrected claim-release assertion passes the affected complete root separately at 5/0/0. Preserve both source receipts and the initial failure.
- Native v18 remains 2/1/0: earlier Agent input selector registration hits two serialization conflicts and fails at 349ms before recipient refresh. No native performance, paid-boundary or progress credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Reuse original-Grant batch in Human connection proof
- Reuse the existing bounded Grant batch for initial/final connection checks; preserve exact original Grants, denial histories, Consent, quota and the500ms deadline.
- Five actual PostgreSQL roots passed; correct the new observer's pgx option handling and the affected Agent root passes separately. Preserve both source-bound receipts and the initial313/2/0 failure.
- Actual native paid audio remains2/1/0: recipient refresh reaches1126 queries and494ms before cancellation. No paid-boundary, cloud or progress credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Early complete Agent refresh dependency rendezvous
- Reuse existing selector locks before final proofs, then independently recheck the complete final union and all generations. Keep actual payments, all authorization/storage guards and the500ms deadline unchanged.
- PostgreSQL follow-up passes48/0/0 across five complete affected roots after correcting test audit classification. Preserve the original116/4/0 run and its own source. Actual native paid media still fails2/1/0: Room lock wait and claim conflict consume the retry budget. No weighted credit or external qualification. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent output lifetime after paid continuation
- Keep first-use binding expiry distinct from admitted output's original hard ceiling. Expired first publication and late ACK still fail; native authority and Stop can still close earlier.
- Local component regression:284 passes with3 missing-fixture failures, then corrected focused PASS3/0/0 on the same Python source. Native paid-media result:FAIL 2/1/0. Preserve all source bindings and remaining gates; no added credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent paid-media owned supervisor correction
- Select the existing fixed two-segment supervision duration for the long Agent paid-media fixture, so native host and authority child outlive its original paid boundary. Production500ms and all authority/RTP/receipt assertions remain unchanged.
- Source-bound actual native result: FAIL 2/1/0; preserve the previous90s-supervisor failure and prior source bindings. No score increase, model/cloud/hardware or settlement credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent initial same-Human authority reuse
- Reuse the already complete input owner inside the same transaction; keep distinct initiating-Human fallback, operation-specific permissions and all final checks. Real PostgreSQL race regression61/0/0 across13 roots confirms the initial Human lookup executes once.
- Retained selector re-read regression51/0/0 remains source-bound. Actual native v11 is FAIL 2/1/0; preserve v10's SERIALIZABLE/retry timeout failure and all original budgets. No progress credit or upstream patch growth. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent snapshot batching and recipient receipt correction
- Batch complete Agent authority snapshots under the existing canonical selector lock, preserving individual provenance and deadline/storage guards; batch-only PostgreSQL race regression passed45/0/0. Recipient capture uses the explicitly receipted current snapshot while retaining the first attachment.
- Complete the original Agent audio recipient receipt guard in migration165. Latest source authority units35/0/0 and migration safety34/0/0 pass; actual native continuity remains FAIL2/1/0 because concurrent Agent output preparation exhausted its unchanged500ms budget. Preserve the preceding initialization and runtime failures and exact source bindings; no progress credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent recipient rolling coverage
- Reuse original Agent authority and complete paid input/output receipts for Human recipients, keeping immutable business hard deadlines separate from charged coverage and short first-use material. Migration165 preserves old rows and exact native attachment/claim ownership.
- Current authority units29/0/0 and migration safety34/0/0 pass. Real cross-segment native qualification remains FAIL2/1/0: latest initial recipient audio succeeds, but Agent refresh_receipt exhausts the unchanged500ms budget. All prior failures and source bindings remain recorded; no progress credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Native terminal funding tail correction
- Preserve original paid media until its exact expiry when less than a whole billing second remains under the existing hard ceiling; do not schedule an impossible renewal that closes the attachment early. No new payment, grace or authority.
- Current source:436/0/0 Linux race events across99 roots and3/0/0 real official Worker audio/stop events. Preserve the preceding native failures, bounded Consent rollback recovery and exact source manifests. Multi-segment continuity, Device media and settlement remain open. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent native quota enrollment (in progress)
- Enroll original Agent execution/claim authority through the existing native quota coordinator and audio runtime leases. Revoke now closes the owned quota and child media clocks before native invalidation. No upstream patch growth.
- Source-bound component regression: 423/0/0 across 99 rtcpolicy roots; current adapter regression: 163/0/0 across 16 roots. Prior failures are retained. Real initial native audio qualification ended FAIL (2/1/0): output was published, but the Worker stopped before recipient delivery while quota remained live. Preserve the failed receipt and diagnose the actual admission/refresh phase; paid media continuity, effective revoke, Device deadlines and settlement remain open. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent complete durable media renewal (in progress)
- Commit complete original Agent input/output/base quota snapshots atomically through the existing owner and migration164. Retain exact predecessor/attachment/claim and current authority checks; reject missing, stale and crosswired media without partial payment.
- Separate new output business hard from original short first-use material; keep historical rows and old deadlines immutable. Actual paid renewal now passes without extending the500ms bound, and expired material remains denied. Current Agent regression passes32/0/0 and same-source Human/material compatibility passes11/0/0; both earlier failures remain preserved. Migration safety tests pass34/0/0. Native Agent enrollment/continuity, Device media and settlement remain open with no weighted credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent media clock correlation and source processing (in progress)
- Preserve exact Agent execution/claim correlation through the existing private quota/media clock coordinator, including all-or-nothing updates and original snapshot/marker checks. Source-bound unit regression passes414/0/0 across98 roots; native Agent rolling remains disabled.
- Reuse the source-change processor for exact paid Agent successor captures and select the latest receipt before matching the current snapshot. Real PostgreSQL/race regression passes22/0/0 across four complete roots, including no spurious revoke after old quota expiry, original Grant revoke, replay rejection and unchanged paid liability. Durable media receipts, native continuity, Device media and settlement remain open. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent own paid renewal owner (in progress)
- Reuse private Agent admission and quota/receipt owners for actual paid quota_advance and same-reservation current-input refresh; add migration163. Preserve original authority, independently renewed Worker claims, exact attachment lineage, immutable prior liability and all operation bounds.
- The complete affected native-admission PostgreSQL/race root passes13/0/0 after correcting SQL generation and fixture scheduling. Preserve the previous eight passing roots within their failed source-bound run, plus both failed attempts; do not claim a current nine-root PASS. Complete native input/output renewal, media activation, Device media and settlement remain open, with no weighted credit. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent current input and publisher renewal (in progress)
- Capture an exact paid publisher receipt at new Agent native admission while retaining immutable first provenance and original hard limits; add migration161. Three separately source-bound local suites pass 56/0/0, 40/0/0 and 173/0/0. These qualify the 350-file increment, not later changes or native media delivery.
- Allow Human publisher renewal while an Agent exists through the existing refresh owner and migration162. Preserve captured Agent authority and expired-claim rejection; current 352-file runtime qualification passes 57/0/0 across nine complete roots. The first adapter attempt timed out before tests and remains failed; affected Human publication regression passes 8/0/0, and the adapter run with actual compiler-output forwarding passes 4/0/0 with unchanged Linux ELF hashes. Current Agent core regression passes 75/0/0; all four current lanes are separately recorded against the same 352-file source snapshot, with the earlier failed adapter attempt retained. Keep Device protections, all deadlines and historical failures. Agent-own rolling and settlement remain open; no weighted credit is added. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md).
## 2026-10-11 — Agent hard and funded input coverage (in progress)
- Separate new Agent execution hard limits from current funded input coverage; reuse existing receipt/quota authority and cap Worker leases and native use without widening execution/model ceilings. Add migration160 origin/claim guards, including an actual lock-wait expiry recheck.
- Complete both affected PostgreSQL/race roots: 75 passed, zero failed/skipped. Exercise genuine receipt adoption, real funding expiry, strict receipt negatives and lease rollback. Preserve the earlier source-bound 70/0/0 result and both later failures instead of rebinding them.
- Correct an old signed-observation fixture SID and forward genuine child-test progress to the bounded runner, preserving every timeout and assertion. Native current-input integration, Agent rolling and admitted-tail settlement remain open; no weighted credit or cloud/native-media qualification. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md) for exact hashes and evidence limits.
## 2026-10-10 — Device media authorization (in progress)
- On 2026-10-11, reuse immediately preceding complete Device Delegation discovery with a fresh lifecycle/reference check, and combine the original-authority tail's complete fence-hit isolation/clock query. Preserve all later authority checks, sorted fallback locks, phase/write boundaries and the 500 ms limit. Fresh Linux race units pass 531/0/0, real Delegation persistence passes 193/0/0, and eight PostgreSQL compatibility roots pass 415/0/0. Complete Device renewal still fails 0/7/0; no performance or weighted credit follows. Preserve the separate Q non-race 8/5/0 diagnostic and its two expected negative receipt rejections. Exact source bindings and unresolved failures are in the implementation checkpoint.
- The separate current R diagnostic also fails 0/7/0, reaching final publication checks before final subscription times out. Its rolling observation contains 1,101 completed queries and one still in flight; it is not a complete-path total or a controlled performance comparison. Record the Agent hard/current-quota lifetime dependency and stop the incomplete connection-only draft before application; neither static findings nor ignored drafts earn credit.
- On 2026-10-11, bind fresh Q SQL and CPU diagnostics to the actual working source: both complete Device public/rolling runs remain FAIL 0/7/0 with unchanged authority, assertions and 500 ms budget. Capture and inspect both failed refresh profiles using the exact Linux ELF; distinguish overlapping process CPU and query wall, and retain all source/cleanup receipts. No missing phase handoff was found, no speculative optimization is applied, and no qualification or weighted credit is added. See the implementation checkpoint for evidence and remaining work.
- On 2026-10-11, reuse complete locked Device Grant fence facts, remove the duplicate consumed-Consent lookup, and use existing read-only quota validation for Device owners. Current Linux race units pass 531/0/0; real PostgreSQL Grant, Consent and origin regressions pass 205/0/0, 23/0/0 and 13/0/0. Complete public/rolling renewal still fails 0/7/0 at the unchanged deadline. Preserve the separate pre-test WSL working-directory failure and its corrected invocation. No full-renewal qualification, upstream patch or weighted credit; source bindings are in the implementation log.
- On 2026-10-11, run both complete Device PostgreSQL roots with bounded race diagnostics. Both still fail the unchanged 500 ms renewal budget; no weighted credit is added. The rolling trace identifies cumulative authority work before deadline, while the previous unavailable-authority error remains unclassified. Public-root SQL observation is absent and is not reported as zero database work. Source bindings, observer limits and cleanup are recorded in the implementation log.
- On 2026-10-11, pass the existing Device phase into AppSession Grant history, reusing complete raw history while preserving each session's own interval, selectors, expiry and first invalidation. Current Linux race units pass 531/0/0 and actual PostgreSQL Grant tests pass 201/0/0. Complete public/rolling renewal remains FAIL 0/7/0: one unavailable-authority error is still unclassified and one failure is a deadline. No latency improvement, full-renewal qualification, upstream change or weighted credit is claimed. Exact source bindings and the corrected pre-execution test fixture are recorded in the implementation log.
- On 2026-10-11, batch fully matching original Device Grant selections within the existing read-only phase, using one fresh database clock for the whole set and preserving ordered scalar fallback, every finite expiry, independent result copies and all final owner checks. Publication, subscription and Packet use the same existing selection contract. New Linux race units pass 530/0/0 and real PostgreSQL Grant regression passes 199/0/0; complete public/rolling race remains FAIL 0/7/0, and non-race rolling remains FAIL 6/5/0 at final receipt timeout. The diagnostic's last trace has one in-flight query and cannot establish a complete query total or controlled speedup. No full-renewal qualification, upstream change or weighted credit is claimed; source-bound receipts and limits are in the implementation log.
- On 2026-10-11, execute the existing receipt diagnostic with exact migration159/function/INSERT bindings and unchanged complete-root assertions. It remains FAIL 6/5/0: only about 1 ms remains at receipt insertion, and only function entry is observed. Preserve the source-bound result and distinguish missing observations from lock or statement-cost evidence. Continue attribution of completed earlier intervals; no runtime/migration change, complete-renewal qualification or progress credit follows.
- Reuse complete bounded owner-history rows only within the existing Device authority-check transaction/context phase, rerunning the original predicates on every use. Preserve complete streaming fallback, fresh post-write phases, identity boundaries and the 500 ms operation limit; existing quota coordination writes do not authorize reuse of quota facts.
- Add actual eight-target subscription Grant wrapper coverage and correct the strict separation between material expiry and business hard expiry. Local Linux race: 462/0/0; eight-root PostgreSQL compatibility: 318/0/0. The full Device subscription diagnostic still fails the 500 ms limit (0/4/0); native Device media qualification remains open. See the [implementation checkpoint](../development/M1_IMPLEMENTATION_LOG.md) for exact working-source receipt bindings and retained failures. No new weighted credit or external qualification.
- Subsequently remove duplicate same-batch Delegation reads and batch current Grant checks with the original predicate. New local race: 463/0/0; corrected complete Grant fixture: 133/0/0, with the earlier 317/26/0 failed compatibility attempt retained. Full Device authority now reaches its final check, but dependency registration still exceeds 500 ms; complete qualification remains open. Test isolation was corrected to Serializable without changing production fence requirements.
- Reuse the existing complete retained-publisher final checker for Device subscription final validation. The first direction now commits within the bound; the second still times out during dependency registration, so the full diagnostic remains FAIL 0/4/0 and adds no qualification credit.
- Reuse complete checked roots within the same existing Device phase, preserving exact Room matching, all misses, locks and fresh post-write phases. New Linux race regression: 469/0/0. Both subscription directions now commit within 500 ms (approximately 476/486 ms); the complete diagnostic still fails during subsequent Device quota refresh and remains FAIL 0/4/0. No native-media or progress credit is inferred.
- Share that existing phase across initial Device quota-refresh facets and start an empty phase after reservation or copied-coverage replacement. The new source passes 469/0/0 Linux race checks; complete diagnostic remains FAIL 0/4/0, now reaching real reservation before the fresh final connection check times out. A real post-reservation Grant-withdrawal rollback regression is prepared but NOT_RUN; full PostgreSQL refresh and native qualification remain pending.
- Replace correlated historical-deny candidate enumeration with an equivalent UNION and current-Grant join. Preserve all historical checks and canonical deny predicates without adding an index, migration, cache or timeout. Current real PostgreSQL Grant regression: 140/0/0, including seven candidate/history cases. Complete Device timing remains FAIL 0/4/0: reservation completes at 488 ms, then fresh final authority checking exceeds the unchanged 500 ms budget. No complete renewal qualification or weighted credit follows.
- Reuse complete original Grant history and denial membership within the existing bounded Device phase; rerun every caller's interval/selector predicates and retain fresh post-reservation checks. Current Linux race units pass 469/0/0 and real PostgreSQL Grant regressions pass 151/0/0, including revoke/restore and concurrent transient-deny protection. Full Device timing still fails before final authority completes. Query fingerprints now distinguish repeated database calls from other time; no full qualification or progress credit is claimed.
- Record a separate normal-compiler diagnostic: the same complete public root, assertions, source, fixture limits and 500 ms deadline pass 11/0/0 without race instrumentation. Its faster setup does not trigger conditional quota renewal, so it does not establish equal-work performance or successful renewal. The source-bound receipt is diagnostic only; the failed race result remains open, with no capacity, native-media or progress credit.
- Explicit non-race rolling also fails (6/5/0); the ordinary public 11-pass diagnostic did not renew. Formal race without timing overlays fails both roots. Preserve these source-bound failures and do not attribute the defect only to instrumentation.
- Reuse complete current-Grant facts inside the existing Device phase while retaining exact original selection, fresh clocks and fallback. Units pass 488/0/0 and real PostgreSQL Grant checks 154/0/0; complete race renewal remains FAIL 0/7/0 at setup. A subsequent Room-extension hit reuse passes 491/0/0 units, including foreign scope rejection. Complete renewal/native qualification remains open; no weighted credit is added.
- Enable complete same-owner reuse only in the read-only pre-reservation Device refresh phase, with copied exact evidence, bounded fallback and a fresh database clock; final phases remain full checks. Current unit regression passes 529/0/0 and PostgreSQL Grant/clock regression 157/0/0. Complete public/rolling race still fails 0/7/0 (initial subscription registration at 501 ms; rolling setup timeout). Preserve the failed source-bound result; no complete renewal or new progress credit.
- On 2026-10-11, batch successful 3+ target Device credential checks through the exact original scalar predicate, preserving ordered negative fallback and a fresh actual-credential-expiry clock. Current units pass 529/0/0 and PostgreSQL query/clock regression 190/0/0. Both complete public/rolling race roots still fail during setup-maintain renewal (0/7/0): one unclassified application error and one database timeout. Continue the existing current-source SQL diagnostic; no complete renewal, native or progress credit is claimed.
- Combine each Device phase Grant-history miss's current-row lock and ordered suffix into one query, preserving the shared complete-history checker, retention bound and unchanged nil/Human reader. Current units pass 529/0/0 and real PostgreSQL regressions 195/0/0. Complete race renewal still fails 0/7/0; a newly source-bound non-race diagnostic fails 6/5/0 at the final receipt timeout. Record all failures and unexecuted downstream checks; no complete renewal, native or weighted progress credit follows.
- Combine unlocked Delegation roots and complete ordered bindings in one query; preserve original locked paths, shared validation and fresh clocks. Actual PostgreSQL Delegation regression passes 184/0/0 and eight compatibility roots pass 404/0/0. Complete Device race renewal remains FAIL 0/7/0 at setup; fixed failure classification distinguishes the observed write error from the separate timeout. A fresh current-source non-race diagnostic remains FAIL 6/5/0 at final receipt insertion, with 1703 queries and all snapshots completed near493ms. Native qualification remains pending; no measured speed or weighted progress credit is inferred.
- Combine creation metadata and complete ordered Grant references, preserving existing predicates, overflow detection and later Requirements checks. New PostgreSQL Delegation regression passes 190/0/0; eight compatibility roots pass 404/0/0. Complete race renewal still fails 0/7/0; current non-race diagnostic fails 6/5/0, with 1666 queries and final receipt timeout after snapshots complete near 483 ms. Receipt timings remain cancellation-clipped; continue targeted guard diagnosis without extending 500 ms. No native, cloud or progress credit.
## 2026-10-10 — Original self-Device connection rolling quota
- Existing self-Device connections retain original identity-token, credential, Delegation, Grant, Consent, attachment and hard-lifetime authority across finite operational quota renewal. Expired material cannot create a new attachment. Device media and Agent rolling remain closed.
- Original Linux race 200/0/0; original PostgreSQL 316/0/0; current PostgreSQL 325/0/0; corrected adapter race 194/0/0; actual native 6/0/0; migration 41/0/0. See [source-bound evidence](../development/evidence/m1-v3-gx10-device-rolling-abeb73fa/index.json). Preserve all original formal failures, diagnostic-only evidence and per-lane source bindings; no weighted credit, billing settlement or external acceptance inferred.
## 2026-10-10 — Human Packet, Streams and RPC rolling quota
- Original Human Packet, Streams and RPC retain complete server authority and one native guard across operational quota renewal; immutable first-use material and historical NULL bounds remain. Device/Agent modes and admitted-tail settlement remain open.
- Local race 601/0/0; PostgreSQL 112/0/0; adapter 33/0/0; actual native 3/0/0; JS units 215/0/0; ESP32 host 272/0/0; migration 37/0/0. See [source-bound evidence](../development/evidence/m1-v3-gx10-packet-rolling-5df8635c/index.json). Preserve original failures and per-lane bindings; no weighted credit or external acceptance inferred.
## 2026-10-10 — Human DataTrack rolling quota
- Human DataTrack and mixed audio/DataTrack reuse the original rolling quota owner and server authority. Keep immutable original target/material boundaries, native limiter/replay state, and finite revoke/exhaustion behavior; Packet/Device/Agent rolling modes remain open.
- Local race 303/0/0, owned PostgreSQL 58/0/0, native adapter 42/0/0, actual installed-SDK/native 2/0/0, SDK unit 161/0/0, and contract/migration 39/0/0 passed. Preserve both SDK failure diagnostics and the generator correction. See [evidence](../development/evidence/m1-v3-gx10-datatrack-rolling-11356c0c/index.json). Historical populated upgrade and external qualification remain NOT_RUN; no new weighted credit.
## 2026-10-09 — Proven unused initial RTC allowance
- Release only the original unused operational reservation for newly enrolled Human/self-Device connections with no native admission history and an exact same-transaction effective proof. Preserve original quantities and all admitted, unknown, historical and Agent liabilities; bind the release audit by primary key. No Usage, monetary refund or settlement is inferred.
- Local affected race 18/0/0, owned PostgreSQL 389/0/0 and contract/migration 39/0/0 passed; generated Go compilation, TypeScript and Linux C syntax passed. See [evidence](../development/evidence/m1-v3-gx10-rtc-unused-allowance-7a1ff87e/index.json). Historical populated 154-to-155 upgrade, native media, paid Provider and external qualification remain NOT_RUN.
## 2026-10-09 — Remaining Agent observed Usage dimensions
- Add seven original STT/TTS token, model-connection and request metrics to the single Usage ledger, preserving prior source identities, bounded shared work, exact quantities, replay and Owner reversal. UNKNOWN/nonbillable; no inferred duration, cost or hold release.
- Local affected race120/0/0, owned PostgreSQL19/0/0 and contract/migration45/0/0 passed; generated Go compilation, TypeScript and Linux C syntax passed. See [evidence](../development/evidence/m1-v3-gx10-agent-remaining-6cf229ab/index.json). Actual historical populated upgrade, paid Provider and external qualification remain unexecuted.
## 2026-10-09 — Native RTP observed Usage projection
- Project original upstream/downstream RTP categories once through the existing Usage ledger/outbox, with exact counters, shared Agent/native batch limits, atomic rollback and Owner reversal. Observations remain UNKNOWN/nonbillable; no quota or liability is released.
- Local affected race122/0/0, owned PostgreSQL14/0/0 and contract/migration39/0/0 passed. Generated Go compilation, TypeScript and Linux C syntax passed; earlier validator/C failures remain archived. See [evidence](../development/evidence/m1-v3-gx10-native-usage-65544ea5/index.json). Financial settlement and external qualification remain open.
## 2026-10-09 — Native audio statistics delivery
- Activated official native composition and bounded authenticated media transfer to immutable original-identity receipts. Added fixed operational metrics and finite retry/shutdown loss accounting; no upstream patch growth.
- Fixed advisory media's next-poll budget reservation. Final affected race371/0/0 and actual SDK/native audio1/0/0 passed; original owner26/0/0 and native104/0/0 evidence retains its source. Receipts remain UNKNOWN/nonbillable; Usage projection and settlement are open. See [evidence](../development/evidence/m1-v3-gx10-native-media-transfer-a42fea92/index.json).
## 2026-10-09 — Durable native media observation receipts
- Added private signed media ingestion and immutable original consumer/publisher receipts with exact counters, nanosecond clocks, conflict fencing and historical post-revoke attribution. Observations remain UNKNOWN/nonbillable; no current permission is restored.
- Local protocol race 200/0/0, corrected owned PostgreSQL 21/0/0 and migration33/0/0; initial fixture skips remain a recorded failure. Host delivery, Usage projection and financial settlement are still open. See [evidence](../development/evidence/m1-v3-gx10-native-media-owner-da31e42b/index.json).
## 2026-10-09 — Native analytics capture preparation
- Added a bounded private audio/Opus RTP statistics adapter with exact counters, immutable scalar capture, explicit loss and UNKNOWN/nonbillable semantics. Reused the actual official telemetry worker; no upstream patch or public SDK change.
- Added deterministic pinned host-composition generation and separate self-contained artifact / real-source regeneration checks. Startup still uses the existing initializer until durable authenticated ingestion is ready.
- Local source-bound Linux race101/0/0 and Node9/0/0; tenant attribution, durable Usage ingestion, complete settlement and external qualification remain open. See [evidence](../development/evidence/m1-v3-gx10-native-analytics-85acf3e2/index.json).
## Unknown Provider money remains unknown — 2026-10-09
Preserve missing Provider costs as null and stop generating zero-money Usage facts from unpriced observations. Keep Task quantities, replay and quota settlement intact. [Evidence and limits](../development/M1_STATUS.md#unknown-provider-money-remains-unknown--2026-10-09).
## Human duplex audio across original quota expiry — 2026-10-09
Refresh complete Human audio publisher/receiver proofs on the original native attachment while preserving first-use expiry, original authority and held liability. Verify both installed SDK consumers continue simultaneous decoded audio beyond their original quota windows; old connection material still cannot rejoin. Separate receiver material expiry from active-policy lifetime in the canonical SDK contract. [Evidence and remaining scope](../development/M1_STATUS.md#human-duplex-audio-across-original-quota-expiry--2026-10-09).
## Current RTC SDK actual media qualification — 2026-10-09
Verify the publication-lifetime SDK package through the formal two-consumer audio and signal-recovery path. Original authorization and expiry limits remain enforced. [Source-bound result and limitations](../development/M1_STATUS.md#current-publication-lifetime-sdk-media-qualification--2026-10-09).
## Formal RTC connection state and audio recovery — 2026-10-09
Display the existing public SDK connection state separately from operation results. Verify explicit subscription reauthorization after signal recovery produces fresh decoded audio while retaining original authority. [Evidence and limits](../development/M1_STATUS.md#formal-audio-recovery-through-public-session-state--2026-10-09).
## Publication first-use and hard authority separation — 2026-10-09
Separate new Human audio binding material expiry from original business authority. Expired material cannot be replayed or reused after a later quota reservation; existing NULL/DataTrack behavior remains bounded. Update both SDK consumers and preserve all server authority checks. [Local evidence and remaining media-renewal work](../development/M1_STATUS.md#publication-first-use-and-hard-authority-separation--2026-10-09).
## Existing Linux native contract gaps closed — 2026-10-09
Run the existing actor-chain and Go/C/C++ selector checks in Linux: original suite34/0/0. The two Windows-skipped scopes now have actual execution evidence; delegated runtime remains inactive. [Qualification](../development/M1_STATUS.md#existing-linux-native-contract-gaps-closed--2026-10-09).
## Shared durable resource preservation — 2026-10-09
Verify existing identity/Consent readback and old Data Sync user/key/budget fixtures through current migrations on exact7450ad89. Sixteen PostgreSQL cases passed; no runtime or migration was changed. [Evidence and scope](../development/M1_STATUS.md#shared-durable-resource-preservation--2026-10-09).
## Original Human attachment quota refresh — 2026-10-09
Keep an authorized empty Human native connection alive across its old quota/JWT deadline using a separately committed finite quota receipt. Old reconnect material remains expired; existing media deadlines and unknown liabilities remain intact. [Qualification and limits](../development/M1_STATUS.md#original-human-attachment-runtime-quota-refresh--2026-10-09).
## Exact media-key receiver membership inputs — 2026-10-09
Reuse the complete subscription authority owner to bind one Human receiver to an exact audio publication and original expiry. Cross-scope, stale and revoked inputs deny; key issuance and public E2EE remain unavailable. [Evidence and limits](../development/M1_STATUS.md#exact-media-key-receiver-membership-inputs--2026-10-09).
## Agent state recovery and product handoff — 2026-10-09
Complete local selected-Agent state recovery qualification and document the advisory state/quality API. Original Signal recovery and later Selection replacement retain distinct native receipts; old connection restoration stays forbidden. [Evidence and limits](../development/M1_STATUS.md#agent-state-recovery-integration-and-handoff--2026-10-09).
## Consent original-owner preparation recovery — 2026-10-09
Check the original pending request owner before returning a prepared Consent committer. Recover one confirmed preparation serialization rollback within the original deadline while retaining current authority and caller cancellation. Completion and Commit are never retried. [Evidence and limits](../development/M1_STATUS.md#consent-original-owner-preparation-recovery--2026-10-09).
## Human quota conflict recovery — 2026-10-09
Recover one confirmed preparation rollback within the original request deadline. Concurrent next-segment requests both succeed while committing one new reservation; protected replay still checks current Grant/Consent. Atomic completion/commit is never retried. [Evidence and limits](../development/M1_STATUS.md#human-quota-preparation-conflict-recovery--2026-10-09).
## Explicit Human quota continuation — 2026-10-09
Fresh Human admission can append a bounded quota segment after natural expiry while preserving old liabilities, identity and original proof deadlines. Real PostgreSQL concurrency and storage guards pass. Automatic native renewal and settlement remain separate. [Evidence and migration boundary](../development/M1_STATUS.md#explicit-human-next-quota-segment--2026-10-09).
## Consent preparation conflict recovery — 2026-10-09
Retry one confirmed pre-commit serialization rollback within the original Consent deadline, rechecking all authority. Preserve exactly-once receipt/audit/cache and deny revoked Grants. Current SDK strict and reproducible package builds also pass. [Evidence and remaining scope](../development/M1_STATUS.md#consent-preparation-recovery-and-combined-sdk-build--2026-10-09).
## Agent observed TTS characters and audio duration — 2026-10-09
Project original TTS character/audio observations once into the existing nonbillable Usage ledger; preserve old terminal cursors, original authorized reversal and unsettled liability. [Evidence and remaining scope](../development/M1_STATUS.md#agent-observed-tts-characters-and-audio-duration--2026-10-09).
## Private official RTC encryption component — 2026-10-09
Add a private pinned KeyProvider/worker preparer and package the exact official worker with its license under the sole stack lock. Public E2EE stays unsupported until server key membership, rotation and authorized decryptor integration are complete. [Actual component evidence and limits](../development/M1_STATUS.md#private-official-rtc-encryption-component--2026-10-09).
## RTC RPC developer and operator handoff — 2026-10-09
Document explicit RPC policy and lifecycle, fixed Action authority, uncertain-effect reconciliation and original Signal recovery limits. Retain the known first-call availability risk and original source-bound qualification. [Runbook](../runbooks/RTC_RPC.md).
## Agent observed STT duration projection — 2026-10-09
Project original final STT audio duration once into the existing nonbillable Usage ledger with exact decimal conversion, bounded durable cursor, backfill and authorized reversal. Preserve completed token projection and unsettled liability. [Evidence and remaining scope](../development/M1_STATUS.md#agent-observed-stt-duration-projection--2026-10-09).
## Agent authorization publication and final identity reuse — 2026-10-09
Acquire the existing publication selector rendezvous earlier and reuse identical final Human/session observations within their original transaction. Preserve all independent authorization and revoke checks. Independent PostgreSQL qualification passed; actual state replacement qualification remains open. [Evidence and limits](../development/M1_STATUS.md#agent-authorization-publication-and-final-identity-reuse--2026-10-09).
## Example developer/operator handoff — 2026-10-09
Connect the existing Task, RTC and Agent consumer instructions from the canonical examples directory. Clarify credentials, explicit lifecycle, original-source evidence and external limits. Documentation only; no native rerun or publication. [Evidence and scope](../development/M1_STATUS.md#example-developeroperator-handoff--2026-10-09).
## Formal example Streams and DataTrack integration — 2026-10-09
Qualify the unchanged browser example with actual text/byte Streams and original DataTrack operations. The successes come from separate source-bound runs; historical failures remain preserved. Correct only fixture listener order and existing room-version readiness, with product permissions and deadlines intact. [Evidence and limits](../development/M1_STATUS.md#formal-example-streams-and-datatrack-integration--2026-10-09).
## Playback developer/operator handoff — 2026-10-09
Add the [playback operations guide](../runbooks/AGENT_PLAYBACK.md) and correct stale adapter/command notes. Cover public owner/receiver flow, honest graceful and failed cleanup, secrets, validated entries and fault diagnosis. Local contracts pass 75/0/0; existing native evidence is reused without rebinding. External qualifications remain NOT-RUN.
## Native SDK playback and formal Agent closeout — 2026-10-09
Qualify installed SDK original Agent output, advisory state, stale-policy rejection and joined stop, together with unchanged formal Agent create/get/stop/get UI: 6/0/0 actual native tests. Match the exact official metadata profile, forward original first-frame lifecycle and join original Room EOS without extending deadlines or changing upstream code. Failure cleanup retains the execution error and emits no final Usage observation. Local 208/37/18/18/23 and historical failures remain source-bound. [Evidence and remaining scope](../development/M1_STATUS.md#native-sdk-playback-and-formal-agent-closeout--2026-10-09).
## Native subscription conflict detection — 2026-10-09
Moved existing selector rendezvous ahead of final rechecks while preserving original lock order and complete authority. Real PostgreSQL tests pass and SDK audio now decodes; joined Agent stop remains a recorded failure. [Evidence and limits](../development/M1_STATUS.md#subscription-conflict-detection-and-actual-sdk-audio--2026-10-09).
## Formal RTC example audio validation — 2026-10-09
The existing browser example now has actual authorized publication/subscription, decoded audio, mute/unmute and clean-close evidence. Agent example operations remain open. [Results and limits](../development/M1_STATUS.md#formal-example-audio-integration--2026-10-09).
## Native subscription authority recovery — 2026-10-09
Added bounded recovery after confirmed transaction rollback and combined same-transaction history reads. Real PostgreSQL regressions pass; native playback still has a recorded deadline failure. [Evidence and limits](../development/M1_STATUS.md#human-subscription-recovery-and-history-batching--2026-10-09).
## Formal RTC example network validation — 2026-10-09
Verified the unchanged browser example with actual authorized packet and echo-RPC exchanges, plus clean close. The current Agent-state SDK package also passes independent consumer checks. Audio/Agent example flows remain open. [Evidence](../development/M1_STATUS.md#formal-example-packetrpc-and-current-state-package--2026-10-09).
## Subscribed Agent UI state — 2026-10-09
Added `session.audio.agentStates` and bounded `onAgentStatesChanged` notifications for currently authorized audio subscriptions. The Agent producer reuses official native state attributes while retaining custom I/O and server authority. [Validation and limits](../development/M1_STATUS.md#bound-agent-ui-state--2026-10-09).
## SDK delivery and migration regression — 2026-10-09
Verified the latest public SDK lifecycle and unsupported-encryption behavior from its independently installed package. Repaired seven stale migration compatibility expectations; all33 existing static migration tests pass with safety checks intact. [Source-bound results](../development/M1_STATUS.md#sdk-package-and-migration-regression--2026-10-09).
## Explicit RTC encryption support and Agent result limits — 2026-10-09
The JavaScript SDK rejects unsupported connection options before network or authentication and reports its own E2EE support accurately. Agent Task result limits now have real PostgreSQL64/65, replay and generation-fence regression evidence. [Evidence and incomplete scope](../development/GX10_PRIVACY_LOCAL_QUALIFICATION.md).
## RTC lifecycle observation — 2026-10-09
`RTCSession.onStateChanged` adds bounded, asynchronous observation of the existing local connection state. It adds no polling, automatic reconnect or authority. The SDK README records coalescing and terminal cleanup. Strict SDK build and23 affected cases pass with substituted native I/O. [Evidence and scope](../development/RTC_JAVASCRIPT_LIFECYCLE.md#advisory-rtc-lifecycle-subscriptions--2026-10-09).
## RTC Action and signal recovery — 2026-10-09
Installed SDK/native RPC now has actual Task Action authority and signal-recovery tests. Prior intermittent failures remain documented; no transport or permission retry is introduced. Agent observed Usage migration143 now explicitly documents its old-binary upgrade/rollback boundary. [Evidence and remaining scope](../development/M1_V3_RTC_PACKET_POLICY.md#native-rpc-task-action-and-signal-recovery--2026-10-09).
## Agent observed token totals in Usage — 2026-10-09
The existing Usage worker now records original cumulative LLM input/output totals once as nonbillable `agent_observed_input_tokens` and `agent_observed_output_tokens`. These are observed quantities, not prices, customer Quota or settled liabilities. Missing data stays unknown; breakdown and plugin totals are not added. Migration143 and generated contracts accompany the change. Local PostgreSQL4, quota1 and Node14 tests pass. [Evidence and remaining scope](../development/GX10_AGENTS_USAGE_LOCAL_QUALIFICATION.md#agent-observed-token-totals-in-canonical-usage--2026-10-09).
## Advisory RTC local connection quality — 2026-10-09
Expose a read-only local quality value and bounded change subscriptions on the existing JS RTCSession. Reuse official native quality; reconnect/close shows unknown, cleanup is idempotent, and nested notifications cannot replay an old round. Actual SDK build and13 local cases pass with substituted I/O; no native network or cloud claim. [Usage and limits](../../sdks/javascript/README.md#advisory-rtc-connection-quality).
## Agent Usage owner observation readback — 2026-10-09
Add a bounded internal read of the original final Agent observation with exact tenant, execution, generation and hold binding. Actual PostgreSQL qualification passes6/0/0; duplicate reads preserve cumulative quantities and unresolved liability without billing, release or new worker loops. [Scope and evidence](../development/GX10_AGENTS_USAGE_LOCAL_QUALIFICATION.md#agent-observation-readback-by-the-usage-owner--2026-10-09).
## Native RPC in-flight timeout and revoke — 2026-10-09
Add one real installed-SDK/native regression for already-entered handlers, timeout, original Grant withdrawal and late replies. Actual result 1/0/0; no implicit retry or policy restoration. Production SDK/server/upstream bytes are unchanged. Action composition and reconnect remain separate existing obligations. [Evidence and limits](../development/M1_V3_RTC_PACKET_POLICY.md#native-rpc-in-flight-timeout-and-revoke--2026-10-09).
## ESP32 bounded stream receive — 2026-10-09
Add receive-only Streams preparation/configuration/callbacks and local poll to
the existing RTC owner. Fix up to four topics before connect, one original
peer/SID and 64 lifetime tombstones; preserve server authority, bounded borrowed
memory and cleanup. No new upstream patch, transport, timer or network polling.
Current owner90 and affected Packet41/audio29/native15 host cases pass; actual ESP32-S3 target compile/link and eight readback stages pass. Native traffic, hardware and cloud remain NOT-RUN. Targeted send and OneSay RPC callee adaptation remain unfinished.
[Acceptance and limits](../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-bounded-stream-receive--2026-10-09).
## Native RPC finite first-call observation — 2026-10-09
Add fixed-enum and bounded-counter diagnostics to the existing native RPC test. One actual source-bound local root passed 1/0/0 at 6c2ac189 plus the exact test overlay; the original first-call failure remains UNKNOWN. Preserve all business assertions, operation timeouts, retries and production behavior. No new milestone credit or cloud/hardware qualification. [Evidence and limits](../development/M1_V3_RTC_PACKET_POLICY.md#native-rpc-finite-first-call-observation--2026-10-09).
## ESP32 explicit Agent Control — 2026-10-09
Add typed create/get/stop through the existing canonical Control owner, independent
of an active RTC connection. Preserve exact input/scope, nanosecond duration,
complete playback observations, server Grant/Consent and honest stop state.
Add bodyless/keyless GET to the shared adapter while preserving POST/PUT behavior.
Actual shared Control client/path/HTTP adapter: selection 44, original public 19, Agent GET 20, mutation 8 and original idempotency-key 546 checks, all with zero failures/skips in one Linux ASan/UBSan execution. HTTP is a recorder; no server, socket or Agent runtime is exercised.
Agent facade: PASS — 175/0/0 with the maintained --agents Linux GCC13 ASan/UBSan leaf, actual OneSay serialization/closed decoder and Control recorder. Complete playback, original request scope, nanosecond bounds, callback mutation and failure-output erasure are covered; no HTTP, server or native Agent execution is inferred.
Target: PASS for the exact current Agent/Control source union: 8 stages, 144 SDK files, 36 locked dependencies/33 managed components, 11 OneSay RTC TUs and 15 official TUs; all three public Agent calls compiled, linked and read back. Shared Control compiles with the existing Task namespace isolation inside the RTC joint target (8 Task TUs, 445 symbols, 40 objects). The 1279 Ninja steps and independent readbacks completed in 84.390 seconds. No separate current Task-only rebuild, target execution, Agent inference, native network, Device, hardware or cloud validation is claimed.
No upstream pin/patch or Agent runtime change. Real ESP32/server, Provider,
hardware and cloud qualification remain open.
[Acceptance](../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-explicit-agent-control--2026-10-09).
## ESP32 packet policy and bounded native send — 2026-10-09
Add OneSay-only packet policy configure, send and readback on the original RTC
owner. Keep peer routing private, invalidate expired/replaced native mappings,
and hand packets directly to the pinned official sender. Full replacement
omits/disables Streams/RPC; receive remains unavailable because the pinned
callback lacks reliability mode. Separate host 131/41/29/15 runs passed;
Packet target qualification: PASS for this exact source union: eight stages, 141 SDK files, 36 resolved dependencies with 33 managed source hashes, 10 OneSay RTC translation units and 15 official units, all eight Task units with 445 symbols/40 objects, and all three public packet functions retained. Ninja compile/link performed 1278 steps; the complete eight-stage qualification took 82.146 seconds. This is target/source/include qualification, not native network or hardware execution.
Real native traffic, hardware and cloud qualification remain open. No upstream
pin or patch growth. [Acceptance](../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-packet-policy-and-bounded-native-send--2026-10-09).
## ESP32 public audio owner and exact component graph — 2026-10-09
Connect the public original-authority audio owner to official ESP32 capture/render and Room lifecycle; preserve exact publication name, bounded ownership and failure cleanup. Close the native delayed-media teardown use-after-free with bounded completion and retained-owner semantics; Room disposal failures preserve resources for explicit retry. Actual host and final component target checks passed in separately bound runs; native runtime/Device/hardware/cloud qualification remains open. [Acceptance](../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-public-audio-owner-and-exact-component-graph--2026-10-09).
## ESP32 RTC admission and private official boundary — 2026-10-08
Add bounded RTC admission preparation and a private official ESP32 lifecycle binding. Keep credentials/native objects private, preserve Task behavior and record separate host qualifications with original failure. Public capture/Source/connect and target/media/hardware qualification remain incomplete; no progress credit added. [Acceptance and evidence](../development/M1_ESP32_SDK_ACCEPTANCE.md#esp32-rtc-admission-and-private-official-boundary--2026-10-08).
## SDK pair fixture Room readback and RPC diagnostics — 2026-10-08
The native pair tests wait for actual native Room SID and completed owner version readback between their single SDK admissions, preserving all production guards and deadlines. Packet and Streams passed; the original RPC first-call failure remains unresolved despite a separate diagnostic-only passing run. Finite canonical RPC diagnostics and all failed evidence are retained. Formal example serve separately passed 3/0/0. No new progress credit. [Qualification and remaining scope](../development/M1_V3_RTC_PACKET_POLICY.md).
## Public JavaScript RTC example — 2026-10-08
Add a plain browser example using only the OneSay SDK for explicit audio, declared data/RPC and Agent operations. Reuse the packed consumer tooling and existing Task quickstart. Composition and actual-browser pretransport checks passed; successful network/media flows and the formal startup path remain open. [Qualification](../development/GX08_JS_RTC_EXAMPLE_QUALIFICATION.md).
## JavaScript Agent control real-server qualification — 2026-10-08
Add an installed SDK/real HTTP/SQL test for existing Agent create/get/stop with Grant, Consent and replay semantics. Fix local PostgreSQL readiness to exclude the initialization temporary server; preserve safe Docker diagnostics. No runtime authorization change or additional progress credit.
## Agent crash authority retirement — 2026-10-08
Retire the original business claim after joined abnormal Worker exit using
the existing signed operation. Preserve unknown Stop/Usage and original
effects/budget; do not restart ambiguous work. The private pipe now joins
in-flight authority callbacks before declaring Run joined. Local race, actual
Python process, PostgreSQL and native crash tests passed; original failures
and external gates remain explicit.
[Qualification](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#joined-crash-retirement-and-official-worker-recovery--2026-10-08).
## JavaScript Agent control facade — 2026-10-08
Add OneSay-only Agent create/read/stop with original server authority, strict
resource projection and bounded cancellation. Preserve pending stop and UNKNOWN
playback facts. Reuse existing packet/stream/RPC/DataTrack owners.
[Local qualification and retained failures](../development/evidence/m1-v3-gx08-agent-facade-8bb8e794/index.json).
## Optional Agent playback observation — 2026-10-08
Project actual official speech/native-source stages through the existing
authorized AgentExecution GET. Optional telemetry cannot renew authority or
turn cache failure into claim failure; stale/replaced/expired output is absent.
Remote hearing stays UNKNOWN. Local functionality passed; integration,
handoff and earlier SSI risks remain open.
[Qualification and limits](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#optional-native-playback-observation--2026-10-08).
## RTC result lineage and native realtime speech — 2026-10-08
Add explicit pipeline-only rtc.transcription.v1 result intent with its current
server Grant/Consent and immutable typed Task/Artifact receipts. Enable the
locked official native realtime model under original finite execution budgets
and joined lifecycle. Unknown timeline/duration and absent transcripts remain
unknown. Local functions passed in separate source-bound runs; intermittent SSI
availability remains unresolved and integration/handoff are incomplete.
[Local qualification and remaining gates](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#rtc-transcript-results-and-native-realtime-speech--2026-10-08).
## Fixed official Agent Task cancellation — 2026-10-08
Connect the one registered task_cancel tool through the original private job
callback to the existing signed server Action. Preserve current authority,
Consent, finite model budgets, joined Stop and durable replay protection.
[Local native qualification and remaining scope](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#fixed-official-task-cancellation-through-the-native-pipeline--2026-10-08).
## Original Agent Task cancellation owner — 2026-10-08
Reuse canonical cancellation and protected idempotency under the original Agent
claim and current Task Grant/Consent. Correct full-result replay across Artifact
timezone JSON representations; late authority changes roll back atomically.
[Local PG14/0/0 evidence](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-agent-task-cancellation-owner--2026-10-08).
Official tool callback remains open.
## Durable final Agent observation — 2026-10-08
Preserve one final cumulative Agent observation atomically with original claim
Release. Original instance checks, explicit gaps, immutable replay and nil-worker
compatibility are covered locally. All observations remain UNKNOWN/nonbillable;
no Usage settlement or hold release is inferred.
[Qualification](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#durable-final-agent-observation--2026-10-08).
## Honest internal playback observations — 2026-10-08
Separate official speech and native-source phases, protect newer observations
from old handles/epochs and retain UNKNOWN remote hearing/correlation. Formal
local pipeline202/0/0; public UI delivery remains open.
[Original qualification](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#honest-internal-playback-observations--2026-10-08).
## Complete local voice turns — 2026-10-08
Support official 200ms TTS frames and joined barge-in; retain original budget
and isolate late audio. Add local private policy configuration using existing
store owners, remove redundant authority reads, and reuse the graph lock.
[Qualification and remaining limits](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#complete-local-voice-turns-and-native-pipeline-qualification--2026-10-08).
## Original Agent budget across LLM turns — 2026-10-08
Divide the original finite output allowance across official LLM requests without
refund. Add opt-in locked pipeline qualification to the existing Linux test
entrypoint:186/0/0.
[Evidence and external limits](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-budget-across-llm-turns-and-repeatable-qualification--2026-10-08).
## Active official Agent pipeline — 2026-10-08
Connected effects-admitted Worker to the selected official STT/LLM/TTS graph,
original budget and protected IO with joined shutdown. Integrated Linux
qualification95/0/0 uses deterministic Provider responses; external canary and
full native model graph remain open.
[Evidence and limits](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#active-official-pipeline-and-worker-lifecycle--2026-10-08).
## Original Agent native output — 2026-10-08
Connected native publication and independent recipient authority to original Agent execution/claim/source dependencies in migration139. Removed lease-only fanout and duplicate route reads while retaining revocation and original deadlines. Actual protected official PROCESS Worker output reaches an independent Human native receiver, with advancing RTP and joined stop/release. gx07-connected-native-66639280981dd411 passes 14/0/0; this is bounded test-audio loopback, not model output or hearing proof.
[Evidence and limits](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-agent-publication-and-independent-human-receiver--2026-10-08).
## Agent output preparation — 2026-10-08
Bound the original Agent output Source/Publication/Signal to its live business
claim and effects response. Added signed private output projection and official
publication lifecycle consumer. Native permission and model activation continue.
[Validation and limits](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md#original-agent-output-preparation-and-effects-handoff--2026-10-08).
## Agent pipeline I/O preparation — 2026-10-08
Added bounded official input/mixer and output/source adapters, single-segment
operational budget consumption, and the Service-generated audio Source contract.
Provider activation and native Agent output authority remain under implementation.
[Validation and limitations](../development/GX07_AGENT_PIPELINE_LOCAL_QUALIFICATION.md).
## Official Agent protected audio input — 2026-10-08
Connected the official named Worker to original business claims and exact
server-authorized audio inputs. Added actual joined stop/release and retained
default-dispatch/direct-client restrictions. Migration137 reuses existing
admission snapshots and invalidation; native changes retain five hook families.
Active model execution, output, Action/Usage and full recovery remain open.
[Scope and evidence](../development/GX07_AGENT_CONNECTED_INPUT_LOCAL_QUALIFICATION.md).
## Native DataTrack product — 2026-10-08
Added data Source/publication authority with independent Grants, original
Consent and migration136; bounded server-side native enforcement and official
JavaScript publish/read/end facade. Actual installed browser and PostgreSQL
paths pass locally. Audio history is retained and locked ESP32 support remains
explicitly unavailable. [Scope and evidence](../development/M1_V3_RTC_DATA_TRACKS.md).
## RTC authorized RPC calls and handlers — 2026-10-08
Added typed optional RPC policy with independent configure/call/handle Grants,
durable original Consent, and the OneSay JavaScript call/handler facade using
official native RPC. Actual installed browser delivery/revocation and direct
native permission checks pass locally. Bounded private preparation now supports
the full public policy/peer combination. Privileged Action composition and full
recovery qualification remain open; native upstream patch unchanged.
[Evidence and limits](../development/M1_V3_RTC_PACKET_POLICY.md#public-rpc-policy-and-sdk-integration--2026-10-08).
## RTC RPC authority component — 2026-10-08
Added bounded peer-method RPC checks using the existing native policy seam and
official V1/V2 protocol. Prevented pending-call side effects before authorization
and cross-source/stream-family ID reuse. Component and upstream compatibility
checks pass; public RPC integration remains in progress.
[Evidence and limits](../development/M1_V3_RTC_PACKET_POLICY.md#rpc-authority-and-native-protocol-component--2026-10-08).
## RTC text and byte streams — 2026-10-08
Added explicit stream policies and the OneSay JavaScript text/byte stream facade
using the official native runtime, with independent send/receive Grants and
bounded cancellation. Real local packed-SDK delivery and original receive-Grant
withdrawal are verified. Full adversarial/recovery qualification remains open.
[Evidence and limits](../development/M1_V3_RTC_PACKET_POLICY.md#public-stream-policy-and-sdk-integration--2026-10-08).
## RTC stream permission foundation — 2026-10-08
Added bounded server stream permissions, shared packet rate budgets and terminal
metadata cleanup using existing native policy boundaries. Current/next-version
component checks pass; public stream integration remains in progress.
[Evidence and limits](../development/M1_V3_RTC_PACKET_POLICY.md#stream-guard-and-existing-native-policy-seam--2026-10-08).
## RTC native Room recreation — 2026-10-08
Fixed stale durable SID after actual empty Room expiry. Verified mismatch hints
schedule the existing fenced worker; official signed configuration preserves
capacity on recreation. Fresh public connections and separately authorized
packet policies restore reliable/lossy delivery. Selected native/PG/material88
and separate host profile87 pass; external and final qualification remain open.
[Details](../development/M1_V3_RTC_PACKET_POLICY.md#empty-native-room-recovery-and-public-packet-restoration--2026-10-08).
## RTC revocation proof recovery — 2026-10-08
After a confirmed pre-commit serialization rollback, release only the current
exact proof lease for existing worker scheduling. Unknown commit still preserves
the lease. Selected PostgreSQL7 passes; full reconnect remains failed on native
Room SID recovery, tracked for the next existing lifecycle fix.
[Details](../development/M1_V3_RTC_PACKET_POLICY.md#revocation-proof-recovery-and-native-room-gap--2026-10-08).
## RTC packet signal recovery — 2026-10-07
Fixed public RTC session state during upstream signal recovery and retained
explicit packet reauthorization after recovery. Actual installed browsers pass
old-mapping rejection, protected policy replay and recovered reliable delivery;
selected native checks add resume/dedup, envelope bounds and revoke denial.
Final selected SDK159, native16 and browser1 pass in separate source-bound lanes;
earlier failures remain recorded. Full reconnect and final qualification stay open.
[Details and limits](../development/M1_V3_RTC_PACKET_POLICY.md#packet-signal-recovery-and-native-adversarial-behavior--2026-10-07).
## JavaScript RTC packet send and receive — 2026-10-07
Added `session.packets.updatePolicy/send/onPacket` over the official LiveKit data
transport, with bounded sends/listeners and private original-peer routing material.
Policy replay preserves its original material deadline and protected response.
Actual independently installed SDKs passed bidirectional reliable/lossy delivery
in two Linux browsers with original authority and full owned-fixture cleanup.
Selected SDK145 and PostgreSQL74 checks also passed. Earlier native failures,
including the unresolved receive stability risk, retain their own evidence;
reconnect, complete RTC-13, full CI and external qualification remain open.
No upstream patch growth, new migration, permission widening or network retry.
[Scope and receipts](../development/M1_V3_RTC_PACKET_POLICY.md#javascript-packet-session-and-original-peer-material--2026-10-07).
## RTC packet observed enforcement and policy control — 2026-10-07
Added trusted first-guard observations with immutable original snapshot, consumer
and source-cut provenance; preparation and control ACK still cannot claim effect.
Migration132 does not backfill historical policies. Same-transaction retained
authority avoids duplicate construction while keeping final Grant/Consent,
Service, lifecycle and clock checks. JavaScript adds `rtc.packets.updatePolicy`
with existing public Consent/idempotency/deadline semantics; send/receive remains
incomplete. Selected backend51 and real native10 pass with fixture cleanup;
component receipts and earlier failures preserve their own source bindings.
No upstream patch growth, timeout extension, network retry or cloud qualification.
[Scope and evidence](../development/M1_V3_RTC_PACKET_POLICY.md#observed-enforcement-and-javascript-policy-control--2026-10-07).
## RTC packet durable dispatch — 2026-10-07
Added same-transaction packet dispatch enqueue, exact joined-readiness checks,
one attempt per original connection across policy versions, and a bounded lane
in the existing authority worker. Lost responses and expired claims are not
retried; control acknowledgement does not prove native effect. Migration 131
does not backfill historical policies. Private preparation remains at 500 ms
with no upstream patch growth. Fixed artificial quota-fence writes during
existing Human validation and the effectiveness source-cut Agent-claim scan.
Final selected local lanes passed native9 and PostgreSQL15 with owned fixture
cleanup; the archive retains earlier separately bound passes and failures.
SDK, effective projection, reconnect and full qualification remain open. The
pre-131 pinned test seam does not qualify a complete historical binary.
[Scope and limitations](../development/M1_V3_RTC_PACKET_POLICY.md#durable-accepted-intent-dispatch--2026-10-07).
## RTC packet native enforcement checkpoint — 2026-10-07
Added a bounded native packet permission hook and external OneSay adapter over
the existing LiveKit transport and attachment watch. Sender ingress and each
receiver's delivery/replay enforce independent original authority; data grants
remain false and RPC/unknown payloads remain closed. Migration 130 permits
accepted joining intent without fabricating native presence or losing terminal
lifecycle history. Generated contracts only refresh the canonical spec digest
after the policy source moved into its isolated guard package.
Selected local evidence: 333 Go seam/adapter events, 119 PostgreSQL events
including nonempty upgrade, 8 actual native-client events, 130 next-version
resolved-patch events, 39 migration Node tests and 12 boundary Python tests;
each lane has zero failures/skips and its own source binding. Historical failed
attempts remain archived, including a post-join Consent 500 whose cause remains
unresolved despite the later passing diagnostic run. Public durable dispatch,
SDK packet exposure, complete RTC-13, full CI and external qualification remain
open; no milestone points are added.
[Evidence](../development/evidence/m1-v3-rtc-native-packets-6798f9e3-raw/index.json).
## RTC packet private preparation and attachment watch — 2026-10-07
Private signed packet preparation, same-snapshot projection, existing attachment watch and restricted version selection are implemented. Linux private-protocol/watch race: 127 roots, 759 pass/0 fail/0 skip; real PostgreSQL preparation and nonempty upgrades: 29 pass/0 fail/0 skip. Prior unit receipt retains its original manifest before the additional PostgreSQL HTTPS test and test-only fixture correction; runtime sources are unchanged. Native packet enforcement, SDK, full CI and external gates remain incomplete. No points or denominator change.
Reuses existing signed Service and attachment/freshness authority; migration 129
adds only the two non-authorizing version columns to the native role. Real
restricted-login HTTPS/PG preparation refuses stale versions and withdrawn
Grants. The failed immutable-generation fixture is preserved separately.
Native forwarding and SDK exposure remain disabled, with no upstream patch
change or new public transport.
[Evidence](../development/evidence/m1-v3-rtc-packet-preparation-be23885b/index.json).
## RTC packet dependency capture and reevaluation — 2026-10-07
Accepted packet policies now retain immutable original authority snapshots and
use existing RTC source capture/export/reevaluation for current lifecycle and
authority changes. Terminal peer lifecycle changes cannot be hidden by restoring
the same current state. Historical pre-capture policy is not retroactively trusted.
Local race qualification passed 12 roots (8 PostgreSQL, 4 parser/selector) / 117 pass events including subtests, zero failures/skips,
with owned fixture cleanup. Native forwarding, effective permission and SDK
packet exposure remain closed; no upstream patch expansion or progress credit.
Historical 111/114 upgrade runs remain FAIL; their public-connection HTTP 500
occurred before upgrade, and the historical comparison fixes remain unverified.
Prior failed attempts remain in the evidence index; current-schema PASS does not
qualify these upgrades or establish an SQLSTATE diagnosis.
Separately, actual nonempty 127-to-128 upgrade passed 4/0/0,
preserving original rows and requiring fresh public Consent/CAS after the new
capture epoch. Its receipt retains its pre-optimization source binding.
Same-operation subscription publisher/client/session reuse keeps final per-publication
authority checks and the 500 ms budget; its independent race lane passed
50/0/0 across 2 roots, including after-audit
Grant, client and session withdrawal rejection/rollback. These are separate
source-bound lanes, not qualification of one later exact committed SHA.
The independent publication Grant batch regression passed 137/0/0
across three PostgreSQL roots and one unit root; current evidence, historical
denial, original publisher and Consent checks remain covered. SQL diagnostics
are separate, include fixture setup and do not count as qualification evidence.
Preparation and actorless reevaluation independently passed 12/0/0
within the existing preparation root and unchanged 500 ms product budget. Its
receipt, the new bounded Grant regression (143/0/0) and the
current main lane cover the later source; earlier Grant and Observe receipts
retain their original manifests without rebinding. The fixed four-reference
publication wrapper is retained above a maximum-ten exact-original batch core;
subscription nil-original selection is unchanged. For eight targets, the origin
and final Grant SQL calls each decrease from 30 to 2 (56 fewer round trips in
total), preserving history semantics without promising measured latency.
The earlier 12/0/0 preparation/reevaluation, 49/0/0 retained Observe/origin and 143/0/0 bounded Grant results remain immutable PASS in index.prior_passes with their own original receipt and source-manifest hashes. They are neither failures nor qualification of the later private final-facts implementation. The 137/0/0 publication Grant and 4/0/0 actual upgrade results remain separately scoped component history.
Subscription observation and actorless reevaluation now pass private typed final connection facts between their own final-check compositions. Each fact is created only after a full connection owner recheck, copied from that refreshed owner and restricted to the exact same operation context, SQL transaction and original endpoint tuple. No identity/client/session authority write or external callback may occur between construction and the publisher checks. Each publication still performs its own original Grant/history, Source, Consent, quota and current-clock checks. General/public rechecks and Agent paths retain their existing full checks; this is not a cross-request cache or portable authorization permit. The current retained lane exercises zero/foreign operation/transaction and wrong-endpoint misuse using real original owners, while the current actorless and main lanes cover the two affected compositions.
Remaining latency risk: current-source eight-target actorless samples are final-facts-reevaluation-pass: 495 ms (reported margin about 5 ms); current-pass: 463 ms (reported margin about 37 ms), against the unchanged 500 ms product budget. The prior pre-final-facts sample remains separately recorded as subscription-reevaluation-pass: 498 ms (reported margin about 2 ms); its narrow margin is historical evidence, not a current-source timing claim. All integer-millisecond samples retain their original lane/log hashes. These samples do not establish robust tail-latency headroom, load capacity or repeated-run stability. The risk remains explicit without adding an acceptance gate, changing budgets or awarding credit.
[Scope and source-bound evidence](../development/M1_V3_RTC_PACKET_POLICY.md).
## RTC packet independent original authority — 2026-10-07
Added server-side verification of original accepted packet policies and the
independent sender/receiver intersection. Missing original identity or Consent,
withdrawn Grants, changed incarnations, stale versions and invalid directions
remain denied. Public replay shares the same original Grant/Consent checks.
Local PostgreSQL race qualification passed 4 roots / 66 events, no failures
or skips, with owned fixture cleanup. Native packet activation remains closed;
source invalidation, native integration and SDK qualification continue.
[Scope and evidence](../development/M1_V3_RTC_PACKET_POLICY.md).
## RTC packet durable Consent and API — 2026-10-07
Connected the packet policy endpoint to immutable PostgreSQL policy CAS, the
existing encrypted Consent lifecycle, retained original Grant/peer authority,
audit and protected idempotency. Replay cannot renew authority or restore a
revoked policy. Migrations 126/127 retain original locators without a plaintext
Consent Action mirror. Linux Go race checks passed 7 real PostgreSQL roots /
138 events and 15 affected API/bootstrap roots / 108 events, with no failure or
skip and confirmed fixture cleanup. Accepted intent still grants no native data
permission; native delivery, receiver enforcement and SDK packet exposure remain
unfinished. [Scope and evidence](../development/M1_V3_RTC_PACKET_POLICY.md).
## RTC packet policy contract and current authority — 2026-10-07
Added the bounded connection-scoped packet Action, configure/send/receive Grants,
typed Consent and generated public policy contracts. Added strict input validation
and a PostgreSQL Human authority primitive retaining original AppSession/Grant,
connection/generation, same-room peer instances and held quota. Ordinary packets
require no Source/Publication lifecycle; the preceding implementation note is
corrected accordingly. Durable policy/Consent installation and native enforcement
remain unfinished, with `CanPublishData=false` and no SDK packet API enabled.
Affected JS/TS/Go/C/C++ contract tests passed 2,270 events; Linux race input tests
passed 4 roots / 29 events. Real PostgreSQL race qualification passed 1 root / 30 events, with owned cleanup. These are local preparatory results only.
[Scope, remaining integration and evidence](../development/M1_V3_RTC_PACKET_POLICY.md).
## RTC packet permission and overload predicate — 2026-10-07
Added an immutable external server predicate for native application data packets:
original sender/recipient attachments, explicit destinations, topic allowlists,
whole-envelope bounds, expiry/revocation, and concurrency-safe packet/byte limits.
It reuses LiveKit protocol and the existing pinned Go rate limiter. Linux race
qualification passed 14 top-level tests with no failures or skips, including
closed signing-material regressions. This is preparatory implementation: the
business issuer and native interception point are still missing, the SDK packet
API is not exposed, and `CanPublishData` stays false. No upstream patch changed.
[Scope and evidence](../development/M1_V3_RTC_PACKET_POLICY.md).
## Task/RTC continuous media window correction — 2026-10-07
The owned Task/RTC fixture now reuses the native duplex test's 1200 ms media
window, with decoded audio checked on each observation and packet, byte and
sample-duration growth required across each complete window. Regressing counters,
stream replacement, sustained frozen counters and an unobserved complete tail
window still fail. No public SDK/runtime behavior or upstream patch changed.
Seventeen real-process regression tests and the three Task/RTC integration roots
passed with cleanup and no input drift. The evidence binds the committed parent
plus explicit working-file hashes; it does not replace historical failed runs or
qualify native policy, same-tenant authority, cloud or hardware.
[Evidence](../development/evidence/m1-v3-task-rtc-media-window-edc4bb3f/index.json).
## Task/RTC failure diagnostics and relay opt-in — 2026-10-07
The Task/RTC supervisor now retains one bounded, numeric-only failed media
observation without changing its RTP/audio assertions or deadlines. Eight local
process tests passed, including failure cleanup and sensitive-field exclusion.
One owned integration diagnostic failed at RTP_ADVANCE: counters did not advance
across about 103 ms although decoded audio remained valid. Cleanup passed; the
root cause and integrated qualification remain open, with no new credit.
[Diagnostic evidence](../development/evidence/m1-v3-task-rtc-media-diagnostic-300eeedc/index.json).
Linux ephemeral-port selection now requires an explicit fixture option, preserving
the relay's existing default rejection contract. Four Linux ingress/TLS tests
passed, including a real trusted TLS handshake and invalid option rejection.
The earlier standalone Task receipt retains its original hashes and is not
rebound to this additional opt-in change.
## Unprivileged WSL Task fixture and native build preparation — 2026-10-07
The owned Task TLS fixture now uses a kernel-assigned loopback port on Linux,
preserving canonical SNI/Host checks and Windows port selection. Its standalone
Task/Usage test passed 1/0/0, including TLS rejection cases and cleanup; the
receipt explicitly records post-run hashes rather than a pre-run source freeze.
The existing repository Go cache also built fresh Linux LiveKit and authority
executables. These are fixture preparation results, with no additional ledger
credit; intermittent Task/RTC media failure and external gates remain open.
