Capacity/provider execution — pushed native admission and usage custody fixes

API 90a6eca and Agent 0def5fc40027ad22bf2d720baad7fcbccefa56fd are pushed and independently exact-read back. API parent c791a8e contains the 11-file admission/native-fixture batch. No UI, activation, model/campaign, acceptance, merge or release.

361 COMPLETE seven API files: admission/postgres.test.ts; admission/timeout-postgres.test.ts; architecture/admission-replay-authority.test.ts; architecture/initial/enrollment/dependency-operator-postgres.test.ts; architecture/initial/bootstrap/dependency-bootstrap-postgres.test.ts; architecture/offer-freeze.test.ts; ontology/availability-locks-postgres.test.ts (paths under tests/unit/control-plane/capacity/execution except ontology). 40/40 PASS/zero pending with original config/maxWorkers2 and disposable loopback PG32769; api361-batch.json SHA256 2312bff6f2336b7811c2b48cbaf2c0f35f049c8332d597dfffdf76f9139d7a3e. Original compiler still exit2/495 diagnostics, including two preexisting terminalPerformance return-contract errors; no waiver/check disabling. API361/364 compiler logs identical SHA256 8fc10644909958787f24f9c6562a8f3d9cb9ac3c7fb0089a1682cda0ee8fb107. Actual facade replaces timeout fixture's unchecked lifecycle-store cast; every older timeout/accounting/late-completion assertion retained. 359 temporary incomplete facade fixture failed 5 getProviderAssignment calls; 360 corrected actual composition passed all5 plus all8 bootstrap tests. Read/fixture failures retained, not product RED.

Usage regression: 362 COMPLETE original usage-observation-persistence.test.ts 7/4PASS/3FAIL before product repair; report SHA256 fa52ca5361366aaa583e6e553a08907bdb265d646fd21dd6625e35892a0664b4. Old zero-active negative still has native activeSeconds=1 and remains denied; consistent zero-active/positive elapsed infrastructure is admitted. 363 exposed unchanged informational telemetry behavior and a new fixture QueryResult.rows indexing mistake, both retained/corrected without weakening old assertions. 364 COMPLETE usage file + accounting/architecture/public-record-custody.test.ts + settlement-persistence.test.ts 22/22PASS/zero pending, api364-usage.json SHA256 03e8e36b92744916ed7ceeb02484d5d5b9759d614db9b63f37bb09503e4c89db.

Exact new UNIT/native names in ORIGINAL usage file:

• retains separately measured infrastructure time and rejects contradictory native second measurements without rewriting either input / api.golden.execution-usage-seconds-unit.
• owning SQL readback preserves contradictory native measurements and returns only an explicit consistent zero-active retry without charging infrastructure / api.golden.execution-usage-seconds-native.
  Existing API registry/component scene exact same suffix steps checked; scope local-component-tests, NOT managed acceptance. Original serializer rejects conflicting explicit native active/elapsed copies only for charged accounting modes; informational diagnostics remain unchanged. No unit conversion, fabricated charge, repair or new representation.

Original Agent settlement scene's SAME agent.golden.architecture-record-custody-live-1 case now independently asserts actual aggregate seconds equal any repeated native seconds beside whole original canonical/lease/reservation/Settlement/Reporter/repeated-read checks. Existing file/name/binding unchanged; AUTHORED NOT EXECUTED. Agent365 original compiler empty PASS + layout/diffPASS. Earlier807PASS belongs to e1cbe6d, not fresh prerequisite proof for 0def5fc.

Exact focused commands: pinned PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts followed by ALL seven 361 files or ALL three 364 files, --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api{361-batch,364-usage}.json --reporter=default. PG URL applied only to361. No acceptance authorization from focused receipts. Native TreeDX bindings, SDK whole canonical five failures, API strict/remaining governance failures and installed SDK/Actions failures remain OPEN. Continue work; no scheduler/checkpoint stop.

Capacity/Agent execution — completed local suites and installed-package blockers (2026-10-05)

Agent e1cbe6d8635e230ffe6d627ddcfdefce2bf59f4d is committed, pushed and independently read back. Its COMPLETE original Vitest suite (109 files/807 tests) passed 807/807, zero failures/pending: agent353-complete.json SHA256 830237e94ff0be833b4d97ba902609d1e23b5571a2725c1680c3edccf9b66a0a. Exact command from Agent worktree: PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts --maxWorkers=2 --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/agent353-complete.json --reporter=default. Original compiler and file-layout checks passed; candidate held throughout. This is local prerequisite evidence, NOT installed/released dependency closure or managed acceptance.

API ea1a170 plus uncommitted owning replay/fixture edits: 354 COMPLETE original admission-replay-authority.test.ts and admission/postgres.test.ts passed 11/11 (api354-replay.json SHA256 dca4d355d873db5a3d379ea01005fe85b87ccd6e2b2314e6cd0f070392bc4bb5). New UNIT api.golden.execution-admission-late-replay-unit and original native api.golden.execution-admission-late-replay-native are declared in existing registry/component scene, NOT executed acceptance. The native case retains actual independent PostgreSQL claims, rollback, retry, counter and exact-once assertions. Original no-current-ready path now checks an already committed exact replay through the SAME original validator, never creates another admission. Native timeout/phase original five cases then passed 5/5 in 358 after complete canonical input/running-node/reservation fixtures (api358-timeout.json SHA256 23c8e49930b714f22b38094c1819983eb0629773169fda0037ae6210370b055c). 355–357 incomplete fixture failures remain preserved, not product RED. Same watchdogs, caps, deadlines, failure/late-success/duplicate and accounting assertions retained. These supplied inputs are NOT actual managed model timeout/charges or physical teardown.

Actions inspection, no rerun: API Verify 37296103736 failed (1824/1619 passing/205 failing against installed SDK a12f06dc33c02161cedb4d74928fb915a803911f); SDK Verify 37296060686 failed (456/451 passing/5 whole-canonical failures); Agent Verify 37298623414 failed BEFORE tests because installed SDK 38255cf2557862972d9aed166f1d25fe1194bd61 lacks capabilityOfferDigest/capabilityOfferSchema/validateCapacityProviderManifestV5 exports. Install steps succeeded, downstream scenes/pack/artifact steps skipped. Private local SDK and local suite pass are NOT waivers. SDK ff9092684d6bba852434159755686de87bc09982 remains pushed/clean. No acceptance/model/campaign/activation/merge/release.

Current work continues: finish native API fixture typing/batch verification and commit; resolve remaining real governance/readiness/usage contracts, native TreeDX prerequisites and whole SDK canonical/installed dependency failures. Human priority contract: node priority updates for future scheduling; issued Attempt remains frozen. Infrastructure/queue remain separate from active allocation and original phase deadline is retained. NO UI. Prior evidence/history retained unchanged below.

Capacity/Agent execution — candidates 338–354; full suites fail closed, no SDK acceptance

Pushed and independently read back API ea1a170 (original graph digest guard + availability fixes); SDK ff9092684d6bba852434159755686de87bc09982 (existing ProviderExecutionAdapterSnapshot now exposes required runtimeBuild + CapabilityOffer[]); Agent 5f85c02d984a65f6bf02a52aefd76fb1c65ba767 (existing actual availability-history acceptance case independently checks runtime build/exact canonical offers/unique IDs). All original cases/negative assertions retained. These are not releases, installed-package closure, managed acceptance or provider/model activity.

338 API original compiler exit2/514 diagnostics: two newly exposed SDK snapshot type errors plus native offer field diagnostic retained. SDK type correction + original SDK build:dist + npm pack --ignore-scripts --json into allocated /tmp/capacity-sdk-snapshot-OegqDW + API no-save/no-lock/ignore-scripts private install: tracked manifests/lock unchanged. 339 API compiler exit2/511 diagnostics, no snapshot field diagnostics; log api339-types.log SHA1589913db3b79b32a9cc446698268f7c44d3a565821a49a719ad941f7bdf1cba. SDK338 original compiler exit2/41 diagnostics (TreeDX registry/graph/codeScopes/options), not waived by build:dist. Agent338 compiler empty PASS. All three original check:file-lengths and diff checks passed. Private diagnostic SDK is NOT registry release or reviewed dependency-pin closure; node_modules NEVERstage.

Complete original suites, ALL tests/no filters/0pending:

• API340 exact ea1: 1824 total/1784 PASS/40 FAIL, 523.84sec. Original vitest.control-plane.config.ts (maxWorkers2), disposable original PostgreSQL binding loopback32769; no TreeDX bindings. JSON api340-complete.json SHA fef10233535f01b2d90f6b1d7e087f3220be6d088cab638c7ad96b2568b3e4f4; log SHA733756178be3b6a58ae397cee0dba0250b7221fbb10e937eb3b66245ea167895. Twenty failures are required native TreeDX unavailable. Others: genuine Decision/readiness/usage contracts, original admission/timeout/offer fixtures, native availability lock fixtures and exact enrollment audit expectations. No failure/skip waived.
• SDK340 ff909: 456/441PASS/15FAIL. Invocation omitted TREESEED_DEVELOPMENT_WORKSPACE_ROOT; my invocation error, NOT product RED. JSON SHA33d2e47fea4ed90f05b140c8605406abeb5f832bd4e58f818353d28e74a1cce5.
• SDK341 same held candidate with canonical authority environment /home/adrian/Projects/platform: 456/451PASS/5FAIL, 108.84sec. JSON SHA5e9b5f701952f48d3235a704d40bb55ad71c72688add87af7f04c36108e13c6e. Whole executable canonical equivalence remains genuinely incomplete: nine target stored models missing runtime representations, shared/conditional/uniqueness constraints not semantically observed. No fake diagnostics/stripped schema/refinement/duplicated cosmetic validator.
• Agent340 5f85: 807/797PASS/10FAIL; 4 absent canonical env + original unbounded worker contention/timeouts. JSON SHA4f9af8eab1fc636f2947bab763891b6700e19337d27357ba914e0b06932fc1f5.
• Agent341 environment corrected: 807/799PASS/8FAIL, 46.65sec; native/test watchdog failures retained, not live productive model timeouts. JSON SHA90ba3e1e3693db5a378933a2deb48c094d415d66e773b83c3a4f07e5d15b0461.
• Agent342 original config plus CLI --maxWorkers=2, same all109files/807tests/original watchdogs: 807/806PASS/1FAIL, 73.45sec. JSON SHA76230235123cf589928ed9ccce7155332fb3322b30a73ca341512424d16135b1. MicroVM/build/replay failures pass unchanged watchdogs; sole grouped qualification case still 5000ms timeout. Config/agent productive caps NOT changed.

Reports all /tmp/capacity-agent-focused-20261004-OB6xb5; counts overlap NEVERsum. Complete commands:
API: PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH TREESEED_TEST_POSTGRES_URL=<original public CI credential on allocated loopback32769/postgres> node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --reporter=json --outputFile= --reporter=default.
SDK341: same pinned PATH TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts --reporter=json --outputFile= --reporter=default.
Agent342: same pinned PATH/canonical authority env node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts --maxWorkers=2 --reporter=json --outputFile= --reporter=default.
Platform HEAD42a67d98207211f3b84018d04af8c58090645d97 canonical docs/agent.schema.yml clean exact HEAD/current bytes; dirty architecture/assignment docs PRESERVED. No UI work.

Agent original native qualification efficiency attempts 343 and344 both13/12PASS/1TIMEOUT retained, JSON SHA907e367153379e4e6863eece33cb6768210aa634c903698c312a8ac90c15b49a and48dea06b8a1e8134ec8d966b1bab269c92ef93ddfe39787c68d7a72dfc2f1089. 345 temporary timing instrumentation demonstrated six denial/retry pairs ~7.08sec vs5000ms, fixture268ms/first507ms; 13/12PASS/1TIMEOUT JSON SHA42ef202d35b35be345b8157d0cb74d90c1b41615ba7357f8b4ffb8303ca2ff75. Instrumentation removed.
SAME original arbitration native case/fixture/process: reuse one native child via IPC for grouped six controlled-input denials; EVERY attempt reloads actual manifest + encrypted host identity and invokes ORIGINAL dist publisher. All six denial causes, byte/history/routes/input immutability + each exact restored signed whole output asserted; immutable equal signatures verified once within invocation. Separate independent-process signing test unchanged. No new file/runner/product policy/cache substitute/timeout extension. Allocated IPC child disconnect + exit0/no signal verified by cleanup; original independent runtime children retained. Native component proof, NOT qualification suite execution/API governance/model/Kata physical closure.
346 complete original file13/13PASS, qualification4258ms; JSON SHA33e1197ae94d2102db742da74332929eeaf683364c43c2d1dc7c72b8da45ce86. Introduced test helper null path TypeScript error 347 corrected via existing nullable config narrowing; 348 empty compiler PASS. Final350 same13/13PASS20.59sec. Original check:file-lengths +diffcheckPASS. Three original files committed/pushed Agent e1cbe6d8635e230ffe6d627ddcfdefce2bf59f4d; independent remote exact readback. Full353 all807tests originalconfig/maxWorkers2 on exact committed candidate started, NOT yet final here. No Agent edits while held.

API fixture corrections in progress, not yet committed:

• availability-locks-postgres original four cases lacked complete offers/registered public identity. SAME existing canonical offer helper + native Node Ed25519 signing gives valid controlled inputs; original actual SQL locking/races/public services remain. 347 complete4/4PASS. Not signed enrollment/model qualification proof.
• enrollment dependency-operator-postgres exact SQL expectations omitted original nullable before_fingerprint/after_fingerprint; assert both null per original0000 DDL (no product change). 348 9/8PASS/1FAIL then original audit-clock recovery expectation corrected to original committed reviewed_at, not retry wall clock, per original recordRegistrationReview. SAME500/failed history/nonce/registration retained. 351 entire9/9PASS.
• offer-freeze original integration-capable renamed class UNIT lacked both exact predecessor Git contexts; add those same supplied read-only refs, primary base/release permission checks unchanged. 349/351 all3PASS.
• admission postgres originally seeded source_ref_json={} and no authority refs: controlled native node now uses exact attempt source+authority. Original store readback then returned partial {id,nodeRevision}, causing TypeError before final replay: now ORIGINAL ProviderAssignmentRepository readback. Real stale-absence retry still genuine product RED351 after first commit moves node running.

New focused regression in ORIGINAL tests/unit/control-plane/capacity/execution/architecture/admission-replay-authority.test.ts:
"retains the exact concurrently committed admission after an absent first lookup and denies changed or missing late snapshots without writes" / api.golden.execution-admission-late-replay-unit.
Actual original admitLivingExecutionAssignment, controlled unit collaborators: first lookup null + missing-ready row; exact committed late read must return SAME snapshot; foreign provider/changed build/missing late record exact409 owning codes; exactly2lookup/1read/zero writes and whole inputs immutable. 352 complete10/9PASS/1genuineFAIL before fix. Existing original native postgres case "serializes competing claims and rolls back without orphan reservations or duplicate charges" / api.golden.execution-admission-late-replay-native retains independent pools/concurrent admission/exact late replay/custody/native settlement interruption/retry/exactonce counters/usage/ledger negatives.
Both ORIGINAL golden registry + component-boundaries scene steps execution-admission-late-replay-unit/native declared, local-component-tests NOT full managed scene/acceptance. Product now rereads only after missing ready authority and returns only existing requireExactReplay; no new claim/write when committed, missing/changed denial retained. 354 complete UNIT+native files started, not final here. Native timeout fixtures still need complete canonical attempts/prior Settlement, no product autocharge shortcut.

Owned PostgreSQL container SAME43f869c3.../name above still required for native tests; installed database/services untouched. Native TreeDX requirement remains absent; installed release image/prod credentials NOT used/faked-dev auth. Read original conformance/runtime/JWKS/delegation sources only, no TreeDX server/activation/build launched. No tests skipped for missing environment. SDK golden NEVER passed. Full semantic coverage, implementation/strict compile/released dependency closure/native environments + all three acceptance layers remain OPEN. NO acceptance/model/campaign/merge/release/activation. Continue work, no scheduled checkpoint/new task/automation.

Capacity/Agent continuation — native PostgreSQL regressions 333–337; SDK acceptance still held

API fc4ad98 committed/pushed; independent remote branch readback confirmed. Primary-source batch 332: ten complete files 97/97 pass, not complete-owner prerequisites. All older failed evidence retained below.

Disposable native PostgreSQL remains ONLY owned container capacity-agent-tests-4b46a638-1d88-4c4f-a28b-af9bf89de622 (43f869c3dac8d8906be9e898e5329374e290eb46c385e4510f31bb68aa0f57e9), exact original Actions postgres17.11-alpine digest18cfe3ef5e6815560c98237d6216d1e5119702fb0f3894c8785dd58b8bbe5d73, tmpfs/no installed volumes, loopback32769. Existing TREESEED_TEST_POSTGRES_URL configured ONLY per diagnostic invocation using original public CI migration-test-only credential. Installed database/services untouched. Cleanup of this allocated container required after native work.

333 original native files: 9/4PASS/5FAIL/0pending. JSON /tmp/capacity-agent-focused-20261004-OB6xb5/api333-postgres.json SHA6788a551fd9e3323ab7325a3fc51e7d7218130cdd69bd348ac1385ee51d8d78a. Guessed graph-watch-postgres.test.ts selector ABSENT and filtered by Vitest: invocation error, NOT four-file or prerequisite proof; actual original file graph-watch.test.ts. Native concurrent graph winner digest retained but losing nodes/edges also persisted: genuine product RED. Native canonical availability readback omitted offers/runtimeBuild: genuine product RED. Priority SQL ORDER BY id versus JS localeCompare: exact represented values retained, ordering-oracle error NOT product RED. Two older accounting fixtures lacked canonical signed offers/registered Ed25519 identity and never reached accounting barrier; original 30sec timeout/setup rejection NOT model timeout or product RED. Every original observation retained.

New exact UNIT: tests/unit/control-plane/capacity/execution/graph/architecture/living/living-graph-contract.test.ts — "binds every graph mutation to its exact winning digest even when competing revisions share the same publication clock" — api.golden.execution-graph-digest-guard-unit / scene execution-graph-digest-guard-unit. 334 complete UNIT file 10/9PASS/1genuineFAIL; SHA24ee321588207d6f42514cd77d65374ce89733105ad36144aaab84bb429ff59e. Original SQL mutation guard lacked graph_digest. SAME original guard now binds team/revision/createdAt/graphDigest for node insert/update, edge removal and insert. No new model/token/storage/transaction/runner. UNIT controlled database operations are not integration proof.

Original native PostgreSQL conflicting-writer case strengthened: BOTH independent pool public readers exact winner, losing retry409/code unchanged full SQL, winner matching replay unchanged. Earlier original PGlite concurrent/stale/late-interruption cases retained. 335 four COMPLETE original files contract/integration/postgres/graph-watch, original config:26/26PASS/0pending SHA21b8c5c51cab2e725de1af911154ae2915c8f6104c440051ae9246eb4d0500e1. Priority native SQL expected ID ordering corrected to codepoint comparison under original C-collation CI image; every exact identity/priority remains asserted. Issued Attempt stays frozen while node scheduling priority updates (resolved human decision). No managed scene run.

New exact UNIT: tests/unit/control-plane/capacity/ontology/availability-accounting.test.ts — "retains every canonical executable offer and exact runtime build in public availability readback without rewriting stored authority" — api.golden.execution-availability-offer-readback-unit / scene execution-availability-offer-readback-unit. 336 complete original UNIT file8/7PASS/1genuineFAIL SHAe88f2fd68e8f844c1b356fb1895c6e85dd524f569fb19941cbb0e098a63d567a. Earliest original serializer now retains existing runtimeBuild/offers without reconstruction/normalization. SAME existing original golden registry/component scene binds both new UNIT cases, scope local-component-tests NOT managed E2E.

Original availability-postgres three cases retain every denial/history/concurrency assertion. Corrected only controlled canonical signed offer/public-key inputs in older accounting fixtures; actual Ed25519 verifier/native service/transaction/accounting/independent pools still own proof. Core executionCapability replaces invalid legacy implementation identifier, original accounting ceilings and all negative statuses/clocks unchanged. Barrier now propagates early rejection instead of hiding it behind an unreached promise; no watchdog increase. Qualification-positive uses one separate controlled team/membership so ordinary publication closure cannot close original executable session. Native compile retains original phase endsAt alongside allocated active3 seconds per resolved human decision, not admission+3seconds. No supplied qualification is relabeled genuine external suite/managed authority.
337 SAME two COMPLETE original files11/11PASS/0pending SHAd123d44ac5e2c3b43bc37405a0cba190a8722c26bf9818d86f443bf805ca8b07.

Agent SAME original tests/acceptance/workday/record-custody.test.ts / "Actual participating provider availability retains closed accounting history and monotonic exact public observations beside unchanged terminal attempt charges" / existing runtime verifier+settlement scene strengthened: actual runtimeBuild SHA256, nonempty exact raw canonical offers, whole original SDK digest, provider-global offer-ID uniqueness within each actual publication; all history/accounting/terminal-charge checks preserved. AUTHORED NOT RUN. No model/campaign/activation/acceptance. Complete fresh participating-owner suites still required FIRST; SDK golden NEVER passed.

All 334–337 JSON paths under /tmp/capacity-agent-focused-20261004-OB6xb5. Exact focused commands use pinned PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH, node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts, COMPLETE named original files, --reporter=json --outputFile= --reporter=default, stdout/stderr corresponding.log. Native335/337 use only above disposable PG binding. Counts overlap, never sum. Current new edits uncommitted afterfc4; compiler/layout checks pending; no complete coverage or three-layer PASS claim. No UI edits. No automation recreated. Continue implementation/test closure and fresh full suites; checkpoint is not a stopping point.

2026-10-05 — CAPACITY/EXECUTION 326–332; PRIMARY SOURCE REGRESSION AND NATIVE PREREQUISITES

API27965c308da3cca0ff47fde17a3cd13d0aa2de2d committed/pushed the preceding thirteen-file batch and was independently read back. SDK8a2468ba8f901c40a45c9acda8ce319d3cc31e75 and Agent1968e9164bddbdec9a0b7056e5547952116162ef remain pushed candidates, not released closure. Full objective OPEN; no UI, managed acceptance, model/campaign, activation, merge or release. Heartbeat remains deleted. Implementation/check execution authorization in #490 remains in force; no checkpoint is completion.

Complete original API suite on held pushed27965

Original command in API worktree, pinned PATH, TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform:
node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api326-complete.json --reporter=default
Exit1 /1819total/1725passed/83failed/11pending,425.98sec. SHA25614a3b31dbb9991666fa136f9e3ace9f562925d6aa8ffdbcd8d85b3bc61db6e95. Candidate tracked bytes and SDK tracked8a246 held throughout; diagnostic private installed SDK12 is NOT published dependency closure. Most failures explicitly missing disposable PostgreSQL/TreeDX; remaining local failures classed Decision UNIT/native, primary/secondary write scope, old incomplete agent-page/estimate/Note-read fixtures, optional-capability conflict and older zero-active assertion. All pending/failing coverage blocks acceptance; no filtered or old receipt substitution.

