Description
Transport and local custody preserve representations and history but cannot verify vendor configuration or safe remote transitions from opaque hashes. Add the independently reviewed typed engine boundary between resolved authored resources, complete backend observations and the delivered durable custody protocol. Public CLI, blueprint parsing, credentials, runtime admission and live activation remain separate application work.
Acceptance Criteria
- #1 Source-backed typed normalization, dependency substitution and complete scoped inventory preflight reject wrong destination, invalid or paid/unknown foreign coverage, drift, ambiguous ownership and unsupported content before any mutation.
- #2 Real-file and TLS boundary proofs observe durable intent before each single request, whole effective-configuration and checkpoint readback before receipts, and no retry after dropped or contradictory post-commit responses; recovery permits only independently approved never-attempted work.
- #3 Cleanup verifies the whole historical consumer closure disabled or absent before dependent-first deletion, preserves custody and honest retained or unresolved outcomes, and never converts status acceptance, hashes or operator assertions into drain or execution authority.
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Implement only apply.go, recover.go, cleanup.go and lifecycle_test.go in the provisioner package against reviewed private contract 848d71a1f14dee78417f83d7f5cc028fcd31ede3b48507fd49fa2ac87636c0f8. Consume the unchanged independently reviewed one-PUT helper prerequisite as a separate actual source handoff, not a dependency overlay; all preflight reads precede durable Intent. Preserve typed source normalization, complete whole-checkpoint observations, one-request/no-retry custody sequencing, attributable recovery and disabled whole-consumer cleanup. Public CLI, discovery/schema, credentials and runtime admission remain outside this component.
Implementation Notes
Owner decision required before implementation/mutation: pinned genuine evaluator absence and generic selective route/proxy absence both yield the same typed HTTPError404, even with the same destination, complete healthy inventory and a positive sibling read. Real-file/trusted-TLS plain/race diagnostic is intentionally red; no production engine, intent or mutation was created. Choose explicitly documented inventory-backed absence under scoped operator assumptions, or retain the stronger fence until an identity/destination-bound negative contract exists. No wrapper, Boolean, hash, raw request or first-write probe adds the missing evidence. Resume only after explicit owner choice and contract revision.
Owner resolved the absence-policy decision affirmatively. Reopen only under documented inventory-backed current absence, retaining destination/parent/version scope, complete authenticated inventories, contradiction/error rejection and explicit routing ambiguity. No change to unowned-deletion, one-request/no-retry, attribution/recovery or operator-versus-backend-truth fences. First revise and review the contract/policy revision; no silent test weakening or previous-red pass claim.
Partial four-file engine has meaningful real-file/TLS subset proof but is not accepted: full plain/race remains red. Actual foundation Bootstrap refuses the minimum nonempty checkpoint (six records/six steps/one claim/539 authored bytes) before enrollment or mutation. Independent frozen-admission diagnosis is separating accounting from contract infeasibility; no silent cap increase or omitted phase. Separate cleanup disable-lies barrier and context/retirement failures are being isolated in the existing C scope, not excused as capacity. Cleanup recovery implementation inspection is not the required lost-disable/delete runtime proof.
Independent accounting diagnosis and guarded proposal review show the legacy bound is mathematically insufficient for the required nonempty suite with full legal evidence, not merely a projection bug. Separately tracked revision-gated STATE-ONLY amendment preserves plan/preview/spec/approval and all safety bounds. Independent C retirement repair changed only fixture observation: remote handler now reads actual durable disk state after actor Close instead of borrowing a closed actor. Original lying-disable message conflated admission refusal with pending absence; zero DELETE was observed, and the actual-PATCH safety assertion was strengthened and remains blocked, not waived.