[Task evidence](../development/evidence/m1-v3-wsl-task-tls-usage-only-300eeedc.json)
and [build preparation](../development/evidence/m1-v3-wsl-native-build-preparation-300eeedc.json).
## GX17 exact WSL SDK lifecycle evidence — 2026-10-07
The exact committed source c0d3425639f26963c68fa56be8113ae619d99918 ran the independent packed SDK and passed 59 selected lifecycle, admission, capacity, bounded-material, permission and quota/aggregate tests with 0 failures and 0 skips. The owned PostgreSQL/Redis/LiveKit fixture and consumer cleanup passed. This is local SDK/browser and HTTP evidence only; patched policy authority, Agent/Usage, real Provider, Staging, Production, cloud, hardware, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. [Evidence](../development/evidence/m1-v3-gx17-sdk-lifecycle-c0d34256.json).
## GX17 exact WSL SDK subscription evidence — 2026-10-07
The exact committed source 709bc51a980293b27d7e0042e1364928b00c664a ran two independent packed OneSay SDK browser contexts and passed TestPostgresRTCBrowserSDKSubscription 1/0/0 with offline installation and owned PostgreSQL/Redis/LiveKit cleanup. This is local SDK/browser subscription evidence only; patched LiveKit policy authority, Agent/Usage, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. [Evidence](../development/evidence/m1-v3-gx17-sdk-subscription-709bc51a.json).
## GX17 exact WSL SDK publication evidence — 2026-10-07
The exact committed source 07c76d4395fef8a9c6ce7057e6dace23bf2d6e50 installed the packed JavaScript SDK in an independent offline consumer using the Linux pnpm store and passed TestPostgresRTCBrowserSDKPublication 1/0/0. Consumer cleanup and the owned PostgreSQL/Redis/LiveKit fixture passed. This is local SDK/browser publication evidence only; production admission/policy, patched LiveKit, Agent/Usage, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. [Evidence](../development/evidence/m1-v3-gx17-sdk-publication-07c76d43.json).
## GX03 exact policy invalidation fixture evidence — 2026-10-07
The exact committed source 542f0635a2f293c176d5651cda085017c60ddf8f was run in the WSL/Linux Docker-owned PostgreSQL, Redis and LiveKit fixture. Policy-feed storage, invalidation ordering/idempotency, durable revocation, migration and worker scope passed 100/0/0 across five packages with exact roots/packages, zero source drift and owned cleanup. Runtime push invalidation, effective native enforcement, long-lived authorization, native policy host, full local CI, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. [Evidence](../development/evidence/m1-v3-gx03-policy-invalidations-542f0635.json).
## GX03 exact revocation fixture evidence — 2026-10-07
The exact committed source b793a400a848f692f3fbda7b01b7e7ad9fad94d4 was rerun with the WSL/Linux Docker-owned PostgreSQL, Redis and LiveKit fixture. The durable revocation, absence-readback, migration and worker scope passed 91/0/0 across five packages; exact roots/packages and zero source drift were confirmed, and owned fixture cleanup passed. This closes the local fixture rerun only; native OneSay admission/media/Agent, full local CI, Staging, Production, cloud, hardware, paid Provider, Desktop and hosted CI remain NOT-RUN. No ledger credit was added. [Evidence](../development/evidence/m1-v3-gx03-connection-revocation-b793a400.json).
## GX17 client implementation build evidence - 2026-09-28
A clean exact-source Node build and Task contract capture now records 310 pass, 0 fail, 4 explicit Windows-native NOT-RUN skips. GX17.client implementation_build adds 6 points only; total 454.15/1200 (37.8%). [Evidence](../development/evidence/m1-v3-gx17-client-93b24e97/index.json). No runtime/API redesign or external qualification.
Post-commit readback: commit `906c6fc4182356a8f97dfd39d75ee2cd0dd2bca5` contains this evidence/docs closeout and the tracked working tree is clean. The build evidence remains bound to the tested product source `ab2e5a460cf29a7ee38b60a6b19019bef31be1f4`; the docs commit is not a new product test.
## GX17 client local behavior evidence - 2026-09-28
An isolated tarball-only public Task consumer bound to `5a5600aa163246c95df2890b396ee49616d7f5c9` covered 43 scenarios, 6 successful requests, 29 pretransport rejections, 6 no-retry error cases and zero forbidden global accesses. GX17.client local_behavior adds 3 points only; total 457.15/1200 (38.0%). [Evidence](../development/evidence/m1-v3-gx17-client-behavior-5a5600aa/index.json). No external qualification or runtime redesign.
## GX17 package implementation build evidence - 2026-09-28
Two independent clean JavaScript package builds bound to `d484419140bd2c1fec7f3a8833f0cd7bfb938bd3` produced byte-identical deterministic `@onesay/sdk` archives with 87 entries and no workspace/native leakage. GX17.package implementation_build adds 4 points only; total 461.15/1200 (38.4%). [Evidence](../development/evidence/m1-v3-gx17-package-build-d4844191/index.json). No external qualification or runtime redesign.
## GX17 recovery implementation build evidence - 2026-09-28
The Node-only TypeScript draft SDK build bound to `24faca39cb1318030da8e4b0bf247099e08268fa` emitted 44 JavaScript files including the realtime recovery path and confirmed no duplicate Task state machine. GX17.recovery implementation_build adds 5 points only; total 466.15/1200 (38.8%). [Evidence](../development/evidence/m1-v3-gx17-recovery-build-24faca39/index.json). No external qualification or runtime redesign.
## GX17 client loopback integration evidence - 2026-09-28
An installed tarball-only Task client bound to `ed7946fb6c5c1b5c2e633b9445d891f548d0a43f` completed create/list/get/cancel against a real loopback HTTP Control service with four request assertions and short-lived bearer/idempotency verification. GX17.client integration adds 1.2 points only; total 467.35/1200 (38.9%). [Evidence](../development/evidence/m1-v3-gx17-client-integration-ed7946fb/index.json). No external qualification or runtime redesign.
## GX17 package handoff evidence - 2026-09-28
A fresh consumer directory outside the repository received the deterministic 87-entry JavaScript tarball bound to `be8451b7d6a84c374cf393f3f89253d4df3272ca`, imported the public package and exposed Task methods without workspace paths or native RTC exports. GX17.package handoff adds 0.8 points only; total 468.15/1200 (39.0%). [Evidence](../development/evidence/m1-v3-gx17-package-handoff-be8451b7/index.json). No external qualification or runtime redesign.
## GX17 client handoff evidence - 2026-09-28
A fresh external consumer compiled the public Task TypeScript contract from the installed tarball bound to `c6d538f53524817d31168d33239c1b88a9fb891b` and imported three Task methods with zero native exports. GX17.client handoff adds 1.2 points and completes its local milestones; total 469.35/1200 (39.1%). [Evidence](../development/evidence/m1-v3-gx17-client-handoff-c6d538f5/index.json). No external qualification or runtime redesign.
## GX17 recovery handoff evidence - 2026-09-28
A fresh external consumer compiled and imported the public RealtimeClient resume/replay/bounded-audio/close contract and canonical connect-plan builder from the tarball bound to `113cdb3f7417e53c9624b2708f78d1eb85e9fa70`. GX17.recovery handoff adds 1 point; total 470.35/1200 (39.1%). [Evidence](../development/evidence/m1-v3-gx17-recovery-handoff-113cdb3f/index.json). No external qualification or runtime redesign.
## GX17 selected Browser evidence after Consent correction — 2026-09-28
Fresh installed Gecko/WebKit Task execution at clean `93b24e97` passed 11/0/0 with zero source drift and confirmed cleanup. The first run had incomplete runner provenance and remains diagnostic; the corrected run is archived separately. [Evidence](../development/evidence/m1-v3-gx17-browser-current-93b24e97/index.json). No product changes or new credit; total 448.15/1200 (37.3%). Remaining endpoint and external gates stay open.
## GX17 failure-history archive correction - 2026-09-28
Preserve the omitted fifth native attempt (1 pass, 1 fail, Usage NOT-RUN) with its original runner, raw receipt and Go events. The successful source-bound qualification and 448.15/1200 (37.3%) progress are unchanged. [Archive](../development/evidence/m1-v3-gx17-authorized-task-41a45efb/native-staging-collision/linux-index.json).
## Authorized public Task Quickstart and Consent read correction - 2026-09-28
The installed SDK example now obtains canonical connection material through explicit short-lived identity ports and confirms exact protected actions. A real local GET409 exposed missing Delegation Consent observation dispatch; the server now reuses its current management read owner. Node29/0/0 and qualified Linux31/0/0 are recorded with original source bindings and four failed native batches. Linux combines the original28 passing Consent events with3 fresh SDK roots; the fourth failed batch had passing Go tests but incomplete receipt parsing. [Evidence](../development/evidence/m1-v3-gx17-authorized-task-41a45efb.json). GX17.sample adds4.5 points only:448.15/1200(37.3%). No SDK/migration/Provider/LiveKit patch changes; external gates remain NOT-RUN.
## Public Task Quickstart using the installed SDK - 2026-09-28
A Node fixed-PCM sample now composes the existing public SDK and observers with explicit authorized application ports, bounded waits and checked cleanup. Two real local PostgreSQL/Redis roots and 18 selected Node tests passed; prior assertion/parser failures remain archived. [Evidence](../development/evidence/m1-v3-gx17-public-task-8c00deb7.json) preserves working-source hashes and qualification limits. Only GX17.sample integration adds0.5 points:443.65/1200 (36.9%). No runtime/SDK/Provider/LiveKit patch changed; cloud/hardware/real Provider remain NOT-RUN.
## Exact Node pin and selected installed Browser verification - 2026-09-28
An isolated official Node 24.19.0 Linux runtime now matches the repository pin. Fresh installed Gecko/WebKit execution on exact caa51304 passed ten existing Task scenes (11 Go pass events, no failures/skips), with matching package hashes and confirmed fixture cleanup. [Receipt](../development/evidence/m1-v3-gx17-node2419-browser-caa51304.json) preserves source, tooling and qualification limits; old Node 24.18.1 results are unchanged. This adds no milestone credit: total 443.15/1200 (36.9%). No runtime/SDK or public contract changed.
## Task client boundary and installed WebKit qualification - 2026-09-28
The [source-bound static boundary review](../development/evidence/m1-v3-gx17-client-boundary-20355440.json) confirms caller-owned Task PCM acquisition, existing public APIs, server-owned Task authority and lazy RTC initialization. No Task capture API or new runtime is introduced. Five installed WebKit26.5 scenarios passed locally (6 Go events, no failures/skips), extending the existing bounded client evidence with no duplicate credit; [WebKit receipt](../development/evidence/m1-v3-gx17-webkit-installed-20355440.json) preserves TLS, Provider, permission and endpoint limits. Only the existing client boundary milestone adds 0.6 points: total 443.15/1200 (36.9%).
## Installed Gecko Task recovery qualification - 2026-09-28
Four existing installed Firefox153.0 Task recovery scenes passed on exact source 874a149a (5 Go events, zero failures/skips/source drift). Cancellation-after-ACK, lost ACK, active-audio revocation and bounded buffers retain distinct scope; nonzero PCM replay keeps the older Node evidence binding. [Receipt](../development/evidence/m1-v3-gx17-browser-recovery-874a149a.json) records cleanup, shared package hashes and client/TLS/Provider limits. Only GX17.recovery integration adds 1 point; total 442.55/1200 (36.8%). Historical E7 notes gain Task Voice boundary prefaces with original bodies preserved; RTC microphone publication is unchanged.
## Installed Browser Task SDK verification - 2026-09-28
The existing Browser Device fixture can serve verified installed OneSay SDK assets and records Task isolation observations after successful cleanup. Selected real Firefox package/source checks passed locally. [Evidence](../development/evidence/m1-v3-gx17-browser-installed-15f54fea.json) records exact source inputs, limits and zero additional credit; complete client and cloud qualification remains open.
## Installed Task SDK recovery integration - 2026-09-28
Actual installed Node SDK recovery and Task/Artifact/Usage have current-source local evidence. The existing migration transaction now retries exactly once, with the original context, only after an artifact statement reports 23505 at pg_authid_rolname_index and the first attempt has rolled back. Commit uncertainty, other errors and unsafe role attributes remain failures. Existing SQL, manifest, SDK behavior and LiveKit patch are unchanged. Existing Task scenario fixtures now accept an explicitly selected verified installed SDK and emit success only after cleanup and package verification; startup diagnostics retain fixed classifications without credentials. Selected Linux suites only; this increment is not full ci:local or the complete SDK/client/platform qualification matrix. Browser/Electron and the remaining client matrix plus Quickstart, real Provider and cloud remain open.
## Task recovery local qualification — 2026-09-28
Seven existing public SDK recovery scenarios now have current-source local
PostgreSQL/Redis evidence: cancellation resume, Device revocation, lost ACK,
write-failure replay and bounded buffers. Product behavior is unchanged.
Source-portable Node evidence does not qualify installed packages, other client
runtimes, real Provider or cloud deployment.
## Initial Task and SignalStream binding — 2026-09-28
`task.created` now includes the server-confirmed `signal_stream_id` with its
existing Task ID, waiting-input status and profile. The JavaScript SDK uses
this association on the first connection, so confirmed Task termination stops
only that stream's audio send/replay. Duplicate creation cannot reopen a
terminal Task, and genuine contiguous ACKs still own PCM release.
ESP32's strict decoder and current-stream binding check are updated together.
Its existing strict event-sequence rejection remains unchanged. This local
candidate requires matching generated contracts and SDKs; it is not a cloud
rollout or qualification of older installed clients. No new Task authority,
permission or LiveKit patch is introduced.
The Delegation test file now guards both native test roots and its executable
helper on Windows, preserving the isolated Linux qualification route.
## Task terminal checkpoint observation — 2026-09-28
For a Task already bound to a SignalStream by a server resume checkpoint, the
JavaScript SDK now observes `task.completed`, `task.failed` and `task.cancelled`
on the current connection. The matching stream stops local send/replay while
other streams remain usable. Unacknowledged PCM still requires a genuine ACK;
duplicate terminals are safe and conflicting terminals fail closed. A cancel
request alone does not imply cancellation. No new stream binding is inferred.
## Task audio replay error projection — 2026-09-28
Audio replay now reports transport write failures as retryable
`client_network_unavailable`, matching ordinary audio sends. It stops at the
first failed write and retains every unacknowledged frame for explicit retry;
transport error messages and causes are not exposed. No retry loop or alternate
Task state machine is added. The installed-package consumer reuses the existing
PCM and Usage observers with injected responses; this is local package evidence.
## Task SDK isolated package consumer — 2026-09-28
The packed JavaScript Task Control facade now executes create/list/get/cancel
and error/credential cases in a consumer outside the repository with injected
Fetch fixtures and no LiveKit installation. Get/cancel locally reject ULIDs
whose first character exceeds the canonical `0..7` range. The error remains
`TypeError`; server authority and audio lifecycle behavior are unchanged.
This local package proof does not qualify real audio, Usage, Staging or release.
## E9 bounded agent-readable corpus — 2026-09-28
The local Docs and Developer Platform builds now share a deterministic
256 KiB `llms-full.txt` policy. Oversized public sources retain a source-bound
head/tail excerpt with their original byte count and SHA-256, while the human
route remains complete and the artifact stays draft/unpublished. The local
E9 contract suite and two-clean-build proof cover the bound and provenance.
The shared corpus generator is now included in Portal build-source digests.
Missing selected content fails generation instead of silently producing an
empty section; UTF-8 boundaries and changes to omitted bytes are regression-tested.
## GX03 durable revocation effectiveness and four-lane worker — 2026-09-26
Added the durable RTC effectiveness finalizer and wired the existing four authority-worker lanes without upstream patch growth. Fixed zero-prefix reporting during a pending source cut; controlled regression, full policy race and a fresh six-root native run pass, with all earlier failures preserved. Actual authority child-process validation awaits the productive fair-drain scheduling correction; current-source CCR requalification remains pending; this is not final architecture qualification. [Source-bound effectiveness checkpoint](../development/evidence/m1-native-revocation-effectiveness-2026-09-26.json).
## GX03 actual Control native application process verification — 2026-09-26
The actual Control executable now has regression coverage for its signed application receiver: closed empty-incarnation read/seal, exact digest and durable audit, tenant isolation, one-use token/audience rejection and current producer Grant withdrawal. The isolated local race harness passed 12 events across two actual-command roots, with no failures, skips or source drift and confirmed owned cleanup. Runtime and native patch bytes are unchanged; these tests do not prove native drain, source freshness or effective revocation. GX03 and the current correction Goal continue; no final review or completion credit is added. [Exact-source process evidence](../development/evidence/m1-control-native-application-process-2026-09-26.json).
## GX03 signed native application producer and durable terminal storage — 2026-09-26
Added signed native application reporting, migration 105 terminal storage and ACK-based local record retirement. Preserved original-instance completion and bounded freshness/shutdown semantics, including completion wakeups and safe empty-startup cleanup. All-incarnation effective ACK/finalizer, quota settlement, P2–P4, rolling quota and final clean exact-SHA qualification remain unfinished. No final review, M1 v3.0, completion credit, Staging, hardware or Production qualification is added. [Source-bound application checkpoint](../development/evidence/m1-native-application-progress-2026-09-26.json).
## GX03 exact native completion handoff and definite-abort recovery — 2026-09-26
Added exact native completion enrollment and error-result forwarding while preserving the existing hook and file boundaries. Corrected definite transaction-abort propagation and bounded whole-consumer retry; fresh formal/native, database, host and rtcpolicy regressions passed. Completion records are process-local and retained within a fixed capacity; disposal is not drain, and durable acceptance/retirement, all-incarnation effective ACK, quota settlement and final exact-SHA qualification remain unfinished. [Exact-source handoff evidence](../development/evidence/m1-native-completion-handoff-2026-09-26.json).
## GX03 current P1 consumer and long-lived runtime checkpoint — 2026-09-26
Added native consumer registration, signed invalidation-feed integration, complete-prefix/source-cut freshness and bounded cleanup, while removing the unused Control notification listener and preventing retry waits from exceeding the original freshness deadline. Latest native and full rtcpolicy race regressions passed; earlier Device/Control/forward evidence retains its exact scope, and the unreproduced normal-close failure remains an unresolved documented risk. Durable native completion/effective ACK, rolling quota and final exact-SHA qualification remain pending; this is not a final architecture review. [Source-bound checkpoint and archived attempts](../development/evidence/m1-native-policy-current-checkpoint-2026-09-26.json).
## GX03 generic native close completion — 2026-09-26
The generic native lifecycle increment adds exact-instance close completion for the retained Participant and its existing native transports. It adds WaitClosed observations, callback/reader enrollment and join, first Pion/GracefulClose error retention, and cancellation that fails closed. Existing permission denial and Close remain the caller's operations; no policy, business, transport, room registry, quota, effective receipt, or durable consumer integration is added. The barrier covers admitted effect-capable callbacks/readers and native peer transport closure; it does not claim buffered network media, remote decoder drain, every SFU maintenance goroutine, or application-spawned work has stopped.
Fresh source-bound metrics against the committed base show 21→25 patched files, 12→15 runtime files, 17→26 modified named runtime functions, 35→41 added runtime functions, 3,966→4,332 changed patch lines, 29→29 distinct OneSay runtime identifiers, 2→2 external hook families, and adapter lexical LOC 121→121. The exact summary is .build/native-close-completion-metrics/summary.json; the corrected source inventory is .build/rtc-native-close-completion-corrected-proposal/source-hashes.json.
The focused native run passed 35 events across 12 roots. Full candidate native phases passed 99/37 service, 32/20 RTC/signalling, and 13/3 Room events/roots. The candidate host build and 215-event/27-root host tests passed, followed by the formal registered-path build and 215-event/27-root host tests. All runs were bounded single attempts on Linux/amd64 with no published ports and owned cleanup. Earlier network-none and redundant-writer-close failures remain archived and are not rebound. Boundary tests now explicitly allow only the four audited lifecycle paths while retaining SFU, routing, store, Protocol, alias, and undeclared-target rejection.
This is local validation of a generic lifecycle foundation. GX03 remains IN_PROGRESS; completion credit is 0, final candidate is null, effective revocation, long-lived authorization, freshness, P1/P5, cloud and staging remain unqualified or not run. No upstream submission is claimed. The draft contribution/removal records preserve best-effort writer-close semantics after SCTP shutdown while retaining real Pion errors.
[Exact native close-completion evidence](../development/evidence/m1-native-close-completion-2026-09-26.json).
## GX03 private policy-consumer lifetime owner — 2026-09-26
Migration104 and the private RTCPolicyConsumerLifetimes owner add durable process-incarnation correlation for the existing configured Service, Project, Environment, infrastructure, cluster and native NodeID. Open and Close reuse the existing signed Service provenance, current room.read selection, Grant fence/deny history, bounded SERIALIZABLE transaction and audit owner. No new authentication or public Resource/Grant is introduced. A server-random session ID, boot nonce and exact positive generation are correlation values, never credentials or native permits.
Same active Open and matching terminal Close are audited idempotent observations. A new boot cannot replace an open incarnation; a replacement must name the exact closed predecessor and use a never-used nonce. An old session cannot close its replacement. SQL guards preserve identity and terminal history, reject erase/reopen, and bind state changes to the same transaction's exact current-Service audit and full ActorChain. Every operation rechecks current authority before commit; failures return zero observations. A lost post-commit response can be recovered only through a newly authenticated same-incarnation operation.
Actual isolated Linux PostgreSQL race validation passed97 parent/subtest events across12 roots in one package, with zero failures/skips/source drift, one attempt and verified owned container/network cleanup. The three new roots cover real signed provenance, durable JTI replay rejection, configured/current authority, exact lifecycle/nonce/generation constraints, concurrent replacement, audit insertion and deferred COMMIT faults, selected Grant ABA rollback, native PG role isolation and canceled lock waits. Existing source-cut, reader and route-dispatch regressions passed in the same frozen source copy. An actual admitted Connection and its held quota remain unchanged. Migration validation, generated no-diff and30 migration E2 tests also passed. Counts are test events, not additional product capabilities.
Evidence is bound to parent2dc50c8d2d47f1af0b84301cc0a95d3b8cad92be plus the exact seven tested source files. The archived PostgreSQL receipt is not represented as a rerun of the later documentation/commit SHA. The fixtures use the existing real feed-audience JWT/JTI path only to test repository provenance; consumer HTTP endpoints and their operation-specific audiences are not implemented by this increment.
The external delta is225 Go runtime lines,86 SQL lines and397 test lines. Native patch metrics remain21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay identifiers,2 hook families and adapter121 lexical/182 physical lines. The seven reuse alternatives require no upstream patch growth here: existing configuration, Server API, SDK/protocol, local hook/state and native permission operations do not own durable OneSay process history; the external configured Service/PG/audit owners provide the required seam.
Open means registered only. Native host/process binding, safe retirement of abandoned open incarnations, consumer transport, applied prefix, pushed invalidation, measured node freshness, native drain/effective ACK and normal long-lived authorization remain unfinished. The temporary at-most-two-second native ceiling and held quota are unchanged. No force-replacement, heartbeat, per-connection renewal, capacity qualification or cloud validation is added. GX03 remains IN_PROGRESS, final candidate null, completion credit added0; no final architecture review or M1 v3.0 is generated. Staging remains NOT-RUN — requires authorized Staging environment.
The additional global readiness command remains nonzero for eleven existing invalid historical evidence entries. Its generated view exactly matches the committed parent, and work packages, items, evidence, gates and weights are unchanged. This readiness limitation is preserved explicitly; it does not turn the focused owner test result into final M1 qualification.
[Exact-source consumer-lifetime evidence](../development/evidence/m1-policy-consumer-lifetime-2026-09-26.json).
## GX03 actual Control feed bootstrap and committed source cut — 2026-09-26
The existing Control API bootstrap now mounts the fixed private policy feed beside admission on the same TLS listener, origin, configured Service routes and internal JWT owner. The unchanged rtc_native_policy configuration enables both; [] disables both. Capacity is bounded separately per operation by the configured value. An immutable Service-to-reader dispatch table adds no authority cache: each selected reader still checks verified provenance, exact tenant, current room.read and durable audit. Public paths, SDK contracts and native runtime remain unchanged.
Migration103 adds two partial indexes covering ALL unfinished export and reevaluation work, including held leases, delayed attempts and dead letters. The existing reader computes an optional source cut in its same SERIALIZABLE authority/page transaction, requires the exact page head, and returns it only after final authority checks and successful commit. Its clock anchor precedes lock waits. Reversed IDs and later commits are not inferred from max IDs or queue metrics. Ordinary feed pages remain available without a cut. The cut is a captured-source observation, not a permit, applied ACK, node freshness or native drain. Unrelated global pending exports conservatively prevent a positive cut; sustained traffic and vacuum/index maintenance remain availability/capacity risks requiring measurement.
Final source-bound Linux validation passed351 parent/subtest events across46 roots in cmd/control-api and rtcpolicy, plus80 events across13 real PostgreSQL roots. Both lanes have zero failures/skips/source drift and verified owned cleanup, use isolated internal Docker networks and publish no host ports. The real Control executable covers disabled/private routing, two tenants, correlated JWT/audit, replay, Grant withdrawal, readiness failure and successful shutdown. Its build is an actual child build; the outer Go suites use race instrumentation. The source-cut lane covers same-snapshot head, pending/leased/delayed/dead-letter work, lower-ID late commit, actual deferred COMMIT failure, Grant ABA rollback and PostgreSQL index plans with2048 genuine source mutations. Counts are test events, not distinct product capabilities. The six source/static checks passed, including35 architecture and55 migration tests; document/archive checks follow separately.
All earlier attempts remain archived as their actual results. Corrections include isolated Redis fixture databases, use of the pinned upstream logging.Disable before command clients/goroutines (metrics/readiness/error returns remain), the correct upstream logging package, permanent Grant revocation instead of forbidden deletion, and acknowledging the real Consent capture created by the revocation fixture before draining export. No assertion was weakened or failed result rebound.
Native patch metrics remain21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay identifiers,2 hooks and adapter121 lexical/182 physical lines. Consumer lifetime, pushed invalidation, measured node freshness, normal long-lived RTC and effective native revocation remain unfinished. The old PostICE timeout cause remains NOT_PROVEN; native and forward replay were not rerun by these lanes. GX03 stays IN_PROGRESS, final candidate null and added completion credit0. No final architecture review or M1 v3.0 is generated. Staging remains NOT-RUN — requires authorized Staging environment.
[Source-bound bootstrap and source-cut evidence](../development/evidence/m1-policy-feed-source-cut-2026-09-26.json).
## GX03 bounded local invalidation state — 2026-09-26
A denial-only local state component now reuses the committed private feed's exact scope, contiguous-page and opaque-binding checks. Page installation and watch registration share one bounded critical section. Retained maximum policy versions prevent a delayed original admission from escaping an already installed invalidation. The exact durable/native pair and Room/Connection generation key keeps an old-generation event from closing a different generation. A malformed later event, scope mismatch, gap, replay or exhausted history limit fails the whole state closed without advancing its cursor; no eviction or reset restores prior authority.
Active watches and retained binding history have separate explicit limits. Denied is a pure O(1) atomic observation; nil/zero/released handles fail closed. Release removes only its exact handle and never deletes denial history. No callback, I/O, timer, goroutine, native membership/routing or transport logic runs in this component. A nil Denied result is not authentication, a permit, renewal, freshness or quota authority. This component is not yet wired into the native host; existing original authority and the <=2s join-only ceiling remain unchanged.
Actual isolated Linux race execution on transport parent246e76af3d9ab9f127f64233b6f8ea556280b3bb plus two new Go files passed228 parent/subtest events across38 exact roots in the complete rtcpolicy package, zero failures/skips/source drift and confirmed owned container cleanup. The new five roots include32 actual install/attach race rounds, late/equal-version denial, replacement-generation isolation, partial cursor progress, whole-page failure, permanent terminal state and exact release/capacity behavior. Docker network was none, with no published host ports; HTTP fixtures use container loopback only. No PostgreSQL, patched native runtime or cloud lane is claimed. Ten source/static checks passed including35 architecture and55 migration tests; final archive/document checks follow before commit.
The continued native completion inspection also found that concurrent Close calls can return before a first close completes, subscription close launches asynchronous flushes, and transport close logs rather than returns peer-close errors. Existing onClose/Release/absence and a new notification merely placed after these calls would not prove native drain. No patch-growth approval or upstream change follows from this source-only finding. Node consumer lifetime, source-cut freshness, push wiring, normal long-lived authorization, native completion and effective quota release remain unfinished. Native metrics stay21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay identifiers,2 hooks and adapter121 lexical/182 physical lines. GX03 remains IN_PROGRESS, final candidate null and completion credit added0. No final review or M1 v3.0 is generated; Staging remains NOT-RUN — requires authorized Staging environment.
[Local invalidation state evidence](../development/evidence/m1-policy-local-state-2026-09-26.json).
## GX03 private Service-authorized policy feed HTTPS transport — 2026-09-26
The fixed private HTTPS policy-feed operation reuses existing internal Service JWT issuance, exact audience, durable one-use replay consumption, authenticated provenance, configured scope and room.read. Its repository adapter delegates to the already committed bounded SERIALIZABLE feed reader. Requests contain only cursor and page limit. A denied Room rejects the entire page; no client-supplied scope, applied-prefix ACK or SDK capability can grant authority.
The existing admission server/client share their exact TLS/SNI/Host/raw-path, strict JSON, capacity, proxy/redirect and socket ownership mechanisms through two closed operations. Admission remains room.join with its original500ms deadline; feed has a separate fixed2s I/O budget, unrelated to permit lifetime or freshness. The client validates at most128 events/128KiB, exact scope, contiguous sequence, resource/native binding and positive generations/version. It returns either the complete page or zero and joins raw TCP/dial cleanup. No listener, production bootstrap, native patch, SQL query, migration, generated contract or public SDK is added. Seven Go files comprise two shared runtime adaptations, three new runtime adapters/types and two test files.
Actual isolated Linux race execution on reader parent 6089147acf51ef5c523cc0e55f08289a105129c6 plus seven integrated files passed264 parent/subtest events across39 exact roots and2 packages, zero failures/skips/drift and verified owned cleanup. The full rtcpolicy test package includes genuine TLS HTTP1/HTTP2, fresh signed JWTs, direct-client wrong audience/permission/replay, scope injection, malformed bodies, private aliases, invalid peer pages, capacity and cancellation; its memory identity is protocol-fixture evidence only. The new PostgreSQL HTTPS root independently uses real durable JWT/JTI and audit, actual95/96 revocation rows in two Rooms, contiguous partial/empty pages, direct replay, audit failure and whole-page Room denial. It asserts that read observation neither marks native enforcement effective nor releases held quota. Five existing PostgreSQL reader/authority/transport roots also pass. Ten source/static checks passed including35 architecture and55 migration tests; final archive/document checks follow before commit. Counts are test events, not unique business capabilities.
This delivers a private bounded read transport only, not a pushed subscription, node consumer identity, applied-prefix ACK, complete source freshness cut or native drain. The native <=2s join-only ceiling and quota liability are unchanged. Historical denial-scan capacity remains unmeasured. All seven native patch metrics are unchanged:21 files(12 runtime/9 tests),17 modified/35 added functions,3966 changed lines,29 OneSay runtime identifiers,2 hook families and adapter121 lexical/182 physical lines. Earlier native/replay receipts retain their original bindings; the old PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate null and added completion credit0. Final review and M1 v3.0 remain ungenerated. Staging remains NOT-RUN — requires authorized Staging environment.
[Private feed HTTPS transport evidence](../development/evidence/m1-policy-feed-transport-2026-09-26.json).
## GX03 private Service-authorized policy feed reader — 2026-09-26
The private RTCPolicyFeedReader derives one configured Service, ProjectEnvironment and native infrastructure/cluster. It accepts an existing verified internal Service identity and the registered room.read permission, then rechecks the current Service graph, original selected unbound Grant and applicable current/historical denial facts. Every Room in the complete contiguous page must pass; an unauthorized event cannot be filtered while advancing the cursor. Empty pages still require current scope and unbound authority. One bounded SERIALIZABLE transaction reads, audits and rechecks before returning a nonportable observation.
The existing policy-invalidation repository now exposes its unchanged storage body to this caller-owned transaction. Its standalone read-only REPEATABLE READ wrapper remains. The new seam refuses insufficient isolation or an unbounded context; it neither authenticates nor commits for its caller. No Room, publication-key or stream-head writer lock is added. Three Go files comprise one storage extraction, one private owner and one actual PostgreSQL fixture. There is no migration, generated-source, endpoint, native ACL or permission registry change.
Actual isolated Linux race execution on clean host parent 2b394d1a1068fe95aa8f3b056e9b25a581ebf3ed plus the three integrated files passed81 parent/subtest events across8 exact roots in1 package, zero failures/skips/drift and verified owned cleanup. Three new roots exercise genuine signed/verified/replay-consumed Service requests, public95/96 revocations in distinct Rooms, full/partial/empty prefix, wrong scope/identity/Grant, later-Room whole-page denial, post-audit allow and deny withdrawal/restore, audit rollback, real Service/Grant lock waits, serialization conflict, token expiry and cancellation. Five existing policy-caller/storage roots are focused regressions. Ten source/static checks passed including35 architecture and55 migration tests; archive/document checks follow before commit. Counts are events, not unique business capabilities.
The <=128-event bound does not establish total Service denial-history cost or capacity. This is a private read owner only: HTTP transport, pushed subscription, consumer-session lifetime, node applied-prefix/freshness and native drain are not proved. room.read is not permission to claim node application or effective revocation. Native <=2s and existing quota liability remain unchanged; no native runtime or previous replay evidence is rebound. Native metrics remain21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay runtime identifiers,2 hooks and adapter121 lexical/182 physical lines. GX03 remains IN_PROGRESS, final candidate null and added completion credit0. No final review or M1 v3.0 is generated. Staging remains NOT-RUN — requires authorized Staging environment.
[Private feed reader evidence](../development/evidence/m1-policy-feed-reader-2026-09-26.json).
## GX03 actual authority worker host and bounded observations — 2026-09-26
The thin cmd/rtc-authority-worker composes the existing source-export and original-authority-processing RunOne owners through cmd/internal/workerhost. Each configured coarse round gives one bounded turn to each lane. Repository leases, retries and atomic processing remain the authority owners. There is no per-participant authorization poll, listener, new scheduler infrastructure, native API or media dependency. Fourteen Go files comprise five shared overlays and nine new files; migrations and generated sources are unchanged.
Configuration is a strict first-line stdin JSON object with database_url, infrastructure_environment, cluster_key, poll_interval_ms, startup_timeout_ms, shutdown_timeout_ms and max_connections. Database policy and ambient-PostgreSQL rejection reuse the existing private host. Startup verifies schema102 without applying migrations. The operational interval is explicitly configured between 1000 and 60000 ms; it is not a freshness or security guarantee. Subsequent stdin liveness/readiness/metrics/postgres/backlog requests use the existing private controls; EOF cancels and joins shutdown. The dedicated metadata sampler includes incomplete leased, delayed and dead-letter work, caps each lane at10001 with an explicit lower-bound flag, and uses existing500ms context/400ms statement bounds and one-second cooldown. Readiness means process/database availability only. LIMIT and timeouts do not establish workload capacity or a bound on history/index visits.
Actual isolated Linux execution on committed worker parent e77c297766224ff88d3cc50cb55fba15a649a647 plus the fourteen integrated files built the real command with Go1.26.7, race instrumentation and no build network. Its ELF SHA256 is 35a140d1dd60d2d4fea0e727ab220c76c4b33deda9682f4bd0d0ad9098fcee90. The selected complete workerhost/backlogrepo/command unit packages and two real PostgreSQL roots passed 62 parent/subtest events across31 exact roots and4 packages, with zero failures/skips/source drift and verified owned cleanup. The child received real fixture credentials through stdin, processed an actual signed-Service admission's source changes, produced correlated atomic results and a requested revocation, exposed bounded private observations, then reported stopped and exited successfully after EOF. The separate real database sampler test covers held leases, scope and nonmutation. Counts are test events, not unique product cases. Ten source checks passed, including35 architecture and55 migration cases; archive/document checks follow before commit.
This host does not implement native push/subscription, node freshness, effective revocation, rolling quota or normal long-lived RTC. effective_at remains NULL and quota liability remains held. Native <=2s lifetime is unchanged. Native patch metrics remain21 files(12 runtime/9 tests),17 modified/35 added runtime functions,3966 changed lines,29 OneSay runtime identifiers,2 hook families and external adapter121 lexical/182 physical lines. No old native or replay evidence is rebound; the old PostICE timeout cause remains NOT_PROVEN. GX03 stays IN_PROGRESS, final candidate null, no completion credit, no final architecture review and no M1 v3.0. Staging remains NOT-RUN — requires authorized Staging environment.
[Actual host evidence](../development/evidence/m1-authority-host-2026-09-26.json).
## GX03 bounded authority worker owners — 2026-09-26
The source-export worker reuses the existing 101 repository through Discover, Claim, Publish, FanoutPage and Fail. One call validates at most 32 unique positive hints and executes one claimed phase or one bounded page. A zero-output nonfinal page does not trigger an unbounded drain. The processing worker reuses configured 102 discovery, opaque claims and Process; it never converts a separate Check observation into mutation authority. Current original-authority checking, audit, exact requested revocation and completion remain owned by the existing single repository transaction.
Both workers preserve the six-second coarse cycle context, repository transaction bounds, database holder/fence/expiry ownership, sanitized finite failure policy and full-jitter retry delay. The processing call also respects the claimed expiry and existing 500 ms processing deadline. Cancellation cannot be acknowledged as late success; a committed claim may expire and be reclaimed. These are bounded RunOne owners with no new production loop, scheduler, host, native API or authority cache. Five source files are byte-exact copies of their frozen proposals; the sixth changes only the package documentation. No schema or generated registration bytes change.
Actual isolated Linux race lane on committed processing 102 parent `af87eba35b1077d899e1c9fab6930881b2be20ac` plus six new Go files: 55 passing parent/subtest events, 13 exact roots and 2 packages, zero failures/skips/drift and verified owned cleanup. Nine unit roots exercise bounded discovery, single-phase/page behavior, finite sanitized failures, deadlines and cancellation without claiming durable database proof. Two separate new real PostgreSQL roots acquire actual leases and observe source Publish then later claimed Fanout completion, processing of benign and denied originals, configured-scope exclusion, cancellation after committed Claim, expiry/reclaim and stale-fence rejection. Their explicit fixture-clock advances prove guarded reclaim semantics, not a measurement of natural 30-second passage. Existing Export and Processing are the two owner regression roots. Ten source/static checks pass, including 35 architecture and 55 E2/specialized migration tests, unchanged version 102 validation and generated no-diff. Counts are parent/subtest events, not unique business cases; archive/document checks follow separately.
The runtime host is not installed and no cloud or deployed scheduling is tested. Native push/subscription, node freshness, effective revocation, rolling coverage, quota release and normal long-lived authorization remain unqualified. No patched native host is rerun; the at-most-two-second join-only ceiling is unchanged. Native metrics remain 21 files (12 runtime/9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical/182 physical LOC. Earlier processing and reevaluation failures/results retain their original source bindings, and prior native/replay evidence is not rebound. GX03 remains IN_PROGRESS, final candidate null and added completion/G_PRE credit 0; the earlier PostICE timeout cause remains NOT_PROVEN.
[Source-bound authority worker evidence](../development/evidence/m1-authority-workers-2026-09-26.json).
## GX03 fenced original-authority processing and atomic revocation requests — 2026-09-26
Migration 102 adds configured mutable job companions and immutable results for the existing 101 event/admission work. Its constant append trigger creates the companion in the work insertion transaction. The migration runner takes the work-table writer barrier before its first snapshot, backfills existing work once, and returns before the barrier for verified no-op. Existing capture epochs, journal, pending events, admission snapshots and immutable 101 work remain unchanged.
Configured indexed discovery and opaque claims use database-clock 30-second leases, exact holder/fence checks, five attempts and durable dead letters. Process performs current original-authority checking, a new correlated audit, an immutable result and live-fence completion in one 500 ms SERIALIZABLE transaction. It takes Room UPDATE, native binding, connection UPDATE and the job fence in that order; it takes no publication-key lock. It reuses the private current-authority owner inside that same transaction and never treats the separate Check observation as mutation authority. A denied exact original binding reuses RequestConnectionRevocation, including existing 95/96 job/feed effects, while superseded work completes only its old event/admission pair. A valid result is a database-timestamped observation, not a permit or node-freshness acknowledgment. Errors and unavailable evidence remain errors, not fabricated denials or successful completion.
The first actual attempt is preserved with 672 passing events and two failure events: the new upgrade-backfill root rejected an unsupported fixture database prefix, and its package failed. It did not execute that root's upgrade body. The correction changes only that one test argument to the existing allowed onesay_http_authority_ prefix; shared fixture rules, runtime, SQL, assertions, E2 and generated bytes are unchanged. All ten original source/static checks remain preserved with the failed source.
Corrected actual isolated Linux race regression on committed reevaluation parent `c2c33c826e0ef09b061745ddbdc7630cfb1a7b45` plus ten integrated files: 673 passing parent/subtest events, 11 exact roots, 3 packages, zero failures/skips, no source drift and verified owned cleanup. The five new repository roots cover current Human authority, benign observation while a publication row is held, Service withdrawal/restore, exact requested revocation and later supersession, atomic audit/result/completion failure, post-result lease expiry, stale/reclaimed leases, configured discovery and dead letters, concurrent original jobs, and the actual 101-to-102 paused-fanout installation barrier. Two migration roots verify preserved prior bytes, no-op and writer barriers. The existing public Device fixture exercises actual report refresh and processing; original Check, Export and ExportAdmissionRaces are the three focused regression roots. Ten source/static checks pass, including 35 architecture and 55 E2/specialized migration tests, version-102 validation and generated no-diff. Counts are parent/subtest events, not unique business cases; final archive/document checks follow separately.
This increment installs no runtime worker host, native push/subscription, node freshness, effective revocation or quota release. Normal long-lived authorization remains unqualified. Indexed finite pages and due jobs do not establish production capacity or bound total historical work. The native at-most-two-second join-only ceiling and admission deadline remain unchanged; no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior source, original failed reevaluation fixture and corrected evidence stay bound to their own inputs; no native/replay evidence is rebound and the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
[Source-bound authority processing evidence](../development/evidence/m1-authority-processing-2026-09-26.json).
## GX03 observe original RTC admission authority — 2026-09-26
The original five Go files add an IDs-only repository Check of actual immutable source/admission work and the original Human or Device authority. The bounded SERIALIZABLE owner verifies the stored binding, complete audit ActorChain, original intervals, selected Grants, Consent, quota and executing-Service continuity. A completed Service request JWT may expire without replacing that original authority. Benign report/fence updates are rechecked by existing owners; withdrawal and ABA remain denied. SQL/context/serialization failures and unavailable route or quota return errors, not a fabricated terminal observation.
The corrected owned Linux PostgreSQL race run passed 678 parent/subtest events across 4 exact roots and 2 packages, with no failure, skip or source drift and confirmed cleanup. The new Human root includes actual stale-snapshot 40001 and released-quota checks; the public Device root includes actual same-content report refresh through token exchange/PUT and source export. Ten source static checks passed, including unchanged schema101 validation and generated no-diff. Counts are test events, not distinct business cases.
The first actual run remains FAIL: 670 pass events and nine failure events from two leaf checks plus ancestors/package. The real report refresh had advanced the shared report head before later original-request Consent probes. A separately reviewed two-file fixture correction runs the unchanged complete distinct-root admission/report fixture after those probes and intervening credential ABA, before Human Grant loss. All five original proposal files and runtime checks remain byte-identical; no assertion or expected status is weakened, no authority history is restored, and both complete source/result/static lineages are archived.
This increment records no durable reevaluation outcome, installs no worker and requests no revocation. It changes no native code, permit, <=2s window, original hard/quota ceiling, freshness, effective barrier or quota release. GX03 remains IN_PROGRESS, final candidate remains null, and no G_PRE, P1/P5 or completion credit is added. Earlier native/replay evidence is historical; the earlier PostICE timeout cause remains NOT_PROVEN.
[Source-bound original authority evidence](../development/evidence/m1-admission-reevaluation-2026-09-26.json).
## GX03 publish captured source changes and discover reevaluation work — 2026-09-26
Migration 101 appends one private export-work row atomically with each immutable source pending event. The runner drains pending appenders before its first snapshot, backfills earlier committed pending rows once and installs the constant AFTER INSERT enqueue trigger; verified applied 101 returns before that barrier. Original journal/pending bytes and both capture epochs remain unchanged. The source transaction takes no Room, admission-registration or policy-stream lock and does no dependent fanout.
Discovery ranges over indexed due unfinished work. Claim fences and database-clock leases keep retries bounded and leave explicit dead-letter state. Event identities never become a commit cursor: a lower identity that commits later remains discoverable independently. Publication inserts every sorted selector before incrementing each generation, including zero-dependent events, and records its immutable READ COMMITTED MVCC cut in a separate statement after key waits. A Consent receipt publishes both its source ID and complete fourteen-coordinate binding alias. Publication holds no Room/binding locks and performs no dependent scan while holding registration keys.
After publication releases its keys, fanout initializes a finite audit-ID traversal maximum. This only bounds traversal; fixed-cut admission visibility and original source visibility still decide eligibility. The reverse/forward C-collation index supports at most 129 candidates from each of at most two selectors before visibility classification. A bounded deduplicated page advances over excluded candidates as well as affected ones, so a zero-output nonfinal page is valid. Required immutable event/admission reevaluation rows and fenced cursor progress commit together. SQL checks prevent skipped affected members and incomplete completion. This is an index-aligned design and logical page bound, not a measured production-capacity result; physical query cost still depends on plans, MVCC tuples and index/storage maintenance.
Actual isolated Linux race regression on committed snapshot100 parent `0b97fdbe9ed8e4222302c7f7e2a57d5e4190b364` plus nine integrated files: 36 passing parent/subtest events, 14 exact roots, 2 packages, zero failures/skips, no source drift and verified owned cleanup. The five new repository roots check fixed-cut matching and exclusions, finite empty pages, cut/output rollback, stale/reclaimed leases, dead-letter bounds, reversed allocation/commit order, Consent alias matching, real admission/export waits and the mixed existing-alias/new-key registration primitive. Three real upgrade roots check earlier/later appenders across installation, preserved capture/migration history, verified no-op and source rollback. Six focused storage, native-admission owner, Service-capture and migration regression roots also pass. The existing-key-first actual admission waits remain under the original admission bound; the zero-dependent exporter-first case requires exact serialization SQLSTATE 40001. Ten source/static checks pass, including 35 architecture and 55 E2/specialized migration tests, version-101 validation and generated no-diff. Counts are test events, not unique business cases; final archive/document checks follow separately.
This increment stops at durable source publication and discovery of original admissions that require reevaluation. It installs no runtime worker, owner reevaluation result, ordered native-feed delivery, pushed invalidation, node freshness, effective revocation or quota release. Normal long-lived authorization remains unqualified. The native at-most-two-second join-only ceiling and existing 500 ms admission deadline are unchanged; no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Snapshot100 and preceding evidence remain bound to their original source; prior native/replay evidence is not rebound and the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
[Source-bound authority export evidence](../development/evidence/m1-authority-export-2026-09-26.json).
## GX03 retain checked admission graph and durable selectors — 2026-09-26
The original Human/Device and independent Service checks now assemble a private typed admission graph from their actual checked proof objects in the same serializable owner transaction. It retains exact original roots and intervals, resource observations, Grant fences, current Service detail, consumed Consent binding, capability/requirements facts and quota coverage. No token, credential verifier, signing key or mutable native participant is retained. Exact source selectors include the full fourteen-coordinate Consent binding as well as the original receipt ID.
Migration 100 stores immutable admission snapshots tied to the actual same-transaction audit and native connection binding. The database derives capture epochs, XID, fixed authority snapshot and clock. Normalized dependency rows must match every distinct selector; SHA256 limits index size and full coordinates remain part of lookup validation. Sorted selector INSERTs and SHARE locks form a registration rendezvous. Deferred checks reject missing dependencies and own-transaction source mutations, and expiry is checked after waits and at commit. Existing public/native backend privileges do not grant this storage. The private owner records the graph after the final original and Service rechecks and commits before returning.
Actual isolated Linux race regression on committed Service99 parent `c680f74706d20235966bcf496052f6b469c43d51` plus fourteen exact integrated files: 675 passing parent/subtest events, 8 exact roots, 3 packages, zero failures/skips, no source drift and verified owned cleanup. Actual Human and public Device admission fixtures check graph/selector storage. Storage tests cover immutable evidence, native-role exclusion, source/audit/selector rollback, deferred rejection of a source mutation after registration, an existing-key serialization primitive and a real stale admission against a newly inserted publication key that must fail with exact SQLSTATE 40001. The latter invokes the rendezvous directly; no source exporter or zero-dependent publication job ran. Successful checked report absence remains copy-only coverage, not a new successful real absent-report fixture. Existing PolicyCallerWithdrawal, embedded digests, fresh-schema and concurrent migration application also pass. Ten source checks pass, including 35 architecture tests, 55 E2/specialized migration tests, version-100 validation and generated no-diff. Counts are test events, not unique business cases; final archive/document checks follow separately.
This increment stores the graph and registration foundation only. It does not run an exporter, publish a complete invalidation feed, reevaluate an admission, push invalidations, prove node freshness or effective revocation, or qualify normal long-lived authorization. The at-most-two-second join-only ceiling and existing 500 ms admission deadline are unchanged; no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Service99 evidence remains bound to its own source and commit; prior native/replay evidence is not rebound and the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
[Source-bound admission snapshot evidence](../development/evidence/m1-admission-snapshot-2026-09-26.json).
## GX03 capture current Service detail presence — 2026-09-26
The existing Service checker requires its current detail row. Migration 99 adds that missing durable source to the private authority journal without changing the checker or prohibiting previously legal detail deletion/restoration. Exact INSERT/DELETE facts use the Service ID, SQL-null source revision and ID-only projection. BEFORE TRUNCATE captures every removed ID under the existing source lock; empty truncation, no-op and metadata updates fabricate no presence change. Journal and pending work commit or roll back with the original mutation. No Principal/Grant generation or connection event is invented.
The runner drains existing capture writers and then the new detail source before its first serializable snapshot and journal constraint DDL. The independent immutable Service capture epoch preserves epoch 98, earlier migration records and owner history; pre-installation state is not backfilled as fictional events. A verified applied 99 returns before source locks. Source writers acquire no shared stream head, registration lock or connection fanout. Event IDs remain work identities, not commit cursors.
Actual isolated Linux race regression on committed parent `de91872e6adbdba93f6989779d3a2753d0d0adda` plus eleven exact integrated files: 27 passing parent/subtest events, 8 exact roots, 2 packages, zero failures/skips, no source drift and verified owned cleanup. The signed Service fixture checks current denial, rollback, committed ABA and unchanged Principal/Grant versions; actual version-98 upgrade fixtures check the installation boundary, writer handoff, per-ID truncation/rollback and verified no-op. Existing PolicyCallerWithdrawal, embedded digests, fresh-schema verification and concurrent application also pass. Ten source checks pass, including 35 architecture tests, 55 E2/specialized migration tests, version-99 validation and generated no-diff. Counts are test events, not unique business cases. Final archive/document checks follow separately.
The exact version/path/SQL-hash tooling exception permits only this reviewed source-kind CHECK expansion while preserving destructive DROP/TRUNCATE rejection. The manifest uses destructive:false and data-preserving-rtc-capture-source-expansion; this explicit tooling supplement supersedes the original four-file proposal README's earlier expand-only wording. The separately reviewed E2 correction appends explicit versions 93–99 and exact version-99 classification, retaining earlier assertions and frozen inventories.
This increment captures Service presence only. The latest committed Human/Device retained facts remain separately source-bound. It does not install admission-vector storage, an exporter, publication barrier, runtime push, freshness or effective revocation. The at-most-two-second join-only ceiling is unchanged and no patched native host is rerun. Native metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior native/replay evidence is not rebound; the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS, final candidate stays null and completion/G_PRE credit added is 0.
[Source-bound Service capture evidence](../development/evidence/m1-service-detail-capture-2026-09-26.json).
## GX03 retain checked Human and Device owner facts — 2026-09-26
The existing Human RTC owner now retains its checked Application client, original stored AppSession and selected AppSession/Room Grant evidence, including nullable expiries. Existing Device Room and connection owners retain the exact original AppSession, final successfully checked stored Delegation roots and binding/reference fields, current requirements, explicit report presence with complete checked report metadata, and the actual compatibility assessment. Distinct Human roots remain separate. Existing Grant fences and original resource intervals retain their own observations.
Private copy helpers isolate optional pointers, stored reference slices, nested capability/profile slices, report contents and assessment values. The shared AppSession copy owner serves both increments. Full successful rechecks replace retained facts only at the existing successful assignment; a failed recheck leaves earlier observations with no authority, and failed acquisition returns no retained facts. Thin time/credential checks do not pretend to refresh dependencies. No additional SQL, lock, authorization predicate, generation-equality denial, native hook or deadline is introduced. All 23 existing runtime raw literals are unchanged. Stored original ObservedAt, current root observation time and HistoryThrough remain distinct; none becomes a capture epoch or publication watermark.
Actual local Linux race regression on clean Resource parent `ba4607ca44eb47932711dd5e56bf8f247bd02820` plus the reviewed 12-file composition: 1022 passing parent/subtest events, 7 exact roots in 3 packages, zero failures/skips, no source drift and verified owned-container/network cleanup. The suite includes the separate synthetic copy-ownership root (3 passing event(s)); those values are not actual authority acquisition. Real existing Human and signed public Device fixtures compare retained values with independent database/repository evidence, cover nullable and finite Human Grant expiry, successful recheck, denied fresh acquisition and failure preserving only prior observations, and preserve the complete distinct-Human root facts. The handler root uses stock LiveKit Room API and separate Redis; no patched native host is run. Source gates (35 tests), authority, native boundary, format, docs, secrets and diff passed. Final archive/document checks follow separately. Counts are test events, not unique business cases.
Optional expired report bytes remain present when the existing evaluator accepts that state. Successful acquisition without a report is NOT_NEWLY_TESTED by this fixture; synthetic absence-copy coverage cannot supply that proof. The normal public Device fixture already has report history, so deleting it is a denied case. Required native capability enforcement and extra Application/Device binding shapes are not newly qualified.
The original combined manifest keeps parent_resource_commit null. Separate evidence binds it to the actual Resource commit and all 13 parent source blobs, preserves Human4/Device8 manifests and all three reviews, and proves the five new files were absent at that parent. These are latest successfully checked facts, not an immutable published dependency vector, portable permit, publication/capture barrier, push path or longer-lived authority. The at-most-two-second join-only ceiling is unchanged. Native patch metrics remain 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior native/replay evidence stays separately source-bound; the earlier PostICE timeout cause remains NOT_PROVEN. GX03 remains IN_PROGRESS; complete vectors, freshness, effective revocation and long-lived RTC remain unqualified. Final candidate stays null and completion/G_PRE credit added is 0.
[Source-bound owner facts evidence](../development/evidence/m1-connection-dependency-facts-2026-09-26.json).
## GX03 propagate complete original resource intervals through checked owners — 2026-09-26
Existing AppSession lifecycle and final Delegation checks now return their already-read resource facts alongside the same results. Checked Human AppSession, Human RTC, Device Room and Device RTC owners retain copied outer graphs and nested change revisions only after their original checks succeed. Every original admission interval remains distinct, including repeated resource keys from lifecycle and different roots. The batch keeps the final successful root observations, not superseded prepass copies. HistoryThrough is an observation timestamp, never a semantic generation, publication watermark or recheck-equality rule. No Service resource graph is invented for paths that do not read one.
The nine runtime files preserve all 58 raw literals and the existing queries, authorization predicates, lock ordering and deadlines. Full successful origin rechecks replace observations; failed rechecks leave only prior nonauthoritative observations. Failed acquisition returns no partial graph. Existing time/credential-only final checks remain unchanged. These retained facts do not authorize use after a failed check or ended transaction and do not form an immutable publisher snapshot.
Actual local Linux PostgreSQL race regression on clean parent `8849c1798876bd10517a7663af917d5922dc8d3d` plus the 13 reviewed overlays: 1017 passing parent/subtest events across 6 exact roots in 3 packages, zero failures/skips, no source drift and confirmed owned-container/network cleanup. Existing real Human fixtures check exact admission/head/change coordinates, terminal/restoration history, successful changed-head rechecks with unchanged deadlines, and copied nested slices. The signed distinct-Human Device fixture checks complete multisets of 25 Room and 34 origin observations, including the separate AppSession/RTC anchors and repeated Device observations. Additional distinct Application/Device targets are not newly exercised. The handler root uses stock LiveKit Room API and separated Redis; the patched native host is not executed. Counts are parent/subtest events, not unique business cases. Source gates (35 tests), authority, native boundary, format, docs, secrets and diff passed; final archive/document checks are a separate step.
The frozen proposal retains its original null parent_grant_commit. The evidence separately proves the actual committed Grant parent, all 17 corrected Grant source blobs, and the 13-file bridge: eight Grant-layer parents and five unchanged earlier committed owners. The corrected permanent-membership revocation cleanup remains intact; the preceding Grant failed attempt and corrected PASS retain their separate source-bound archive.
The at-most-two-second join-only ceiling and native patch are unchanged. Seven unchanged metrics: 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. Prior PostICE and forward replay evidence is not rerun or rebound. The old PostICE timeout cause remains NOT_PROVEN and stability unresolved. Complete dependency vectors, publication/capture barriers, normal long-lived RTC, export/push, freshness and effective revocation remain unfinished and unqualified. GX03 stays IN_PROGRESS; final candidate is null; completion/G_PRE credit added: 0.
[Source-bound Resource evidence](../development/evidence/m1-resource-owner-propagation-2026-09-26.json).
## GX03 retain checked Grant-set fence observations — 2026-09-26
The existing Grant authority owner now retains copied exact PrincipalID/generation facts from its successful checks. Human application clients and original RTC authority, current Human AppSession authority, the independently checked executing Service, and the complete Device original AppSession-plus-RTC-root union keep their own checked observations. Distinct Human delegators remain separate keys; a shared Device principal is deduplicated. No ActorChain inference or caller-provided proof is introduced.
These are latest-successful checked observations, not an immutable publication snapshot or portable permission. A full successful recheck replaces them; a failed recheck leaves only the previous observation, which cannot authorize anything after failure or transaction completion. Existing time/credential-only final rechecks remain time/credential-only and do not reread Grant fences. The 33 raw SQL literals in eight runtime files are unchanged. No extra query, lock order, authorization predicate, generation-equality refusal or deadline is added; unrelated same-transaction Grant changes can advance retained observations after a successful full recheck.
Actual corrected local Linux PostgreSQL race regression on source base `17e8a6bab37d2a98d03d9488ff7190ebbc92e8df` plus the 17 reviewed overlays: 994 passing parent/subtest events, 14 exact affected roots in 2 packages, zero failures/skips, no source drift and verified owned-container/network cleanup. The real signed Device fixture exercises separate original AppSession and RTC Human delegators, exact database generations and the shared Device. The existing handler root uses stock LiveKit Room API with separated Redis; this lane does not run the patched native host. Counts are not unique business cases. Source gates (35 tests), authority, native boundary, format, docs, secrets and diff checks passed; archive/document checks are a separate subsequent step.
The first actual run remains a FAIL: 986 pass events, 9 failure events from one cleanup leaf and its parent/package propagation, 13 of 14 root passes, zero skips/drift and verified container cleanup. Its deferred membership DELETE correctly hit the permanent-identity guard (P0001). The explicit one-file test correction revokes the exact created membership and verifies row/head/history parity; it preserves permanent identity and prior active history. It supersedes only the original proposal/review expectation of deleting the row or restoring absence. All 16 other proposal files, including all runtime code, are byte-identical. Both original and corrected source/static/result evidence are retained separately.
The at-most-two-second join-only admission ceiling and native patch are unchanged. Seven unchanged patch metrics: 21 files (12 runtime / 9 tests), 17 modified and 35 added runtime functions, 3,966 changed patch lines, 29 OneSay runtime AST identifiers, 2 external hook families and adapter 121 lexical / 182 physical LOC. The archived historical PostICE comparison identified no concrete old resume-race repair from the lifetime extraction. Prior PostICE diagnostic/contextual results retain their original source binding; they are not rerun or rebound to this Grant increment. The older timeout cause remains NOT_PROVEN and stability unresolved. Complete dependency vectors, publication/capture barriers, normal long-lived RTC, export/push, freshness and effective revocation remain unfinished and unqualified. GX03 stays IN_PROGRESS; final architecture candidate remains null, and this increment adds zero completion/G_PRE credit.
[Source-bound Grant evidence](../development/evidence/m1-grant-dependency-2026-09-26.json); [historical PostICE comparison](../development/evidence/m1-grant-dependency-2026-09-26-raw/postice-original-failure-comparison.md.txt).
## GX03 bounded PostICE diagnostic and shared-observer regression — 2026-09-26
The latest single real PostICE diagnostic passed on source base `73c3884ac1d0bc3f4bcb905281feb147cc91ff64` plus the two reviewed test-only overlays, using a freshly built formal native host (ELF SHA-256 `ac412fc321734ff135edea61b6a71f52e089d756ad8e9ef13642f386de3de677`). Existing same-SID recovery, full reconnect, revoked-Grant HTTP 403 refusal, durable audit and final native readbacks passed. The fixture used actual PostgreSQL, separated Redis, compiled native LiveKit and the real TLS admission receiver; no mocks or skipped roots were credited.
The bounded trace observed signal loss at 2427 ms and the reconnected callback at 2501 ms (74 ms later) in this run. Three allowed HTTP observations returned 200 and the revoked attempt returned 403. These are test/HTTP observations: response ceiling offsets are not exact native StartedAt or proof of the original attached native lifetime. The diagnostic snapshot does not prove the absence of later requests.
The diagnostic root recorded 1 passing test event; the shared observer regression recorded 7 passing parent/subtest events in one exact root. Both race runs had zero failures/skips, no input drift and confirmed owned container/network cleanup; source static gates, authority, native boundary, format, docs and secrets passed. Final archive/document checks are a separate post-closeout step.
A separate contextual run repeated the historical nine-root native suite shape using this same fresh host and overlays: 971 passing parent/subtest events across 9 exact roots in 2 packages, zero failures/skips and verified cleanup. Its PostICE root repeats the isolated diagnostic requirement and is not additional unique coverage. An initial contextual-runner preflight failed on a host-checkpoint validator typo before any tests or containers; its unchanged failure receipt and pre-fix runner are retained separately.
The older timeout and secondary foreground-count mismatch remain historical failures. Their root cause is NOT_PROVEN; stability remains unresolved. One passing diagnostic does not demonstrate an intermittent runtime issue was fixed. The overlays add bounded observation only: no runtime behavior, assertion, authority TTL or watchdog was changed. The at-most-two-second join-only admission ceiling remains unchanged. GX03 remains IN_PROGRESS; P1/P5, long-lived authorization, push/freshness/effective revocation, G_PRE, full CI and final architecture review remain unqualified. Final candidate stays null; completion credit added: 0.
[Source-bound diagnostic evidence](../development/evidence/m1-postice-diagnostic-2026-09-26.json).
## GX03 actual forward replay of current local-validity patch — 2026-09-26
Official untagged LiveKit source `f7ec53ca73dc895c447a7bd110b71c6de32e3b43` and Protocol `26af364d03193a0d4902588e980d896f15a8ea12` were actually replayed against patch `81abe7215d8310e4c52460e6d243e0c4c9be0d6a6b7120fea110d6c4d434863c`, using the immutable Platform `4ca259fc1796e0692df5bcf5c3e0f90026a7b852` snapshot. This is a forward source candidate, not a new release. Production pins and Platform host adapter bytes are unchanged. Later Platform authority changes are outside this replay snapshot.
The initial apply recorded two conflicted files and four rejected hunks in `NewRoom` and `RoomManager.StartSession`. Seven recorded patch-text replacements preserve the candidate's clone helper and telemetry SDK arguments; this is not a unique output-source LOC count. Original rejects, resolution patch and apply logs are retained.
All eight fresh phases passed: Wire, offline host dependency preparation, native service, RTC/signalling, selected upstream Room, Platform host build, host tests and binary module readback. Native suites recorded 144 passing parent/subtest events across 60 exact roots; host suites recorded 215 events across 27 exact roots. Counts are events, not unique business cases. The selected race suites had zero failures/skips; input hashes stayed unchanged and owned-container cleanup passed.
The current-patch result is PASS_FOCUSED_FORWARD_PATCH_REPLAY_WITH_DOCUMENTED_MECHANICAL_REBASE. Historical patch `17ee9858...` evidence remains separate and is not rebound. This lane did not run native-host E2E or post-ICE recovery. P1/P5, normal long-lived authorization, freshness, effective revocation, full upstream regression, full local CI, G_PRE, final architecture review, Staging, hardware and Production remain unqualified by this evidence. Completion credit added: 0.
[Source-bound replay evidence](../development/evidence/m1-local-validity-forward-2026-09-26.json).
## GX03 retain checked resource history dependency evidence — 2026-09-26
The existing resource-history owner now retains exact owner keys, original admission revisions, independently checked head revisions and every interval change revision. Delegation history exposes copied repository evidence for its already-traversed owner graph, including membership and Device owners. Terminal and restored revisions stay distinct. HistoryThrough is read-observation time, never a semantic generation or publication watermark and never a strict equality requirement across rechecks. No extra SQL, lock, authority predicate or deadline change is added.