New exact original mappings (AUTHORED; local-component scene NOT managedE2E)

Original guarantees/verifiers/golden.verifiers.yaml + guarantees/agent/golden/scenes/component-boundaries.scene.yaml, step IDs omit api.golden:

• UNIT tests/unit/control-plane/knowledge/workspaces/architecture/relation-scheduling-authority.test.ts — "selects only the explicit primary repository for writes in either citation order and denies absent or ambiguous primary authority without rewriting inputs" — api.golden.execution-primary-source-unit.
• REAL original compiler/native PGlite SQL admission/repository/reservation/concurrent exact replay tests/unit/control-plane/capacity/execution/architecture/initial/initial-admission.test.ts — "native compiler admission preserves only primary Git writes and exact foreign read citations through reservation concurrent replay and denied authority" — api.golden.execution-primary-source-native.
• UNIT original ready reader tests/unit/control-plane/capacity/execution/ready-execution-node.test.ts — "derives primary source identity from the verified project repository rather than its database row or foreign citation order" — api.golden.execution-primary-source-reader-unit.
  Existing Agent tests/acceptance/workday/cross-project.test.ts /support/cross-project-custody.ts already require exact own-primary sourceWrite, immutable primary base despite foreign citations, authentic owning Note+independent review Decision, actual predecessor read grants, usage/settlement and Reporter. Existing runtime cross-project scene retained unchanged and UNEXECUTED; component registration is NOT this managed proof.

Actual RED / fix / fixture history

327 five complete files27/25passed/2genuine primary-write failures; SHA6b547e9c03c0de65b29700043683df437afa6a9dba9e21b72d7f2a0e59694d1e.
328 complete relation UNIT+initial native files17/14passed/3failed, including NEW real native compilation denial; SHA966ed2764f15cd1c90405489c5c76c27e8bd430ca3820cbe0adadb0a72f65732.
329 complete original ready file23/22passed/1genuine database-row-vs-Git identity failure; SHAa1f4f4bb1b0ab3af140be222a651e6b34b444d77f8d9e3a906af521a5782f079.
Earliest original ready reader now derives canonical owner/name from SAME verified explicit primary Hub tuple; DB UUID is no longer transported as Git identity. Compiler uses ONE primaryGitReference for writable workspace+sourceWrite; foreign refs remain sourceRead/context. Missing/mismatched/duplicate/multiple primary authority denies409 assignment_source_repository_required without writes or input mutation. Single exact Git context remains valid original authority, not foreign first-reference selection. Original scheduling fixture supplied explicit own primary; older ready expectation corrected exact representation after separate genuine RED, no disappeared negative.
330 eight complete files88/87passed/1retained predecessor validation failure newly exposed after write fix; SHA4a7ea93ce75be4a1e31b84769c64681772aba6e4538f723f05abad1a9ed95097.
Reuse SAME existing admission canonical predecessor validation via original exported assignmentPredecessors, called by compiler AND admission: no second validator/policy/schema/runner. Reporting still legitimately consumes failed outcomes; executable work requires distinct completed canonical results/exact context+read grant/self-attempt denial.
331 ten complete files97/92passed/5old fixtures lacked exact predecessor context; SHA443f3b7748063d567d981133aa70359804f27428797e545864a4166706b43f15. These five newly exposed fixture failures are NOT product RED. Add ONLY declared exact predecessor Git refs to five original positive fixtures; all original assertions/branch/fan-in/failed/duplicate negatives retained.
332 SAME ten complete files97/97passed/0failed/pending; SHA9bebb71d6a8d3f2c9133622ee6c4a6a600a46cb6ab0e27023f2d50bb23169cca. Focused diagnostic, NOT complete-owner or acceptance receipt. Native SQL input principal/qualification/context remain supplied; PGlite not independent PostgreSQL connections/model/physical Kata proof.

All327–332 reports under /tmp/capacity-agent-focused-20261004-OB6xb5; exact command uses pinned PATH and original vitest.control-plane.config.ts, full files named above plus agent-operations.test.ts, agents/handler-inspection.test.ts, execution/graph/relations/exact-dependency-links.test.ts, planning/assignment-estimate-integration.test.ts, execution/assignment-attempt-builder.test.ts, initial/admission/dependency-admission-{authority,native}.test.ts. All original nine/other cases retained; no watchdog/allowance change.
331 original tsc -p tsconfig.json --noEmit exit2/512diagnostics; SHA9e2c8559e2dbb0f7b553ae1ccf2cda51b310c2b3eedd09adfb8ade8a4bfc56ad. No new touched product diagnostics, original test typing remains unwaived. 332 strict follow-up running, not passing claim.
331/332 npm run check:file-lengths and git diff --check PASS; layout SHA69adf5b6377a345f27badc1937921a76e9c3991eac5c8dce53bb89d7cf63c024. Thirteen-file new batch currently dirty/uncommitted atop27965, no exact new commit receipt yet. Fresh staging fetch unchanged1817b0f0b817c6d6a211ecd11284c4bdda54ad2f.

Actions independently inspected, NOT rerun

SDK8a246 Verify37287833815/job111690872328: complete456/451passed/5failed in canonical equivalence/custody; later scenes/pack skipped. Agent1968 Verify37284898243/job111681353907: install-exact SDK38255cf2557862972d9aed166f1d25fe1194bd61 succeeded, declaration build fails missing capabilityOfferDigest/capabilityOfferSchema exports BEFORE tests/scenes.
API27965 Verify37291386830/job111702347382: failure,1819/1612passed/207failed against install-exact SDK a12f06dc33c02161cedb4d74928fb915a803911f; includes missing current SDK contracts/priority, NOT same local privateSDK12 candidate. Original PG service initialized successfully; later native verification/pack/scenes/artifacts skipped. Logs independently read, no blanket reruns/dependency bypass/check disabling. Private local pass cannot waive pinned release closure. PR492/320/358 prior exact updated bodies independently read back29427/21032/15631chars; no routine comments.

Newly available native prerequisite, not production reuse

Read-only Docker inspection found SAME original Actions pinned PostgreSQL17.11 image locally available: sha25618cfe3ef5e6815560c98237d6216d1e5119702fb0f3894c8785dd58b8bbe5d73. Provisioned ONLY new disposable capacity-agent-tests-4b46a638-1d88-4c4f-a28b-af9bf89de622, container43f869c3dac8d8906be9e898e5329374e290eb46c385e4510f31bb68aa0f57e9, random127.0.0.1:32769, tmpfs/no mounts/no production data/credentials/new schema/environment field or image pull/build. Original TREESEED_TEST_POSTGRES_URL points to this test /postgres authority with public synthetic migration-test-only credential. pg_isready passed. Original fixtures allocate/drop ONLY UUID DBs and independently connected pools. 333 native focused tests in flight; no result yet. Explicitly remove ONLY this owned container when native work finishes and verify absence. Installed database:5432/treeseed_api untouched. TreeDX disposable binding still absent; no installed token reuse/server mutation or false skip.

Continuing real local/native failures and schema/released dependency closure; SDK golden NEVER passed. Full objective remains OPEN; every eventual scene still requires fresh complete exact participating-owner UNIT+REAL integration FIRST/zero fail skip todo missing inconclusive/no previous receipt reuse.

2026-10-05 — CAPACITY/EXECUTION 314–325; FOUR NEW OWNER CASES, SDK GOLDEN STILL BLOCKED

Latest user scope remains capacity-provider/Agent execution only; no UI. No checkpoint is completion. API current e31ceae and SDK current 8a2468ba8f901c40a45c9acda8ce319d3cc31e75 committed/pushed and independently ls-remote read back this segment; Agent1968e9164bddbdec9a0b7056e5547952116162ef unchanged. API13-file new batch still UNCOMMITTED at this checkpoint. Staging freshly fetched before next commit, unchanged1817b0f0b817c6d6a211ecd11284c4bdda54ad2f. All original failed evidence retained. SDK golden NEVER passed. No scene/campaign/model/activation/merge/release/newbranch/newrunner/timeout extension.

Exact new behavior / owner / existing verifier and scene mapping

All bindings are ORIGINAL guarantees/verifiers/golden.verifiers.yaml and guarantees/agent/golden/scenes/component-boundaries.scene.yaml, scope local-component-tests, step ID omits api.golden. No managedE2E or native-provider usage/physical teardown claim.

1 UNIT tests/unit/control-plane/capacity/execution/graph/architecture/usage-observation-persistence.test.ts — "requires a valid stored usage timestamp without rewriting bytes or charging elapsed infrastructure time as active work" / api.golden.execution-usage-clock-unit. Four valid UTC/offset/leap timestamps retain exact bytes; nine missing/null/nonstring/empty/space/invalid/date-only/impossible calendar/hour deny original500/capacity_task_usage_corrupt/exact row-column details; all supplied inputs immutable. Zero active + positive elapsed remains VALID infrastructure measurement per user separation, not charge fabrication.
2 REAL originalSQL + public owning query service, SAME file — "owning SQL usage reads retain malformed clock history and admit only an explicit valid-clock retry" / api.golden.execution-usage-clock-native. Four actual malformed native stored clocks deny, EACH full original row retained. Restore ONLY controlled original valid-clock bytes, one exact result and whole original row equality. Actual PGlite SQL is not independent PostgreSQL connections/provider-generated usage/Settlement.
3 UNIT tests/unit/control-plane/governance/proposals/governance-service.test.ts — "retains exact authorized evaluation and accepted-decision recovery while denying missing or malformed readiness before mutation" / api.golden.execution-proposal-evaluation-unit. Exact original open positive/body/actor/mutation, accepted recovery without rechecking old acceptance; six malformed flags/array shapes plus null readiness deny409 before mutation; inputs retained. Existing unresolved-blocker/unready-plan negative and EVERY old case retained.
4 REAL original ControlPlaneStore evaluation/readiness + original nativeGit/officialHTTP SDK/PGlite, tests/unit/control-plane/governance/proposals/architecture/proposal-decision-denial-native.test.ts — "owning native proposal evaluation denies incomplete plans and exact unresolved feedback before electorate or decision writes without rewriting retained history" / api.golden.execution-proposal-evaluation-native. Two fresh original fixtures. Missing actual estimate and actual native canonical proposal-class rejected Decision feedback plus SQL unresolved concern index; two overlapping calls + SAME-input retry deny409 before electorate/decision writes. Full represented SQL/native Git snapshot and controlled inputs immutable, nonempty actual reads. These supplied inputs are NOT genuine provider Reviewer/authenticated issuer/managed model output; overlapping PGlite promises are NOT separate PG server connections. Finally only original allocated fixture cleanup, not managed physical closure.

Earliest owner fixes / old fixtures

Original task-usage serializer now checks z.string().datetime({offset:true}) without normalizing any stored bytes/active time/charge. Original public governance evaluation and store evaluation use SAME existing assertGovernanceProposalReady before electorate/vote/write. Existing readiness method is sole authority; missing/malformed readiness denies. Original explicit admin rejection/request_changes paths and accepted-decision recovery retained. No new policy/field/schema/receipt.

Original review-result legacy UNIT fixture now supplies frozen Reviewer profile/time through original full canonical review fixture; two positives and all wrong-candidate/read-only/mutable-workspace negatives preserved. Original discussion-binding UNIT inputs use actual SDK Attempt parser/original assignment serializer/exact provider ID and ready-row reply; all nine cases/native PGlite assertions retained. These are fixture corrections, NOT manufactured product RED.

Original CapacityGovernanceDatabase.run declaration now Promise, matching actual original ControlPlaneStore SQL receipt; no runtime SQL behavior changed/unchecked cast/typecheck disabling. SAME original native producer uses actual capacity facade for admission/lease/repository methods missing on governance store. Its old admission+3sec deadline oracle corrected ONLY to user's explicit original phase deadline decision: activePlan.endsAt, with maximum active allocation3 and every expiry/no-tolerance check retained. This fixture remains unexecuted beyond missing disposable TreeDX authority; no native producer PASS.

Original true TreeDX producer case also strengthens public evaluation denial before original adminDecide denial; all old oracles retained. Four new cases PASS, but classed Decision authority missing remains genuine UNIT+native failure. Old combined zero-active negative still FAIL and retained, not relabeled: user explicitly separates infrastructure elapsed from productive active time; no universal deny-zero rule/native-unit conversion invented. Optional requiredCapabilities conflict with canonical schema remains pending user answer.

Exact commands and immutable observations

APIcwd /home/adrian/.local/state/treeseed/worktrees/architecture-guideline-tests/api. PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH. Report/log root /tmp/capacity-agent-focused-20261004-OB6xb5. Whole files, no name filters/skips. All counts overlap, NEVER sum.

Focused325 command:
node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/governance/decision-execution-plan-authority.test.ts tests/unit/control-plane/capacity/execution/review-result.test.ts tests/unit/control-plane/governance/proposals/early-external-approval.test.ts tests/unit/control-plane/governance/proposals/governance-service.test.ts tests/unit/control-plane/capacity/execution/admission/discussion-binding.test.ts tests/unit/control-plane/capacity/execution/architecture/review-decision-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/review-decision-native.test.ts tests/unit/control-plane/governance/proposals/architecture/proposal-decision-denial-native.test.ts tests/unit/control-plane/capacity/execution/graph/architecture/usage-observation-persistence.test.ts --reporter=json --outputFile=/api325.json --reporter=default > /api325.log 2>&1

314 two old fixture files11PASS. 315 complete four review/discussion/authority/native files26PASS; api315.json SHA256 adb3d929782ae5f5893fca1e5ff82cbacbe05904d479f2e1ca06534ace00dc9e.
316 genuine clockRED complete file5/2PASS3FAIL, api316-red.json03936b201954a9272074857f514fed58fa8e3cf3f44326eac83972af0dfcba97.
317 after clock owner repair5/4PASS1oldzeroactiveFAIL, api317.json778d1beeaf248184fbb14baf185422c0ffecbb5bdab20d5f17d648f77b8890ba.
318 genuine public readinessRED complete3files16/14PASS2FAIL, api318-red.jsonf273dc0386729c004ea327b51a0cb0f2f323404e8aa3d46452244fabee148740.
319 after readinessrepair16/15PASS1classedFAIL;320 complete4files18/16PASS2FAIL(classed+missingTreeDX explicitfatal)149ac42e3965a2583d79d1cc35df800f29a4cad176e6cd1a2ab279de3736e2f1.
32121/18PASS3FAIL b5063834106d496cc0ea46603ea6d232126ee163ce5422c98397b98c214a598a: new supplied proposal-class/request-changes Decision INVALID SDK fixture, not productRED; corrected controlled disposition to rejected, valid assertion retained.
32221/18PASS3FAIL4eca2670c535e34ad833ded96adf043d40536c5322f34f13760c85a4ca20ee05;3234/2PASS2FAILf5bbce038e0b875387bf2791cff60a60e78d66853b78a0bd560308ca0f5595e7: new native db.all adapter wrong raw rows vs original expected {results}; fixture error NOT productRED, corrected exact original DB contract with satisfies, not bypassed readiness.
324 nine complete files52/49PASS3FAIL0pending b5d7c73fca72eb5439925aa2ef8f757f4aa2bfc2f64c909c615e3c3e5ab16449; build freshPASS14d9a4d3da9b8735b37a1290645b0e065d45c6c4b59fe370351fcd06cf6db937. Strict324528remainingerror9faa15519aa571884804c193b7bff387bd7e0d66b62307775c56f32e5c241faf.
325 SAMEcomplete9files52/49PASS3FAIL0pending SHA25660db7f5d3d70f9429a667e5167552bedfc8e1460376845af65fe292cdaeb5f7a. ONLY classedDecision UNIT+native and retained old zeroactive clause fail. Four new cases pass.
Strict325 command node node_modules/typescript/bin/tsc --noEmit > /api325-strict.log 2>&1; exit2 512 remaining errors, SHA2567af4dd3d11cf14a199960243925b2d4fba797d0fc9327d809f724965fadec7d3. All touched new native/readiness/matcher errors gone; unrelated remaining errors UNWAIVED. Matcher type fix preserves exact412/code via satisfies.
Layout325 npm run check:file-lengths PASS, SHA25669adf5b6377a345f27badc1937921a76e9c3991eac5c8dce53bb89d7cf63c024; git diff --check PASS. Earlier layout322505line policyFAIL retained; grouped ONLY added statements/removal of blank lines into originalfile, no assertion removed/limit raised. Existing 500 hard policy unchanged. Same log hashes across independent invocations are not old receipt reuse.

Remaining delivery boundary

No complete API/SDK PASS, no all-three-layer completion. Agent308 COMPLETE807PASS remains component prerequisite observation, not managed acceptance. Fresh complete all actual participating owner suites still mandatory before EVERY acceptance invocation; prior receipt not reusable. Disposable native PostgreSQL/TreeDX bindings absent, installed database:5432/treeseed_api NOT test authority. No credential reuse/serverstart/env fabrication/skip. SDK canonical semantic equality five FAIL/strict41 remain; APIclassedDecision producer/reader must be genuine governed content, never accepted SQL substitution. No new role hardcoding/runner/storage/service/publicfield or fake charge/citation/receipt/PASS. Full objective OPEN; next commit/push exact known batch, fresh complete API, continue original owner defects. No UI work.

Capacity/provider execution 302–313 — complete Agent pass; SDK/API authority gaps retained

Scope remains capacity/provider/agent execution only. No UI, activation, managed SDK campaign, scene, release or merge. Original phase deadline and all native/test watchdogs unchanged. Node priority updates future scheduling; issued Attempts remain frozen. Full SDK golden NEVER passed. Fresh complete ALL participating-owner unit+real integration prerequisites are still required before EVERY acceptance invocation.

Complete Agent execution inventory

Agent HEAD 1968e9164bddbdec9a0b7056e5547952116162ef remained CLEAN and unchanged throughout. Diagnostic private SDK10 dependency, not published dependency closure.
302 correct Platform authority binding, COMPLETE four original files: microvm-result-authority, verification/replay-failure, provider/architecture/arbitration-native, custody/record-custody-readback:45 PASS/0 pending; SHA256 4e30f9b0729068d09a1dc0d739c45aea9623b4d3f1691657eeaf097ebbc96e0b.
303 COMPLETE project-handler-build file:3 PASS, bfe470618ba79fa5f15a732c1efefc0ad1b22c754685121ac7d6b30e89c626cf.
304 COMPLETE original default worker scheduling, correct TREESEED_DEVELOPMENT_WORKSPACE_ROOT:807 total/804 PASS/3 FAIL/0 pending; 5e521d4abf36bce8c5808c8afa67bf423eb2f4f58b0854b2790cb172dac2d120. Three exact original 5000ms TEST-watchdog failures: microvm 110-variant test, arbitration preclaim metadata child, arbitration six qualification-failure modes. These are NOT measured model/assignment productive timeouts and remain failed observations, not relabelled passes.
308 COMPLETE original suite with explicit native Vitest host scheduling --maxWorkers=2:
PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts --maxWorkers=2 --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/agent308-complete.json --reporter=default > /tmp/capacity-agent-focused-20261004-OB6xb5/agent308-complete.log 2>&1
807/807 PASS,109 files PASS,0 FAIL/skip/todo/pending; SHA256 2094e49dc1282b6d43ca90a464ca498f6f2624e061b12bec048b2211bbc2a003. NO source/config/assertion/deadline/allowance change. Native concurrent children/provider/assignment cases still execute their original concurrency. Two workers limit only concurrent host test files; NOT a default-worker pass claim. Prior301 omitted-env failure and304 default timeouts retained. This is complete local Agent unit+native integration evidence, NOT managed Kata/model/all-attempt charges/physical closure or SDK acceptance.

Exact readiness/dependency ownership repair; current working bytes UNCOMMITTED

API HEAD541665039c624558e67941a7e8a60be9f9ab28fe dirty ONLY src/api/governance/executable-proposal.ts and original proposal-native-readiness.test.ts.
Original hasCompleteExecutablePlan now delegates original SDK portable Proposal validation plus original estimateSchema rather than permissive Number-coercion/parallel work validator. No supplied status rewrite or second schema.
SAME original native case “denies incomplete and cyclic executable dependency graphs before public ready projection” (api.golden.architecture-readiness-native-dependencies; original registry/component scene retained) adds repeated dependency IDs to the older duplicate-work-ID/missing/cycle negatives, immutable SQL/input readback and restored controlled single-dependency positive. No new case/fixture/runner.
SDK HEADb514c29ae6b9e5c99711a4179697efda6514fc74 dirty four files: content-model-schemas.ts, original proposal-execution-plan.test.ts, original golden.verifiers.yaml/component-boundaries.scene.yaml.
SAME original UNIT “rejects missing and cyclic work-item dependencies” retains older missing/cycle negatives, adds repeated dependsOn rejection+input immutability+unchanged valid single dependency. Original generic unique() wraps existing dependsOn array; no new validator/model/field.
Exact new declarative binding sdk.golden.execution-work-dependencies-unit / execution-work-dependencies-unit to tests/unit/content/proposal-execution-plan.test.ts, original test name. API native case is owning SQL/official-client/native-Git counterpart. Component bindings are NOT production-shaped managed E2E acceptance.

305 genuine API readiness RED:10/5 PASS/5 FAIL, feabb91b5183154a9a2ab3241556901b3d0803e98eae77d074696a1c832c3419.
306 original SDK validation delegation:10/8 PASS/2 FAIL, 5a71c0743ccc1e33a2bb0fb411e320c03e9c3c26f71e3db6595e9c8a05f7783f.
307 strengthened native duplicate-dependency RED:10/7 PASS/3 FAIL, 2d554a6bc11b20896f5d554e0b978263ed380e1e91596a0114fea7bb0a42cbca.
SDK307 original12-case file11 PASS/1 genuine duplicated-dependency FAIL, ee12f89eb63090b9b79d3933793d12a4a2e3da30fee1c85e62f39f6099067a2e.
SDK309 COMPLETE proposal-execution-plan+proposal files14 PASS, 56c53f886da82f87db7d47687e596397e690e5a2b6d3ec65d8d1603308183703.
Focused API command: pinned PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/governance/proposals/architecture/ready-proposal.test.ts tests/unit/control-plane/governance/proposals/architecture/proposal-native-readiness.test.ts (full original files). SDK: pinned PATH node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts tests/unit/content/proposal-execution-plan.test.ts tests/unit/content/proposal.test.ts. JSON/default logs retained in /tmp/capacity-agent-focused-20261004-OB6xb5.
SDK310 held build PASS b60549fc08a3fdfa498d358287a1aa767472a0c6e1e97f2b16131032d09c141c; layout/diff PASS32e905f9c320e19d49ce9551bff67ab3b9beb31f25b607a42d065cf72e98f231. Original strict remains41 FAIL/no changed-file diagnostics, bffa325b131ee765648c082fb08513924af805b81dc99737514ede3490cca89b. No type-check waiver.
SDK311 COMPLETE original contracts config, proper Platform binding:456 total/451 PASS/5 FAIL/0 pending;71 files,69 PASS/2 FAIL; 13a0e2951cbb8499918f39e1d571767ed07340c7255f2c62f3569f8e0e4baad1. Five original canonical schema semantic/custody failures remain, not accepted.
Held private archive12 /tmp/capacity-sdk-candidate12-XAMdii/treeseed-sdk-0.13.0-rc.122.tgz, npm pack --ignore-scripts --json from held build, SHA c1c41f5276a6744d9047303f5d51fdcae27b167ef7de4611d2e240669e6413a4. API ONLY diagnostic npm install --no-save --ignore-scripts --package-lock=false exact archive, manifest/lock unchanged. Archive contains UNCOMMITTED source working bytes, NOT b514 commit custody/public publication/dependency closure. node_modules NEVER stage. Agent dependency not changed.

