Description
A remote mutation can commit before its response reaches the caller. The manual provisioner therefore needs destination-bound local custody, durable intent and historical real-only restrictions that survive interruption, deselection and missing selected configuration. This foundation performs no network operation or activation.
Acceptance Criteria
- #1 Private bounded file state and real process locking preserve checksum, generation, destination, pending intent and monotonic historical restrictions without reset, adoption or silent pruning.
- #2 Structured preview and operator approval binding rejects wrong, expired or inconsistent destination, state and canonical agent namespace before mutation authority can be used.
- #3 Real-file and bounded subprocess red-green proofs observe lock and durability failure surfaces, missing enrolled history, symlink refusal and retained ambiguous evidence.
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Implement the independently reviewed private local file, attestation and durable custody protocol as a network-free foundation. Freeze its private API before a later engine consumer; prove real file locks, strict binding, bounded persistence and missing-history refusal.
Implementation Notes
Original pre-code API failure and first source review failure retained. Convergence tripwire transferred six-file candidate to escalation; actual red/green recipes cover post-dispatch capacity, independent NotApplied suffix, contradictory custody coordinate reload and cross-target provenance. Full replacement 99728bd5cb8ae4bd15c042fbb5fea4cb8eb613cbcdcdf509cc5835ad1a8d9fa5 is under combined delta review. Native Linux execution and privileged UID proof remain required, not supplied by Darwin or cross-compilation.
Final Summary
Delivered six-file custody/approval foundation at feaaf4189b1f6b5a97aa1471f31093adaa9156ec, exact tree3f5713f3afcdf2ffd7e147e434cf72fbb55a32b7. Frozen API unchanged; original failed rounds and escalation evidence preserved. Combined source repair review and aggregate CodeRabbit six-file coverage passed with zero remaining findings. Actual native Linux arm64 UID0 execution passed process lock/reload/crash/grant/poison/max-evidence tests and foreign-UID ownership rejection; retained Darwin proofs also pass. Exact committed clean tree passed full remote just check including race. Gen/dump inapplicable to a network-free non-renderer package. This is no backend truth, drain, antirollback, remote fence, CLI hard-exit or execution-admission guarantee; typed engine and application wiring remain separate.