Actual isolated Linux PostgreSQL race regression: 448 passing parent/subtest events, 11 exact affected roots in 2 packages, zero failures/skips, no source drift and owned-container/network cleanup confirmed. Counts are not unique business cases. Real signed Device and Service Delegation fixtures compare independent exact owner sets and SQL admission/head/change coordinates, including membership withdrawal/restoration and copied graph isolation. Additional binding-target graph shapes are not newly tested. Source architecture/ledger gates (35 tests), authority binding, native boundary, format, docs and secrets passed; final archive/docs checks are recorded separately at the commit checkpoint. [Source-bound evidence](../development/evidence/m1-resource-dependency-2026-09-26.json).
This remains a partial owner projection. Grant-fence retention, top-level RTC origin propagation, complete vectors, capture/publication barriers, export/push, node freshness, long-lived sessions, P2-P4 and effective revoke remain unfinished. The native Post-ICE failure is NOT_RERUN by this increment; forward replay is tracked by a separate source-bound lane. Native patch and all seven metrics are unchanged. No final architecture review, completion credit, M1 v3.0, cloud or hardware qualification is added.
## GX03 retain complete checked Consent dependency facts — 2026-09-26
Human and Device RTC origin owners now retain the complete checked Consent binding, selected receipt ID and receipt expiry by value. The projection requires the exact owning transaction and reuses the existing current check without extra SQL. Failed final rechecks cannot replace retained facts. Receipt expiry remains distinct from the possibly shorter policy Deadline; no authority/native lifetime is extended.
Actual isolated Linux PostgreSQL race regression: 903 passing parent/subtest events, 69 exact roots in 4 packages, zero failures/skips, no input drift and owned-container/network cleanup confirmed. Event counts are not unique business cases. Architecture/ledger gates (35 tests), authority binding, native file boundary, format, docs and secret checks passed. [Source-bound evidence](../development/evidence/m1-consent-dependency-2026-09-26.json).
This is a partial dependency-retention increment, not a complete immutable vector or runtime authorization. Long-lived sessions, publication barrier, export/push, node freshness, P2-P4 and effective revoke remain unfinished. The prior native Post-ICE failure is NOT_RERUN here; current-patch forward replay is NOT_RUN. Native patch and all seven metrics remain unchanged. No final review, completion credit, M1 v3.0, cloud or hardware qualification is added.
## GX03 external local-validity ownership extraction — 2026-09-26
The external Platform adapter now owns the unchanged admission lifetime and terminal policy state. Native LiveKit retains pure local checks, original-capability attachment, exact-SID cleanup and existing join/resume boundaries. Fresh unused admission capabilities are released, and Release never signals policy loss.
Candidate Linux race results: service 99 passing parent/subtest events / 37 exact roots; RTC/signalling 32 passing parent/subtest events / 20 exact roots; selected upstream Room 13 passing parent/subtest events / 3 exact roots; Platform host 215 passing parent/subtest events / 27 exact roots. Wire and the actual Platform host build also completed.
Formal registered-path host build and 215 passing parent/subtest events / 27 roots completed independently. This repeats the host requirements under the registered source paths; it is not additional unique product coverage.
Counts are real parent/subtest events, not unique business cases. All selected phases recorded zero failures/skips, no source drift and owned-container cleanup. Incremental changed-source physical LOC: runtime +40, tests +223; 3 runtime and 4 test files changed, 0 newly added upstream files in this extraction. These physical source deltas include comments/blanks and are distinct from full-patch additions/deletions.
[Source-bound evidence](../development/evidence/m1-local-validity-2026-09-26.json) and [growth/metrics review](../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md). Migration98 source-capture evidence remains valid against unchanged inputs; it was not re-executed by this checkpoint.
The <=2s join-only ceiling is unchanged. Normal long-lived authorization, immutable dependency vectors/publication barrier, authenticated export/push, node freshness, P2-P4 enforcement and effective revocation remain unimplemented/unqualified. TestPostgresRTCNativeHostPostICERecovery retains its previous failure and is NOT_RERUN here; current-patch forward replay is NOT_RUN. No completion credit, final architecture review, M1 v3.0 or architecture-finalized claim is added.
## GX03 durable authority change capture — 2026-09-26
Migration 98 records changes from the existing authority owners in the same
transaction and retains independent pending work. Source writes do not lock an
RTC stream head, fan out across connections or call a native runtime. Report
withdrawal/restoration, quota assignment ABA and lower-ID late commits are retained.
Actual isolated Linux PostgreSQL race regression: 881 passing parent/subtest events, 67 exact required roots in 4 packages, zero failures/skips. These are test-event counts, not unique business cases. Source drift was absent; owned containers/network cleanup passed. No host ports were published.
[Source-bound evidence](../development/evidence/m1-authority-changes-2026-09-26.json).
This is capture-only storage evidence. Dependency vectors, authenticated export,
node freshness and effective revoke remain unfinished. The previous native
post-ICE recovery failure remains open; current-patch forward replay is NOT_RUN.
No upstream patch/adapter/public contract change or GX03 completion credit.
## GX03 complete resource terminal history — 2026-09-26
Fixed an existing authority-history gap: independently setting deleted_at,
revoked_at or archived_at while status stayed active previously did not advance
resource history. Clearing the marker could conceal original authority loss.
Migration97 extends the existing owner snapshots and retains the actual write
time. AppSession and Delegation history consumers reject that loss even after
restoration; RTC original-authority checks reuse those consumers.
Actual isolated Linux PostgreSQL race regression: 858 passing parent/subtest events, 59 exact required roots in 4 packages, zero failures/skips. These are event counts, not unique business cases. Source drift was absent and owned cleanup passed.
[Source-bound evidence](../development/evidence/m1-owner-timestamps-2026-09-26.json)
and [implementation/limits](../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md).
This is control-plane history correction only. Long-lived authorization, complete
dependency capture/push, freshness and effective revocation remain unfinished.
The prior native post-ICE recovery failure remains open, not requalified here.
No patch/adapter/public API change, no milestone credit and no final-review handoff.
## GX03 separate authority and quota ceilings — 2026-09-26
Separated short admission-use, original authority-hard and initial quota-coverage
deadlines across existing owners, private TLS API and external native adapter.
Retained exact immutable reservation facts and refreshed database time after
quota row-lock waits for both Human and Device. Native lifetime stays at most
two seconds; no upstream patch or public SDK contract changed.
PostgreSQL/private API: 508 passing parent/subtest events / 49 roots; host adapter/startup: 207 events / 23 roots. Both race lanes passed with exact required sets and zero failures/skips. The compiled-native lane is FAIL: 970 passing events, 8 of 9 roots passed, one failed root plus its package-failure event, zero skips. TestPostgresRTCNativeHostPostICERecovery did not complete actual SDK signal recovery. Counts include parent events and overlapping helper scenarios, not unique business cases.
[Source-bound evidence](../development/evidence/m1-authority-ceilings-2026-09-26.json)
and [implementation/limits](../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md).
This advances the existing correction without new milestone credit. Dependency
capture/push, node freshness/effective barrier and normal long sessions remain
unfinished. External review CORRECTIONS_IN_PROGRESS; cloud/hardware NOT_RUN.
## GX03 durable policy invalidation storage — 2026-09-26
Added transaction-owned ordered explicit/Room-close invalidations, commit-only
empty notification hints and bounded snapshot replay. Fixed standalone/middle
prefix gaps and migration backfill's concurrent-snapshot/DDL lock order. Existing
revoke work, immutable bindings and Data Sync transaction patterns are reused.
No LiveKit patch, native adapter, SDK contract or two-second join lifetime changed.
Actual final isolated Linux race: 100 events / 22 roots / 5 packages,
zero failures/skips; includes real PostgreSQL upgrade/lock wait, concurrent Apply,
rollback, ordering, pagination, notifications and existing official native API
regressions. [Source-bound evidence](../development/evidence/m1-policy-invalidation-storage-2026-09-26.json)
and [implementation/limits](../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md).
Only storage is qualified: complete dependency capture, authenticated feed,
runtime push, node freshness/effect barrier and long-lived sessions remain open.
G_PRE 1.8%, zero new credit, eleven previous invalid receipts; full local CI
incomplete. External review CORRECTIONS_IN_PROGRESS; no cloud/hardware PASS.
## GX03 Room operation policy extraction — 2026-09-26
Moved managed Room naming/configuration and closed Agent execution decisions to
the existing host adapter, using one pure-local typed callback at existing
pre-side-effect boundaries. Native preset merge, default dispatch/job machinery,
checked join, scheduler and media ownership stay upstream. Two native function
bodies are restored; modified runtime functions 19 -> 17, added functions 34 ->
34, files 21 (12 runtime) unchanged. Runtime changed lines grow 49 and tests 231;
the seven-alternative reuse/growth justification is explicit.
Actual local Linux race: native 133/0/0, host 199/0/0; same formal-path host rerun
199/0/0 and both host builds passed. Both Go AST inventories passed. See
[implementation and limits](../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md)
and [source-bound evidence](../development/evidence/m1-policy-hook-room-policy-2026-09-26.json).
No completion credit is added. Long-lived authorization, pushed invalidation,
all-node effective revocation, current-patch replay and final exact-SHA review
remain open; independent Egress/worker execution is not qualified by this slice.
G_PRE remains 1.8% with eleven prior invalid receipts, full CI is not complete,
and external review stays CORRECTIONS_IN_PROGRESS. No cloud/hardware PASS.
## GX03 participant-admission business extraction — 2026-09-26
Moved five business-ID validations and the complete closed join-only claim
profile from native admission to the existing Platform adapter. Native keeps
verified claims, bounded capacity/deadlines and immutable opaque binding/version
checks; official ClaimGrants.Clone isolates the adapter snapshot. All 34 signed
privilege-expansion cases migrated with zero-backend-call assertions.
Actual Linux race results: 121 native pass events and 160 host pass events,
zero failures/skips; formal-path host rerun 160/0/0, both host builds passed.
Authority/progress/review gate tests passed 35/0/0. Source-bound AST measurement:
21 files / 12 runtime unchanged; added runtime functions 35 to 34; patch physical
lines 3880 to 3856; native OneSay identifiers 41 to 33 (225 to 185 occurrences).
[Implementation, seven metrics and remaining limits](../development/POLICY_PATCH_CONVERGENCE_REVIEW_2026-09-26.md)
and [exact evidence](../development/evidence/m1-policy-hook-neutral-admission-2026-09-26.json)
belong to the existing Goal. Managed-room/Agent/Egress policy convergence,
long-lived invalidation and honest effective-revocation barriers remain open.
The new patch's next-version replay is NOT_RUN; previous replay was not rebound.
G_PRE remains 1.8%, no credit added, eleven prior invalid receipts remain, and
full CI is NOT_COMPLETED. External review stays CORRECTIONS_IN_PROGRESS;
no v3, final architecture or unexecuted cloud/hardware qualification is claimed.
## GX03 policy convergence and external review gate — 2026-09-26
Adopted both Owner amendments in the existing Goal, feature branch, GX order and
complexity baseline. Completed the current 21-file policy-patch classification:
12 runtime files, 35 added / 19 modified runtime functions, +3399/-56 patch lines.
This is the before-convergence snapshot; it identifies embedded business rules,
duplicated native control, scattered side-effect checks and the temporary 2s
permit. It is not a long-lived authorization PASS.
The progress validator now requires all fourteen GX03 exit evidence mappings
and preserves the seven-alternative patch-growth review inventory. External review requires a clean
exact source SHA, later actual architecture/security/native/adapter/replay runs,
and a new source-bound report. Old working-tree receipts cannot be relabeled.
V3 consolidation and retiring existing amendments require explicit source-bound
Owner review approval. Focused progress/gate validation passed 30/0/0.
The first Room convergence is implemented: checked and ordinary joins now share
their local state insertion, retaining native call/lock ordering. The isolated
candidate passed 160 Linux race tests (147 OneSay + 13 selected native Room);
this is focused regression, not complete upstream or long-lived qualification.
Patch files remain 21; patch text 3886 to 3880 lines, +3393/-54 after convergence.
The parser-based measurement tool passed 40 Linux race cases with no failures
or skips. Its metrics do not certify semantic neutrality or hot-path safety.
Local upstream proposal and durable/local-state reuse mapping are retained.
The actual forward source candidate is 27 commits after the locked Server pin.
Initial replay found two function-context conflicts; seven mechanical patch-line
changes preserved upstream behavior. The new patch then passed 160 focused
tests, actual OneSay host compilation and 73 additional host tests. This is
focused forward replay evidence, not the final complete GX03 qualification.
No pin promotion, posting, cloud or hardware operation follows this checkpoint.
Long-lived authorization and the final external handoff remain in progress.
The evidence index is `docs/development/evidence/m1-policy-hook-convergence-2026-09-26.json`.
Weighted G_PRE remains 1.8%; no new completion credit. Eleven prior invalid
receipts still make the progress check exit 1; full local CI is not complete.
## GX03 durable connection revoke — 2026-09-26
Migration 95 transactionally enqueues committed whole-connection revocation.
The new bounded worker reuses Room-work leases/fencing and official LiveKit
RemoveParticipant plus exact absence readback. It preserves revoking state,
effective_at NULL, held seats and unsettled quota; no upstream patch changed.
Linux race regression passed **91/0/0**, 19 roots across five packages, including
real PostgreSQL concurrency/crash/retry and actual official client removal.
The first test-fixture compilation failure is retained, not overwritten.
[Implementation and CCR-A boundaries](../development/RTC_CONNECTION_REVOCATION_WORK.md) and
[source-bound evidence](../development/evidence/m1-gx03-connection-revocation-2026-09-26.json).
No GX completion credit is added. Continuous authority, invalidation, effective
barrier, host assembly and G_PRE remain open. The newly supplied policy-hook
amendment is the immediate next checkpoint before expanding P2–P5; this
increment does not treat the temporary two-second join window as a final design.
## ESP32 internalization — current checkpoint, 2026-09-25
Adopted official LiveKit ESP32 as the future internal RTC runtime through one
private adapter, retaining the separate OneSay Task WSS/OSAF path. The targeted
ten-item audit found no existing RTC core duplication, native public-type leak
or board implementation. The candidate stays at **v0.3.11 /
fbf09edf27a504d82119f730a35bf00fa287f7c1**, with **0 LiveKit ESP32 patches**.
Added a canonical-lock-backed compatibility matrix, read-only upstream checker
and candidate upgrade requirements. Adapter/runtime remains **NOT_IMPLEMENTED**;
exact media dependencies remain NOT_RESOLVED. Eight existing Task native source
substitutions require future combined dependency/RTC regression because their
CMake targets may be shared with LiveKit.
Final Authority/tracking/acceptance tests passed **30/30 with no failures or
skips**. Official immutable Git blob reads now verify source-body hashes within
bounded request/operation limits. Final live discovery returned **NO_UPDATE,
exit 0**, verifying release/tag/registry, manifest/license and all public headers
without changing the pin. The earlier timeout and raw LICENSE fetch failure
remain CHECK_FAILED receipts; discovery does not qualify RTC/device runtime.
The latest Owner correction makes real-device SDK smoke **required for
GX09 / PRE-SDK and currently NOT_RUN**, replacing the earlier optional status.
Board BSP, codec/AEC tuning, audio quality and soak remain OS/OEM-owned.
GX09 and G_PRE are not complete, no completion credit was added, and the existing
GX03 sequence continues. Current results and preserved discovery receipts
are centralized in the
[correction report](../development/ARCHITECTURE_BOUNDARY_CORRECTION_REPORT_2026-09-25.md)
and [ESP32 evidence index](../development/evidence/m1-esp32-internalization-2026-09-25.json).
No board, cloud, purchase, publish, push or merge operation is included.
## Architecture boundary correction — current checkpoint, 2026-09-25
Integrated the targeted GX01 foundation audit, corrected stale qualification
notes and source-scan handling of ignored upstream build caches. Added a local
Linux-only two-Server official LiveKit RTP/reliable-data smoke with separate
Platform/native Redis and verified fixture cleanup; no product or cloud
qualification is inferred from this upstream foundation test.
The native integration now contains **1 patch / 21 files**. Removed duplicated
room allocation, Redis routing, room fences, custom retirement and continuous
500 ms remote authorization polling. LiveKit retains runtime ownership; OneSay
retains bounded business-policy hooks and local immutable expiry. A native
file-boundary gate rejects runtime-kernel patch targets without claiming that
an allowlist alone proves the remaining control hooks safe.
Admission is currently **join-only and limited to at most 2 seconds**, with no
renewal or resume extension. The external durable revocation consumer is **not
implemented**, so sustained authorization and full P1/P5 remain unqualified.
The next existing GX03 task uses durable connection revocation, official native
RemoveParticipant and absence readback; old participant SID events cannot
authorize identity-level removal of a valid replacement.
Signed lifecycle observations are thin, nonbillable **GX05** facts. They are not
precise connected duration, native runtime replicas or effective revocation
proof. Full rolling settlement remains GX10. Current progress is **GX03 0 / 100**,
active scope **983.75** against the original **1000** baseline, with **18.565
earned (provisional 1.8%)**; deferred scope earns no credit.
Final runtime status and source-bound evidence are maintained in the
[correction report](../development/ARCHITECTURE_BOUNDARY_CORRECTION_REPORT_2026-09-25.md)
and [evidence index](../development/evidence/m1-boundary-correction-2026-09-25.json).
Full local CI is incomplete; G_PRE is NOT_READY. CCR-B remains
NOT-RUN — requires authorized Staging environment. Earlier entries below retain
their historical scope and evidence; polling-based behavior is superseded by
this correction. No push, merge, cloud change, purchase or hardware
qualification is included.
## Device required-capability expiry — 2026-09-25
## RTC unsettled quota liability — 2026-09-25
The existing quota owner now retains RTC budget after permission expiry.
Generic expiration, reserve replay, commit and release cannot adopt or settle an
RTC reservation. Unresolved holds remain scoped to ProjectEnvironment, metric
and UTC week and survive quota-policy replacement exactly once. Historical
expired, released and committed rows remain immutable; an unrelated generic
UsageEvent is not native settlement proof. Existing billable facts still count,
so historical unresolved commits may conservatively over-hold budget until
trusted reconciliation. No billable duration is invented from a reservation.
Forward migration 93 adds a non-RTC expiration partial index and a scoped RTC
liability covering index. Canonical Usage semantics and all generated consumers
were regenerated normally; no historical migration or terminal row was rewritten.
Local PostgreSQL race regression: **472/0/0 across 26 roots
and 3 packages**. This includes original Human authority, actual native SDK ICE
and active-lease withdrawal, Device authority, ordinary quota and Task settlement.
After assertion-only strengthening in the new test, its final focused race run
passed **11/0/0**, including ten liability cases. Production,
migration, canonical and generated inputs are identical between those runs; raw
receipts preserve both test checkpoints. Real short-segment expiry, policy
replacement, historical terminal states, generic mutation denial and ordinary
positive controls are exercised against PostgreSQL. Generated Go/TypeScript/C
consumer compilation passes; generated Go packages contain no tests, so that
compile lane earns no test passes. All network tests ran inside owned Linux
Docker with no published host ports, and owned resources were removed.
This closes an actual budget-release gap while continuing GX03. Native interval
measurement, rolling segment reservation/settlement, crash reconciliation and
settlement backlog visibility remain required. The original token and native
authority ceilings are unchanged. Full P1/P5, full local CI and G_PRE remain
unqualified; this increment earns no complete milestone credit. Package order
and the fixed 1000-point denominator are unchanged. CCR-B remains
NOT-RUN — requires authorized Staging environment. No cloud, purchase, hardware,
Desktop, Production, remote push or main merge was performed.
[Local evidence](../development/evidence/m1-gx03-rtc-quota-liability-2026-09-25.json).
## Native active connection authority — 2026-09-25
The pinned native host now owns one bounded active lease per exact Participant
object/SID. Every 500 ms it reuses the existing private ConnectionAdmission owner
and real one-use Service identity to revalidate the original binding. The
two-second development lease has an independent expiry watchdog; cancellation,
late replies, refreshed tokens and same-SID resume cannot revive expired authority.
Old-SID cleanup cannot close a full-reconnect replacement. Existing native Close,
Room removal and checked join/resume are reused; no media engine is changed.
Actual local evidence: native service race **241/0/0**, private HTTPS
race **165/0/0**, host race **73/0/0**, and affected PostgreSQL
race **390/0/0 across 11 roots / 2 packages**. Counts include parent
and child tests. A compatible native SDK holds real ICE beyond three seconds,
then original Grant withdrawal or actual TLS receiver shutdown causes server
disconnect and native participant removal while the original JWT, AppSession
and initial quota remain live. Human/refreshed-token/isolation/Device/report
expiry regressions retain exact foreground calls; background renewals are checked
separately, including after native shutdown. The diagnostic call-kind header
never affects server authorization. All listeners stay inside owned Linux Docker.
This is local join-only participant-lifecycle evidence. Initial quota and original
authority expiry are not extended. Continuous billable Usage, rolling quota,
revocation outbox/all-node effective_at, actual media cutoff, publish/subscribe/
data/RPC permissions and full P1/P5 remain incomplete. Native ELF is a normal
compiled build; race instrumentation applies to service and integration test
processes. Earlier evidence retains its original source fingerprints.
Continue the existing GX03 quota/Usage and durable active-authority closeout.
Package order and weights are unchanged; this increment earns no complete
milestone credit. Full local CI NOT_RUN; G_PRE NOT_READY. CCR-B:
NOT-RUN — requires authorized Staging environment. No cloud, hardware, Desktop,
Production, purchase, remote push or main merge is implied.
[Current local evidence](../development/evidence/m1-gx03-native-active-lease-2026-09-25.json).
A fresh Application now exercises required audio.input/audio.pcm_s16le.v1 with
an actual signed Device report, independent Human-approved Delegation and public
AppSession admission. The existing production owner permits native signaling
while evidence is fresh, then rejects both cached/new public material and raw
native resume/full reconnect after the required report becomes stale. Replaying
the original report cannot renew it. The attacker bypasses the OneSay SDK.
The isolated fault shifts both persisted report timestamps by 301 seconds while
retaining the exact 300-second interval, content, digest and revision. Original
AppSession/RTC roots, session and connection material remain live. Thus the test
isolates current report reevaluation; it does not claim real five-minute waiting
or physical microphone acceptance. Native readback rejects participant replacement
and elevated publish/subscribe/data/Agent permissions; failed operations create no
new origin, seat, quota reservation or Consent consumption.
Reuse mapping: local base a6c13491 public bootstrap, Device identity, report PUT,
AppSession/Consent/Delegation owners, RTC execution, private Service receiver and
compiled native host. Extract only the initial Application/policy/paired Grants
from the existing delegationtargets.Session fixture; the new journey creates no
synthetic AppSession. Original empty-required optional-expiry checks remain.
No production runtime, contract or pinned upstream policy patch changes.
Actual affected Linux race regression: **1103 / 0 / 0 across 5 roots and
3 packages**. This includes the new required-capability journey, retained Device
native signaling, full public Device/Service Delegation, durable Delegation and
version-42 AppSession migration checks. The focused new root passed 11/0/0.
Counts include parents/subtests. Fresh host build, source fingerprints, separate
Redis discovery, zero published host ports and owned-stack cleanup are verified.
One stale-host-source preflight failure is preserved as NOT_RUN test execution;
a fresh build resolves it without rebinding historical evidence.
Required-report expiry: PASS_LOCAL_PUBLIC_AND_NATIVE_ADMISSION_ONLY. CCR-A remains
in progress; previous aggregate evidence still needs current-source revalidation.
Media, active-session enforcement, continuous quota/Usage and full P1/P5 remain
unqualified. Full local CI NOT_RUN; G_PRE NOT_READY; milestone credit stays zero.
CCR-B: NOT-RUN — requires authorized Staging environment. No cloud/hardware/
Desktop/Production acceptance, procurement, remote push or main merge occurred.
Continue GX03 continuous quota/Usage and native enforcement for active sessions,
retaining original authority and bounded renewal. GX07 Agent execution, package
order, weights, SDK scope and all G_PRE gates remain unchanged.
[Local evidence](../development/evidence/m1-gx03-rtc-required-capability-2026-09-25.json).
Earlier entries retain their original checkpoint scope and next-action history.
## 2026-09-25 — Device native signaling admission
Connect actual public Device RTC origins to the existing compiled admission
hook. Use one private ConnectionAdmission path, closed Human/self-Device durable
profiles and original authority checks without constructing a Device login.
Direct native clients exercise join, pre-ICE resume and full reconnect; original
root and credential-generation withdrawal reject new admission. Keep join-only
permissions, unique Service routing, TLS/JTI bounds and restricted database roles.
[Local evidence](../development/evidence/m1-gx03-rtc-device-native-2026-09-25.json).
Actual Linux PostgreSQL, shared Redis, private TLS admission and compiled native
host signaling regression: **1711 / 0 / 0 across 100 roots**,
including 11 Device native case events. Native
host race checks: **73 / 0 / 0 across 13 roots**. Counts
include parents/subtests and retained regression cases, not feature totals.
The isolated stack publishes no host ports, records no source drift and proves
owned container/network cleanup. These are local signaling results, not media
quality, load measurements or a Staging capacity baseline.
The archive preserves 3 failed attempt(s) separately from the
final passing lanes. They are not rewritten as passing runtime evidence.
| Attempt | Pass / fail / skip | Recorded reason |
| --- | --- | --- |
| invalid-schema-selectors | 1393 / 119 / 0 | New predicates incorrectly referred to participant user_id/device_id columns absent from the canonical schema. Real PostgreSQL rejected the normal creation flow. Fixed to the existing principal_id/principal_kind plus connection self-Device mapping; malformed-profile tests now exercise those actual fields. |
| stale-role-test-schema-ceiling | 1674 / 2 / 0 | The expanded regression reached the old native-role test, whose prerequisite still required max migration 89 despite the current schema being 92. Updated only that test to require the complete current embedded schema through VerifyCurrentSchema, while independently retaining exact migration 89 digest and original role withdrawal/restore checks. |
| mixed-native-test-cluster | 286 / 8 / 0 | The unpatched upstream Room API fixture and compiled policy host shared native Redis node discovery. The second Device join lacked the required private callback. The strict call/audit assertion caught this invalid fixture: each native cluster now has its own owned Redis process, distinct from Platform Redis. |
Compilation/setup failure without test events is not a runtime rejection result.
A launcher-generation syntax failure was also retained separately; it started no test or container and earns no runtime credit.
Continue GX03 with required-capability report expiry using a genuinely admitted
Device AppSession whose Application requires that capability. The existing empty-
capability fixture does not qualify this condition. Then complete continuous
Quota/Usage and native enforcement for active sessions. Agent execution retains
its existing GX07 position. Package order, weights and the single ledger remain.
Device native admission: LOCAL_DIRECT_SIGNAL_JOIN_RESUME_RECONNECT_ONLY.
Media, active-session removal and P1/P5 remain NOT_QUALIFIED. Full local CI is
NOT_RUN and G_PRE is NOT_READY. New milestone credit is zero. CCR-A remains in
progress; unrelated historical receipts are not rebound to current sources.
CCR-B: NOT-RUN — requires authorized Staging environment. Production, Desktop
and physical-device acceptance were not executed by this checkpoint.
## 2026-09-25 — Device RTC HTTP execution and immutable origin
Add actual Device RTC create/read/revoke with independent public Delegation and
Human Consent, migration 92 immutable original authority, atomic Device seat and
initial Quota, protected replay and cache-loss rejection. Preserve held capacity
while revoking. Direct HTTP rejects stale credential generations, revoked roots/
Grants and lost original AppSession authority without relying on SDK integrity.
[Local evidence](../development/evidence/m1-gx03-rtc-device-execution-2026-09-25.json):
Linux PostgreSQL, shared Redis and the retained upstream Room API Go race:
**1058 / 0 / 0 across 55 roots**. Migration safety/static checks:
**53 / 0 / 0**; migration manifest/generated consistency passes. Counts
include parents/subtests and retained regressions, not additional feature totals.
The isolated Linux stack publishes no host ports, has no source drift and passes
owned container/network cleanup. The unpatched upstream fixture proves Room API
setup only, not Device native policy, join, media or cloud behavior.
The archive retains 2 failed attempt(s) separately
from the final passing lane; earlier receipts remain historical.
Continue GX03 with native Device admission, required-capability report expiry
qualification and continuous RTC Usage/Quota renewal. Agent execution stays in
the existing GX07 sequence. No new infrastructure or competing plan is introduced.
Device native admission is NOT_IMPLEMENTED and Device media is NOT_QUALIFIED.
P1/P5 remain NOT_QUALIFIED, full local CI is NOT_RUN and G_PRE is NOT_READY.
New milestone credit is zero; package order and complexity weights are unchanged.
CCR-A remains in progress; this checkpoint does not refresh unrelated historical
aggregate receipts. CCR-B: NOT-RUN — requires authorized Staging environment.
## 2026-09-25 — Device credential generation and RTC seat/Quota prerequisites
Bind signed Device access tokens to monotonic credential authority generations;
reject missing/noncanonical generations and prevent revoked/restored credentials
from reviving old JWTs or stale opaque authentication snapshots. Existing JWTs
without the generation claim require a fresh credential exchange. Migration 91
keeps only credential IDs and generations in append-only history, without secrets.
Recheck held Device Room authority in its original transaction before commit.
Add separate Device seat/initial Quota entry points with exact durable projection,
replay/expiry checks, quota-denial rollback and retained revoking capacity.
[Local evidence](../development/evidence/m1-gx03-rtc-device-generation-2026-09-25.json): Linux PostgreSQL/Redis
race 1034 / 0 / 0 across 55 roots; migration/static checks 46 / 0 / 0;
manifest/generated consistency, source stability and owned cleanup pass.
The isolated fixtures publish no host ports. Counts include parents/regressions.
Actual Device RTC Consent consumption, immutable connection origin and native
admission are still incomplete. P1/P5 remain NOT_QUALIFIED, full CI NOT_RUN and
new milestone credit zero. Cloud: NOT-RUN — requires authorized Staging environment.
## 2026-09-25 — Device RTC delegated Consent preparation
Add migration 90 and public Device RTC Delegation/Consent preparation using
existing identity, AppSession, Grant and Human confirmation owners. Enforce exact
Room/session/operation bindings, immutable observation/replay and revoked-root
denial. Fix multi-binding Grant/fence lock ordering with a real concurrent writer.
[Local evidence](../development/evidence/m1-gx03-rtc-delegated-consent-2026-09-25.json):
Linux PostgreSQL/Redis/upstream Room API race 653/0/0, migration static tests
40/0/0, generated schema consistency and owned cleanup pass. Retained
Human RTC tests pass. Initial failed/skip evidence is preserved. Actual Device RTC
execution, quota/native admission, P1/P5, full CI and Staging remain incomplete.
## 2026-09-25 — Device RTC prerequisites and delegated contracts
Adds a server-owned, transaction-bound Device/Room/AppSession prerequisite using
existing signed identity, original admission, Grant and Consent history owners.
Adds canonical bounded RTC create/revoke Delegation and Consent operation
bindings with generated SDK projections. This does not enable Device RTC native
admission or replace a new RTC operation's Consent with AppSession Consent.
[Local evidence](../development/evidence/m1-gx03-device-room-authority-2026-09-25.json):
PostgreSQL/Redis race 586/0/0, canonical 364/0/0, generated/native contracts
1368/0/0; Go/TS/C compilation and regeneration pass. Counts include parents and
retained regressions. A C++ test now explicitly selects its source language;
strict warnings and C ABI tests remain. Initial failures are archived.
Full CI, complete Device RTC and P1/P5 remain incomplete; Staging is NOT-RUN.
## 2026-09-25 — Actual native refresh and independent scope isolation
Adds direct-client tests for actual LiveKit refresh material, original/refreshed
token rejection after Grant withdrawal, same-project cross-environment isolation
and same-environment cross-Room isolation. Shared fixture helpers reuse existing
identity, Consent and Room-worker initialization; no production code changes.
[Local evidence](../development/evidence/m1-gx03-native-refresh-isolation-2026-09-25.json)
passes 31/0/0 across five roots, including retained actual ICE recovery, with
no drift and confirmed owned cleanup. Counts include parents/subtests.
Test/client race instrumentation does not imply the reused static native ELF is
race-instrumented. P1/P5, active-session removal, media and Device/Agent remain
incomplete; public Rate/Usage sinks are substitutes. Full CI is NOT_RUN and cloud
is NOT-RUN — requires authorized Staging environment. Earlier entries are historical.
## 2026-09-25 — Native client recovery and callback lifetime
Fixes retained Room/Participant callbacks inheriting an ended request context,
preserving 500 ms persistence budgets, generation fencing and cancellable
admission. The 29-file policy reconstructs with real Wire; Linux build passes.
Service race tests pass **178/0/0 (32 roots)**, host **73/0/0 (13 roots)** and
actual-client tests **25/0/0 (3 roots)** including 22 negative subcases, with
source stability and owned cleanup. Counts include parents/subtests and overlap.
Public Go SDK 2.18.1 APIs prove ICE/ACTIVE state, actual signal-loss recovery with
the same SID, full reconnect with a new SID and revoked unexpired-material denial.
Adversarial coverage adds source-list claims and a valid admission after the
negative sequence. [Evidence](../development/evidence/m1-gx03-native-client-recovery-2026-09-25.json)
retains first-run ACTIVE-readback failure and the next helper-classification
failure; coarse wire refusals require durable/no-insertion/positive controls.
Distinct-scope pairs are not the independent Project/Environment/Room matrix.
Refresh-token replay and media delivery remain NOT_RUN; public Rate/Usage sinks
are substitutes. **P1/P5 NOT_QUALIFIED**, full CI **NOT_RUN**, zero milestone
credit, public traffic disabled; cloud
**NOT-RUN — requires authorized Staging environment**. Earlier entries are historical.
## 2026-09-25 — Managed Room and actual native host signalling
The existing authenticated management path now prepares protected Rooms without
granting Human admission authority. The 28-file policy series and real Wire
generation reproduce the tested source exactly. Local race tests pass
**172/0/0 (30 service roots)** and **73/0/0 (13 host roots)**; Linux build and
owned cleanup pass. Actual host/PostgreSQL/private TLS/direct WebSocket signalling
passes **1/0/0 (1 root)**: join/readback, checked resume preserving SID, full
reconnect with a new SID, unexpired-token denial after Grant withdrawal without
new allow audit, and anonymous denial. Counts include parents/subtests and overlap.
The [archive](../development/evidence/m1-gx03-native-managed-host-2026-09-25.json)
retains compile/cache failures, old host join HTTP 500 and the incorrect pre-ICE
resume expectation. The passing resume keeps the old signalling source live;
no ICE/media or real network-loss recovery is qualified. Public Rate/Usage sinks
remain substitutes. **P1/P5 NOT_QUALIFIED**, full CI **NOT_RUN**, no milestone
credit, public traffic disabled; cloud
**NOT-RUN — requires authorized Staging environment**. Earlier entries retain
their historical scope.
## 2026-09-25 — Native Room generation fencing
The current GX03 increment fences ordinary/protected Room callbacks by exact
instance, shared SID/node and serialized state. Participant callbacks are
update-only; deleted children cannot be resurrected. Closed local Rooms remain
tombstones until shared cleanup is confirmed. Real Redis cleanup checks the exact
multi-key command ACL before any mutation. Existing management authority and
native media/reconnect engines are preserved.
Actual affected Linux race results: service **148/0/0 (25 roots)** and rebuilt
host **73/0/0 (13 roots)**, with owned cleanup PASS. Counts include parents and
subtests; the 7 local and 15 Redis fence events are included in 148, not added.
Pinned-source extraction, formal patch application and real Wire generation
reproduce the tested native/protocol bytes; Linux host compilation passes.
The first ACL-fixture failure is retained, and corrected fixtures prove their
actual Redis identity and ACL denial response. See [current evidence](../development/evidence/m1-gx03-native-room-fence-2026-09-25.json) and [state ownership and limits](../development/RTC_NATIVE_ROOM_GENERATION_FENCE.md).
This closes the identified local generation-fencing gap only. Native P1/P5 and
real host/PostgreSQL/direct-client admission remain NOT_QUALIFIED; full local CI
is NOT_RUN, G_PRE is NOT_READY, and this increment earns no GX03 milestone credit.
CCR-B: **NOT-RUN — requires authorized Staging environment**.
Earlier sections retain their historical scope and evidence.
## 2026-09-25 — Native host and locked session boundaries
Adds the Platform-owned LiveKit host, pinned source/patch preparation tools and
minimal native admission hooks for protected allocator, manager, Room and resume
transitions. Existing Platform identity and private admission remain authority;
Human admission cannot authorize automatic Agent/Egress execution. Real Wire
generation and a bounded Linux host build pass. Separate local race scopes pass
**126/0/0 (19 roots)**, **52/0/0 (23 roots)** and **73/0/0 (13 roots)**, including
an owned real Redis allocator case; counts include parent/subtest events.
The [original archive](../development/evidence/m1-gx03-native-lock-session-2026-09-25.json)
retains its historical 62-event host result. The
[signing-policy archive](../development/evidence/m1-gx03-native-signing-2026-09-25.json)
supersedes only host tests/build; unchanged service and Room native/root Go
inputs reuse their previous results without rerunning. Removes default
`devkey`/`secret`, requires every effective signing secret (including key-file
overrides) to be at least 32 bytes, and rejects native development mode in
Staging/Production before database access. Five actual CLI rejection cases
observe zero database connections; host source stability and cleanup pass.
Cross-generation cleanup fencing is under repair. **P1/P5 NOT_QUALIFIED**,
public traffic disabled, no new progress credit, full CI **NOT_RUN** and cloud
capacity validation **NOT-RUN — requires authorized Staging environment**.
See [host boundaries](../../cmd/livekit-server/README.md).
## 2026-09-25 — Restricted native database startup
SQL formatting follow-up: removed only the extra terminal blank lines in migration
89 and its owned withdrawal fixture, regenerated immutable digests, and reran the
same 12-suite scope: **113/0/0, cleanup PASS**. The original role receipt remains
historical. No milestone, full-CI or cloud credit is added.
Adds forward migration 89 and mandatory restricted-LOGIN startup validation for
the native admission backend. Exact column privileges cover 11 application
tables plus three migration-ledger columns. Catalog and existing exact-schema
checks share two seconds; per-admission work remains bounded to 500 ms.
The unchanged schema verifier moves to a leaf package to avoid a test import
cycle, preserving the existing migration API. Local race-enabled validation
passes **113/0/0**, 12 required suites, cleanup PASS; two earlier failures remain
archived. This startup snapshot does not continuously attest owner-controlled
database state. Native host/StartSession/P1/P5 remain unfinished. Current bound
progress is 2.8%; aggregate CCR/progress and existing E6 checks remain FAIL,
full CI is NOT_RUN and cloud capacity validation requires authorized Staging.
See [scope and evidence](../development/RTC_PRIVATE_ADMISSION_CLIENT.md).
## 2026-09-25 — Native Human admission backend
Composes shared-cluster native-pair routing with the existing durable Service
issuer and private HTTPS client. The read-only route transaction ends before
issuance; one 500 ms budget bounds pool waits and cleanup. No cached allow,
Service fallback or sent-request replay is added; existing bounded identity
transaction retries remain. Focused race-enabled validation passes **70/0/0**,
cleanup PASS. Native host/StartSession and database-role guard remain pending;
P1/P5 and full CI are not qualified, progress receives no new credit.
See [scope and evidence](../development/RTC_PRIVATE_ADMISSION_CLIENT.md#native-backend-composition-increment--2026-09-25).
## 2026-09-25 — Private Human admission client
Adds fresh Service-token issuance and strict private Human admission calls,
with no sent-request replay, independent scope/expiry checks and a 500 ms
absolute budget through per-call TCP/HTTP/2 cleanup. Local race-enabled unit
and actual PostgreSQL/TLS composition pass **72/0/0**, cleanup PASS. Native
backend/StartSession integration and P1/P5 remain unfinished. Last sealed
progress stays 10.0%; shared-source regression awaits the combined checkpoint.
Global E6 remains FAIL; final local CI, hardware and cloud acceptance remain
NOT_RUN. See [implementation and evidence](../development/RTC_PRIVATE_ADMISSION_CLIENT.md).
## 2026-09-25 — Private Human and Service RTC admission
The additional Scope/public-control and bootstrap startup regression passes
20/0/0 with owned PostgreSQL cleanup. Historical Data Sync receipts are kept
byte-exact; the reviewed optional private receiver mount needs separate current
source and actual case validation. This does not qualify full StartRuntime
assembly. The final checker also exposes a preexisting E6 Usage-spec evidence
mismatch, assigned to existing GX10.usage; global acceptance remains FAIL.
Adds the private HTTPS receiver and transactional SQL owner for original Human
connection admission. Exact native routing, independent current Service Grant,
original Human authority, final rechecks and actor audit must commit before a
short-lived decision is returned. Existing Service authentication and the
Control API TLS listener are reused; strict configuration explicitly disables
or completely configures the receiver.
Local focused validation passes 283/0/0 after preserving and fixing the first
262/4/0 attempt. Native caller/StartSession/P1 enforcement, Device/Agent
admission and effective revocation remain incomplete. The ledger stays 10.0%,
G_PRE NOT_READY. Affected regressions are archived; the interrupted Task/RTC
harness attempt remains a failure, followed by its single passing timeout retry. Work
stays on the local feature without push, merge or GitHub Actions. CCR-B remains
**NOT-RUN — requires authorized Staging environment**.
See [implementation and evidence](../development/RTC_NATIVE_HUMAN_ADMISSION.md).
## 2026-09-25 — Exact native RTC connection mapping
Native Room/identity routing now selects only the exact current Human connection in its configured cluster. It is non-authorizing and composes with durable original authority and final transaction rechecks. Race-enabled SQL tests cover positive paths, invalid pairs, lifecycle/generation drift and withdrawn authority; native admission enforcement remains open.
## 2026-09-25 — Original RTC connection authority
Connection issuance now records immutable original identity, Room Grant revision,
Consent receipt and authority lifetime. Restored identity mappings or Consent
policies cannot revive old connection material; the existing Grant timeline also
retains effective Room denials after they are revoked or expire. Current original
authority is rechecked during sensitive replay and before atomic commit. This is
a local prerequisite for GX03 native admission enforcement, which remains open.
Migration metadata revalidation now binds unchanged historical Data Sync
receipts to exact cases in current local regression logs, retaining failures and
rejecting missing coverage or stale sources.
## 2026-09-25 — Local Task WSS and RTC regression
Existing Task PCM/ACK/replay and Task/Usage now have a reproducible local TLS-verified regression during RTC audio and after publisher leave. The Device conformance version lock is regenerated, process failure cleanup is bounded, and real negative TLS cases are checked. This is early separate-namespace local evidence; native server enforcement, same-tenant composition and cloud qualification remain open.
## 2026-09-25 — JavaScript RTC receiving facade
The public OneSay audio session now replaces an exact server-authorized subscription set, enables playback from a user gesture, and releases local resources on expiry, cancellation, reconnect or close. Independent packaged OneSay publisher/receiver browsers pass known-audio decoding, mute/unmute, fresh-authority full reconnect and leave cleanup. This is isolated local media evidence; final native enforcement and deployed metering remain incomplete.
## 2026-09-25 — Current RTC subscriber authority
The isolated owning subscription service now authorizes independent receivers, exact selected publications and original publisher authority through current server-side Grant, Consent and quota. Policy versions, audit and protected responses commit atomically; revoked or superseded material cannot be replayed. Public native enforcement and complete media acceptance remain separate incomplete gates.
## 2026-09-25 — Original RTC publisher authority
Publication creation records its original identity, Grant and Consent bindings and a durable Source withdrawal generation. Current authority is required again for protected replay; restored permissions cannot silently revive old material. No subscription or native permission completion is implied.
## 2026-09-25 — Durable RTC subscription policy storage
Adds forward migration 85, immutable bounded subscription versions, exact generation targets, CAS, private mappings and separate trusted-observation storage. Shared lifecycle fencing prevents stale snapshot writes. This private prerequisite does not enable subscription authorization or native enforcement.
## 2026-09-25 — RTC subscription upper-bound contract
Adds the draft canonical subscription update Action, exact bounded publication
selectors, version and observed-effect separation, generated contracts and
protected HTTP/ESP32 Control transport boundaries. Runtime subscription
authority and native policy are not enabled. Existing Platform SDK and OS/OEM
hardware ownership remains unchanged.
## 2026-09-25 — JavaScript RTC microphone lifecycle
The draft OneSay session adds Source-bound microphone publication, mute/unmute
and local-first end cleanup through internal LiveKit reuse. Public types stay
independent of native objects. Validation is an isolated local experiment; full
OneSay media and native server policy qualification remain open.
## 2026-09-25 — RTC publication execution
Local publication creation and ending now compose current server permissions,
Consent, held connection quota and atomic protected replay. Ending records a stop
request without claiming media has stopped. Public deployment remains disabled
until native enforcement and SDK media qualification are complete.
## 2026-09-25 — RTC publication confirmation
Publication creation and ending now use the existing durable Consent flow with
original resource/session bindings and current server permissions on every
read, decision and replay. A confirmation cannot itself start or stop native
media. Public publication execution remains under development.
## 2026-09-25 — RTC publication API contracts
Define canonical RTC publication create/end inputs and responses with exact
resource binding and honest requested-versus-observed stop state. Extend the
ESP32 Control client to nested Room/publication resource paths. Both APIs remain
disabled pending their owning authority/Consent/quota service and native policy.
## 2026-09-25 — RTC publication end prerequisite
Add the internal authorized desired-stop transaction for owned RTC publications.
Repeated stops preserve original request history; media remains pending/active
until actual termination is confirmed. Current server permissions still apply
after Source withdrawal or prepare expiry. Public publication APIs remain under
development.
## 2026-09-25 — RTC publication preparation
Add an internal durable RTC audio publication intent using existing Source,
SignalPublication and SignalStream resources. Bound concurrent preparation,
preserve immutable resource generations and keep unknown capture timing explicit.
Closing a Room requests native RTC stop; it does not report effective media end
until confirmed. Public media publication remains under development.
## 2026-09-25 — ESP32 SDK integration responsibility
Clarify that OneSay ESP32 SDK supports independent OEM integration without
OneSay OS. Platform validates its complete SDK, component delivery and media
port contract; OS/OEM validate concrete boards, drivers, tuning and hardware
quality. Reference conformance and optional real-device portability evidence
remain separately labeled. Existing SDK functionality is unchanged.
## 2026-09-25 — RTC Source authority prerequisite
Add an internal current Source and connection-generation check for RTC
publication preparation. It requires the same signed identity, original
AppSession and current server permissions, including checks after database
waits. This does not enable media publication yet; the public local candidate
continues to issue join-only connections.
## 2026-09-25 — Installed JavaScript RTC candidate validation
Validate the RTC connection lifecycle from an independently installed OneSay
package in a real local browser against Control API, PostgreSQL and LiveKit.
SDK and transitive dependency bytes are verified against the package and pinned
lock. This remains a private local candidate; full media, native policy and
release qualification remain open.
## 2026-09-24 — JavaScript RTC connection lifecycle
Add OneSayClient.rtc.connect/get/revoke and session refresh/close using existing
OneSay authentication and server admission. Sessions expose scoped OneSay
resources and observed capabilities; native objects and connection tokens remain
internal. Close disconnects locally before requesting revocation, preserves its
retry key and reports pending server revocation accurately. Initial local
validation supports join-only connections; media and continuous native policy
remain under development. This is not a published SDK or cloud release.
## 2026-09-24 — Neutral Room and separate task/RTC operations
Remove the unpublished Room service selector from creation and resource
contracts. Task voice and RTC keep separate operations and connections within
the same Room. Their admissions share the Room capacity limit; RTC accounting
counts only RTC connections. A forward migration retains existing Rooms, Tasks,
Participants and runtime bindings. The old selector is rejected rather than
retained as an alias. SDK composition and native policy remain in progress.
## 2026-09-24 — Initial RTC connection runtime under local validation
Compose connection create/query/revoke with current identity and confirmation,
atomic capacity/quota reservations and protected retries. Management queries
return no connection credentials; pending revocation keeps its reserved capacity.
The implementation is restricted to local validation while native policy and
SDK integration continue. Local Windows RTC tests now execute from stable paths
to reduce repeated firewall prompts without changing system permissions.
## 2026-09-24 — RTC connection confirmation authority
RTC connection create/revoke confirmation now uses the existing Consent
service and current server permissions. Original session ownership survives
confirmation-content erasure; old confirmations cannot replace current access.
The public RTC connection API and SDK remain under implementation.
## 2026-09-24 — RTC connection contracts and capacity reservations
Add connection create/read/revoke contracts and durable internal reservations.
Concurrent requests cannot exceed the Room seat limit; reconnects retain one
seat per current AppSession generation. Requested revocation is distinct from
effective revocation. The public API and SDK implementation remain in progress.
Server authority applies equally to compatible third-party clients; hiding
native SDK objects is a product boundary, not a security mechanism.
## 2026-09-24 — Internal RTC session authorization
RTC admission preparation now reuses current AppSession authority and checks
current Room join permission within one database transaction. Revoked, expired or
wrong-client sessions cannot authorize this preparation. Existing Data Sync
permissions are preserved. The public RTC connection API and SDK remain under
implementation; this change does not enable RTC service or cloud deployment.
## 2026-09-24 — Durable internal RTC Room lifecycle
RTC Room preparation now has persistent retry and stale-worker protection.
Closing a Room records native cleanup in the same database transaction; native
completion requires readback. Existing task Room behavior is retained. Public
RTC admission and the OneSay SDK facade remain under implementation, and this
internal change does not enable cloud deployment.
## 2026-09-24 — Internal native RTC compatibility
The existing JavaScript SDK package now carries an exact internal LiveKit client
dependency. Local engineering tests exercise native Room APIs and decoded audio
between independent browser contexts. The public OneSay RTC facade, current
authorization bridge and reconnect remain under implementation; this change
does not expose RTC service or qualify cloud deployment. Existing task APIs remain.
## 2026-09-24 — ContextSnapshot durable value bound
Added a forward PostgreSQL constraint for the existing 4096-byte context value
limit. Invalid historical content blocks migration without rewriting it;
valid snapshots retain their content and immutable behavior. Explicit context
create/read and privacy classification remain incomplete. Snapshot storage
regression also fixes repeated RLS scope scans at maximum namespace size;
the 20-second build budget and authorization checks remain.
## 2026-09-24 — Dual voice implementation foundation
Adopted the Owner's complete task-voice/RTC/two-SDK precloud scope and local-only CI
policy. Added a checked, complexity-weighted execution ledger, owned PostgreSQL/Redis
baseline tests, pinned official LiveKit sources/image and executable isolated Server
readiness. This release does not yet expose OneSay RTC operations or qualify media,
Agents, hardware, real providers or cloud deployment. Existing task and Data Sync APIs
are preserved; their historical evidence is not reset or promoted to cloud acceptance.
# Changelog
## Data Sync W08 TypeScript SDK and reference Runtime — 2026-09-24
Added generated strict TypeScript Data Sync protocol types, a bounded
Host-transport client, an instance-scoped Sync Runtime, explicit
Storage/Projection ports and a durable file-journal reference backend. Local
qualification covers atomic History/intent persistence, torn-tail recovery,
byte-identical unknown-result retry, pull/cursor rollback, snapshot staging,
bounded Outbox and storage exhaustion, identity fencing and inert rich-text/URL
data. Priority delete intent and explicit conflict resolution use Host ports
without inventing public routes. The JavaScript package remains
byte-reproducible, and all four repository-local W08 units are complete. Public
data-plane HTTP composition remains in W04/W06/W09; Desktop encryption and
Staging remain open. CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync W07 fleet backlog and alert acceptance — 2026-09-24
Added a fixed, content-free PostgreSQL observation for all six durable Data
Sync worker kinds and exposed it through the existing GC supervisor's private
backlog command. The observer has a 400 ms read deadline, a 10,001 lower-bound
cap and no scheduling authority; alerts derive only from age or durable stall
facts. Actual PostgreSQL 17.6, upgrade and combined Go race qualification pass
with owned cleanup. W07 repository-local acceptance is 4/4 (100%). Deployed
multi-replica capacity remains
`NOT-RUN — requires authorized Staging environment`.
## Data Sync backup-retention completion gate — 2026-09-24
Added migration 69, a durable backup-inventory evidence projection and the
least-privilege `onesay_sync_backup_retention` role. Online purge now enters a
durable pending state atomically; the ordinary privacy worker cannot assert
backup expiry. Completion requires source-bound evidence that the earliest
retained restore point is strictly newer than the purge boundary. Real
PostgreSQL 17.6 race, fresh-schema and v68 upgrade tests pass. Actual Aliyun
backup readback and OSS Writer/Recovery/provider qualification remain
`NOT-RUN — requires authorized Staging environment`, so W05 stays 5/6 (83%).
## Data Sync public Scope control runtime candidate — 2026-09-24
Implemented the canonical `enableDataSyncScope` and
`disableDataSyncScopeRetainingData` Control API paths as a local runtime
candidate. The handlers reuse the generated Action parser, current signed
Human/AppSession/Grant/Consent authority, the existing versioned Scope
activation/deactivation participants, atomic transport idempotency and
semantic replay validation. Real PostgreSQL 17.6 tests cover cross-server
replay, malformed original wire input, stale Scope results, Grant revocation,
retained-data disable and the constrained `onesay_sync_control` role. W05
remains 5/6 (83%): backup-retention completion and independent OSS
Writer/Recovery/provider qualification remain open. The canonical OpenAPI
keeps `x-onesay-runtime-implemented: false` until authorized Staging
deployment and verification; CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync `scope.disable_retain` control participant — 2026-09-24
Added migration 68 and a restricted, Consent-bound PostgreSQL control
participant for non-erasing Scope disable. It advances participation,
epoch/control/privacy barriers atomically while retaining records, ciphertext,
keys, quota and stream history. Real PostgreSQL 17.6 race and migration tests
cover rollback, stale/duplicate intent, least privilege, commit binding and
explicit re-enable preservation. W05 remains 5/6 (83%); the public Scope
control runtime, backup retention and independent OSS Writer/Recovery/provider
qualification remain open. CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync exact `record.delete` privacy barrier — 2026-09-24
Added migration 67 and an exact-key reservation, Apply, Finalize and purge path
for `record.delete`. Pending targets are blocked from ordinary writes and
redacted from Change Reader/snapshot publication while the Scope remains live.
Real PostgreSQL 17.6 race and migration suites prove known/unknown key handling,
atomic quota and stream updates, exact ciphertext purge and preservation of an
unrelated record. W05 remains 5/6 (83%); migration 68 later closes the local
`scope.disable_retain` primitive. Public Scope control, backup retention and
independent OSS Writer/Recovery/provider qualification remain open. CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync bounded online privacy purge — 2026-09-24
Added the durable `LEDGER_CONFIRMED` to `ONLINE_PURGED` worker stage for Scope
clear and disable-purge. Bounded PostgreSQL batches terminate stale snapshots,
remove pins, purge online ciphertext and tombstone old identities without
selecting ciphertext or touching a new epoch. Real PostgreSQL 17.6 race and
migration suites prove expired-lease recovery, multi-batch completion and
new-epoch isolation. W05 advances to 5/6 (83%). Migration 67 later closes exact
`record.delete`; independent OSS fencing, provider qualification, backup
retention and `scope.disable_retain` remain open. CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync durable privacy stage worker — 2026-09-23
Added PostgreSQL-owned scheduling and a bounded dispatcher for separately
committed Ledger Prepare, atomic main-store Apply and Ledger Finalize stages.
Monotonic claim fences, durable retry deadlines and immutable Apply-outbox
confirmation data remove process-local completion authority. Actual PostgreSQL
17.6 tests cover retry/reclaim and the three-cycle orchestration path. Actual
OSS writer/recovery fencing, provider behavior and online payload purge remain
unqualified; CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync atomic main-store privacy Apply — 2026-09-23
Added a restricted, bounded PostgreSQL Apply transaction for `scope.clear` and
`scope.disable_purge`. It atomically advances the durable privacy barrier and
Scope epoch/control state, releases active quota, records the cutoff Change and
persists notification and immutable Finalize facts. Real PostgreSQL race and
migration tests cover commit isolation, idempotent/concurrent Apply, durable
alignment and least privilege. This advances W05 to 4/6 (67%); independent
Ledger provider/fencing, Finalize confirmation, physical purge, Staging,
Desktop and Production remain unqualified. CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync final snapshot response fence — 2026-09-23
Added the restricted data-read authority role and private snapshot publication
composition. It decrypts and encodes before a short final transaction, then
rechecks current AppSession/Grant/Consent and exact durable data authority;
failed checks release no body, while a committed response is marked `no-store`.
Real PostgreSQL race/migration tests cover concurrent Replica, privacy and Grant
changes. The complete local CI gate passes 5,008 Node tests with two existing
platform skips, 22 Python tests, complete Go/vet, generated compilation, OSV
and Redis-loss proof. Fresh WSL2 Gecko/WebKit Console regression against owned
PostgreSQL 17.6 also passes; native browser TLS remains `NOT_EXECUTED`. The
Canonical Registry has no public Snapshot route, so public API,
real KMS, Staging, Desktop and Production remain unqualified; CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync canonical snapshot page — 2026-09-23
Added a closed canonical snapshot response, exact signed continuation binding,
bounded plaintext page construction and original-record-AAD AES-GCM open. The
private PostgreSQL read paths now also carry the current Scope Consent receipt
ID for the eventual final authority fence. Focused race/wire tests and a real
local PostgreSQL writer-to-reader composition pass. Public route authorization,
real KMS, Staging, Desktop and Production remain unqualified; CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Migration provenance reconciliation — 2026-09-23
The bounded local CI gate detected that the recorded migration 61 SHA-256 no
longer matched the committed SQL bytes. The manifest was corrected to the
actual migration, generated embed/schema artifacts were regenerated, and all
source-bound Data Sync receipts were refreshed. This is provenance repair for
the existing migration, not a new schema or cloud mutation.
## Data Sync private snapshot completion storage — 2026-09-23
Added migration 62 and a dedicated forced-RLS `CompleteSnapshot` storage
participant. It binds every durable READY manifest axis, atomically commits
the terminal status with GC-pin removal, and supports exact terminal replay;
real PostgreSQL 17.6/race and migration suites pass with owned cleanup. This
is local CCR-A evidence only. Public API/canonical authority, Staging,
Desktop, cloud and Production acceptance remain unqualified; CCR-B is
`NOT-RUN — requires authorized Staging environment`.
## Data Sync notification metrics host readback — 2026-09-23
The private notification process now retains its bounded Dispatcher counters
and publishes a fixed, content-free `notification` snapshot through the
existing workerhost metrics pipe. Local host/race/vet checks pass. This adds
CCR-A process observability only; PostgreSQL remains the durable queue and
lease authority, and W07, Staging and Production acceptance remain open.
## Data Sync privacy reservation lineage binding — 2026-09-23
The durable privacy reservation adapter now compares Environment,
ProjectEnvironment, Application and Owner against the canonical Namespace
lineage while the Scope row is locked, before inserting the immutable operation
and raising the Scope fence. A real PostgreSQL regression rejects forged context and retains
the least-privilege privacy role; the existing target/fence and immutable-row
checks remain covered. Main-store Apply, Worker Finalize, Staging and
Production remain unqualified.
## Data Sync privacy lifecycle primitive — 2026-09-23
Added a local, fence-bound `PrivacyOperation` state machine for the accepted
Prepare → Apply → Finalize flow. It rejects target expansion and stage skips,
keeps privacy safety facts separate, supports exact terminal replay, and
serializes concurrent local readers/transitions, and adds a strict
snapshot/restore projection for future durable adapters. Main store,
independent Ledger, Worker, Staging and Production integration remain
unqualified.
## Current local CI and Mock Device delivery evidence — 2026-09-23
Recorded the current `main` Mock Device protocol delivery manifest/receipt and
the bounded local `ci:local` receipt. The local lane completed 5,004 Node tests
with 5,002 passes and two explicit platform skips, 22 Python tests, 104 Go
packages, generated compilation and Redis-loss proof. This is development
evidence only; E11, CCR-B, Staging, Desktop, Production and publication remain
unqualified.
## Data Sync local boundary fencing — 2026-09-23
Closed three local Data Sync boundary gaps: StateBinding selectors are checked
against owner payload bindings before private page and durable operations,
notification quota arithmetic fails closed at signed 64-bit limits, and
snapshot retirement discovery rejects duplicate or stale keyset hints. The
builder token guard also rejects the all-zero UUID. Focused PostgreSQL/race,
Go vet and full bounded local CI evidence pass; CCR-B remains
`NOT-RUN — requires authorized Staging environment`.
## E9 current-source evidence binding refresh — 2026-09-22
Refreshed existing E9 manual/Console evidence bindings to the current source
digests after local CI detected documentation drift. The targeted binding suite
passes; no new browser or deployment acceptance is claimed.
## Data Sync explicit notification host composition — 2026-09-22
Added the private `cmd/data-sync-notification` process entry. It composes the
restricted PostgreSQL lease worker, bounded dispatcher and environment-bound
HTTPS sender only from an explicit pipe configuration; there is no default
external endpoint. Local configuration and package tests pass. A process-boundary
regression also proves invalid private-pipe configuration fails before database
startup. Staging and Production delivery remain unqualified.
Added local W11 guard coverage for notification counter saturation and fixed
batch-budget rejection; no durable queue or cloud capacity result is claimed.
The guard coverage now also rejects duplicate/foreign discovery and preserves
bounded storage failure observability before claim.
## M1 local-first CI qualification policy — 2026-09-22
Adopted a cost-controlled M1 development loop: complete bounded local
`ci:local` is the hard iteration gate, while GitHub Actions is deferred until
the final integrated M1 candidate. Merge still requires the complete hosted
Linux, Windows, browser and native matrix to finish green. Documented the
self-hosted runner baseline, explicit non-pass states and the current PR #241
cancelled run; no hosted qualification is inferred.
## Data Sync bounded HTTPS notification sender — 2026-09-22
Added a concrete, content-free HTTPS sender for the existing notification
dispatcher port. It enforces environment transport boundaries, disables
redirects, bounds response inspection and fails closed on malformed or
non-success delivery responses. Local race/TLS tests pass; no default host,
external recipient or Staging/Production delivery is claimed.
## Data Sync private READY storage guard — 2026-09-20
The deferred snapshot READY constraint now locks and rechecks current
Namespace, Scope, Replica and Stream state and refuses an expired builder.
Local PostgreSQL race and migration tests cover stale-view rollback; canonical
authorization, public snapshots and Staging capacity remain pending.
## Data Sync private snapshot retirement worker — 2026-09-20
Added a bounded Task Worker cleanup cycle over restricted PostgreSQL
discovery and retirement. Local race and real PostgreSQL tests pass; deployed
host wiring and Staging capacity remain pending. Stabilized the unrelated
Python invalid-close test fixture deadline on loaded Windows CI runners.
## Data Sync private snapshot retirement discovery — 2026-09-20
Added restricted, environment-bound due-snapshot discovery with a 32-hint
limit and stable cursor. Local PostgreSQL race and migration tests pass;
operational scheduling, public completion and Staging capacity remain pending.
## Data Sync bounded private snapshot retirement — 2026-09-20
Added a restricted PostgreSQL role and restartable fixed-expiry cleanup that
releases expired pins and deletes at most 32 encrypted items per transaction.
Local PostgreSQL race and upgrade tests pass; public complete and Staging
capacity remain pending.
## Data Sync private encrypted snapshot page — 2026-09-20
Added a restricted read-only PostgreSQL role and bounded READY/pin page reader
that returns ciphertext only. Local PostgreSQL race and migration tests pass;
current public authority, decryption and Staging capacity remain pending.
## Data Sync private snapshot manifest binding — 2026-09-20
The private materialization result now carries the Scope control version and
binds it, Collection and Replica to the encrypted manifest digest. An actual
PostgreSQL regression proves a control-only revision changes that digest.
Public READY publication and Staging capacity remain pending.
## Data Sync snapshot race regression — 2026-09-20
Added isolated PostgreSQL interleaving tests for a concurrent write during
MVCC materialization and GC advancing before a READY pin commits. Both reject
mixed baselines or a stale READY manifest; public snapshot publication and
Staging capacity remain pending.
## Data Sync private snapshot materialization — 2026-09-20
Added a bounded PostgreSQL REPEATABLE READ primitive that copies encrypted
current records and hashes their fixed ordinal manifest in one view. It leaves
the session BUILDING; current authority, READY publication, paging and cloud
capacity remain pending.
## Data Sync snapshot storage model — 2026-09-20
Added bounded durable snapshot sessions, encrypted ordinal items and GC pins
that protect a READY baseline across processes, including against premature
builder completion. Local PostgreSQL/Go race and
migration tests pass; public snapshot creation, paging and Staging capacity
remain pending.
## Data Sync private incremental storage scan — 2026-09-20
Added a restricted, bounded PostgreSQL reader for committed encrypted Changes
with exact owner/Scope isolation, durable resume bounds and body-free privacy
redaction. Local storage tests pass; public read responses and cloud capacity
remain unqualified.
## Data Sync cross-process write admission — 2026-09-20
The private Writer now holds a PostgreSQL session permit across preparation
and commit, enforcing at most two in-flight batches per Namespace across
processes. Bounded pool and overload checks fail before Seal or business
effects. Real local PostgreSQL process-loss and writer tests pass; public API
and Staging capacity remain unqualified.