API313 COMPLETE six original files: both readiness files; decision-execution-plan-authority.test.ts; proposal-decision-denial-native.test.ts; both workday-start-authority/native files.36 total/33 PASS/3 FAIL/0 pending; SHA75f6bfadb208a0ebfde07d9fe129c1f614dcb6400adb4d09e5d1921563b62abd. Original direct/start/replay tests PASS; duplicated dependency UNIT+native now PASS. Failures: optional requiredCapabilities omission; TWO genuine classed-Decision authority omissions UNIT/native. API313 build:dist PASS14d9a4d3da9b8735b37a1290645b0e065d45c6c4b59fe370351fcd06cf6db937. API311 original strict532 FAIL/no changed-file diagnostics c1162654926fa9f0b091ce06b0126044120e61556724f902b767eae5e9d235ea; API312 layout/diff PASS69adf5b6377a345f27badc1937921a76e9c3991eac5c8dce53bb89d7cf63c024. No source changes during each held invocation.

Real authority gaps / next implementation

Platform canonical WorkItem required list excludes requiredCapabilities; optional array permits omission/empty. Older SDK negative requires omission denial and contradicts original API native positive. Both retained unchanged; one nonblocking user question asks approval to correct that specific historical oracle to canonical requirement, retaining old failure and malformed/duplicate negatives. Do not silently erase it.
API public Decision missing classed canonical Decision remains genuine RED. Older review-result fixtures omit frozen Reviewer profile/start; discussion fixtures pass runtime executor while frozen Attempt says codex, then partial replay rows. Correct fixture authority, NOT loosen runtime checks. Governance readiness evaluation fence and actual corrupt usage clock remain open.
Disposable PostgreSQL/TreeDX bindings still absent; installed database:5432/treeseed_api is NOT disposable test authority. Relay CA readable. No installed mutation/native fake fallback/skip/environment pass.
Read errors from guessed filenames and absent cgroup cpu.max are READ errors, not tests/product RED; combined SDK registry output truncation is not full audit. Preserve entire preceding208945-character Issue body below.

Capacity/Agent execution 284–301 — pushed candidates, acceptance STILL BLOCKED

API candidate 5416650 (parent 3dbfb64), Agent 1968e9164bddbdec9a0b7056e5547952116162ef (parent 19a2c03b71292a093127951c6b9340e40c6cb86e), SDK b514c29ae6b9e5c99711a4179697efda6514fc74: committed/pushed and independently exact ls-remote verified. Original codex/architecture-guideline-tests owner worktrees. API/Agent tracked clean; diagnostic node_modules never staged. Protected staging independently fetched unchanged: API1817b0f0b817c6d6a211ecd11284c4bdda54ad2f, Agent6c0f0bf8ffe22c1bd20ca7034d8a2a5fa225d41c. Draft PR492/320/358 remain unmerged. No UI/campaign/acceptance/model/runtime activation/release. SDK golden NEVER passed.

Exact added mappings / owning boundaries

All mappings in ORIGINAL golden.verifiers.yaml and component-boundaries.scene.yaml, matching step IDs omit owner.golden prefix; local-component-tests, NOT managed E2E. Every older assertion retained.

• API UNIT existing tests/unit/control-plane/governance/decision-execution-plan-authority.test.ts, “decision creation replay rejects retained foreign stale rejected and superseded authority before returning or rewriting an existing decision”, api.golden.execution-decision-producer-unit-1. NEW real native SQL tests/unit/control-plane/governance/proposals/architecture/proposal-decision-denial-native.test.ts, “original decision creation replay denies retained foreign stale rejected and superseded SQL authority without rewriting history”, api.golden.execution-decision-replay-native. Original ControlPlaneStore creation replay now calls ORIGINAL validateDecisionAuthority BEFORE returning existing row. Seven invalid retained authorities twice each exact409/own code/no writes/full snapshot immutable. Controlled native Git proposal bytes and SQL inputs NOT genuine accepted classed Decision creation. Original positive proposal-decision-native-1 remains required and blocked without disposable TreeDX; operational SQL+Proposal ref without classed Decision remains genuine UNIT/native RED.
• API existing workspace-identity UNIT negatives and workspace-readback native case strengthened missing/null/numeric/empty/foreign exact identity denial. NEW tests/unit/control-plane/treedx/workspaces/architecture/workspace-readback-persistence.test.ts, “denies a changed native workspace identity after successful verification before any success audit or receipt and admits only the unchanged exact retry”, api.golden.execution-workspace-response-native. Actual original public proxy/catalog/official client/native HTTP+SQL FIRST valid workspace verification then SECOND changed response, three substitutions deny before success audit/receipt. Six failed native HTTP observations retained; exact retry one original success audit. Original helper assertTreeDxWorkspaceIdentity reused BOTH verify and final getWorkspace response; missing/foreign ID409 treedx_workspace_identity_mismatch, wrong repository403 retained. SAME workspace-cleanup fixture only added controlled read-response sequence; defaults/older cases unchanged. Controlled endpoint NOT native TreeDX/physical teardown/operator authentication.
• API NEW tests/unit/control-plane/capacity/workdays/scheduling/architecture/recurring-intent.test.ts, “rejects a lost conditional schedule update from its own SQL result without certifying another writers matching version”, api.golden.execution-schedule-update-unit. Original recurring-persistence concurrent conflicting edit case api.golden.architecture-recurring-replay-sql-3 strengthened exact loser409/code/winner actual purpose and full winner row. Owning schedule CAS now UPDATE…RETURNING via first; no returned row409, never read another writer's matching version as own success. No new lock/version/clock. PGlite overlapping promises NOT independent PG concurrency; old receipt replay fixture NOT first start/dispatch.
• Agent NEW tests/modern/sandbox/architecture/budget-authority.test.ts, “requires native ESRCH for owned process group absence and preserves permission and unknown observation failures”, agent.golden.execution-process-group-unit. Existing native budget-native.test.ts “native hard stop graceful parent interruption and failed parent exit close every recorded descendant before reporting failure without leaving late bytes”, agent.golden.execution-descendant-closeout-native-1, SAME ESRCH/no late bytes assertions retained. Existing descendant-closeout-unit-1 retained. Original process runner had SIGKILL pending after parent close while real descendant still State R; PID1 was actual user systemd, not established zombie/reaper failure. Runner now waits native owned group ESRCH after kill under SAME existing3sec forced-closeout bound, polls10ms. This is newly waited infrastructure SIGKILL acknowledgement, NOT productive continuation/deadline refresh/allowance increase; original watchdog/hard/idle/closeout bounds retained. Unknown/EPERM fail; no zombie-as-absence/reaper/service. Unsafe PID/current/fraction/nonfinite/malformed or nonboolean group deny BEFORE any signal. UNIT process.kill observations are controlled INPUTS; native integration closes recorded actual descendants, NOT Kata/provider/session managed physical closure.

Original API preflight type corrections: createCapacityWorkdayRun returns original canonical SDK CapacityWorkdayRunRecord|null, claimed preflight id:string instead UUID-template inference; receipt original SQL started_at OR canonical run.startedAt OR original stored startsAt. No fresh clock/fallback field/cast/check-disable.

Exact focused/whole evidence; all failed observations retained

Commands use PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH, original owning cwd, node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts (API) or ./vitest.config.ts (Agent), COMPLETE named original files, --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/.json and matching .log redirect. No filtered case receipts accepted as prerequisites.

API284-red governance UNIT+denial-native files:7/3PASS4FAIL/0pending SHA dc4778addab74f6ed1ae95b042cdae5f3b10cab0ca0ceb97abec80de4ecd98d4.
API285 samefiles after replay fence:7/5PASS2FAIL/0pending SHA2498d0f964ea2a64a4980bfc98cb52650822efdc71aa102a8c63d9c0d06cc2e1. TWO operational snapshot-without-classed-Decision failures retained, NOT fixed/pass.
API286-red workspace UNIT+readback6/4PASS2FAIL SHA4af157ceddf98bad4b737b7550cd860cd2c58ccfd61f9565f804df66a608951e; strengthened287-red6/4PASS2FAIL SHA377158edc6c130b0bf316dbd8a0ce11fa048cfec1fb5ecb02e343f03163fe0d1. API290-red new second-response case7/6PASS1FAIL SHA c474c4ed2568fec6435c2aa6792f5e39ec776c01ebbe37a089348d30af483795; API291 five complete workspace/cross-project proxy files27PASS SHAf1bd33cfd3515e627820c03519cad80cea75e773a6808454acd9a982b96e02f4.
API292-red two original recurring files10/7PASS3FAIL SHAc51c75dd6d520a9010088aa5f567789d97fa101509b9decfc29922eee58d18c8; API29310/9PASS1FAIL SHAb2eac7c0cb12667caf3a4f317367fb31318693a34e16a7dfd5181b608146a9dd. Remaining SDK-constraint failure caused old private dependency; owning SDK validator already repaired, NOT duplicate API policy.
API296 held TWELVE complete original files86/84PASS2classedDecisionFAIL/0pending SHA3fea256cfa2c47714e5c060c452b0afa3a025367257f3c4ad56c4fd49c62dd31: recurring-intent/persistence; workday-start-authority/native; selection-preflight; workspace-identity/readback; workspace-cleanup-persistence; cross-project-proxy-authority/native; decision-execution-plan-authority; proposal-decision-denial-native. Build/layout/diffPASS; strict532FAIL SHA caf29df26a885f4e6f3c2af009e24636b1c15e2c8375b2b3124731dcd3ea9b00, no changed-file diagnostics, NOT strictPASS.
Agent294-native6/5PASS1FAIL SHA9f96001b2a7a6158388cffa312d5045e0742bc43253182688a9cda2eaa3d4451; Agent295-native6/5PASS1FAIL SHAeee7fba1c555f79457e25ecddff9d2b06108ed2326ecd7ac5b203f600cbf8b3d. Old native premature-completion failures plus finally identity-guard transient cause retained.
Agent297-red11/9PASS2FAIL SHA8b285613dbb1b5daf698d83c4cf37e8882de1982f98e0eff497b074906b91938 includes NEW UNIT missing-export TypeError (construction gap NOT productRED) plus existing genuine native failure. Agent299-red malformed PID added SAME UNIT after helper exists5/4PASS1genuineFAIL SHA67c78c5c15166d6014db32134a2e13fe2c7af6b9dd38d03fab3546b5c8c97255.
Agent300 THREE complete original files budget-authority/budget-native/codex-idle-recovery22PASS/0pending SHA1c0ac5553ac3706cb476e7294d62ed56be4ef9c1c3d7f490b194c7bd6055d7e8. StrictPASS empty e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855; buildPASS02d19d2ab54f1b3c10783d5179a0185fa505941f684c6e198a26cb1f02af3419; layoutPASSed73d142605e4fb1a90eb7675a056c29b2dedead59bf0f0067b0adabfdd28923.
API301 COMPLETE control-plane invocation on541665 exit1:1815tests1706PASS98FAIL11pending; reportSHA8c7219df1cf9943a8652a4f22b253950700b88057531aa2121f4d3326a84c970. Native PG/TreeDX bindings missing cause many explicit MUSTFAIL, plus actual remaining contract/assertion/fixture failures; NOT all productRED and NOT passing prerequisites.
Agent301 COMPLETE modern invocation on1968 exit1:807tests796PASS11FAIL0pending reportSHAb078421b9fde481be67728a81aba91a4786aa77325bc80f935f7afb292b98c52. This invocation omitted REQUIRED TREESEED_DEVELOPMENT_WORKSPACE_ROOT, causing canonical custody authority failures; retain original failed run, correct later invocation not waive. Other microvm/runner/native provider/project build failures being isolated; unexpected timeouts still failures, no deadline increase. Full reports local immutable diagnostic evidence, NOT uploaded Actions artifacts or whole semantic completion.

Private dependency / CI

SDK held b514 dist packed npm pack --ignore-scripts --json WITHOUT rebuild/prepack into allocated /tmp/capacity-sdk-candidate11-7hbSiv/treeseed-sdk-0.13.0-rc.122.tgz SHAcecec2a4c365c5cc0b7f5f2e9125bb4e76a41aeb2215fab4a38f8624adff6e31. API only installed diagnostic candidate11 via npm install --no-save --ignore-scripts --package-lock=false; manifest/lock unchanged. Installed lifecycle.js SHA302e526abb6dcef440e1161f20e3eb087a90be864d26b81598eefaaa725600af. Agent remains privatecandidate10. NOT published SDK/dependency closure/public registry/CI proof.
API3dbfb Actions37282278147/job111672885215 FAIL, originalPG17servicehealthy, SDKinstall success but old public SDK exports/priority missing causes failure. Migration/identity/allocation/pack/scenes/upload stepsSKIPPED NOT proof. SDKb514 Actions37280921692/job111668578812 FAIL:71files69PASS2FAIL /456tests451PASS5canonicalFAIL0pending; scenes/pack/seal/uploadSKIPPED. FULL connected logs retained in memory api300JobLog/sdk300JobLog; no rerun/merge/publish.
SDK five canonical authority/registration failures and strict41 remain OPEN. Nine missing stored schemas/eight missing shared schemas/full native equivalence NOT solved by loose/copy-target validators.

No disposable native PostgreSQL/TreeDX binding established. Installed database:5432/treeseed_api is NOT disposable test authority; relay CA readable. Existing relation fixture explicitly forbids starting/building/installing engine or controlled HTTP fallback to replace missing native conformance/trust. Read-only Docker inventory shows installed services only, NOT disposable test authorization. No installed credentials exposed/read or runtime mutation.

Read-only path guesses failed and some combined output truncated; no whole-source audit claims. API295 introduced one returned-row union diagnostic corrected before final532; no assertion weakened. Parent build/source overlaps in older batches NOT custody proof, final held builds retained. Full objective OPEN; continue capacity/provider/Agent execution, no checkpoint stopping or UI. Fresh COMPLETE all participating owner UNIT+real integration/strict/build/candidate closure zeroFAIL/SKIP/TODO/missing/inconclusive required BEFORE every native scene/SDK acceptance invocation.

Capacity-provider / Agent execution batch 272–283 — continued repair, NOT acceptance completion

API d398994 and 3dbfb64, SDK b514c29ae6b9e5c99711a4179697efda6514fc74 are committed/pushed on the existing codex/architecture-guideline-tests branches; independent ls-remote matched. API protected staging freshly fetched remains 1817b0f. No merge/release/activation/scene/model/campaign. No UI. SDK golden NEVER passed.

API272: original upstream proxy operation keeps the generated adopted-operation type from lookup through the official SDK client, replacing a loose string type, with no cast/check disable/authorization change. Four complete original files 20/20 PASS/0 pending; JSON SHA256 47fe1f483ec09ea90f4ecf39d34e7aab6ed2e7623649d359e15fcadaccd2ca99. Strict remains 538 diagnostics FAIL (5 cascading diagnostics removed), log 37496e5b7f26c9be03fefda402f943038600b6e5eaf105bb717a2967b3b65cac. Build/layout PASS; not acceptance prerequisites.

SDK273–277: TWO new UNIT cases in ORIGINAL tests/unit/operator-contracts/workday-lifecycle.test.ts:

• "requires explicit all or unique canonical project identities without broadening missing malformed or repeated project scope" / sdk.golden.execution-project-selection-unit.
• "retains bounded provider constraints and rejects malformed unknown or duplicate supply selectors without changing workday authority" / sdk.golden.execution-provider-constraints-unit.
  Original guarantees/verifiers/golden.verifiers.yaml and component-boundaries.scene.yaml exact bindings authored (scene step IDs omit sdk.golden); local-component-tests NOT managed acceptance. SAME original tests/unit/control-plane-client.test.ts native case sdk.golden.architecture-intent-native-1 strengthened: every malformed project/operator constraint through BOTH preflight and scheduled request bodies must cause ZERO native HTTP requests and immutable inputs; all older 28 valid requests, typed failures/retries/abort/transport assertions retained.
  Only original validateWorkdayIntent repaired: projects required as 'all' or nonempty unique bounded canonical IDs; supplied operatorConstraints must be an object with ONLY providerIds/maxConcurrency, unique bounded canonical provider IDs (original empty list remains valid), positive integral maxConcurrency. No caller-derived authority/new schema/model/parallel policy.
  sdk273-red 37/35 PASS/2 genuine FAIL/0 pending SHA 55d1754611872ffe672a40e1fe088ec94e09a3ae527de210b352299bbcdf67b4; sdk275-red 38/36 PASS/2 genuine FAIL/0 pending SHA 3a8ad55cf06cfbdd0e2d4b864a86bf3ad5792ad98247315739f9ab18cfbcac80.
  sdk276 two COMPLETE original files 38/38 PASS/0 pending SHA 63709cbec1bf94a4b764b741a7de3c198249c3743220777e64dc3a0782c3a1a7.
  sdk277 COMPLETE SDK contracts with required Platform binding 456/451 PASS/5 canonical FAIL/0 pending SHA abe32556ef9aa03b6fe85164bc0df4d8566cceda73095ff4fdf03dbb86268d38. Command: pinned PATH, TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform npm run test:contracts -- --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/sdk277-complete.json. Build/layout PASS; strict remains 41 diagnostics FAIL, bffa325b131ee765648c082fb08513924af805b81dc99737514ede3490cca89b. Controlled HTTP responses do NOT prove native API governance/provider authority/charges/physical closure.

API278–282: new UNIT in ORIGINAL tests/unit/control-plane/capacity/workdays/lifecycle/workday-terminalization-graph-custody.test.ts:
"retains an orphan active graph node as unfinished even when no assignment row remains" / api.golden.execution-terminal-orphan-unit, same original registry/component scene binding.
Original REAL owning SQL tests .../lifecycle/architecture/terminalization-persistence.test.ts strengthened unknown productive usage exact409/provider_assignment_usage_required and exact orphan unfinished count; every older control/assertion retained. Native IDs agent.golden.architecture-workday-terminal-1..5 remain; particularly -2 unknown usage and -5 orphan running node. Original workday terminalization reuses terminalPerformance/admitted canonical assignment/original aggregate receipt BEFORE any page settlement; missing productive measurements deny without zero-charge substitution. Original SQL unfinished count now includes scoped orphan active graph nodes, without deleting/repairing their history.
api278-red native five cases 5/3 PASS/2 genuine FAIL/0 pending SHA c07b94187a2d64b341238d07cf4958c2c638f9acca8ecd42bc0d58713b187347.
api279-red UNIT+native 8/5 PASS/3 genuine FAIL/0 pending SHA ffeb436470fd5813b3f44647f3afc82abcd40c15d89e7d5d419fb8c62b1d1413.
api282 FIVE COMPLETE original files 18/18 PASS/0 pending SHA cfcc334e72b74fe8a9c9eea1e250115c996802cd91f260cce3bfb4459f2ccb01:
workday-terminalization-graph-custody; terminalization-persistence; recovery-persistence; providers/assignments/architecture/cancellation-persistence; capacity/assignments/terminal-performance.
Command uses pinned PATH and node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts followed by those five complete test paths, --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api282.json. Strict initially 540 FAIL including TWO introduced generic vi.fn TS2322; corrected typed generic collaborators plus spyOn WITHOUT casts/check bypass, and older tuple typing corrected without assertion changes. Final strict 534 FAIL, no changed terminalization-file diagnostics, log SHA11b5848dd5ff956d0cd81592a5beddb7e708caecc64e974cc8a3c039a66a0b23. Fresh final held build/layout/diff PASS: build SHA0e62d1abc244c289227e1a9212683f6dabba941d761588ba25873ab887828cc7/layout69adf5b6377a345f27badc1937921a76e9c3991eac5c8dce53bb89d7cf63c024.
Earlier SDK274/API281 builds overlapped source edits and are NOT exact final held proof; fresh277/282 replaces only that custody claim. Two malformed diagnostic report-reader node -e SyntaxErrors and guessed absent source paths were inspection errors, NOT product/compiler/test RED. No failure history erased.

API283 next genuine unresolved authority observation: complete original governance/decision-execution-plan-authority.test.ts + governance/proposals/architecture/proposal-decision-denial-native.test.ts, 6/3 PASS/3 genuine FAIL/0 pending SHA f631300d8af9b8108e6ac8c33ded529e0e2b9d82ac9370117b5fdcaa9ffc9802. Operational SQL+exact Proposal bytes still accepted without a governed classed Decision (UNIT/native), and decision creation replay returns foreign/stale/rejected/superseded rows. Original proposal native Git+SQL+official client fixture is NOT actual TreeDX governance; native accepted Decision production remains OPEN. Continue implementation, no checkpoint stopping.

All artifacts above under /tmp/capacity-agent-focused-20261004-OB6xb5 are LOCAL diagnostic evidence, NOT Actions artifacts or fresh complete participating-owner acceptance prerequisites. Complete SDK five canonical failures/41 strict; API534 strict/native environment gaps; Agent descendant absence and public SDK dependency closure remain UNRESOLVED. No SDK golden until complete exact all-owner prerequisite suites pass with zero failure/skip/todo/missing/inconclusive, then genuine managed scene/readback/usage/settlement/durable teardown. No diagnostic dependency staging/new schedule/chat/campaign/allowance extension.

Capacity-provider / Agent execution batch 262–271 — implementation and verification, NOT acceptance completion

API candidate f9ebfac and SDK candidate 8f52b40126a1ec9c86a0b2dd59baec663db7d0e1 committed/pushed to existing codex/architecture-guideline-tests branches; independent ls-remote exact. Fresh fetched staging remained API1817b0f0b817c6d6a211ecd11284c4bdda54ad2f / SDK94094c39813618125266c1328c60e6c5ddaf569b. Existing PR492/358; no merge/release/activation/UI/scene/model/campaign. PrimaryAgent319 and Agent19a2c03b71292a093127951c6b9340e40c6cb86e untouched.

API: original cross-project-proxy unit1/native1/native2 strengthened, older controls retained. Empty requested path selection preserves exact nonempty secondary grant paths in real signed delegation rather than an unbounded empty scope. Empty secondary grants deny with original durable audit and zero upstream requests. Wildcard /* controls deny; api267-red filename ACTUALLY13/13PASS, NOT new RED. Removed incompatible Store.run override; user actor identity read through original record narrowing, no authorization weakening. SAME original product proxy-operation-service/upstream-operation and two tests only. Native uses original SQL, public proxy/official transport/signature verification against controlled native HTTP inputs, NOT native TreeDX governance/model/provider charge/physical managed closure.

API264 genuine RED13/10PASS3FAIL before bounded-scope repair SHA60edad4781ef0a5a495cb771f551c884161cd650a8e46ab71d260b47641ba0d2. API26616PASS SHA400fe4d114c071e09ca54b07d5ed2397ac7adbf5d2e8fb0a81ef92835d18ae58. Final api269 three COMPLETE original files16/16PASS0pending SHA bf893827114e990c7a73afc2c9f2f3b7d8a6004c76bc3ba46043bb889daf0f47.
Command API: pinned PATH node node_modules/vitest/vitest.mjs run --config vitest.control-plane.config.ts tests/unit/control-plane/treedx/authority/architecture/cross-project-proxy-authority.test.ts tests/unit/control-plane/treedx/authority/architecture/cross-project-proxy-native.test.ts tests/unit/control-plane/capacity/treedx/proxy-access.test.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api269.json.
API270 build PASS SHA0e62d1abc244c289227e1a9212683f6dabba941d761588ba25873ab887828cc7; original layout PASS69adf5b6377a345f27badc1937921a76e9c3991eac5c8dce53bb89d7cf63c024; git diff --check PASS. Broad original tsc --noEmit543 diagnostics FAIL SHA7341f12156b9df510af01ebe5b883317d85ad58c7ae3a7ea16dbf7ee0c862afc, down4 from547; proxy-operation-service original4 fixed, TWO upstream-operation string-to-generated-union diagnostics remain, no whole strict PASS.

