Record attachment promotion evidence

Author: Gini

docs/LINEAR-BOARD.md

@@ -24,6 +24,8 @@ ONE-254 privacy follow-up: centralized `inputs/`, `evidence/`, and metadata-decl
 
 ONE-254 operation-journal follow-up: commit `9de229e` adds the durable `follow_up_operation` journal to SQLite/Postgres, idempotent attachment/guidance materialization, startup recovery for prepared/ready operations, and explicit failure for provider-claimed operations whose external outcome is unknown. Commit `a6f049c` adds atomic expiring execution claims, stable execution/provider-request correlation identities, provider-started state, and an explicit unknown-outcome acknowledgment route. Commit `5ce158e` adds the durable `follow_up_attachment` reservation ledger, storing bounded private bytes/metadata transactionally with keyed operation acceptance and re-materializing them after restart. The current slice also renews active claims with a fenced heartbeat and aborts on lease loss. `npm run e2e:follow-up-recovery` proves preparation-crash recovery of exactly one four-message follow-up with one attachment and a provider-start crash that fails closed, rejects replay with `409`, and acknowledges with HTTP `200` without retry. Remaining gaps are the non-atomic cross-store promotion boundary, provider-side idempotency, and production deployment controls.
 
+ONE-254 promotion follow-up: commit `dfb73b1` adds failure injection after filesystem attachment staging but before task metadata promotion. The restarted API recovered the durable reservation, preserved six messages, materialized two attachments, and replayed the keyed request with `200`; the harness reported `attachmentStageCrashExit=99`. This is local recoverability/idempotency evidence, not a single database/filesystem/task-JSON transaction or provider-side exactly-once proof.
+
 The handover adds [ONE-245](https://linear.app/onecomputer/issue/ONE-245/secp0-enforce-litellm-only-model-routing-for-every-harness) as a security release gate: every harness must route model traffic through the server-controlled LiteLLM boundary. Direct first-party Anthropic API traffic is prohibited, not a fallback. The current Claude SDK path now fails closed without the relay; Codex/AgentCore remain open until their adapters use the same boundary.
 
 `THEMING_EXTENSIBILITY.md` is now tracked as a planned Phase 7 workstream in `TODO.md` (P7-01 through P7-09). It is explicitly downstream of the current P4 auth/Postgres/org gates and P5 UI foundation. The workstream covers token migration, typed tenant config, Postgres-backed theme persistence, admin appearance/content controls, secure asset handling, and deployment-time theme packages. It must preserve sans-serif UI typography and cannot alter LiteLLM routing, approval authority, auth policy, evidence, or sandbox controls. The source brief's arbitrary HTML, remote font, and dynamic package examples are treated as security risks requiring bounded schemas, sanitization/CSP, provenance, and allow-lists before implementation.