## Data Sync notification dead-letter maintenance — 2026-09-20
Added private, bounded, environment-bound dead-letter listing and restricted
server-time seven-day retirement to the existing notification outbox. Expiry
releases quota without claiming delivery; local PostgreSQL role, race and
upgrade tests pass. Other Worker job kinds and cloud validation remain open.
## Data Sync restartable notification dispatch — 2026-09-20
Added a restricted, bounded database discovery function and a private
two-concurrent-send notification dispatcher on the existing durable lease.
Local PostgreSQL tests cover cross-replica claim, retry and deadline ACK safety.
No default delivery transport, other job kind or cloud acceptance is implied.
## Data Sync private notification lease storage — 2026-09-20
Reused the existing content-free outbox with a restricted PostgreSQL Worker
role, durable revision-scoped lease/fence, bounded retries and conditional
acknowledgement. Local PostgreSQL concurrency and upgrade tests pass. Public
Data Sync, other Worker job kinds and cloud capacity remain incomplete.
## Planned Scope Action catalog qualification — 2026-09-20
Catalog regression now recognizes the two canonical Data Sync Scope Actions
and verifies their `planned` status. Full local Go, Python, Node and generated
consumer checks have passed; public Scope execution and cloud acceptance are
still pending.
## Current-source Data Sync storage evidence — 2026-09-20
Local schema-48 PostgreSQL storage and upgrade regression, domain/adapter race
tests, page wire checks and CCR evidence were rerun and rebound to current
sources. The E10 optional error outlet also passed its 11 focused local tests
with actual loopback. Public Data Sync execution, cloud capacity, Desktop and
Production remain unqualified.
## Local evidence refresh for current Data Sync candidate — 2026-09-20
The deterministic Portal export, owned PostgreSQL Gecko/WebKit Console session,
Device conformance bundle, and isolated OS-PLATFORM-0009 fixture were rerun for
the current canonical spec. Historical OS readback remains intact; a new current
compatibility readback and governed fixture bind this source. The full Node
regression still fails on stale source-bound evidence and missing public Scope
handler bindings, so this does not qualify Staging or the complete M1 release.
## Data Sync private Scope activation — 2026-09-20
Applied enable facts now commit with exact Consent/session/Scope state and audit
under a restricted SQL role. Shared session checks allow parallel requests while
retaining close/revoke fences; independent Collections avoid a Namespace mutex.
Local SQL, isolation, rollback and upgrade regression pass. Public Scope execution,
business idempotency, adapter health and complete Data Sync qualification remain
in progress; Staging, Desktop and Production are not validated by these results.
## Data Sync Scope Consent integration — 2026-09-20
Scope confirmation now reuses Consent creation, explicit decisions, reads and
cross-server replay with current authority. Original session identity survives
content erasure; preparation contexts remain valid through atomic completion
while explicit cancellation still rolls back. Local PostgreSQL regression and
upgrade tests pass. Scope business execution and full Sync qualification remain
incomplete; no default public Scope runtime or cloud acceptance is enabled.
## Data Sync Scope authority preparation — 2026-09-19
Scope confirmation preparation now composes signed User session/Grant authority,
current Consent Policy and locked metadata. Decision fences precede Scope locks;
final checks preserve original expiry and SQL retry causes. Actual local Consent
storage flows pass; public Scope control and business mutation remain incomplete.
## Data Sync Scope control observation — 2026-09-19
A restricted metadata reader now supports exact or absent Scope baselines in
bounded transactions, without creating data or exposing payloads/keys. Local
PostgreSQL checks cover isolation, stale state, deadlines and privilege drift.
Current authority composition and public control mutations remain unavailable.
## Data Sync Scope Consent storage — 2026-09-19
A forward migration adds the two Scope control Actions to existing Consent
storage, with direct Human Application-profile checks and preserved history.
Actual local PostgreSQL upgrade and existing Consent regression pass. Scope
business execution and current full authority remain unavailable.
## Data Sync Scope control contract — 2026-09-19
Explicit enable/import choice and disable-retain now have canonical Actions,
Consent inputs and unpublished public API projections. Cross-language consumers
reject inconsistent lifecycle baselines and bind the complete control intent.
Targeted contract conformance passes; complete package qualification remains open.
Collection names now have one strict validator across registration, encryption,
cursors and recovery. Scope Consent create/pending presentation fixtures cover
the generated Console client; these unit checks do not qualify cloud runtime. The AppSession deadline fixture now proves
transaction lock release independently of a closed driver connection; repeated
maximum-length registration fixtures remain unique. Real local SQL regression
passes. Current SQL authority and public business
runtime remain incomplete; this does not qualify Staging or enable data access.
## Data Sync final transaction checks — 2026-09-19
Private writes and receipt reads now recheck retained transaction authority before
commit/result release. Final expiry rolls back; serialization retries reacquire
authority. Actual local PostgreSQL regression passes; full public Sync admission
and Staging qualification remain pending.
AppSession/Consent transaction deadlines retain the expiry error even when a
retained-context callback races the query timer; explicit cancellation from
either caller still propagates. CI evidence refreshes preserve failed runs.
## CI package-manager cache — 2026-09-19
Required CI reuses the pinned pnpm tool through a platform/version-separated
Corepack cache after an observed registry connection reset. Frozen dependency
installation and all required proof jobs remain mandatory. Warm offline startup
and cold offline rejection pass locally; hosted cache validation remains pending.
## CCR Room idempotency workload - 2026-09-19
The control-api-idempotency-replay capacity entry now verifies canonical Room
replay snapshots and changed-body conflicts instead of HTTP counts. Requests,
responses and deadlines are bounded; failures cancel peers, and execution
requires scoped Room mutation authorization. Reports keep durable effects,
replica validation and capacity acceptance explicitly unverified.
## E9 hosted binding refresh - 2026-09-18
The current manual accessibility and Console receipts are rebound to the
portal export produced by this tree (`648c0462…` for the manual export and
`ede5d217…` for the Console export). The hosted run's native-memory failure
was an Ubuntu snapshot 502/503 and remains an external qualification failure.
## Native Device relay close-boundary hardening - 2026-09-18
The native HTTP relay now waits within a bounded five-second deadline for
forwarded control sockets and fault request bodies to close before the final
receipt assertion. Existing request, mutation and failure checks remain
unchanged; a relay failure or an unresolved close still fails the proof.
## Native qualification tool diagnostics - 2026-09-18
Native source-selection qualification now reports whether a tool was missing,
timed out, denied execution, exceeded its output limit or exited unsuccessfully.
Diagnostics omit child output and executable paths. The existing five-second
probe deadline and single attempt remain in force.
## E10 bounded Redis recovery observations - 2026-09-18
The capacity runner can observe a completed Task before, during and after an
operator-managed dependency fault using the canonical Staging SDK route.
Consecutive healthy readback is bounded by request and recovery deadlines;
authorization failures stop observation. Results retain unresolved causality,
data-loss and acceptance states. The runner never changes cloud resources.
## E10 bounded durable backlog observations - 2026-09-18
Private process supervision can request Task, Usage and Trace outbox depth and
oldest pending age. Capped counts are explicit lower bounds; failed or overly
frequent samples expose no numeric data. Sampling has read-only transactions,
query deadlines and one in-flight request per process. Usage aggregate shutdown
also preserves cancellation when database/sql has already rolled back its
transaction. Ordinary business failures remain failures.
## E10 Task/Provider metrics and reliable close results - 2026-09-18
Task bootstrap can now expose bounded claim outcomes and Provider API activity
through the existing private sampler. No resource IDs, customer content or
Provider error text are retained. Completed Tasks still wait for bounded Provider
cleanup; concurrent and repeated cleanup preserves the first close result.
Unconfirmed closure remains visible instead of becoming a successful shutdown.
## E10 bounded Redis operational metrics - 2026-09-18
Control rate limiting, Realtime authority and the ephemeral transcript cache
can observe Redis client operation counts, latency and fixed outcomes without
retaining keys, payloads, addresses or error text. Control/Gateway private
samples include these observations. Missing keys and normal script-cache
fallback are separate from failures; policy denial remains a successful Redis
operation. No command, retry, TLS or authorization behavior changes.
## E10 HTTP and Realtime operational metrics - 2026-09-17
Control API now measures every handler, including authentication denial,
rate limiting and request-ID failure, with final status classes and fixed
latency bins. Realtime counts accepted active sockets, upgrade/ticket denials,
resume outcomes and protocol errors. Closed sockets leave the active gauge
before durable disconnect projection; timer and reader closure count once.
Commands expose these fixed numeric observations through the existing private
supervisor pipe. No resource labels, request content or public API are added.
Cloud collection and measured Staging capacity remain unexecuted.
## E10 private process and PostgreSQL pool metrics - 2026-09-17
The shared command host accepts an explicit metrics request on its existing
private supervisor pipe. Each fixed-schema record contains Go runtime memory,
goroutine and CPU estimates plus actual PostgreSQL pool size/use/wait counters.
Records are bounded to 4096 bytes with a one-second write deadline. Sampling
performs no database query, retains no history and exports no credentials,
content, resource IDs or arbitrary labels. Normal stop/cancellation and failed
reader cleanup are tested; actual isolated PostgreSQL contention is observed.
Full component metrics, OS RSS/CPU, dashboards and Staging remain unqualified.
## E10 public Task/Usage capacity readback - 2026-09-17
The PCM runner now optionally verifies completed Tasks, finalized Artifact
metadata and exactly one task/audio Usage event through canonical public SDK
APIs. The observer has an independent credential, explicit Project/Environment
scope, bounded full pagination and a shared run deadline. Missing, duplicate,
foreign, truncated or denied observations remain failures; output contains
counts and fixed categories only. Local real PostgreSQL/Redis proof confirms
one completion/settlement and 80 ms after two unique frames plus one replay.
Real Staging capacity and broad durable-effect acceptance remain unqualified.
## E10 PCM disconnect and resume observations - 2026-09-17
The existing PCM capacity driver can now disconnect after its first frame,
mint one fresh Staging resume ticket through the public SDK, validate retained
Participant/Signal/Task bindings and replay only unacknowledged audio. Missing
ACK and unreceived-frame fixtures both complete without silent frame loss.
Authorization denial stops later sessions, including malformed denial bodies.
Thirty-four local capacity tests pass. Cross-replica recovery, durable effects
and actual Staging capacity remain unqualified.
## E10 PCM protocol capacity observations - 2026-09-17
CCR-B now has a PCM observation driver using the existing JavaScript SDK for
frames, ACK release and exact replay. It sends paced synthetic audio with a
bounded window, probes client backpressure and correlates terminal Task and
Artifact events. Twenty-four local capacity tests pass. Driver output remains
`NOT_EVALUATED` for acceptance: connection resume, durable duplicate effects,
server saturation, actual cloud metrics and capacity still require evidence.
## E10 bounded capacity connection observations - 2026-09-17
The existing CCR-B runner now measures sustained WebSocket connections,
handshake latency, active/peak connections, throughput and received bytes.
Reconnects and cleanup are bounded; authorization/policy denial stops new
attempts and independent ticket URLs avoid accidental reuse. Fifteen local
tests pass. Transport observations never imply protocol or capacity acceptance.
The twelve scenarios remain planned and unexecuted; canonical PCM/replay,
Data Sync, cloud-fault orchestration and runtime metric export still require
preparation within E10. No cloud or procurement gate changed.
## E10 official public contract refresh - 2026-09-17
Added a machine-bound snapshot of current official GitHub Actions, Cloudflare
WAF, ZITADEL and Alibaba Cloud public contract facts. The E10 validator now
fails if those facts are treated as account entitlements, quotes, readbacks or
cost decisions. No account-specific readback, BOM value, external state or
authorization changed; E10 remains procurement-not-ready with 9/3/10 pending.
Focused governance tests pass 67/67 and complete `ci:prepare` passes.
The first PR CI preserves one ordinary Windows failure caused by the changed
public Changelog invalidating the current Console export digest. The correction
refreshes derived portal bindings only; runtime, driver and specification
inputs are unchanged.
Evidence: docs/development/evidence/e10-public-contract-refresh-2026-09-17.json.
## E10 CCR-A concurrency and capacity readiness - 2026-09-17
Added the integrated CCR-A horizontal-scale audit and CCR-B Staging harness.
Control, Realtime, Worker, PostgreSQL, Redis, quota and backpressure paths have
no found scale blocker; disposable PostgreSQL/Redis race and loss testing
passes. The result is `PASS WITH DOCUMENTED RISKS` because Data Sync is not an
adopted authority and real capacity, metric export and alert delivery need
authorized Staging. All 12 CCR-B scenarios remain explicitly `NOT-RUN`.
Review: docs/infrastructure/E10_EXECUTION_READINESS.md.
Evidence: docs/development/evidence/ccr-a-pre-cloud-readiness-2026-09-17.json.
## E3 local PostgreSQL qualification - 2026-09-17
Qualified the existing E3 identity and Control API persistence paths against a
disposable loopback-only PostgreSQL 17.6 fixture. The fresh-schema migration
proof and all four affected Go packages pass under race detection with the
repository-required serial package execution on watchdog attempt 1. The first
parallel characterization failure remains recorded and was not retried
unchanged. This adds local evidence only; live E2 identity and external Control
API acceptance remain open, so E3 and formal M1 stay incomplete.
Evidence: docs/development/evidence/e3-local-postgres-qualification-2026-09-17.json.
## E10 ten-item repository readiness review - 2026-09-17
Added a machine-validated ten-item E10 readiness record. It reuses current
ingress, quota, secret, telemetry, Outbox, site-build, Provider and artifact
assets; retains seven conditional directions; and revises the edge-plan,
Sentry-plan and Provider-capacity selection logic. Data Sync authority and all
cloud validation remain explicitly absent. The canonical BOM still carries
9/3/10 pending inputs, a null exact total and no purchase or deployment
authority. Focused validation passes 64/64.
Review: docs/infrastructure/E10_EXECUTION_READINESS.md.
## E6 aggregate scheduling authority reconciliation - 2026-09-17
Requalified the Usage Worker's explicit Project Environment and Service
Principal aggregate scheduler against current main. The affected eight Go
packages pass PostgreSQL 17.6 race testing on attempt 1 and merged-main run
`35166459227` passes 23/23 required jobs. Acceptance now closes the stale
`AGGREGATE-SCHEDULING-AUTHORITY` blocker and names the actual remaining gate,
`DEPLOYED-AGGREGATE-SCOPE-ASSIGNMENT`. No runtime, canonical contract or
deployment changed; E6 and formal M1 remain incomplete.
PR #173 exact-head run `35168750095` and merged-main run `35169481823` each
passed 23/23 required jobs on attempt 1. Both watchdogs reported no stall and
no rerun; exact merge-tree readback and local/remote branch cleanup passed.
Evidence: docs/development/evidence/e6-aggregate-scheduling-authority-reconciliation-2026-09-17.json.
## E8 shared Protocol Ready coverage - 2026-09-17
The version-locked Device conformance bundle now fails closed unless all five
executable profiles retain every one of the 21 Owner-directed Protocol Ready
behavior groups. The verifier accepts only the reviewed JavaScript aggregation
for negotiation and pressure behavior; removing any of the 176 selected
profile/case entries is rejected. Focused checks pass 45/45, and the real
isolated PostgreSQL/Redis portable product chain passes 67/67 without skips.
PR #171 exact-head run `35161733517` and merged-main run `35163284293` each
passed all 23 required jobs on attempt 1. Both watchdogs reported
`NO_STALL_TIMEOUT` without rerun; identical-tree readback and originating
branch cleanup pass. The work package is lifecycle sealed at 100%. Deployed
E2–E4 integration and publication remain open, so E8, Protocol Ready and
formal M1 do not advance.
Review: docs/architecture/E8_PROTOCOL_READY_COVERAGE_REVIEW_2026-09-17.md.
Evidence: docs/development/evidence/e8-protocol-ready-coverage-2026-09-17.json.
## E8 WebSocket ticket downstream-copy reconciliation - 2026-09-17
The E8 acceptance ledger now matches the canonical ESP32 SDK contract for the
delivered adapted component. Exact source replacement and compile provenance
prove that the reviewed adaptation is compiled, and existing dual-TLS
constructor execution proves its ticket-bearing URI and parsed path copies are
erased before release on success and all allocation failures. The selected
native-memory blocker is closed. Broader library internals, OS buffers and
physical RAM remain excluded; E8, Protocol Ready, Staging and publication stay
open.
Review: docs/architecture/E8_WEBSOCKET_TICKET_COPY_RECONCILIATION_REVIEW_2026-09-17.md.
Evidence: docs/development/evidence/e8-websocket-ticket-copy-reconciliation-2026-09-17.json.
## E4 native Device scenario lifecycle seal - 2026-09-17
The eleven native Device scenario-family entries that still carried historical
hosted-pending labels are lifecycle sealed. Merged-main run `35130742892`
passed 23/23 on attempt 1; native Device job `104914150554` executed four
isolated dual-TLS partitions and passed all 152 cases. Watchdog run
`35132800754` returned `NO_STALL_TIMEOUT` without a rerun. Later main changes
through `5c55edc6` do not touch the qualified native runtime, scenario, spec or
workflow paths. Historical receipts remain immutable and hash-bound. E4,
Protocol Ready, external Staging and publication remain open, so formal M1
stays 2/14 (14%).
Current-source local qualification is also recorded without overstating a
single aggregate pass. The first aggregate attempt passed the 63-package audit
and found two stale portal bindings; fresh isolated PostgreSQL and WSL2
Firefox/WebKit evidence corrected them. The second attempt stopped at an
external OSV request failure after all pre-audit gates passed. The corrected
downstream workload passes 4,491/4,493 Node tests with two platform skips, 22
Python tests, all 104 Go packages plus vet, and generated consumer compilation.
Review: docs/architecture/E4_NATIVE_SCENARIO_LIFECYCLE_SEAL_REVIEW_2026-09-17.md.
Evidence: docs/development/evidence/e4-native-scenario-lifecycle-seal-2026-09-17.json.
## E8 C-host lifecycle seal - 2026-09-17
The three C-host Device packages that still carried hosted-pending labels are
now lifecycle sealed on current `main`. Run `35138623173` passed all 23 required
jobs on attempt 1; Linux Mock job `104937207903` executed and passed the exact
`c-task-cancel`, `c-write-failure-replay` and `c-capability-withdrawal`
product subtests. The matching Mock race, Windows Go and aggregate jobs passed.
Watchdog run `35139890787` returned `NO_STALL_TIMEOUT` without a rerun. The
three implementation commits are current-main ancestors, exact commit/tree
readback passes, and their original local and remote branches are absent. The
SDK applicability package was already lifecycle sealed; its older hosted-pending
summary is historical rather than current state. E8, Protocol Ready, external
Staging and publication remain open, so formal M1 stays 2/14 (14%).
Review: docs/architecture/E8_C_HOST_LIFECYCLE_SEAL_REVIEW_2026-09-17.md.
Evidence: docs/development/evidence/e8-c-host-lifecycle-seal-2026-09-17.json.
## E8 Node normal Device flow - 2026-09-17
The shared Device network matrix now includes an explicit no-fault Node path
through the public JavaScript SDK. It proves a single connection can publish
deterministic PCM, observe the canonical ACK, complete the downstream Task and
Artifact, end the Signal and settle Usage without reconnect or replay. The
focused checks and all 67 portable Node/C product scenarios pass locally.
Exact-head and merged-main CI each pass 23/23 after diagnosis and one controlled
rerun of the initial PR native assertion; main watchdog, exact-tree readback and
implementation-branch cleanup pass. Protocol Ready, deployed integration,
publication and external Staging remain open. Ignored local build-directory
cleanup remains blocked by automatic execution policy.
Review: docs/architecture/E8_NODE_NORMAL_FLOW_REVIEW_2026-09-17.md.
Evidence: docs/development/evidence/e8-node-normal-flow-2026-09-17.json.
## E8 selected native memory ownership completeness - 2026-09-16
The ESP32 SDK now has an exact selected native memory ownership inventory. It
proves the caller-owned SDK core remains heap-free, binds all eight reviewed
native adaptations, and requires the existing lifecycle, HTTP, constructor,
fault, certificate and TLS-session proof phases. Broader library internals,
caller storage, OS buffers and physical memory remain explicitly outside the
claim. Publication, external Staging, Protocol Ready and E8/M1 acceptance remain
open. The complete local Node, Python, Go/vet, generated-consumer and Redis-loss
workload passes in bounded segments, and fresh Firefox/WebKit Console evidence
is bound to the corrected source. Exact-head and merged-main CI each pass 23/23,
including both exact-source TLS native memory profiles; the lifecycle watchdog,
tree readback and cleanup also pass.
Review: docs/architecture/E8_NATIVE_MEMORY_OWNERSHIP_COMPLETENESS_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-native-memory-ownership-completeness-2026-09-16.json.
## E8 SDK fixture applicability reconciliation - 2026-09-16
The version-locked Device bundle now has a fail-closed applicability inventory
for all eleven shared fixture families, both public SDK contracts and the five
executable network profiles. Missing consumers, fixtures, profiles or evidence,
unsafe paths and unexplained exclusions reject before network I/O. Focused
validation passes 38/38 and all 66 portable product scenarios pass locally.
External Staging, publication, Protocol Ready and E8/M1 acceptance remain open.
Review: docs/architecture/E8_SDK_APPLICABILITY_RECONCILIATION_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-sdk-applicability-reconciliation-2026-09-16.json.
## E8 C-host capability withdrawal - 2026-09-16
The C-host matrix now exercises the existing capability-withdrawal contract.
The compiled C runtime keeps the admitted Signal active after capability removal,
continues to 1280 acknowledged samples, completes its Task and resumes the exact
terminal checkpoint. Two separately delegated new-stream probes receive
nonretryable `grant_missing` before and after resume. Public contracts are
unchanged. The focused case and all 66 portable product scenarios pass locally;
hosted qualification is pending.
Review: docs/architecture/E8_C_HOST_CAPABILITY_WITHDRAWAL_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-c-host-capability-withdrawal-2026-09-16.json.
## E8 C-host synchronous write-failure replay - 2026-09-16
The C-host matrix now exercises the existing synchronous write-failure replay
contract. The C SDK retains the exact frame when its host transport returns
`client_network_unavailable`, then replays it after a real resume checkpoint
and completes the Task. Public contracts are unchanged. The focused case and
all 65 portable product scenarios pass locally; hosted qualification is pending.
Review: docs/architecture/E8_C_HOST_WRITE_FAILURE_REPLAY_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-c-host-write-failure-replay-2026-09-16.json.
## E8 C-host running-Task cancellation - 2026-09-16
The portable C host now selects the existing `task-cancel` Device scenario. It
uses the generated C action input and public delegated control path after one
acknowledged 640-sample frame, requires the real Gateway `task.cancelled` event,
and proves the C runtime rejects subsequent connection, Signal, audio and replay
operations in its terminal state. Server readback requires the durable cancelled
Task and delegated Consent/audit join with no completion, settlement or billed
audio. Public contracts and wire formats are unchanged; the private package is
unpublished. Local product qualification passes all 64 isolated scenarios;
hosted exact-head qualification remains pending.
Review: docs/architecture/E8_C_HOST_TASK_CANCELLATION_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-c-host-task-cancellation-2026-09-16.json.
## Browser Device complete-corpus CI budget - 2026-09-16
The required Gecko/WebKit Device suite now has a bounded 660-second Go test
budget within its existing 900-second job ceiling. Merged-main evidence showed
the former 540-second limit expiring only after the final WebKit case started;
all completed cases passed. Scenario behavior, per-case deadlines and the
single-attempt policy are unchanged.
## E8 shared sequence-conflict enforcement - 2026-09-16
Portable Node, C host and actual-browser JavaScript now run the existing
`sequence-conflict` Device scenario. Two exact duplicate frames remain
idempotent; reusing that sequence with changed PCM receives canonical
nonretryable `protocol_sequence_conflict` and a matching 1008 close. The
terminal Signal retains one unfinished Task and one durable audio checkpoint,
with no completed or terminal-bound Task, settlement or durable audio Usage. The client
replay buffer is empty. Public contracts and wire formats are unchanged, and
the private package remains unpublished. The segmented local workload passes
across Node, Python and all 104 Go packages. PR #156's final evidence head and
the byte-identical merged-main tree each pass all 23 required jobs, including
the hosted OSV gate; its watchdog reports no stall and performs no rerun.
Review: docs/architecture/E8_SHARED_SEQUENCE_CONFLICT_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-shared-sequence-conflict-2026-09-16.json.
## E8 shared synchronous write-failure replay - 2026-09-16
Portable Node and actual-browser JavaScript now run the existing
`write-failure-replay` Device scenario. A synchronous socket-write failure is
reported as canonical retryable `client_network_unavailable`; the exact queued
audio frame remains available for resume and retransmission. The real Gateway
then supplies the ACK, completed Task, Artifact and Usage settlement. Public
contracts and wire formats are unchanged, and the private package remains
unpublished.
Local qualification covers the complete race-instrumented Go workspace and
22/22 Python tests. A current Console receipt refresh and uninterrupted final
local CI remain required before hosted qualification.
Review: docs/architecture/E8_SHARED_WRITE_FAILURE_REPLAY_REVIEW_2026-09-16.md.
Evidence: docs/development/evidence/e8-shared-write-failure-replay-2026-09-16.json.
## E8 shared active-audio revocation - 2026-09-15
The private Mock Device matrix now runs active-audio revocation through portable
Node and actual-browser JavaScript as well as C and both native profiles. The
public SDK opens a Signal, sends one frame only after Device revocation, retains
the unacknowledged bytes and rejects further use after the real Gateway
`grant_missing` error and matching 1008 close. Public contracts and wire formats
are unchanged.
The package lifecycle is sealed through PR 152: its exact corrected head and
merged-main tree each pass all 23 required jobs. The native producer now uses
ESP-IDF's official GitHub-assets mirror after one retained upstream HTTP 500
incident; pinned size and SHA-256 verification remain mandatory.
Review: docs/architecture/E8_SHARED_ACTIVE_AUDIO_REVOCATION_REVIEW_2026-09-15.md.
Evidence: docs/development/evidence/e8-shared-active-audio-revocation-2026-09-15.json.
## E8 shared canonical Realtime errors - 2026-09-15
The private Mock Device conformance matrix now executes `signal_not_found`,
`message_id_conflict` and `quota_exceeded` through portable Node, C host and
actual-browser JavaScript in addition to both native profiles. One shared core
requires the real Gateway error and 1008 close, terminal SDK behavior, exact
unacknowledged-frame retention and durable Task/Usage readback. Canonical
contracts and product wire behavior are unchanged.
Review: docs/architecture/E8_SHARED_CANONICAL_ERRORS_REVIEW_2026-09-15.md.
Evidence: docs/development/evidence/e8-shared-canonical-errors-2026-09-15.json.
## Linux validation preparation order - 2026-09-15
Required Linux validation now completes browser system dependency installation
before complete repository preparation. This preserves every validation step
while preventing package installation from starving the native CMake proof.
The Python Provider interruption fixture also separates its bounded child
startup window from the unchanged 20-second blocked-operation deadline. No
public API, runtime behavior, production timeout or retry policy changes.
Review: docs/architecture/M1_LINUX_PREPARATION_ORDER_REVIEW_2026-09-15.md.
Evidence: docs/development/evidence/m1-linux-preparation-order-2026-09-15.json.
## E7 SignalStream sample continuity - 2026-09-15
The unpublished JavaScript SDK now rejects a new audio frame whose sample
start is not contiguous with its SignalStream's retained frame or validated
ACK checkpoint. Rejection leaves the backlog unchanged and occurs before
Realtime network I/O. Stateless frame bytes and exact duplicates are unchanged.
Review: docs/architecture/E7_SIGNAL_SAMPLE_CONTINUITY_REVIEW_2026-09-15.md.
Evidence: docs/development/evidence/e7-signal-sample-continuity-2026-09-15.json.
## E8 native binary flag validation - 2026-09-15
The unpublished ESP32 SDK now rejects unknown OSAF audio flag bits at the
native WebSocket transport boundary, including direct calls that bypass its
encoder. Both paths share the mask generated from the unchanged canonical
binary-frame spec. Valid frames and the public wire format are unchanged.
Review: docs/architecture/E8_NATIVE_BINARY_FLAGS_REVIEW_2026-09-15.md.
Evidence: docs/development/evidence/e8-native-binary-flags-2026-09-15.json.
## E8 Device secret contract consistency - 2026-09-14
The ESP32 SDK credential metadata now references the canonical display-once
Device secret schema. Its generated Control bounds and client capacity continue
to follow the public 32–512 character contract. This removes a stale 64-byte
SDK declaration without changing issuance, authorization or secure-storage
ownership. Generated projections and the shared Device bundle lock are updated
from the canonical specs. The component remains unpublished.
Review: docs/architecture/E8_DEVICE_SECRET_SCHEMA_SOURCE_REVIEW_2026-09-14.md.
## E8 native HTTP initialization failure correction - 2026-09-14
The native HTTP constructor now guards partially initialized request/response
headers and uses existing complete transport/foundation destructors when
allocation or transport-list insertion fails. This corrects one null-header
cleanup crash and two ownership leak classes without changing public API,
credentials, authorization, certificate validation or transport semantics.
The shared native allocation observer retains transient allocation ordinals.
Both TLS profiles require all 34 HTTP constructor failures and successful
recovery after each, alongside the existing 14-point WebSocket sweep. The
regular memory qualification requires both constructors and preserves baseline
allocation uncertainty. HTTP constructor inputs contain no credential.
The component remains unpublished. Current execution results and remaining
qualification gates are recorded in the development evidence, independently of
this exported product change description. E8/E11/E12/E13 and external/final
acceptance remain open.
Review: docs/architecture/E8_NATIVE_HTTP_INIT_FAILURE_REVIEW_2026-09-14.md.
Evidence: docs/development/evidence/e8-native-http-init-failure-2026-09-14.json.
## Native JSON grammar — 2026-09-09
Reject malformed native Realtime/Control JSON separators and primitive spellings.
Actual-client regressions retain PCM and the ACK cursor after malformed ACKs.
Selected host suites pass; complete candidate and rebuilt native qualification
remain pending. Public payload fields and resource semantics are unchanged.
## Realtime speech and Task receipt completion — 2026-09-08
Fix an HTTP/1 Task transfer race that could cancel the final response after
successful callback completion. Keep cancellation and unfinished-reader cleanup.
Reuse Control audio assertions to exercise the actual Realtime executable through
signed Task HTTPS, Artifact completion, terminal replay and joined shutdown.
The local speech fixture uses deterministic Provider output.
Evidence: docs/development/evidence/realtime-speech-receipt-2026-09-08.json.
## 2026-09-08 — Control API service command
Add the private-configured HTTPS service entry point with real product bootstrap,
explicit OIDC/Redis policy and joined resource ownership. Selected command and
CI contract checks pass; complete current qualification remains pending.
## 2026-09-08 — Shared Control API admission
Add a concrete bounded Redis limiter and enforce provisioning-code ingress
budget before code lookup. Selected real Redis and Linux race tests pass;
complete current qualification and deployable composition remain open.
## Native fault memory — 2026-09-08
- Serialize Linux native fixture logs using the FreeRTOS primitive required by the pinned scheduler.
- Add actual dual-TLS fault/recovery memory cycles to required native qualification, preserving existing phases and deadlines.
- Keep the unresolved parent Task HTTP/1 CI failure and incomplete SDK scope explicit.
## E8 Platform SDK acceptance scope — 2026-09-08
- Align SDK acceptance with Platform protocol/connectivity ownership and the Owner decision assigning physical implementation and testing to onesay-os.
- Retain open protocol, memory, runtime-integration and publication gates, and preserve historical evidence.
- Give the complete browser Device suite an independent required CI job after the combined job exceeded its time limit; preserve every proof and timeout.
## Shared browser ACK, timeout and resume expiry — 2026-09-08
- Share lost-ACK, buffer-pressure, real heartbeat-timeout and resume-expiry conformance across Node and actual browsers.
- Verify exact retained/replayed PCM, server ACK reconciliation, canonical expiry and durable Task/settlement counts.
## Shared browser invalid-frame and credential rejection — 2026-09-08
- Share ten locked malformed-frame and three credential rejection paths across Node and actual Gecko/WebKit.
- Verify exact wire bytes, canonical errors, server closes, retained unacknowledged data and zero Task/settlement/checkpoint side effects.
## Shared browser backpressure and sequence recovery — 2026-09-08
- Share existing two-Task capacity and sequence-gap/duplicate-ACK conformance across Node and actual browsers.
- Verify exact retained replay, cumulative ACKs and durable execution/settlement counts in Gecko and WebKit.
## Shared browser negotiation — 2026-09-08
- Reuse seven locked negotiation vectors across Node and actual browser Device clients.
- Verify real rejected upgrades preserve ticket use, rejected versions preserve idempotency/resume, and no Task or audio usage is created.
## Shared browser capability withdrawal — 2026-09-08
- Reuse capability-withdrawal conformance across Node, native clients and actual browsers.
- Verify denied new streams, admitted Task completion and completed-result resume in Gecko and WebKit.
## Authenticated Task HTTPS service — 2026-09-08
- Compose the durable Task runtime with a private TLS listener and existing internal service authentication.
- Join HTTP requests, Task runtime and maintenance before cache closure; retain explicit shutdown failure.
## Worker process resource shutdown — 2026-09-08
- Join Worker runtime and resource cleanup before database closure; preserve explicit shutdown failure.
- Separate browser TLS certificate setup from the bounded CONNECT behavior proof.
## Task runtime shutdown — 2026-09-08
- Reject new Task operations during owner shutdown and join existing work before dependency closure.
- Stop idle Provider sessions and preserve one bounded cleanup result across concurrent stop paths.
## Task realtime bootstrap — 2026-09-08
- Assemble durable Task creation, execution, Usage and final-cache components with live Provider policy.
- Reject configuration before database access and preserve independently migrated schema ownership.
## Portable protocol delivery — 2026-09-08
- Verify all 53 portable Device cases against exact copied prebuilt files outside the checkout.
- Reject changed manifests, payloads, inventory, traversal and redirected artifact paths before execution.
## Browser public Device recovery — 2026-09-08
- Verify actual Gecko/WebKit Device setup, Task completion and audio replay through public SDK networking.
- Add required Linux browser qualification and preserve TLS shutdown through the isolated fixture proxy.
## Task peer failure isolation — 2026-09-08
- Verify fresh Tasks execute and settle on the surviving service after another Task process exits.
- Preserve explicit failures for requests assigned to the unavailable service and prevent automatic replay.
## Fixed Task owner routing — 2026-09-08
- Keep a Participant's complete Task group on one configured private execution service.
- Preserve grouping across Gateway replacement and differently ordered target configurations.
- Verify two-stream audio continuity, exact Task settlement and explicit recovery rejection after owner loss.
## Mock server shutdown verification — 2026-09-08
- Verify the original listener handles are closed before reporting successful shutdown.
- Preserve cleanup checks when another fixture reuses a released port.
## Task restart and response lifetime — 2026-09-08
- Finish private service cancellation callbacks before releasing HTTP responses.
- Verify authenticated Task service reconnection after process replacement while preserving Gateway configuration.
- Reject unavailable old executions after restart without inventing acknowledgements or replaying retained audio.
## Independent Task owner failure — 2026-09-08
- Verify Task service failure with Control and Gateway still running.
- Preserve retained audio and reject recovery when the original Task execution is unavailable.
- Cover lost transfer confirmations with the real Task runtime over both HTTP versions.
- Keep abandoned execution recovery, deployment and external acceptance explicitly open.
## Private Task network transport — 2026-09-08
- Add private authenticated HTTPS transport for the existing Task application interface.
- Preserve original actor attribution, exact audio counters and bounded cancellation across service calls.
- Verify same-Task continuity across Gateway process replacement and replica switching with real service authentication.
- Keep Task-owner failure, deployment and full candidate qualification explicitly open.
## Portal export source provenance — 2026-09-08
- Bind Portal exports to rendered documentation, frontend and SDK sources, generated contracts and dependency locks.
- Reject stale build inputs or changed output bytes before browser or manual accessibility evidence is recorded.
- Verify source inputs around both clean builds; finalize site documentation before qualification.
## Internal Service request cancellation — 2026-09-08
- Propagate internal Service request cancellation and deadlines through authentication and audit transactions.
- Roll back canceled replay/audit writes and suppress authentication outputs.
- Require context on unpublished internal Go token methods; update all callers.
## Current internal Service token authority — 2026-09-08
- Revalidate current Service and Organization/Project/Environment authority for internal JWT issuance and use.
- Keep scope locks, replay identity and audit results in one transaction; clear callback results on serialization retry.
- Reject invalid signed time bounds and fractional TTL configuration; recheck expiry after authority waits.
## In progress — Dedicated native memory qualification
- Run both memory profiles serially on a separate required CI runner.
- Transfer the exact qualified binaries with workflow, source and digest checks.
- Record TLS handshake and open timings while preserving all cases and limits.
- Pass 124 focused checks, fresh native runtimes, isolated artifact import, both memory matrices, Gateway and 148 Device cases; hosted qualification remains pending.
## In progress — Memory qualification before Device workloads
- Complete both TLS memory profiles before starting Gateway and Device workloads.
- Observe memory cleanup and reject later workloads on failure; preserve every case and timeout.
- Pass changed local execution; retain hosted connection assertion failures until new hosted qualification succeeds.
## In progress — Prepared native memory tool image
- Prepare the pinned memory tool alongside IDF and Go construction, before runtime consumers start.
- Bound tool construction independently and verify exact image, recipe and builder identity before both profiles.
- Pass both actual local memory matrices, Gateway and all 148 Device cases using the prepared image; retain hosted download cancellation and pending hosted slow-header verification.
## In progress — Native artifact construction before memory checks
- Build Gateway and Device Go executables before native runtime and memory checks, alongside the independent IDF preparation lane.
- Require complete build success and exact prepared source, spec and executable bindings; preserve all request and CI deadlines.
- Retain the prior hosted slow-header assertion failure pending qualification of the changed schedule.
## In progress — HTTP fault-path memory qualification
- Repeat the existing 20 HTTP scenarios under Valgrind with baseline, warm and repeated observations.
- Keep request deadlines and canonical error checks intact; observe DNS and task cleanup between requests.
- Reject incomplete evidence, invalid access, leaks, unexplained retention and repeated allocation growth.
- Build the shared memory tool image once, then observe both isolated TLS profile checks through cleanup under unchanged time limits.
## In progress — Native HTTP pressure and quota scenarios
- Keep primary Device admission in native C while a separately credentialed Mock Device consumes the same Project Environment capacity.
- Preserve actual pressure rejection, retained-frame replay, quota rejection and settlement assertions across both TLS profiles.
- Require distinct Device/Source identities and two actual claim records; pass all 148 cases locally in 133 seconds with complete owned-resource cleanup.
## In progress — Independent Device qualification groups
- Run native HTTP and historical Control scenarios in separate owned namespaces for each TLS profile.
- Require all four groups, exact source and ELF bindings, complete case inventory and successful cleanup before publishing combined evidence.
- Preserve all four real heartbeat deadlines. All 144 cases pass locally in 132 seconds, compared with 229 seconds before grouping; hosted timing remains unverified.
## In progress — Native capability Control
- Move capability withdrawal, original-report replay and completed-result resume into the native Control facade.
- Keep credentials and connection tickets in C, with fresh token keys and the original capability idempotency key.
- Reuse the shared admitted-audio and new-stream denial checks and preserve historical scenarios.
- Pass all 144 actual Device cases locally, including 70 native HTTP cases, with both updated TLS runtimes and complete owned-resource cleanup.
## In progress — Native runtime qualification stages
- Qualify independent Linux TLS runtimes concurrently after the target builds finish.
- Require both runtime results before memory, Gateway and Device validation; preserve failure propagation and owned-resource cleanup.
- Keep shared memory-image construction sequential and retain every CI deadline.
## In progress — Native expiry and negotiation conformance
- Exercise credential expiry and resume expiry through the native Control facade and existing server-owned transitions.
- Extend native ticket admission to upgrade rejection and locked HTTP protocol-version rejection vectors.
- Preserve exact canonical errors, cleared failed tickets and retained unacknowledged audio; require actual-service qualification.
- Pass all 142 actual Device cases locally across both TLS profiles, including 68 native HTTP cases and complete owned-resource cleanup.
- Qualify both updated Linux runtimes, Gateway and selected WebSocket memory lifecycles; full native conformance and HTTP fault-path memory remain open.
## In progress — Native Device CI scheduling
- Run TLS 1.2 and TLS 1.3 Device qualification concurrently with independent isolated dependencies.
- Preserve all scenarios and deadlines; reject incomplete or stale combined evidence.
- Pass all 122 Device cases locally in parallel in 3 minutes 23 seconds, including 48 native HTTP cases and complete owned-resource cleanup.
- Retain the previous hosted timeout as failed qualification evidence; complete candidate and hosted validation are pending.
## In progress — Native Control HTTP
- Bound synchronous TLS DNS work with four owned slots, late-result reaping and preserved hostname verification/SNI.
- Block FreeRTOS scheduler signals before Linux DNS worker entry; the original Valgrind and revoked-device hangs no longer reproduce.
- Verify 20 HTTP and 22 facade cases per TLS profile, all 122 Device cases, both target builds and selected WebSocket memory lifecycles.
- Prevent occupied global event queues from blocking private HTTP requests; retain synchronous metadata callbacks.
- Verify busy-queue requests and slow/stalled TLS handshakes on both native TLS profiles.
- Validate 24 selected native HTTP modes against actual local Go services on both TLS profiles, including replay, revocation, heartbeat and invalid frames.
- Preserve all 74 historical Device cases; 48 native HTTP cases bring the matrix to 122.
- Retain exact revoked-request errors and erased tickets while the native client remains terminal.
- Qualify both ESP32-S3 TLS target builds and selected existing memory lifecycles with current source/ELF bindings.
- Add native provisioning exchange with scope validation and an explicitly erasable credential handoff.
- Generate the 512-byte secret capacity and preserve caller-owned storage.
- Pass 45 provisioning host/sanitizer cases and seven new native cases per TLS profile.
- Add native bootstrap/resume control callbacks and Device capability publication using fresh short tokens.
- Preserve canonical HTTP error metadata and erase transient request/credential workspace.
- Reuse strict bounded JSON helpers across Realtime events and Control responses.
- Decode Device token and Realtime ticket responses with cleared failure outputs.
- Generate C operation metadata and token limits from the canonical public API.
- Adapt the pinned native HTTP client for bounded replies, shrinking I/O deadlines and sensitive-copy erasure.
- Prove 15 native HTTP TLS cases per profile; Device flow integration and full conformance remain in progress.
## In progress — Device access token exchange
- Exchange per-device secrets for short-lived Control API tokens through one public operation.
- Reject Device secrets on ordinary API calls; preserve service keys and human OIDC isolation.
- Apply ingress limits before secret authentication and protect idempotent token responses.
- Revalidate credential expiry, Device, Principal, Organization, Project Environment and grants on token use and exchange replay.
- Validate token expiry as an RFC 3339 calendar date and reject extra response fields.
## In progress — Assigned Usage aggregate scheduling
- Run bounded aggregation for explicit Project Environment Service assignments.
- Revalidate current execution authority; preserve historical Usage attribution.
- Include scoped backlog in readiness and join both Worker loops on shutdown.
- Qualify process restart, revocation and in-flight aggregate rollback locally.
## In progress — Native canonical Gateway errors
- Decode exact signal_not_found, message_id_conflict and quota_exceeded errors.
- Preserve queued rejections across all three exact protocol-policy closes.
- Qualify six real dual-TLS errors, retained PCM and actual quota admission.
## In progress — Native capability withdrawal
- Reuse the shared capability-withdrawal scenario on both native TLS profiles.
- Verify current capability admission, idempotent report replay, admitted audio
completion and completed-result resume using public SDK protocol primitives.
- Expand the selected matrix to 68 cases, with protocol-layer scope explicit.
## In progress — Native sequence recovery
- Decode canonical sequence_gap and preserve original PCM for exact retryable
gaps; replay remains an explicit caller action and conflicts stay terminal.
- Deliver queued canonical conflict errors before a known policy close.
- Qualify omitted-frame resume, gap recovery and identical/conflicting duplicates
over both native TLS profiles; expand selected coverage to 66 cases.
## In progress — Native upgrade negotiation
- Exercise all three shared WebSocket upgrade rejection vectors over both native
TLS profiles, including no subprotocol, unsupported version and wrong case.
- Verify actual 403, zero probe WebSocket events, cleanup and unchanged-ticket
reuse by the formal SDK through one completed Task and settlement.
- Expand selected qualification to 60 client cases with 52 native WebSocket cases.
## In progress — Native invalid audio rejection
- Preserve queued canonical errors for exact audio-policy closes while keeping
parser/decoder failures and unknown close reasons immediately terminal.
- Exercise all ten shared invalid audio vectors over both native TLS profiles;
prove wire bytes, original-frame retention, no retry and no admitted usage.
- Expand selected qualification to 54 client cases, including 46 actual native
WebSocket cases; retain bounded execution and the private-only fault port.
## In progress — Native heartbeat recovery
- Exercise actual45-second heartbeat timeouts on both native TLS profiles.
- Verify offline frame retention, same-participant/Task recovery, exact replay
and single settlement after the real Gateway heartbeat close.
- Expand the selected suite to34 native client cases, including26 actual
WebSocket cases; preserve protocol timeout and bounded execution policies.
## In progress — Native admission and resume rejection
- Preserve queued rejection events when a peer closes immediately after the
native handshake, preventing resume retries before the rejection is processed.
- Stop and join terminal native connections before destruction, retaining
ownership on cleanup failure; skip private-driver close before any connection.
- Expand selected native client qualification to32 cases:24 actual WebSocket
cases and8 pretransport rejections, including credentials, versions and expiry.
- Verify retained PCM, terminal operation rejection and zero Task/audio usage.
## In progress — Native Device revocation
- Preserve queued canonical rejection events when native TLS closes with the
exact grant policy reason; keep malformed and unknown closes rejected.
- Deliver decoded client events alongside terminal poll results without
turning a revoked credential into a retryable condition.
- Verify native signal/audio revocation on both TLS profiles, terminal client
behavior, original unacknowledged PCM, rejected resume and zero Task/audio usage.
- Expand the required selected native Device suite from twelve to sixteen cases.
## In progress — Native terminal overflow and server pressure
- Verify terminal overflow after a real native disconnect, retained PCM and
rejection of further operations without creating Tasks or audio usage.
- Verify two real capacity denials, unchanged ACK/PCM and exact native replay
after capacity release, with two completed Tasks and 120 ms total settlement.
- Expand required dual-TLS native Device qualification to twelve cases and
distinguish private-driver exit failures from native resource cleanup failures.
- Complete native HTTP, shared conformance and external acceptance separately.
## In progress — Native replay and buffer recovery
- Return the canonical retryable network error when a valid native audio write
encounters a closed connection; retain malformed-frame rejection.
- Verify byte-identical replay after write failure and ACK-driven reuse of a
two-slot C buffer through real native TLS, public APIs and Task/Usage services.
- Preserve complete private fixture receipts across interrupted and partial
writes; add a non-root Linux signal regression for the reproduced truncation.
- Expand required native Device qualification to eight selected cases. Full
native HTTP, conformance and external acceptance remain open.
## In progress — Native Device task recovery
- Exercise actual C native WebSocket transport through public Device setup,
Task completion and lost-ACK resume on TLS1.2 and TLS1.3.
- Verify one80 ms settlement, original Task identity, no duplicate replay and
native cleanup against isolated PostgreSQL/Redis-backed services.
- Reuse the shared C driver with private native ports; handle interrupted pipe
reads and explicitly disconnect before deinitialization.
- Add source-bound native Device qualification to required CI. Native HTTP,
full conformance, external runtime and publication remain unqualified.
## In progress — Native Realtime Origin interoperability
- Permit Origin omission for ticket-authenticated native WebSocket clients.
Keep exact validation for every supplied Origin and reject invalid/reused
tickets independently of cookies.
- Verify actual native TLS1.2/TLS1.3 welcome decoding and cleanup against the
Gateway; remove the host C fixture's injected browser Origin.
- Regenerate unpublished contract/SDK pins. No endpoint or wire-message alias,
migration, publication or deployment is introduced.
## In progress — ESP32 protocol qualification alignment
- Record executed protocol-only component builds, selected native Linux
FreeRTOS/TLS paths and partial erasure of SDK/adapted native owned buffers.
- Regenerate metadata and SDK/fixture locks without changing the public protocol,
PCM, ABI or retry policy. No migration or deprecation is required.
- Keep complete protocol conformance, hardware and publication unqualified.
## In progress — Live Gateway round trips and native CI ownership
- Verify one Task across two live Gateway processes and back, preserving ACK
checkpoints, execution identity and a single settlement in the private fixture.
- Use distinct idempotency keys for separate Mock resume operations.
- Run native memory containers as the Linux caller so receipt writeback succeeds.
- Public contracts and spec digest remain unchanged; no migration or deprecation
is required. Production discovery, service auth and acceptance remain pending.
## In progress — Native memory lifecycle qualification
- Run actual native TLS1.2/TLS1.3 ELFs under pinned Valgrind across baseline,
three reconnects and twelve reconnects; preserve retained allocations and
reject invalid accesses, leaks, suppressions and unexplained growth.
## In progress — Native connection fault recovery
- Verify real TLS drop/stall, interrupted WebSocket upgrade and partial-message
disconnect under both TLS profiles, with bounded cleanup and fresh reconnect.
## In progress — Native TLS session lifetime and reuse
- Install cached sessions once before handshake retries; preserve cached tickets
on failed SAVE, update selected references on replacement and clear them on FREE.
- Verify real TLS1.3 resumption, full handshake after release, server key rotation
and replacement using the peer's actual session-reuse result.
## In progress — Usage in-flight process recovery evidence
- Verify actual Worker termination while an expiry update is uncommitted.
- Cover server completion and rollback, then replacement-process recovery,
unchanged settled timestamps and preserved future reservations.
- Keep deployed recovery and aggregate scope assignment pending.
## In progress — Usage executable specification alignment
- Record the existing local Usage Worker executable and post-settlement process
restart proof in the canonical Usage specification and generated projections.
- Keep aggregate scope assignment and deployed recovery explicitly pending;
no public API, Usage quantity or deployment behavior changes.
## In progress — Usage Worker executable
- Run existing quota expiration and private health probes in an OS process with
strict stdin configuration, bounded shutdown and fixed diagnostics.
- Share the proven Task maintenance pipe lifecycle and PostgreSQL configuration
checks between both commands; retain domain-specific composition.
- Qualify stop/EOF, crash recovery, durable expiration and terminal query errors
on isolated PostgreSQL; emit real Go test progress within existing budgets.
## In progress — Usage Worker database-loss qualification
- Separate clean process cancellation from database-loss qualification.
- Hold the first real PostgreSQL expiry query until readiness has observed
database loss, then require terminal process failure without retry.
- Runtime behavior and public contracts are unchanged.
## In progress — Native opening-handshake validation
- Reject malformed status, upgrade headers, challenge responses, subprotocols
and unrequested extensions while accepting legal header casing/whitespace.
- Initialize native error events and capture TLS failures before abort so HTTP
ticket/grant rejection retains its correct SDK error category.
- Execute both TLS profiles through real certificate and handshake matrices,
verifying cleanup and zero application messages after rejection.
## In progress — Native certificate validity enforcement
- Require TLS certificate time/date checks and reject insecure build settings.
The host supplies valid system time before connecting.
- Reject expired, future, wrong-host and untrusted certificates before the
WebSocket upgrade in actual TLS1.2/TLS1.3 client tests, with cleanup verified.
- Bind complete certificate matrices and compiled configuration to native
receipts. Preserve pending broader fault, heap and full acceptance gates.
## In progress — TLS1.3 native client lifecycle
- Run the actual native WebSocket/FreeRTOS lifecycle under TLS1.2 and TLS1.3,
with exact peer negotiation and separate compiled/executed receipts.
- Verify blocked-close ownership, explicit cleanup and three fresh connections
under both protocols. Preserve pending expiry, trust/fault and heap coverage.
- Require both profiles in the native CI job. Full candidate and hosted
qualification remain distinct from selected local lifecycle evidence.
## In progress — Native runtime receipts and independent CI qualification
- Add pinned native Linux build and isolated execution with exact source,
compilation and ELF readback; reject stale or mismatched proof records.
- Verify actual blocked-close cleanup and three reconnect cycles, then compile
both updated SDK TLS configurations. These are selected local proofs.
- Separate complete Linux/browser, Go race and native SDK checks into required
dependencies, preserving the existing aggregate check and per-job limits.
Forward explicit browser environments to bounded child processes.
- Retain all hosted failures and pending full candidate qualification. No
protocol-ready, release, deployment or publication status is advanced.
## In progress — Full native Linux lifecycle qualification
- Execute the actual SDK, TLS/WebSocket dependencies and Linux FreeRTOS port
through blocked-callback close, retained-resource retry, queue erasure and
three fresh connections. These selected TLS1.2 scenarios pass locally.
- Preserve native tick width in the worker lock timeout and explicitly select
Ninja for the compilation-database proof on Windows. Hosted failure logs are
retained; full follow-up regression and required-CI integration remain open.
## In progress — Native dependency lifecycle adaptation
- Retain native handle and callback storage when stop/close/destroy fails;
require explicit successful cleanup before reuse.
- Bind reviewed Apache-2.0 native source substitutions to exact original hashes
and actual compile-source verification on pinned ESP-IDF 6.0.2.
- Bound close waits/sends, erase owned credential copies before release, remove
raw request diagnostics and reject ticket endpoint redirects.
- Make established sockets nonblocking and share each I/O deadline across TLS
WANT direction changes, EINTR and transient TCP errors. Preserve signed
backend error returns and partial progress.
- Actual TCP and pinned TLS 1.2 backpressure/deadline tests and wrong-hostname/
untrusted-certificate rejection pass; four native sources compile/link in
pinned esp32s3. TLS 1.3 reads now yield on ticket progress, process buffered
handshake work, preserve old tickets on save failure and erase owned copies.
Real save/discard-mode TLS 1.3 and both IDF configurations pass. Full local CI
passes with 646 Node tests, 22 Python tests and all 67 Go packages/vet.
Actual Gecko/WebKit pass. Full WebSocket/RTOS lifecycle and exact hosted
qualification remain pending; this is not a published SDK.
## In progress — Native connection receive cleanup
- Erase unread control messages, lengths and queue cursors after native transport
destruction so a reused context cannot deliver previous-connection content.
- Fence native callbacks with atomic closing state during cleanup.
- Record upstream stop/close and ticket-copy lifetime gaps separately from the
SDK-owned receive-buffer fix.
## In progress — Gateway restart with surviving Task execution
- Extend the standalone Mock with an actual parent-owned Task runtime and a
bounded private pipe to its independently replaceable Gateway child.
- Verify hidden/observed-ACK Gateway restarts continue the same Task, accept the
next PCM frame and settle once; retain explicit rejection for execution loss.
- Preserve the existing transfer reservation and reject missing final receipts.
## In progress — Complete Go qualification scheduling
- Execute isolated HTTP authority alongside Mock and the serial Go remainder,
retaining every discovered package and every lane outcome.
- Run race instrumentation over the same complete package inventory, with fresh
results and no scope overrides, instead of a handwritten package list.
- Reuse bounded owned-database cleanup for HTTP authority fixtures.
## In progress — Protocol delivery evidence
- Assemble existing specs, generated contracts, SDKs, shared fixtures and Mock
Server into an unpublished local candidate with exact file hashes.
- Verify the same artifact bytes outside the checkout through JavaScript replay
and C lost-ACK completion, with independent database/listener cleanup checks.
- Record actual process-continuity and native transport gaps before Protocol
Ready acceptance; preserve current contract and release boundaries.
## In progress — Isolated fixture cleanup
- Allow twenty seconds for an owned test database DROP after an observed
PostgreSQL checkpoint exceeded the former ten-second allowance.
- Verify cleanup survives owner cancellation, closes an abandoned connection
and preserves the input database; retain ordinary cleanup failures.
- Refresh Mock delivery documentation to the current shared 53-scenario matrix.
## In progress — Provider timeout qualification
- Separate dial timeout from start-response timeout in the existing provider
regression tests while preserving the configured 30-ms limits.
- Require a real run-task message and observed client connection cleanup after
response timeout, including deliberately delayed connection setup.
## In progress — Watchdog failure evidence
- Reject automatic retries when cancelled jobs or steps hide ordinary failures;
require complete step records and bounded, complete job-log evidence.
- Read candidate logs using exact job IDs, bounded requests and no shell;
missing logs or explicit test/command failures cannot authorize a retry.
- Replay actual incident metadata and failure lines, retaining synthetic positive
stall coverage and rejecting malformed evidence or mixed outcomes.
- Keep the trusted-main workflow and existing job, permission and retry limits.
## In progress — Owned Realtime Task maintenance
- Observe idle canonical terminals and reconcile expired local Task resources
without waiting for another client request, using bounded batches and reads.
- Preserve foreground and resume ownership across maintenance observations;
retry terminal settlement without restarting a Provider or losing receipts.
- Give the shared product host an owned maintenance loop that stops and joins
before dependencies close, with one deadline shared by Provider Cancel/Close.
- Verify public cancellation cleans up a real idle Python worker and releases
quota through the existing HTTP, WebSocket, PostgreSQL and Redis composition.
## In progress — Realtime cancellation qualification
- Qualify public cancellation while actual WebSocket PCM, receive or Finish
is blocked in a Python Provider, using canonical Task and Usage services.
- Verify rejected audio receives no ACK, cancelled Finish replays no duplicate
terminal, Redis checkpoints remain truthful and quota is released once.
- Reuse the shared product fixture with Task-scoped Provider fault injection.
- Give cancellation, authority and Mock Device matrices separate owned databases
and fixture lifetimes, preserving their existing deadlines and all scenarios.
## In progress — Cancellation during Provider execution
- Observe canonical Task authority while Provider PCM, receive or Finish is
blocked; stop the owned Provider and suppress interrupted output after cancel.
- Bound authority reads and retries to the active operation, joining the
observer before consuming results or returning to the caller.
- Qualify real public cancellation with PostgreSQL and blocked Python workers,
including idempotent replay and exactly one terminal release decision.
## In progress — Public Task cancellation execution boundary
- Re-read canonical Task authority before Provider PCM and Finish, stopping an
externally cancelled session without adding terminal output or Usage decisions.
- Reject unaccepted audio without a receipt; reconcile terminal quota and retain
bounded recovery metadata when settlement is unavailable.
- Qualify public cancellation and idempotent replay against isolated PostgreSQL,
plus authority-read failures and Realtime receipt/settlement recovery.
## In progress — Python Provider interruption
- Interrupt blocked PCM, receive and finish operations by stopping their owned
Python child; preserve normal private-protocol cancellation when idle.
- Fence interrupted responses and retain canonical Task cancellation without
final delivery, Provider cost or a second terminal Usage decision.
- Qualify actual worker cancellation and process reaping through shared fixtures.
## In progress — Native WebSocket callbacks
- Assemble native receive chunks and fragmented text within the existing queue
limits; accept interleaved Ping/Pong without passing controls to JSON parsing.
- Decode exact heartbeat timeout closes, drain pending canonical events before
reporting network loss, and preserve terminal rejection and audio cursors.
- Replace failed native handles for caller-driven, fresh-ticket reconnect.
- Allow bounded cold Mock fixture compilation without changing scenario or CI
deadlines, and report preparation expiry explicitly.
## In progress — Complete Go test scheduling
- Run the isolated Mock package beside the serial remainder of the discovered
Go package set, retaining fresh test execution, all outcomes and bounded CI.
- Include private cmd sources in the formal formatting gate.
- Bound race-executable test compilation separately from process lifecycle
deadlines, with explicit preparation-timeout diagnostics.
- Reject automatic run-wide retries when a timeout has an ordinary-failure peer.
## In progress — Task maintenance executable
- Compose canonical Task expiry and terminal Usage reconciliation in a private
Go executable with protected configuration input and bounded shutdown.
- Reject ambiguous policies, ambient database overrides and unsafe connections;
verify existing schema without DDL and expose only fixed process status.
- Qualify actual expiry, stop, restart, EOF and dependency failure using owned
software fixtures and canonical Task/Usage admission.
## In progress — Bounded Mock scenario concurrency
- Run at most two independently isolated Device conformance scenarios at once,
retaining actual processes, deterministic PCM and complete Task/Usage readback.
- Hold the concurrency slot through database and listener cleanup; preserve
real heartbeat timers, all failure assertions and required CI time limits.
## In progress — Windows scheduler proof startup budget
- Allow bounded Windows process startup in the real concurrent-lane proof,
preserving its peer handshake and predecessor ordering assertions.
- Keep one attempt, all required checks and the 15-minute CI job limits.
## In progress — Shared heartbeat timeout and Device resume
- Add a version-locked heartbeat fixture consumed by the JavaScript Mock and C
protocol peer, using the real canonical 45-second Gateway inactivity timeout.
- Preserve unacknowledged PCM and resume the same Participant through downstream
Task/Usage completion. Correct JavaScript heartbeat close classification while
keeping other policy/protocol errors and prior terminal failures absorbing.
## In progress — Task maintenance process-loss qualification
- Kill real isolated maintenance processes after cleanup claim, Task expiry,
Usage projection and quota release; recover against the same durable authority.
- Preserve real cleanup lease timing, immutable Usage identity and terminal
deduplication. Verify abandoned generation fencing, unstarted Task protection
and clean replacement shutdown through the existing Task bootstrap.
## In progress — Linux validation phase scheduling
- Overlap full local validation with browser installation, then overlap native
qualification with the complete serial Gecko/WebKit browser proof sequence.
- Preserve all checks, exact toolchain pins, both 15-minute required jobs and
bounded failure handling. Qualify dependency ordering with real subprocesses;
exact remote timing remains a separate requirement.
- Isolate the Task atomicity test database so unrelated pending outbox history
cannot fill its bounded read page across repeated local runs.
## In progress — Durable terminal Task Usage reconciliation
- Scan persisted Task terminal decisions for missing Usage projection or quota
settlement, including work left after execution claims have been released.
- Reuse canonical settlement transactions and Task-correlated identities;
preserve expired quota rather than attempting to reactivate or release it.
- Integrate bounded reconciliation into every Task maintenance cycle, with
explicit Usage configuration and failure propagation. Qualify concurrent
readers, interrupted projection/settlement and real scheduled PostgreSQL work.
## In progress — Scheduled Task execution expiry
- Add an explicit Task maintenance bootstrap that verifies the existing schema
and composes a caller-controlled runner without migrations or Provider I/O.
- Run bounded serial passes, including when batches are full. Reject overlapping
or repeated runner invocation; cancellation stops cleanly and failures exit
without implicit retry or private dependency details.
- Prove real PostgreSQL expiry across scheduled batches while preserving
unstarted Tasks. Usage settlement and successful audio recovery remain open.
## In progress — Abandoned Task execution expiry
- Add bounded discovery and expiry of abandoned dictation execution claims.
Recheck lease ownership under existing locks and reuse the canonical terminal
transaction for Task state, outbox and Usage decision.
- Qualify concurrent cleanup, stale discovery, live-worker protection and old
generation fencing with isolated PostgreSQL and race detection. Scheduler,
settlement integration and successful audio recovery remain open.
## In progress — Mock Gateway process-loss qualification
- Add a separate software Gateway/Task child with bounded startup, observed
abnormal exit and replacement against the same isolated database and Redis.
- Ship a deterministic Device process-loss client. The retained-process control
resumes and settles once; both lost and observed ACK crash cases expose an
explicit resume rejection with no false Task completion or extra settlement.
- Successful recovery after losing the Task execution process remains open.
## In progress — Linux native proof scheduling
- Overlap Go race qualification with the scoped ESP-IDF software compilation
after full local CI. Browser proofs wait for both results.
- Preserve both required jobs, every check, exact toolchain pins and the
15-minute job limit. Each native lane uses the existing bounded process
supervisor without an internal retry; failures remain blocking.
## In progress — Bounded Console navigation diagnostics
- Report the browser target and, on failed navigation, distinguish document
loading from semantic control readiness. Record bounded request/response and
load-event metadata without URLs, headers, bodies, page content or error text.
- Preserve the existing 30-second load and control deadlines, original failure,
and no-retry behavior. Detach all observers after each route.
- Add a deliberate loopback script-response fault proof to qualify diagnostic
accuracy separately from the unresolved Windows CI navigation failure.
## In progress — ACK sample checkpoint integrity
- Require the JavaScript ACK sample and duration to match their exact integer
representation and the transmitted frame end before releasing retained PCM.
AudioSignalBacklog acknowledgement now requires an explicit bigint sample.
- Validate all retained resume samples before applying any stream checkpoint;
verify duplicate ACKs against the last accepted sample even after PCM release.
- Reuse the C resume checkpoint lookup for ordinary ACK admission. Invalid
samples fail the receive path without releasing PCM or enabling retry.
- Add 17 shared software vectors, ordinary/duplicate C and JavaScript execution,
and multi-stream resume atomicity cases; package nine conformance payloads.
## In progress — Shared Realtime timestamp admission
- Share 43 timestamp vectors across schema tooling, Gateway sockets, JavaScript
ACK/resume validation and the native C decoder. Validate calendar dates, time
and offsets; accept lowercase separators and possible UTC leap-second positions.
- Stop the C session after rejected control input, retaining exact unacknowledged
PCM and refusing further sends, replay, reconnect and late ACK release.
- Package eight conformance payloads with a regenerated version lock. Preserve
the C consumer's existing bounded timestamp storage without changing the schema.