SDK: four NEW literal case mappings:
UNIT tests/unit/content/architecture/canonical-schema-equivalence.test.ts "rejects omission of an implemented stored execution record from the root union despite unchanged complete definitions" / sdk.golden.execution-stored-root-unit.
REAL native Git/public verification tests/unit/content/architecture/platform-schema-custody.test.ts "native public verification denies an omitted executable stored root while retaining the committed declaration and complete definitions" / sdk.golden.execution-stored-root-native.
UNIT tests/unit/agent-capacity/capacity/architecture-record-custody.test.ts "requires the authorized context value field while retaining null scalar and structured payload bytes without changing authority" / sdk.golden.execution-context-value-unit.
REAL native public SDK process tests/contract/agent-capacity/agent-execution-contract.test.ts "native public SDK context item validation requires the payload field without inventing content or another authority" / sdk.golden.execution-context-value-native.
All FOUR original golden.verifiers.yaml and original component-boundaries.scene workflow bindings, exact IDs minus sdk.golden prefix for steps. Scope local-component-tests, NOT production-shaped managed E2E. No scene launched. Same original closeout-native.ts mode extended, actual public validator/readback/native child ORIGINAL15sec bound, no alternate runner. Null,false,0,empty-string,array,object/structured payload exact positive; missing/own undefined/unknown extra grant deny; inputs and source bytes immutable. Supplied payloads/refs NOT actual governed model consumption.

Original verifier now requires every IMPLEMENTED stored root member, and registers existing GraphRevision/WorkdayPolicy plus existing runtime/shared validators WITHOUT copying target declaration or creating parallel validators/models. Optional-only object need not invent required array; boolean true and {} both unconstrained; false retained. Every structural assertion still compared. Nine unimplemented stored authorities and conditional/uniqueness/structural mismatches remain FAIL, not ignored. Original authorizedContextItem.value z.any accepted absence; z.unknown refine now requires payload, preserves every legitimate payload, no invented content.

SDK261 genuine omission RED17/9PASS8FAIL (2new+6older) SHA1517b9db9a47749d1a4e62b8fef046b113b661bcf913c201a62323f9cd5e925c. SDK26317/12PASS5FAIL SHAa1b3afa041469b3bdb6be6db80144ea636e8780f0c7e3459e73a0ed72607426a. SDK268 genuine value RED16/14PASS2FAIL SHA6a66b15a4271bf5151adb427dedfea5c3324e6b9eb1d9250a731d9a29a829a3c. Final SDK269 five COMPLETE files41/36PASS5canonicalFAIL0pending SHAb92ef76bc8008ca70d2e05cb18f6000233e47d02f0cf321b9f89b194159b15f4.
Focused command: pinned PATH TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config vitest.contracts.config.ts tests/unit/content/architecture/canonical-schema-equivalence.test.ts tests/unit/content/architecture/platform-schema-custody.test.ts tests/unit/content/architecture/platform-agent-schema-verification.test.ts tests/unit/agent-capacity/capacity/architecture-record-custody.test.ts tests/contract/agent-capacity/agent-execution-contract.test.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/sdk269.json.
SDK269 build PASS c31e6c64de4ed22e5597585c6fa52c9034031cad7f4725905c889e83089379ff / layout PASS32e905f9c320e19d49ce9551bff67ab3b9beb31f25b607a42d065cf72e98f231 / diff-check PASS. Original strict41FAIL unchanged bffa325b131ee765648c082fb08513924af805b81dc99737514ede3490cca89b.

IMPORTANT SDK270 COMPLETE suite invocation omitted required Platform binding (our invocation error):454/439PASS15FAIL0pending SHA9c32e7c311eab0b1ef46fcfb5120426d33297f3a89220407648e32ba258aa039 retained, NOT15productRED. Corrected SDK271 COMPLETE original test:contracts with SAME exact Platform authority:454/449PASS5FAIL0pending SHA2a88f194e11d6c409e8d6f2252a10b2dd33106bd5ff85157c214ac9a6fddff8e.
Command: PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform npm run test:contracts -- --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/sdk271-complete.json. Five failures exact canonical positiveUNIT/native and three exhaustive shared/field/constraint mutation checks. NO passing prerequisites, NO acceptance permission. Reports in SAME /tmp directory are LOCAL evidence NOT Actions artifacts.

API prior2ba6 CI run37277246099/job111656893495 actual54failed312passed366files/220failed1591passed1811tests. Native PG service present CI; no local disposable authority inferred. Backup/identity/allocation followups/pack/scenes/artifact upload SKIPPED after verify failure. Logs independently read/stored api271PriorLogs; no rerun. Public released SDK dependency still differs from local diagnostic SDK. Existing Agent complete modern native descendant-absence failure and public SDK missing-export CI remain unwaived. Host PID1systemd; no new reaper/zombie-as-absence/timeoutextension/trustbypass.

Full task OPEN: canonical WHOLE semantic authority, public package dependency closure, complete API+Agent prerequisites, actual provider/Agent execution/native model clocks/all-attempt accounting/settlement/durable teardown and SDK golden remain incomplete. Continue fixes now, not stop at push/checkpoint. UI excluded. Preserve ALL preceding body byte-for-byte below.

Provider/Agent batches 251–260 — review inventory and secondary read authority repaired

API commit 2ba6bf3 PUSHED; independent ls-remote exactly matches. Parent70d6a3ba9ce2a196c086c84f2063f7136f171181; fetched staging independently unchanged1817b0f0b817c6d6a211ecd11284c4bdda54ad2f. Existing PR492 remains Draft. SDK56f9297/Agent19a2c03 unchanged. No UI, schedule, activation, release or managed acceptance.

Exact owning changes and original mappings

• Original admission-replay-authority/native tests now supply complete SAME canonical root/envelope identity (workday/provider/executionProvider/reservation/class/ordinal), plus the required durable explanation. Original malformed/changed authority and immutable read-only replay negatives retained. The earlier root-fragment errors were supplied-fixture defects, not proof of replay denial. All16 replay cases pass.
• Original review-decision-fixture now supplies the SAME complete canonical assignment and governed arbitrary reviewing profile. Product src/api/capacity/services/capacity/assignments/context/review-result.ts requires exactly one matching work-review disposition, exact assigned profile reference, exact Actor candidate/project and decidedAt within original admission/result interval. It denies mixed valid + foreign maker/project/candidate/clock in BOTH reference orders, instead of accepting the first valid entry. Original SDK Decision validator still owns classes/methods/positions/dispositions; non-work-review citations are not relabeled formal disposition. No named-role or duplicate voting policy.
• Strengthened SAME UNIT tests/unit/control-plane/capacity/execution/architecture/review-decision-authority.test.ts "denies conflicting exact review Decisions rather than selecting the first returned disposition" / api.golden.architecture-decision-review-unit-conflict and SAME real original-DDL/PGlite/Git/official-client/native HTTP review-decision-native.test.ts "rejects conflicting committed dispositions instead of treating reference order as authority" / api.golden.architecture-decision-review-native-conflict. Existing golden registry/component-boundaries scene bindings retained, local-component-tests only, NOT managedE2E.
• Original cross-project-proxy fixture had replaced a complete original capacity envelope with a fragment. It now reads original valid repository custody first and retains the SAME envelope identities while supplying the original60sec test authority. No executed deadline/allowance increase.
• Product selectTreeDxReadRepositoryGrant requires one exact match, not first ambiguous grant. The SAME selected grant is carried through authorization to signed delegation; a second project-only lookup no longer signs a sibling grant's empty/wrong paths. Original treedx-proxy-access validates explicit malformed/elapsed handle clocks and token/operation before primary repository/path mismatch; secondary reads bypass ONLY primary repository/path mismatch, not expiry/revocation/assignment/token/operation denial. Omitted expiresAt remains optional under original SDK handle interface; this is NOT a missing-clock prohibition claim.
• Original cross-project-proxy-authority.test.ts four UNIT and cross-project-proxy-native.test.ts nine real owning SQL/repositories/catalog/official client/native RSA-verified HTTP cases retain existing api.golden.architecture-cross-project-proxy-unit-1..4/native-1..9 and matching original component scene bindings. Exact positive signed refs/paths, durable denial audit, finance/assignment immutability, concurrent requests, 403/503/reset/badJSON/preabort, late audit-trigger interruption/retry preserved. Added diagnostic message contains ONLY credential-free captured scopes/body, never bearer/proof/header data.
• Original provider-assignment-timestamp.test.ts now supplies SAME FK reservation and root node/revision/envelope identities before encrypted diagnostic event assertions. First attempt exposed missing FK reservation: introduced TEST INPUT failure retained, NOT productRED. No fake admission/settlement; original public event encryption, replay/concurrency, transactional interruption/no plaintext and3sec deadline assertions retained.
• Original terminal-performance.test.ts usage-write positive now uses SAME canonical typed assignment/ordinal1, not a root fragment with impossible ordinal0. Exact activity-vs-provider-signature assertion unchanged. This was positive fixture correction, not weakening a zero-ordinal negative.

Exact focused commands and evidence

All run in API worktree with PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH, original vitest.control-plane.config.ts, native resources only actual selected owning callbacks. Reports/logs in /tmp/capacity-agent-focused-20261004-OB6xb5 are LOCAL diagnostic evidence, NOT Actions artifacts/prerequisite PASS. Counts overlap, never sum.
251 fourfiles32/26PASS6 genuine review failures after complete canonical replay/review input correction; SHAa2089b8dadde25a51d6fbb690a9474843439cfa30cbd1d1bc9aa83e65683b0ba.
25232/32 intermediatePASS SHA232efd99a8f8aae0c2c097a8b86f64aa4f83ee3f113fa63e2e369903c6f85ef6; test-edit timing relative to process completion was not independently held, NOT final exact-candidate proof.
253-red twofiles15/13PASS2 mixed makerRED SHAb07930d6c50cd8719f894f4dbde01160584d82736b652968859776b4a3eed409.
254 sixfiles45/45PASS SHA83f9e8b8ae7460faf13b55ee7761cc2bd342901bbdefb3a358d7ff1092398876.
255 fourfiles23/17PASS6FAIL SHA153838d102a1ca35e3e6837a36a60c080f82cf74a8f70d3d6a0a73f8b0b3cd2b; contains introduced FK fixture failure, NOT all productRED.
256-red twofiles16/13PASS3 genuine proxy failures SHA52593223252a9639f4a504f4783e94dd6e6653ca692c626b74002b9020efc763; repaired diagnostic fixturePASS, independent signed scope exposed empty sibling paths.
257 fivefiles26/25PASS1 native malformed-expiry bypassRED SHA17adb1560a1cb076ffa2315087573c0278d64aec507f8173bc9a382bd7fda029.
258 ninefiles58/58PASS SHA4ce47455fe63ffc4711e31ec17c6eec8c163810b9966aab67bd7659040a04f7f.
259 twofiles15/13PASS2 mixed foreign-project reviewRED SHAea70da4e8a270c8654298d9da6b561434f82b60abbf68db80e2a5936d9db0190.
260 final ninefiles58/58PASS0pending SHAac45fb81485f25ead4b3edcf54a380ca493d4d941e08a03d84d19755bb02cfed; BOTH mixed inventory orders exercised after fix.
Final command:
PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/treedx/authority/architecture/cross-project-proxy-authority.test.ts tests/unit/control-plane/treedx/authority/architecture/cross-project-proxy-native.test.ts tests/unit/control-plane/capacity/treedx/proxy-access.test.ts tests/unit/control-plane/providers/provider-assignment-timestamp.test.ts tests/unit/control-plane/capacity/assignments/terminal-performance.test.ts tests/unit/control-plane/capacity/execution/architecture/admission-replay-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/admission-replay-native.test.ts tests/unit/control-plane/capacity/execution/architecture/review-decision-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/review-decision-native.test.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api260.json > /tmp/capacity-agent-focused-20261004-OB6xb5/api260.log 2>&1
npm run build:dist PASS logSHA14d9a4d3da9b8735b37a1290645b0e065d45c6c4b59fe370351fcd06cf6db937. Original npm run check:file-lengths + git diff --check PASS; layoutSHA69adf5b6377a345f27badc1937921a76e9c3991eac5c8dce53bb89d7cf63c024. Broad strict currently running, NOT typecheck PASS.
Initial hash read guessed api253.json/api256.json absent because actual filenames include -red; command returned incomplete checksum set/error. Recovered exact original -red reports, no deletion/fabricated custody/RED.

CI and remaining gates

API prior70d6 run37274881522/job111649611144 FAILED59/366files,232FAIL1579PASS1811tests against public released SDK; logs show missing validators and priority contract rejection plus other failures. No successful suite reuse/retry. PostgreSQL follow-up jobs, pack, coded scenes and artifact upload SKIPPED. New2ba6 batch not yet CI result.
SDK56f9297 run37274700287/job111649065213 FAILED6 canonical tests, exact Platform checkout succeeded; scenes/pack skipped. Agent19a2 public-SDK build gap, local native descendant ESRCH failure, absent disposable TreeDX/local PostgreSQL authority and SDK whole canonical/schema broad strict failures remain OPEN.
This closes scoped review/proxy regressions ONLY. Seeded authority/native controlled HTTP/Git are not authenticated governance, live model, genuine findings, native all-attempt charge/Settlement or managed physical teardown. Empty-request secondary path scope, full canonical runtime/record alignment and complete production-shaped scenes remain unproven; no counts-as-coverage claim.
Every eventual acceptance requires fresh COMPLETE ALL participating-owner UNIT+REALintegration exact candidates zeroFAIL/SKIP/TODO/missing/filtered/inconclusive FIRST. SDK golden NEVER passed; no campaign launched. Continue capacity provider/Agent execution work, not UI; do not stop merely after this persistence/push.

Provider/Agent batches 240–250 — public execution records and graph watch repaired; full acceptance still blocked

Human priority decision remains implemented (API b102a09): update canonical node priority for future scheduling, keep issued Attempt/reservation frozen. No UI, schedule, campaign, activation or release.

PUSHED with independent exact ls-remote readback:

• API 6635079: original bootstrap PostgreSQL test ORACLE correction only. Provider IDs are provider_ + first32 base64url fingerprint characters, not UUID; original audit IDs are deterministic SHA256(action:resourceId), rotation resource identity includes team/version. Other UUID assertions, original3sec expiry, interruption/history/immutable SQL assertions retained. Early helper draft64hex corrected SOURCEONLY to actual43base64url before execution. Local bootstrap authority7/7PASS; native PG correction NOT locally exercised, no disposable binding.
• SDK 321c8972ffac312943a57dd451e6772fea79a57a: original verify job exact Platform authority checkout 42a67d98207211f3b84018d04af8c58090645d97 at .treeseed/platform-authority, original pinned checkout/no credentials/moving ref/copied oracle; development workspace environment points there. Reviewed feature commit, NOT merged staging authority.
• SDK 342227a41a62f6f607c9331dc82f7f0959001429: two original TEST INPUT/type corrections only, explicit typed refs/string arrays, omit required property via destructuring, malformed input via Object.assign, removed unsupported Vitest matcher type arguments. Runtime assertions unchanged; whole threefiles31/31PASS. Broad strict53→41 diagnostics, still FAIL.
• SDK 56f92967ad941ee4be93ae022ddc70f3b780262a: existing canonical Lease/Reservation executable validators/types at original assignment-contract boundary, exported through original public agent-capacity entrypoint, wired to existing equivalence verifier. No new model/storage/service/policy or API-row reconstruction. Exact required fields, four states each, integer bounds, strict IDs/timestamps/unknown-field denial; optional releasedAt/closedAt remain structurally optional per exact declaration, no invented TTL/terminal-clock policy. Four focused regressions genuinely RED before repair; all now PASS.
• API 70d6a3b: owning graph-watch cursor decoder rejects malformed/nonstring/negative/fractional/unsafe revisions before SQL; omitted starts0, legitimate decimal cursor/whole hundred-tail pagination preserved. Existing storage decoder file reused; no support runner/config. New UNIT + strengthened original SQL denial case RED before repair then PASS. Initial service504line layoutFAIL retained; decoder moved into ORIGINAL execution-graph-storage.ts, same behavior, final layout PASS, no checker weakening.

Fresh staging fetches unchanged: API1817b0f0b817c6d6a211ecd11284c4bdda54ad2f, SDK94094c39813618125266c1328c60e6c5ddaf569b. PrimaryAgent319/dirty Platform docs untouched, diagnostic node_modules never staged, no install/public release/dependency-closure waiver.

Exact new maps, existing scene harness only

SDK original golden.verifiers.yaml / component-boundaries.scene.yaml, local-component-tests NOT managed E2E:

1. tests/unit/content/architecture/canonical-schema-equivalence.test.ts — "CI binds complete canonical execution verification to one exact Platform checkout before the original suites and coded scenes" — sdk.golden.execution-canonical-ci-unit.
2. tests/unit/content/architecture/platform-schema-custody.test.ts — "the declared CI Platform commit independently resolves the exact held canonical execution bytes without a moving ref or generated replacement" — sdk.golden.execution-canonical-ci-native.
3. tests/unit/agent-capacity/capacity/architecture-record-custody.test.ts — "validates exact canonical lease states identifiers clocks and numeric boundaries without rewriting supplied records" — sdk.golden.execution-lease-record-unit.
4. same file — "validates exact canonical reservation states identifiers clocks and numeric boundaries without rewriting supplied records" — sdk.golden.execution-reservation-record-unit.
5. tests/contract/agent-capacity/agent-execution-contract.test.ts — "native public SDK lease validation retains complete records and denies every missing field malformed value and unknown authority" — sdk.golden.execution-lease-record-native.
6. same file — "native public SDK reservation validation retains complete records and denies every missing field malformed value and unknown authority" — sdk.golden.execution-reservation-record-native.
   Scene step IDs omit sdk.golden prefix. Existing closeout-native.ts reused for independent Node+tsx PUBLIC owning validator inventory; no new runner; original workday/estimate branches and older cases retained. Controlled record INPUTS are not admitted native rows, authentication, generated usage, exactly-once settlement or physical managed teardown.

API original golden registry/component scene:
tests/unit/control-plane/capacity/execution/graph/architecture/living/graph-watch.test.ts — "requires exact nonnegative safe integer watch cursor strings before reading history without normalizing malformed input" — api.golden.execution-graph-watch-cursor-unit / execution-graph-watch-cursor-unit.
Existing api.golden.architecture-graph-watch-2 same original real SQL case strengthened with empty/space/exponent/hex/unsafe cursor negatives, exact input/snapshot retention, valid original retry. Existing all101 revisions/team isolation and older four invalid selectors retained. UNIT store collaborator not integration; real owning service/PGlite history is component integration, not complete producer/managed watch proof. Bindings authored, no scene launched.

Retained exact commands / local outcomes

Pinned PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH; reportroot /tmp/capacity-agent-focused-20261004-OB6xb5; matching *.log retains stdout/stderr. JSON report flags --reporter=json --outputFile=. These are LOCAL diagnostics, NOT Actions artifacts or passing acceptance prerequisites.
API: node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts

• api242 complete bootstrap-authority file7/7PASS, SHA308c5f38dbe03fb9f1c28c5ac24cb6306c35006535132672b5bf277dadcafc5e.
• api243 COMPLETE original configured inventory on6635079:366files1810tests1658PASS141FAIL11pending/skipped, dcff866b2da6994b697e9cd866961361dbe1a1f1536f7048b8382e2f6ef9ef3d.75 failed assertions specifically missing disposable PostgreSQL/TreeDX bindings;66 others require classification/repair (many now-corrupt older supplied fixtures plus genuine owning denials/terminal/clock/concurrency failures). Existing11skips remain unwaived. This is NOT complete passing prerequisite coverage; no live campaign.
• api248 complete graph-watch file3/1PASS2genuineRED, e16e3e058c867aca8cb587e9d832e10cbc5ca85984b37b725817759311ff26ed.
• api249 whole graph-watch/living contract/living integration20/20PASS, b2dfdd80cc044a379b7ed318222bfe5002563bea6a772d1956869d9c3d26317c; layoutFAIL0bf7d663f796a1fd04be89f3fad7930443116e9077f4222c66ab4d570e4404ae.
• api250 SAMEthreecompletefiles20/20PASS0pending after decoder relocation, 1ca79bc4f0c16abd6cf6cc5417abf350bc0914d97fdb3a2fdd1d3fcc83d61384. Original npm run check:file-lengths including architecture + git diff --check PASS; layout14a7c5fb22fba363113e34931a1200a2a365da45054a47967b2dc521cad788bf.
  SDK: node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts; canonical cases additionally TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform, exact clean tracked schema at42a67d9 held.
• sdk240 complete canonical equivalence+native custody15/6PASS9FAIL before CI binding; newtwoCIbindingRED; 1da075920effc5b5f2815c6e5c6ea6f0ec59985d49a96fc4cd0898d67dd190a5.
• sdk241 SAMEtwofiles15/8PASS7FAIL after binding, e4ae600867a0a1ae6a4f1be5ce181944c8463a3e22b5786624482b4fcd16b828. npm run typecheck SCRIPT ABSENT invocation retained, actual original node node_modules/typescript/bin/tsc --noEmit --pretty false53diagnosticsFAIL d6b15ff33b742e34f211c7f6f64510dbe5b6a2736d339bb0819da7b007472468.
• sdk244 proposal-execution-plan/control-plane-client/workday-allocation31/31PASS,1556c90ab93b2abe41e2e4bf40d3454e2a24591562e02f23de29ba1971a37495; broadstrict41DIAGFAIL bffa325b131ee765648c082fb08513924af805b81dc99737514ede3490cca89b.
• sdk246 complete architecture-record-custody + agent-execution-contract14/10PASS4genuine missing-public-validatorRED, d8524b1ac770f465fa498398200deaac1cdd28cd51b545a820854b8d12035b1b.
• sdk247 SAMEtwofiles+workday-closeout+canonical-schema-equivalence+platform-schema-custody38/32PASS6FAIL0pending, c4ef1c4d15fc6a19bc072effa0eb9d1db1cb2f7b83eabb99c13eda71d5f03c26. All23record/native/oldcloseout cases PASS; remaining6wholecanonical cases genuinelyFAIL/unwaived. Lease/Reservation deletion detection now works; other missing canonical models/fields/constraints/root/shared omissions still unresolved. Build:dist PASS b60549fc08a3fdfa498d358287a1aa767472a0c6e1e97f2b16131032d09c141c. Broad strict41diagnosticsFAIL unchanged bffa325..., no introduced diagnostics in this batch. Original layoutPASS32e905f9c320e19d49ce9551bff67ab3b9beb31f25b607a42d065cf72e98f231; diffPASS.
• Read sdk247 report before completion returned missing file; invocation error ONLY, later actual complete report independently read; not product RED/PASS. Guessed absent source/test paths and truncated broad inventory output remain READ failures, recovered narrow sections, not full audits.