Whole guarded source review of candidate3581eda6 failed two major authored-admission checks: float64 rule sample_rate silently rounds raw approved decimals/range; case-insensitive typed JSON decoding admits source-invalid keys and erases nested typed nulls. Findings are static proofs with concrete repro inputs, not newly executed regression reds; existing TLS/file subset passed but does not cover them. Original parent/C convergence park and limited owner reopening retained; new numeric/exact-key class does not reset attempts. Park for owner decision on one bounded senior-escalation raw lossless source-admission pass plus red-first tests and delta review, or stop with engine/dependents incomplete. No repair started, no C publication/CLI/runtime/live admission. Published bounded B foundation remains delivered independently.
Owner explicitly approved the single focused escalation pass: YES YOU CAN PROCEED. Reopen only for the two reviewed authored-admission findings, lossless numeric validation and exact-key/nested typed null rejection, with red-first tests and one delta review. Existing safety contracts, source revisions, bounds, legitimate case-content nulls, old failure history and original lineage remain unchanged. No broad redesign, live deployment or major waiver; stop/report if this pass fails or opens a new class. Root reconciled unchanged saved candidate and preserved concurrent main updates by normal merge before isolated escalation.
Reopened after actual hosted CI39678337951 on published e8e09219 failed Go race473.723s. Three new assertions: full ten-family standard retained teardown reached20s context deadline; lost-delete recovery teardown failed tombstone/last-present acquisition assertion; normal whole-closure cleanup reached4s context deadline. E2E skipped; Docker/hygiene/UI/helm/secrets/signal-fidelity passed. Prior immutable composed gate/native/source reviews remain historical PASS, not substituted for hosted failure. Cause unproven; read-only source/log triage underway, no identical CI retry, timeout change or further code repair authorised by the completed focused M1/M2 pass. Dependent manual application safe-boundary pause requested, acknowledgement pending.
Read-only hosted triage completed. Two positive cleanup tests returned deadlines/empty receipts; exact parent-versus-request deadline site is not logged. Lost-delete test has a proven precondition gap: it checks teardown construction mode but not that pending is the intended action DELETE; correct recovery of an earlier rule DISABLE can reach its action-Removed fatal. This is a source-consistent hypothesis, not the observed hosted Pending, and no production data loss or blanket load-flake conclusion is proved. Proposed next bounded diagnostic: deterministic actual-handler rule-response barrier using unchanged request/caller deadlines, exact pending/operation/state evidence, preserve separate actual-DELETE preconditions, and stage-cost measurement before choosing a repair. No reproducer/test/repair run yet. Park needs owner continuation decision; previous focused input-validation pass is closed and not a blanket repair budget. Application is now confirmed paused by supervisor interrupt; partial source preserved.
Owner explicitly approved ONE bounded cleanup/recovery CI-hardening pass with SURE. Start with deterministic actual-handler operation-mismatch falsifier and measured request/stage/state work; then only cause-supported fixes preserving deadlines, receipts, exact attempted-operation evidence, inventory/readback and no-replay assertions. No timeout increases/skips/blanket flake exemption; custody-invariant or protocol conflict or another failed class stops for decision. Original hosted failure and prior review/red/green history retained, paused owner-wait ends without clock reset. Dependent manual application remains paused until engine verification is actually restored.
Bounded Q05 pass stopped at ownership boundary. Test-only deltae1e58e3 proves the earlier-rule-DISABLE counterexample and strengthens exact lost-action-DELETE preconditions; no production change. Instrumented remote five-family cleanup race3.46781s leaves532ms of shared4s; ten-family7.48160s fits20s. Profiles predominantly show B commit/codec/budget work; cumulative samples/allocations are not live heap or hosted-cause proof. No justified C-only performance remedy established. Final actual package remote build/vet/plain28.334/race250.441 PASS does not clear hosted AMD64 failure. Root retains candidate unlanded while engine acceptance and dependent CLI stay blocked. Read-only original B-owner assessment of measured pure work is authorised to determine whether any exact-contract optimisation is viable; no B source edit or new repair budget granted.