- Keep the formal uncached Go suite; restrict the generated-consumer compile
phase to generated Go packages to avoid a second complete Mock matrix run.
## In progress — C active-session and negotiation refusal
- Wait for actual WebSocket admission inside the C transport callback. Reuse all
shared upgrade and resume-version negatives with terminal-state checks.
- Verify an independent observer can use a ticket after rejected upgrade, while
the failed C client performs no retry or fallback.
- Exercise public Device revocation before open and after queuing deterministic
PCM; preserve original audio/bindings and reject further work without ACK or Task.
- Keep Node port error projection explicit and retain native networking and
broader cross-SDK qualification as separate incomplete work.
## In progress — C software bootstrap admission
- Request the actual public HTTP bootstrap result from inside the C runtime's
control-plane callback; preserve failed clients for terminal-state inspection.
- Cover revoked/expired credentials and two shared create-negotiation vectors,
asserting cleared bindings, zero transport connects and refusal of subsequent
connect, reconnect, open, replay, end and deterministic PCM writes.
- Keep Node HTTP/WebSocket ports explicit: this qualifies C failure handling,
without claiming native C HTTP or ESP-IDF TLS network implementation.
- Correct the conformance bundle guide to enumerate all seven current payloads.
## In progress — JavaScript server event admission
- Generate the canonical control envelope and server-only event registry into
the JavaScript contract. Validate envelopes before ACK, resume or transcript
state changes, including Trace IDs, message IDs and timestamp calendar values.
- Reject unknown fields/types, client/audit messages and invalid sequence numbers;
expose optional trace_id and event_sequence in the existing RealtimeEvent type.
- Reuse shared trace fixtures for ACK and resume rejection with unchanged
backlog/ACK state, terminal retry refusal and late-event fencing.
- Execute the formal Go suites with test-result caching disabled so child
JavaScript/C fixture changes cannot inherit old Mock qualification results.
## In progress — Canonical control envelope and Trace IDs
- Accept all registered control types, including ping/pong/error, and require
canonical uppercase ULIDs for optional trace_id. Bound message IDs to the
existing 128-character limit and reject trailing newlines.
- Reject explicitly empty/null Trace IDs in Gateway admission. Reuse canonical
resource validation in the C decoder and exclude the invalid ULID letter L.
- Share 17 Trace ID vectors across schema validation, Gateway sockets and native
C decoding; include them in the regenerated, version-locked conformance kit.
## In progress — Gateway canonical error projection
- Map internal protocol/lifecycle/authority failures to registered public codes;
take error-event retryability from generated canonical metadata.
- Use canonical ticket, lost-lease and Usage failure close reasons.
- Verify error events, policy closes, unchanged ACK/replay checkpoints and
recoverable gap delivery through actual Gateway sockets and isolated Redis.
## In progress — Canonical server pressure and C replay recovery
- Map internal Task/SignalStream capacity pressure to registered retryable
rate_limited; remove the unregistered C backpressure alias.
- Preserve retryability in decoded C error events. A retryable rate_limited
during audio keeps retained PCM and leaves bounded retry to the caller.
- Verify two actual capacity refusals, unchanged ACK and PCM, blocker completion,
exact C replay, Task/Artifact completion and one settlement per Task.
## In progress — C client replay-buffer capacity
- Verify terminal client_buffer_overflow preserves both queued frames and rejects
further writes, replay, reconnect, open and end operations without transport I/O.
- Verify caller pause at capacity, exact release after real ACKs and ring-slot reuse
through 160 ms of audio, completed Task/Artifact and one settlement.
- Give the client-pressure fixture a separate four-frame Task limit; the actual
server-pressure fixture continues to exercise its two-frame limit.
## In progress — C SDK canonical audio-frame errors
- Decode canonical frame_invalid and frame_too_large errors into the existing
protocol-error category while preserving the exact server code in the event.
- Run all ten shared malformed audio vectors through the product Gateway and C
runtime, requiring one error callback, terminal rejection and retained PCM.
- Verify no Task, settlement or audio checkpoint is created for rejected frames.
## In progress — Human authority and Source state qualification
- Verify membership downgrade/revocation during join/open/resume lock waits using
a Human ticket minted by the public API and controlled persistence barriers.
- Extend Source ordering checks to disabled and owner-mismatch fixture states;
both mutation-first and admission-first paths preserve rejection and cleanup.
- Bind mint audit assertions to each request ID. Runtime and canonical contracts
are unchanged; Source state fixtures do not introduce an ownership-transfer API.
- Make provider-failure tests deterministically exercise errors observed during
PCM write and during event receive, preserving canonical error redaction checks.
## In progress — Realtime authority after lock waits
- Revalidate current authority inside join/open/resume transactions before commit,
rolling back resources and takeover if credentials or grants changed while waiting.
- Evaluate a credential's full grant set in one SQL statement using the existing
ownership, scope, expiry and explicit-deny rules.
- Preserve terminal cleanup after revocation; verify 24 controlled Service/Device
races and the shared Control API authorization paths.
## In progress — Realtime mutation ordering qualification
- Exercise Source revocation and Device capability withdrawal before/after open
and resume with observed database locks and deferred commit barriers.
- Require stale admission rejection, unchanged ownership, zero rejected resources
and terminal cleanup for already admitted streams. Product runtime is unchanged.
- Source revocation uses fixture state; this does not introduce a mutation API.
## In progress — Room close sees committed lifecycle changes
- Give closure its own Read Committed transaction, locking Room before reading
authority and projecting children. Room creation remains Serializable.
- Reproduce and correct admission-first closure leaving active children; verify
both lock orders and recheck membership changed during the wait.
- Preserve atomic response/idempotency/audit handling through the existing close
service and public API lifecycle tests.
## In progress — Room closure fences Realtime lifecycle
- Acquire a shared Room lock before Participant and Signal mutations, matching
the Room-first ordering of closure without upgrading competing admissions.
- Verify closure-first join/open/resume/finish for Service and Device with
observed database barriers, canonical rejection and no active/orphan resources.
- Admission-first closure and broader mutation concurrency remain unqualified.
## In progress — Signal-open and resume lock ordering
- Lock the current Participant before Source during signal registration, matching
resume's order and preventing a reproduced PostgreSQL deadlock.
- Verify Service and Device takeover against a concurrent old-owner open with
observed database locks, canonical rejection and no orphan resources.
## In progress — Shared C resume-expiry conformance
- Run the C protocol runtime against both shared resume-expiry phases through
actual HTTP/WebSocket authority and unchanged server rejection events.
- Verify retained PCM after rejection, terminal refusal of replay/reconnect/open,
exact socket counts and zero Task/Usage/ACK persistence.
## In progress — C SDK retained replay and atomic resume validation
- Run the native C protocol client through real reconnect with an omitted frame
or lost ACK; require exact replay bytes or release from the server checkpoint.
- Validate the complete resume ACK before moving the C client to finalizing.
Invalid checkpoints preserve state and retained PCM.
## In progress — C SDK server-allocated lifecycle bindings
- Bootstrap the C protocol runtime with Source and Room only; learn Participant,
SignalStream, Task and Artifact identities from validated server events.
- Exercise actual C framing, ACK and event handling against the independent
product server through Node HTTP/WebSocket ports.
- Wait for server handler cleanup before fixture readback, with a finite deadline.
## In progress — Shared standalone Device rejection matrix
- Run all 22 existing Mock scenarios against the independent local server,
including malformed audio, credential revocation/expiry and resume expiry.
- Share deterministic expiry transitions with the product harness; inspect
resource ownership, absent ACK state and zero Task settlement on rejection.
## In progress — Independent Mock Server and provisioning Usage
- Start isolated Control API, Gateway and deterministic downstream processing
as a separate local executable for portable Device clients.
- Attribute anonymous code-exchange Usage to the authorized Device while keeping
the application request anonymous; preserve actual durable Usage/stage checks.
## In progress — Portable software Mock Device
- Package the compiled SDK, unchanged Mock scenarios, pinned WebSocket runtime
and locked PCM fixtures for execution outside the checkout without installation.
- Run product Device conformance from an independent temporary kit, retaining
server-side authority, audio, Task and Usage readback.
## In progress — Version-locked Device conformance fixtures
- Package shared Device fixtures and deterministic PCM with canonical-spec and
content digests. Verify the lock before Mock network I/O and record it in receipts.
- Provide an offline verifier that works outside the repository without dependencies.
## In progress — Shared Device resume expiry
- Verify expired resume authority rejects ticket minting and post-mint Gateway
recovery, preserves pending SDK audio, and prevents automatic frame-zero fallback.
Use scoped deterministic Redis expiry with software-only PCM fixtures.
## In progress — Shared Device connection negotiation
- Add portable Control API version and WebSocket subprotocol rejection fixtures.
Verify invalid requests leave the original idempotency key usable, rejected
upgrades preserve the issued ticket, and valid SDK connection/resume succeeds.
## In progress — Public capability withdrawal lifecycle
- Verify Device capability withdrawal blocks new streams, preserves an admitted
stream's completion, and permits replay of completed results without granting
new audio admission. Replaying the old publication response cannot restore it.
## In progress — Mock Device sequence recovery
- Verify an out-of-order frame produces sequence_gap without closing the socket,
retained replay restores contiguous ACK, and exact/retransmit duplicates return
the current ACK without repeating Task progress or usage settlement.
## In progress — Duplicate audio final-flag identity
- Fix JavaScript SDK duplicate detection to reject changes to the final flag,
matching SignalStream identity. Preserve exact duplicates and unACKed bytes.
- Extend shared Go/JavaScript/C ACK-state fixtures with final-flag add/remove
conflicts and byte-preservation checks.
## In progress — Shared malformed-frame network conformance
- Execute all 10 rejected shared audio-frame vectors through independent Mock
Device connections to the product Gateway. Assert exact nonretryable errors,
policy-close reasons, retained client audio and unchanged server ACK state.
## In progress — Shared ACK state conformance
- Share ordered ACK/sequence/duplicate fixtures across Go, JavaScript and the
protocol-only C replay buffer. Verify rejected operations preserve pending audio.
- Fix SignalStream cumulative ACK validation so an out-of-range ACK cannot
partially release pending frames or mutate replay history before rejection.
## In progress — Expired Device credential
- Verify expired Device credentials reject connection-result replay and previously
issued tickets. The isolated server fixture expires the exact credential after
ticket issuance; the independent client uses only public HTTP/WebSocket APIs.
## In progress — Active Device revocation
- Verify public Device revocation on an already joined socket. Subsequent Signal
admission fails with grant_missing, the socket closes, and resume minting fails
with token_invalid. No SignalStream or Task is created after revocation.
## In progress — Revoked Mock Device admission
- Exercise public Device revocation after ticket issuance. The same Device
cannot replay its prior connection-creation response, and the issued ticket
receives authentication rejection before Room admission or audio processing.
## In progress — Shared Task capacity recovery
- Add an independent Mock Device scenario that exhausts real Task Runtime frame
capacity, completes a competing Task, then replays the rejected audio frame.
- Persist acknowledged SignalStream history while unacknowledged frames remain
pending. This lets another stream finish and release capacity; pending frames
retain conflict checks and must still be replayed after restore.
## In progress — Task backpressure retry
- Fix pending audio retries after Task admission pressure. An identical frame
accepted on retry now advances the ACK and persisted resume checkpoint and
delivers Task progress. Already acknowledged duplicates continue to re-ACK.
## In progress — Device buffer-pressure conformance
- Fill the actual SDK audio backlog with deterministic PCM, verify explicit
overflow without a network send or buffer mutation, and retry the rejected
sequence after resume releases the acknowledged frame. Check final audio
duration, Task completion and one usage settlement through the local product.
## In progress — Product lost-ACK conformance
- Extend the independent Mock Device with a server-processed frame whose ACK is
suppressed before SDK delivery. Resume releases retained PCM without replay;
product Task completion and single usage settlement pass the local race test.
- Preserve the separate undelivered-frame replay scenario. Full qualification
for this extension remains pending.
## In progress — Retained SDK resume
- Add explicit same-client resume with retained PCM, atomic ACK checkpoint
reconciliation, stale-socket isolation and fail-closed stream/Participant binding.
- Extend the independent Mock Device with deterministic disconnect/replay. This
now completes through product Task/Usage processing with explicit Task
connection-authority transfer, failed-transfer rollback and old-writer fencing.
Full qualification and further recovery conformance remain pending.
## In progress — Software Mock Device preparation
- Add the SDK's fixed anonymous provisioning exchange and compose registration,
Device capability publication, Source binding and connection-ticket issuance.
- Pin software execution to an explicit loopback server. Validate response scope,
separate Owner and Device credentials, and support disposal without secret output.
- Full product-backed Mock Device Realtime qualification remains incomplete.
- The independent Node client now completes the normal audio path against the
product HTTP/Gateway/PostgreSQL/Redis fixture, with deterministic transcription,
correlated terminal events and one durable quota settlement. Recovery and
negative conformance are still pending.
## In progress — Public Source provisioning
- Add Source creation, scoped reads and cursor lists with server-derived ownership,
Device binding, exact credential revalidation and atomic audit/idempotency.
- Product software tests now register Source through the public API before
deterministic PCM reaches Gateway and downstream processing. Capability
publication and complete Mock Device qualification remain incomplete.
## In progress — Repository ownership correction
- Update JavaScript contracts and generated references to supplied PCM. Treat
historical hardware receipts as provenance and guard against restoring deleted
acquisition/storage code or physical test commands.
- Remove public JavaScript AudioWorklet capture APIs and packaged worklet. Generic
synthetic graph support is test-only; SDK audio transport accepts supplied PCM.
- Remove browser physical-microphone and controlled-media acquisition runners.
Keep synthetic proof routes and deny microphone permission at the test server.
- Revise the canonical SDK contract and generated reference to require caller-
supplied PCM and abstract secure-store access. Physical validation belongs to
onesay-os; the protocol-only ESP-IDF component awaits fresh qualification.
- Establish shared deterministic PCM for the software Device path and reuse the
canonical OSAF encoder in Gateway/Task/Usage integration tests. Full Mock Device
protocol readiness remains under development.
- Remove SDK audio acquisition callbacks. Audio submission starts at caller-
supplied PCM; retain transport replay and ACK behavior with deterministic data.
- Remove Platform I2S/GPIO/DMA capture, concrete NVS storage and the board firmware
test runner. Hardware implementations belong to onesay-os. Retain protocol,
credential interfaces, caller-supplied PCM transport and TLS/WebSocket.
- Replace the board-test plan with Platform Device identity, semantic capability
contracts and deterministic mock-device conformance. Contract and evidence
cleanup is ongoing; this change is not deployment or acceptance evidence.
## In progress — Gateway current authority
- Preserve the issuing credential through Realtime Task creation/cancellation
and audit records. Recheck and lock the exact credential in the Task mutation
transaction; reject revoked, expired and unmatched credentials.
- Apply active scope-wide deny grants before returning Service/Device permission
sets or accepting current-credential grants. Organization/project/environment
denies override allows; expired, revoked and unrelated denies do not. Resource-
specific allows are no longer promoted to environment-wide permissions.
- Recheck the issuing credential and current Room/Principal/environment grants
before every message dispatch, including cached replies and binary frames.
Bound the check and apply the message budget before database work.
- On rejected durable resume, invalidate the matching Redis resume, Signal
checkpoints and Participant/connection leases in one fenced operation. Cleanup
survives request cancellation with a bounded deadline and reports failures.
- Revalidate Source, Publication and SignalStream scope/status inside the durable
Participant resume transaction. Reject revoked, failed, missing, duplicate or
terminal-mismatched checkpoints and roll back connection ownership on denial.
- Regenerate canonical projections and reproduce SDK package bytes for the Source
protocol correction. Refresh migration/package expectations; current Console
browser evidence must be rerun before full local CI can pass.
- Verify exact signal.end replay preserves one terminal event and one settlement.
Align bootstrap tests with migration 15 while continuing to reject future,
incomplete and conflicting migration ledgers. Full Go race regression passes.
- Verify real Service/Device audio-to-completion sockets with the existing offline
Provider, persisted Signal/Task terminal states and exactly one committed Task
quota reservation linked to its Usage event. Provision quota only in the fixture.
- Exercise real durable Task creation/cancellation through product WebSockets,
using the existing Task/Usage/pipeline/cache composition and offline Provider.
Give distinct fixture requests distinct principal-scoped idempotency keys.
- Project SignalStream and Publication terminal states together under current
connection ownership; preserve identical replay and reject terminal replacement.
Wire ended projection before the Gateway acknowledgement.
- Bind durable Signal registration in product Gateway before signal.opened and
verify the resulting database correlations through actual Service/Device sockets.
Reject caller replacement of the product Signal registrar at startup.
- Replace signal.open's removed microphone source string with canonical source_id
in Gateway and ESP32, align JavaScript fixtures, and enforce source.use. Reject
the old alias even when supplied alongside a valid Source ID.
- Add transactional Source-bound Publication/SignalStream registration with
current Participant ownership and revoked Source checks. Verify rollback leaves
no orphan Publication. WebSocket and SDK contract alignment remains pending.
- Reject typed-nil Gateway startup context and verify ten invalid startup cases
without database access. Durable SignalStream registration remains required
before the real Gateway Task chain can be accepted.
- Verify concurrent Participant takeover selects one owner and rejects the other,
with stale cleanup fenced out; expanded database/Realtime race checks pass.
Remove the unused in-memory Usage collector from the durable product fixture.
- Verify explicit leave removes resume state and failed restoration of a removed
Participant releases the new lease without recording a successful reconnect.
- Preserve the resumed Participant owner during delayed old-socket cleanup and
project explicit room.leave before clearing session correlation.
- Fence Participant disconnect and Resume database projections by the owning
connection ID, using a forward migration and compare-and-swap updates.
- Persist server-created Participants before room.joined so durable Usage and
stage records retain valid resource references; lifecycle projection continues.
- Connect the integration fixture to durable Usage and stage projection;
Participant persistence is still missing and currently prevents these writes.
- Reject pre-rotation connection and Resume tickets on real WebSocket admission;
verify the product admission fixture with the race detector.
- Verify Service/Device WebSocket Resume with Gateway-generated tokens and
public Control API issuance after disconnect.
- Bind concrete Redis/database authority at Gateway startup and verify actual
WebSocket admission and policy closure after post-mint Grant revocation.
- Bind internal Realtime ticket metadata to the credential used at issuance,
preparing exact credential checks during Gateway admission.
- Add database-backed connection authorization for current Room, parent,
membership and exact credential grants; Gateway assembly remains in progress.
- Verify Service/Device rotation invalidates old create/resume ticket claims
while replacement credentials produce admissible claims.
## In progress — Realtime product runtime
- Extract read-only create/resume authorization from ticket issuance, allowing
resource checks before HTTP idempotency without minting or consuming tickets.
Product bootstrap uses the same service for preflight and issuance.
- Resolve every requested Realtime Grant from current resource authority,
including credential scopes and role templates, before ticket issuance.
- Reject cancellation after authority lookup and preserve Resume denial audit
ownership while keeping preflight free of ticket and audit writes.
- Add the HTTP preflight adapter for canonical Realtime create/resume operations;
HTTP tests verify revoked authority blocks idempotent replay before handler and
Usage.
- Require explicit environment-matched Redis configuration and bind Realtime
handlers/preflight in product bootstrap. Product tests now verify real Redis
issuance, single consumption, durable replay and membership-revoked replay denial.
- Verify Resume protected replay and outstanding-ticket fencing with real Redis;
reject missing Redis and mismatched environment bindings during startup.
- Verify Service/Device public credential flows through actual Redis ticket
issuance; deny cross-project access, revoked-Grant replay and suspended-parent
replay before Usage.
- Verify scoped Resume principal binding, protected replay and single-use claims;
reject test credentials accessing a live Room in the same Project.
## In progress — Catalog product runtime
- Propagate request context through all four Catalog operations and reject
canceled requests before projection.
- Bind Catalog discovery to current OneSay membership, credential and Grant
state in the product HTTP runtime. Filter Actions again at service execution;
discovery grants never confer resource execution authority.
## In progress — Principal runtime integration
- Pass request cancellation and deadlines through credential authentication
database work, including transactions, grant lookup and audit.
- Authenticate Service/Device opaque credentials through current database state
with explicit environment prefixes and no OIDC fallback.
- Authorize scoped resource reads against current credential, Grant and parent
state. Further resource operations and remaining product assembly are pending.
- Enable scoped Service/Device Room and Task management through existing resource
lookups, requiring current credential scopes and Grants before execution/replay.
Actual PostgreSQL HTTP lifecycle and denial tests pass; full CI remains pending.
## In progress — Human resource authorization
- Resolve account, Organization, Project and Application permissions from
current database membership before resource execution and idempotent replay.
- Enable human Credential creation, reads, rotation and revocation through
current Owner authority, with exact Project/Environment Usage attribution.
- Connect Device management to current database membership and Device scope,
including provisioning-session creation and revocation. Anonymous provisioning
exchange now resolves the one-time code's current resource authority before
protected replay and rejects expired codes or revoked devices.
- Validate canonical request bodies before authorization and Usage recording.
- Connect Room creation, reads, participant/signal collections and closure to
current membership with exact Project/Environment/Room attribution.
- Connect Task creation, reads and cancellation to current membership and
resource ownership, retaining transactional input validation and replay.
- Assemble persistent idempotency on the resource database so successful
mutations and their encrypted replay responses commit atomically.
- Focused HTTP and PostgreSQL checks pass; full package validation is pending.
## In progress — Control API product serving
- Separate startup schema verification from explicit database migration.
- Reuse a bounded Control API serving lifecycle in the Console acceptance tool,
with request deadlines and connection cleanup on cancellation or drain failure.
- Product service assembly and cross-origin integration remain in development.
## 2026-09-05 — Cross-browser Console authentication proof
- Exercise actual redirects and cookies through an exact-authority local HTTPS
proxy with CA-verified upstream connections. Native browser TLS trust remains
unexecuted; no deployed acceptance is claimed.
- Track concurrent provisional WebKit targets in a pinned Playwright driver
patch, retaining target identity checks. Bind the dependency patch, lock and
actual installed driver bytes to the authentication receipt.
- Cross-browser validation and independent patch review must finish before
merge; prior failed runs remain recorded in the implementation log.
## 2026-09-05 — Console static preview error handling
- Missing session endpoints and assets return 404 without crashing the Docs
preview server. Browser-proof cleanup handles prior process exit and has a
five-second wait bound, preserving the actual browser assertion failure.
- Record PR #131's first CI failures and focused regression evidence; corrected
cross-engine validation remains pending.
## 2026-09-04 — E7 Windows Gecko synthetic activation hardening
- Preserve the ordinary PR #121 Windows failure where Playwright's Gecko
pointer action timed out after the named control was visible and stable.
- Wait for explicit proof-module readiness, schedule page-owned DOM activation
and require bounded running-or-terminal acknowledgement before awaiting the
existing terminal result.
- Keep physical microphone trusted-click gates, public contracts, external
traffic, user audio, deployment, Legacy and Production unchanged.
- Seal PR #121 through final and merged-main Ubuntu/Windows CI with exact tree,
ancestry, watchdog and branch-cleanup readback.
## 2026-09-04 — E5 local Task Worker composition root candidate
- Connected the configured-version credential source, live Python process
factory, privacy-gated Resolver, specialized executor, exact v1.3 PostgreSQL
Task repository, pipeline and mandatory Runtime-stage reporter behind one
private bootstrap entry point.
- Invalid configuration fails before database migration. Bootstrap itself does
not read a secret, start Python, perform DNS or call a Provider.
- No public API or canonical domain changed. The Worker is not deployed and all
external E5 gates remain open.
Every public contract, SDK, Docs or behavior change must update the canonical
spec, generated projections, migration impact and release changelog together.
This preview renders repository change entries; it does not announce a release.
## 2026-09-04 — E5 Provider privacy-policy enforcement
- Fixed M1 Provider Route semantics to require `ephemeral_only` retention,
`forbidden` training use and membership in an explicit immutable data-region
authority before dispatch.
- Validate all Routes, including disabled and trailing entries, before exact
credential binding or any health/factory/backend path; runtime resolution
repeats the fail-closed check before health or backend I/O.
- Kept the public contract unchanged and external Provider declaration,
Staging and full retention/privacy acceptance explicitly open.
## 2026-09-04 — v1.3 M1 scope-freeze authority binding
- Rebound the M1 scope freeze metadata from historical v1.2 to the active
accepted v1.3 authority and exact digest.
- Added a fail-closed UTF-8/LF/no-BOM fixed-order gate with 13 negative cases
for stale, malformed or equivalent-but-noncanonical headers.
- Kept the authority bytes, scope body, Epic states, public contracts and
runtime unchanged. This is governance consistency only.
## 2026-09-04 — Provider native-failure race proof
- Removed a test-only scheduler-order assumption exposed by merged-main Go race
execution after PR #112.
- Kept both legal runtime outcomes fail-fast and normalized: an immediate
Provider failure can surface from the PCM write or the following finish.
- Added repeated focused race evidence without external traffic, credentials,
deployment, Legacy or Production changes.
## 2026-09-04 — E5 Resolver exact-binding startup gate
- Added a private, no-I/O exact binding membership contract to the existing
configured-version credential source.
- Made Resolver construction fail closed when any credential-bearing Route,
including a disabled Route, lacks its exact configured binding.
- Preserved one runtime backend read, fixed safe errors and provider-neutral
public contracts; deployed Worker composition and all external gates remain
open.
## 2026-09-04 — Production dependency audit resilience
- Replaced the unreliable npm advisory request with a fixed-endpoint,
fail-closed OSV batch query over the exact lock-verified production closure.
- Added deterministic lock/install equality, SHA-512 integrity,
unsupported-source, response-bound, schema and unresolved-pagination gates.
- Added focused cross-platform tests and documented the Quickstart fixture's
private non-production boundary. This changes no runtime or public contract.
## 2026-09-04 — E5 external Secret Manager boundary
- Added a private vendor-neutral configured-version credential source behind
the existing resolver, with one context-bound read, fixed safe errors,
defensive copy and zeroing on every result path.
- Kept real-backend immutable-selector/cancellation proof and startup
cross-validation explicitly open.
- Unified the private Go/Python credential ceiling at 4096 bytes and extended
the offline raw-OSPP vertical and concurrent race coverage.
- Moved shared credential-byte validation out of the vendor-specific adapter
into the common Provider credential boundary without changing behavior.
- Kept vendor selection/SDK, workload identity, real secrets, Provider traffic,
Staging and deployment explicitly open. No public contract changed.
## 2026-09-04 — bounded command post-exit settlement
- Stop timeout monitoring as soon as the child emits its authoritative exit.
- Bound the remaining close/output-drain handoff to five seconds; destroy only
lingering local streams and preserve the actual exit code when it expires.
- Prove that neither successful nor failed completed commands can be
reclassified as timeouts or trigger a second process tree. Required
Ubuntu/Windows CI and the exact-run watchdog both pass without a rerun.
## 2026-09-04 — E5 Python live process lifecycle seal
- PR #110 and merged-main Ubuntu/Windows CI passed on attempt 1; exact feature
head, tree, merge, watchdog decisions, ancestry and branch cleanup are now
machine-bound in the M1 ledger.
- Sealed the current unpublished 166,433-byte JavaScript package at archive
SHA-256 `bea68a8a…674b` and closed its required-CI reseal gate.
- Kept external secret manager, real Provider canary, Staging, publication and
all Production/Legacy state open and unchanged.
- Retained both npm advisory endpoint failures from the initial required run
and its only same-head retry. A later bounded HTTP 200 probe and successful
local dependency audit now justify fresh required CI on a substantive head.
## 2026-09-04 — E7 Gecko navigation readiness hardening
- Replaced the Gecko synthetic AudioWorklet proof's full-load navigation wait
with bounded `DOMContentLoaded` readiness plus a visible named run control.
- Preserved post-merge Windows run `33797818251` as an ordinary 30-second
navigation timeout; watchdog `33798910193` observed no stall and did not
rerun it.
- Added a regression test for the exact readiness policy. Required
Ubuntu/Windows browser CI remains pending; no public contract, microphone,
external network, deployment or publication state changed.
## 2026-09-04 — E5 Python live streaming Provider adapter
- Added the internal Python Paraformer streaming adapter required by ADR-016,
with exact WSS/TLS/handshake/frame/session bounds and no external dependency.
- Preserved one provider-neutral partial/final/usage/error contract, bounded
partial coalescing, lossless terminal results, credential zeroing and no PCM
retention.
- Added local socket-pair fake-WSS coverage. OSPP live wiring, secret-manager
integration, real Provider traffic, Staging and deployment remain open.
- PR #107 required Ubuntu/Windows CI passed on attempt 1 and the exact tree was
merged. The current private SDK bytes are sealed by that run.
## 2026-09-04 — E5 private Go/Python Provider process bootstrap
- Added an internal OSPP v1 process boundary from the Go Task Worker to the
deterministic Python Provider runtime, with one isolated child per stream.
- Added bounded binary framing, exact duplicate-key-safe JSON, minimal child
environment, timeout termination, fixed error exposure and zero retained PCM.
- Wired the existing capability resolver and specialized speech executor to
the process adapter and added shared-fixture, lifecycle, rejection and race
coverage. PR #105 required and merged-main Ubuntu/Windows CI passed; exact
tree readback and local/remote branch cleanup are sealed.
- Kept the empty-repository Quickstart cold Go build bounded while allowing up
to 120 seconds on Windows; Linux and macOS retain the 60-second ceiling.
- No public contract, live Provider, credential, deployment, publication or
external state is changed.
## 2026-09-04 — E5 Python Provider runtime foundation
- Began the accepted ADR-016 Python Provider boundary with a dependency-free
provider-neutral contract and deterministic incremental runtime.
- Added a shared Go/Python conformance fixture and exact Python 3.14.7 checks on
Ubuntu and Windows. The Go fake-WSS adapter is transition conformance
evidence, not deployment authority.
- Regenerated private consumers from the same registry. The current unpublished
JavaScript SDK package is byte-reproducible and was sealed by PR #103 required
Ubuntu/Windows CI; prior package proof remains historical.
- The live Python adapter, external secret manager,
Provider traffic and Staging remain open. Nothing is deployed or published.
## 2026-09-03 — E5 provider documentation readback
- Rebound the active capability and live-adapter documents to the already
merged PR #46, #95 and #96 lifecycle evidence.
- Removed stale claims that the repository-local live adapter and its required
lifecycle were still pending. External secret-manager/bootstrap integration,
real Provider traffic and Staging remain explicitly open; no contract,
runtime, external state or Epic status changed.
- PR #101 and its merged-main run passed Ubuntu/Windows CI on attempt 1; exact
tree, watchdog, ancestry, readback and branch-cleanup evidence is sealed.
## 2026-09-03 — E9 static-route readiness lifecycle seal
- Sealed PR #99 required Ubuntu/Windows browser CI, exact merge-tree and
remote-main readback, merged-main CI, watchdog decisions and local/remote
branch cleanup.
- Both required and merged-main watchdogs observed no stall and performed no
rerun. The package changes no canonical API, external state or E9 status.
## 2026-09-03 — E9 deterministic static-route readiness
- Replaced Playwright `networkidle` waits on the Console and three static
Playgrounds with deterministic page `load` plus a named visible control.
- Added a regression test that covers the exact navigation contract and rejects
reintroduction of the flaky heuristic. PR #99 and its merged-main run passed
the complete Ubuntu/Windows browser matrix. This changes no canonical API,
external request policy, publication state or Epic status.
## 2026-09-03 — E9 Quickstart fail-closed network evidence
- Upgraded the local Quickstart receipt to closed schema v2 and bound exact
offline package/build policy plus numeric IPv4 loopback application traffic.
- Bound the Quickstart and input-policy source digests while preserving the
existing private SDK, fixture and transport-archive digests.
- Local proof and full local CI passed on attempt 1 without retry, including
249/249 Node tests. PR #98 required Ubuntu/Windows CI passed; a merged-main
Windows static-route readiness timeout is being corrected separately.
OS-level traffic observation, Staging and publication remain unexecuted;
E9 remains `PARTIAL`.
## 2026-09-03 — PostgreSQL Cancel/Pipeline lifecycle seal
- Sealed PR #97 required Ubuntu/Windows CI, exact merge/tree readback,
merged-main CI and local/remote feature-branch cleanup evidence.
- Both required and merged-main watchdog observations completed on attempt 1
with no retry. E5 remains `IN PROGRESS`; external Provider, Staging and TAC
evidence remain unclaimed.
## 2026-09-03 — PostgreSQL Cancel/Pipeline concurrency proof
- Added a deterministic real-PostgreSQL integration matrix covering all six
directions between authorized Task cancellation and claimed partial,
completion or Provider-usage persistence.
- Bound every observed loser to the exact winner backend with
`pg_stat_activity` and `pg_blocking_pids`, then verified exact terminal,
outbox, usage, claim and receipt invariants with zero durable customer text.
- Ten digest-pinned PostgreSQL 17.6-alpine repetitions, focused Go race and the
full taskrepo package pass locally on watchdog attempt 1 without retry.
PR #97 subsequently sealed required and merged-main CI; external/live
Provider, Staging and TAC work is not claimed, and E5 remains
`IN PROGRESS`.
## 2026-09-03 — Incremental Provider progress lifecycle seal
- Sealed PR #95 required Ubuntu/Windows CI, exact merge-tree and remote-main
readback, merged-main CI and local/remote feature-branch cleanup evidence.
- PR #96 then sealed the exact lifecycle note through required run
`33748184806`, merge `2d2afb45…`, merged-main run `33749020839`, identical
tree/readback and bounded watchdog attempt 1 with no retry.
- Preserved E5 as `IN PROGRESS`; live Provider canary, external secret manager,
Staging, deployment, publication, Production and Legacy remain unexecuted.
## 2026-09-03 — Incremental Provider pre-end Task progress
- Replaced the private batch-shaped speech execution path with one bounded
incremental Provider stream across deterministic, Paraformer, canary,
pipeline and Realtime Task adapter implementations.
- Emit canonical `artifact.delta` progress during Audio ingestion while
preserving final/usage terminal ordering, exactly-once recovery, quota
settlement and zero retained PCM.
- Added no-Provider expiry reconciliation for admitted Tasks without an owned
session and limited each request-triggered expiry sweep to one candidate.
- Kept E5 `IN PROGRESS`; live Provider, secret manager, Staging and deployment
remain unexecuted.
## 2026-09-03 — E9 JavaScript Quickstart lifecycle seal
- Sealed PR #93 required Ubuntu/Windows CI, exact merge/tree readback,
merged-main CI and local/remote feature-branch cleanup evidence.
- Sealed the current unpublished private JavaScript SDK archive on Ubuntu and
Windows without publishing a package or changing an external authority.
- Preserved live Provider streaming, Staging, external five-minute acceptance,
manual accessibility and publication as incomplete external gates.
## 2026-09-03 — E9 empty-repository JavaScript Quickstart hardening
- Corrected the local Realtime proof so `audio.ack`, `artifact.delta`, the
client `signal.end`, `signal.ended`, `artifact.finalized` and
`task.completed` preserve v1.3 authority order. The Gateway now accepts and
binds progress events during Audio ingestion; live provider streaming remains
explicitly `PARTIAL / RUNTIME MISSING`.
- Replaced ambient pnpm-store dependence with two exact local archives and a
fresh isolated store. The example pins pnpm `11.23.0`; installation remains
offline with lifecycle scripts disabled.
- Added second-client server ticket-reuse proof, exact receipt validation,
bounded child output/time, raw-output-safe failures and confirmed process-tree
termination. This is private local evidence and authorizes no publication,
Staging, Production or Legacy change.
## 2026-09-03 — Windows CI toolchain and browser hygiene
- Removed the unused Node-20-based MSVC environment action from the required
Windows job and added an explicit fail-closed `clang.exe` version preflight.
- Limited Windows Playwright installation to Firefox, matching its two Gecko
lanes. Ubuntu continues to install and execute Firefox/Gecko plus WebKit.
- Preserved required job identities, timeouts, Node/Go versions and bounded
watchdog behavior. This changes CI setup only and advances no Epic or
external approval gate.
- PR #86 and merged-main required CI passed Windows and Ubuntu on attempt 1;
both watchdog runs observed no stall and did not rerun. Exact tree/ancestry
readback and local/remote branch cleanup pass. Windows emitted zero check
annotations and both browser lanes remained Gecko-only.
## 2026-09-03 — Fail-closed ESP-IDF CI impact scope
- Added an explicit base/head evaluator for the expensive ESP-IDF proof lane.
Changes to the ESP32 contract, generated C, SDK, fixtures, builder, workflow,
evaluator or lockfile run the pinned component compile; uncertain evaluation
also runs it.
- Limited `package.json` impact to the ESP-IDF command and its actual
Node/pnpm/YAML toolchain fields. The unrelated physical-browser script from
PR #83 now proves a safe skip instead of consuming a second ESP-IDF build.
- Corrected E8's stale required-CI label from candidate to proven without
claiming physical hardware, Staging, publication or Epic completion.
- PR #85 and merged-main run `33661122431` now close this package. Windows
required one bounded timeout retry; the second watchdog skipped and no third
attempt occurred.
## 2026-09-03 — E7 physical harness lifecycle evidence seal
- Bound PR #83 head `a465c35a…`, merge `f2f0fc9…`, exact tree
`c96dcfcc…`, required run `33648949210` and exact-range zero-finding scan
`5a05336b-0772-46d6-b425-fefd93e3c170` into the acceptance ledger.
- Retained merged-main run `33650359034` as `NOT PASS`: the first Ubuntu
attempt timed out during slow Playwright system-package downloads; watchdog
`33652088221` reran only that job; the second attempt timed out during pinned
ESP-IDF compilation after Playwright and complete local CI passed. Watchdog
`33653760084` skipped, proving there was no third attempt.
- Added fail-closed lifecycle validation and corrected two stale E8 decoder-CI
descriptions. No contract, runtime, physical-device, Staging, publication,
cloud, Production or Legacy state changed.
## 2026-09-02 — E7 physical microphone acceptance harness
- Added a default-inert manual acceptance runner with explicit CLI opt-in,
dedicated-device consent, two trusted human gestures and a random one-use
loopback session.
- Added coarse streaming liveness proof with immediate transient-buffer zeroing
and strict evidence allowlisting. Raw PCM, exact audio metrics and device
labels/identifiers are never persisted.
- Added fail-closed token, Host, Origin, method, body-size, schema, replay and
process-tree cleanup tests; the physical runner is excluded from CI.
- Closed async teardown, one-use reservation and browser cleanup races,
including a POSIX regression where the browser leader exits while descendants
remain in its process group. Manifest schema v2 binds static inputs, every
served compiled SDK file and executable harness inputs; acceptance recomputes
its digest and each server uses a unique disposable build root before
committing that exact build into the receipt. Each new
attempt invalidates the prior fixed-path receipt, and a PASS receipt binds its
run and manifest. Windows leader-only exit no longer authorizes profile deletion.
- Post-remediation focused tests pass 29/29. Full bounded local CI passes
210/210 Node tests plus all Go, generated compile, Docs, dependency, secret
and Redis-loss gates on watchdog attempt 1. Post-remediation working-tree
security scan `0e3c2f08-da97-42df-a516-86e1dae256b8` closes all 6/6 changed
source files and eight threat surfaces with zero findings/deferred. The later
lifecycle seal binds exact-range scan `5a05336b-0772-46d6-b425-fefd93e3c170`,
PR #83 required CI, merge/tree readback, bounded merged-main timeout evidence
and branch cleanup without upgrading the physical acceptance state.
- Kept physical execution `NOT EXECUTED`, E7 `PARTIAL`, and all Staging,
publication, cloud, DNS, Production and Legacy boundaries unchanged.
## 2026-09-02 — v1.3 active-document authority-drift gate
- Corrected five active architecture/plan documents to the merged PR #41
cutover evidence, canonical Source/Signal ownership and the actual current
local implementation boundary.
- Extended the forbidden-contract scanner and focused regression suite so
plural, lowercase semantic and lowercase canonical-list legacy-resource
prose cannot bypass CI. The Usage attribution ledger now matches the
implemented Organization/Source/SignalStream/Artifact dimensions; historical
provenance and browser MediaStream terminology remain allowed.
- A bounded scan reproduced a lowercase-plural correctness omission but found
no reportable security path. Both lowercase number forms are now covered,
and repository traversal skips only the scanner's exact source file.
- Full bounded local CI passed 198/198 Node tests and all remaining local gates
on watchdog attempt 1 without timeout or retry.
- Exact implementation range security scan
`3b295601-9f03-4810-9029-6e1d727a695a` completed both source reviews with
zero findings, complete coverage and no deferred work. TAC returned
`UNKNOWN / NO GRANTS`; this is non-blocking evidence, not authorization.
- Final immutable package scan `82b5ed4c-00d7-4fe0-bd78-936096730f96`
completed with zero findings and no deferred work. PR #81 required run
`33632318915` passed Ubuntu and Windows before merge.
- Merge `b340cf2461ccc2762f40f08a0f2bd51568dc983a` preserves exact feature tree
`95b253fc91f86e803b6716aa70cbf9b00b84e7ac`. Merged-main run `33633009585`
passed after watchdog run `33634529363` automatically reran only the Windows
job that reached the first-attempt 15-minute ceiling; attempt 2 passed.
- The exact lifecycle evidence now has fail-closed regression coverage. Full
bounded local CI passed 199/199 Node tests and every remaining local gate on
watchdog attempt 1; optional PostgreSQL execution remains explicitly
`NOT EXECUTED` without a DSN.
- No public contract, generated artifact, runtime, Epic status, deployment,
publication or external system changed.
## 2026-09-02 — E10 supporting-cost Owner decision proposal
- Added official-source-backed recommendations, bounded alternatives, billing
components and account-readback requirements for all ten E10 supporting-cost
decisions.
- Added deterministic validation that the proposal remains byte-bound to the
unchanged BOM and cannot claim Owner selection, numeric cost, approval or an
external mutation.
- Six focused tests, full bounded local CI and Codex Security scan
`46049d47-c56b-41b1-94f8-466c0f978c5d` pass; the scan closed five changed
items and six threat surfaces with zero findings and zero deferred work.
- Final exact-range scan `f797c50b-0698-421f-a81a-138a046270ff` binds
`a5c0294..ca297fd` and closes five changed items and seven threat surfaces
with zero findings or deferred work.
- PR #80 required run `33623767497` passed exact evidence head `c354ea2` on
Ubuntu and Windows; watchdog run `33624577575` observed no stall and did not
rerun either job.
- E10 stays blocked with pending counts `9/3/10`, a null exact total and no
purchase, provisioning, DNS, deployment, Production or Legacy authority.
## 2026-09-02 — Bounded local watchdog termination handoff
- Added a fixed five-second cleanup reserve inside the existing fifteen-minute
attempt ceiling for Windows process-tree termination and child `close`.
- A confirmed tree kill can now settle after a missing close handoff by
destroying local pipes; late close events cannot settle twice.
- Retry requires positive termination confirmation. A stalled or unconfirmed
kill exits `124` without starting an overlapping second attempt.
- This is repository tooling only; public contracts and deployed behavior are
unchanged.
## 2026-09-02 — OS Contract Request canonicalization gate
- Added a strict governance registry for byte-exact `OS-PLATFORM-XXXX` requests
originating from `onesay-os`; request snapshots remain proposal evidence and
never become Platform authority by ingestion.
- Enforced Code-Learning-First, Architecture Authority Review, canonical
contract, runtime and exact Staging-readback stages without skip, rollback or
implicit PASS transitions.
- Added deterministic generated conformance fixtures and fail-closed gates for
temporary APIs, compatibility aliases, duplicate domains, rejected-symbol
leakage and unauthorized external mutations.
- The registry is initially empty. No public contract, runtime, deployment,
publication, DNS, Production or Legacy behavior changed.
- The combined Node suite now schedules files deterministically at concurrency
1 and passes 179/179; no assertion or acceptance requirement was removed.
## 2026-09-02 — E9 automated accessibility required-CI proof
- Sealed the private synthetic accessibility proof at exact head
`6deac5c0220cdae818ddbba9565c32639bb3af44` in required run `33596362618` on
Ubuntu Gecko 153/WebKit 26.5 and Windows Gecko 153.
- Proved all eleven resource views at 320 CSS pixels and 200% root text, exact
skip-link focus transfer, canonical 3-pixel focus indicators, 44-pixel minimum
targets, no root horizontal overflow and zero external requests. All engines
produced ARIA SHA-256
`5ac82c97021b5ef10f2a1f25c9ba29649537c8f42eb8f37fe12201a8d6ada948`.
- Reproduced the current private 166,433-byte JavaScript archive at SHA-256
`4033e241fa66075b78b984c37b92d0babd8f0ece7b32e59dc6a05a05497ade0f`
on both required runners. Nothing was published or deployed.
- Manual screen-reader/browser-zoom acceptance, hosted preview, Staging,
community enablement and publication remain open or unauthorized; E9 remains
`PARTIAL`.
- PR #77 merged the exact evidence head as `efda38d…`; final PR run
`33598307565` and merged-main run `33599264913` passed Ubuntu and Windows,
followed by exact readback and local/remote branch cleanup.
## 2026-09-02 — E8 bounded reconnect and resume application candidate
- Added a five-attempt OneSay-owned reconnect loop with bounded jitter waits
and a newly exchanged single-use Realtime ticket for every attempt; native
WebSocket auto-reconnect remains disabled.
- Retain the opaque resume token only in bounded client memory, scrub it from
application event callbacks, and keep authentication, grant, ticket-expiry
and explicit resume rejection non-retryable.
- Apply `connection.resumed` only after exact SignalStream, sequence and sample
cursor reconciliation, release only authoritative ACKed frames, replay the
remaining caller-owned backlog and deduplicate terminal Artifact/Task
callbacks.
- This remains an unpublished local candidate. Required CI, real network,
credentials, Staging, physical hardware and publication are not claimed.
## 2026-09-02 — E8 canonical Dictation event decoder candidate
- Added a fixed 96-token, depth-8 C JSON decoder that performs no dynamic
allocation and maps the supported canonical Dictation server-event subset
into the bounded ESP32 runtime.
- Enforced exact envelope fields, unique data fields, strict IDs and integer
ranges, UTF-8/JSON unescaping, binding equality, contiguous event sequence
and increasing Artifact revision.
- Directly reused MIT `jsmn` commit
`25647e692c7906b96ffd2b05ca54c097948e879c` as a tokenizer, with upstream and
normalized vendored digests pinned. No parser, hardware or network behavior
was inferred from the dependency.
- Kept full connection/resume/room decoding, physical execution, Staging and
component publication open or unauthorized.
## 2026-09-01 — E8 I2S and TLS/WebSocket required-CI proof
- Align the I2S adapter with ESP-IDF `v6.0.2`'s integer channel identifier and
current `I2S_NUM_AUTO` through `I2S_NUM_2` constants; remove the obsolete
`i2s_port_t` and `I2S_NUM_MAX` assumptions from both source and host fakes.
- Post-hardening required run `33524504934` passed Ubuntu and Windows once
without a watchdog rerun. Ubuntu compiled the exact managed WebSocket
dependency and OneSay component for ESP32-S3; its 7,680,892-byte ELF SHA-256
is `438ffabdf0c1c6e16ff3cc9bde6a74b756ab746c02d373e96d1108af8e3e005a`.
- Seal component hash
`fcae4861dfd70361565d18fbe34525d859d1d26ffc4d2deb9ce95f36abb8f5c9`
and reproduce the same private 166,433-byte JavaScript archive on both
runners. No hardware, external network, publication or Production claim is
added.
## 2026-09-01 — E10 v1.3 procurement authority correction
- Bind the E10 BOM to the active v1.3 authority while preserving the detailed
v1.2 topology only as historical provenance.
- Correct the Developer/Infrastructure ADR gate to the Owner-approved
in-repository state without granting purchase, provisioning, DNS, deployment
or Production authority.
- Add ten fail-closed supporting cost decisions so omitted edge, TLS/WAF,
secret-management, observability, backup, hosting, administrative, Provider
and artifact-delivery costs cannot be mistaken for zero.
- Bind any future exact purchase authorization to the computed total, approved
maximum, every qualified evidence ID, Owner, approval time and approval-record
digest; a standalone `APPROVED` gate remains unauthorized.
- Pin every BOM resource to its canonical topology and price class, preserve
public-rate evidence exactly, and reject approval that predates any captured
evidence or postdates any account quote.
## 2026-09-01 — E9 local Next.js runtime candidate
- Replaced the static-only E9 runtime placeholder with a private Next.js
16.3.3, React 19.2.8 and TypeScript 5.9.3 static-export application.
- All 13 canonical human routes plus `llms.txt`, `llms-full.txt`, AI manifest
and route manifest are rendered from the generated route authority.
- CI performs two clean builds and requires every output byte to match; the
local proof emits 86 files with no hosting or publication authority.
- Kept interactive Console/session behavior, manual accessibility, hosted
preview, community enablement and publication explicitly open.
- Added `pnpm audit --prod --audit-level low` to local and required CI, then
upgraded root spec tooling to `ajv@8.18.0` and `yaml@2.8.3` to close the two
Moderate registry advisories discovered during this work package.
## 2026-09-01 — E7 WebKit AudioWorklet required-CI proof
- Required Ubuntu job `99680882295` of run `33451076839` passes Firefox 153 and
WebKit 26.5 on Node 24.19.0 using the same canonical processor, SDK bridge and
loopback-only harness.
- Each engine proves 441 messages, 56,448 input samples, 18,816 output samples
and 37,632 bytes with zero pending samples, external requests, microphone
permissions or raw PCM persistence.
- Windows WebKit exposes no Web Audio API and is explicitly not claimed.
Physical microphone, Staging and publication remain open.
- Final evidence head `fcdf455d` passed Ubuntu and Windows required CI; exact
security scan `a0674a5a-7f01-4270-9f44-2939a01d9045` completed 7/7 changed
source items with zero findings and zero deferred items.
## 2026-09-01 — E7 Gecko AudioWorklet required-CI proof
- Pinned a repository-local Playwright Firefox/Gecko runner that uses
deterministic offline rendering and the canonical AudioWorklet processor
plus SDK bridge without depending on runner audio hardware.
- Added exact 441-message, sample/byte, continuous-resample and lifecycle
validation in both required CI lanes.
- Required Ubuntu and Windows run `33446489484` passed Firefox `153.0` with
exact 441-message, 56,448-input-sample, 18,816-output-sample and 37,632-byte
accounting. No microphone permission, user audio, raw PCM persistence or
external request was involved.
- Current-host execution remains `NOT EXECUTED` because Windows SideBySide
event 33 blocks the isolated Firefox runtime. The later WebKit required-CI
proof above supersedes the earlier open WebKit gate; physical microphone
remains `NOT EXECUTED`.
## 2026-09-01 — E7 controlled media browser proof
- Added a loopback-only browser harness that exercises `getUserMedia` with a
deterministic fake audio device and never reads ambient user audio.
- Chrome 152 and Edge 152 each passed canonical AudioWorklet permission,
lifecycle, sample/byte accounting, MediaStream teardown and content-derived
440 Hz fixture-signature checks without retaining raw PCM.
- Initial security review found one Low self-attestation gap; it was remediated
and final scan `041bc5bc-ee65-499e-83b4-36c958c50a27` completed 10/10 reviews
with zero findings and zero deferred items.
- Physical microphone, Staging and npm publication acceptance remain explicitly
open; Firefox/Gecko and WebKit are covered by the required-CI proofs above.
## 2026-09-01 — `onesay-voice-key` retirement internalization
- Record that `onesay-voice-key` and all known local clones were fully deleted
and the project no longer exists.
- Exclude it from canonical siblings, reuse provenance, M1 dependencies,
backlog, sync/discovery and hardware acceptance prerequisites.
- Add a machine-readable tombstone and a fail-closed Docs gate so the name can
appear only in explicit retirement evidence, never as a current project.
## 2026-09-01 — E7 actual-browser AudioWorklet candidate
- Added an actual `AudioWorkletProcessor`, bounded stateful resampling and an
application-owned browser capture controller without `getUserMedia`.
- The controller remains inert after `create()` and connects only through
single-flight `start()`, including stop-during-resume and partial-connect
fences. `stop()` invalidates retained handlers before guarded graph cleanup.
- The local in-app browser passed a synthetic Web Audio execution with 441/441
messages delivered, exact 48 kHz to 16 kHz sample conversion, no PCM before
start or after stop and no `ScriptProcessorNode` fallback.
- Final security scan `141ffa1d-9915-4838-a4a4-ba29da2d1e1a` completed 16/16
reviews with zero findings and zero deferred items.
- A later controlled fake-media Chrome/Edge proof exercises browser permission;
physical microphone, cross-engine, Staging and publication remain explicitly
unexecuted or unauthorized.
## 2026-09-01 — E7 JavaScript SDK reproducible package candidate
- Added a deterministic release-shaped `@onesay/sdk@0.0.0-e7-local` package
build with ESM JavaScript, declarations, README and Apache-2.0 license.
- Fixed archive path order, uid/gid, mode, mtime and gzip metadata; CI compares
two independent builds and pins both archive and full content-manifest
digests on Ubuntu and Windows.
- The candidate remains private and non-publishable. No npm request or public
namespace reservation is performed; actual-browser, Staging and publication
acceptance remain open.
## 2026-08-31 — C5 Developer Log Runtime-stage authority local candidate
- Added a closed 13-event policy for content-free Developer Log and separate
internal trace stages; callers cannot set event, severity, stage or source
service.
- Added one serializable PostgreSQL transaction with ProjectEnvironment,
Principal, optional Credential and resource-FK authority, exact replay and
conflict rejection.
- Added five-run PostgreSQL 17.6 and eight-way concurrency proof, plus
generated Go/TypeScript/C/Docs event metadata. Call-site wiring, trace
export, deployment, Staging and privacy acceptance remain incomplete.
## 2026-08-31 — C5 access-plane Usage producer authority local candidate
### Control API and Realtime wiring follow-up
- Connected authorizer-resolved ProjectEnvironment API requests and
authenticated Realtime connection/resume lifecycles to the canonical
non-customer-billable Usage producer.
- Added fail-closed API/reconnect behavior, bounded duration, exact source
replay, PostgreSQL outbox evidence and WebSocket ordering tests. MCP,
Console, deployed recovery, Staging and privacy gates remain open.
- Final scan `6a4261a7-2639-4c7c-b869-a1dbf2837bb9` sealed the exact wiring
candidate after 15/15 changed-source reviews with complete coverage, zero
findings and zero deferred items.
- A TAC-backed initial scan found and the implementation remediated one Medium
same-environment cross-Principal Credential attribution path. Final scan
`b52f8fa9-e097-45cc-ae27-0c0f22e1346c` completed 10/10 coverage with zero
findings and zero deferred items.
- Added one closed producer policy for API, Realtime, MCP and Console access
facts while retaining the existing internal Provider-cost producer in the
same immutable Usage ledger.
- Wrapper requests, connection duration and reconnect facts are operational
and non-customer-billable. They cannot reproject Dictation, audio, output or
Provider-cost quantities.
- Added deterministic source replay, conflict rejection, bounded quantities,
ProjectEnvironment/Principal/resource-FK enforcement and atomic outbox
proof across five consecutive PostgreSQL 17.6 runs, including eight-way
concurrent insertion and cross-Project denial.
- The producer authority is local and not deployed. API/Realtime call-site
wiring, future MCP/Console runtimes, all-stage Developer Logs, Staging and
privacy acceptance remain incomplete.
## 2026-08-30 — C5 Provider cost ingestion local candidate
- Added a durable, content-free Provider usage receipt fenced by the exact
Task execution claim generation and immutable routing snapshot.
- Added exact replay/conflict and database immutability controls, with receipt
persistence before Task terminal state.
- Added immutable claim-generation history so a durable preterminal receipt
cannot block expired-claim recovery, and applied the same per-invocation
arithmetic-safety ceiling in the canonical provider contract and database.
- Projected Provider cost as a separate internal, non-customer-billable
`provider_cost_minor` UsageEvent for completed and Provider-consumed failed
Tasks while excluding Provider metadata from public readback.
- Provider cost remains outside customer quota. Other access-plane producers,
Staging, deployment and publication remain incomplete or unauthorized.
- Sealed security review found and remediated the arithmetic overflow path,
immutable-claim recovery issue and a fail-open acceptance-evidence gate. The
gate now requires exact final scan evidence. Final hardened review covers
23/23 source-like items with zero findings and zero deferred items.
## 2026-08-30 — C5 Quota action admission local candidate
- Bound `dictation.v1` execution to one ProjectEnvironment-authoritative
`dictation_tasks` reservation before Provider execution.
- Added deterministic Task-scoped reservation and terminal correlation,
canonical non-retryable `quota_exceeded`, and exact commit/release against
the terminal Usage projection.
- Added ordering, denial-before-Provider, replay, cross-scope and real
PostgreSQL commit/release proofs. Provider cost, other access planes,
Staging, deployment and publication remain incomplete or unauthorized.
- Added terminal-only recovery for committed/released reservation replay so an
ambiguous settlement result cannot restart the Provider or strand the same
Task retry; expired and conflicting replay remains fail closed.
## 2026-08-30 — C5 Quota reservation local candidate
- Added immutable versioned ProjectEnvironment quota-policy authority and a
local reserve/commit/release/expire state machine.
- Added exact replay/conflict, explicit denial, revoke-immediate new admission,
bounded expiry and 16-way no-over-admission proof.
- Commit links an existing UsageEvent and counts it once; customer quota and
Provider cost remain separate. Runtime and schema controls reject settlement
above the admitted reserved quantity.
- Public endpoints, other access-plane admission, deployment and publication
remain unimplemented or unauthorized.
## 2026-08-30 — C4 capability/provider boundary candidate
- Replaced Task Core's direct provider adapter dependency with the canonical
capability resolver and specialized streaming speech executor chain.
- Added fail-closed versioned credential resolution, deterministic health-aware
routing and a durable content-free routing snapshot recorded before provider
start.
- Added a synthetic SHA-256-only canary. Live provider, external secret manager
and Staging execution remain unavailable or unexecuted.
## 2026-08-30 — C2 Control API parity candidate
- Added typed Service Principal Credential create/list/get/rotate/revoke with
display-once secrets, encrypted idempotency and immediate invalidation.
- Added Capability and principal-filtered Action discovery generated from the
canonical registries.
- Added a 52-operation handler parity gate plus unit, contract and PostgreSQL
integration coverage. External deployment and Staging remain not executed.
## 2026-08-30 — C1 identity/auth matrix candidate
- Added a bounded exact-origin HTTPS JWKS resolver with rotation, expiry,
redirect rejection and refresh-amplification protection.
- Bound the 13-case external-ready authorization fixture to the canonical Go
policy authority and canonical failure reasons.
- Codex Security reviewed all four changed source surfaces with complete
coverage and zero findings; TAC remained an `unknown/no grants` advisory.
- Live ZITADEL/JWKS, deployed external matrix execution and Staging readback
remain `NOT EXECUTED`; no external system was contacted or changed.
## 2026-08-30 — v1.3 Cognitive Foundation reset candidate
- Replaced the unpublished prior ownership/output model with Source,
SignalPublication, SignalStream, TaskInput, ContextSnapshot and Artifact.
- Retained proven Audio sequence, duplicate, acknowledgement, backpressure,
replay, resume and terminal-exactly-once behavior under the new boundaries.
- Added exact pre-release spec/schema reset gates and generated Go,
TypeScript, JavaScript, ESP32 C and Docs projections with no compatibility
aliases.
- Full database-backed local CI, Windows GCC/CGO race, required PR/main
Ubuntu+Windows CI and merge lifecycle proof pass. TAC-dependent scanning,
deployment, publication and all external-state actions remain explicitly
unexecuted or unauthorized.
## 2026-08-29 — E5 durable Realtime application and cache replay candidate
- Bound Realtime Task create/cancel to the canonical Task application service
and PostgreSQL idempotency authority with strict scoped replay validation.
- Unified Control API and Realtime create/cancel on atomic Task snapshot,
receipt, metadata-only outbox, audit and terminal usage-decision facts.
- Added deterministic post-resume delivery of an unexpired cached
`transcript.final` followed by `task.completed`; expiry resumes metadata-only
and neither successful nor ambiguous delivery extends the cache TTL.
- Added real PostgreSQL and actual WebSocket Host coverage. Live Provider,
external Staging, cloud, DNS, deployment, publication and Production remain
incomplete, not executed or not authorized.
- Added current active Grant row locking for Service/Device Task create/cancel,
with immediate revoke denial and same-key regrant retry tests. The initial
Low/P3 CWE-863 result is remediated and the post-remediation Codex Security
scan closed all 18 reviewed source files with zero findings.
## 2026-08-29 — E5 Realtime Task wiring candidate
- Connected canonical Dictation Task create, PCM input, finish and cancel to the
Realtime Gateway through a provider-neutral typed application boundary.
- Added Track-owned Task grants, acceptance-before-ACK, validated canonical
partial/final/terminal delivery and metadata-only resume bindings.
- Added a Project/Environment/Task-scoped Redis final-text cache with immutable
content, exact replay, no TTL extension and a ten-minute maximum lifetime.
- Added pre-side-effect Track fencing plus global and Project/Environment Task,
PCM and frame admission; idle/absolute expiry and terminal paths zeroize and
delete buffered state, while transient executor PCM is cleared on return.
- Remediated both Medium/P2 findings from the initial 21-surface security scan;
post-remediation review closed all 21 surfaces with zero findings.
- Proved the adapter against the real canonical Task pipeline and a disposable
Redis instance; durable application wiring, cache-backed resumed delivery,
live Provider and external Staging remain incomplete or not executed.
## 2026-08-29 — E5 Task and Provider local runtime candidate
- Added a Platform-owned Dictation Task state machine with monotonic partial
revisions, absorbing terminal results and exactly-one usage decision.
- Added the provider-neutral Go contract and deterministic no-PCM-retention
adapter with canonical partial/final/usage events and safe error mapping.
- Added synthetic E2E, content-boundary and 32-way terminal race proofs.
- Kept PostgreSQL outbox, Realtime wiring, live Provider, Staging, deployment,
publication, Production and all Legacy behavior unimplemented or unchanged.
## 2026-08-29 — E5 Task PostgreSQL snapshot/outbox candidate
- Added expand-only schema 9 and an atomic PostgreSQL Task runtime repository.
- Persisted typed metadata-only snapshots, source-event receipts and outbox
events with one terminal usage handoff and no transcript or PCM fields.
- Proved cross-replica replay/conflict, crash retry, 32-way terminal
exactly-once, delivery replay and prior-application compatibility locally.
- Fenced provider execution with a durable hashed-owner lease and generation;
concurrent replicas start one provider, and ambiguous recovery never starts
another provider invocation.
- Kept Realtime, live Provider, Staging, deployment, publication, Production
and all Legacy behavior unimplemented or unchanged.
## 2026-08-29 — E3 Usage and Developer Log read candidate
- Added typed, Project/Environment-scoped Usage summary/event and Developer Log
list/timeline reads backed by one repeatable-read PostgreSQL authority.
- Added immutable UsageEvent, reversal, attribution, reservation/aggregate/
outbox scaffolding, append-only Developer Logs and separate internal traces.
- Enforced a closed Developer Log safe-field projection at OpenAPI, Go and
database boundaries, including value types, bounds and restricted diagnostic
characters.
- Bound reversal, quota-commit, principal attribution and Task-to-Room edges
at the PostgreSQL authority after two pre-remediation Low/P3 Codex Security
findings; added exact negative and legitimate-path regression proof.
- Kept reservation/commit/release producers, outbox/aggregate workers, Console
dogfood and all external acceptance unimplemented or not executed. The API
remains local, draft and unpublished.
## 2026-08-29 — E3 migration compatibility and Console dogfood candidate
- Added explicit application/schema compatibility groups and a fail-closed
startup sequence without adding destructive down migrations.
- Proved exact prior application revision `6ccad6652…` and its complete Control
Handler PostgreSQL suite remain valid on schema v8 across five fresh
databases.
- Added the private canonical Console Public API client with fixed authorities,
cookie omission, browser credential fencing and exact operation policies.
- Kept the Next.js UI, Staging, deployment, DNS, publication, Production and
Legacy boundaries unexecuted or unauthorized.
## 2026-08-28 — Identity serializable retry hardening
- Expanded the bounded PostgreSQL identity transaction retry budget for
recognized serialization and deadlock conflicts from 30ms to 635ms.
- Preserved fail-closed handling for all other database errors and immediate
canonical reread after a competing identity insert wins its unique key.
- This is a Platform-only CI/runtime hardening change; no external or Legacy
environment is modified.
## 2026-08-28 — E3 Task metadata lifecycle candidate
- Added typed Task create/list/get/cancel operations for one-Track dictation.
- Bound Task Project/Environment/Room/Track ownership with composite database
constraints and fail-closed exact grants.
- Added atomic absorbing cancel, audit/idempotency replay and bounded config/
locale metadata without Provider, raw audio or Transcript content.
- Hardened the Device lifecycle integration fixture to exercise the documented
same-idempotency-key retry path only for a server-declared retryable failure.
- Kept Realtime execution, Provider/Transcript processing, Usage and all
external acceptance unimplemented.
## 2026-08-28 — E3 Room lifecycle candidate
- Added typed Room create/list/get/close and Room-scoped Participant/Track list
operations with exact Project/Environment authority.
- Added one-participant and TTL bounds, fail-closed Live behavior, atomic close
terminalization, audit and exact cross-replica idempotent replay.
- Added expand-only Room/Participant/Publication/Track persistence with
composite ownership foreign keys that reject cross-Room child graphs.