Actions — actual latest inspected outcomes, no rerun

API2794 run37271359447/job111638856560 COMPLETEDFAIL:366files305PASS61FAIL;1809tests1573PASS236FAIL. Signed enrollment now reaches actual native UUID-oracle failures (corrected6635079, not locally nativePASS). Released SDK missing exports and native TreeDX environment still block; scenes/pack skipped.
SDK54c9008 run37262406523/job111612199532 FAILED:444tests433PASS11missing-authorityFAIL. Corrected CI321c8972 run37273094429/job111644109197 exact Platform checkout SUCCESS,446tests439PASS7genuinecanonicalFAIL, scenes/pack skipped. SDK public archive/release not delivered.
Agent19a2 run37271357696/job111638851003 FAILED at build: released SDK capabilityOfferDigest/capabilityOfferSchema/validateCapacityProviderManifestV5 missing. Local private candidate build PASS is not public dependency closure. Agent actual descendant ESRCH stillFAIL. Host PID1 independently observed systemd, no claimed cause/reaper workaround, no zombie-as-absence/timeout extension.
Private candidate10 still diagnostic only. SDK golden NEVER passed; no acceptance launch until FRESH complete all-owner exact-candidate UNIT+REAL integration zero fail/skip/todo/missing/filtered/inconclusive. Keep repairing capacity-provider/Agent owning failures now, not UI or checkpoint-only stops.

Provider/Agent batch 230–239 — human priority resolution implemented and pushed; acceptance still blocked

Human decision: “Update node priority; keep issued assignment frozen.” This supersedes the unresolved/frozen-node-priority conflict below. Canonical node priority (including explicit omission) updates for future selection; the issued Attempt/source/grants/limits/node revision, reservation, counters and financial records stay unchanged. No pending-priority authority or compatibility path added.

Second batches committed/pushed with independent exact remote readback: API 2794f53 (parent b941891), Agent 19a2c03b71292a093127951c6b9340e40c6cb86e (parent735a04394d6b91c9355192b19a274da311409701). Third API batch b102a09 (parent2794f5395f033d65441f204022969499832d72b3), five original product/test/verifier/scene files, pushed and independent ls-remote exact. Fresh origin/staging fetch before commit remained1817b0f0b817c6d6a211ecd11284c4bdda54ad2f. Primary Agent319 and dirty Platform docs untouched; no activation/campaign/release.

Exact regression / real integration / scene mapping

Existing UNIT tests/unit/control-plane/capacity/execution/graph/architecture/living/living-graph-contract.test.ts — “binds changed canonical priority to the same semantic node revision while preserving running authority blocked dependencies and exact replay”, api.golden.execution-node-priority-unit-1: ONLY old priority freeze expectation changed according to the explicit human decision; preserved all source/grant/limit/revision/invalid input negatives and added exact convergence and omission-clear assertions.
NEW real owning SQL graph/service/admission/repository integration in ORIGINAL tests/unit/control-plane/capacity/execution/architecture/initial/initial-admission.test.ts — “native graph reprioritization changes future scheduling only while issued canonical attempt reservation and exact admission replay remain frozen”, api.golden.execution-issued-priority-native / step execution-issued-priority-native. Original golden.verifiers.yaml / component-boundaries.scene.yaml binding; local-component-tests, NOT managed E2E. Original PGlite/full original table fixtures, existing0041+0044 migration bytes and real graph writer/public graph-service reads/admission transaction/repository; original canonical issued Attempt, reservation/counters/proxy preserved through changed graph and concurrent exact replay. Supplied source/profile/clock inputs are not native governance/provider usage. Original allocated DB cleanup only, not physical managed teardown.
Existing actual execution-schema.ts acceptance retains exact frozen admission selector inputs, exact original Proposal commit/raw digest/priority, full actual canonical Attempt and original allocator replay; it does NOT substitute today's changed graph. Existing api.golden.execution-clean-schema-live-1 remains AUTHORED/UNEXECUTED. Component binding and passing totals are not proof of a managed reprioritization scenario or full acceptance.

Exact local commands and retained outcomes

Pinned PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH. API node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts with complete files below; JSON output /tmp/capacity-agent-focused-20261004-OB6xb5/.json, stdout/stderr corresponding.log.
232: complete living-graph-contract.test.ts after human oracle resolution BEFORE product fix, 9/8PASS1genuine priority RED, api232-priority-red.json SHA25623a24bc8a6a46e2e2d07c7b9fb01d9b8f65ff81623404c3e812ce38eca4a5919.
233: complete living contract/integration + relation authority/native, 28/28PASS0pending, api233-priority.json SHA256f7c775cc9b89da950d8bfa1494e7ac8e9d4eb79170aa509c52a844fe17cccf55.
234: complete initial-admission.test.ts 10/9PASS1 introduced test-input failure: initial fixture's minimal seed node omitted estimate/requiredCapabilities/requestedPermissions/workspace required by original SDK decoder. NOT product RED; api234-issued.json SHA25600333d391a70d939d9e4eecda5d325de20907e018badd1d70153c61f37dab3ef.
235: ONLY same newly supplied node input enriched from f.attempt's exact existing canonical fields; original decoder unchanged/all nine old cases retained; complete file10/10PASS, api235-issued.json SHA256b8d6a36beddb5459f2e8b514dcd3a77842a955ab4c8d8fc820e400f19a524186.
236: focused command used two guessed absent workday-profile paths; these files were not covered. NOT nine-file proof/prerequisite; corrected actual original paths in237 without skips or config change.
237: NINE complete original files58/58PASS0pending: living/living-graph-contract.test.ts + living-graph-integration.test.ts; initial/initial-admission.test.ts; graph/architecture/workday-profile-projection.test.ts + workday-profile-persistence.test.ts; graph/architecture/relations/relation-authority.test.ts + relation-native.test.ts; realtime/architecture/session-subscription-authority.test.ts; graph/living-execution-graph-migration.test.ts. All paths beneath tests/unit/control-plane/capacity/execution except realtime beneath tests/unit/control-plane. api237-priority.json SHA25641b0d95ac0b97c3deb2be65619f068ddc771b2550d6e1e98a33d6f7694c28d54. Original npm run check:file-lengths (including architecture) and git diff --check PASS; api237-layout.log SHA25614a7c5fb22fba363113e34931a1200a2a365da45054a47967b2dc521cad788bf.
These are focused local diagnostics, NOT complete-owner acceptance prerequisites or Actions artifacts.

Agent228 COMPLETE original modern suite with supported --maxWorkers=2 (no in-test concurrency/deadline/allowance change) 806/805PASS1FAIL0pending; report SHA25615e89ec5ef07dd50493880b1f42b1b39bc28cdde40f9c32ed02e63dcadf4a189. Native descendant PID ESRCH/durable absence remains FAIL (latest safety cleanup “Cannot clean up an unproven descendant identity”); no zombie-as-absence, new runner/reaper/PID1 modification or physical closure claim. Original unbounded224 watchdog failures preserved; complete build/arbitration22716/16PASS is diagnostic only.
API229 broad explicit --strict TypeScript check FAILED1577diagnostics, SHA2563cb3f2f5b0ffdd6c35898e781fb87c5dbf0f94e8514f19557cd83144b64aa9e3. Earlier549diagnostics was original config (strict:false), NOT a strict pass. No strict config disable. Agent221 local build/typecheck PASS with private selected SDK, not public dependency closure.

Actions inspected; no unchanged rerun

Agent19a2 Verify run37271357696/job111638851003 FAIL declaration build: released SDK lacks capabilityOfferDigest/capabilityOfferSchema/validateCapacityProviderManifestV5 plus derived implicit-any diagnostics; install/exact-SDK steps pass, scenes/pack skipped. Private SDK local passes are not a waiver.
API2794 Verify run37271359447/job111638856560 still in verify:direct at latest independent read; disposable PostgreSQL17 owning CI, NOT installed database access. APIb102 is a fresh commit, not rerun of unchanged2794.
SDK54c9008 Verify run37262406523/job111612199532 FAILED71files/444tests:433PASS11FAIL; actual logs establish all11 fail at missing TREESEED_DEVELOPMENT_WORKSPACE_ROOT, not yet underlying schema execution in CI. Scenes/pack/seal skipped. Local canonical equivalence remains separately genuinely unresolved and is being diagnosed with held Platform authority; CI binding must use exact existing Git authority, never generated/copied passing oracle.
Relay CA readable; human supplied installed PostgreSQL metadata hostdatabase/dbtreeseed_api only. NO disposable local PG/TreeDX authority established; never run destructive conformance against that installed credential. Native environment gaps remain unproven.

Full capacity/provider/Agent objective OPEN. No UI, new scheduling/chat, model probe, live acceptance, allowance extension, fabricated usage/receipts/citations/settlement or passing replay. NEXT actual complete-suite owning defects, canonical SDK/public dependency delivery and native physical closure. SDK golden NEVER passed. ENTIRE preceding152975-character Issue body preserved unchanged below.

Provider/Agent implementation batch 201–229 — active work; acceptance remains blocked

This supersedes the older “not yet pushed” statement without removing any history. First batches were committed and pushed: API b941891 (parent bd2370d), Agent 735a04394d6b91c9355192b19a274da311409701 (parent 539d0d0244b623cd86ed5e0f15502edd0dcd990c); independent remote branch readbacks matched. API PR492 and Agent PR320 remain Draft; no merge/release/activation/model/campaign. Current second-batch source/test/binding changes are uncommitted and NOT those pushed candidates. UI remains out of scope. Scheduled heartbeat was removed; work continues directly.

Actual Actions failures inspected, not rerun unchanged

API run 37267868572 / Verify job111628389295 on b941: 365 files, 66 failed/299 passed; 1805 tests,279 failed/1526 passed. Disposable PostgreSQL is now inherited from the existing job environment; seventeen operator/bootstrap tests stop at invalid HTTP protected-resource metadata (HTTPS is required) before their intended assertions. Other failures include public released SDK lacking canonical priority/offers/UsageSettlement parser contracts, graph/lifecycle/receipt tests. Agent run37267870848/job111628396147 on735: original build now precedes strict test typing, which fails against the public released SDK missing capabilityOfferDigest/capabilityOfferSchema/validateCapacityProviderManifestV5 and resulting types. Later scenes, packaging and artifact-upload steps were skipped. These are failed exact pushed candidates, NOT CI passes or release evidence. Current local private SDK archive10 is not published/installed dependency closure and cannot waive either failure. SDK golden has NEVER passed.

Current original-owner repairs and exact maps

API session-event service: per-logical-registration callback ownership (including identical callback values), shared failing LISTEN acquisition rejects original cause, failed/native-reset client destroyed/released once, healthy final UNLISTEN precedes release, stale releases cannot delete newer subscribers, one immediate original reconnect and durable missed-event catchup without new timer/deadline. Retains existing native SQL event/publisher path, all older cases and no alternate bus.

• UNIT: tests/unit/control-plane/realtime/architecture/session-subscription-authority.test.ts — “identical callback registrations retain independent release ownership without deleting their shared team or reviving a released registration” — api.golden.execution-session-registration-unit / execution-session-registration-unit.
• Native independent PostgreSQL pools/listener/publication: tests/unit/control-plane/realtime/architecture/session-registration-postgres.test.ts — “one native listener preserves identical callback registrations independently through stale release retry and final durable channel cleanup” — api.golden.execution-session-registration-native / execution-session-registration-native.
  Original missed-publication case now uses native FIFO advisory transaction lock to hold the replacement LISTEN; this corrects an unsupported idle-pool scheduling assumption while retaining durable missed event, no callback, retry and release assertions. Original schema/environment/watchdogs retained. Native PG cases fail absent local binding; no native passing or physical provider closure claim.

API workday/living graph: reporting class is uniquely selected by governed reporting activity, not literal reporter name; lifecycle dependencies derive ONLY declared activity events and unknown events deny; unrelated planning/reporting dependencies do not leak. Completed/failed/cancelled reviewer state survives projection-only revision, but failed/cancelled paired Actor revokes stale approval; exhausted correction does not rewrite digest. Source team must match input; exact dependency endpoints must be TreeDX Proposal refs. Original SQL/public graph ordering is made identical to producer ordering. Exact Note digest uses untrimmed bytes and returned path must equal request.
Existing UNIT/native maps retained (reporting rename/selection/event-scope/denial, living graph state/provenance/readiness/retry, relation intake); no fabricated accepted governance/charges or UI work.

Canonical priority storage defect was first reproduced in two new focused cases in ORIGINAL files:

• UNIT tests/unit/control-plane/capacity/execution/graph/architecture/living/living-graph-contract.test.ts — “decodes exact persisted safe integer priority without coercing malformed storage or inventing omitted authority” — api.golden.execution-priority-storage-unit / execution-priority-storage-unit.
• Real owning PGlite writer/public read/invalid native writes/retained snapshots tests/unit/control-plane/capacity/execution/graph/architecture/living/living-graph-integration.test.ts — “native owning SQL preserves optional safe integer priorities and exact dependency provenance while invalid writes retain the complete graph” — api.golden.execution-priority-storage-native / execution-priority-storage-native.
  Necessary NEW migration0044_execution_priority_dependency_provenance.sql adds ONE nullable bigint priority column to existing node projection (safe integer CHECK; NULL means omitted, ranking zero), and permits existing treedx-link edge provenance. Original applied0023/0028 migrations unchanged. Original writer now stores/clears priority, decoder accepts native integer/decimal bigint transport ONLY and rejects malformed/unsafe/coerced values. Minimal original fixtures consume actual new migration, not copied schema. Native separate-server priority query uses to_jsonb(priority) for canonical numeric transport; old number-vs-driver-bigint string expectation was unsupported and never reached locally. No new policy/model/storage table/runner. Existing unit running-priority graphRevisionUpdated expectation still FAILS and is NOT weakened; avoiding repeated revision churn remains open. Component scene scope local-component-tests, not managed portfolio E2E.

Agent original broker/client/Kernel/runner: actual readable required relay CA is retained. Broker test fixture now allocates its own original supported mode0600 encrypted-custody key instead of reading unavailable host key; restores prior env and removes ONLY allocated directory. Controlled broker response is INPUT, not real Kata. Corrected original fixture to parse public prepare body.assignment (confirmed owning Deployment route), not whole envelope.
Actual product defects: short/long artifact responses retain sandbox_artifact_integrity_invalid; unverified teardown preserves original destroy denial/error cause; ordinary executor events omit absent optional protectedPayload rather than sending own undefined (SDK denies it).

• New UNIT tests/modern/provider/provider-runner.test.ts — “omits absent protected evidence from ordinary executor events while retaining exact SDK-valid public bytes and terminal history” — agent.golden.execution-public-event-unit-1 / execution-public-event-unit-1.
  Original native case in tests/modern/execution/sandbox-broker-preparation.test.ts continues owning Unix HTTP/SDK validation/signing/materialization/Kernel/runner/usage/retained closeout/destroy-boundary assertions for completed/failed/expired/diagnostic-denied/settlement-denied; all old artifact/destroy/input/resource negatives retained. Existing golden verifier/component scene bindings strengthened, not a new runner or fake physical closure.

Introduced oracle errors remain separate: Agent218 UNIT used descriptor.schema.input instead of actual schema.body; corrected only real catalog access. Native failed receipt expected absent idempotency key, but existing SDK ProviderProtocolClient generates UUIDv4 for required mutations; corrected assertion to actual UUIDv4 contract while retaining exact entire failed body, one failure, history and zero false settlement. API226 Note read expected paths[] although actual single-file original client uses path; corrected to exact whole public body rather than changing product to an unsupported invocation. These observations are NOT product REDs.

Local diagnostic evidence — overlapping totals, never summed

All reports/logs remain /tmp/capacity-agent-focused-20261004-OB6xb5, NOT Actions artifacts or acceptance prerequisites. Pinned Node24.12 PATH used. API commands use ORIGINAL vitest.control-plane.config.ts; Agent ORIGINAL vitest.config.ts. All complete selected files include old cases, zero filtering/skip/todo in reported observations.
201 api-subscription201.json 8/0pass8fail genuine listener RED SHA3ad95b339943243edfbe73492dd3eaafb5a3b3048301944477b91fc21c8247e4.
202 api-subscription202.json18/7pass11fail (10 missingPG, one async-release observation oracle);203 api-subscription203.json36/36pass SHA2932f99cac56a07a52f57a9e7393fc1aff222c24c037e4c888b4653b1fbd4994.
204 api-subscription204.json49/38pass11missingPGfail SHA05e0fc552f614dd682a68c540e377d23a858d0db4e1d30b112559e26a8a5f087; strict original549diagnostics retained, no introduced diagnostic; layout/diff pass.
205 COMPLETE Agent original modern suite805/795pass10fail SHA bfffb39deb88960492f8c7a32d0431f0aeca5f08adce24852a4fbe3026092e0a:5 unreadableCA,1 descendant physicalabsence,4 missing canonical-env invocation errors.208 complete record file with correct existing TREESEED_DEVELOPMENT_WORKSPACE_ROOT22/22pass SHA87eef87d42f834d97bb27a9b0a8c58d1d2ff83972f1c4a3a16b5159a4bdae8d3, not corrected whole prerequisite.
206 api-profiles206.json13/7pass6genuinefail SHAe14c1293a53447f7054449a278e1e3f52352c3a44442aba172d95ebec8f6927f;20729/25pass4remaininggraphfail SHA f8a20d404814b48379a15788adecedcdbbc3a5dadc2ce05cb1ee220efdd7af54.
209 api-graph209.json73/68pass5fail SHA0a1e6a0eabc07d629aeab47574981eaf37e626944fae0f095e8c1b3fd6f0e789 (missingPG, frozen priority, SQL order2, endpointmodel).
210 broker11/6pass5missingkeyfail SHAed589357a71e846c295ba75df50a66e7b220cc3e9ca170d2d65adbec726cb380;21211/6pass5invalidfixturewire fail SHA32229b94e918ef0754c11141a4d0424826b4b46becc0d679a1412f09a2e34bc5; neither environment/oracle failure is productRED.
213 api-graph213.json18/14pass4fail SHA8f7c3a702cd48cfba8fcd3d278d390e735a6c6e5c0774263289edf5cd1b80bd9 (hash3 + native provenanceCHECK1).
214 broker11/8pass3fail SHAc32b9b4282bd1b9047b83fbf725a738260f3c206f078d8b9ba204cf8fd0a107e;21511/10pass1fail SHA f96c91593710f236faa264f29663b620d8f3dd90aa3264f4b0fb62e0fa251684;21611/10pass1fail SHA b6cb4c18a6e04bed0e58fea0b642882c364e4f24050c8cb9f8393144e5c96aa6 traces actual protected optional SDK rejection.
217 focusedUNIT22/21pass1genuinefail SHA f6f3f147fc1247ac9ff9083c7be78c871f0688f78e7d23f1a1a3fd47eba3d8f6;21833/31pass2oraclefail SHA006d64417f1c8d569c1a7bfd9374bb33189b2f42672e29d819495e7cdc7aeba9;219 original native default log retained exact UUID mismatch.
220: node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts tests/modern/execution/sandbox-broker-preparation.test.ts tests/modern/provider/provider-runner.test.ts tests/modern/guarantees/bindings.test.ts --reporter=json --outputFile=<agent220.json>;35/35pass0pending SHA5e1714c6a64e1a12eca145e54270302aea27187b8e33ce440a33e9dd4903de7a.
221 Agent npm run build:dist then npm run typecheck BOTHexit0; log SHAs df11e3c3b9c2687f667474606273cf2bdbb53ccc6198d406ad9940bf0ed2c953 /2742ac3a56066351c2b9e86d5dcce0b6fc55a5c252d22d3f8f4eae87667c49f0.
222 api222-red.json17/14pass3fail SHAade1439b69bf4cd44dbf2161e5d5410da9770f81e774509f52f82945678ec241 (prioritydecoder UNIT, provenance realSQL, retained running-priority FAIL), before storage repair.
223 six complete original graph/profile/relation files35/33pass2fail SHA8063c2358b41415ebf73b5c3fd70e938d76ec2b309b4a19eaa0d48fdf9684fa6; new UNIT/native storage cases PASS, frozen priority and Note path-array oracle remain.226 default native relation7/6pass1samepathoracle.
224 COMPLETE original modern suite npm run test:modern with correct canonical env806/802pass4fail0pending SHAa9e0c613212da06bbc95eea3dc73f139c2cf72b4be9b9c2c4b8de53e88b54dfe: original project-build30sec watchdog, two offer5sec watchdogs, descendantabsence genuinefailure. No timeout/allowance/config extension. Targeted whole build+arbitration files22716/16pass; originalfailed whole receipt remains failed.
225 Agent original length/architecture/diff PASS; API lengthFAIL501line graph service corrected by grouping one existing declaration only, no changed assertion/product semantics; recheck pending.
228 COMPLETE original modern suite with supported --maxWorkers=2 running to bound test-worker resource contention, NOT weakened in-test concurrency/deadlines or reused prerequisite.229 API strict tsc --noEmit --strict --pretty false running; no strict-pass claim.

Environment facts and remaining delivery

Human made /etc/treeseed/sandbox/relay-ca.crt readable; independently verified. Metadata-only human read shows installed database scheme postgresql, host database,port5432,path/treeseed_api, and component keys TREESEED_ENVIRONMENT/API_BASE_URL/AUTH_APPROVAL_BASE_URL. No disposable TEST/CONFORMANCE binding found. These are installed service configuration, not test authority: NEVER use installed DB credential for destructive fixtures. No credential value exposed. Missing disposable local PostgreSQL and native TreeDX env still block those layers; existing CI PostgreSQL can provide fresh native tests on next pushed batch.
Read errors/guessed absent files and truncated combined output retained as READ/invocation problems only, not whole source audit or productRED. No migration applied to installed service, no host infrastructure or dependency/config/CI repair this batch. Physical descendant ESRCH still fails; no zombie-as-absence/reaper/extra runtime shortcut. Production-shaped real provider/TreeDX/Kata/model/clock/ALL-attempt externalusage/whole canonical semantics/SDK golden and scenes remain OPEN. No totals or component bindings count as complete coverage. Work continues on exact owning failures; no checkpoint-driven stop.

Provider/execution repair batch 191–199 — verified locally, delivery still open

Scope remains capacity-provider + Agent execution only; no UI edits or SDK golden launch. Latest human timing decision is retained: infrastructure/queue time stays separately bounded and assignment authority retains the original phase deadline. Original bootstrap proof expiry remains strict.

API candidate before commit: bd2370d plus 27 scoped dirty files. Agent candidate before commit: 539d0d0244b623cd86ed5e0f15502edd0dcd990c plus five scoped dirty files. No new commit or push at this checkpoint. SDK54c9008bf178e597bfde959812633f0dc1d0b4fe unchanged; local private SDK10 is not released dependency closure or a CI waiver.

Implementation aligns existing tests with same-key credential/token/audit recovery, original rotation-clock audit custody, durable lease/availability clocks, current token fences in poll/synthesis/final claim, immutable longpoll input and exact listener cleanup, complete admission explanation, transitive predecessor lineage, and unknown executed usage retained as operator action rather than a fabricated zero settlement or safe retry. Existing measurements settle BEFORE completion; no new usage, receipt, authority, clock tolerance, policy, or allowance is invented.

