From c8968efdc9b3c0c7eb5fbefc3bcf1a24e45cabcb Mon Sep 17 00:00:00 2001 From: EHotwagner Date: Thu, 15 Oct 2026 08:34:01 +0200 Subject: [PATCH] docs: capture delivered capture-retention source boundary --- docs/atlas/catalog.json | 1 + ...fdd35d75ada3890e855a15906c0e400f13f03.json | 1 + ...ernance-423-neutral-capability-bindings.md | 23 +++++++++++-------- 3 files changed, 16 insertions(+), 9 deletions(-) create mode 100644 docs/atlas/catalog.json create mode 100644 docs/atlas/records/7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03.json diff --git a/docs/atlas/catalog.json b/docs/atlas/catalog.json new file mode 100644 index 00000000..f8233b1c --- /dev/null +++ b/docs/atlas/catalog.json @@ -0,0 +1 @@ +{"records":["7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03"],"schema":"fsgg.atlas/1"} diff --git a/docs/atlas/records/7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03.json b/docs/atlas/records/7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03.json new file mode 100644 index 00000000..55aa0b37 --- /dev/null +++ b/docs/atlas/records/7b7c04c85d989e7136e526e749bfdd35d75ada3890e855a15906c0e400f13f03.json @@ -0,0 +1 @@ +{"citations":[{"path":"src/FS.GG.Governance.VerifyCommand/ProviderContextCapture.fs","repository":"FS-GG/FS.GG.Governance","revision":"8a6a74c701ccc713f28723fad5eea539acaada38","sha256":"4b6fd57ec3786aef02e077a1c6be3eb11896f6ba5131730a820e783bfb2f2fe9"},{"path":"tests/FS.GG.Governance.VerifyCommand.Tests/ProviderContextCaptureTests.fs","repository":"FS-GG/FS.GG.Governance","revision":"8a6a74c701ccc713f28723fad5eea539acaada38","sha256":"03d2c1e98a464139b338daaa4e3412c01f0dcd0da985cb12c385d11d3fba74d7"},{"path":"docs/roadmaps/governance-423-neutral-capability-bindings.md","repository":"FS-GG/FS.GG.Governance","revision":"8a6a74c701ccc713f28723fad5eea539acaada38","sha256":"b8073de13dbdb43173e8c94b2191c01234de913f759d8add1d7279bf86bd7ae5"}],"conflictsWith":[],"id":"governance/provider-capture-retention-boundary","kind":"boundary","recordedAt":"2026-10-15T06:33:45Z","repository":"FS-GG/FS.GG.Governance","schema":"fsgg.atlas/1","status":"recorded","summary":"The capture interpreter keeps native operations and clock immutable per original session; production prepare selects unchanged Linux calls, while friend-visible controlled construction supplies inert operations and refuses native lease duplication. Registered actual activity, original ends, bounded immutable evidence, sticky failures and close uncertainty remain with the caller owner; release retains outstanding root leases. Ten finite real-interpreter controls cover pending read, uncertain synthetic close, cancellation, failure ordering and normal lifecycle joins. These controls and hosted source qualification cannot establish blocked kernel read or physical uncertain-close acceptance. The existing physical wrapper deliberately retains unsettled sessions, so a separate qualified observation and whole-worker/resource teardown boundary is still required. C2 loader/profile/package joins and physical acceptance remain open.","supersedes":[],"tags":["governance","capture","ownership","retention","qualification"],"title":"Capture owner retention does not establish physical blocked-read or uncertain-close qualification"} diff --git a/docs/roadmaps/governance-423-neutral-capability-bindings.md b/docs/roadmaps/governance-423-neutral-capability-bindings.md index da0b92e7..7b87f8c9 100644 --- a/docs/roadmaps/governance-423-neutral-capability-bindings.md +++ b/docs/roadmaps/governance-423-neutral-capability-bindings.md @@ -328,8 +328,8 @@ Templates/public receivers and broader release completion retain their applicabl ### GOV423-C2 controlled retention source window (2026-10-15) -Owner: Governance source lane. Status: source prepared; hosted qualification pending. C2 remains -unchecked. This extends the existing capture milestone and preserves all earlier failures and custody +Owner: Governance source lane. Status: [source window delivered](https://github.com/FS-GG/FS.GG.Governance/pull/459) +at `8a6a74c701ccc713f28723fad5eea539acaada38`; C2 remains unchecked. This extends the existing capture milestone and preserves all earlier failures and custody unknowns. The historical 15-case report above describes #449; #453 subsequently added held-root lease coverage and reported 20 physical controls. Those reports do not qualify blocked kernel reads or uncertain physical closes. @@ -341,16 +341,21 @@ signature remain preserved. A post-read work check prevents a late read from acc Synthetic sessions cannot duplicate native leases; production's outstanding lease fences stay intact. The surface guard explicitly rejects exported operation/test types and entry points. -Local validation is limited to source, exact touch set, diff and relative links. No local CLR or native -fixture execution is admitted. Normal PR CI may qualify compilation and controlled/default tests with -physical capture still pending. Preserve its first failing run and exact successor head; hosted green -establishes source qualification only. The source PR and its exact checks supply delivery evidence; -publication, installed adoption and physical acceptance remain separate. +Local validation covered source, exact touch set, diff and relative links; no local CLR or native +fixture ran. [Hosted qualification](https://github.com/FS-GG/FS.GG.Governance/actions/runs/38692065699) +passed the required source matrix and advisory API job at `8c242c6133b36206f9ff83fc287684840788a777`. +VerifyCommand passed 219 tests in each of Debug and Release, with all 20 physical cases skipped. +The first `b086c148` build failed on two nullable reflection accesses; its successor repaired the +guard. After rebase, the first routine event refused the stale head marker; the subsequent authentic +edited event passed after rebinding. Both failures remain preserved. The protected delivery helper +accepted routine eligibility and coherent validation, then one guarded apply delivered #459. +This establishes source qualification and delivery only; publication, installed adoption, physical +blocked-read/uncertain-close acceptance and the rest of C2 remain open. The remaining physical gate needs an accountable supplying owner, an authentic regular-file blocked read accepted by production acquisition, independently observed uncertain close and demonstrated whole-worker/resource teardown. No backend is qualified by this window. Keep those physical cases pending and retain the original caller owner and failure evidence. The existing provider loader, Program/Verify integration, stronger profiles, coherent SDD consumer joins and C3/C4 milestones remain -open. Atlas capture remains an asynchronous owning-archive follow-up for the programme integrator: -`governance/provider-capture-retention-boundary`. +open. The owning Atlas archive records `governance/provider-capture-retention-boundary`; retrieve it +with the Atlas helper and verify its immutable source citations before reuse.