- Kept the API local and unpublished; Task, Usage, Logs and external acceptance
remain incomplete.
## 2026-08-28 — E3 Device lifecycle candidate
- Added all eight typed Device operations with PostgreSQL-backed lifecycle,
exact ownership and Environment fences, and atomic audit/idempotency commits.
- Added a generated Device grant ceiling plus nonhuman actor subset checks.
- Protected display-once provisioning and credential responses with
AES-256-GCM idempotency storage; stored secrets remain HMAC digests.
- Added immediate reprovision/rotate/revoke behavior and linked
Application-to-Device invalidation.
- Kept the API local and unpublished; Room, Task, Usage, Logs and external
acceptance remain incomplete.
## 2026-08-28 — E3 Organization lifecycle candidate
- Added exact safe Current User (including memberships and accessible
Projects), Organization create/list/detail/update and Organization
Membership list/create contracts. Current User embeds at most 100
Memberships and 100 Projects and reports explicit truncation flags.
- Added centralized owner/developer/viewer Grant templates, PostgreSQL keyset reads, serializable
mutations and response-aware atomic audit/idempotency commits.
- Added an expand-only Organization audit scope migration and five repeated
disposable PostgreSQL proofs for cross-replica replay, isolation, developer
Project creation and over-limit Current User behavior.
- Replaced per-Project Environment reads with one bounded set-based query after
a Low/P3 CWE-400 security-diff finding.
- Kept the API local and unpublished; remaining E3 resource families and all
external gates remain incomplete.
## 2026-08-28 — E3 Project lifecycle candidate
- Added exact Project list, detail, update, archive and Environment-list
contracts from the same canonical OpenAPI source.
- Added owner-scoped repeatable reads and serializable update/archive services;
every mutation commits its audit and replay result atomically.
- Added soft archive semantics that preserve facts while deleting/disabling the
Project and its test/live Environments at the resource-state layer.
- Kept the API local and unpublished; the other E3 resource families and all
external gates remain incomplete.
## 2026-08-28 — E3 atomic Project commit candidate
- Added a response-aware Project application service that commits Project,
test/live Environments, allow audit and exact idempotent HTTP result in one
serializable PostgreSQL transaction.
- Made both memory and PostgreSQL completion idempotent only for an exact stored
response, so post-commit readback cannot rewrite or diverge from wire bytes.
- Added unit and real PostgreSQL proofs for commit ordering, byte-identical
cross-replica replay and rollback without leaked domain/audit rows.
- Kept the API local and unpublished; remaining E3 CRUD and all external gates
remain incomplete.
## 2026-08-28 — E3 HTTP kernel candidate
- Added generated Go metadata for all canonical Control API route policies and
Error Envelope definitions.
- Added the local fail-closed Control API kernel with request IDs, policy hooks,
bounded JSON, deterministic in-process idempotency and encrypted opaque
cursors.
- Kept every public operation draft and unpublished. Domain handlers, durable
idempotency, deployment and public availability are not part of this entry.
## 2026-08-28 — E3 durable Project creation candidate
- Added exact canonical schemas and a local HTTP binding for Project creation.
- Reused the E2 membership, serializable Project/test/live and append-only
audit authority behind the handler.
- Added hashed PostgreSQL idempotency with cross-replica replay, conflict,
abort, lease takeover and fencing semantics.
- Kept the API unpublished; remaining resource handlers and all external-state
acceptance are still incomplete.
# 2026-09-03 — Empty-repository JavaScript Quickstart local proof
- Added an executable local JavaScript Quickstart that installs the private SDK
candidate plus pinned WebSocket transport into a fresh repository and runs
canonical dictation against an ephemeral loopback fixture.
- The proof persists no PCM, transcript, ticket or user content and makes no
external request. Staging, hosting and public package publication remain
unexecuted or unauthorized.
# Data Sync independent writer/recovery boundary controller — 2026-09-24
Added a concrete `DurableBoundary` over an external durable authority port.
Writes now bind generation, object key and content digest before OSS I/O and
persist committed, rejected or unknown outcomes; an unknown result or missing
settlement keeps recovery closed. Recovery cuts bind writer fence, in-flight
drain, storage evidence and distinct normal/recovery principal digests. The OSS
adapter now uses separate writer and recovery clients, and recovery checkpoints
preserve the new evidence. Cross-instance Go race tests pass. The authority
adapter, real credential revocation/drain and OSS provider behavior remain
`NOT-RUN — requires authorized Staging environment`, so W05 remains 5/6 (83%).
## 2026-09-24 — Immutable Room service identity
Room creation now accepts `service_kind=task_voice|rtc`. The task default keeps
its existing single-participant and Consent semantics; RTC permits 1 through
100 participants. Generated Go/TS/C contracts bind the service and capacity.
Migration 77 preserves old rows and prevents changing a Room's service type.
Task WSS issue/resume and Gateway admission reject RTC Rooms. RTC connections,
media and Agents remain unavailable pending their implementation and validation.
# 2026-09-24 — Neutral Room contract correction (unpublished)
Room creation and resources no longer use `service_kind` to choose task voice
or RTC. Both services retain separate operations and credentials on a neutral
logical Room; capacity is shared, RTC quota attribution follows RTC bindings.
Obsolete selectors are rejected rather than aliased. Generated contracts follow
the canonical schema. Local validation is in progress; see ADR-059 and the active
M1 ledger for evidence and remaining gates. No SDK or cloud readiness is implied.
## 2026-09-25 — LiveKit upstream-native architecture amendment
- Adopt the full-stack authority, exact component-role mapping, candidate matrix,
bounded read-only checker and existing PRE-PACKET qualification requirements.
- Isolate JavaScript RTC native operations behind one private adapter and version
signed participant observations before durable business projection.
- Add the mandatory self-contained architecture review and preserve original
failure/source-bound test evidence. No product-completeness, Staging, device
or Production claim; continue the existing GX03 sequence.
## GX03 actual authority child productive drain correction — 2026-09-27
The worker scheduler correction is now verified in the actual process lane. The coordinator keeps the existing ordered source, processing, native-removal and effectiveness owners, gives each one its existing bounded cycle, and continues only when a complete round claimed work without an error. A productive burst stops between complete rounds at the existing discovery limit (32 rounds) or after the existing 6-second cycle budget; idle, error and cap paths retain the coarse interval. This is a between-round scheduling bound, not a total wall-time or freshness SLA, and it does not renew or extend authorization.
The controlled command race passed the new productive-drain cases (5 events / 2 roots) and the affected existing runtime suite (14 events / 6 roots), with no failures, skips, source drift or owned cleanup errors. The formal worker was rebuilt from schema 106 with zero overlays (1630 inputs; worker SHA 77ede512a4db182cfb8f5004116ec99d2f2ea22c8b51c373578a8037fb0e18e8, runtime source SHA 3ee65c0ff0d6f30678abf10797574ee1477407325d55e7ad5f9b4b13f7b34004). The actual PostgreSQL/native child gate then passed both TestPostgresRTCAuthorityHostProcess and TestPostgresRTCNativeHostAuthorityProcessEffectiveness (2 events / 2 roots, no drift/skip, owned container and network cleanup). The native host remained the exact current SHA ab81c73c47c88252bfcd08a68e6dd1308783cc784e5c7024e84d2d0bd5b49c1f.
The actual effective root recorded the original-SID callback before effect, kept official absence alone pending, proved the live incarnation's applied source cut, and left financial quota unchanged. Its setup source drain still measured 8011ms for two pending exports; productive draining kept the consumer alive, while the original freshness rule remained unchanged. This does not establish a six-second source-drain SLA, node-wide capacity, Staging or Production qualification. The final exact source commit, critical-check reruns and final architecture review remain pending. [Source-bound effectiveness checkpoint](../development/evidence/m1-native-revocation-effectiveness-2026-09-26.json).
## M1 v3 GX15 terminal runtime local qualification — 2026-09-27
Bound the current `codex/m1-v3-execution` source at `3c014b542484ddedf03aa4f29d3c0239e7223975` and qualified the existing Task terminal, receipt replay, late-input fencing, bounded recovery and Usage settlement paths with `278 pass / 0 fail / 2 required skip` under offline race tests. The two PostgreSQL-backed application tests remain required skips without `ONESAY_TEST_POSTGRES_DSN`; durable Artifact/receipt/outbox integration, Provider canary, Staging, Production, cloud and hardware remain unqualified. No architecture boundary or LiveKit patch surface changed. [Source-bound terminal evidence](../development/evidence/m1-v3-gx15-terminal-runtime-3c014b54.json).
## JavaScript Quickstart offline installation — 2026-09-28
The isolated Quickstart installer now supplies the SDK's complete pinned
dependency closure from local archives, including required peers. A new empty
store no longer relies on an already warmed LiveKit cache. Package lifecycle
scripts remain disabled, product pins are unchanged, and missing or conflicting
local lock inputs fail closed. This does not publish a package or qualify cloud
execution.
## Installed Task/Usage qualification mode — 2026-09-28
The local Task/Usage fixture can select an independently installed OneSay
candidate. Installed files, package provenance and cleanup are verified before
and after execution; invalid or missing installed inputs fail without falling
back to a source build. The default source SDK fixture remains available.
This changes qualification tooling only, not a public SDK API or Task protocol.
## 2026-09-28 — GX17 package/recovery boundary qualification
Closed the remaining local GX17 package and recovery boundary weights with exact-source static evidence at cc2aedaec696979bfb70f7eb3a9c912ca2e33a2b. The package boundary preserves the private, nonpublishable Control-backed Task product surface and excludes native/RTC exports; the recovery boundary preserves one checkpoint owner, scope-fenced resume/replay, bounded audio overflow and single-use connection material. No runtime or upstream patch surface changed.
## 2026-09-29 - GX18 target build diagnostics
Recorded the task-only ESP32-S3 OEM build with cached local dependency resolution
and the separate original-project offline git-fetch failure. No joint Task/RTC,
hardware, live Provider or cloud qualification and no progress credit is claimed.
The pinned IDF build runner now skips optional update probes, verifies complete
managed-source checksums, uses the bounded watchdog and preserves raw logs.
A TLS12-only `--oem` mode builds the original OEM project with its exact Git lock.
No SDK runtime, LiveKit patch or progress denominator changed.
## 2026-09-29 — GX18 C cancellation and pinned target qualification
Verified the repaired original OEM build at exact source 30a307c7. Added real C
regressions for late partial/final/completed results after cancellation with
unacknowledged audio, legal positive controls and explicit zeroized release.
Existing runtime semantics remain unchanged; native backend, joint RTC and
hardware qualification stay separate.
## 2026-09-29 — Task PCM and result ownership
Clarified the existing ESP32 Task caller/SDK buffer and transport lifetimes.
Added C tests for admitted PCM copy after send failure, exact replay, ACK erasure,
bounded result dispatch and independent caller result copies. Runtime and ABI
remain unchanged; real backend and hardware qualification stay separate.
## 2026-09-29 — Native Task integration readback
Recorded 152 actual local native Task integration cases at exact source713b5143,
including both TLS profiles and native HTTP/JS Control paths. Updated stale SDK
qualification wording and retained explicit Provider, hardware, joint-build and
cloud limits. Application result callback observation remains a separate gap.
## 2026-09-29 — Native Task application callback proof
The private C peer now observes actual SDK result callbacks after queue delivery,
retains bounded caller copies and proves their explicit release. The native
runner verifies partial/final and cancelled paths across both TLS and Control
profiles. SDK and runtime behavior remain unchanged.
## 2026-09-29 — ESP32 Task SDK delivery
Added a consolidated Task SDK integration and qualification guide covering
borrowed/copied buffers, application result callbacks, sample/UTC clocks and
resource release. Recovered and verified the existing source-bound build and
native evidence assets; no native test rerun or runtime change is claimed.
The scoped core/port delivery milestones are complete. Joint Task+RTC build,
OEM example, RTC media, real Provider, hardware and cloud qualification remain
separate; the next execution cursor is GX18.build.
## 2026-09-29 — Task-private native dependency isolation
Moved the existing Task native dependency adaptations into five private targets
with a verified complete symbol namespace, preserving shared upstream targets
and the single IDF PSA startup. Requalified both target TLS configurations,
both native TLS profiles and the 152-case local Task regression; affected Node
and real Linux ELF build-tool tests also passed. Public Task behavior is unchanged.
GX18.build remains open with no progress credit: joint LiveKit/IDF crypto
compatibility is separately unresolved, and no replacement candidate is activated.
The source-packaging supplement records two build files normalized to LF,
fresh scoped Node/ELF checks and unchanged original native qualification bytes.
Eight explicitly attributed historical empty stderr logs retain the existing
raw-evidence format exemption without editing their bytes or weakening source
and prose checks. No target/native rerun or progress credit follows.
## 2026-09-29 — Exploratory joint audio build evidence
Archived an audio-only ESP32-S3 candidate compile/link with real Task and
LiveKit symbols, bound to ea622336 plus explicit scratch overlays. The current
5cf1308b Task-private product implementation is a separate source checkpoint.
Original joint/video failures and offline second-configure failure remain
preserved. No product pins or configuration changed, no runtime qualification
is claimed, and no progress credit is added. Existing GX18.build work continues
with canonical Component Manager configuration and current-product integration.
[Source-bound candidate evidence](../development/evidence/m1-v3-gx18-joint-audio-candidate-ea622336/index.json).
## 2026-09-29 — ESP-IDF WebSocket dependency identity checks
The target build checker supports both observed short and canonical dependency names while retaining the exact upstream Git pin. It rejects duplicate aliases, substituted sources and lock/build path mismatches. Forty-two affected tests and real configuration readback passed. SDK behavior, pins and CLI defaults are unchanged; this does not qualify the pending joint RTC product build.
## 2026-09-29 — Conditional ESP32 Task / RTC component builds
The local OneSay component owns conditional RTC dependencies, an explicit audio/security profile and resolved-configuration rejection checks. Task-only and the internal RTC audio candidate both compile/link in independent consumers; private Task native adaptations leave the upstream targets intact. Fresh selected Linux Task TLS12/TLS13 regression also passes after canonical dependency identity support. [Evidence and scope](../development/ESP32_TASK_NATIVE_ISOLATION.md). GX18.build closes its local build scope; RTC API/runtime, candidate promotion, hardware and cloud acceptance remain separate and unclaimed.
## 2026-09-29 — Independent ESP32 OEM Task example
The standalone Task example now uses public Control and typed room/task WebSocket operations, bounded PCM/result ownership and explicit cleanup. A local-component exporter removes repository-private paths. Actual ESP32-S3 compilation and Linux native normal/cancel/network-failure checks passed; physical hardware and cloud qualification remain open. [Evidence and integration](../development/ESP32_OEM_TASK_EXAMPLE.md).
## 2026-09-29 — Local Task / Python composition qualification
- Added a fixture-only installed OneSay SDK → actual Python worker → durable Artifact/Usage regression, with process reaping and no-fallback observations.
- Preserved default fixture behavior and external qualification boundaries; see [local scope](../development/TASK_END_TO_END_LOCAL_QUALIFICATION.md).
## 2026-09-29 — Task Python cancellation and socket recovery qualification
- Verified the actual installed SDK and existing Python worker across cancellation/resume, lost ACK and replay of one omitted frame with durable single-result/Usage checks.
- Retained the normal 80 ms regression and explicit synthetic Provider, WS/WSS and external-qualification boundaries; see [local qualification](../development/TASK_END_TO_END_LOCAL_QUALIFICATION.md).
## 2026-09-29 — Task cancelled-cost concurrency qualification
- Connected an existing Provider-receipt/cancel lock-order test to the actual Usage projection and settlement services, proving internal cost retention, zero customer billing and concurrent replay uniqueness.
- Reused existing terminal/fee regressions with explicit PostgreSQL versus memory evidence boundaries; see [qualification](../development/TASK_TERMINAL_COST_CONCURRENCY.md).
## 2026-09-29 — Private Task HTTPS process entrypoint
- Added `cmd/task-worker` around the existing authenticated Task runtime, with bounded explicit configuration and existing joined shutdown.
- Qualified the actual Linux pre-Provider lifecycle, TLS/service authority, canonical Consent cancellation and durable zero-billing result.
- Documented exact private credential projection and static route enablement limits in the [command contract](../development/TASK_WORKER_COMMAND.md); complete stack and external gates remain open.
## 2026-09-29 — Actual five-process Task qualification
- Exercised public Control/Consent and WSS against the actual Task HTTPS executable, alongside real maintenance and Usage work.
- Preserved the existing synthetic-Task regression and explicit no-PCM/Provider/cloud limits in [local qualification](../development/TASK_FIVE_PROCESS_LOCAL_QUALIFICATION.md).
## GX11 packaged Task image local qualification - 2026-09-29
The Task image now has a source-bound local qualification using the pinned
Python 3.14.7 base, packaged static Linux binaries and the private stdin
entrypoint. The final image passed 14 Python launcher tests and 24 Go events,
including five-process lifecycle, manifest rejection, malformed configuration,
SIGTERM join and cleanup. The run stayed non-root with a read-only root and
`/tmp:noexec`; the qualification harness used a separate disposable exec
tmpfs. Provider, RTC/Agents, cloud, Staging, Production and hardware remain
NOT-RUN. This prerequisite adds zero M1 v3 credit. [Evidence](../development/evidence/m1-v3-gx11-task-image-3fc9c64b/).
## GX11 local network contract qualification - 2026-09-29
Added a read-only source-bound audit for the canonical LiveKit lock/matrix and
local deployment boundary. The isolated loopback fixture, digest-pinned images,
two authenticated Redis processes, owned cleanup and focused 13-case test set
all passed. GX11.network receives 9.6/12 local points; DNS/TLS/UDP/TURN,
Staging, Production and hardware remain NOT-RUN. [Evidence](../development/evidence/m1-v3-gx11-network-cdf7be03/index.json).
## GX11.data current-source migration and recovery qualification - 2026-09-29
The current migration receipt validates 108 ordered migrations, generated
artifacts and 31 migration contract tests. Owned PostgreSQL 17.6 durable-state
and recovery-reconciliation profiles passed and cleaned up. Historical backup
receipts remain source-bound and are not rebound; cloud backup inventory, PITR,
OSS/KMS fencing, Staging, Production and hardware remain NOT-RUN. [Evidence](../development/evidence/m1-v3-gx11-data-50e3624b/index.json).
## 2026-09-29
- GX12 local security/metrics qualification is now recorded against source
`6ee2869b2420c8f37603aa9eb7497d737be16b99`. Security contracts pass 35/0/0;
bounded observations retain HTTP 5/0/0, rate 20/1/0, WebSocket 10/1/0 and
auth/revocation 10/1/0. Stale source-bound dispatch guards remain explicit
failures, so no full CCR-B or cloud qualification is claimed. Ledger progress
is 551.7/1200 = 45.9%; see
`docs/development/GX12_SECURITY_METRICS_LOCAL_QUALIFICATION.md`.
## 2026-09-29
- GX13.external now records a current-source local handoff packet check.
E10 BOM, execution-readiness and specification checks pass; modeled cost is
USD 30.6 with pending quotes/readbacks/decisions, `purchase_authorized=false`
and zero cloud validations. CCR readiness remains fail-closed on stale
historical source digests; no external qualification is claimed. Ledger is
556.1/1200 = 46.3%. See
`docs/development/GX13_EXTERNAL_LOCAL_QUALIFICATION.md`.
## 2026-09-29
- GX13.runbook now records the local deployment, rollback, service maintenance,
fault-evidence and external handoff procedure using existing pinned assets.
Candidate replay and all cloud/Staging/Production/Provider/hardware gates
remain `NOT-RUN`; no deployment mutation was attempted. Ledger progress is
558.85/1200 = 46.5%. See
`docs/development/GX13_DEPLOYMENT_RUNBOOK.md`.
## 2026-09-29
- GX13.replay now records current-source bounded Linux stack readiness and
official native two-node foundation evidence. The full candidate
install/upgrade/drain/rollback replay and OneSay admission/media,
Provider/Agent, cloud and hardware gates remain `NOT-RUN`. Ledger progress
is 565.45/1200 = 47.1%. See
`docs/development/GX13_REPLAY_LOCAL_QUALIFICATION.md`.
## 2026-09-29
- GX14.candidate now records an exact clean source/content snapshot bound to
`0d8b6652fd78cffe61307411f2c5dd9265cf4bd3`: 10,900 tracked paths,
10,900 content hashes, docs/secrets/authority/diff/spec checks PASS and no
raw-audio pattern. GX13 complete candidate replay, GX14 gates and all
external gates remain `NOT-RUN`; Ledger progress is 568.75/1200 = 47.3%.
See `docs/development/GX14_CANDIDATE_LOCAL_SNAPSHOT.md`.
## 2026-09-29
- GX11.stack now has a source-bound single-host non-HA profile and fail-closed
checker covering the five Task commands, Platform LiveKit policy host,
PostgreSQL and two isolated Redis roles. Public traffic and external networks
remain disabled; Agents and Provider are explicit `NOT-RUN`. The profile
receipt adds 8.25/15 local boundary and implementation-build points, moving
Ledger progress to 577.0/1200 = 48.0%. See
`docs/development/GX11_STACK_LOCAL_PROFILE.md`.
## 2026-09-30
- ESP32 offline tracking now rejects SDK dependencies that diverge from the
canonical LiveKit pin, private visibility or RTC condition, including
source overrides and mixed-case aliases. Dependency pins are unchanged.
- Added durable RTC effectiveness worker replacement regression and corrected
healthy-history test heartbeat ordering before immutable cohort capture.
Final local race suite: 23 pass, zero failure/skip. No production timing or
native patch change; cloud/hardware qualification is not claimed. See
[evidence](../development/evidence/m1-v3-local-recovery-pin-binding-24c1ba90/).
- Repaired the historical evidence storage/format mismatch while preserving
original digests and authentic empty command outputs. The full format gate
and five targeted regressions pass; runtime/source qualification is unchanged.
[Proof](../development/evidence/m1-v3-historical-bytes-c93a0fd4/repair.json).
## 2026-09-30 — Explicit ContextSnapshot public delivery
- Added immutable scoped ContextSnapshot create/read operations, closed bounded
input, server-derived ownership and atomic encrypted idempotency completion.
- Unified current read authority for direct reads, private replay and typed Task
inputs, including Human explicit denies and nonhuman partial resource denies.
- Preserved historical item JSON and null unknown event times; documented shared
HTTP structural limits and regenerated canonical consumers.
- Local selected checks: 126 context race events, 201 HTTP events, 19 Node tests,
all zero failure/skip; TypeScript SDK compilation passes. Historical failed
attempts and exact source bindings are preserved in
[evidence](../development/evidence/m1-v3-context-snapshot-public-8e67b34a/index.json).
Provider semantic consumption, terminal composition, full CI and external
qualification remain separate. [Guide](../guides/CONTEXT_SNAPSHOTS.md).
## 2026-09-30 — Context-bound cancellation composition evidence
Added one real PostgreSQL integration scenario joining public context/Task
creation, existing deterministic Provider PCM, public cancellation/replay,
late-input and replacement-worker absorption, and durable Usage release replay.
Linux race: 2 pass events (parent + one subtest), zero failure/skip; owned cleanup
verified. No production behavior or new progress credit.
[Source-bound evidence](../development/evidence/m1-v3-context-pipeline-d3a6b005/index.json).
The context guide now explicitly distinguishes durable binding from unfinished
Provider content projection. Full CI and external qualification remain separate.
## 2026-09-30 — Exact local stack role/configuration mapping
Replaced the unusable common private config reference with explicit Task,
native-policy, PostgreSQL and Redis launch/file bindings. Existing profile
validation now consumes the same mapping and rejects unsafe role/source/env
substitution. Binding/upgrade regression: 45 pass, zero fail/skip; no service
startup or new progress credit claimed.
[Runbook](../development/GX11_STACK_LOCAL_PROFILE.md) and
[source-bound evidence](../development/evidence/m1-v3-stack-private-bindings-9362a6cd/index.json).
## 2026-09-30 — Real Linux private files and enabled stack startup
Added strict Linux private-file checks and reused existing Control/Task/native
fixtures for actual nine-container startup and normal shutdown. File tests:
23 pass, zero fail/skip. One actual stack fixture verified all nine normal
exit-zero stops and durable native consumer close; owned cleanup left no
containers or volumes. Earlier failed attempts remain archived. Scope excludes
full Task/RTC, continuous revocation, Agents/Provider, upgrade and external gates.
[Runbook](../development/GX11_STACK_LOCAL_PROFILE.md) and
[source-bound evidence](../development/evidence/m1-v3-stack-owned-runtime-f98e7c23/index.json).
## 2026-09-30 — Fixed two-native-node local stack
Added a narrow overlay reusing the singlehost launch bindings and file checker.
Ten actual containers passed startup and normal shutdown; two independent
native consumer lifetimes and the surviving node's fresh reporting were read
back from the actual Control/PG authority. All thirteen private files remained
unchanged and no owned container/volume remained. Static mapping: 67 pass;
Linux file checks: 30 pass; actual fixture: one pass, all zero fail/skip.
Empty-node drain only; full upgrade, active-participant/media, Provider and
external qualification remain open. [Runbook](../development/GX11_STACK_LOCAL_PROFILE.md)
and [exact receipts](../development/evidence/m1-v3-stack-twonode-runtime-8e808251/index.json).
## 2026-09-30 — Scoped active-participant native drain
Added test-only graceful-signal observation and a real two-native-process fixture.
The original A participant remains ACTIVE during upstream drain; A exits normally
after voluntary departure while B preserves its original ACTIVE SID and signed
fresh reporting. Exact participant terminal outcomes and owned cleanup were read
back. Four roots plus three ActiveLease cases passed (7/0/0); the deliberate
receiver-outage case retains its required native exit-1 negative-control result.
The actual authority-child lane and isolated export/processing lane stay separate.
Both earlier failed attempts are preserved; the Consent setup ordering correction
does not claim a production concurrency fix or a proven SQLSTATE.
No production runtime or LiveKit patch change. No new progress credit; complete
stack integration, restart/upgrade/rollback, media, Provider and external gates
remain open. [Drain runbook](../development/GX11_UPGRADE_LOCAL_CONTRACT.md) and
[exact receipts](../development/evidence/m1-v3-stack-active-drain-d04e854e/index.json).
## 2026-09-30 — Native restart and forward-source rollback fixture
Added a real Linux two-artifact, four-process native lifecycle test with existing
public admission, official SDK, persistent authority and unchanged migration ledger.
Original revoked material remains denied after rollback. Initial test quota is
selected at creation; immutable policies remain enforced. All three failed
attempts are retained. Intermittent rollback admission HTTP 500 remains OPEN;
the diagnostic PASS does not establish its cause or a fix. Scoped test passed
1/0/0; clean committed replay is pending.
No runtime/upstream patch changes, complete profile claim or new progress credit.
[Scope and evidence](../development/GX11_UPGRADE_LOCAL_CONTRACT.md).
## 2026-09-30 — Clean source native replay 340b425b
Fresh Linux builds and actual runtime tests against clean committed source
340b425bd316b3d8b3d7295729ba4b9e909eff5a passed the scoped four-phase native test (1/0/0)
and default fixture regressions (2/0/0). Five preflight checks passed. No runtime
changes or new progress credit. Historical intermittent admission HTTP 500
remains OPEN; complete profile and external gates remain unqualified.
[Exact-source receipt](../development/evidence/m1-v3-native-upgrade-clean-340b425b/index.json).
## 2026-09-30 — Native admission diagnostic observations 3100c2f6
Transparent test-only wrappers preserve existing service, transaction and HTTP
cache ownership; unit tests passed 6/0/0 and default native regressions 2/0/0.
Five predeclared lifecycle samples produced 3 PASS and 2 FAIL, observing
prepare_create/sqlstate_40001 and atomic_commit/sqlstate_40001. Two forced cleanup
failures remain explicit with zero residual resources. No production fix, HTTP
retry or progress credit; the prior unclassified HTTP 500 remains OPEN/UNPROVEN.
[Exact diagnostic evidence](../development/evidence/m1-v3-native-upgrade-diagnostics-3100c2f6/index.json).
## 2026-09-30 — RTC HTTP serialization recovery regression
Added six real PostgreSQL conflict/recovery cases at preparation and atomic
completion. Failed transactions leave no RTC business/protected-cache facts;
one explicit same-key request rereads current Grant/Consent. All 13 named tests
passed including diagnostic regressions. No runtime behavior or progress changes;
original native failures remain open.
[Exact receipt](../development/evidence/m1-v3-rtc-serialization-recovery-7e6f7790/index.json).
## 2026-09-30 — Actual Control mutation lifecycle regression
Added a Linux process test for public Project mutation, normal stop, refused
mutation with no durable effects, same-config restart and exact idempotency replay.
The process root and existing manifest/ELF guards pass 20/0/0. Original production
artifacts and source provenance remain unchanged after full non-test input equality.
No production behavior or progress changes; native failures and historical 500
remain open. [Exact receipt](../development/evidence/m1-v3-control-mutation-restart-69676367/index.json).
## 2026-09-30 — RTC deployment constructor configuration
Added explicit trusted deployment scope, private management and independent client
signaling configuration by composing the existing RTC scope, official management
client and protected cache owners. The restricted local constructor delegates to
this shared composition. Constructor and adapter unit checks pass 29/0/0; the first
protocol-fixture failure remains preserved. Actual Control RTC bootstrap, durable
Room preparation and hosted worker are still pending. No upstream patch or added
progress credit. [Exact receipt](../development/evidence/m1-v3-rtc-deployment-config-805f2dd1/index.json).
## 2026-09-30 — Explicit Control RTC configuration
Added strict rtc_connections disabled/singleton configuration and connected one
existing RTC owner to actual Control handlers, authorizer and protected replay.
Private policy/environment/cluster checks remain required; an optional observer
uses matching native credentials. Existing private JSON producers must include
rtc_connections: [] to retain disabled behavior. Fresh local checks: 155 unit and 25
actual-command named PASS (180/0/0 total). This is negative HTTP/configuration
qualification; durable first-Room preparation and Room worker remain pending.
No native positive path, public deployment or old failure repair is claimed.
No added credit. [Exact receipt](../development/evidence/m1-v3-control-rtc-binding-cd6dfa58/index.json).
## 2026-09-30 — Hosted durable Room worker
Composed the existing Room worker as a fixed fifth lane in the RTC authority
command, retaining the original four-lane order and six-second per-turn cap.
Added fixed content-free counters and deadline/cancellation/fairness tests.
Fresh local units56 plus actual-host2 pass58/0/0, including real native Room API,
normal restart and authorized repository close of fixture-created durable intent.
Public HTTP close is not qualified. Public first-Room intent/admission and whole-profile
integration remain pending; nativejoin/cloud are NOT-RUN. Prior native failures
remain preserved; no added progress credit.
[Exact receipt](../development/evidence/m1-v3-rtc-room-host-9deb87ae/index.json).
## 2026-09-30 — First RTC Room durable preparation
Added bounded preparation to existing fresh RTC create execution after current
authority and pending idempotency ownership. Worker readiness enables a new
fully authorized admission; preparation cannot consume Device Consent or create
a success response, connection or quota reservation. Local selected validation: 81/0/0.
Human actual-worker and signed Device in-process worker evidence remain distinct;
synthetic storage completion is storage-only. Deployed Control positive path,
full profile and nativejoin/cloud remain pending. Historical native failures and
zero progress delta are preserved.
[Exact receipt](../development/evidence/m1-v3-rtc-room-preparation-62d901ea/index.json).
## 2026-09-30 — RTC authority worker in local stack profiles
Packaged the existing RTC authority command and wired its private configuration alongside Control RTC admission. Singlehost/two-node profiles now use ten/eleven instances and twelve/fourteen private files. Local selected validation: 149 PASS, zero FAIL/SKIP; the earlier noexec fixture failure remains recorded. Positive RTC business flow, native media and cloud qualification remain pending.
[Exact receipt](../development/evidence/m1-v3-rtc-stack-composition-85d82624/index.json).
## 2026-09-30 — Actual Control RTC and ordinary-user Usage attribution
Fixed real API Usage attribution for authorized ordinary Application Humans without target organization membership using exact historical Grant and registered-client interval evidence. Added a real Control TLS/OIDC journey through public AppSession/Consent, cold409 Room intent, actual worker readiness, same-key201/encrypted replay and revoked original Grant denial. Selected Linux qualification: 76 PASS, zero FAIL/SKIP, including 46 Usage regressions and three migration checks; all 6 original failures remain separately preserved, including mandatory Control shutdown failure corrected only in the test lifecycle. Native join/media, complete-profile and cloud acceptance remain pending. Historical native five-sample FAIL and unclassified500 remain OPEN.
[Exact receipt](../development/evidence/m1-v3-control-rtc-positive-b49e8b61/index.json).
## 2026-09-30 — Scoped native lifecycle diagnostic qualification
Added test-only upstream pgx SQL-stage tracing and phase-local Room intents processed
by the actual authority child. Parent11a3b9ef plus four exact test files passed four
diagnostic tests and five native lifecycle samples, each with four phases: 9 named
PASS, zero FAIL/SKIP, normal dependency stops and zero owned residuals. Earlier unit
and failed native attempts remain separate; the original eight-second shutdown
failure and historical40001/unclassified500 risks are not resolved by this PASS.
No production fix, retry, native patch, full-profile/cloud qualification or progress
credit is claimed.
[Exact receipt](../development/evidence/m1-v3-native-sqlstage-11a3b9ef/index.json).
## 2026-09-30 — Actual Control/native signal admission
Added real Control-to-native integration using the original public JWT, actual
Room authority worker, official participant readback and exact identity/Consent/
quota audits. Selected local Linux tests passed27/0/0 with normal service stops
and zero owned residuals. The native ELF has explicit current source-equivalence
provenance. Only tests changed; full ten-role business integration, media and
external qualification remain open. No progress credit or historical-failure
resolution is claimed.
[Exact receipt](../development/evidence/m1-v3-control-native-41660f66/index.json).
## 2026-09-30 — Ten-role profile Task/RTC business qualification
The actual enabled profile now covers public Task cancellation and RTC signal
admission using the same final Control, Room and Environment, with separate Task
owner and ordinary-Human principals. Profile1 plus same-build regressions28
passed29/0/0; ten normal stops, twelve stable read-only private files and zero
owned residuals passed. PCM/Provider execution remains unqualified. Source binds
parent ebf9d2b8 plus six test overlays; native source-equivalent reuse does not
rebind historical results. Only existing stack.integration earns1.5 points:
stack90%, GX11 72.3%, total610.8/1200 (50.9%). Profile upgrade/rollback, stack
handoff, full media and cloud remain open; historical40001/500 risks stay OPEN.
[Exact receipt](../development/evidence/m1-v3-profile-business-ebf9d2b8/index.json).
## 2026-09-30 — Same-profile native signal drain and restart
Added an opt-in test-only seven-application restart journey to the existing
ten-role profile. One actual fixture passed1/0/0: retained original RTC signal
participant through native wait and official DeleteRoom, real stopped Control
mutation refusal with no durable effect, exact original-key replay, and successful
previously refused mutation after restart. The same containers/images and twelve
private files were retained; all seventeen lifetimes exited normally, both
consumers closed and owned residuals were zero. Parent2eb6d13a plus three exact
test files is not clean-SHA replay. Both pre-fixture Docker metadata FAIL attempts
remain preserved after independently proven runner-only projection corrections.
No runtime/upstream patch or points changed: upgrade55%, total610.8/1200=50.9%.
Forward upgrade/rollback and complete business admission stopping remain unverified;
prior GX03/revocation evidence is unchanged. Media and external qualification are
outside this receipt; historical40001/500 risks remain OPEN/UNPROVEN.
[Exact receipt](../development/evidence/m1-v3-profile-restart-2eb6d13a/index.json).
## Profile forward/rollback failure evidence — 2026-10-01
Added an opt-in actual ten-role A/B/A Task/RTC signaling qualification with unchanged
default helpers. Current run fails at fresh rollback admission (HTTP500); same-build
default regressions pass28/0/0. The failed profile, incomplete normal stop and zero
owned-resource residuals are preserved in the [source-bound receipt](../development/evidence/m1-v3-profile-upgrade-failure-cf9796c4/index.json).
No runtime, migration, SDK, Provider or native patch changed; no points added.
Next fix fixture failure-lifetime supervision and obtain request-correlated diagnostics.
## Request-scoped PostgreSQL diagnostics — 2026-10-01
Added an optional bounded pgx request-failure observer and existing-private-command
readback; Control supplies its trusted context RequestID. SQL, parameters, raw
errors and credentials are not retained. The connector, transactions, retries
and business authority remain unchanged. A test fixture barrier preserves real
services until normal shutdown after failure.
Actual PG diagnostics pass19/0/0. The real upgrade/rollback profile still fails
at admission; its request has a correlated40001 read/write dependency under
`sql_other`, with exact statement and primary/secondary propagation unresolved.
All24 lifetimes stop normally and owned cleanup is complete. [Source-bound evidence](../development/evidence/m1-v3-profile-requestdiag-a697afde/index.json)
preserves the separate outcomes. No concurrency fix, historical root-cause
attribution, new credit or external qualification is claimed.
## PostgreSQL statement failure classification — 2026-10-01
Expanded the existing closed PostgreSQL statement labels to53, at most26 bytes,
with unknown statements still mapped to `sql_other`. No SQL content, transaction,
retry or authorization change. Diagnostic tests pass19/0/0; the current signal
upgrade/rollback profile remains0PASS/1FAIL/0SKIP. Its exact request identifies
the authority-origin INSERT40001 and direct PrepareCreate-to-HTTP500 propagation.
Trigger-internal SQL, conflicting writer and SSI graph remain unknown; no fix or
historical cause is claimed. All24 lifetimes stop normally with zero residuals.
[Source-bound receipt](../development/evidence/m1-v3-profile-stmtdiag-c2c7aa32/index.json)
preserves both outcomes. Next reproduce that conflict and identify the writer
within the existing GX11 work; zero new credit or external qualification.
## Controlled RTC origin SSI reproduction — 2026-10-01
Added one real-PostgreSQL test using the actual Effectiveness owner and signed
admission in a second Room. The corrected run passes1/0/0 by requiring B's
committed effective receipt and A's exact origin INSERT40001 plus full rollback.
The initial whole-relation-lock assumption failed and remains separately
NOT_REPRODUCED; finite tuple/index observations replace only that assumption.
[Source-bound evidence](../development/evidence/m1-v3-origin-ssi-ce31f234/index.json)
preserves both attempts. Production, authorization, retries and LiveKit patches
are unchanged. No historical writer attribution, upgrade pass or new credit is
claimed; the production correction and actual profile rerun remain next.
## Bounded Human RTC origin recovery — 2026-10-01
Added one fresh authority attempt after Human origin INSERT40001 and confirmed
rollback, preserving the original deadline, idempotency owner and current checks.
ActualPG26/0/0 verifies recovery, revoked Grant/denied Consent/cancellation and
existing serialization/cold Room behavior. No Device, cold-intent, atomic-commit
or HTTP retry. [Evidence](../development/evidence/m1-v3-origin-retry-f78d80c4/index.json)
does not qualify full profile upgrade/rollback; clean committed-source replay is
next. Zero points, unchanged upstream patch and no historical failure rebinding.
## Upgrade fixture terminal context — 2026-10-01
Fixed final consumer cardinality readback to use its caller context after the business child ends. The narrow realPG/strict artifact suite passes24/0/0; [evidence](../development/evidence/m1-v3-stack-terminal-context-73f321f4/index.json). The clean73 profile reached three business phases but failed final readback; [both failed attempts](../development/evidence/m1-v3-profile-artifactbinding-73f321f4/index.json) remain preserved. Complete profile rerun on the fixture repair is pending. No new credit, production runtime change or external qualification.
## Ready admission transaction recovery — 2026-10-01
Extended confirmed-abort Human admission recovery to the ready preparation body, preserving one fresh authority transaction and its original deadline. [Actual PostgreSQL/regression evidence](../development/evidence/m1-v3-ready-retry-827f4a7f/index.json):31PASS/0FAIL/0SKIP, with prior failed fixture retained. The [clean827 full profile](../development/evidence/m1-v3-profile-terminalcontext-827f4a7f/index.json) failed rollback at held-seat40001 and remains FAIL. Complete clean-source replay on this correction is pending. No HTTP retry, native patch growth, new credit or external qualification.
## Local stack upgrade and rollback handoff — 2026-10-01
[Clean ed8 evidence](../development/evidence/m1-v3-profile-readyadmission-ed8b0e4c/index.json):23 artifact checks plus1 complete ten-role signal upgrade/rollback fixture PASS,24 normal lifetimes,0owned residuals. [Operator runbooks](../development/GX11_STACK_LOCAL_PROFILE.md#current-exact-source-operator-handoff) bind exact artifacts and recoverable runners; existing local upgrade and stack handoff milestones are complete. Prior failures remain unchanged. Media/Provider/Agents and external qualification are not provided; complete artifact dependencies/NOTICE/SBOM remain open.
## Exact Go artifact metadata — 2026-10-01
Added Linux-only read-only ELF/build-info and actual package-import-graph tooling. [Local evidence](../development/evidence/m1-v3-artifact-metadata-3f25ac4a/index.json):37Go/9Node tests PASS and eight exact prior-ed8 artifact graphs; no service runtime rerun. Preserved earlier failures and repaired absent same-version toolchain license metadata. Complete license/NOTICE/SBOM and multi-language image closure remain open, with no new progress credit or external qualification.
## 2026-10-01 — Selected Go notice collection
Added bounded Linux selected-Go-notice collection with 13 passing filesystem tests and eight actual source-bound artifact inventories. [Evidence](../development/evidence/m1-v3-selected-go-notices-93a4fce0/index.json). First-party license gaps remain explicit; upstream attribution cannot count as a OneSay declaration. No complete SBOM/legal clearance, runtime rerun or progress credit.
## 2026-10-01 — Selected Go module cache integrity
Added Linux selected-module integrity tooling using the existing pinned Go/xmod context. 37 named unit events passed; 179 actual module zip/tree/go.mod records matched original source-bound go.sum. [Evidence](../development/evidence/m1-v3-module-integrity-d0ddc6d6/index.json). No application dependency changes, cache repair, product runtime rerun, complete SBOM claim or added milestone credit.
## 2026-10-01 — Existing Task image Python inventory
Added source-bound Linux Python inventory tooling and 22 passing synthetic tests. Actual immutable Task image collection records pip/CPython metadata and notices; missing generated bytecode remains PARTIAL. [Evidence](../development/evidence/m1-v3-task-python-inventory-a11d62d5/index.json). No image rebuild, Provider/runtime change or extra progress credit.
## 2026-10-01 — Offline image catalogs and disabled Agents disposition
Recorded three existing image SPDX catalogs and disabled Agents source/selection evidence using official/existing tools. [Image evidence](../development/evidence/m1-v3-image-catalogs-2586b470/index.json); [Agents evidence](../development/evidence/m1-v3-agents-selection-2586b470/index.json). Preserved first coordinator/reader failures and blocked temporary-file cleanup. No runtime changes, complete SBOM/license claim or progress credit.
## 2026-10-01 — Current JS package and ESP32 source artifacts
Preserved the current reproducible JS candidate and15-package installed byte/notice inventory, plus the current103-file ESP32 source export. [JS evidence](../development/evidence/m1-v3-js-artifacts-2be4c943/index.json); [ESP32 evidence](../development/evidence/m1-v3-esp32-source-artifact-2be4c943/index.json). Kept the original JS cleanup assertion failure and PARTIAL license/integrity coverage explicit. No runtime changes or new qualification credit.
## 2026-10-01 — Model/configuration references and Bufbuild notice metadata
Required model/configuration source references and reused static launch projections in the artifact checker; eight targeted tests pass. Preserved version-bound Bufbuild external license bytes with prior reader failures; no package mutation, full integrity or legal qualification claim. [Reference evidence](../development/evidence/m1-v3-artifactrefs-587ecac5/index.json); [notice evidence](../development/evidence/m1-v3-bufbuild-notice-587ecac5/index.json). No runtime changes or new progress credit.
## 2026-10-01 — Current SDK integrity, target artifacts and selected provenance closure
Preserved current JS original-tarball/installed-payload integrity and actual ESP32 Task/RTC build, native boundary and selected NOTICE readback with earlier failed attempts intact. Joined existing source-bound artifact evidence and awarded the existing GX11.artifacts local_behavior 25 milestone (+3.5 points); integration/distribution and external qualifications remain open. Corrected the manifest-checker description to distinguish policy/path checking from secret-content scanning. No product source changes. [JS evidence](../development/evidence/m1-v3-js-integrity-2294ec7c/index.json); [ESP32 evidence](../development/evidence/m1-v3-esp32-current-build-2294ec7c/index.json).
## GX11 Debian notices and selected artifact delivery — 2026-10-01
Added bounded Debian notice collection and create-only candidate delivery/readback tools. Parent e9d53a565da31df39fd73ef7f2254310b4d3c6a3 plus exact source overlay:24 Linux collector tests and15 delivery tests pass; three existing images each87 installed packages/17 common-license paths/85 catalog hashes, and266 delivery members (38,731,360 bytes) independently read back. The original Node reporter parser failure remains preserved and was reconciled from logs without test reexecution. Source/status/partial coverage remain original; no complete OCI distribution, SDK runtime/hardware, legal clearance or cloud qualification follows. [Debian evidence](../development/evidence/m1-v3-debian-notices-e9d53a56/index.json); [delivery evidence](../development/evidence/m1-v3-artifact-delivery-e9d53a56/index.json).
GX11.artifacts reaches90%, GX11 90.4%, total622.6/1200=51.8%; the existing integration milestone adds1.4 points once and handoff stays open. Corrected the stale external Go metadata-access blocker using already verified179-module/eight-artifact evidence. No runtime/migration/SDK/Provider/LiveKit patch changes. Git Transition Status: current branch codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; local continuation only.
## GX11 canonical artifact operator and durable restore — 2026-10-01
Added verify/restore CLI entries and an [operator catalog](../development/GX11_ARTIFACT_CANDIDATE_HANDOFF.md).14 restore tests passed; three CLI cases observed the intended success/rejection exits. Actual restoration from persistent evidence produced the original266 members (38,731,360 bytes) and manifest byte-identically; independent CLI readback passed. [Evidence](../development/evidence/m1-v3-artifact-operator-fda4866d/index.json), SHA-256 5b6064d9593590436ce3b5d3a86afb6fed9316a7aa26108377189d8da5f14d36, retains parent fda4866dd964d0d54ca48bb9be4663ae50c3aa1c plus exact source overlay. No rebuild, runtime or historical evidence rebinding.
Narrowed ESP32's144 observations:139 IDF metadata absences already have license references,2 first-party metadata absences and3 NO_NOTICE items. Remaining first-party and exact dl_fft supplement scope stays visible. Full product handoff remains open; GX11.artifacts90%, overall622.6/1200=51.8%, zero extra points. Staging/hardware/Production remain NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; local continuation only.
## GX11 dl_fft notice supplement and GX01 source reuse — 2026-10-01
[Exact upstream notice evidence](../development/evidence/m1-v3-dlfft-notice-fda4866d/index.json), SHA-256 a19933b51e6bc75c81a8ee4b2ce1b8df25e07014c1608969e88c7dd2e9fa201e, preserves seven verified files at esp-dl commit1ab1e264d4270bfad6a45760ea19273dca0cedfc under the original fda4866d collector parent. The MIT component/root declarations and Apache-2.0 selected source headers remain distinct. Removed installed-volume bytes and original NO_NOTICE are not requalified; the supplement stays separate from the immutable266-file carrier. No named tests/build/package execution or legal completeness claim.
Corrected GX01.supply's stale proxy/cache next action: eight actual package graphs,179 effective module checks and selected multi-language/image notices already exist and are reusable. No duplicate credit is awarded. Owner first-party declarations and explicit partial inventory limits remain recorded; continue independent ready local work. Overall622.6/1200=51.8%,GX11.artifacts90%,GX01.supply17.5% unchanged. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED. External Staging/Production/hardware remain NOT-RUN.
## GX11 local logical backup and independent restore — 2026-10-01
[Source-bound evidence](../development/evidence/m1-v3-local-backup-7c401d81/index.json), SHA-256 07669ee12a260d488c58a5cca16d6fcefe036e81e8f8c9c64ac62911bc649143, records parent 7c401d81eecb511cd412a81e612a6128ae27d23c plus its exact frozen test/coordinator overlay. Actual PostgreSQL17.6 dump/restore between independent owned clusters passed1/0/0: all109 migrations,140 tables,5 sequences, logical schema/ACL/native role restrictions, post-backup write exclusion, and16-byte truncated-header rejection. Counts of database objects are not tests. Owned databases were removed; four containers exited normally and container/volume/network residuals were0/0/0. Migration registry/generated consistency checks also passed.
The first failed run remains0/1/0: native CHECK deparse grouping and explicit-default versus NULL ACL representation differed. The comparison now uses PostgreSQL-native precedence/ACL projections and retains raw observations. The first SQL diagnostic's uppercase sequence type was invalid; its original receipt remains and a new lowercase-s sequence diagnostic verifies added-grant/grant-option detection. No old result was rebound or converted to PASS.
The [fixed operator runbook](../development/GX11_DATA_LOCAL_QUALIFICATION.md) documents inputs, source binding, verification and owned cleanup. Existing GX11.data integration/handoff each add1.2 points once; data100% local, GX11 61.2/65=94.15%, overall625/1200=52.0%. Physical volume/PITR/offsite, arbitrary owner remapping, OSS/KMS/independent Privacy Ledger recovery and business cutover are not qualified. Staging remains **NOT-RUN — requires authorized Staging environment**; Production/hardware remain NOT-RUN. No production runtime, applied migration, SDK, Provider or LiveKit patch changed.
Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED. Continue existing dependency-ready local work without push, merge, new branch or CURRENT_HANDOFF refresh.
## GX13 selected Task image missing-config rejection — 2026-10-01
[Actual selected-image evidence](../development/evidence/m1-v3-task-missing-secret-9bd1ec9e/index.json), SHA-256 fbd91a26b916a400a0fbd824810ab4e8406658d321fb8d09116f6a7a45417c67, records six role argv selections rejecting absent private configuration at the real packaged launcher before starting Go children. All six naturally exited1 with the fixed sanitized diagnostic; one separate metadata probe verified absent config/public hashes. Seven containers were removed normally, residual0. These are six process observations,0 named tests/0 new points. The original ed8 image producer remains unchanged while the coordinator binds clean9bd1ec9e. An independent813-input byte comparison supports reuse without a rebuild or historical evidence rebinding.
GX13.replay stays55%, overall625/1200=52.0%. Full candidate replay, native/media/Provider and external qualification remain open. No product code changed. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push, merge, new branch or handoff refresh.
## Selected offline candidate import and isolated readiness — 2026-10-01
[Actual offline candidate evidence](../development/evidence/m1-v3-offline-candidate-a3d2416d/index.json), SHA-256 321620eb5f4bf75948903f1329240d91079adbb6c58a100a0cf75341f109b6db: five product/state images plus one qualification-only Node image were exported/imported through the 1,595,003,904-byte exact Docker archive. One default precompiled fixture passed1/0/0; ten role lifetimes stopped normally, with three TLS handshakes, native health, Usage readiness and zero owned residuals. This used a fresh namespace on an existing image store, not an empty daemon or business A/B/A replay. Coordinator a3d2416d and producer ed8b0e4c remain distinct. Original export/reader failures are preserved; required local tar/ELF bytes are hash-only in Git and must be retained. No runtime code changed.
GX13.replay stays55%; total625/1200=52.0%, points delta0. Continue complete candidate business cold-start/upgrade/drain/rollback using the delivered same artifacts. Full candidate/media/Provider/external qualification remains open. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Delivered offline Task/RTC business upgrade and rollback — 2026-10-01
[Source-bound replay](../development/evidence/m1-v3-offline-business-acac7ba3/index.json), SHA-256 e51fd6f4b4d873cd37435a1fff4c5447e8d4ac9488ed33fea9d0ab2dc3977d4f: original delivered artifacts passed Task-cancel/RTC-signaling A→B→A, one named test / zero failures / zero skips, 24 normal service lifetimes, three native consumers normally closed and zero owned residuals. Original revoked B material was rejected after rollback without refresh. Coordinator acac7ba3 and producer ed8b0e4c remain distinct. No product code or patch change; zero PCM/Provider execution and no full candidate/external qualification claim.
GX13.replay55%; overall625/1200=52.0%, zero new points. Continue existing GX12 prerequisites. Staging NOT-RUN — requires authorized Staging environment; Production/hardware NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Same-scope Task completion through native process failure — 2026-10-01
[Joint qualification](../development/GX12_JOINT_LOCAL_QUALIFICATION.md) and [source-bound evidence](../development/evidence/m1-v3-joint-native-failure-f37041bf/index.json) (d807fe78c7c6c63d54cfe0cf9a20bfbd399ef1acec425e7318cc49bffd28e20a): current Linux qualification with unchanged original product artifacts passed two named tests, zero failures/skips. Same-Room Task audio completed after exact owned native SIGKILL, with one Task settlement/terminal outbox and unchanged end replay. The original native-join normal-close regression also passed. Zero owned runtime/build leftovers and no published ports. The deterministic Provider fixture makes no external model calls.
GX12.joint boundary/build earns8.25/15=55%; GX12=49.375%; overall633.25/1200=52.7%. Complete RTC terminal settlement is still pending; an RTC reservation is not completed billing. No new gate or denominator; Staging NOT-RUN — requires authorized Staging environment, Production/hardware NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Public revoke after native failure preserves original liability — 2026-10-01
[Joint report](../development/GX12_JOINT_LOCAL_QUALIFICATION.md) / [source-bound evidence](../development/evidence/m1-v3-joint-native-revoke-9eb8efa7/index.json) (bf6810c3d40f4c71c67c788ecf13c8ade01d27cd41e619382d507a03069256fb): corrected actual local run2 pass/0 fail/0 skip; initial omitted-policy failure1 pass/1 fail/0 skip is preserved separately. Public Human Consent/revoke and same-key replay after native crash retain the exact RTC hold and single Task settlement; no billable RTC quantity or native effective-revocation claim. Only two test files changed, no product/runtime/patch changes. Zero owned leftovers.
Additional credit0; overall633.25/1200=52.7%. Trusted native measurement/RTC settlement remains pending. Staging NOT-RUN — requires authorized Staging environment; Production/hardware NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Actual Control RTC intent owners; prior Consent failure remains open — 2026-10-01
[RTC reuse and intent report](../development/RTC_GX05_REUSE_INDEX.md) / [source-bound evidence](../development/evidence/m1-v3-control-rtc-intents-b0157d50/index.json), SHA-256 d9ec059a48e44f21be16788e5314a49408c7e413f3c78f2a83ce950a3b4cdf40: parentb0157d50f857f3bf122159be8d62c09f7e1e9fd1 plus nine files; six fresh command ELFs and four qualification tools, original ed8 native provenance separate. Production bootstrap wires publication/subscription intent handlers, Authorizer and ReplayValidators to the existing RTCConnections owner. Actual Control/PG intent, protected replay and deny-all subscription CAS passed in the diagnostic26/0/0 run with zero owned leftovers.
Two25/1/0 failures remain archived: missing-Consent403 expectation corrected to canonical409; the later Task signal.open Consent decision500 remains UNKNOWN and was not reproduced, so joint stability is not closed and no fix is claimed. Public intent is not native media enforcement. GX05.publications80% and overall633.25/1200=52.7% remain unchanged, additional credit0. Native mapping/current subscription upper bound and real audio qualification remain unfinished; no cloud/scope/patch/migration/SDK change. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Bounded actual Control Consent failure diagnostics — 2026-10-01
[Diagnostic report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-control-consent-diagnostics-7dbb4938/index.json), SHA-256 2a86b75f19a35a2d90db57639ec8d3d59f059559e2934c27ea8b71a4337fa623: parent7dbb493889be2f30240da7b50411ea15fc61758a plus two test files. Local20/0/0 qualification covers bounded request-correlated private diagnostics, an expected fixture-injected40001 and rollback, plus the three existing regressions; no owned runtime leftovers. Existing production telemetry is reused; only the Gateway test ELF was rebuilt, with six prior commands/test2json and separate original native provenance preserved.
The historical Consent500 remains UNKNOWN/UNRESOLVED: injected failure and a passing regression do not establish its cause or repair. Runtime/migration/SDK/Provider/native patch are unchanged. No new gate, score or external qualification;633.25/1200=52.7%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
The first diagnostic attempt is preserved separately:16 unit passes, one actual-test failure, no skips, one package failure; the three gateway regressions were NOT-RUN. The test incorrectly reused the ordinary RTC rejection helper, which requires retryable=false, for an internal HTTP500 whose existing contract requires retryable=true. Only that new-test assertion was corrected to the exact safe internal error envelope; no production response or retry behavior changed. Both attempt sources, runners and receipts remain immutable.
## Native publication route and current publisher authority — 2026-10-01
[Route reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-native-publication-route-16d1461a/index.json), SHA-256 53f7d4b0a633c76f8eb773553619bdc84d9b311274d4122f453bd40321fd44a2: parent16d1461a7746ae0239a77d968d94bd7f24e3a92f plus private route implementation and actual PostgreSQL integration test. ReadNativePublication and RecheckNativePublication bind the existing server-issued handle to the exact native pair/current scope and generations; they remain non-authorizing and require the existing original publisher authority/final recheck. Local56/0/0 passes include wrong-pair isolation, lock order, changed snapshots, revoked/restored origin and stale-transaction rejection. Official LiveKit management is fixture setup only; native media remains unqualified.
No patch/migration/SDK/Provider/public-contract change or new completion credit; GX05.publications80%, overall633.25/1200=52.7%. Historical Consent500 remains unresolved. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Complete native subscription route — 2026-10-01
[Route reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-native-subscription-route-19d21010/index.json), SHA-256 4b8b0b20d4a3d668e96d04fabfdb1c4e904b026e27820f12f9c1faff8f8ed725: parent19d21010eb2a8dd122bc56c006a1477018ed9b7b plus two source files. Latest accepted subscription policy and the entire ordered target mapping now resolve through exact native identities and current generations; missing targets cannot become an implicit allow or empty success. Local70/0/0 tests passed with the existing subscription HTTP/authority regressions. This is non-authorizing SQL routing; original subscriber Consent/Grant and actual native enforcement remain separate.
No new completion credit; GX05.publications80%, overall633.25/1200=52.7%. Historical Consent500 remains unresolved; external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Public Control and two actual Gateway processes — 2026-10-01
[Task transport report](../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) / [evidence](../development/evidence/m1-v3-cross-gateway-resume-8dd023b9/index.json), SHA-256 b6baa6a67cfb2618d7147b26f471833a97d28615934069c07d8e8317cddfe54c: parent8dd023b9d0ccbe9555267b3ac3d561af5acc216d plus one actual-process fixture. Public Control admission/resume, two Gateway processes and the original live durable Task owner verify checkpoint transfer, old-connection fencing, duplicate audio handling and single terminal settlement. Both selected roots passed2/0/0; the separate five-process regression retains its narrower existing scope.
Runtime/protocol/SDK/Provider/native patch unchanged. Full transport fault qualification remains open; no new credit, overall633.25/1200=52.7%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Public resume-state loss and original Task continuity — 2026-10-01
[Task transport report](../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) / [evidence](../development/evidence/m1-v3-cross-gateway-resume-loss-32a6b869/index.json), SHA-256 f89003d9975d03de6ccf0de23dda4937c6829af6ddb9ef57597491c5611d9a4f: parent32a6b8690b9c682389283a71b90499a43afcc32e plus one loss fixture. Publicly issued resume material cannot recover a missing Redis record; the second real Gateway rejects it and preserves the original connection/Task owner. The original Gateway then completes that Task exactly once. The loss scenario and positive resume regression passed 2/0/0.
No production runtime/protocol changes. The existing transport integration 10% earns 1.2 points; GX15.transport 90%, GX15 81.6%, overall 634.45/1200=52.8%. Handoff remains open. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Retained original subscription authority and explicit policy-history gap — 2026-10-01
[RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-subscription-origin-proof-e34c0c61/index.json), SHA-256 24e9a722e2b5f05b9685b790b8715ea5e93f9edb964e554fdbb6406f2ae93028: parente34c0c61db32142efba7884b3055aff63471213b plus four source files. The existing subscription owner now retains real original Human/Grant/Consent and publisher authority and rechecks the whole policy in one bounded transaction. Temporary separate Grant denies also invalidate original public replay. Local84/0/0 includes one explicit test demonstrating the still-open Consent policy denied-then-restored history gap. It does not qualify that revocation case or native media.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Next: narrow subscription policy-history correction, native consumer/upper bound and real media qualification. Historical Consent500 unresolved; external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Subscription Consent policy history and forward upgrade — 2026-10-01
[RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-subscription-consent-fence-cdd66716/index.json), SHA-256 75d51fabb8f26f997ae966d14016f87ef0c6b547a025b523c242cb7e3a5d68c8: parent cdd6671644c6c1ef7b68923e67fc763cd2502c3f plus eleven reviewed source files. Migration 110 closes subscription Consent policy restoration for the local retained original-owner proof and protected public replay. A genuine 109 upgrade retains old NULL generations and rejects them without invented history; fresh authorized acceptance remains possible. Local 93/0/0 includes 8 fence, 1 upgrade, 14 origin and 70 affected regression events. Prior 84 evidence remains unchanged.
Additional credit 0; GX05.publications 80%, overall 634.45/1200=52.8%. Native consumers/upper bounds, authority-change propagation, actual media and RTC settlement remain unqualified; historical Consent HTTP 500 unresolved and external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Signed publication authority and nonrevival — 2026-10-01
[RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-publication-authority-3cd36adb/index.json), SHA-256 b1def55f38526e38660d3c7fc7c839d2c7719ee93232fe234df68dcbbba3195a: parent3cd36adb7958fd6dd465c08b17bcc85a46c07ab4 plus 16 reviewed source files. The closed signed publication query now composes original Human connection/publisher authority and current Service authority before committing an observation audit. Migration111 and existing Grant history prevent old publisher revival after Consent/deny restoration. Real109/110 forward upgrades preserve old provenance and require fresh current acceptance. Local qualification: 130/0/0; three fresh Linux artifacts, control-api compile-only. Native permission/media/propagation remain unqualified.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Historical evidence remains source-bound, historical Consent HTTP500 unresolved, external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Publication dependency preparation and original native close — 2026-10-01
[RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-publication-preparation-53d543aa/index.json), SHA-256 7fd1c7cb74b5a55a7ffd104893dcdcb714dada7ba1cad5b1b19531f6b3d724fc: parent53d543aa6a7281f30b22a19289e579d8e5ad24f4 plus27 reviewed source files. Explicit signed preparation now commits original publisher dependencies; migration112 reuses existing capture/export/processing and preserves old NULL epochs. Real Source withdrawal/restoration closes the original join-only native SID through the actual authority process and terminal ACK. Local runtime77/0/0 and separate static36/0/0; five fresh Linux ELFs, control-api compile-only. Media and native operation permissions remain unqualified.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Historical evidence remains source-bound, historical Consent HTTP500 unresolved, external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Signed publication preparation client — 2026-10-01
[RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-publication-preparation-client-a5680d1a/index.json), SHA-256 5bff05ea845f7c2df142a0657817c8701f50a05352e3d9340f6f817d5834491a: parenta5680d1a8f69145937654a3c3336a571cff0a3e1 plus3 reviewed source files. The closed signed client now consumes the real publication dependency owner through fixed TLS and one-use Service JWTs. Strict original binding/time checks, no automatic registration retry and bounded raw TCP cleanup are verified. Real publisher withdrawal/restoration cannot register new authority. Local runtime31/0/0; control-api compile-only. Native publish rights and media remain unqualified.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Prior native-close evidence remains bound to its original source; external qualification NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Original attached-lease publication preparation — 2026-10-01
[RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) / [evidence](../development/evidence/m1-v3-native-publication-preparation-6a12c810/index.json), SHA-256 a043d5dde0a402758287749f7a71c6e6e213ff2c491bc548012c4a02eecc0fb2: parent6a12c810a7bbf7e77ae422d30cb45771139121e8 plus7 reviewed source files. Original attached-lease preparation now consumes the closed signed client with exact instance/version/deadline checks and in-flight invalidation/cancellation rejection. Real restricted PostgreSQL/TLS tests verify committed publisher dependencies and one retained consumer/ordinal. Local47/0/0 across13 roots; control-api compile-only. Fixture SID/completion are explicit substitutes, not native presence/media or WaitClosed evidence. Existing upstream reuse limits and the required remaining publication guard are recorded without a new audit or patch change.
Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. Native publication/permission/media remain unqualified; old evidence is not rebound and external qualification remains NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Native publication guard, restricted Human profile and actual media — 2026-10-01
[Source-bound evidence](../development/evidence/m1-v3-native-publication-guard-0aae78c4/index.json), SHA-256 50391c3176b6bed0ae06dc041810cbf6d756be2fea773ed7f9db20a6b2102a7f, binds parent0aae78c4cc91eb560ab8d1a20a2094e362d8c4ff plus the exact corrected3 overlay and 851-file native source snapshot. Restricted Human microphone signaling now requires original-lease publication preparation before native mutation; Device and broader rights remain denied. Actual official-client track/RTP readback and Source-revoke/native-completion proof pass. Separate local vectors: native217/0/0, current race322/0/0, actual next-version replay423/0/0. Original corrected2 Consent-setup failure168/1/0 is retained; aggregate40001 is uncorrelated and general Consent-concurrency availability remains unqualified. The narrow fixture drain adds no retry or extended deadline.