Additional original mappings:

• UNIT tests/unit/control-plane/capacity/execution/living-execution-lease-authority.test.ts — "rejects expired malformed and coerced reservation workspace and availability clocks against the unchanged original current time" — api.golden.execution-lease-clocks-unit / execution-lease-clocks-unit.
• REAL owning PGlite recovery tests/unit/control-plane/providers/assignments/architecture/recovery-persistence.test.ts — "late recovery retains unknown executed usage and the original attempt without a fabricated zero settlement or a reopened ready node" — api.golden.execution-recovery-unknown-usage-native / execution-recovery-unknown-usage-native. Original transaction, immutable Attempt/ordinal, one original recovery audit, unchanged reservation/counters/usage/ledger, no reopened ready node, immutable replay. Not external provider billing or physical closure.
• UNIT tests/unit/control-plane/release/provider-prerequisites.test.ts — existing CI PostgreSQL service binding inherited by complete verification — api.golden.execution-postgres-prerequisite-unit / execution-postgres-prerequisite-unit. Existing service URL moved to job.env from duplicate per-step env; no new service/workflow/environment or local server start. Metadata unit, NOT native PG proof.
• Agent UNIT tests/modern/kernel/project-handler-build.test.ts — "public verification builds the exact provider declarations before strict complete test typing and retains one build before native tests" — agent.golden.execution-provider-build-typecheck-unit / execution-provider-build-typecheck-unit.
• SAME Agent REAL isolated build case strengthened, agent.golden.execution-compiled-project-native-1: copied complete original src/scripts/tests/config, original build, strict whole copied TypeScript source+tests, compiled selected handler and Kernel, missing/duplicate/wrong-build denial, byte custody, original 30-second watchdog. Existing release script now build:dist -> typecheck -> test:modern, one build, strict check retained. All bindings use original golden registry/component-boundaries local-component-tests; no managed scene PASS.

Local focused evidence directory /tmp/capacity-agent-focused-20261004-OB6xb5; Node24.12 pinned PATH. JSON/logs are local focused evidence, NOT uploaded Actions artifacts, full owner prerequisites or acceptance authorization. Counts overlap, never sum:

Correction to intermediate rough commentary: API191 has EXACTLY17 missing-PG failures plus TWO strict-HTTPS UNIT fixture errors and TWO real lease-product failures, not18+3. Controlled issuer fixture now uses required HTTPS; this fixture correction is not a product fix. API192 retained genuine invalid-now, transitive-lineage and unknown-usage REDs before implementation.

API195 exact command in API cwd:
PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --maxWorkers=1 tests/unit/control-plane/capacity/execution/architecture/initial tests/unit/control-plane/capacity/execution/living-execution-admission.test.ts tests/unit/control-plane/capacity/execution/living-execution-lease-authority.test.ts tests/unit/control-plane/capacity/execution/ready-execution-node.test.ts tests/unit/control-plane/capacity/execution/assignment-recovery-service.test.ts tests/unit/control-plane/providers/assignments/architecture/recovery-authority.test.ts tests/unit/control-plane/providers/assignments/architecture/recovery-persistence.test.ts tests/unit/control-plane/capacity/execution/assignment-attempt-builder.test.ts tests/unit/control-plane/mcp/session-event-bus.test.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api-provider-execution195.json > /tmp/capacity-agent-focused-20261004-OB6xb5/api-provider-execution195.log 2>&1
Log SHA f88e2b3be76e230e8f4b5c68d50024542909967c003863f59b5fcf5a7cc9bd08.
Other API focused runs use same original config/one worker/full named files; Agent uses original vitest.config.ts/full named files. No name-filtered suite, original deadlines/watchdogs unchanged.

Independent tracked-source custody before/after ENTIRE API195 exactly equal: HEADbd2370...,1386 tracked files, SHA d18c725d24b2b6ec49a93037372652b0e1ee77bd51f4c1732189b53c55bf468c; includes original index/mode/pin/path/length/untrimmed bytes. Explicit original gitlink .fixtures/treeseed-fixtures=940d1de721656bf84e63b60e7fbea6c86034e08b not nested-file closure. Dirty authored bytes are NOT in HEAD; no untracked/dependency or whole installed closure. Only declarative CI unit/bindings changed after195.

API strict195 still exits2/549 diagnostics, log SHA917b83d990f587403f7d3765715682d3a8c9bbecc0e5516883da3e7ec698f6dc. No new repaired wait arithmetic or new lease/recovery/poll test diagnostics; old errors unwaived. Strict200 after CI unit currently running; no result claim. Agent strict197 PASS empty log, original layout197 PASS SHA ed73d142605e4fb1a90eb7675a056c29b2dedead59bf0f0067b0adabfdd28923. API layout199 PASS SHA dd50c4448e119b3c0304f2074bb1eac87eaa7e58e55c6d0c21a78d119c0e8e24. Diff checks PASS. Layout/meta/type outputs do NOT prove native acceptance.

Latest user says access should exist. Actual process uid1000 groups lack treeseed-manager; /etc/treeseed/sandbox is750root:treeseed-manager, actual relay-ca read remains EACCES. Disposable PG/TreeDX variables absent. Accessible CLI localhost CA is NOT relay CA; no substitute/bypass/sudo/production credential use/replacement server. Original native missing bindings fail rather than skip. Existing PG17 CI service will now be inherited by complete verify, but native Actions execution remains pending new commit.

OPEN: full API strict/owner prerequisites, whole canonical SDK semantic equality, model clocks/reserve/authorized continuation, generated all-attempt charges, native TreeDX/PG producer/dispatch, relay CA and descendant PID1 closure, installed published dependency closure, complete managed SDK golden. No model/campaign/scene, activation, release or merge. Next publish this scoped batch, inspect exact new Actions, and continue subscription/Agent execution repairs; do not end after saving checkpoint.

Provider longpoll and admission explanation repair — continuing, SDK golden still blocked

The human timing decision remains authoritative: infrastructure/queue time is separate and the original phase deadline is retained. No UI work, schedule, new task, activation, model call, scene or campaign. API branch codex/architecture-guideline-tests remains HEAD bd2370d; changes below are currently UNCOMMITTED, not yet a remote candidate.

Owning product repairs and exact test boundaries

Original createProviderAssignmentService.next now rejects explicit nonnumber/nonfinite/negative/>30 waitSeconds before reconciliation or lease, while retaining omitted/zero and legitimate fractional waits. It snapshots the original caller input before awaiting anything, uses those bytes for every subsequent lease/wake filter, returns the original empty envelope for pre-aborted authority, fences post-reconciliation/post-subscription/post-wake work on abort, and clears its owned wait timer/abort listener. A late subscription acquired before abort is released exactly once; post-release callbacks cannot revive polling.

Original access-token authentication now denies unreadable/malformed durable expiry rather than admitting NaN comparison. Original resolveProviderSynthesisContext rechecks the actual authenticated accessTokenId's active/unexpired membership-scoped row before synthesis; membership/provider/session gates remain their original owning SQL. Final lease CAS already fences current membership/provider/token authority from the preceding credential repair. No alternate authenticator, private route, body token field, scheduler, schema, storage, runner or policy.

The same original native polling fixture now composes actual createCapacityControlPlane with ControlPlaneStore and delegated native PGlite transactions, not a fake synthesis/lease method. It supplies exactly its represented single project and two explicit project/Team-Library metadata bindings instead of accidentally requesting the default eight unavailable projects. Those rows/refs are controlled INPUTS, not native published Team Library content or managed portfolio proof. Original Attempt, phase/window, reservations, predecessor bytes, finance and three-second authority remain unchanged. Required instance_id/library_id omissions in the first draft produced a real fixture setup 23502; that diagnostic is preserved, NOT product RED. Guessed absent repository/query paths and premature report reads were READ/invocation errors only.

Original admission now uses buildProviderAssignmentExplanation for its complete first explanation (own team/assignment/source/node, eligibility/reasons/gates, original clock, allocation and empty prior history), instead of storing only allocation metadata. The builder's input type narrows to precisely the five existing fields it consumes; no new explanation model/path. Exact replay compares the immutable allocation itself, not equality of the entire explanation metadata bag; recorded history/clock is not a second allocation authority. All original grant/profile/provider/node/Attempt comparisons remain. First implementation caused 18 native setup conflicts because the previous replay postcondition assumed metadata had ONLY allocation; that failed observation is retained before the owning comparison correction.

Exact maps

• NEW UNIT tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-longpoll-authority.test.ts: "current access token custody rejects withdrawn missing and malformed durable token authority before synthesis reads or writes without changing the principal" -> api.golden.execution-poll-token-custody-unit / execution-poll-token-custody-unit. Nine original-row negative inputs, exact one membership-scoped token SQL/read params, zero further inventory/read/write/transaction, original 401/code and immutable inputs.
• SAME strengthened original UNIT tests/unit/control-plane/capacity/execution/living-execution-admission.test.ts: "claims the node, reservation, and immutable attempt in one batch without legacy demand/allocation authority" -> api.golden.execution-admission-explanation-unit / execution-admission-explanation-unit. Exact first explanation fields/clock/history added; every old batch/parameter/negative assertion retained.
• Existing REAL HTTP/native SQL polling cases and mappings remain: architecture-dependency-longpoll-native-1..7, architecture-dependency-longpoll-unit-1..4, execution-pending-subscription-unit-1/native-1, existing public-poll/poll verifier IDs. The natural fractional native case independently retains its complete original admission explanation in actual persisted history; no assertion removed or normalized to a failure.
• Original golden.verifiers.yaml and component-boundaries.scene.yaml bind both new mappings, scope local-component-tests. This is declarative component scene coverage, NOT an executed scene or managed SDK golden acceptance.

Oracle correction: the pending-subscription unit's fresh retry originally required only a new lease count with ZERO reconciliation reads, despite the original successful fresh call performing THREE reconciliation reads. It now independently requires exactly those three new-request reads. The old request's exact zero post-abort/post-release read/write/lease/subscription assertions remain unchanged. This fixes a test-authoring contradiction; it is not a product failure or weakened withdrawal fence. A first added admission assertion used an undefined local now and failed with ReferenceError (report187), corrected to the existing assignment.createdAt BEFORE genuine assertion-only report188. Both histories retained.

Observed commands/results (local focused diagnostics, not owner prerequisites or Actions artifacts)

Exact api-polling190 command in owning API cwd:

PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --maxWorkers=1 tests/unit/control-plane/capacity/execution/living-execution-admission.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-poll-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-poll-native.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-public-poll-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-public-poll-native.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-longpoll-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-longpoll-native.test.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api-polling190.json > /tmp/capacity-agent-focused-20261004-OB6xb5/api-polling190.log 2>&1

Evidence directory /tmp/capacity-agent-focused-20261004-OB6xb5; pinned PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH, original config vitest.control-plane.config.ts, --maxWorkers=1 (no watchdog extension/filtered test-name run).
Six COMPLETE original polling files are initial/polling/dependency-{poll,public-poll,longpoll}-{authority,native}.test.ts; shell execution supplied all six literal paths. Original command: node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --maxWorkers=1 --reporter=json --outputFile=/.json, stdout/stderr retained in corresponding .log.

• api-polling183: 27 /15 passed/12 failed/0 pending, SHA256 b9f98bbece365b0e8ac236e37414b7674d20589c8205d68954fd9dcce9acdb30.
• api-polling184: 27 /23 passed/4 failed/0 pending, SHA256 21d80f19a51afce0ce0680b46014a9263fadd0578901c258d4aa5798aa3ac64c.
• api-polling185: 27 /26 passed/1 failed/0 pending, SHA256 51cacc74ed20b6d2a7bbb2841256e61aa861b8c574a6a3a474826a94d7a77b16.
• api-poll-token186 COMPLETE original UNIT file: 6/6 passed/0 failed/0 pending, SHA256 224b550bb1a0d1b60fb772904e47eed8b8be2f06b7547f3404f7c1128ad6642c.
• api-explanation-red187 COMPLETE original admission UNIT file: introduced undefined-now assertion error, NOT productRED; SHA256 2902459fa3ff1c22788c69e3b4e86ab894b5bf4c7125d9e255ba4c5ef95f98f4.
• api-explanation-red188 SAME complete file: 6/5 passed/1 genuine missing-complete-first-explanation assertion failure, SHA256 11210a8dee1f3be041c1f33bf8eaea4b286fecdcd11d03d3431761f242166ec6.
• api-polling189 seven COMPLETE files (admission plus six polling): 34/16 passed/18 failed/0 pending; introduced replay-metadata postcondition regression, not falsely accepted/PASS. SHA256 3e8882fb007a2ce086f5dc96a7492049272ab5e6952c11577dbb63063020c855.
• api-polling190 SAME complete seven files: 34/34 passed/0 failed/0 pending. Exact token UNIT now included, all older cases retained. Report SHA256 3ee03a4cf57a9755441aeb1ff5f8f815e121aa0387d4361e68572508814b326b; log SHA256 9935ee4ea3b56d5c07e43d85ca945673c4bbe0a9f27540d517d4c681e44e6e13. No passing scene/campaign claim.
• api-strict185: original strict tsc --noEmit --strict FAILED1579 diagnostics, SHA256 c553078356d1cda952cdba108cec207d4c12190c962e22e6682194776e2e300a. Introduced host null project/approval/repository projections and Promise run fixture signature corrected by asserting readable original results/delegating exact original run, not filtering authority/casts/check disable. Those two fixture paths have no remaining diagnostics in this invocation; whole API strict remains FAIL.
• api-layout185: original check:file-lengths + check:file-architecture PASS, log SHA256 dd50c4448e119b3c0304f2074bb1eac87eaa7e58e55c6d0c21a78d119c0e8e24. Current registration service remains499lines, no checker/cap changes.
• Original git diff --check PASS after current edits, not a semantic acceptance result.
• Broader COMPLETE initial provider directory plus original admission unit is currently running as api-provider-initial191, including PostgreSQL cases with original fail-closed missing environment (never skip/start/install/probe). New strict191 also running. Do not claim their results before completion.

Original source synthesis diagnostics independently showed capacity_workday_project_missing then capacity_team_library_missing from incomplete supplied fixture inputs. No failed audit changed into success or deleted; corrected fresh fixtures now consume required represented authorities. A source return annotation on assignNextReadyExecutionNode incorrectly promised Assignment|null while its original body returns {assignment,selection}; infer the existing actual return (no algorithm/schema change).

PGlite/concurrent promises are NOT independent PostgreSQL server connections. Controlled bindings/predecessors/canonical inputs are NOT genuine native Decision governance, actual managed model usage, source-to-selected-build closure, all-attempt native charges, Settlement or physical provider/session/Kata teardown. All broader blockers in prior body remain OPEN. Full strict and complete participating-owner prerequisites remain required before ANY scene/SDK acceptance; SDK golden NEVER passed. Continuing to the remaining provider/execution failures, not stopping at this Issue persistence.

Capacity-provider credential / execution recovery — continuing, not full acceptance

API parent bd2370d; current scoped changes remain UNCOMMITTED while final shared-poll regression and strict checks run. SDK54c9008bf178e597bfde959812633f0dc1d0b4fe and Agent539d0d0244b623cd86ed5e0f15502edd0dcd990c unchanged. UI excluded; no scene/campaign/release/activation.

Direct user phase authority remains: infrastructure/queueing separate from active allocation; retain the original phase deadline. New owning lease regressions independently expose pending assignments bypassing that phase deadline, NOT the rejected admission-plus-active-seconds oracle. No deadline/allowance extension, bootstrap proof refresh, fake clock, tolerance or skip.

New exact UNIT mapping: tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-credential-authority.test.ts — "credential and membership audit retries preserve their original scoped identity clock metadata and failure without independent reads or rewriting another operation" — api.golden.execution-credential-audit-unit / component scene step execution-credential-audit-unit. ORIGINAL golden.verifiers.yaml/component-boundaries.scene.yaml local-component-tests, not managed E2E. Existing exact credential, token, identity, revocation, bootstrap, lease and poll UNIT/native mappings retained. Existing REAL owning public Hono/native PGlite cases remain the concurrent, interrupted-audit, retry, revocation and immutable-attempt integration obligations; not independent PG connections, genuine enrollment, managed model/charges or physical teardown.

API focused report progression in /tmp/capacity-agent-focused-20261004-OB6xb5 (counts overlap, never add):

• credentials177:30/14PASS/16FAIL/0pending; JSON SHA9516b2c18f67cb160d6c826d85daf5bb42503fc790f9f5c2f82cd643bca81be3.
• credentials178:30/21PASS/9FAIL; SHA6a835324e19427940eaa531845acec2ab0009a721ffc4fd898fa1db2fe083b32.
• lease-authority179:12/5PASS/7FAIL; SHAe5e81389316cfd5026050dfffe345de1ac1ca4f6b778653cba09977abf6268bb. Three owning lease/deadline/input failures are genuine; additional failures include old exact SQL/readback fixture assertions after audit/credential implementation changes, NOT all product RED.
• credentials180:36/34PASS/2FAIL (losing rotation nonces and revocation/claim race); SHA7c148713f8ea5debb9b574034c668aa20d0b264da2d2586f9bbd7d8fe9755c3a.
• bootstrap-unit181:7/7PASS; SHA4128f7df55eae1f2a43a2f096ca5a273c8cb33ecdb09da927e96c3dc801bbcc6.
• credentials182:43/43PASS/0FAIL/0pending across ELEVEN complete original files; SHA6d905f4a2e6ea716c71017a7ee973bebc66316044ecab536f308a633d23eba06. Some later source-only strict fixture/type corrections occurred, so this is not a fresh whole-candidate acceptance prerequisite.

Exact 182 invocation: pinned Node24.12, original vitest.control-plane.config.ts, --maxWorkers=1, complete initial/credentials/dependency-{credential,revocation,identity}-{authority,native}.test.ts, initial/tokens/dependency-token-{authority,native}.test.ts, initial/leasing/dependency-lease-authority.test.ts, initial/polling/dependency-poll-authority.test.ts, initial/bootstrap/dependency-bootstrap-authority.test.ts; --reporter=json --outputFile=/api-credentials182.json, stdout/stderr /api-credentials182.log. NO test-name filter or changed watchdog.

Earliest product fixes: strict numerical identity version; current signed version/status checks before nonce use; atomic token insert conflict plus exact committed readback/secret derivation; credential readback by same issuance key; missing audit recovery with original durable clock and one conditional event identity; same-key membership cleanup resumes after interruption; phase-bounded lease expiry/strict explicit lease input; final claim SQL fences authenticated token and membership/provider state; identity rotation locks original provider in the SAME SIX-operation transaction and only consumes proofs for the still-current version. No new table/schema/runner/service/receipt/config/model or compatibility path. Existing audit row/failed footprint retained. Caller-supplied actors remain inputs where no original durable actor field exists; not invented physical/authenticated authority.

The polling 500 was traced to "store.leaseNextProviderAssignment is not a function": original test fixture used raw ControlPlaneStore after facade extraction. It now uses ORIGINAL createCapacityControlPlane and delegates original host reads; malformed original approval rows fail instead of being filtered. That fixture correction is NOT a product polling RED. Strict checks initially exposed newly introduced host-surface mismatches; corrected without unchecked cast/any/typecheck disable. Pre-existing generic bootstrap unit first-return typing remains unwaived. Read/path/invocation errors and truncated source output retained, not whole-source audit.

Original bootstrap exact unit observations updated for conditional audit SQL/deterministic event identity (strong exact 13 parameters, cause, no independent reads and byte immutability retained), winning credential issuance-key readback, and SAME six-operation row-lock/conditional-nonce batch. Positive current-version replay now requires exactly one audit observation; stale/future versions still cause no new writes. No old negative case, failure-cause, clock or custody assertion removed.

Strict182 broadly FAILED; log SHAd442d6e3864a2f027e79fc5b782d13d9529774fd1675aff04fac2f13a26185fe. Original layout182 PASS, log SHAdd50c4448e119b3c0304f2074bb1eac87eaa7e58e55c6d0c21a78d119c0e8e24; final service499lines via blank-line-only organization. Current strict183 and complete SIX-file polling183 underway. These are focused diagnostics, not complete-owner prerequisites or Actions artifacts.

New exact pushed-head Actions independently inspected once, no rerun:
SDK54c9008 run37262406523/job111612199532 failed complete verification: canonical tests lack TREESEED_DEVELOPMENT_WORKSPACE_ROOT (environment/authority boundary), scenes/pack/artifacts skipped.
APIbd2370d run37262406980/job111612200662 verify:direct FAILED; selected logs include missing native PG/TreeDX authorities, released SDK incompatibility, existing selection/graph/poll/bootstrap failures; scenes/pack/artifacts skipped. Selected log reads NOT whole-job diagnosis.
Agent539d0d run37262409109/job111612206925 verify:local FAILED: installed released SDK missing capabilityOfferDigest/capabilityOfferSchema/validateCapacityProviderManifestV5/usageSettlementSchema plus native fixture dist imports unavailable before build. Dependency-install step success is NOT correct dependency-contract closure. Local private SDK10 does NOT waive CI.

Whole coverage/strict/canonical semantics/native PG/TreeDX/relay CA/physical descendant closure and SDK golden remain OPEN. Complete fresh all-owner prerequisites still required before ANY scene. Continue shared polling/longpoll and Agent execution; no checkpoint final or scheduled pause.

Scoped batch pushed — continuation remains active

Exact remote PR heads independently read back after all three successful pushes and supported PR-body updates: SDK54c9008bf178e597bfde959812633f0dc1d0b4fe (5files123+/30-, PR358); APIbd2370d4331da4e2d502de868718310df0b26051 (20files236+/62-, PR492); Agent539d0d0244b623cd86ed5e0f15502edd0dcd990c (4files30+/5-, PR320). Same codex/architecture-guideline-tests branches. API/Agent working trees CLEAN; SDK only prior diagnostic node_modules remains untracked and unstaged. Protected staging fetched unchanged before transport. No merge/release/activation/model/campaign/scene or UI.

Complete four ORIGINAL enrollment files174 now32/32PASS/zero pending: strict registration counters and supplied offer denial; all native registration, approval, rejection, concurrent action/key/digest and audit-recovery cases; exact conditional13-column audit UNIT. Complete approval-authority1739/5PASS/4FAIL genuine RED preserved before the final owning terminal rejection/review-digest/recovery fixes. Original native16823/23PASS was narrower; counts overlap never sum. Final one conditional audit INSERT retains old existing event regardless of its ID, uses one deterministic event identity for concurrent absence, original ON CONFLICT, original supplied/persisted actor/disposition/clock; NO independent read or added table/receipt/model. API layout175 and diff checksPASS; cosmetic blank-line organization removed no code/assertion or checker. Agent169 four files45/45PASS and original metadata1762/2PASS, strict169PASS. SDK16516/16PASS, SDK17221/14PASS/7FAIL whole canonical semantics still RED, strict16753 diagnostics. API strict175 broad failures retained, not delivery PASS. These focused/precommit exact source candidates are NOT complete-owner acceptance prerequisite receipts.

Correction to the preceding APIphase158 command text: the actual original seventh file is tests/unit/control-plane/capacity/execution/admission/time-budget.test.ts, not guessed execution/time-budget.test.ts. Report independently lists all7 complete files; all55 cases passed. Older incorrect prose retained, NOT a command to rerun.