Read-only B-owner assessment identified one narrow contract-equivalent allocation candidate: final custodyDecode canonical re-encoding of both already parsed trees exists solely for equality. Root authorises only plan.go plus attestation_test.go to substitute exact closed-domain tree comparison, preserving lexical json.Number strings, key presence, container distinctions and array order; all scans/strict typed roundtrip/checksums/full invariants/fresh I/O/defensive copies/CAS/reservations remain. Differential old/new decision/wire equivalence, meaningful coercion/missing-key mutants and bounded comparable before/after allocation/C-path measurements are required. No demonstrated speedup or hosted fix yet. Prior test-only C delta is physical read-only input, unaccepted; combined review and actual hosted proof remain required. No broader B change or new policy/repair budget.
Published exact combined repair0810d95231dfb3d561e6642da97c9d4cadd8bf4f/treee31c80e68b942bf899f74de1430d5a352d987bf1 after combined guarded review, aggregate CodeRabbit3/3zero and one immutable full gate20261021T233620Z-synthkit-ca2328aa (plain33.170s/race220.354s). Exact sourceca4ee080 and122historical evidence hashes preserved. No deadlines, acceptance assertions or validation paths removed. Task intentionally remains In Progress with AC2/3 and DoD1 unchecked until the NEW commit-bound hosted Linux-amd64 race and end-to-end jobs actually pass. Olde8 hosted failure remains historical FAIL, not a flake exemption. Manual application remains paused; no acceptance/restart from ARM or composed green alone.
Owner requested immediate loop closeout; work is parked and no continuation is authorised by background CI events. Preserve delivered source and partial work; resume only under an explicit new instruction, reconciling current Git, board, runtime and the recorded acceptance blockers. Engine hosted AMD64 race/e2e result remains pending at closeout; no full-estate completion or runtime/live activation claim.
loop52 BATCH12: C1 Stage 1 landed f7ccbdc (11 engine tests isolated, -v deadline-margin probe, race-split rule; rvc1 PASS; CodeRabbit 0; gate gaterun 20261022T071150Z-synthkit-3d567402 exit 0). Not Done: hosted acceptance per plan rev3 (slow-class runs, margins) pending; Stage 2 (custodyBudget) owner-approved and in progress.
loop52 BATCH13: C1 Stage 2 landed c7bbb2b (custodyBudget one encode per call; differential oracle 333 boundary docs, 12 mutants; rvc1s2 PASS; CodeRabbit retry 2 files 0; gate gaterun 20261022T075815Z-synthkit-e7dc0489 exit 0). Hosted acceptance pending (slow-class run, every isolated margin >= 0.15).
loop52: hosted acceptance met on c7bbb2b, ci run 39745788691 success (race + e2e). Runner class slow (agento11yprovision cover 104.049s >= 95, slowest observed). Isolated deadline margins min 0.272 (WholeClosure/normal), next 0.477, n=30, all >= 0.15. Prior Stage-1-only slow run f7ccbdc min 0.056 (not eligible). Children SKT-0153.03.04.02 (teardown-aware apply refusal) and .03 (error specificity) remain open.
Final Summary
Published e8e0921951b47d58329353c0166ff3378c078c3c/tree0c3d7bd9112898fb4b7e9ed51d215f1cdb6b643d after immutable full gate20261021T211050Z-synthkit-eb6fbf4a, complete aggregate CodeRabbit6/6zero, native LinuxGo1.27.3 typed TLS/file lifecycle proofs. Sourcec2194c79 exact. Original whole-C review FAIL/3581 and 32 actual malformed-admission REDs retained; owner-approved focused repair passed original-reviewer delta with M1/M2 closed. Real6NONEMPTY/10family standard+proxy apply/noop/retainedcleanup, whole consumer barrier, lost create/disable/delete recovery, current absence limits, exact revisions and strict lossless authored schema covered. Full gate real package plain45.100/race262.776; source/tree/index unchanged. Gen/dump not run: not applicable to this internal non-renderer component, no config/schema/skills/emission surface change; guide/skill runtime fences unchanged. No D/CLI/runtime/live admission/backend conformance follows. Hosted commit-bound CI running separately, not yet claimed green.