The registered30-file patch reuses LiveKit media/runtime; its seven before/after metrics, exact candidate conflicts/resolutions, source cuts and limits are in the [RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md). Durable TrackSID/subscription/subscriber media/RTC settlement and external qualification remain open. Additional credit0; GX05.publications80%, overall634.45/1200=52.8%. This is affected local qualification, not full ci:local or cloud acceptance. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Public Task ticket consumed once across actual Gateways — 2026-10-01
[Evidence](../development/evidence/m1-v3-public-ticket-once-ac069618/index.json), SHA-256 ac6a74755cba02bbfba27b4ec74117bb0f3f33e00dfce891d983a463d3a62b07, binds ac069618 plus one test file. One public Control ticket raced through two actual Gateway processes yields exactly one welcome; PostgreSQL confirms one original-scope participant. Old-ticket replay is denied on both nodes while the admitted connection remains usable. New initial admission plus existing positive/lost-state resume regressions pass 3/0/0 with fresh Linux artifacts and verified owned cleanup. Protocol/runtime/SDK/Provider/LiveKit patch are unchanged.
The existing GX15.admission integration 10% adds 1 point after combining this proof with separately source-bound prior public API, identity and Device entry evidence; no inherited result is rebound or credited twice. Admission 90%, GX15 83.6%, overall 635.45/1200=52.9%; handoff, other Task/RTC product scopes and external qualification stay open. See [Task transport report](../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) for exact limits. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Claimed PostgreSQL completion response loss and terminal readback — 2026-10-01
[Evidence](../development/evidence/m1-v3-ambiguous-completion-8997e805/index.json), SHA-256 a5770663b2e4112a7a5e7adbe6125c9d0eafa939d7ebf78bbc965677f410dbb9, binds parent 8997e805 plus one test file. Actual PostgreSQL Complete commits before a wrapper loses its return; the production pipeline reads the terminal through a second independent connection, preserves its live final and invokes Provider once. Fresh pipeline and Usage compositions replay without duplicating Artifact, receipt, outbox, usage or quota commit. Current Linux race qualification: 23 named pass, 0 fail, 0 skip, six roots/two packages; the existing memory regression is separately labelled. Runtime/protocol/migration/SDK/Provider/LiveKit patch are unchanged.
The existing GX15.terminal local_behavior remainder and integration add 1.2 points: terminal 90%, GX15 86%, overall 636.65/1200=53.0%. Prior ca2fd7f/f63db12c/fd4a4d7b evidence retains its original SHA; no GX19/GX16 duplicate credit. See [terminal qualification](../development/TASK_TERMINAL_COST_CONCURRENCY.md) for exact scope. Handoff, broader Task/profile/Context scope, actual process/network faults and external qualification remain open. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Signed native publication producer facts and precise observation limits — 2026-10-01
[Evidence](../development/evidence/m1-v3-native-publication-webhook-c7e2180/index.json), SHA-256 c88503e335e6c8704497f434957a9c7a5e2c671e043d00f694e4d606b954af9b, binds parent c7e2180 plus two test files. Fresh Linux controlrepo.test and separately provenance-bound unchanged native artifacts run three affected roots: 3 named pass/0 fail/0 skip. Official signed track_published facts match the original Room/Participant/Track SID, prepared handle, Opus microphone and microsecond publication version. Original revoke/ACK and participant lifecycle regressions pass with verified owned cleanup. Durable publication remains prepared; no production runtime, migration, SDK, Provider or LiveKit patch changes.
Audio metadata can be SDP-fired before first RTP. The bounded sender is exercised, but metadata is not packet-arrival, capture-clock or quality proof. Exact-pin normalized negotiated format and native logical-time limits are recorded in the [RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md). Older receipts keep their original hashes/results. Durable projection/inbox, subscription/subscriber media and external qualification remain open. Additional credit0; overall636.65/1200=53.0%, GX05 61.8%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Finite signed publication adapter with preserved participant verification — 2026-10-01
[Evidence](../development/evidence/m1-v3-publication-observer-84132322/index.json), SHA-256 4c2df150fba8e762166df89d1b38bba8804691925b5a2f6cd83b08c0337c1433, binds parent84132322 plus four observer files. One official raw-body verification now supports opaque finite publication dispatch while retaining the existing participant entry point. The publication contract binds native producer/Pion pins, precise publication time and normalized Opus semantics; invalid ticks/time/shape are rejected and client metadata grants no authority. Current Linux race selection: 122 pass/0 fail/0 skip across observer, owned-TLS receiver and two pure receipt-value regressions, with exact source and normal cleanup checks.
The new publication path is not yet mounted; no database/native media or durable projection runs in this lane. Existing producer proof keeps its original SHA. See [RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) for scope and remaining original-attachment/inbox/projection work. Additional credit0; overall636.65/1200=53.0%, GX05 61.8%; external qualification remains NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/CURRENT_HANDOFF refresh.
## Original native publication attachment retained by the existing authority owner — 2026-10-01
[Evidence](../development/evidence/m1-v3-native-attachment-579080de/index.json), SHA-256 0185f44f14b05d97dabe5f95a8c1266e1216d42db9a914fe7b78bb5a3c4dbcd8, binds parent579080de plus the exact preparation/owner/migration/test overlays. The existing private Prepare and native lease now carry and recheck one required original attachment. The current authority transaction atomically retains its immutable first association with the checked snapshot; identical repeats retain it and conflicting/closed/terminal declarations fail closed. Migration113 is expand-only; prior migration bytes and the native patch remain unchanged.
Current selected Linux race and actual PostgreSQL qualification: 82 pass/0 fail/0 skip. This includes existing official Room management fixtures, not current patched native media execution. The original source-freeze preflight rejected hash drift before any snapshot/Docker/tests; its 0-test failure record is retained separately from the corrected2 first actual execution. The association remains provenance; signed publication dispatch/inbox/TrackSID projection is still open. See [RTC reuse report](../development/RTC_GX05_REUSE_INDEX.md) for exact limits. Additional credit0; overall636.65/1200=53.0%, GX05 61.8%. External Staging/cloud, Production, hardware and full ci:local remain NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/handoff refresh.
## Signed publication projection through original stored authority — 2026-10-01
[Evidence](../development/evidence/m1-v3-publication-projection-1996d718/index.json), SHA-256 f8285d5db4fe4853e9472606f3836d26f1d96144062e7d8a4a19e62b83e7e1f7, binds parent1996d718 plus exact receiver/owner/migration/test overlays. The existing signed lifecycle endpoint now atomically projects publication metadata using its first original attachment/snapshot and retained server authority; one immutable event namespace preserves participant history and rejects cross-kind conflicts. Original authority is rechecked around the existing canonical projection; failure rolls everything back. No native patch or public contract changes.
Corrected affected-package Linux race and PostgreSQL: 71 pass/0 fail/0 skip; the preceding159 passing observer/receiver/receipt tests remain source-bound and unchanged. The original200/28/0 failed lane and its three repaired fixture causes are retained separately; actual TLS is included, official Room management is setup only. Bootstrap compile-only is zero tests. Actual current native producer projection and subscriber media remain open. Credit0, overall636.65/1200=53.0%. Staging/cloud: NOT-RUN — requires authorized Staging environment; Production/hardware/full ci:local NOT-RUN. Git Transition Status: current branch retained, merge_main_ready NOT_READY, new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/handoff refresh.
## Actual native publication through the shared durable projection — 2026-10-01
[Evidence](../development/evidence/m1-v3-native-publication-projection-883f7ed2/index.json), SHA-256 ee5ac47d432b9962971d1c3c5547b7180897138cdb8119242b92899477694404, binds parent883f7ed2 plus two test overlays. Fresh offline Linux controlrepo.test, native host and authority-worker ELFs run the existing three roots: 3 pass/0 fail/0 skip/0 package failures. Only test2json retains its original tool provenance. The actual official native publication reaches the signed receiver, original consumer/first snapshot, shared event inbox and atomic canonical publication projection. Original close/withheld-ACK behavior, preparation-only and participant regressions are retained. After withdrawal the desired end is recorded while observed publication stays published; no observed media end is invented.
The original851/855 source-list mismatch is a preserved static freeze rejection with zero build/Docker/test execution. Corrected1 checks all855 files (851 module files plus4 provenance) and supplies the actual result above. This is not a product-test failure, received-media/Usage qualification or current full CI. Selective subscription and subscriber media remain the next existing work. No production or upstream patch changes in this test increment. Additional credit0; GX05.publications80%, GX05 61.8%, overall636.65/1200=53.0%. Staging/cloud: NOT-RUN — requires authorized Staging environment; Production/hardware remain NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/handoff refresh.
## Current original subscription authority and exact published targets — 2026-10-02
The private subscription-authority operation now returns the complete accepted zero-to-eight target set at its exact version, after original Human/Service, Grant/Consent, publication provenance and quota/deadline checks. Published targets require their original native attachment, first snapshot and verified inbox receipt. Same-transaction reuse removes repeated work while preserving each original snapshot's MVCC/time bounds and every publisher's historical deny checks. The 500ms product deadline remains fixed; failed final checks roll back the tentative audit and return no partial result.
[Evidence](../development/evidence/m1-v3-subscription-observation-704b52a6/index.json), SHA-256 cf733a5bc35b7648f264d37ee0cab8db2ea3ec1ec94fe9e2ac4b368f33c36820, binds parent704b52a6 plus 16 exact overlays: current Linux race PG **90/0/0/pkg0** (32 observer + 50 existing + 8 Service-set named tests), with bootstrap compile-only. Prior policy 484 PASS and seven failed attempts retain their own sources; they are not current reruns or additional credit. Detailed diagnostics are in RTC_GX05_REUSE_INDEX. This qualifies a control-plane observation, not native subscription/media, durable subscription dependency registration, Usage settlement, multi-publisher capacity or full CI. Staging/cloud: NOT-RUN — requires authorized Staging environment; Production/hardware/real Provider qualification remain NOT-RUN. Continue selective-subscription preparation, invalidation and native/media qualification. Additional credit: 0; GX05.publications: 80%; GX05: 61.8%; overall: 636.65/1200 = 53.0%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; no push/merge/new branch/handoff refresh.
## Original subscription dependency registration and captured-authority reevaluation — 2026-10-02
The existing private subscription owner now distinguishes Observe from explicit Prepare. Prepare commits rtc.native.subscription.prepared, the original subscriber/calling-Service snapshot and a finite zero-to-eight ordered target vector in the existing immutable authority graph; Observe still creates no dependency snapshot. Each target retains its original publication first-snapshot audit, migration113 native attachment and migration114 verified published tuple. No current request or client field can replace those original references or silently select a newer accepted subscription version.
Forward migration115 adds the immutable subscription capture epoch and finite snapshot branch, extends the existing captured source kinds with accepted subscription versions and subscription Consent fences, and reuses the current source-event/outbox/export/reevaluation machinery. Actual114-to115 upgrade fixtures preserve nonempty old graph/history without backfill, keep old records and the new epoch immutable, and verify only later real policy/Consent writes create new captured events. Existing migration bytes and immutable guards remain intact.
[Source-bound evidence](../development/evidence/m1-v3-subscription-dependencies-7000688c/index.json), SHA-256 54938c9b166e4d8fa58955eb7edef86b04715a6e830fa3a2299d262a30118e6c, binds parent7000688c4def87ee3261de1e350dd0bfabd83fa2 plus exactly28 reviewed source/test/migration overlays. The affected Linux race regression completed 625 pass / 0 fail / 0 skip / 0 package fail, with bootstrap compile-only (zero runtime tests), frozen-source match before/after and all owned resources removed. The executed affected regression selection is625 named/102 roots: the complete current private RTC policy package495/92 roots plus selected real PostgreSQL/controlrepo130/10 roots.
The separate focused corrected2 lane has actually completed37 pass/0 fail/0 skip/0 package fail:11 preparation HTTPS named cases and26 PostgreSQL/parser/upgrade named cases, with bootstrap compile-only zero tests, source-before/after match and zero owned resources after normal cleanup. The separate migration Node selection has39 pass/0 fail/0 skip. These overlapping focused/static results are not added to the625 selected regression as unique tests or progress.
The two-target union fixture uses two legally admitted, independent publisher principals/connections and a third receiver; it proves full selector union rather than a count-only assertion. The zero-target accepted policy remains deny-all. The eight-target fixture uses eight distinct publications from one original publisher connection; it is not multi-publisher capacity, concurrency or load qualification. Official LiveKit management is fixture Room setup only, and publication facts are signed fixture declarations consumed by the real projection owner.
The original focused lane remains FAIL31 pass/6 named fail/0 skip/1 package fail. Two fixture causes were repaired without changing product semantics: the three-identity fixture initial Room now agrees with its declared maxRoomParticipants3/quota while retaining the original180000 budget; the upgrade Consent fixture changes wording_version together with wording_text through the legal update. Corrected1 remains FAIL35 pass/2 named fail/0 skip/1 package fail, caused by the maximum-target observation exceeding its unchanged500ms deadline at commit. Diagnostic phase labels preserve that cause. No failed or unexecuted case is converted to PASS and both original source snapshots/runners/logs remain distinct. The subsequent narrow optimization reuses an already checked original Human connection AppSession lifecycle during initial subscription composition only within the SAME transaction, with exact scope, identity/session/client, connection/participant/generation/policy and live lifetime checks. A local distinct-connection map prevents repeating that same lifecycle per publication. Public publisher APIs still take the original nil-proof path; a private mismatch falls back to the original resolver. Every publication still checks its own app/room/source/publish Grant revisions and historical denial, Source, Consent/fence, quota and final original-authority constraints. Final rechecks and the500ms product budget remain unchanged; no retry, cross-transaction cache or relaxed authorization is introduced.
No native subscription capability or permission installation, subscriber presence, received RTP, effective revoke/ACK, SDK/audio-quality, RTC Usage/settlement, current full ci:local or actual patched-host result is claimed by this increment. Staging/cloud: NOT-RUN — requires authorized Staging environment; Production, hardware and real Provider qualification remain NOT-RUN. Existing native evidence keeps its original source binding.
Continue the existing GX05.publications cursor with finite native consumption of this registered subscription authority, pushed withdrawal/freshness and selective-subscription upper-bound enforcement, then actual native subscriber media and RTC settlement qualification. This registration proof advances the existing implementation; it does not complete native subscription integration or justify upstream patch growth.
Additional credit0; GX05.publications12/15=80%, GX05 61.8%, overall636.65/1200=53.0%. The current integration/handoff milestones, denominator and package order remain unchanged. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue locally without push, merge, new branch or CURRENT_HANDOFF refresh.
## Bounded signed subscription preparation client — 2026-10-02
SubscriptionPreparationClient reuses the existing owned private RTC HTTP transport, fixed TLS endpoint/Service route and one-use internal token manager. Prepare sends one native room/identity pair and an explicit positive accepted policy version to the already committed subscription preparation owner. It performs one bounded500ms call with finite capacity, a16KiB response ceiling and strict complete flat/nested decoding; it never retries a sent one-use registration or substitutes a newer policy.
[Source-bound evidence](../development/evidence/m1-v3-subscription-client-d8bf6159/index.json), SHA-256 b9bd8b8a82d499e0db9086b4bef7eae7f87a0d86df4c4c317497d1d3b3b4fd8f, binds parentd8bf6159083b2605f5de26fc3cea6dfa64f25b18 plus exactly three new files: the finite private client, its transport tests and the PostgreSQL HTTPS integration test. The affected Linux race regression completed 508 pass / 0 fail / 0 skip / 0 package fail, with bootstrap compile-only (zero runtime tests), frozen-source match before/after and all owned resources removed. The full current policy package executed503 named tests (495 existing names rerun on this source plus8 new client names); the new PostgreSQL selection is TestPostgresRTCSubscriptionPreparationHTTPS, with its final leaf vector 5 named (the root plus independent_publishers_commit_complete_union_with_fresh_requests, explicit_empty_policy_commits_complete_deny_all, eight_targets_over_actual_tls_remain_complete, and wrong_and_superseded_versions_write_nothing).
The dependency registration, original source/Grant/Consent/MVCC authority and actorless invalidation owner remain the implementation committed at d8bf6159. Their [previous evidence](../development/evidence/m1-v3-subscription-dependencies-7000688c/index.json) retains its own source and625 affected regression, separate focused37 and Node39 results; none is added to this increment's current counts or progress. No migration, upstream patch, runtime wiring, SDK, Provider or deployment change is introduced by these three new files.
Continue the existing GX05.publications cursor with native consumption of the registered dependency result, selective-subscription permission upper bounds, pushed withdrawal/freshness and actual subscriber media. The client is not yet wired to a native permission consumer. No native host/permission installation, effective subscription/revoke/ACK, received RTP, media quality, Usage/settlement, current full CI or cloud acceptance is qualified by this increment. Staging/cloud: NOT-RUN — requires authorized Staging environment; Production, hardware and real Provider qualification remain NOT-RUN.
Additional credit0; GX05.publications12/15=80%, GX05 61.8%, overall636.65/1200=53.0%. Existing milestone weights, integration/handoff credit, denominator and package order remain unchanged. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue locally without push, merge, new branch or CURRENT_HANDOFF refresh.
## Native subscription preparation on the original joined lease — 2026-10-02
The existing OneSay native admission backend now supplies a bounded PrepareSubscription callback on the original joined-connection watch. It reuses the committed signed subscription client and durable original publisher dependency graph, checks the same consumer/session/ordinal/native SIDs and current freshness before and after unlocked HTTPS, and preserves the complete ordered zero-to-eight target set. Every target must belong to the originally attached native Room. Preparation neither reenrolls a watch nor renews admission, authority, quota or freshness; it does not install native permissions.
[Source-bound evidence](../development/evidence/m1-v3-native-subscription-preparation-1592d75f/index.json), SHA-256 b4a5a6e17bcea500e9f31fb88df6dd0b406bb2da3f568e88f0f26c8fedee6648, binds parent1592d75fe0e5262d8a62d0f3f86ee1181cec3d37 plus exactly seven reviewed source files. The affected Linux race qualification completed530 pass/0 fail/0 skip/0 package fail: full current policy511 (503 existing names rerun plus8 new callback names) and real PostgreSQL19. Bootstrap completed compile-only with zero runtime tests; frozen source matched before/after, and normal cleanup removed all owned containers, volumes, anonymous data volumes and networks.. All530 current named outcomes and source/cleanup bindings are retained in the archive; bootstrap adds no runtime-test count. The previous d8bf6159 client508 remains historical source-bound evidence. Actual native subscription installation, selective media delivery, all-node subscription revoke/freshness timing, Usage/settlement and current full CI remain NOT-RUN for this increment; Staging requires an authorized environment. Additional credit0; GX05.publications12/15=80%, overall636.65/1200=53.0%. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue the existing reviewed cursor without push, merge, branch creation or handoff refresh.
## Task admission technical delivery — 2026-10-02
Completed the existing GX15.admission delivery mapping in [Task transport qualification](../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md#task-admission-technical-delivery--2026-10-02): public Control API, original one-use Task ticket, actual two-Gateway consumption, original identity/Grant scope and diagnostic entry points. The [delivery readback](../development/evidence/m1-v3-task-admission-delivery-10c58f7a.json) binds source parent `10c58f7acf4227bb80a9ef6bceefe0b423fb822d`, original receipt hashes and twelve selected unchanged entry/runtime/test files. Historical results keep their original source boundaries; this documentation/readback increment executes zero runtime tests and does not establish current full transitive qualification.
The existing 10% admission handoff milestone is accepted for1 point: GX15.admission100%, GX15 88%, overall637.65/1200=53.1%. No new gate, weight or denominator is introduced. Other Task profiles/Context/terminal, joint RTC, paid Provider, hardware and full CI work remain separate. Staging/cloud: NOT-RUN — requires authorized Staging environment. Production/hardware: NOT-RUN. Git Transition Status: codex/m1-v3-execution; merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue local work without push, merge, branch creation or CURRENT_HANDOFF refresh.
## Task transport technical delivery - 2026-10-02
Completed the existing GX15.transport handoff using the unchanged [local qualification](../development/TASK_TRANSPORT_LOCAL_QUALIFICATION.md) and [private transport](../development/TASK_NETWORK_TRANSPORT.md) documentation. The original ACK, sequence, duplicate conflict, bounded backpressure, replay/resume and lease/fence behavior maps to its source-bound receipts; operational bounds, failure behavior and cleanup remain explicit. No new delivery checklist or runtime implementation is introduced.
The [delivery readback](../development/evidence/m1-v3-task-transport-delivery-70bd11d7.json) binds parent `70bd11d7d24808bcc9561e5f95fcb7e0dc409a92`, two existing documents, eighteen selected source files and six original logs. Sixteen files still match ca2fd7f; the two known gateway response/test changes are explicit, and all eighteen match ac069618. The historical430 and separate2-test process results retain their original sources and scopes. This increment executes zero runtime tests and makes no current full transitive CI claim. Existing handoff10% adds1.2 points only: transport100%, GX15 90.4%, overall638.85/1200=53.2%.
Task-owner process loss, wider Task profiles/Context, terminal and SDK delivery, joint Task+RTC and full local CI remain with their existing work items. Paid Provider, cloud, hardware and Production are NOT-RUN; Staging is NOT-RUN - requires authorized Staging environment. Git Transition Status: `merge_main_ready: NOT_READY`; `new_feature_branch_ready: NOT_NEEDED`; continue the current branch locally without push or merge. CURRENT_HANDOFF is unchanged.
## Original subscription version selection - 2026-10-02
The original subscription watch now selects the latest accepted version through its exact durable native Human connection, then invokes the existing signed exact-version preparation. Lookup is read-only SERIALIZABLE, takes no row locks, closes before HTTP and shares the original500ms deadline. Revoke, replacement and expiry are checked before/after selection and after HTTPS; a changed version never triggers an automatic newer-version retry. Migration116 adds SELECT on only connection_id/policy_version; prior migrations and strict ACL denial remain intact.
Actual source-bound Linux race result:581 pass/0 fail/0 skip/0 package fail, comprising full policy518 and real PostgreSQL63. The restricted LOGIN-to-HTTPS case commits explicit empty-set preparation and verifies policy replacement through the existing exporter/worker/feed invalidates the original fixture watch. Bootstrap is compile-only with0 runtime tests. All2598 frozen source files match before/after; one235516ms attempt and five normal container exits leave0 owned resources. Official LiveKit is Room setup only, and explicit fixture SIDs/completion do not prove actual native installation, media or drain. [Exact-source archive](../development/evidence/m1-v3-native-subscription-version-c4d656bc/index.json), SHA-256 `a8a1d758e221b969ae816110c9a9d8572067925d784b083c63db176f1a77191b`, binds parent `c4d656bcc9262019be3457b60797aed47dc58ad6` plus exactly16 reviewed source/test/migration files. Historical receipts retain their original sources.
Native media-only capability installation, actual selected media receipt and native client races remain the next existing GX05 step. No LiveKit patch, media/data permissions, SDK, Provider or new public protocol changes. Additional credit0; overall638.85/1200=53.2%, GX05 61.8%, GX15 90.4%. Cloud/Production/hardware remain NOT-RUN; Staging is NOT-RUN - requires authorized Staging environment. Git Transition Status: merge_main_ready NOT_READY; new_feature_branch_ready NOT_NEEDED; continue current local branch, no push or merge. CURRENT_HANDOFF is unchanged.
## Task terminal technical delivery - 2026-10-02
Completed the existing GX15.terminal technical handoff using unchanged [terminal/cost qualification](../development/TASK_TERMINAL_COST_CONCURRENCY.md) and [installed Task local qualification](../development/TASK_END_TO_END_LOCAL_QUALIFICATION.md) documentation. The original three acceptance criteria map to single Artifact publication, terminal absorption and unique Usage/settlement facts. Existing owners, commands, failure boundaries and cleanup evidence remain explicit; no new gate or runtime implementation is introduced.
The [delivery readback](../development/evidence/m1-v3-task-terminal-delivery-8ba68541.json) binds parent `8ba68541e1b2c019683f6d5698117b0e3240ef42`, two documents, six selected source files and the original lossless logs. The six files match the8997 frozen snapshot and current committed bytes. Historical23,35,5 pass results remain separate original scopes and SHAs; the original import-cycle setup failure and two required skips are preserved. This increment executes zero runtime tests and makes no current full dependency-closure claim. Existing handoff10% adds0.8 point only: terminal100%, GX15 92%, overall639.65/1200=53.3%.
GX15.task/profile/Context and GX19 integration obligations remain open. Repository-return response loss is not database/network failure; installed socket recovery is not Worker/Task-owner process-loss recovery. Full local CI, paid Provider, cloud, hardware and Production are NOT-RUN for this increment; Staging is NOT-RUN - requires authorized Staging environment. Git Transition Status: `merge_main_ready: NOT_READY`; `new_feature_branch_ready: NOT_NEEDED`; continue the current branch locally without push or merge. CURRENT_HANDOFF is unchanged.
## Original selective native media subscription - 2026-10-02
The original connection watch now installs one immutable media-only permission
before checked native Join, using the existing signed Service owner and at most
eight exact publication/track targets. One foreground attempt retains the500ms
deadline; native publisher permission remains an additional restriction.
Client intent cannot expand authority. Native CanSubscribe stays false.
Pure local checks and exact-object rollback reuse TrackResolver/AddSubscriber;
actual Close callback replay fixes the registration race without treating
DownTrack.IsClosed as completion. The existing original lease/close pipeline
owns preparation, synchronous additions and invalidation. No remote business
I/O enters RTP/frame forwarding, and no media algorithm, routing, Redis coupling,
scheduler or generic transport is added.
Source-bound results remain separate: current candidate race370/0/0; first real
native attempt overall FAIL3/1 because its singleton fixture rejected the two
actual participants; corrected focused native1/0/0; actual next-version
f7ec53ca replay370/0/0; formal generator/host build and observation race91/0/0.
The first forward attempt failed offline module-graph export after host build,
with0 tests. Its missing29 exact module versions were acquired through official
Go proxy/checksum verification; actual offline graph recheck passed. Both
failures remain archived. All completed lanes retain exact source vectors and
normal owned cleanup, without rebinding old tests to the later commit.
The real restricted native host/HTTPS/PostgreSQL/worker fixture receives selected
Opus RTP and rejects another real unselected track despite receive Grants for
both. Public policy replacement closes the original subscriber; effective
acceptance waits for its real terminal ACK. Publisher remains active and old
resume/full-reconnect material cannot revive authority. This is packet receipt,
not decoded audio, audible quality or settlement.
Actual seven-metric before/after: files30→36(runtime18→22, tests12→14);
runtime functions modified31→39 and added50→59; total LOC+5388/-73→+6455/-91
(runtime+1652/-73→+2067/-91; tests+3736/-0→+4388/-0);
OneSay AST identifier occurrences194→206; hook families3→4;
external adapter physical LOC346→510(nonblank331→490). Reuse the original
seven-alternative proof. A supported upstream immutable target authorization
seam with equivalent async/sync and close-race guarantees can replace this hook.
Formal registration applies the exact tested patch into a fresh owned source
tree and actually regenerates Wire. Its447 native/408 protocol bytes match the
tested candidate. The two host module replacement paths and corresponding
publication-contract provenance hash have a separate fresh build/contract
qualification; the earlier RTP result is not relabeled as a whole-platform
rerun. [Exact-source evidence](../development/evidence/m1-v3-native-selective-subscription-3db05f93/index.json), SHA-256 `cf6939f651252736ebfa8b9e60bcffd1c41aa147caf2c699f6982ff447c31884`, retains parent
`3db05f938f707d3a3651d94f1f3592a75f836253` and every declared overlay.
Existing GX05.publications integration10% adds1.5 points only: publications90%,
GX05 44.75/70=63.9%, overall641.15/1200=53.4%; handoff remains open.
Full local CI, SDK product workflows, decoded quality, all-node subscription
timing/soak, Usage/financial settlement and universal legacy data-packet/RPC
receiver isolation are not qualified here. Staging is NOT-RUN - requires
authorized Staging environment; Production/cloud/hardware remain NOT-RUN.
Git Transition Status: merge_main_ready NOT_READY; new_feature_branch_ready
NOT_NEEDED; continue codex/m1-v3-execution locally without push or merge.
CURRENT_HANDOFF is unchanged.
## Selective native subscription technical delivery - 2026-10-02
Completed the existing GX05.publications technical delivery using the current
host/policy reproduction instructions, subscription contract and source-bound
reuse index. Corrected the host README to the actual Linux CGO_ENABLED=1 lane
and tested build flags; no runtime, module, migration, SDK or patch bytes changed.
The [delivery readback](../development/evidence/m1-v3-subscription-delivery-adca021f.json) binds parent
`adca021fcabd6193da9d557892f83db93d11984f`, three delivery documents, eleven unchanged selected
formal/fixture files and original archives. It maps the existing binding/upper
bound, reproduction, lifecycle, patch/upgrade and qualification boundaries.
Runtime tests executed0; prior current370, focused native1, forward370 and
formal91 remain separate original source cuts. Governance11 command exits0,
original discover36PASS/1SKIP and separate supplied-archive1PASS are retained.
No old result is rebound to this documentation commit or presented as a full
current dependency-closure rerun.
Existing handoff10% adds1.5 points only: GX05.publications100%, GX05 66.1%,
overall642.65/1200=53.5%. Continue the existing GX06 product audio and remaining
GX05 Room/convergence obligations. Decoded quality, SDK workflows, multi-node
timing/soak and Usage settlement retain their separate work items. Staging is
NOT-RUN - requires authorized Staging environment; cloud/Production/hardware
remain NOT-RUN. Git Transition Status: merge_main_ready NOT_READY;
new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally.
No push, merge, new branch or CURRENT_HANDOFF refresh.
## Authorized native browser decoded audio - 2026-10-02
Added one real Linux browser audio root using existing public Human/Consent,
signed native preparation, PostgreSQL projection and official LiveKit/Chromium.
The [qualification](../development/RTC_NATIVE_AUDIO_LOCAL_QUALIFICATION.md) and [source-bound evidence](../development/evidence/m1-v3-native-authorized-browser-dd38438e/index.json) record the actual
current1PASS/0FAIL/0SKIP/pkg0:4096 decoded samples near878.91Hz, selected-only
reception against an independently active excluded tone, mute/unmute and
unchanged original subscriber snapshot. Three fresh ELF builds passed; all3639
frozen inputs matched and all owned containers/volumes/networks were removed.
Original attempt0PASS/1FAIL/0SKIP/pkg1 is retained. The corrected fixture uses
the upstream red:false option for the current Opus-only profile. The original
combined mismatch did not retain its specific field; do not claim its MIME was
directly observed. No runtime, SDK, Provider, migration or upstream patch changed.
Accept only existing GX06.audio boundary5%=1point; other95% remains uncredited.
GX06.audio5%, GX06 1.4%, overall643.65/1200=53.6%. The public SDK publish codec
default and connect-before-subscription ordering remain explicit GX08 work;
bidirectional/multiparty, impaired-network/quality, Usage and full CI remain
unqualified. Task next work remains existing profiles and Context outbound
semantics, without reopening delivered admission/transport/terminal.
Staging: NOT-RUN - requires authorized Staging environment. Cloud, Production
and hardware: NOT-RUN. Git Transition Status: merge_main_ready NOT_READY;
new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally.
No push, merge, new branch or CURRENT_HANDOFF refresh.
## GX08 initial subscription and Opus adapter wiring — 2026-10-02
The existing SDK connect accepts initialSubscriptions before native join, using
the existing strict Action/decoder and controller. Inputs are copied before I/O;
connection and policy mutations have independent keys and one total deadline.
Denied, mismatched, cancelled or expired policy cannot start join. The private
controller reconciles the initial native participant snapshot after join without
resubmitting policy or relying on TrackPublished. Microphone publishing selects
upstream red:false for the current audio/opus profile; no new codec or patch.
Local units and independent deterministic package/type consumers:90PASS/0FAIL/
0SKIP, including18 initial-policy tests. All71 frozen inputs matched. The initial
Windows preload invocation failed before product tests (6file failures); its
raw receipt and the file-URL launcher correction are preserved separately.
No Windows native test executable was built or launched.
[Exact-source SDK evidence](../development/evidence/m1-v3-sdk-prejoin-0f519f29/index.json).
No new milestone credit:643.65/1200=53.6%,GX08=42.1%. Next is the existing real
public-package/native-browser integration without fixture permission overrides;
bidirectional/multiparty/quality, full local CI and remaining Task profile/Context
work retain their scopes. Staging: NOT-RUN — requires authorized Staging environment.
Production/cloud/hardware: NOT-RUN. Git Transition Status:merge_main_ready NOT_READY;
new_feature_branch_ready NOT_NEEDED; continue codex/m1-v3-execution locally.
No push, merge, new branch or CURRENT_HANDOFF refresh.
## GX08 public SDK and current native one-way audio — 2026-10-02
One independently installed OneSay tarball is consumed by two isolated browser contexts. Its public HTTP calls use the real Human identity, PostgreSQL Grant/Consent, current native policy and signed publication observation; the receiver submits its exact initial policy before joining. No fixture grants native media permissions or pre-accepts that policy. The browser uses only the OneSay public API, with standard browser capture/playback/statistics observations.
The fresh Linux run built the test, authority worker and native host from parent 40e8cb5a4dd59e60422e69061a7bfed5959d1d60 plus the three exact test overlays. All 3,733 frozen inputs matched. Actual result: **1 PASS / 0 FAIL / 0 SKIP**. Decoded 4,096 samples measured 878.91 Hz for the 880 Hz source before and after mute; silence, original signed subscription snapshot, one preparation, exact public request counts and all three accepted end/revoke operations were verified. Capture/playback/peers closed, and owned containers, volumes and networks were all zero.
The initial run remains **0 PASS / 1 FAIL / 0 SKIP**. Its strict child decoder hid a cleanup failure behind an unavailable-phase message. The correction only adds finite safe diagnostics; the later run did not reproduce the underlying failure. **The original cleanup cause is unconfirmed, not fixed or erased.** Both runs contain an uncorrelated PostgreSQL 40001 count; that is insufficient to attribute cleanup failure. No retry, timeout increase or authority weakening was used.
[Exact-source evidence](../development/evidence/m1-v3-sdk-native-public-40e8cb5a/index.json), SHA256 3cf48464a091f05f6f9f18a54d1e6cdbb235974fbb01f582064b0684f9a7bebc. This earns only the existing GX08.adapter integration milestone (+2 points); adapter90%, GX08=44.8%, overall645.65/1200=53.8%. Broader lifecycle stability and handoff remain open. This is one-way audio, not duplex, multiparty, media quality, Usage settlement, full local CI, hardware or cloud qualification. Staging: **NOT-RUN — requires authorized Staging environment**. Production/hardware/cloud: **NOT-RUN**.
Current two-session duplex remains an existing GX06 product gap: initial subscription preparation requires an already observed target, while publication starts after join; changing a prepared policy invalidates its original snapshot. A separate third connection would consume a real AppSession/seat and cannot be represented as ordinary two-session duplex. No new architecture, patch surface, denominator or audit gate is introduced. Continue existing Task profile delivery alongside remaining RTC product work.
Git Transition Status: merge_main_ready **NOT_READY**; new_feature_branch_ready **NOT_NEEDED**; continue codex/m1-v3-execution locally. No push, merge, new branch or CURRENT_HANDOFF refresh.
## GX15 approved profile technical delivery — 2026-10-02
The existing dictation.v1 profile inventory now has a technical delivery section in [Task voice reuse and gaps](../development/TASK_VOICE_REUSE_AND_GAPS.md#gx15-profile-technical-delivery--2026-10-02). It documents the approved typed inputs/transcript output, finite lifecycle and shared Control/WSS ownership, exact existing Linux reproduction entries, owned cleanup and remaining Context/Provider/external scope. No new profile, DAG, Context compiler, SDK, runtime, migration or upstream patch is added.
[Delivery readback](../development/evidence/m1-v3-gx15-profile-delivery-ff1aac82/index.json), SHA256 38237c98b01a23d35ec8d5a3fdbb6c697823aef531eea2241831344ca5d48432, is bound to parent ff1aac824413883260bef8ea9aff96aac5c1c304 and the exact delivery document. Eleven selected profile/input/service files equal both committed current bytes and original2f8b817e source. This is a limited comparison, not a full transitive-source qualification. Original61 Control,430 transport,17 installed Python composition and5 recovery results retain their own SHA/overlays and separate counts; historical failures/skips remain unchanged. **Runtime tests executed this increment:0.** Synthetic Provider content and cost do not prove a paid Provider call.
Only the existing GX15.profiles handoff milestone advances (+1 point): profile90%,GX15=94%,overall646.65/1200=53.8% rounded down. Current full integration remains uncredited. GX15.task Context kinds/field mapping/locale/priority/duplicates/egress policy, broader product composition and real Provider qualification remain existing work. This delivery does not reopen completed admission, transport or terminal work. Staging: **NOT-RUN — requires authorized Staging environment**. Production/cloud/hardware/paid Provider/full local CI: **NOT-RUN**.
Git Transition Status: remain on codex/m1-v3-execution; merge_main_ready **NOT_READY**; new_feature_branch_ready **NOT_NEEDED**. No push, merge, branch creation or CURRENT_HANDOFF refresh.
## GX06/GX08 formal deferred subscription registration — 2026-10-02
Registered the existing bounded first-subscription seam against the reviewed 36-target LiveKit policy patch. The Linux formal lane generated Wire, built the registered host and passed 91 observation-contract tests (91/0/0); generated native/protocol bytes matched the tested candidate. Historical FAIL results and the UNKNOWN publication-end cause remain preserved. This adds no progress points and does not claim Staging, Production, hardware, Usage or cloud qualification.
## 2026-10-03 — GX19 joint ten-role local composition
The joint Task+RTC fixture now provisions the Task quota in the same immutable policy as the RTC quota, and business-failure cleanup waits for the external runner before removing its database and support files. Exact source `5aa421e7403d44bd355ebbc1ad8882012bc534bc` built and passed the ten-role Linux Docker runtime: 10/10 services started, private readiness passed, one joint PCM event passed, native RTC participant and independent RTC hold survived Task completion, PostgreSQL facts were projected, and owned cleanup removed all resources. The deterministic Provider fixture made zero external calls; this is local composition evidence only.
Source-bound evidence: `docs/development/evidence/m1-v3-gx19-joint-runtime-5aa421e7/index.json`. GX19.joint advances by 8.5 points (build 50%, local behavior 25%, integration 10%); total 682.45/1200 = 56.8%. Task-without-RTC, same-device busy/switch, paid Provider, Staging, Production, cloud and hardware remain NOT-RUN. Windows native executables remain disabled after the Defender quarantine event.
Git Transition Status: `codex/m1-v3-execution`; merge_main_ready `NOT_READY`; new_feature_branch_ready `NOT_NEEDED`; no push, merge, branch creation or CURRENT_HANDOFF refresh.
## 2026-10-03 - GX19 Task-only no-RTC qualification
Added current-source Linux Docker evidence for
`TestCapacityPublicTaskUsageReadback` at
`eb9c8989c18114fa1d921fc4b21201cca8d2e179`: **1 pass / 0 fail / 0 skip**.
The bounded Task Gateway/worker -> PCM -> Artifact/Usage path used owned
PostgreSQL/Redis, no LiveKit or RTC, zero external Provider calls and passed
owned-resource cleanup. The device conformance version lock and its 40/0/0
Node consistency suite were refreshed together.
Credit is limited to the existing GX19.joint no-RTC boundary (**+0.1 point**;
GX19.joint **86%**; total **682.55/1200 = 56.8%**). Same-device busy/switch,
handoff, paid Provider, Staging, Production, cloud and hardware remain
**NOT-RUN**. Windows native test executables remain prohibited after the
Defender quarantine event.
Evidence: `docs/development/evidence/m1-v3-gx19-task-only-eb9c8989/index.json`.
Git Transition Status: remain on `codex/m1-v3-execution`; merge_main_ready
`NOT_READY`; new_feature_branch_ready `NOT_NEEDED`; no push, merge, branch
creation or CURRENT_HANDOFF refresh.
## 2026-10-03 - GX10 governance current-source refresh
Reran the selected governance suite from exact source
`331ad0c7cb8db9872569ae107132c43d12e3c841`: Linux Docker Go tests **10/10**
and current Node suites **96/96**, with zero failures or skips. The previously
missing `go-cleanhttp@v0.5.2` module was resolved from the offline local cache.
This is corroboration only and adds no points; durable multi-replica settlement,
deployed alerts, live Provider, Staging, Production, cloud and hardware remain
`NOT-RUN`. Windows native executables were not built or launched.
Evidence: `docs/development/evidence/m1-v3-gx10-governance-current-331ad0c7/index.json`.
Git Transition Status: remain on `codex/m1-v3-execution`; merge_main_ready
`NOT_READY`; new_feature_branch_ready `NOT_NEEDED`; no push, merge, branch
creation or CURRENT_HANDOFF refresh.
## 2026-10-03 — GX06 current-source duplex audio evidence
- Added source-bound Linux Docker evidence for
`TestPostgresRTCSDKNativeDuplex` at clean parent
`8a07147c8bfa01b8a02ecc4d5091a70eda60a207` (1 pass / 0 fail / 0 skip).
- Recorded three fresh native ELF builds, two-session signed public SDK duplex,
immutable authorization snapshots, packet arrival and simultaneous 880Hz /
1320Hz decoded tones with Docker cleanup.
- Credited only the existing `GX06.audio` partial milestones: 80% / 16 points;
overall 697.55/1200 = 58.1%. Multiparty, mute, quality, constrained
network/ICE/TURN, recovery, Usage, hardware and external environments remain
unqualified.
- No Windows native executable was built or launched, and no GX08/GX05/GX03
duplicate credit was added.
## 2026-10-03 — GX06 current-source mute/unmute evidence
- Added source-bound Linux Docker evidence for
`TestPostgresRTCSDKNativeAudio` at clean parent
`1fed00805868973103489046020e86459aebe793` (1 pass / 0 fail / 0 skip).
- Recorded three fresh native ELF builds, signed public SDK one-way 880Hz
decode, mute-to-silence, unmute-to-resumed-audio, authority snapshots and
Docker cleanup.
- Added only the existing `GX06.audio` local_behavior slice: 85% / 17 points;
overall 698.55/1200 = 58.2%. The transient SQLSTATE 40001 failed attempt is
retained without credit; bidirectional, multiparty, quality, constrained
network/ICE/TURN, recovery, Usage, hardware and external environments remain
unqualified.
- No Windows native executable was built or launched, and no GX08/GX05/GX03
duplicate credit was added.
## GX10 independent-pool quota regression - 2026-10-04
Added four-pool capacity and idempotent settlement-after-revocation regressions,
corrected deterministic test-ID collisions, and verified 23/0/0 in Linux Docker.
Runtime contracts are unchanged. [Evidence and limits](../development/GX10_QUOTA_LOCAL_QUALIFICATION.md).
No new progress credit or external qualification.
## GX10 quota arithmetic correction - 2026-10-04
Fixed remaining-quota integer wraparound while preserving legitimate negative
Usage from cross-week corrections. An unrepresentable positive balance now
fails without a new reservation; exhausted capacity cannot become available
through overflow. Actual Linux PostgreSQL/LiveKit-management race regression:
38 pass / 0 fail / 0 skip. Prior failure and missing-fixture skips are preserved.
[Source evidence and limits](../development/GX10_QUOTA_LOCAL_QUALIFICATION.md).
No additional points, native media, rolling settlement or external qualification.
## Internal Agents usage capture - 2026-10-04
Added a private adapter for the pinned official Agents cumulative session event.
It preserves model units and unknown completeness, bounds capture memory, and
rejects discontinuities without inventing a new generation or billing result.
Linux official-core qualification passed **28/0/0** with synthetic metrics.
Dispatch/claim/durable Usage integration and external qualification remain open.
See [qualification](../development/GX10_AGENTS_USAGE_LOCAL_QUALIFICATION.md).
No public SDK/API or upstream patch change; no new progress credit.
## Private native Agent dispatch adapter - 2026-10-04
Reused official SDK create/list/delete with exact generation correlation,
explicit unknown mutation outcomes and duplicate conflict detection. Linux race
qualification passed **86/0/0**, including real native management response loss.
This enables no public Agent permission or worker/model execution; durable
business authorization and dispatch wiring remain open.
See [qualification](../development/GX07_AGENT_DISPATCH_LOCAL_QUALIFICATION.md).
## GX07 durable Agent dispatch intent — 2026-10-04
Added private PostgreSQL dispatch intent/fencing and migration117. A lost or absent native reply never permits automatic recreation; cancellation preserves attempt/native facts and does not prove effective Agent stop. Actual local race qualification:105/0/0; migration contracts:31/0/0. No Agent public API, paid execution, native permission or upstream patch is enabled.
[Source-bound qualification](../development/GX07_AGENT_DISPATCH_PERSISTENCE_LOCAL_QUALIFICATION.md). No whole milestone credit; overall59.9%.
## GX07 bounded AgentExecution contracts — 2026-10-04
Added canonical create/read/stop resource, grants, Consent and generated Go/TypeScript/C projections without enabling public runtime or paid inference. Reused exact authority timestamp arithmetic and corrected nanosecond ordering rejection. Linux contract/consumer regression: **2337 pass, 0 fail, 0 skip**; generated Go/SDK/portal/C compilation passed. Failed setup/old compile-count attempts remain evidence.
[Local qualification](../development/GX07_AGENT_EXECUTION_CONTRACT_LOCAL_QUALIFICATION.md). Business authority, model budget, claim and official worker integration continue; no whole milestone credit, overall59.9%.
## GX07 current Human Agent input authority — 2026-10-04
Reused current Human/AppSession/Room, original publisher/connection, Grant history,
canonical typed input and exact published-inbox owners in one finite SERIALIZABLE
proof. No caller RTC connection is required. Final recheck retains original ceilings
and rejects withdrawals/ABA/stale snapshots; subscription uses the same extracted
inbox predicate. No execution Consent, model budget, claim or public Agent activation.
Linux PostgreSQL race: **160/0/0** across five roots. Initial 300-second package timeout
is retained as FAIL; complete unchanged source reran with a 600-second package budget.
Source parent eb0ec1a3 plus declared three-file overlay, not clean exact-SHA runtime
qualification. All owned resources removed. Signed publication fixture facts are
not actual media/native freshness or an Agent job. [Evidence and scope](../development/GX07_AGENT_INPUT_AUTHORITY_LOCAL_QUALIFICATION.md).
Next: durable AgentExecution desired lifecycle, then owning Consent/model budget/claim
before official worker wiring. Zero complete-bridge milestone credit; **719.55/1200=59.9%**.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push/merge/handoff refresh; unrelated pre-cloud plan edit preserved.
## GX07 durable requested AgentExecution lifecycle — 2026-10-04
Added migration118 and private transaction-owned prepare/read/desired-stop storage.
Original Human/AppSession, Room/native generation, ordered input associations and
expiry are immutable; expiry floors to PostgreSQL microseconds. Desired stop is
absorbing and never fabricates effective stop; observed state remains pending.
Existing protected idempotency, current Consent/budget and business claim remain
future owning-service duties. No public activation, worker or upstream patch.
Linux race qualification: **215/0/0**, ten roots/four packages, including real
PostgreSQL, concurrent duplicate creation, expired-input historical read/stop,
unchanged nonempty117→118 upgrade and existing Room/dispatch regressions. Migration
static tests: **32/0/0**, with generated no-diff. Initial104/10/0 failure is preserved:
the canonical aexec_ prefix was absent from the runtime ID validator; corrected with
generated-prefix and AgentPrincipal-separation regression. [Evidence and limits](../development/GX07_AGENT_EXECUTION_LIFECYCLE_LOCAL_QUALIFICATION.md).
Source parent0304028e plus declared overlay; not a clean exact-SHA full execution
qualification. No additional complete-bridge credit: **719.55/1200=59.9%**. Continue
current read/stop authority, then Consent/model budget/claim and official worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push/merge/handoff refresh; unrelated pre-cloud plan edit preserved.
## GX07 current AgentExecution read/stop authority — 2026-10-04
Reused current Human/Application identity, original historical ownership, Grant
revision/fence and identity-remap fence for independent AgentExecution read/stop.
Original session/input/create/budget loss no longer prevents these current scoped
operations. Same-transaction final recheck rejects stale, revoked or rebound authority;
requested stop still does not prove effective stop or satisfy separate Consent.
Linux PostgreSQL race evidence: **344/0/0**, thirteen roots/four packages,
including original-session expiry and no-RTC-connection owner. [Evidence and limits](../development/GX07_AGENT_EXECUTION_ACCESS_LOCAL_QUALIFICATION.md).
Parent0024efe1 plus declared overlay; complete bridge remains unqualified. Progress
unchanged **719.55/1200=59.9%**. Next: current create/stop Consent integration.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No cloud/Provider execution, push, merge or handoff refresh.
## GX07 Agent create/stop Consent lifecycle — 2026-10-04
Connected the existing typed Consent HTTP lifecycle to current Agent create/stop
authority. Added only create original-AppSession observation metadata in migration119;
stop reuses the immutable execution. Historical reads use current independent read
Grants, while pending decisions recheck their original complete mutation input.
Receipts remain current-bound; no Consume, Agent dispatch, execution or effective stop.
Linux PostgreSQL race: **423/0/0**, eighteen roots/four packages. Exact
nonempty118 upgrade and existing RTC/Agent regressions pass; migration static and
generated no-diff **33/0/0**. [Evidence and limits](../development/GX07_AGENT_CONSENT_LOCAL_QUALIFICATION.md).
Sourceparent2f91475f plus declared overlay, not full execution qualification.
Progress unchanged **719.55/1200=59.9%**. Next: server model/region/privacy/budget,
atomic dispatch/audit/protected idempotency and business claim, then official worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push, cloud deployment or handoff refresh; unrelated plan edit retained.
## GX07 current Agent model policy — 2026-10-04
Added private current server model/plugin/region/privacy policy selection, exact
versioned Secret membership without reads, monotone publication generations and
immutable policy versions. Existing AgentExecution storage consumes the selected
snapshot with a nonrenewable, narrowed lifetime. Migration120 preserves all old
Agent/Consent history with no selection backfill. Task routing reuses extracted
identifier/region validation with its prior behavior retained.
Linux race qualification: **568/0/0**, 53 Go roots/six packages,
including populated119 upgrade and original Agent/RTC/Provider regressions.
Migration static and generated no-diff: **33/0/0**. [Evidence and limits](../development/GX07_AGENT_MODEL_POLICY_LOCAL_QUALIFICATION.md).
Parentba3e2dce plus declared overlay, not full Agent execution qualification.
No paid budget, dispatch activation, claim, worker or Provider call follows.
Progress unchanged **719.55/1200=59.9%**. Continue bounded operational hold,
atomic dispatch/audit/protected idempotency and business claim, then official worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push/cloud/handoff refresh; unrelated plan edit retained.
## GX07 initial Agent operational envelope — 2026-10-04
Private fixed stage/unit cumulative caps and immutable holds extend the existing
RTCQuota/QuotaPolicy owner. One initial hold per real execution; exact replay,
current model/assignment recheck and all-policy/all-period conservative exposure.
No new customer metric, purchased funds, fake business generation, expiry refund,
paid execution or dispatch activation. Migration121 preserves nonempty120 history.
Linux race **188/0/0**, 21 roots/three packages; static **40/0/0**.
[Evidence and explicit limits](../development/GX07_AGENT_OPERATIONAL_BUDGET_LOCAL_QUALIFICATION.md); source parent7c9b9fc5 plus tested overlay,
not complete Agent bridge qualification. Generated outputs differ only by spec
digest and corresponding manifest hashes.
Progress unchanged **719.55/1200=59.9%**. Continue the atomic current-authority
execution/dispatch/audit/protected-idempotency owner, then business claim and worker.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature branch
NOT_NEEDED. No push, cloud change or handoff refresh; unrelated plan edit retained.
## GX07 exact Agent dispatch association and initial deadline — 2026-10-04
Extended the existing durable dispatch intent with an immutable optional exact
aexec association; old NULL history remains unassociated. New selection checks
the actual execution/native/model tuple; historical lookup/stop never guesses by
Room or Agent name. Existing RTCQuota supplies a read-only pre-create envelope
deadline so the stored resource does not outlive its initial hold. No new
scheduler, upstream patch, media path, public activation or business claim.
Linux race **328/0/0**, 31 roots/four packages, plus separate modified schema117
upgrade **1/0/0**; static **40/0/0**.
[Evidence and limits](../development/GX07_AGENT_ATOMIC_PREPARATION_LOCAL_QUALIFICATION.md); parent7b0eb506 plus tested overlay. Migration122
preserves populated121 history and the original117 upgrade regression.
Progress unchanged **719.55/1200=59.9%**. Continue complete current-authority
Control create/read/stop/replay with audit/protected idempotency, then business
claim and official worker. Git Transition Status: codex/m1-v3-execution; merge
main NOT_READY; new feature branch NOT_NEEDED. No push/cloud/handoff refresh;
unrelated pre-cloud plan edit preserved.
## GX07 atomic Agent Control owner and current replay — 2026-10-04
Composed existing current Human/input/Grant/Consent/model/quota/budget owners,
one exact execution/hold/dispatch, audit and protected HTTP idempotency in the
original bounded transaction. Historical read/stop survives original create
authority loss; current replay preserves original response without renewal or
redispatch. Explicit fixture route injection only; no production bootstrap,
new migration, native Agent execution or upstream change. Linux race
**658/0/0**, 83 roots/four packages; static **40/0/0**.
[Evidence and limits](../development/GX07_AGENT_CONTROL_LOCAL_QUALIFICATION.md); source parent f5949498 plus tested overlay.
Progress remains **719.55/1200=59.9%**. Continue original-authority origin and
business claim, then official worker/plugin enforcement. Git Transition Status:
branch codex/m1-v3-execution; merge main NOT_READY; new feature branch NOT_NEEDED.
No push/cloud/handoff refresh; unrelated pre-cloud plan edit preserved.
## GX07 original Agent authority and current check — 2026-10-04
Persisted original verified Human/client, exact Grant revisions and Consent
origin atomically through the existing Control owner. Added bounded actorless
current proof without fabricated authentication or initiating RTC connection.
Migration123 preserves old storage-only rows and rejects retroactive origin;
read/stop remain independent of withdrawn creation authority. Linux race
**778/0/0**, 100 roots/four packages; static **40/0/0**.
[Evidence and limits](../development/GX07_AGENT_ORIGIN_LOCAL_QUALIFICATION.md); parent b42aaf72 plus tested overlay.
Progress remains **719.55/1200=59.9%**; continue business claim/fence and official
worker/plugin integration. No Provider/native Agent or cloud qualification.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push/cloud/handoff refresh; unrelated plan edit preserved.
## GX07 Agent business claim and exact native job readback — 2026-10-04
Added a private authenticated owner combining original Human authority, current
model/credential membership, original operational hold and sealed official job
readback. Migration124 retains immutable generations, single-owner fences,
bounded renewal and a one-shot durable possible-effects marker. Release is
not effective stop or refund; no public/native Agent/Provider activation.
Linux race **571/0/0**, 52 roots/two packages; static **40/0/0**.
[Evidence and limits](../development/GX07_AGENT_BUSINESS_CLAIM_LOCAL_QUALIFICATION.md); source parent950d4bd3 plus tested overlay.
Overall remains **719.55/1200=59.9%**; continue official Worker/private receiver
and plugin envelope integration, with no complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push, cloud changes or handoff refresh; unrelated plan preserved.
## GX07 private Agent claim HTTPS — 2026-10-04
Reused the strict private RTC TLS/JWT/JTI receiver with five closed Agent claim
operations and the existing durable owner. Claims work across receiver instances
without process-local authority; effects are never retried after uncertain response.
No production bootstrap, native Worker, paid Provider or cloud activation.
Linux race **612/0/0**, 114 roots/two packages.
[Evidence and limits](../development/GX07_AGENT_CLAIM_HTTPS_LOCAL_QUALIFICATION.md); source parentbb78daef plus declared overlay.
Overall remains **719.55/1200=59.9%**; continue official Worker/trusted process
credentials and selected plugin envelope. No complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push, cloud change or handoff refresh; unrelated plan preserved.
## GX07 trusted Agent claim client — 2026-10-04
Added the bounded trusted Go caller to the existing private receiver and durable
claim owner. Every call uses a fresh signed Service JWT; uncertain effects responses
produce no executable result and are never automatically retried. Strict TLS,
exact scope/owner/lease and retirement shape are verified before returning.
Linux race **636/0/0**, 120 roots/two packages; actual TLS and PostgreSQL
lifecycle/revocation/lost-response checks. [Evidence and limits](../development/GX07_AGENT_CLAIM_CLIENT_LOCAL_QUALIFICATION.md).
Source parent b5ce5493 plus declared client/test overlay; no runtime bootstrap,
official Worker, paid Provider or cloud qualification. Overall stays
**719.55/1200=59.9%**; complete GX07.bridge is still unearned.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push or handoff refresh; unrelated plan preserved.
## GX07 atomic Agent Worker bootstrap owner — 2026-10-04
Reused the durable dispatch association and signed Service boundary to resolve
closed native job metadata. The existing claim transaction now returns its
final authorized input/model/operational envelope after successful commit.
No extra state store, schema, dispatch, hold refill, effects or upstream patch.
Linux race **751/0/0**, 139 roots/three packages.
[Evidence and limits](../development/GX07_AGENT_WORKER_BOOTSTRAP_LOCAL_QUALIFICATION.md); parent d6059a7e plus declared overlay.
Actual official Worker/private bootstrap wire/plugin execution remains incomplete;
overall stays **719.55/1200=59.9%**, no complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push/handoff refresh; unrelated plan preserved.
## GX07 trusted Agent bootstrap HTTPS — 2026-10-04
Reused private RTC HTTPS and signed Service/JTI with the existing atomic
bootstrap owner. Closed configuration delivery now has a trusted bounded caller,
precommit representation validation and committed-response-loss no-replay.
Linux race **886/0/0**, 155 roots/three packages.
[Evidence and limits](../development/GX07_AGENT_BOOTSTRAP_HTTPS_LOCAL_QUALIFICATION.md); parent 0015640a plus declared overlay.
Official Worker, process credentials and selected plugin execution remain
incomplete; overall **719.55/1200=59.9%**, no complete bridge credit.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY; new feature
branch NOT_NEEDED. No push/handoff refresh; unrelated plan preserved.
## Active M1 v3 progress authority in acceptance — 2026-10-04
The acceptance entry point now reuses the existing v3 structural validator and
the unique active v3 Ledger. Frozen v2 execution/acceptance ledger bytes remain
bound to their S11/S12 hashes. Structural progress is explicitly not current
candidate qualification; the rest of the acceptance/source-drift gates remain
in force. Linux affected regression: **35 pass / 0 fail / 0 skip**. The original
floating-point test assertion failure and a 60-second secret-scan idle timeout
are retained; the corrected tests and single normal-budget scan retry passed.
Full acceptance is still **FAIL** for E6 scheduling, E8 WebSocket tickets,
CCR source drift and E10 readiness/CCR-A evidence. Full CI and external gates
are not qualified. This is a zero-credit correction inside existing GX12.supply;
total stays **721.95/1200 = 60.1%**. Parent `384f60a7` plus declared four-file
governance/test overlay; historical test receipts are not rebound.
[Source-bound evidence](../development/evidence/m1-v3-active-progress-authority-384f60a7/index.json).
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**. Unrelated pre-cloud plan changes preserved.
No push, merge, new branch or CURRENT_HANDOFF refresh.
## E6 current-source aggregate qualification - 2026-10-04
The existing E6 acceptance gate now verifies historical evidence against its
original Git commit/tree and separately verifies fresh local execution against
current dependency bytes. The new isolated PostgreSQL 17.6 race run passed
**414 / 0 / 0** across eight selected packages, on parent
`7c7f334a35d7798b68650e9530c3906bcb1957a2` plus the exact Consent upgrade test
overlay. This is not clean-SHA or full-CI qualification. All 1,237 captured
repository inputs, 95 package inventories and migration SQL inventory are checked;
eight generated test mains are archived separately from repository source.
The initial **377 / 16 / 0** failure remains archived. Migration 119 adds a
nullable Agent create selector; the old snapshot comparison treated its added
null key as changed history. The correction independently asserts historical
selectors remain null and retains the full old-row/ciphertext/audit/namespace
comparison. A version-118 upgrade regression was added; runtime and migrations
were unchanged. Failure logs and all declared execution artifacts are authenticated.
Four named exclusions are explicit: the subprocess helper is exercised by its
included parent tests; the separate backup and two pristine-cluster role-conflict
fixtures remain NOT-RUN in this lane. All owned containers, the source volume
and test databases were removed. Linux-only execution published no host ports.
The acceptance command no longer reports E6; it still fails E8 ticket-copy,
CCR readiness and E10 readiness/CCR-A source evidence. Full CI, Staging,
Production, hardware, cloud and real Provider qualification remain incomplete.
[Execution evidence](../development/evidence/m1-v3-e6-aggregate-current-7c7f334a/index.json).
This is zero-credit repair within GX12.supply; **721.95/1200 = 60.1%**.
Git Transition Status: `codex/m1-v3-execution`; merge main `NOT_READY`;
new feature branch `NOT_NEEDED`. Unrelated pre-cloud plan changes preserved;
no push, merge, branch creation or handoff refresh.
## E8 current-source constructor ticket erasure - 2026-10-04
Two fresh Linux native builds from committed source
`79a9ad31907720315a7e6df35ff4b436c384c41c` passed the existing constructor
failure sweep for TLS12 and TLS13. Each observed 14 allocations, 14 recoveries,
29 attempt rows and both ticket copies erased before real free. Socket start,
TLS handshake, full native lifecycle, hardware and cloud acceptance are outside
this narrow run; no runtime, SDK or upstream patch changed.
Both initial attempts failed before behavior at CMake dependency resolution:
the runner selected an older cache without the current namespace. Correcting
the helper to use the already resolved canonical dependency cache preserved
the exact upstream component bytes. Those failures remain archived; they are
not counted as passing tests. All four runs removed their owned resources.
[Current execution and preserved failures](../development/evidence/m1-v3-e8-ticket-current-79a9ad31-raw/index.json).
Historical E8 evidence remains bound to its original SHA. This supplements the
existing GX12.supply acceptance gate without new work items, gates or credit;
total remains **721.95/1200 = 60.1%**. Full CI remains unqualified; CCR/E10 and
external Staging, Production, cloud, hardware and Provider gates remain open.
Git Transition Status: `codex/m1-v3-execution`; merge main `NOT_READY`;
new feature branch `NOT_NEEDED`. Unrelated pre-cloud plan changes preserved;
no push, merge, branch creation or handoff refresh.
## CCR current storage and migration compilation evidence - 2026-10-04
The existing CCR scopes now compose independently verified executions: DataSync
235/0/0 at `79a9ad31907720315a7e6df35ff4b436c384c41c`, TaskInput 36/0/0 at
`858c5d0b3b688494124511ff0c7969ee879df563`, and the original E6 migration
parent plus declared test overlay. Complete baseline case identities are retained,
including all 58 migration cases in the latest 94-case Context receipt. Each
run keeps its original source and dependency inventory; no historical result is rebound.
The initial DataSync/TaskInput parent remains FAIL 235/4/0. TaskInput refused the
runner's non-test database name; a separately owned `_ci` fixture passed all 36
cases and read back all 124 migration versions and digests. BOOT at exact
`858c5d0b3b688494124511ff0c7969ee879df563` passed 33 static migration tests,
migration generation and Go/TypeScript/C compilation. Its first compilation
failure from an omitted SDK dependency mount is preserved; the fixed runner
uses the existing read-only SDK cache. All owned fixtures were removed.
[Current execution records](../development/evidence/m1-v3-ccr-storage-current-858c5d0b-raw/index.json)
and [BOOT provenance](../development/evidence/m1-v3-ccr-storage-current-858c5d0b-raw/boot/index.json)
support only these selected local scopes. Current input checks use actual
compiled dependencies and membership, not unrelated governance files. The existing
four-file migration metadata bridge remains bounded; nonmetadata runtime,
Control API, RTC, capacity and E10 qualification still require their own evidence.
Malformed active v3 ledgers now fail closed instead of falling back to legacy.
No additional credit: **721.95/1200 = 60.1%**. Full local CI remains unqualified;
Staging, Production, cloud, hardware and real Provider gates remain NOT-RUN.
Git Transition Status: `codex/m1-v3-execution`; merge main `NOT_READY`; new
feature branch `NOT_NEEDED`. The unrelated pre-cloud plan modification is preserved.
## M1 v3 GX12.supply — current public Data Sync PostgreSQL evidence — 2026-10-04
The existing public Control fixtures ran at exact source
`558a15a89dd291d7a91539a4d3269c51ad442e60` in isolated Linux with
PostgreSQL17.6 and the existing offline Go cache: **35 PASS / 0 FAIL / 0 SKIP**,
one uncached race attempt. This is18 supplemental cases and17 public Scope
cases from the same actual Control package run. The separate migration74 case
reuses the authenticated E6 parent`7c7f334a` plus its recorded Consent test
overlay; it is not relabeled as execution at558a15a8 or a new19-case run.
The verifier authenticates raw lifecycles, exact case identities,1321 repository
dependency inputs,93 package inventories, embedded SQL membership, the generated
test main, executed runner files and cleanup. Existing per-case PostgreSQL
databases and login roles were removed; the administrative database remained
empty before its own deletion. Both owned containers and the source volume were
removed with no published host ports. No runtime, migration, SDK or LiveKit patch
changed in this increment.