Immutable local report SHA256 evidence

Directory /tmp/capacity-agent-focused-20261004-OB6xb5:

• api-phase158.json78fcf83f0a20945496520c88f1e6e1b1c866156a9b2cf3d5b7a66b5abfd09949.
• agent-provider169.json4df8c1b61cd662c8e9916d9b1bd7a4a249104a1d4f612b05a7e0ef99d0f2ab04.
• api-enrollment168.jsond3deb9491a7a20d2b5aadf247c4794bc621300a204745fc91b6d8f97fff78511.
• sdk-supply-red164.jsoned45513980b86c29e383ca99e3524c9aafdd635ae7c10ab70dff955f5d4635db.
• sdk-supply165.jsonc3a840122e3877d7ec814fa5663f081b9f4fbae19373da7f05339cf25c86e2ce.
• sdk-schema172.json8de746bc0142d6a9b29facf5b344e2a10772c8c0393c4801f75528690b8c68d4.
• api-approval-red173.json5f180498440c160e533e7d9d6300feecaf47586665f18e6e2741d94b1386dbe8.
• api-enrollment174.json557e106c862da4d589c83bf0c20dc7910a8f5741e618647a003d788471608681/loge6113c931344d650b3f358dca4e50b1d9bb705ba4532074f14fb01e17187aadb.
• agent-bindings176.json909fb93678e8d87aae1b585fb5d47e6297a4cdfcb44db0a1c9c67e799d8ecccb.
• api-strict175.log4263b2d3929a8f277a6bbcd591c20b06af9a433477f03c34cbb3e90e5c4a0e98.

Local /tmpreports are not Actions artifacts or a passing remote dependency receipt. New push-triggered Actions not yet inspected. Earlier exact failed Actions/jobs/logs and all full137 failures remain immutable; no retries. Native CA/PG/TreeDX, physical descendant absence, canonical whole schema, all-attempt actual generated charges, remaining provider/execution and complete SDK golden gates remain OPEN.

Work continues NOW with complete8 original credential/revocation/identity/token files177, original API config and --maxWorkers=1, same private SDK10/candidates/original3sec windows; result still pending. No bootstrap expiry relaxation or synthetic authority. Do not end at this saved/pushed checkpoint. Entire prior107632-character Issue body preserved verbatim below.

Provider enrollment and original phase authority — implementation in progress, acceptance still blocked

Latest DIRECT user timing decision: Keep infrastructure/queue time separate; retain the original phase deadline. The active allocation is separately bounded; the assignment does NOT expire at admission plus allocated active seconds. Earlier local reports api-deadline-red141/agent-deadline-red143 and their proposed shortening passes142/144 remain retained, but are unsupported-oracle observations, NOT genuine product deadline RED. ONLY my uncommitted shortening/managed active-only assertion was reverted. The original offer-freeze expectation was corrected under this explicit user authority to the original phase boundary, while retaining maximumSeconds3 and every binding/replay assertion. Bootstrap proof/fixture expiry3sec is unrelated and remains STRICT; no refresh, extension, tolerance, fake clock or skip.

Working candidates currently remain SDK b5f421727adcc542d4bc7c0297dffa2310e8fb58 / API aac84e0 / Agent7052fc442ec0661a776ac39a454741471ccfc747 plus UNCOMMITTED scoped changes. Fresh ls-remote independently confirms those branch heads and protected staging SDK94094c39813618125266c1328c60e6c5ddaf569b/API1817b0f0b817c6d6a211ecd11284c4bdda54ad2f/Agent6c0f0bf8ffe22c1bd20ca7034d8a2a5fa225d41c unchanged. No UI, scheduler recreation, new chat/task/goal, merge, release, activation, model, scene or campaign.

Exact new tests / original owning declarations

All bindings authored in ORIGINAL owner golden.verifiers.yaml and guarantees/agent/golden/scenes/component-boundaries.scene.yaml, scope local-component-tests. NOT executed scenes or managed E2E. Existing manual/recurring managed start scene assertions unchanged after reverting the unsupported active-only assertion. Existing API signed registration/native rate/interruption/replay and approval/rejection/concurrency/audit-recovery mappings preserved; all older cases/assertions retained. SDK supplied-offer denial is also exercised through the real original API public enrollment boundary consuming the privately packed SDK, NOT an alternate validator.

Implemented owning corrections / retained limits

API and Agent old positive offer fixtures now consume actual canonical capability definitions and exact digests; controlled qualification evidence remains INPUTS, not native attestation. Agent original bad definition/offer digests were the cause of its two fixture failures: the previous prefix's “expiry” classification was inaccurate and is corrected here without erasing history. No legacy product alias, role hardcoding or deadline/cap/allowance increase.

API continuation rejects unreadable/empty/nonobject ancestry and malformed supplied parent IDs; native settled returned/released assignments no longer count as active solely because status is returned, while retained leases/tokens/reservations still deny. The original native returned fixture now supplies its required canonical AssignmentAttempt; no product fallback or read-time fabrication. Complete continuation155:13/12PASS/1FAIL mandatory missing native PG environment.

API one declared operation-status authority preserves allowed statuses and denies malformed/undeclared status as500 rather than unexpected success. Initial draft preceded runtime regression; original constructor was restored for status-red150(4/3PASS/1FAIL), then corrected; do not claim a first RED commit before that draft.

Registration159(10/0PASS/10FAIL) initially stopped at unexpected500. Direct original service diagnostic identified TypeError reading results.slice: the ORIGINAL native PGlite fixture discarded actual batch results. Corrected only that fixture to return original-shaped actual query rows/change counts. Registration162(15/11PASS/4FAIL) then exposed genuine production malformed-counter fail-open, missing supply offer TypeError, duplicate concurrent audit and missing-audit replay. Counter reader now requires a complete exact batch and one positive safe-integer counter per bucket, never Number/default/coercion. Original transaction/rate limits untouched.

SDK supply-red164(16/15PASS/1FAIL) retained actual undefined-root TypeError; supply16516/16PASS. Original validateProviderSupplyOffer now safely validates unknown roots and strict supplied numbers without mutation/coercion. Original positive distribution and empty-array contract not narrowed. SDK build166 and npm pack --ignore-scripts produced PRIVATE /tmp/capacity-sdk-candidate10-kUYALZ/treeseed-sdk-0.13.0-rc.122.tgz SHA256 f78a77699c39c7cf618c79850af53596f65a9cc1fd8de41692e9ec19208d15a0. Installed into API/Agent REAL allocated node_modules directories with --no-save --package-lock=false --ignore-scripts; SDK/CLI diagnostic links untouched/NEVER staged. No publication or installed global closure claim.

Enrollment16723/20PASS/3FAIL exposed approval race/recovery. Enrollment16823/23PASS after owning fixes: losing cancellation requires exact committed cancelled action/key/digest; approval audit is immutable/exact-once/recoverable. Further complete approval-authority1739/5PASS/4FAIL exposes unbound terminal rejection and changed winner digests and missing rejected audit recovery. Corrections now being verified in complete four-file enrollment174; not yet claimed passing. Audit recovery uses the ORIGINAL13-column record in one conditional INSERT, retained actual request/actor/disposition/clock, deterministic same event identity + existing ON CONFLICT; no independent audit read, no added schema/storage/receipt/history deletion. Initial newly authored generic mocked-row type error was a fixture typing error, not product RED; final audit UNIT uses only actual write observation and no unsafe generic return cast.

SDK original schema verifier now includes existing executable content/assignment/graph/workday validators, validates root authority, retains union/conditional/reference/numeric/uniqueness constraints and complete difference paths rather than truncation/annotation-only checks. Unknown implementations remain explicitly UNVERIFIED; NOT whole canonical semantic closure. Correct authority command schema17221/14PASS/7FAIL; all8 original platform verifier cases pass, whole-equivalence/complete native closure remains RED. Wrong-path schema169 zero tests and omitted-authority schema17021/11PASS/10FAIL are invocation failures retained, NOT product RED/prerequisites. Existing original standards:build148 generated ignored original bundle using npm pack --ignore-scripts (not prepack/build fallback); not whole SDK release acceptance.

Local results / exact complete-file commands (focused, NOT owner prerequisites)

Evidence directory /tmp/capacity-agent-focused-20261004-OB6xb5. Every report/log retained; counts overlap, never sum. APIphase15855/55PASS, Agentphase1586/6PASS, Agentprovider16945/45PASS with unchanged watchdogs and --maxWorkers=1. Prior default-worker/full-run timeout failures retained, not erased or explained away by a contention inference. Agent strict161/169PASS. SDK strict167 remains53 baseline diagnostics; API strict171 remains broad failures, no blanket pass/disable/waiver. Introduced generic audit UNIT typing issue corrected without casts. Layout SDK169 and Agent157 PASS; API171 fails501lines, to be corrected by source organization only, not checker change. No full owner green claim.

API prefix PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH:
node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/capacity/capacity-query-operations.test.ts tests/unit/control-plane/capacity/accounting/architecture/public-record-custody.test.ts tests/unit/control-plane/capacity/execution/assignment-attempt-builder.test.ts tests/unit/control-plane/capacity/execution/admission/assignment-active-window.test.ts tests/unit/control-plane/capacity/execution/architecture/offer-freeze.test.ts tests/unit/control-plane/capacity/execution/architecture/initial/initial-admission.test.ts tests/unit/control-plane/capacity/execution/time-budget.test.ts
Enrollment174 command same API config, --maxWorkers=1, complete tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/{dependency-approval-authority,dependency-registration-authority,dependency-registration-native,dependency-approval-native}.test.ts (literal four files, no filtered cases).
Agent169: node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts tests/modern/provider-boundary.test.ts tests/modern/provider/architecture/arbitration-native.test.ts tests/modern/execution/verification/replay-failure.test.ts tests/modern/kernel/architecture/custody/start-custody-readback.test.ts --maxWorkers=1.
SDK165: node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts tests/unit/agent-capacity/capacity/providers/capacity-provider.test.ts.
SDK172: TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts tests/unit/content/architecture/platform-agent-schema-verification.test.ts tests/unit/content/architecture/canonical-schema-equivalence.test.ts tests/unit/content/architecture/platform-schema-custody.test.ts.
Reports --reporter=json --outputFile=/.json and stdout/stderr to matching .log. Strict API node node_modules/typescript/bin/tsc --noEmit --strict; Agent npm run typecheck; SDK node node_modules/typescript/bin/tsc --noEmit. Mistaken nonexistent npm check:types invocations160 retained as invocation failures, not strict checks.

Full-suite / Actions / acceptance gates still held

Final original API full1371797/1520PASS/266FAIL/11PENDING, SDKfull137443/426PASS/17FAIL, Agentfull137803/792PASS/11FAIL; these are historical held candidates, NOT current prerequisite receipts. Latest prior pushed-head Actions independently inspected: API aac84 run37258253346/job111599809254 failed real suites (package/scenes/artifact skipped); SDKb5f421 run37258251878/job111599804729 failed canonical tests (scenes/pack/seal/artifacts skipped); Agent7052 run37258253017/job111599808047 failed verify:local with released-SDK missing exports and pre-build dist provider fixture typing; scenes/artifacts skipped. Exact job logs retrieved, no rerun. Private local SDK archive does NOT satisfy released dependency/Actions authority.

Readable real /etc/treeseed/sandbox/relay-ca.crt still denied, native PG/TreeDX environments still missing, true descendant ESRCH still fails under PID1 nonreaping. No sudo/credential/TLS bypass, fake CA, manufactured physical absence, new native helper/subreaper/runner or skipped environment. Whole canonical semantics, native all-attempt generated charges/authorized continuation/producer completeness/global fairness/model clocks/Deployment-Kata/physical closure and SDK golden remain OPEN. Every eventual acceptance needs FRESH COMPLETE ALL participating owner unit+real integration on exact held candidates FIRST, zero fail/skip/todo/missing/empty/filtered/inconclusive; no previous passing receipt reuse. No golden launch before gates pass.

Continue active work; this persistence is not a stopping point. Entire prior94439-character Issue body preserved verbatim below.

Canonical stored settlements and provider native units — pushed, acceptance still blocked

Exact pushed candidates: SDK b5f421727adcc542d4bc7c0297dffa2310e8fb58 / draft PR358; API aac84e0 / draft PR492; Agent 7052fc442ec0661a776ac39a454741471ccfc747 / draft PR320. Branch codex/architecture-guideline-tests. Protected staging independently ls-remote + fetched unchanged: SDK94094c39813618125266c1328c60e6c5ddaf569b/API1817b0f0b817c6d6a211ecd11284c4bdda54ad2f/Agent6c0f0bf8ffe22c1bd20ca7034d8a2a5fa225d41c. All three pushes and PR head/body independent readbacks confirmed. SDK diagnostic node_modules untracked NEVER staged. No UI, schedule/chat/task/goal, merge, release, activation, model, scene or campaign.

New exact cases / existing owning maps

SAME original Agent REAL Kernel/native HTTP/Git case native successful usage delivery preserves exact observations and blocks denied closeout before completion without another model turn / agent.golden.execution-all-attempt-usage-native-1 strengthened; SAME original native Unix broker/executor/Kernel/runner case native microvm Kernel and provider runner retain original successful and failed executor measurements through exact public delivery and denied closeout / native-2 strengthened, NOT newly counted and BLOCKED by required relay certificate EACCES. Original tests/cases/negative assertions retained. Original node scene Every native managed attempt exposes one unchanged canonical lease reservation result and UsageSettlement across public views / agent.golden.architecture-record-custody-live-1 now parses strict exact original canonical settlement and compares numeric native units to own actual aggregate; original runtime registry/settlement.scene unchanged, AUTHORED NOT live/executed/PASS. Component bindings are not managed E2E proof. Six scoped registry/name/AST/scene maps independently checked in accounting-metadata136.log; no scene launched.

Owning implementation and retained REDs

SDK uses canonical target UsageSettlement vocabulary (exact ids, agentClass, measured integer seconds, nonnegative finite distinct native units, optional cost/currency, exact timestamp) in existing executable contracts. Introduced trim-order failure sdk-settlement125 5/4PASS1FAIL retained: original identifier trims, so a post-trim check was tautological. Fixed raw identity check BEFORE existing identifier parser; sdk-settlement1265/5. No weakened assertion/check disable.

API persists the canonical record in SAME original exactly-once ledger metadata transaction, using frozen Attempt + original measured inputs/native units/entry ID/settlement time. No new table/migration/runner/service or read-time canonical reconstruction. Existing operational ledger envelope retained; canonical usageSettlement is returned as ONE strict child, not copied again inside public metadata. This changes the initial top-level test expectation to match the existing page envelope while retaining EVERY required canonical field, exact stored-row comparison and old operational checks; it is not narrowing canonical semantics. Missing/malformed/moved records fail closed; older legacy rows do NOT become canonical by inspection. Same native case compares actual stored metadata/id/key/time, EACH controlled absent/foreign/coerced/changed measurement/time, unchanged whole native state, explicit restoration of ONLY supplied metadata and same original read-back.

Additional focused genuine RED api-settlement-replay-red1346/5PASS1FAIL showed original retry accepted corrupted stored settlement while public inspection denied it. Fixed earliest original assertSettlementMatches to use SAME original ledger serializer, including replay policy, retaining failure and all retry history. Removed unused old replay helper, not a public compatibility path. api-accounting135 six COMPLETE original files43/43. API132 original file-length/ownership policies pass; full strict133 remains FAILED (no waiver), including original catalog grant page typing/status errors and broad existing diagnostics. Full Agent original strict131 exit0/empty. SDK/Agent132 original file policies pass.

Agent original translator previously copied string provenance into nativeUsage. Unit + original owning portable/native boundary agent-usage-red12319/17PASS2FAIL retained; remove ONLY diagnostic provenance from native numeric map, preserve it top-level and preserve EVERY other raw value, including invalid values for owning aggregation denial. agent-usage124 three COMPLETE files40/40. No invented units, zero charges, rounding, native-unit conversion or fake usage. Native broker13313/8PASS5FAIL, all five required /etc/treeseed/sandbox/relay-ca.crt EACCES, no skip/fake CA/TLS/permission bypass. Native replies/counters remain controlled inputs, not actual provider billing/Kata/model/governance or physical closure.

Exact local evidence (NOT Actions/prerequisites)

Evidence root /tmp/capacity-agent-focused-20261004-OB6xb5. Counts overlap, never sum.

• api-accounting12241/40PASS1FAIL canonical read-back, SHA d0e682f2554aa179df883bd31dad7dc58c7714dc12b8094c8a850b601f649171.
• api-accounting13043/43 SHA83236e92280bc9eb02b56d7e6d5afca21465e2d551966d3f74bdb92dd312eb64.
• api-settlement-replay-red1346/5PASS1FAIL SHA1840576d8fd6d084f62d214a9f7f9df79266966d724faa2b75f4cad489c0983e.
• api-accounting13543/43 SHAc88a973cf74de2381c9e0d8831272625c43ee1da23db18e1063f002082131b57.
• agent-usage-red12319/17PASS2FAIL SHA9443faa59831fb5a0250197d63845a18025d7399d860fabdd7f3d82c215da1f0.
• agent-usage12440/40 SHAa633b213bd450828617358923988f06d479eb59aa933f7a9552248cbee55b57a.
• sdk-settlement1255/4PASS1FAIL SHAb93c6963035b3371ee48028ccf0a051ad19668d0d00af4d1e0655a0a7a3aa5c3;1265/5 SHA3051b536ccab4ed163da0e2a42ffea06ef598721f55955094ddf936155af0d1f.
• agent-native13313/8PASS5FAIL SHA7a36f3877bd1cecfb121053f4ac01538778ae10ed4aa6ad618c2d68da44344e5.
  Original SDK build127/pack128 completed; local archive /tmp/capacity-sdk-candidate9-DYTU5Q/treeseed-sdk-0.13.0-rc.122.tgz SHAc805616c8849aca1398aea0fe837628f0a7fdd0a58b6c0ad15a04edbceaa533e. Private API+Agent no-save/no-lock/ignore-scripts install129, no source manifest/lock changes or registry publication. Build/private package bytes are not published/whole dependency closure.

Focused135 exact API cwd command:

PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/capacity/accounting/architecture/settlement-authority.test.ts tests/unit/control-plane/capacity/accounting/architecture/public-record-custody.test.ts tests/unit/control-plane/providers/assignments/architecture/provider-accounting-persistence.test.ts tests/unit/control-plane/providers/assignments/architecture/provider-accounting.test.ts tests/unit/control-plane/providers/assignments/operator-planning-cancel.test.ts tests/unit/control-plane/providers/assignments/architecture/cancellation-persistence.test.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/api-accounting135.json

Agent124 same Node/config complete files sandbox-accounting-usage.test.ts + portable-kernel-integration.test.ts + provider-kernel-executor.test.ts; native133 original bindings.test.ts + sandbox-broker-preparation.test.ts. SDK126 original vitest.contracts config COMPLETE architecture-record-custody.test.ts. Exact original source file paths are in map/commands above and preceding preserved body. stdout/stderr retained same-basename .log.

Fresh COMPLETE suites on committed batch

Exact command in EACH owner cwd: TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config --reporter=json --outputFile=/-full137.json, stdout/stderr corresponding .log. SDK config vitest.contracts.config.ts; Agent vitest.config.ts; API vitest.control-plane.config.ts. No filtering, new runner, deadline/allowance/watchdog change.
SDK full137443/426PASS17FAIL/zero pending: original missing generated standards bundle +16 genuine WHOLE semantic-equivalence failures remain. Agent full137803/792PASS11FAIL/zero pending: five CA EACCES, two native qualification fixture expiry errors, three STACK_TRACE_ERROR observations (cause not yet established), original descendant physical absence failure. API full137 STILL RUNNING at this exact checkpoint; no invented outcome. These all BLOCK acceptance. Fresh exact full passing owner suites required again before EVERY eventual scene; no prior passing receipt reuse. All heads/tracked bytes held for each full invocation; no full artifact/dependency/cross-owner custody proof claimed.

Task OPEN. Next finish full API result inspection, fix original qualification fixture timing without extending admitted clocks, investigate timeout cause, canonical whole schema semantic gap and descendant physical closure; mandatory CA/native PG/TreeDX missing authority stays explicit. Do not stop at saving this checkpoint. Existing failed evidence/history retained verbatim below.

Public canonical record and cancellation/accounting repair — work continues

SDK pushed candidate 92bacdafcb99e681c913c7ee0c92b57375972a48 to existing branch codex/architecture-guideline-tests / draft PR358. Protected staging independently unchanged 94094c39813618125266c1328c60e6c5ddaf569b. API remains a7a23bc and Agent 5fd0af089dedd8c29389bd5365b04861e0cc64d3 with current scoped source/scene changes UNCOMMITTED. No merge/release/activation/provider/model/scene/campaign or UI work. Task OPEN; saving evidence is not a stopping point.

Exact layers and original bindings

• SDK original tests/unit/agent-capacity/capacity/architecture-record-custody.test.ts, all four original names/bindings sdk.golden.architecture-record-custody-unit-1..4 / component-boundaries.scene retained. Validator now uses original canonical Attempt/Result schemas, refuses parse repair/default laundering, binds root provider/executor/team/project/workday/node/revisions/reservation/ordinal/creation identity to the unchanged attempt, and binds the original admitted capacity envelope to operational row identities. Opaque project-agent-class ROW ID is NOT the agent-class slug; positive explicitly retains unequal IDs. Completed records need a complete owning completed Result; supplied failed results cannot become completed history. Results bound to original created/start/finish/deadline and operational completion. No new canonical authority field/model.
• SDK tests/unit/agent-capacity/capacity/assignments/assignment-record-validation.test.ts retains all three older cases/negative assertions. Old positive fixture lacked a canonical Attempt; now supplies original parsed schema, full envelope, node/revision/provider/ordinal facts. Initial draft mistakenly used operational pending as canonical Attempt status; report90 preserves that fixture ZodError, corrected to canonical created. Not product RED/PASS laundering.
• API REAL original PGlite SQL + ProviderAssignmentRepository/public cancellation: tests/unit/control-plane/providers/assignments/architecture/cancellation-persistence.test.ts five original cases and api.golden.architecture-cancellation-sql-1..5/component scene retained. First case strengthened: supplied malformed JSON, empty attempt, foreign team attempt must deny executable get, permit explicitly invalid diagnostic/cancellation readback with NULL executable snapshots, fail SDK execution validation, retain exact bytes/all represented SQL, deny foreign team. Existing diagnostic path must not certify invalid records; SDK execution validator remains strict. API typedJson additionally forbids schema normalization. Original cancellation and settlement fixture inputs now represent full native persisted operational identities/envelope, opaque class row and bounded controlled Result; these are not actual admission/model/charges.
• ONE new UNIT in original tests/unit/control-plane/providers/assignments/operator-planning-cancel.test.ts: "denies missing malformed and incomplete measured usage before cancelling a released productive attempt" / api.golden.operator-cancellation-measurement-unit / component-boundaries step operator-cancellation-measurement-unit. Eight controlled missing/incomplete/coerced/negative/nonfinite measurement variants, exact owning error, one read, ZERO mutations/settlement, unchanged assignment/request. All six old cases preserved. Owning cancellation now reuses terminalPerformance measurement contract BEFORE any cancellation mutation; released lease is not never-started proof. Original internal recovery accepts partial cancellation disposition, not fabricated complete agent acceptance evidence; public lifecycle schema unchanged.
• API UNIT original settlement-authority.test.ts + provider-accounting.test.ts and REAL native SQL original public-record-custody.test.ts + provider-accounting-persistence.test.ts preserve original names/bindings/all negatives. Public report/settle now refuse raw measurement/ordinal coercion, wrong provider under matching membership, unknown/terminal nonterminal accounting modes. Whole named native counter/descriptor and raw numeric nativeUsage readback bound to idempotency; existing known replay first reads and denies before changing reservation timestamps, plus native batch NOT EXISTS guard for concurrent same identity. Original canonical Attempt required before preparing usage persistence. Current aggregate underreporting and canonical ledger gaps remain tracked; no complete ALL-attempt/physical proof.
• Agent original tests/acceptance/workday/record-custody.test.ts first native managed case (agent.golden.architecture-record-custody-live-1) now requires SDK whole public-record validation and exact repeated public views. Original failed-attempt case (live-2) additionally retains cancelled disposition and owning exactly-one finite terminal measurement. Existing settlement.scene/runtime.verifiers/native harness retained. AUTHORED NOT RUN: needs actual complete managed run and fresh complete all-owner prerequisites first. Public row agreement is not charge provenance/physical teardown.