The existing migration matcher composes this scoped proof with current
storage/BOOT only for its original four metadata paths. Immutable old receipts
and their hashes stay unchanged. Current public Scope17 is independently
reported; bootstrap runtime, native admission, changed nonmetadata sources and
the historical10000-record/100MiB/20-second capacity assertion remain separate
qualification work. Full CCR-A and full local CI are still unqualified.
Staging, Production, hardware, cloud, Provider and hosted CI remain NOT-RUN.
Progress remains721.95/1200=60.1%, with0 new points and no denominator change.
Git Transition Status: `codex/m1-v3-execution`; no push; merge main NOT_READY;
new feature branch NOT_NEEDED. Preserve the unrelated precloud-plan edit.
[Current public execution and distinct migration provenance](../development/evidence/m1-v3-ccr-public-current-558a15a8-raw/index.json).
## M1 v3 GX12.supply — current bootstrap and private dispatcher — 2026-10-04
The existing Control bootstrap and private dispatcher tests ran at exact source
`95c3d857eb386889ccbb23af3adc8d5a78e05777`: **10 PASS / 0 FAIL / 0 SKIP**
in two packages, one uncached Linux PostgreSQL race attempt. The three startup
cases cover successful migration verification before runtime construction,
schema verification failure and a missing runtime builder. The seven dispatcher
cases preserve the public handler and reject private-route aliases.
The successful startup test applies the current schema to the explicitly owned
database. Raw PostgreSQL stdout preserves all 124 installed migration versions
and digests, compared against the exact source manifest. The verifier reuses the
existing shared source-closure checker for 1185 repository inputs, 77 package
inventories and two generated test mains, and authenticates raw cases, archive
bytes, SQL readback and owned cleanup. The database, two containers and source
volume were removed; no host ports were published.
This is the existing startup and dispatch scope, not full StartRuntime E2E.
The original HTTPS admission fixture requires a real owned LiveKit Room worker;
its eight events remain NOT-RUN in this receipt and will join the next existing
RTC lane. The old reviewed-bootstrap matcher and its runtime digest stay
unchanged; neither public runtime drift nor native admission is bypassed.
Full CCR-A, full local CI and capacity qualification remain incomplete.
No runtime, migration, SDK, Provider or LiveKit patch changed. Progress remains
721.95/1200=60.1%, with zero added points. Staging, Production, hardware, cloud,
Provider and hosted CI remain NOT-RUN.
Git Transition Status: `codex/m1-v3-execution`; no push; merge main NOT_READY;
new feature branch NOT_NEEDED. Preserve the unrelated precloud-plan edit.
[Actual startup, dispatch and migration readback](../development/evidence/m1-v3-ccr-bootstrap-current-95c3d857-raw/index.json).
## M1 v3 GX12.supply — current RTC scope composition — 2026-10-04
The existing selected RTC union ran at exact source
`63c01d2018d5aa2c5d85473200d396b47ef38e3e`: **355 PASS / 0 FAIL / 0 SKIP**
in three packages with uncached Linux race testing. These are 347 distinct
historical RTC identities plus eight real HTTPS admission identities. There
were no additional current children. The four old scopes total 425 pass events
but 404 distinct identities: 57 are separately reused from verified E6 (22) and
public Control (35), retaining their original source SHA and declared overlays.
They are not counted as executions in the new 355-case run.
The initial attempt at the same source remains **353 PASS / 2 FAIL / 0 SKIP**.
The native join child and its parent failed because the network-none fixture
provided no non-loopback ICE interface. The corrected fixture reuses the
existing owned internal bridge, without host ports or external egress; no
runtime, SDK, migration, Provider or LiveKit patch changed. Raw logs, source
closures, runners and cleanup from both attempts are archived unchanged.
The corrected database, containers, volumes and internal network were removed
with zero owned residual resources.
The verifier authenticates 1321 repository inputs, 93 package inventories,
three generated test mains, actual test lifecycles, raw hashes, fixture isolation
and the original evidence sources. Only the four already pinned RTC reference
scopes may use this composition. The separately executed bootstrap3/private
dispatcher7 and this HTTPS8 also satisfy the existing narrow runtime.go matcher
for two immutable Data Sync public receipts, together with the authenticated
public and storage proofs. The old reviewed f7cc branch remains intact; no
generic runtime/source-hash exception is introduced. The old bootstrap receipt
continues to say HTTPS NOT-RUN for its own execution.
This does not qualify full StartRuntime E2E, cmd/control-api/main.go execution,
long-lived native media/policy, capacity, full CCR-A, E10 or the entire local CI
graph. The previous full-acceptance failure remains until its remaining inputs
are actually qualified. Staging, Production, hardware, cloud, Provider and
hosted CI remain NOT-RUN. Progress remains 721.95/1200=60.1%, zero new points.
Git Transition Status: `codex/m1-v3-execution`; no push; merge main NOT_READY;
new feature branch NOT_NEEDED. Preserve the unrelated precloud-plan edit.
[Current RTC composition and original failed attempt](../development/evidence/m1-v3-ccr-rtc-current-63c01d20-raw/index.json).
The affected governance regression finished **82 PASS / 0 FAIL / 0 SKIP**,
including the source/receipt tamper checks and bounded I/O tests. The original
`active-m1-ccr-rtc-readiness` command and its one serial retry both ended with
`IDLE_TIMEOUT` (exit124,300000ms); those failed attempts are retained. That
unchanged command lane was stopped. Independent source reads and package
inventory reads now use fixed batches of32, drain each complete batch and retain
every hash, source, membership and failure assertion. There is no result cache,
budget increase or artificial heartbeat. The corrected checker completed under
the original budget: **FAIL_REMAINING_CCR_QUALIFICATION**, exit1, no timeout.
All four RTC stale-reference errors and both pinned bootstrap runtime-path errors
are absent; **56 other source-digest errors remain**. Their complete list and both
prior timeout logs are preserved in governance-validation.json. This is scoped
qualification progress, not a full CCR-A/E10/local-CI PASS or additional points.
## M1 v3 GX12.supply — current privacy ledger unit qualification — 2026-10-04
The existing complete three-package Linux race suite at exact source
`aee79a30c8c37cc628c5de74f1628e2b988fdd59` finished **128 PASS / 0 FAIL / 0 SKIP**:
domain/datasync97, domain/datasync/history14 and adapters/privacyledger17.
Every original package/test identity was executed; no additional current child,
test selector, skipped case or source overlay was used. The actual dependency
capture contains66 repository inputs,12 package inventories and3 generated test
mains. Its actual empty embedded-input inventory remains empty. The owned
network-none Linux container and source volume were removed with zero leftovers.
The immutable old receipt retains its original source and local-only limits.
Only its two module-lock hash mismatches may use the independently authenticated
current complete three-package proof. The shared source-closure checker now
accepts explicit unit runner/embed requirements; PostgreSQL callers retain the
same six mandatory inputs and full migration SQL membership checks by default.
Every caller still verifies actual source hashes, original Git blobs, dependency
classification, generated inputs, package membership and executed runner bytes.
The bounded I/O implementation is preserved.
This proves local unit semantics with the existing object/fencing probes. Actual
OSS durability, IAM/credential revocation and external in-flight drain remain
NOT-RUN; no PostgreSQL/Redis/LiveKit, Staging, Production, hardware, cloud or paid
Provider qualification is claimed. Full CCR-A/E10/ci:local remains unqualified.
The earlier aggregate56-error result remains historical, not a new aggregate
run for this increment. Points remain721.95/1200=60.1%, zero increment.
Git Transition Status: remain `codex/m1-v3-execution`, no push, merge main
NOT_READY, new feature branch NOT_NEEDED; unrelated precloud-plan edit preserved.
[Current privacy-ledger source-bound unit evidence](../development/evidence/m1-v3-ccr-ledger-current-aee79a30-raw/index.json).
## M1 v3 GX12.supply — generated Data Sync evidence repair — 2026-10-04
Authenticated actual source-bound generator/package PASS and configuration3,
Pages6, W08behavior11; the complete20/1/0 parent remains FAIL. Narrow immutable
bindings reuse ledger90/128 and independent BOOT compilation; corrected full21
rerun awaits the next committed source. No runtime or patch change, no cloud
claim and no duplicate credit:721.95/1200=60.1%. Git Transition Status: remain
`codex/m1-v3-execution`, merge main NOT_READY, new branch NOT_NEEDED, no push.
[Evidence and preserved initial failure](../development/evidence/m1-v3-ccr-generated-current-b15335b2-raw/index.json).
## M1 v3 GX12.supply — corrected exact-source Data Sync suites — 2026-10-04
The corrected configuration3, Pages6 and W08runtime12 suites actually completed
**21 PASS / 0 FAIL / 0 SKIP**, with no cancelled/todo cases, on committed source
`da82bdd523a9f26c6251a2504157400f26f81fe1`. The complete committed snapshot is provenance only;
the actual Node trace records21 repository modules,170 dependency files and40
generated JavaScript artifacts. Before/after source and dependency readback
passed; the owned container and volume were removed with zero leftovers.
The original `b15335b2` parent remains **20 PASS / 1 FAIL / 0 SKIP**. Its generator
and reproducible package results, the independent BOOT compilation and the
separate ledger/domain evidence keep their original source bindings. This new
run executes only the three existing Node suites; it does not rerun those
independent compiler/package checks or qualify full Data Sync/CCR-A/E10/ci:local.
Existing Ajv unknown date-time-format warnings are retained; no date-time-format
qualification is inferred. Real OSS/IAM, Desktop storage, Staging, Production,
cloud, hardware and paid Provider checks remain external NOT-RUN gates.
Continue the existing SQL qualifier-input gaps and remaining capacity/aggregate
checks. No runtime, migration, SDK behavior or LiveKit patch changed here.
Progress remains721.95/1200=60.1%, with no duplicate credit.
Git Transition Status: `codex/m1-v3-execution`; merge main NOT_READY;
new feature branch NOT_NEEDED; continue locally without push. The unrelated
precloud-plan edit remains preserved.
[Actual corrected suite and preserved initial failure](../development/evidence/m1-v3-ccr-generated-corrected-da82bdd5-raw/index.json).
## M1 v3 GX12.supply — SQL and Consent evidence continuity — 2026-10-04
Nine immutable SQL scopes now use the existing authenticated DataSync235 and
E6 migration evidence for the exact changed qualifier input. Six Consent
receipts reuse only the E6-executed test correction, including the original
version43 and added version118 assertions. Original receipt bytes, all other
source checks, failed parent235/4, E6 source plus overlay and external gates
remain unchanged. Missing old proof bytes remain explicitly missing; the
subsequent overwritten FAIL observation is retained. The host qualifier CLI
was not rerun and no worker/capacity scope is implied by these narrow checks.
Affected regression: **68 PASS / 0 FAIL / 0 SKIP**. The complete CCR check
actually finished **FAIL with34 remaining source-qualification errors**,
down from the retained56-error checkpoint; it did not time out. This comparison
also includes the independently committed ledger/generated repairs. The
Authority check passed. These are checker/evidence repairs on parent
`a1c8ea8fe7736d3d9490b886cd6f733cf9e0377b` plus the declared22-file governance overlay,
not a new SQL runtime execution or full CCR-A/E10/ci:local qualification.
Continue the existing worker matrix and snapshot process host in isolated
Linux/PostgreSQL, including four previously unavailable DSN/process tests.
Remaining public API, generated-input, worker/host and qualifier composition
errors stay explicit. No runtime, migration, SDK behavior or LiveKit patch was
changed; Staging/Production/cloud/hardware/paid Provider/Desktop remain NOT-RUN.
Progress stays721.95/1200=60.1%, without duplicate credit.
Git Transition Status: remain `codex/m1-v3-execution`, merge main NOT_READY,
new feature branch NOT_NEEDED, no push; unrelated precloud-plan edit preserved.
[Exact checks, retained failures and remaining34 errors](../development/evidence/m1-v3-ccr-qualifier-continuity-a1c8ea8f-raw/index.json).
## M1 v3 GX12.supply — worker test repair and generated limits continuity — 2026-10-04
The original exact `2325cadb5faabb96970ccabc2df74c6f95c658fe` worker run remains **117 PASS / 1 FAIL / 0 SKIP**.
The snapshot-host test reported `owned snapshot readback failed` after 51.78
seconds. Its 10-second database context began before the independent build;
context expiry is the source-and-elapsed diagnosis, not an emitted error text.
All original raw artifacts are preserved. The test-only correction moves the existing bounded
build before that context. No runtime behavior or time budget was widened.
On that same parent plus the exact declared test overlay, the complete existing
ten-package worker lane actually passed **118 / 0 / 0**. All four required
PostgreSQL/process cases passed. Original case identities, actual Go imports,
generated testmain bytes, raw logs, isolation and owned cleanup are archived.
The first failure has confirmed container/volume cleanup but no fabricated
postrun database readback. The corrected run confirms per-case database/role
cleanup and zero remaining owned containers/volumes.
The four immutable receipt bindings for generated Data Sync limits now reuse
the exact header-only change through existing generator, BOOT compile and SQL
source evidence. Other CLI/worker/capacity differences remain fail-closed.
Affected governance tests actually passed **77 / 0 / 0** against the frozen
read-only worktree. Its generic receipt does not capture an overlay inventory;
the reviewed five governance source hashes are separately declared. The worker
execution itself uses only the one test overlay, not those governance files.
Four actual caller checks also retain the remaining CLI/backlog errors, and
the Linux gofmt check passed; both raw runs and the caller helper are archived.
This is precommit overlay evidence. **Exact committed-source worker rerun is
PENDING / NOT-RUN** until the repair is committed and that execution completes.
Full CCR-A, E10 and ci:local are not newly qualified; the earlier 34-error CCR
observation remains historical, not an updated result from this increment.
Staging/Production/cloud/hardware/paid Provider/Desktop remain external NOT-RUN.
Progress stays 721.95/1200 = 60.1%, with zero new credit.
Git Transition Status: remain `codex/m1-v3-execution`, merge main NOT_READY,
new feature branch NOT_NEEDED, no push; unrelated precloud-plan edit preserved.
[Actual runs, exact overlay hashes and retained failure](../development/evidence/m1-v3-ccr-worker-repair-2325cadb-raw/index.json).
### Current Worker exact-source qualification and retained governance results
Exact source `d11c57097ddd716610020bbb1ab5099b134aeb9c` passed the existing ten-package Worker lane **118 / 0 / 0**.
The first composition check remains **FAIL 9 / 1 / 0**; corrected source-path
normalization passed **21 / 0 / 0**. Actual snapshot caller errors are zero;
capacity still reports its existing qualifier CLI source difference.
The current full CCR attempt is **INCOMPLETE_IDLE_TIMEOUT** (watchdog exit 124;
stopped container exit 143, owned container removed). Current error count is **UNKNOWN**.
The previous completed 34-error observation remains historical and is not rebound.
[The exact current result and historical reference](../development/evidence/m1-v3-ccr-worker-current-d11c5709-raw/governance/full-ccr/errors.json) are retained.
Generic governance receipts did not capture an overlay inventory. The five
current source byte overlays and the original failed helper are separately
declared in [the governance record](../development/evidence/m1-v3-ccr-worker-current-d11c5709-raw/governance/governance-validation.json).
The immutable Worker index and historical evidence were not rebound.
Public contract evidence retains initial **16 / 1 / 0** and test-only overlay
**17 / 0 / 0**. Exact committed-source routing and snapshot Builder runs remain
PENDING / NOT-RUN; those independent prepared lanes continue after this commit.
No automatic CCR rerun or new gate is introduced. This increment does not promote G_PRE, full ci:local or cloud
qualification; external Staging/Production/hardware/Provider/Desktop/hosted CI
remain NOT-RUN. Progress remains **721.95/1200 = 60.1%**, with zero new credit.
Git Transition Status: remain `codex/m1-v3-execution`; merge main NOT_READY;
new feature branch NOT_NEEDED; no push. The unrelated precloud-plan edit is preserved.
## M1 v3 GX12.supply — Public and Builder exact-source evidence — 2026-10-04
Exact committed source `70d5498828274299a20d2dfe4452729ac4190b3f`
completed **17/0/0 Node public contracts**, **90/0/0 Go operation-routing
identities**, and **15/0/0 Snapshot Builder unit/configuration identities**.
The routing root substitutes business authority and proves routing coverage;
it does not qualify all current authorization behavior. Builder uses the
existing fake store and does not qualify PostgreSQL or a native Builder host.
Actual Node reads/imports, schema/handler membership, Go imports/testmain,
source snapshots and zero remaining owned resources are archived separately.
Only executed inputs are current authority; broad snapshots are provenance.
The two unchanged historical Public receipts now compose ten specified source
bindings with these runs and existing P35, generated, BOOT and Pages evidence.
Whole original receipts remain immutable. Missing old proof bytes, the
unexecuted historical qualifier CLI and unselected full package profiles
remain unqualified. The Builder supplement is registered for subsequent
existing component checks, without adding a new gate or runtime requirement.
Affected evidence regressions passed **33/0/0** (Public plus the reused
generated helper) and **14/0/0** (Builder). The initial Builder checker run
**13/1/0** is retained: its negative fixture removed only one duplicate Go
input record, leaving the real input union intact. The corrected fixture
removes all occurrences; the production verifier was not weakened.
CCR now emits one optional event after each real validation stage completes.
Validator order, error collection, result and watchdog budgets are unchanged;
there is no timer-based heartbeat. The actual full run completed all **34**
stages in about315 seconds with **25 remaining errors**, **FAIL**, and no
timeout. This observation predates the Public source composition. It is not
rebound to the subsequent edits. The full acceptance entry point opts into
the same observer; its complete execution is **NOT-RUN** in this increment.
The previous idle-timeout attempt and historical34 errors remain unchanged.
Actual post-registration Public Scope and Public Read caller checks now each
report only their existing qualifier-tool difference: all14 reviewed non-CLI
source-difference occurrences are resolved across the two receipts. The
registered Builder loader also validates all15 identities. This is an affected
caller observation, not a rerun or relabeling of the earlier full CCR25 result.
Continue the eleven existing qualifier-tool component bindings using their
independently executed semantics, affected capacity contracts and then the
remaining E10/full local CI work. Current CLI invocation, complete old
profiles, Staging, Production, cloud, hardware, paid Provider and Desktop
qualification remain explicit **NOT-RUN**. No runtime, migration, SDK or
LiveKit patch changes were made in this increment.
Progress remains **721.95/1200 = 60.1%**, with zero duplicate credit.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit
is preserved.
[Public raw source proof](../development/evidence/m1-v3-ccr-public-contracts-current-70d54988-raw/index.json); [Builder raw source proof](../development/evidence/m1-v3-ccr-builder-current-70d54988-raw/index.json); [Completed CCR failure and stage output](../development/evidence/m1-v3-ccr-stage-observation-70d54988-raw/index.json).
## M1 v3 GX12.supply — component qualification and complete CCR readback — 2026-10-04
The eleven existing component receipts now authenticate the exact reviewed
qualifier-tool change using independently executed SQL, migration, Public,
Worker, domain, generated and Builder evidence. Existing nine-SQL eligibility
remains separate. The complete original receipt, selected root and descendant
identities, source SHA/overlay, previous failed parents and external limits
remain enforced. No raw log is reconstructed and no current CLI run is claimed.
The shared matcher remains per invocation; it cannot cache a global PASS.
Actual bounded Linux checks on parent
`4afbfbc70fdccf5a14fee9ecd64ababd2329247f` plus the declared eight-file overlay:
- Component, retained SQL and migration regressions: **39/0/0**.
- All nine actual SQL callers plus integration counterexamples: **14/0/0**.
- Existing capacity reference-model and qualification contracts: **3/0/0**.
- Complete CCR checker: **34 completed stages, zero errors**, normal exit0
and zero owned containers remaining. The prior completed25-error failure
is retained unchanged with its original source and observer overlay.
This establishes current local checker consistency. The authoritative CCR-A
manifest still says **IN PROGRESS — Data Sync implementation and local
qualification**. It does **not** promote full CCR-A, G_PRE, complete historical
CLI profiles or full `ci:local`. Original runtime test sources remain their
respective committed SHAs; this checker overlay is not a replacement runtime
execution. Full acceptance and the remaining exact-candidate local CI continue
at the existing execution cursor.
Builder coverage remains unit/configuration only; routing coverage retains
its substituted authority; the capacity reference model establishes no real
capacity number or multi-replica/cloud result. Staging, Production, cloud,
hardware, paid Provider, Desktop and hosted CI remain **NOT-RUN**.
No runtime, migration, SDK or LiveKit patch changes are included.
Progress remains **721.95/1200 = 60.1%**, with zero duplicate credit.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit
is preserved.
[Exact source overlay, actual checks and retained prior failure](../development/evidence/m1-v3-ccr-component-continuity-4afbfbc7-raw/index.json).
## M1 v3 GX12.supply — E10 historical and current acceptance binding — 2026-10-05
The existing acceptance checker now verifies the immutable E10 record hashes
against commit `1259c542f33036bb943530a416f0c2af713762a2`, independently pins
the two reviewed current documents, and still runs every existing current E10
and CCR validator. The old ledger and its evidence have not been rewritten.
The reviewed document changes retain twelve historical GX03 summaries, six
current source-bound references and the 4608-byte private metric record limit.
Their document hashes do not qualify those historical summaries as new runs.
On parent `e3dc59b3de01980910377f889b3b679c815bfa55` plus the declared
three-file governance overlay, the ten E10 regression tests passed with zero
failures/skips. The complete M1 acceptance checker passed; all34 CCR stages
completed with zero errors. The earlier two-error acceptance failure remains
archived unchanged. Both runs exited normally and removed their owned containers.
This is local acceptance-checker consistency, with `m1_completion_proven:false`.
Full `ci:local`, full CCR-A, G_PRE and external qualification remain unfinished.
No runtime, migration, SDK, Provider or LiveKit patch changed. Continue the existing
full local CI cursor; no new audit gate or denominator is introduced.
Progress remains **721.95/1200 = 60.1%**. Git Transition Status:
`codex/m1-v3-execution`; merge main **NOT_READY**; new branch **NOT_NEEDED**;
no push. The unrelated precloud-plan edit is preserved. Staging, Production,
cloud, hardware, paid Provider, Desktop and hosted CI remain **NOT-RUN**.
[Actual checks, original failure and exact source bindings](../development/evidence/m1-v3-e10-acceptance-provenance-e3dc59b3-raw/index.json).
## M1 v3 GX12.supply — Redis loss proof in the owned Linux CI namespace — 2026-10-05
The existing Redis loss proof now accepts an explicit Linux CI runner ID and
ownership marker, verifies its label and actual network namespace, and creates
only its own Redis fixture in that namespace on a free loopback port. It does
not publish a host port in this mode. The default Linux host-published mode is
preserved; Windows native/Go execution is rejected. The original Go seed,
unavailable and empty-restart commands and assertions are unchanged. Cleanup
verifies the exact fixture identity and zero remaining owned containers before
the final PASS. No Docker settings, Defender settings or runtime code changed.
On parent `bb9fd6cb1871417ea1746099735d8fcd5521edf8` plus the declared
two-file tool/test overlay, affected Linux orchestration and existing scheduler
contracts passed **35/0/0**. These include command doubles and are not35 real
Redis cases. A separate actual Redis run passed all three original phases:
**seed / unavailable / missing**, with normal exit0, source unchanged and
confirmed owned cleanup. Two earlier real failures remain archived unchanged:
the first could not execute from `/tmp`; the second completed seed but could
not execute the cached Go binary from `/gocache`. The ignored runner's Linux
tmpfs exec options fixed these failures; its owned child-name readback assertion
was also tightened. The tracked tool/test hashes and Go proof assertions did
not change between those attempts.
A separate empty-payload network observation found daemon-host loopback
**ECONNREFUSED** and OSV HTTPS **TLS verified / HTTP200**. It sent no repository
content or credentials and is neither a dependency-audit PASS nor CI evidence.
The owned namespace path removes that host-networking dependency for this
fixture. All original failed logs and each ignored producer revision are retained.
This increment does not qualify full `ci:local`, full CCR-A, G_PRE, Production
capacity or any external environment. Continue the existing full local CI
cursor using the owned Linux source-volume runner; no new gate or denominator.
No runtime, migration, SDK, Provider or LiveKit patch changed.
Progress remains **721.95/1200 = 60.1%**, with zero added points.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit
is preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain **NOT-RUN**. Full `ci:local` is **NOT-RUN in this increment**.
[Original failures, actual Redis phases and bounded regression records](../development/evidence/m1-v3-redis-container-ci-bb9fd6cb-raw/index.json).
## M1 v3 GX12.supply — complete CI setup and pinned raw evidence preservation — 2026-10-05
Eight exact-source Linux CI attempts at `6dc61a0c018bc3a22701a2e148c58e2b697c2e12`
remain FAIL/INCOMPLETE with their original receipts, producer bytes and logs.
The owned source-volume runner reuses existing fixed Linux tools and fixtures;
the repository's complete `corepack pnpm ci:local` command remains unchanged.
Cache-copy and optional build-cache-transfer timeouts, readonly module-directory
extraction, runtime path validation, pnpm configuration/patch revalidation and
missing offline public metadata failures are retained separately. Preparation
probes and Python toolchain compatibility are observations, not product tests.
The final attempt completed normal pnpm frozen-lockfile/frozen-store installation
into fresh owned node_modules from the read-only repository package store.
Public package metadata was allowed for the unchanged supply-chain policy;
package downloads were not substituted for the frozen store. No timestamp or
dependency-validation bypass, capability escalation, Docker/Defender setting
change or Windows native execution was used. All owned fixtures were removed.
That actual CI command then failed OS-PLATFORM-0009's pinned raw receipt check:
the original registry already pins the 2163-byte CRLF receipt, while Git had
normalized its committed blob to 2093 LF bytes. The narrow correction preserves
that existing receipt unchanged using one path-specific `-text` attribute and
commits its original bytes. The registry's pinned SHA and historical result are
unchanged. Runtime, migration, SDK, Provider and LiveKit patch code did not change.
Affected checks and Git roundtrip evidence are recorded with their own actual
source/overlay bindings in the index. They do not turn the failed complete CI
into PASS. Resume the unchanged full CI command after committing this correction.
Progress remains **721.95/1200 = 60.1%**, with zero added points and no new gates.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit
is preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain **NOT-RUN**. Complete local CI remains **FAIL/INCOMPLETE**.
[Original attempts and scoped correction evidence](../development/evidence/m1-v3-local-ci-setup-6dc61a0c-raw/index.json).
## M1 v3 GX12.supply — installed dependency evidence portability — 2026-10-05
The complete unchanged Linux `corepack pnpm ci:local` command at
`875a6939e8006bd7dc4a9758cdb9a25c13e61998` remains **FAIL/INCOMPLETE**.
Normal frozen dependency installation and preceding contract checks succeeded,
but acceptance completed 34 CCR stages with 26 source-drift errors. The original
receipt, actual producer and logs are retained; all owned resources were removed
and the exact source stayed unchanged. No runtime CI qualification is inferred.
The narrow correction preserves the original pinned Pages domain log in Git and
makes evidence comparison account for pnpm's regenerated installation timestamp.
Actual fresh installation changed only `prunedAt`: Generated 420 dependency
files retained their bytes and resolution; Public 169 files had only that
metadata-byte difference and no resolution difference. Lock bytes stayed exact.
Canonical JSON validation rejects duplicate keys instead of accepting a parsed
object with a discarded conflicting value. Final affected regression passed
**59/0/0**, and the real fresh-metadata comparison passed separately.
Original historical pins and failed results remain unchanged. Dependency content,
lock bytes, resolver paths and all non-timestamp installed metadata retain their
existing checks. The recorded readback and affected checks bind only their actual
source/overlay. Initial **58/0/0** regression and acceptance **34 stages / 0
errors** belong to the pre-canonical overlay; final
canonical-parser regression and fresh-metadata checks have separate bindings.
The final standalone acceptance is not rerun: the next complete CI includes it.
This does not promote historical whole-profile results or mark
the failed complete CI as PASS. Runtime, migrations, SDK, Provider and LiveKit
patch code remain unchanged.
Progress remains **721.95/1200 = 60.1%**, with zero added points and no new gates.
The unchanged complete CI must run again from the next committed candidate.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain **NOT-RUN**.
[Actual failed CI and scoped evidence correction](../development/evidence/m1-v3-ccr-install-state-875a6939-raw/index.json).
## M1 v3 GX12.supply — historical raw evidence and format preservation — 2026-10-05
The unchanged complete Linux `corepack pnpm ci:local` at `6d732060bec2006ba468002615a302b347e9f464` remains
**FAIL/INCOMPLETE**. Existing acceptance finished all 34 CCR stages with zero
errors, the lock check passed, and the real OSV dependency audit passed for 76
packages. Those are only the observed command scopes; runtime CI did not finish.
Format then rejected two prose EOFs and seven historical raw-output files.
The original failed receipt, producer, logs and source identity remain archived.
The correction adds only the missing final LF to the two prose documents.
Seven exact raw paths require their original SHA-256 plus explicit Git attributes
before whitespace exemptions apply; neighboring paths and changed raw content
remain checked. All seven original working byte sequences and historical pins
remain unchanged. One portal log had previously been normalized in Git; its
original 2595-byte CRLF content is restored to match the unchanged registry pin,
with the previous 2507-byte Git blob recorded separately. No historical test
result is upgraded. Affected regression passed **6/0/0** at its declared
source overlay. Runtime, migration, SDK, Provider and LiveKit patch are unchanged.
Progress remains **721.95/1200 = 60.1%**; zero points and no new gates.
The next committed candidate still needs the unchanged complete CI.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain **NOT-RUN**.
[Actual failed CI and scoped correction](../development/evidence/m1-v3-format-provenance-6d732060-raw/index.json).
## M1 v3 GX12.supply — registry EOF correction — 2026-10-05
The unchanged complete Linux `corepack pnpm ci:local` at `7054d3e89bce7b6fd082410cbca4d3de56c6451e` remains
**FAIL/INCOMPLETE**. Existing acceptance completed all 34 CCR stages with zero
errors; lock verification, the real 76-package OSV audit and full format checks
passed at that exact source. Those command results do not qualify complete CI.
The next branch-diff check found one extra final blank line in
`docs/development/contract-requests/registry.yaml` at line 3217.
The correction removes exactly one trailing LF from the 149037-byte committed
registry. Its body, parsed meaning, nine Contract Requests and original evidence
pins are unchanged. Actual contract and generated-fixture checks passed at this
one-file overlay. The Linux readonly-mount branch-diff invocation failed with
exit 1 and empty output; its cause remains unestablished and its raw failure is
retained. The same existing branch-diff checker passed separately in bounded
Windows Node/Git only, with no native test execution. That result does not prove
the Linux failure repaired. The failed complete CI receipt, producer and logs
retain their original source; all owned fixtures were removed. Runtime,
SDK, migration, Provider and LiveKit patch code did not change.
Progress remains **721.95/1200 = 60.1%**; zero points and no new gates.
The next committed candidate still needs unchanged complete CI.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain **NOT-RUN**.
[Actual failed CI and one-LF correction](../development/evidence/m1-v3-registry-eof-7054d3e8-raw/index.json).
## M1 v3 GX12.supply — native webhook field scan classification — 2026-10-05
The unchanged complete Linux `corepack pnpm ci:local` at `77169f7969f7d1cfcfd2b772a9eb13e61e04cebe` remains
**FAIL/INCOMPLETE**. Existing acceptance completed all 34 CCR stages with zero
errors; lock verification, the real 76-package OSV audit, full format, branch-diff
and specification checks passed at that exact source. Those observed command
results do not qualify complete CI. The forbidden-contract scan then flagged
`agent_budget_integration_test.go` for one official native webhook field.
The correction adds that exact existing integration-test path to the scanner's
existing native integration-test allowlist and extends its existing regression suite.
The native test and Go/runtime bytes are unchanged; no directory-wide allowance,
new runtime abstraction or canonical media contract is introduced. Actual affected
regression passed **7/0/0**, and the existing full forbidden-contract scan
passed at the declared two-file overlay. Earlier receipts retain their exact
source identities. All owned CI resources were removed.
Progress remains **721.95/1200 = 60.1%**; zero points and no new gates.
The next committed candidate still needs unchanged complete CI.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain **NOT-RUN**.
[Actual failed CI and scoped native webhook field classification](../development/evidence/m1-v3-native-track-provenance-77169f79-raw/index.json).
## M1 v3 GX12.supply — Portal workspace root and framework provenance — 2026-10-05
The unchanged complete Linux `corepack pnpm ci:local` at `81a4f1495939998e2aa0766ce2217569fb9906d8` remains
**FAIL/INCOMPLETE**. The existing acceptance and separate CCR-readiness invocations
each completed 34 stages with zero errors. Lock/OSV, full format, branch diff,
specification/generated consistency, fresh-schema migration, selected local SDK
and Linux native proof commands, and the synthetic JavaScript quickstart passed
within their observed scopes. This is not complete CI or hardware qualification.
Actual Next.js 16.3.6 output shows that automatic root discovery ignored the
workspace because HOME was inside `/workspace/.build/ci-home`; resolution was
then confined to `/workspace/apps/developer-portal`, unable to locate Next.js.
The correction explicitly sets the existing Portal Turbopack workspace root.
The build proof and existing test now read the actual installed framework version
and compare it with the exact package pin, instead of labeling a 16.3.6 build as
16.3.3. [Official root configuration](https://nextjs.org/docs/app/api-reference/config/next-config-js/turbopack#root-directory)
explains this setting. Historical E9 16.3.3 evidence remains unchanged.
The separately closed affected qualification proves two byte-identical private
static exports and **23/0/0** affected tests at the declared three-file
overlay. It does not rebind the original failed CI to corrected source, start a
public deployment, or qualify complete CI. All owned resources were removed.
`docs/developer/CHANGELOG.md` is itself a Portal build input and receives this
closure entry after that affected build. Therefore this export qualifies only
the recorded parent plus three-file overlay, not the final documentation or next
commit. The next complete CI must rebuild the final committed source and docs;
the archived proof is not installed into the host `.build` or rebound.
Progress remains **721.95/1200 = 60.1%**; zero points and no new gates.
The next committed candidate still needs unchanged complete CI.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and hosted
CI remain **NOT-RUN**.
[Actual failed CI and scoped Portal root correction](../development/evidence/m1-v3-portal-root-provenance-81a4f149-raw/index.json).
## M1 v3 GX12.supply — current CI language expectations and fixture provenance — 2026-10-05
The unchanged complete Linux `corepack pnpm ci:local` at `47e4a910999ed25ead9ea1530d4a56f9d16bc06b` remains
**FAIL/INCOMPLETE**. Its two existing 34-stage CCR validations completed with zero
errors and preceding lock, format, branch-diff and spec checks passed within
those commands' scopes. Actual Node and Go failures then occurred. The inner
command ended with `ATTEMPT_TIMEOUT`; its child command receipt and complete
suite aggregate were unavailable. The outer producer exited 1 with no outer
watchdog timeout. Source bytes remained unchanged and all owned resources were
removed. Partial output is not a complete or zero-failure test result.
The corrections update the catalog test's explicit current 26-Action expectation,
independently bind E9 harness tests to current source and generated manifests
while rejecting historical qualification, and run the existing `--write-lock`
generator for the current Device conformance asset. The host generator failed
on the missing `yaml` dependency; the isolated Linux generator succeeded.
Historical acceptance Ledger and browser/operator receipts remain unchanged.
The four HTTP fixtures obtain fresh Device authority after generation-changing
revoke/restore, retain old-token rejection, and use dedicated two-seat Rooms
so capacity cannot mask lock-order checks. Public Room limits, runtime code
and protocol semantics remain unchanged. No manual browser execution is claimed.
The isolated Python toolchain preparation preserves its first failed attempt,
then demonstrates the old launcher's failure and the corrected launcher's
success under the existing closed environment. That observation qualifies only
toolchain compatibility; the later actual product tests carry their own scope.
The first affected batch at its original seven-file overlay recorded Node
**19/0/0**, Catalog **3/0/0**, Providers **117/0/0**, Mock **104/0/0** and Task
shutdown **19/0/0**. The HTTP group recorded **194 pass / 7 failure events /
0 skip**, including parent failure summaries. Those original source bindings
and failed raw logs are retained. Its two deterministic Portal builds covered
13 routes and 91 files, with export digest
`56bc6838e37c17e3f62a8f0dbb566d144cda438c114fbaf933301012bf7936ae`.
This export precedes the closure CHANGELOG/documentation changes and does not
qualify the final committed export. The next complete CI must rebuild it.
The separate follow-up changes only two fixture files: the capacity-lock
observer applies to the human path, and the Device probe requires old tokens
to return **401/token_invalid** while a fresh authenticated token without the
read grant returns **403/grant_missing**. No grant is added. The complete
`TestProductRealtimeRedisIssuanceAndRevokedReplay` root passed **94/0/0** with
its format and module-integrity checks. The earlier green lanes were neither
rerun nor rebound to this corrective overlay. Both runs have confirmed zero
remaining owned containers, volumes and networks. Their results do not qualify
unrelated or interrupted suites, or complete CI.
Progress remains **721.95/1200 = 60.1%**; zero points and no new gates.
Complete CI still requires a successful run of the committed candidate.
Git Transition Status: `codex/m1-v3-execution`; merge main **NOT_READY**;
new feature branch **NOT_NEEDED**; no push. The unrelated precloud-plan edit is
preserved. Staging, Production, cloud, hardware, paid Provider, Desktop and
hosted CI remain **NOT-RUN**.
[Actual CI failures and scoped current-source corrections](../development/evidence/m1-v3-ci-language-provenance-47e4a910-raw/index.json).
## M1 v3 GX07.bridge — Control API Agent Host composition prerequisite — 2026-10-05
Control API now composes the existing public AgentExecution and private
Bootstrap/Claim owners behind explicit, validated operator configuration.
The existing Service identity, PostgreSQL authority and exact private routes
remain in force; credential membership performs no Secret backend reads.
Actual Linux qualification on `04f0088c4d52d41b845f13017b04e691cc03baf3` plus the declared 16-file Go overlay:
**315 pass / 0 fail / 0 skip**; the dependent Gateway fixture is separately
compile-only. Tested inputs stayed unchanged and owned resources were removed.
The preceding exact-parent complete CI remains FAIL/INCOMPLETE due to E6/CCR
source bindings; its raw failure and all historical evidence are preserved.
Reconcile affected closures before another unchanged complete CI run.
This prerequisite does not complete GX07.bridge or add points:
**721.95/1200 = 60.1%**, with GX07 still 0%. Actual Worker/session/plugin effects,
renew/revoke and output/Action/Usage integration remain; external qualification
is NOT-RUN. Git Transition Status: `codex/m1-v3-execution`, merge main NOT_READY,
new branch NOT_NEEDED, no push. Preserve the unrelated precloud document.
[Actual Agent Host qualification and retained CI failure](../development/evidence/m1-v3-agent-host-composition-04f0088c-raw/index.json).
### 2026-10-05 — CCR current-source closure
- Bound E6, PG5, Storage, RTC and dependent composition checks to the exact current source `dfe3651cc75ef4f331ac97680cc3678e04f41f41`.
- Kept historical Storage and E6 archives on explicit historical verification paths; retained the PG5 parent failure and TaskInput follow-up separately.
- Added current Storage lane assertions and updated Consent revalidation coverage to consume authenticated qualifier/Consent corrections without changing external NOT-RUN gates.
- Local evidence: 101/0/0 affected governance checks, 13/0/0 Storage boundary checks, 9/0/0 component checks and 6/6 real revalidation validators. No hosted or cloud qualification was performed.
### 2026-10-05 — E6 current-source fail-closed hardening
- Required the active E6 reference to use the exact DFE3651C current archive; historical 7C7F334A evidence is now historical-only.
- Added the legacy-selection regression and reran E6 17/0/0, affected governance 101/0/0, six real Consent/Data Sync validators 6/6, and Registry hash validation.
### 2026-10-05 — current-source GX19 contract evidence
- Added source-bound current commit evidence for the 44-case Node Task/RTC contract suite (44 pass, 0 fail, 0 skip).
- Kept the Windows-native execution guard and all external qualification limits explicit; no progress denominator or earned points changed.
### 2026-10-05 — historical acceptance test bindings
- Corrected three legacy acceptance assertions to preserve E4 historical snapshot provenance and reuse the existing E10 historical/current document validator.
- Affected acceptance/progress/provenance tests passed 84/0/0. Historical pins, current runtime gates and external NOT-RUN states are unchanged; full local CI is still unqualified.
### 2026-10-05 — portable local validation evidence
- Archived an existing governance receipt and logs so the status document works in an isolated committed checkout without the host `.build` cache.
- Retained the exact `0101f590` full CI failure at the documentation check; later CI lanes remain unexecuted by that attempt.
## Complete-CI empty output archive correction — 2026-10-05
Preserve the original empty stderr bytes in a lossless wrapper and retain the
failed exact `ff40d525` CI attempt. No runtime, CI gate or progress credit changed.
Complete local CI remains unqualified pending a successful candidate run.
## Partial official Agent business lifecycle — 2026-10-05
- Reuse existing HTTPS owners for bootstrap/effects/renew/stop/release of one
official job, with independent expiry and honest unconfirmed-stop reporting.
- Linux race regressions passed 88/0/0 on the declared parent plus overlay.
This does not activate a production Worker or qualify native Provider effects.
- Preserve the exact-parent full-CI timeout separately; no complete-CI or bridge
points, new gates, upstream patch changes or external qualification.
## CCR immutable Git read reuse — 2026-10-05
- Reuse exact immutable Git objects within one evidence-check context. Current
source, logs, Ledger and ancestry remain live reads; no extra PASS cache.
- The three affected suites passed 35/0/0. All original 34 CCR stages passed
before and after, measured at 234.114s and 190.684s (18.6% reduction
in one sequential pair). Full CI and product capacity are not qualified.
- Preserve the initial dependency-layout failure and corrected environment
records. No runtime, SDK, migration, upstream patch or progress credit change.
## Local CI fixture separation and immutable journal regression — 2026-10-05
- Build actual Control from current source for the diagnostic fixture when no
explicit packaged artifacts are supplied. Partial/invalid explicit artifact
configuration still fails. Reuse owned PG/Redis and HTTPS Consent setup;
remove unrelated LiveKit/Room execution prerequisites from this SQL diagnostic.
- Separate Realtime command Redis DB6 from Control command policy DBs0–5.
Include FK dependants in the journal TRUNCATE probe, preserving required
immutable-guard SQLSTATE23514 and unchanged durable rows.
- Affected Linux race suites passed63/0/0. Preserve the exact-source full
CI-phase failures/timeouts and a separate live-policy-window probe that did
not prove its timing condition. No runtime/SDK/migration or progress change.
## Official Worker process handoff — 2026-10-05
- Reuse official AgentServer PROCESS prewarm/entrypoint and the existing Go
business bridge through a bounded private Unix job channel. Signing keys and
claim handles remain in Go; selection uses the existing redacted private wire.
- Correct multiprocessing test entrypoint import with a main guard. Real Linux
spawn/forkserver, idle prewarm and Go/Python interchange are covered.
- Exact parent af0a0fe0 plus nine source files passed139/0/0. This consumer still
rejects an unavailable plugin graph before effects; host activation and
active plugin/media/Usage qualification remain incomplete. No GX points.
## Fixed official Agent graph construction — 2026-10-05
- Resolve selected exact-version credentials through the existing Provider
credential source after business effects admission. Reuse the private job
channel, fixed official OpenAI1.8.2 graph and explicit host endpoint/privacy
bindings; no ambient model/credential fallback or upstream patch.
- Construct official Agent and empty AgentSession without model prewarm or
active start, then actually close and join all owned prepared resources.
- Parent1c559f77 plus eleven overlays passed157/0/0. Preserve earlier failures,
the rejected eager-prewarm run and the separate nonexecuting comment delta.
Active input/output/envelope, host activation and Usage remain incomplete;
this adds zero points and does not qualify full CI or external environments.
## CCR observer and authorization preflight — 2026-10-05
- Reject missing execution/scenario authorization and required tokens before
readiness and workload-file I/O. Authorized execution and preview retain full
current readiness; completed-stage output reports actual work only.
- Preserve observer/configuration assertions while removing repeated full
readiness runs from tests that only need actual manifest configuration.
- Original parent1c559f77 plus twelve test/tool files passed116 observer/preflight
cases and6 separate tamper cases. The retained readiness suite has10 passes
and5 current-source qualification failures; preview result remains untested
beyond refusal. No full CI/CCR-A or cloud PASS, no progress credit.
## Official Agent Worker host and command — 2026-10-05
- Compose the existing workerhost, schema verifier, durable Service identity,
signed bootstrap/claim clients and business bridge into a Linux Agent command.
The official Python CLI retains registration, placement, pools and drain.
- Use fixed isolated Python arguments, an empty environment and bounded private
pipes. Reuse the Task command's exact file/version/digest Secret projection
through one internal package; idle startup does not fetch Provider secrets.
- Preserve cleanup ownership after partial startup. Unconfirmed process/job
cleanup prevents retiring HTTPS/database dependencies; forced termination
never establishes graceful business Stop, release or financial settlement.
- Original command/Task/Host qualification passed90/0/0 and separate official
Python CLI qualification passed26/0/0 on their declared parent1c559f77 source
overlays. These results are not rebound to later Host containment changes.
Active graph execution and full local/external qualification remain open.
- Correct unexpected-leader descendant containment and revoke numeric group
signalling before reap. Do not hold its lock across inherited-I/O join.
Final affected Go qualification passed53/0/0; three actual official-Python
Host regressions passed3/0/0 on matching runtime bytes. Earlier52-pass and
Python2/1 runs retain their own snapshots and are not current qualification.
## Actual native Agent bootstrap visibility — 2026-10-05
- Distinguish a matched live dispatch's unpublished/exact-pending job from
terminal, missing or conflicting native facts. Only initial bootstrap observes
that transient state again within the unchanged authority deadline.
- Keep current final authority checks, exact job/binding, one-shot claim/effects
and no mutation while waiting. Upstream discovery remains unchanged.
- Actual registration/dispatch, signed bootstrap and preconnect stop/release
pass pipeline, realtime and revoked-Grant scenarios. Final34/0/0 events retain
exact parent1c559f77 plus eleven overlays and four original failed attempts.
Active graph/media, production WSS, Usage and external gates remain open.
## Separate local Agent artifact and bounded RECORD inventory — 2026-10-05
- Add an independent pinned Agent image/context builder, reusing the existing
Task stdin supervisor and artifact tools. Agents remains disabled/unqualified;
local imports and config refusal do not establish deployment readiness.
- Stream recorded payload checksums with bounded memory and I/O while preserving
anchored path and mutation checks. All27 scanner tests pass; the unchanged
local image verifies6108 records including its35MB native library.
- Preserve original source bindings and failed attempts, PARTIAL integrity and
unresolved NOTICE/first-party/native/OS inventory. No full SBOM/legal clearance,
active AgentSession, external qualification or progress-point increase.
- Reject unlisted Go/Python/embedded files, source links and changed or missing
bytes in the reusable Agent builder. Separate16/0/0 Node file-closure tests
preserve original image evidence; no image rebuild is inferred.
## Selected Agent inputs and official assignment identity — 2026-10-05
- Use official JobRequest.accept for fresh opaque assignment identity and expose
only the sealed exact identity from the existing native job reader.
- Add a bounded exact selected-input consumer with SUBSCRIBE_NONE and joined
disconnect ownership. The production entrypoint still does not activate it;
local selection is not server permission.
- Preserve original59, subsequent64 and separate reader58/0/0 evidence without
combining overlapping cases or claiming native admission, media or full CI.
No upstream patch or earned progress changed.
## Agent durable Connection and RTC quota preparation — 2026-10-05
- Bind the existing claim and sealed native identity to one distinct Agent seat
and original RTC reservation. Keep hard lifetime separate from renewable lease.
- Preserve external native lookup column privileges; migration125 carries only
the private immutable Agent association and quota storage guard.
- Recheck lease after locks, retain idempotent seat/budget and account only for
the owner's two Room lifecycle writes before full authority recheck.
- Preserve failed attempts and exact eighteen-file source binding. Local PG,
original Human SDK join and Device regressions pass; native Agent media,
all-node Agent authorization and complete bridge/full CI remain unqualified.
## M1 v3 CCR evidence refresh at source 87526211 — 2026-10-05
- Authenticate the existing E6/PG5/RTC scopes against explicit875 execution anchors while retaining all historical receipts and failures.
- Preserve the failed PG5 parent and qualify only its independently corrected S235 scope; keep unchanged TASKINPUT36 at its original DFE source.
- Retain actual source/membership checks, verify lossless archive transport, and reject later Agent/migration125 drift.
- Record161 unique Node qualifier/regression cases without adding progress points or claiming that failed multi-suite commands passed.
These selected results do not qualify a later HEAD. Changed Agent compiled inputs or migration125 membership must still fail closed until their own affected evidence is available. Full local CI, full CCR-A and G_PRE remain unqualified; no milestone points or denominator change. Staging, Production, cloud, paid Provider, Desktop, hardware and hosted CI remain NOT-RUN for this increment.
## Private Agent RTC authority composition — 2026-10-05
- Reuse original Worker Service/Grant history for the durable current claim,
independent of original Human and signed native-policy caller authority.
- Compose existing model/hold, native assignment and distinct RTC seat/coverage;
keep full transaction rechecks and separate hard, lease and use deadlines.
- Preserve the failed attempt. Correct only cancellation cleanup and invalid
negative-input tests, with explicit cancellation and unchanged durable facts.
- Revalidate affected private/adapter scope and actual migration125 readback;
do not promote earlier passing packages to a new source or enable Agent media.
## Windows Go qualification fail-closed guard - 2026-10-06
The repository Go test and Go check entrypoints now stop before any Go command on
Windows. This prevents Windows from creating or launching native test.exe
artifacts after the Defender quarantine event and directs qualification to the
authorized Linux/native lane. The guard is covered by the Windows CI hygiene
suite. Direct Windows invocations returned the expected nonzero safety error;
no Go test, native executable, Docker, cloud, Staging, Production or hardware
qualification was run. The existing Owner precloud-plan edit remains separate.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push.
## GX16 Task context projection Linux race evidence - 2026-10-06
Bound the current provider context projection and Task Voice pipeline binding to
source d750b7fe4817507e19cd2aa2bfa2693e6668dd12. WSL Ubuntu executed the four
affected Go packages with the repository-owned module cache, GOPROXY=off and
race instrumentation: 4 package passes, 0 failures and 0 skips. The missing
go-cleanhttp report is cleared for this cache: go mod download and go mod verify
both pass. Windows native Go tests were not run, and no ledger points or
denominator changes were made. Staging, Production, cloud, hardware and hosted
CI remain NOT-RUN.
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push.
## GX15 Task Voice Linux race/vet corroboration — 2026-10-06
- Bound seven existing Task Voice packages to current source `a69a26f8`; WSL race and vet both passed 7/0/0.
- Kept the historical d750 provider-context race receipt unchanged and recorded this independent current-source receipt.
- No Windows native executable, service fixture, cloud, Staging, Production, hardware or hosted CI qualification was claimed; no ledger points or denominator changed.
## Platform core Linux race/vet corroboration — 2026-10-06
- Re-ran nine existing realtime-core, Task provider and domain packages at `c0b6fea7`; WSL race and vet both passed 9/0/0.
- The receipt is local source-bound corroboration only; it adds no ledger points and does not qualify AgentSession, media, paid Provider, service fixtures or external environments.
## E7 current JavaScript SDK contract qualification — 2026-10-06
- Current E7 package, consumer, AudioWorklet and protocol suites pass 316/0/4.
- Four real Gateway/WebSocket cases remain required NOT-RUN on the authorized Linux/native lane; no external or ledger credit was claimed.
## E8 ESP32 governance and source digest qualification — 2026-10-06
- ESP32 scope, artifact, memory and Linux-lane governance tests pass 67/0/0.
- Current 106-file ESP32 source digest recorded; no native compiler, binary, hardware or external qualification was claimed.
## GX16 Python Provider runtime local qualification — 2026-10-06
- Python 3.14.7 Provider runtime tests pass 22/0/0 for protocol, credential erasure, safe errors and deterministic lifecycle.
- Evidence remains offline synthetic only; no paid Provider or external canary qualification was claimed.
## Data Sync current-source evidence sweep — 2026-10-06
- The full Data Sync evidence-test sweep returned 69 pass, 25 fail and 0 skip.
- Failures remain fail-closed stale source receipts/composition prerequisites; no historical result was rebound and no cloud or Staging claim was made.
## M1 v3 current Linux RTC/Task/Usage unit qualification - 2026-10-06
The current source `cf885a6630f5b3605ab4dca207cae20343caaa74` passed the existing
Task/Provider/Usage unit packages (21/0/0) and the RTC policy/lifecycle/LiveKit
adapter packages (4/0/0, with one package containing no test files) in WSL Ubuntu.
The same selected subset passed with `GOWORK=off GOPROXY=off GOSUMDB=off`, confirming
the repository-owned Go module cache contains `github.com/hashicorp/go-cleanhttp@v0.5.2`.
No Windows native executable, service fixture, AgentSession, paid Provider, cloud,
Staging, Production or hardware qualification is claimed; no ledger points or
denominator changed. [Evidence](../development/evidence/m1-v3-rtc-task-agent-linux-unit-cf885a66.json)
## GX07 official Agents Linux process qualification - 2026-10-06
The locked official `livekit-agents==1.8.2` PROCESS and process-handoff suite
passed 64/0/0 against current source `53908de5b0f06e9ee685e2a17ab93c3630cb4c6f`.
The run used an exact Linux ext4 source copy because the `/mnt/c` multiprocessing
harness timed out during executor initialization. This is local official process
qualification only; active dispatch, durable output/Usage, paid Provider, cloud,
Staging, Production and hardware remain NOT-RUN, and no ledger points changed.
Evidence: [m1-v3-official-agents-process-current-53908de5.json](../development/evidence/m1-v3-official-agents-process-current-53908de5.json).
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push.
## GX07 Agent bridge and LiveKit Go boundary qualification - 2026-10-06
The current Agent execution bridge and LiveKit adapter packages passed WSL race
tests 3/0/0 and `go vet` for all three packages at source
`b14a8ea3743f84b487e4d986c9f266820437bf06`. The run was offline against the
repository-owned Go cache. It verifies the existing bridge/adapter boundaries;
the selected graph remains unstarted and no active dispatch, durable Usage,
Provider, cloud, Staging, Production or hardware qualification is claimed.
Evidence: [m1-v3-agent-bridge-livekit-go-current-b14a8ea3.json](../development/evidence/m1-v3-agent-bridge-livekit-go-current-b14a8ea3.json).
Git Transition Status: codex/m1-v3-execution; merge main NOT_READY;
new feature branch NOT_NEEDED; no push.
## Local Agent worker owned-PostgreSQL qualification — 2026-10-06
The Linux-only Agent worker process test now gives the full ELF build a separate bounded 180-second window on WSL-mounted workspaces, disables VCS probing, and preserves build stderr on failure. Source-bound qualification at `598f0a4af375152a6bb50152d76b81cfaf2c048a` passed 3/0/0 with an owned PostgreSQL fixture and verified the actual command's read-only schema, no idle provider reads, helper join, inactive worker, and argv/ambient-PostgreSQL rejection. Windows-native execution, cloud, Staging, Production and hardware qualification remain unrun. [Evidence](../development/evidence/m1-v3-agent-worker-owned-postgres-current-598f0a4a.json)
## Core runtime local unit qualification — 2026-10-06
Selected Task Voice, Usage, RTC worker and LiveKit adapter packages passed 10/0/0 in the offline WSL Go lane at source `2c1db563c67129a2ec53c3659f1c4bfb25342e71`. This is local boundary evidence only; native Windows, cloud, Staging, Production, hardware, external Provider and hosted CI remain unrun. [Evidence](../development/evidence/m1-v3-core-runtime-unit-current-2c1db563.json)
## Native compatible-client P2–P5 adversarial qualification — 2026-10-06
The pinned Linux Docker lane at source `f15784bf03856db07a5854484b7302cd3e9c9025` passed five focused LiveKit host test roots with zero failures or skips. Coverage includes publish, subscribe, data, RPC/Agent, mutation, terminal revocation, privilege expansion and invalid input rejection. This remains local adapter evidence; deployed media, Provider, cloud, Staging, Production and hardware qualification are not claimed. [Evidence](../development/evidence/m1-v3-native-client-adversarial-current-f15784bf.json)
## Gateway fixture Redis isolation — 2026-10-06
The owned realtime-gateway process fixtures now use deterministic, non-overlapping development Redis databases (7, 8 and 10); the two private stack nodes intentionally continue sharing DB 8 as one authority cohort. The current package configuration/artifact checks passed 4/0/0 in the pinned Linux Docker lane. This is fixture qualification only and adds no runtime, ledger or denominator credit. [Evidence](../development/evidence/m1-v3-gateway-fixture-redis-isolation-current-d8460709.json)
## Realtime gateway package checkpoint — 2026-10-06
The complete `cmd/realtime-gateway` package passed 8/0/16 in the pinned Linux Docker lane. The 16 skips are explicit external-fixture requirements (PostgreSQL/Redis, LiveKit management, native artifacts or private stack volume); they remain NOT-RUN and are not counted as PASS. [Evidence](../development/evidence/m1-v3-realtime-gateway-package-current-57555e27.json)
## Go vet checkpoint — 2026-10-06
The root `go vet ./...` lane now passes in the pinned Linux Docker environment. Two protobuf `WebhookEvent` test fixtures were changed from value copies to `proto.Clone`, removing copylock diagnostics without changing production code or runtime authority. [Evidence](../development/evidence/m1-v3-go-vet-current-3cbd3c01.json)
## Owned worker process qualification — 2026-10-06
With a pinned owned PostgreSQL container and `CGO_ENABLED=1` Linux Docker lane, `cmd/task-maintenance` passed 9/0/0 and `cmd/usage-worker` passed 4/0/0, including their race builds and durable recovery cases. Native RTC, authority/browser/SDK and external environments remain NOT-RUN. [Evidence](../development/evidence/m1-v3-owned-worker-processes-current-1c0ac520.json)
## Agent worker owned-host qualification — 2026-10-06
The current source `cmd/agent-worker` package passed 5/0/0 in the pinned Linux Docker lane with an owned PostgreSQL fixture, including strict config/no-I/O, startup release, orphan exit cleanup, owned-host schema and ELF lifecycle checks. The emitted Agent ELF was read back by SHA-256; no Provider or official livekit-agents dispatch is claimed. [Evidence](../development/evidence/m1-v3-agent-worker-owned-postgres-current-517cc53c.json)
## Controlrepo authority shape checkpoint — 2026-10-06
The current source passed 17 selected controlrepo authority, admission projection, replay identity and fail-closed boundary tests with 0 failures and 0 skips in the pinned offline Linux lane. This is local shape evidence only; database-backed integration, native clients, cloud, Staging, Production and hardware remain unrun. [Evidence](../development/evidence/m1-v3-controlrepo-shape-unit-current-c01760c6.json)
## Closed ContextSnapshot Provider egress contract — 2026-10-06
GX15.task now has a server-owned closed egress inventory: only typed locale.language at priority 100 is projectable, duplicate and unknown kinds reject, and raw values or item metadata cannot cross the Provider boundary. The context snapshot, Provider and Task Voice pipeline packages passed 3/0/0 in the pinned offline Linux lane. Real Provider, PostgreSQL-backed projection, cloud, Staging, Production and hardware remain unrun. [Evidence](../development/evidence/m1-v3-context-provider-egress-current-b627e8df.json)
## Context egress/provider abort boundary — 2026-10-06
The Task Voice pipeline test now binds the closed ContextSnapshot egress projection to Provider startup and verifies that an explicit provider abort cleans up without publishing an unauthorized durable terminal. The three affected Go packages passed 3/0/0 in the pinned offline Linux lane. [Evidence](../development/evidence/m1-v3-context-provider-egress-current-2a0e10bd.json)
## Context egress race qualification — 2026-10-06
The closed ContextSnapshot Provider egress and Task Voice consumer packages passed the Linux race lane 3/0/0. This remains local concurrency evidence; PostgreSQL-backed projection, real Provider and external qualification are unrun. [Evidence](../development/evidence/m1-v3-context-provider-egress-race-current-dfe6577d.json)
## GX15 ledger alignment — 2026-10-06
The active M1 v3 ledger now reflects the completed server-owned ContextSnapshot Provider egress mapping and provider-abort boundary evidence, while preserving the existing 90% earned progress, denominator and remaining Provider/Usage/WSS handoff work. [Evidence](../development/evidence/m1-v3-context-provider-egress-current-2a0e10bd.json)
## PostgreSQL ContextSnapshot projection qualification — 2026-10-06
A real owned PostgreSQL fixture exposed and then verified the JSONB whitespace correction in the closed ContextSnapshot Provider projection. The three local unit packages passed 3/0/0 and the PostgreSQL taskrepo projection roots passed 2/0/0. [Evidence](../development/evidence/m1-v3-context-projection-postgres-current-29e1b225.json)
## GX06 local Linux fixture evidence — 2026-10-07
On exact source `b9d420a744a2b098641e870247945f3211813679`, the WSL/Linux Docker fixture passed 58 RTC connection/admission events with zero failures or skips and verified owned cleanup. The durable Room/worker fixture produced 267 passing events and one explicit required skip for the fixed `127.0.0.1:7880` Agent dispatch fixture; that skip remains unqualified. A temporary owned-PostgreSQL fixture also passed the `cmd/agent-worker`, `cmd/task-maintenance` and `cmd/usage-worker` race suites with zero failures/skips, clearing those worker fixture gaps. The full Go gate still has seven native RTC/browser/SDK tests that require separately owned native host/authority artifacts; they remain unqualified. No completion credit is added and no Windows native binary, hosted CI, Staging, Production, cloud, Provider, hardware or Desktop qualification is claimed. [Evidence](../development/evidence/m1-v3-gx06-native-fixtures-b9d420a7.json)
## WSL Go evidence cache fallback — 2026-10-07
`tools/ci/capture-go-evidence.mjs` now selects a Linux-owned `/tmp/onesay-go-build-cache` when it runs from a WSL `/mnt/*` checkout, while preserving explicit `GOCACHE` overrides and the native repository cache. A WSL run of the identity fixture passed 66/0/0 through the capture tool. This only hardens local evidence execution; it does not change product runtime or qualification scope. [Evidence](../development/evidence/m1-v3-gx06-native-fixtures-b9d420a7.json)
## GX06 native API fixture requalification — 2026-10-07
The exact `da8c971d86876fbd513e83927ff4eb87c0cf86d2` source passed 167 official LiveKit Server API/adapter race events with zero failures and verified owned Docker cleanup. The runner remains `REQUIRED_SKIP` because DistributedMedia/Data requires a separate dual-server fixture and Agent dispatch requires the fixed loopback fixture; neither is claimed as PASS. OneSay admission, media exchange, Agent execution, Staging, Production and cloud qualification remain outside this receipt. No completion credit is added. [Evidence](../development/evidence/m1-v3-gx06-native-api-da8c971d.json)
## GX01 official native foundation fixture evidence — 2026-10-07
The exact committed source `f314d895092f6b7f30b3709bcc3e47db21bbdb51` was exercised in WSL/Linux with two official LiveKit servers and separately authenticated Platform/LiveKit Redis containers. `TestOwnedNativeDistributedMediaAndData` passed 1/0/0, confirming the shared native Room SID, three Opus RTP packets, three reliable data payloads and owned cleanup. The runner now captures the source SHA before Docker teardown so a passing Linux test cannot lose its receipt when the mounted Windows worktree is transiently unavailable. This is fixture corroboration only; GX06/GX07 product, OneSay policy, Staging, Production, cloud and hardware gates remain NOT-RUN, with no ledger credit or denominator change. [Evidence](../development/evidence/m1-v3-native-foundation-f314d895.json).
## GX06 upstream browser/native audio fixture evidence — 2026-10-07
The exact committed source `0a42707335bfba27dc069a3fdb31258a396757d5` passed the isolated Linux browser/native audio fixture 1/0/0. Two independent Linux Chrome contexts exchanged a synthetic 880 Hz loopback stream, asserted decoded samples and packet delivery, verified mute/unmute and participant leave, and completed owned PG/Redis/LiveKit cleanup. The fixture intentionally does not claim OneSay admission, patched-host policy, multiparty, recovery, Agent, Usage, hardware or cloud qualification; no ledger credit or denominator change was added. [Evidence](../development/evidence/m1-v3-gx06-native-audio-upstream-0a427073.json).
## 2026-10-13 — Inspect and revoke an owned RTC connection in Console
Room details now accept an existing RTC connection ID belonging to the current identity and Application. Read its canonical state, prepare a Consent request, choose Allow or Deny, then explicitly execute an allowed revoke. Uncertain transport results retain the original request key for an explicit retry; scope/session changes clear it. Refresh shows the server's actual state. `revoking` and its request timestamp do not prove native media disconnection. Mock Mode supplies a labeled read-only example; an opt-in owned Linux fixture exercises real local API operations without cloud resources.
## 2026-10-13 — Inspect and cancel a Task in Console
Tasks now open scoped public resource details, including lifecycle timestamps and output metadata without transcript content. Cancellation uses the existing direct Human Consent flow: review, allow or deny, then explicitly execute an allowed cancellation. Refresh reads the server's current state; terminal Tasks cannot be restarted. Uncertain network responses retain the original request key for an explicit retry within the same session and scope. Mock Mode remains read-only. The optional local fixture creates a waiting-input Task through the public API; it does not execute a Provider or audio transport.