Exact diagnostic receipts (overlap; never sum)

All local files under /tmp/capacity-agent-focused-20261004-OB6xb5. Original watchdogs/configs unchanged. SDK:
red89 7/4PASS3 genuine validator FAIL SHA dc229c1277acf82dd44a588a0f0471e9abbb3f3c21d38efe2d503bcec9a660ef.
90 7/4PASS3 fixture ZodError FAIL SHA f2b9b2da33d68107a8d0d45936dd9eff7056e02e7530806ab660556adf479fec.
91 7PASS SHA 73fe99c1c8cca3a9fb439660654521702156e4deadad993ab1a92301ecb900da.
95 7/6PASS1 genuine started/finished interval FAIL SHA 92673d3a8789dbc04f00f5bef0bb8203716f0b3a41cdf6fd6f88b9a69ff219f6.
97 7PASS SHA 8de4cc7895c6f4428293cc4be13b7669c30eac98badf8fccb104b68f6d3a630e.
117 THREE complete original files 15PASS/zero skip/todo SHA d857888a29a9cabd37f13f548f787274f7c928d587e7eee9927bf184a11182bc.
SDK FULL original unfiltered vitest.contracts.config.ts at92bacdaf 442/425PASS17FAIL/zero pending SHA bfe1a7ea2e217f6fed6efaa7faa247bd5536a3e01211adbae934731b81b2ffc5: one missing original generated standards bundle +16 whole-canonical-schema semantic verifier gaps. FAILED prerequisites, NOT acceptance permission. Full strict100 still FAILED original diagnostics; no new record-file diagnostics. Original build92/build107/layout119 PASS. Local original npm pack --ignore-scripts candidate8 /tmp/capacity-sdk-candidate8-uMBoMJ/treeseed-sdk-0.13.0-rc.122.tgz SHA c4d38f23e8ee0efd2e217850e171e804cc234fba9ebabb3904033f7fb35857ef installed ONLY private API+Agent node_modules, no-save/no-lock/ignore-scripts; source manifests/locks unchanged, SDK diagnostic link NEVER staged/installed through. Local archive/private dependency NOT registry/release/source-selected-runtime closure.
API96 all5 failed incomplete fixture identities; 98 5/3PASS2FAIL diagnostics+unknown productive usage; corrected controlled input and fixed earliest owning contracts.
99 complete native cancellation+public readback 10/7PASS3FAIL SHA c4516f2b76b07150445165a33618351b2ffdd1351af9ae0e0ed9f34ba6ee82b9.
101 full original cancellation file5PASS SHA 0199237420a50f73c786d591f341f0aec1b01ef971a9bfeb346cb82160c0126f.
104 full original operator UNIT+cancellation SQL files12PASS SHA 46de08d3a618d443fcd3524102afe35cc82f0ff67de93f4eacc3e697dacac403.
116 SIX full original files41/39PASS2FAIL SHA b44bc0aa6660582b62929412cee7e9b53516915ffa94c8fc2ed0a10a87e746ec. 120 subsequent same41/39PASS2FAIL includes positive fixture whose repeated checkpoint token counts contradicted its final aggregate; controlled checkpoint input corrected to its declared native3 while retaining every count/denial/immutability assertion. Canonical UsageSettlement exposure still OPEN, NOT inferred from operational ledger. No historical failed report erased.
Agent strict106 returned exit1 with EMPTY log (inconclusive, not PASS); same original direct strict repeat exit0/no output at same source, no check-disable. Agent layout108 PASS. API strict109/118 still broad FAILED; introduced partial internal completion/test mock typing corrected without weakening public types or assertions; no full strict PASS claim.

Commands

SDK117: node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts tests/unit/agent-capacity/capacity/architecture-record-custody.test.ts tests/unit/agent-capacity/capacity/assignments/assignment-record-validation.test.ts tests/contract/agent-capacity/capacity-configuration.test.ts --reporter=json --outputFile=<117>.
SDK121: TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts --reporter=json --outputFile=<121>.
API116/120: node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/capacity/accounting/architecture/settlement-authority.test.ts tests/unit/control-plane/capacity/accounting/architecture/public-record-custody.test.ts tests/unit/control-plane/providers/assignments/architecture/provider-accounting-persistence.test.ts tests/unit/control-plane/providers/assignments/architecture/provider-accounting.test.ts tests/unit/control-plane/providers/assignments/operator-planning-cancel.test.ts tests/unit/control-plane/providers/assignments/architecture/cancellation-persistence.test.ts --reporter=json --outputFile=.
All with pinned PATH /tmp/sdk-native-node2412-PjB5qe/bin. Focused receipts NOT whole-owner prerequisites.

SDK actual Actions run37255170445/job111590573574 at earlier50335675 independently inspected FAILED Verify442/420PASS22FAIL; missing canonical workspace env+original semantic failures+then-unfixed record validator. Scenes/pack/seal/uploads SKIPPED, not passing/read-back evidence. No workflow rerun or approval bypass. Large returned log truncation retained as observation; no entire-log audit claim.

NEXT continue actual accounting/native producer/whole-schema/strict/full Agent/API failures. Relay CA EACCES, missing disposable native PostgreSQL/TreeDX and genuine broker/Kata physical closure remain unproven. SDK golden NEVER passed; no acceptance launch until fresh complete prerequisites succeed. No UI. Entire previous body retained unchanged below.

Published qualification batch and exact mapping correction

SDK50335675df4fb75a09af482742d50e065c256611 / Agent5fd0af089dedd8c29389bd5365b04861e0cc64d3 / APIa7a23bc71578ae6928313fac4e65f446cf0487f4 ordinary commits pushed; all three remote branch heads and existing draft PR358/320/492 heads independently agree. PR descriptions updated with supported connector and independently exact read back. No staging/main merge, release, activation or acceptance. Protected staging refs freshly fetched unchanged before commit/push; diagnostic links and manifests/locks unstaged.

Correction to the preceding prose alias: the EXACT registered native verifier is api.golden.execution-offer-selection-native-1, not execution-offer-freeze-native-1. Its exact original file/name unchanged in registry and scene, authored/unexecuted; wrong prose alias retained below as historical error, not a new binding/test. API87 retains11/10passed/1deadlinefailed; no positive PASS for the failed original invocation. Agent full strict85 and original layouts81/82/88 passed; API strict86 failed2202 diagnostic lines, no waiver. Counts overlap, never summed.

SDK public record next: the existing four canonical custody UNIT cases are being corrected for the actual operational class-row ID vs canonical agent-class slug distinction. Existing API admission already freezes projectAgentClassId in capacityEnvelope; no new field/model/representation is needed. All old root-drift/missing-attempt/result-negative assertions retained; native authority/class lookup and physical closure are not fabricated. No completed coverage claim or stopped work.

Shared provider qualification and signed publication repair; all acceptance still blocked

Complete Agent67 at committed1332/pack5: original unfiltered vitest.config.ts --maxWorkers=2 with TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform and pinned Node24.12. 802/796 passed/6 failed/0 skipped/todo. Report SHA25675fa70efe3203a4401405953f48097737cebb22ff42083ed002ad4c36059f7c7. Exact dist digest before/after1d81bbb457fd2f0351495590de693b67719f5893b0b6c227f45f167fdaa8020c; source HEAD/status unchanged through invocation. Shared build race no longer fails. Five original relay-CA EACCES and genuine descendant cleanup/absence failure remain fatal. No acceptance launched.

API68 TWO existing whole-publication unit regressions plus inventory regression reproduce three genuine failures:8total/5passed/3failed/zero pending. Exact original vitest.control-plane.config.ts and complete tests/unit/control-plane/capacity/ontology/availability-initialization.test.ts. SHA25603a60b4edb7f221192acb8e5ccdb32074f96b24834ebc36417b27f020f298b87. It accepted missing automated suite, foreign signer and malformed/mixed/duplicate offer inventory.

SDK SAME existing qualification UNIT case (sdk.golden.execution-qualification-unit-1) strengthened BEFORE repair for a shared original contracts validation boundary, exact provider identity, missing/malformed offer and digest; SDK69 failed absent exported function (SHA256ee352faa8c2064b9121e198c4a2ef95dbec9bc93c30cf6fe09375c827e52dbfb). New validateCapabilityOfferQualification in ORIGINAL validation.ts reuses SDK original schema/digest/core ontology/diagnostic contract. One tier/unique receipt/provider/current clock/definition/ref/orphan policy now serves manifest advertisement AND API admission/publication; old manifest inline duplicate removed. No model/schema/storage/config/runner added. Registered-key crypto remains API publication authority, not SDK or prompt policy.

SAME SDK native public contracts case sdk.golden.execution-provider-contract-entry-native-1 additionally calls this boundary in actual compiled public Node import, rejects foreign provider/exact expiry and retries unchanged controlled offer bytes while excluding client/catalog imports. Both original verifier/scene mappings remain, component only. Original three complete files73 passed15/15/zero pending SHA256e2a4e9ca2bbcabcf500e3fc5600b6be9a54b19cb2edf68d3567f0b8bcc0f9fc0. Original SDK build71 passed; local pack6 SHA256b6a531b1f030621987f1405ff19d6b389c0ceea7896a06392eea34b65b9d70b6 installed ONLY private API/Agent dependencies without source manifest/lock changes. Node public qualification inputs/signature fields are NOT real enrollment, suite execution, issuer approval or provider charges.

API ORIGINAL AvailabilitySessionService now validates every raw nonempty offer inventory before publication, global unique offer IDs, canonical digest, exact native definitions and shared SDK qualification. Every Ed25519 receipt is independently verified over whole original unsigned canonical bytes against registered public_jwk_json; malformed/missing/foreign/private-key identity, changed key ID, substituted evidence/signature/padding/short bytes deny409; no publication repair/input mutation. Builder uses SAME SDK qualification before freezing selected supply. API76:11/10passed/1failed SHA256350719d8c22e059f7f300a958761c5b4ccf3628e790878de713fbfedb9ceecae: all8 publication cases and invalid frozen offers pass; original positive deadline+3s assertion still FAILS actualworkday authority+40s. Remains unresolved, never weakened or extended. Fresh87 after strict discriminant narrowing retains SAME failure. Read only original execution-window/queued timing source; no deadline change.

Agent77 exposed an EARLIEST genuine producer defect (25/5passed/20failed, SHA256cf541ee7d76af867315ab3d5ed3f3b557ec2314fac275b1ec9c2656b3b03b6d1): managed offer repartitioning included the previous offerDigest inside newly hashed material. Same existing canonical-offer-selection batch UNIT additionally asserts every template digest; RED78 retained SHA256446bebb43793faa0fed44de998646255548f498651140f41ad7a99b3ae4bc53a. ORIGINAL managed-manifest.ts now omits the prior digest before rehash, not changing scope/model/tier/receipts. Native publication still tests actual original independent provider/signing/host custody. Agent83 FOUR complete files (canonical-offer-selection, provider/managed-lane-coverage, arbitration-authority/native) original config --maxWorkers2/workspace env:28/28passed/zero pending SHA2568b402e0f2fce6a3b05e93b00195609135fd669110070ebbe237b16d03f58a96d. Original build80 and strict85 passed. Initial guessed build-runtime.mjs79 was nonexistent command invocation error only, not compiler/product RED; corrected to original npm run build:dist without fallback/new runner.

Complete SDK84 original unfiltered vitest.contracts.config.ts with workspace env:442/422passed/20failed/zero pending SHA25657b4f733102a6c63e76f0290cf03aa0c8c7d717a5310fe3ea36cd426d0cce4ab. Missing original generated standards bundle, canonical public-record validation and whole-schema semantic verifier remain failed. No whitelist/hash-input-against-input/duplicated authority/PASS substitution. Original API strict86 failed2202 diagnostic lines (not2202 unique errors), historical and owning-source diagnostics unwaived; ORIGINAL builder now narrows Git union in flatMap, uses typed model membership Set and captures checked estimate across callback without casts/disabled checks. API complete suites/native PG and TreeDX remain unproven; no scene/SDK golden launch.

Existing API native case api.golden.execution-offer-freeze-native-1 (availability-postgres.test.ts exact publication/independent pools/retained corruption) and original signature/qualification/inventory native mappings remain authored, NOT executed: authorized disposable PostgreSQL env absent. Native signature or suite-shaped supplied inputs do not establish genuinely executed conformance suites, live all-attempt charges or physical durable teardown. Draft PRs stay blocked. Scope capacity provider/Agent execution only; no UI/schedule/checkpoint completion.

Evidence commands/logs in /tmp/capacity-agent-focused-20261004-OB6xb5 with numbered matching report files; local diagnostics are not Actions artifacts. All preceding bodies and failures retained unchanged below.

Provider contract repairs published; isolated build custody repaired

Agent draft PR320 head 1332e3fafc637052a664035ddd42ae272aec6090 and SDK draft PR358 head b9687ca052dc4a8ee55245b4e09cdc52d1709dd0 were pushed and independently read back. No merge, release, activation, scene or SDK golden. API PR492 remains 7ee40fd. All prior failed evidence retained below.

Full Agent bounded59: original unfiltered vitest.config.ts, --maxWorkers=2, TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform, pinned Node24.12, 802 total /795 passed /7 failed /0 skipped/todo. SHA256 7cc2f8713a0e8f96c198cc9e7aa644eba4a1bf55c57c0e777d6d498b4648c605. Five relay-CA EACCES, one real descendant cleanup failure, one native child ERR_MODULE_NOT_FOUND caused by an older parallel test rebuilding shared dist. This invocation is NOT exact build-byte custody or acceptance prerequisite proof: the older test mutated shared dist. No watchdog extension, config edit or omitted test.

SAME original project-handler-build case now builds its actual original source/scripts/config/package and handler fixture only inside an allocated clone, links existing private dependencies, retains both fixture/default-build assertions and independently compares every original dist byte before/after. No parallel compiler or product build path. Cleanup only allocated clone. The remaining-time unit now captures ONE actual Date.now for its same original 60000ms input; earlier two-clock 60001ms failure is retained as fixture error, not product RED.

Focused Agent60, FIVE complete files: project-handler-build.test.ts, canonical-offer-selection.test.ts, arbitration-native.test.ts, arbitration-authority.test.ts, guest-clock-contract.test.ts; original vitest.config.ts --maxWorkers=2 with same workspace env/pinned Node. 37/37 passed, zero failed/skipped/todo, SHA256 97f21127d581e75af0fa258ecb62b51374a8cc817897ba0ccfebaa716d02b80e. Focused proof only, not whole-owner prerequisites. Agent original strict62 (node node_modules/typescript/bin/tsc --noEmit --strict -p tsconfig.json) exit0/empty log SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Original layout61 passed SHA256 ed73d142605e4fb1a90eb7675a056c29b2dedead59bf0f0067b0adabfdd28923.

SDK ProviderAssignment now types its ALREADY represented optional operationHandoffId:string|null, which existing API serializes from operation_handoff_id and consumes at original lease/terminal/recovery. Type alignment only, no invented runtime authority or validation claim. SDK original build63 passed. Actual npm pack --ignore-scripts --json local pack5 /tmp/capacity-sdk-candidate5-ZzEJPf/treeseed-sdk-0.13.0-rc.122.tgz SHA256 8dd86f4681567695542989db779c700ad9fe7be65b504b858a77d0c27cdd8fea. Installed ONLY private Agent and API node_modules via no-save/no-lock/ignore-scripts; both installs passed, original manifests/locks unchanged. Diagnostic SDK/CLI links never staged.

Evidence files stay under /tmp/capacity-agent-focused-20261004-OB6xb5 (agent-complete-bounded59.json/log, agent-isolated-build60.json/log, agent-strict62.log, sdk-build63.log, sdk-pack64.json, private install65/66 logs). Exact local hashes are not Actions artifact custody. Original previous failed SDK/API Actions remain failures; no reruns/waivers.

Fresh COMPLETE Agent67 now running on committed 1332 with installed pack5, unfiltered original config --maxWorkers=2 and workspace env. No Agent source/build/dependency mutation during invocation. Initial original dist digest 1d81bbb457fd2f0351495590de693b67719f5893b0b6c227f45f167fdaa8020c. No result claimed yet. Acceptance still blocked by all remaining failures/environments. Continue capacity provider/Agent implementation and all-three-layer contracts; no UI, heartbeat, duplicate campaign or checkpoint-as-completion.

Provider contract-entry and native qualification batching — October 5; delivery still OPEN

Capacity provider / Agent execution only; no UI. No scene, managed campaign, model, activation, merge or release. SDK golden has NEVER passed. Heartbeat remains deleted.

Failed Actions inspected, not rerun or relabelled

• API draft PR492 exact HEAD 7ee40fd4ac44a8b8ad0a5603f5282d3fda14f7c5: Actions PR Verify run37251987917 / job111581340526 FAILED at verify:direct. Native PostgreSQL checks, archive, component scenes and artifact upload SKIPPED after that failure. Logs independently read through connected GitHub. Existing installed released SDK rejects the approved governed work-item and projected node priority, alongside real product/fixture failures and explicitly missing disposable PostgreSQL / native TreeDX environments. This is not verification of the joint repaired SDK candidate.
• SDK draft PR358 exact HEAD fd4e69e7f1a9b4e6c1f05362ec8125324df5eea5: Actions PR Verify run37250577814 / job111577173665 FAILED. 440 tests /418 passed /22 failed. CI lacks TREESEED_DEVELOPMENT_WORKSPACE_ROOT; canonical-record and whole-schema/native Git equivalence failures remain. Local environment-backed failures and CI missing authority are distinct, never waived by totals. Scenes/pack/seal/upload skipped. No blind Actions retry.

One existing client-free contract boundary, not duplicate validators

SDK ORIGINAL src/capacity-provider/contracts/index.ts now reexports ORIGINAL validation.ts and capability-ontology.ts through the EXISTING package export. validation.ts imports ORIGINAL governance.ts directly to avoid a barrel cycle. Agent ORIGINAL manifest.ts and materialize-offers.ts import that same existing contracts export, not the broad client entrypoint. No new schema, dependency, package export, runner, model, runtime limit, timeout or allowance.

New exact mappings in ORIGINAL SDK tests/contract/agent-capacity/capacity-configuration.test.ts:

• UNIT "exposes the original provider manifest validator and offer schemas through the client-free contracts boundary" / sdk.golden.execution-provider-contract-entry-unit-1.
• REAL native packaged Node export and resolution hooks "native public provider contracts validate immutable signed-proof inputs without loading control-plane clients or operator catalogs" / sdk.golden.execution-provider-contract-entry-native-1.

Both ORIGINAL golden.verifiers.yaml/component-boundaries.scene.yaml bound as local-component-tests; NOT managed E2E or executed scenes. Native case uses manifest-declared self-reference and held dist (missing bytes FAIL, no source/build fallback), actual original proof validation + exact denial/retry + immutable supplied inputs. Resolution hooks independently reject client/catalog loads. Controlled proof fields and clock are INPUTS, not genuine native issuer/governance/cryptographic proof or productive dispatch/charges/physical closure.

Focused RED46 complete original file:7 total/6 pass/1 genuine assertion fail before implementation; JSON SHA256 5db81540a9f5a03d9df4717be2f4de72e2616106019bab40986c64d32617c074.
Initial repaired47 included TWO actual files:10 pass. A guessed nonexistent third test filename was silently unmatched; that invocation is NOT evidence for the missing qualification file. Corrected49 complete THREE actual files:14 pass, SHA eabd76530ff4025370ffb0399298ec049a105b1c0fc2ba46b443bbd795446551. Native53 complete same THREE files:15/15 pass/zero fail skip todo, SHA eae0ae549c511bf37810c5ee3c2ac8469efa23a87c7ab4274eb5101a43f00578.
Exact THREE files: tests/contract/agent-capacity/capacity-configuration.test.ts; tests/unit/agent-capacity/capacity/providers/provider-environment-profiles.test.ts; tests/unit/agent-capacity/capacity/providers/capability-ontology.test.ts.
Commands pinned PATH Node24.12, node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/sdk-provider-contract-native53.json; stdout/stderr retained same-basename.log.
Original SDK build48 PASS; actual npm pack --ignore-scripts --json --pack-destination allocated /tmp/capacity-sdk-candidate4-N1vAd7 consumes build without prepack. Archive treeseed-sdk-0.13.0-rc.122.tgz SHA256 5b751ea9d9b52872e94e5931402eca676de7216c315b620a9438d2c06ed3f67a. Installed ONLY private Agent node_modules via npm install --no-save --package-lock=false --ignore-scripts; original manifests/lock unchanged; original Agent build52 PASS. Native SDK test/scene statements added after that pack are NOT represented in this installed archive; provider product entrypoint bytes are.

Preserve fatal watchdog observations; batch the same complete assertions

Agent54 complete arbitration authority+native files:20/19 pass/1 fail SHA815e94f9809682cb67a0d0539db311e358571c3f5d270f53a6e5f892f22d7356. Native six-scenario publication case5041ms exceeds actual ORIGINAL DEFAULT5000ms, not a30sec allowance. Broad import removal alone was NOT a fix.
Source identifies repeated complete-offer schema parsing once per capability in ORIGINAL acceptance verifyProviderQualification. That SAME assertion helper now accepts one complete ordered supplied ontology batch, parses original offer once, checks every original definition/signature/provider/ref/status/tier/suite/time assertion. Empty, partial, duplicate and moved ontology denied; no cache, skipped receipt or duplicated policy. Original single-definition semantics retained.
SAME existing native case now passes the complete exact ontology once per offer; all six negative modes, byte-custody checks, independent original runtime children, original retry and every receipt assertion retained. No test/default/child timeout changed.
ONE new UNIT ORIGINAL tests/modern/canonical-offer-selection.test.ts "checks every exact qualification in one complete ontology batch without accepting empty partial duplicate or moved definitions or changing inputs" / agent.golden.execution-qualification-batch-unit-1; ORIGINAL golden/component maps, local-component-tests NOT managed E2E.
Focused55 complete THREE files canonical-offer-selection + arbitration authority + arbitration native:25/25 pass zero fail skip todo; native case4410ms within ORIGINAL5000ms. SHA d5d5842e96d3b9f042f04d5a3d45505e2e4e2f230870d9535c1ab9105b1d96a1. Pinned Node original Vitest config, JSON /tmp/capacity-agent-focused-20261004-OB6xb5/agent-provider-batch55.json and .log. Not a complete-suite waiver.

Full Agent56 ORIGINAL unfiltered vitest.config.ts:802/789 pass/13 fail/zero skip todo, SHA496fcdf428006d60f5827cd9627bb735e08666f4253b50c2dd3ddb69b2e83c8a. Five relay-CA EACCES, two full-load native watchdog failures, descendant physical absence failure, four canonical-custody missing workspace-authority failures, one clock-fixture >60sec caused by TWO sequential Date.now reads. No bypass/skip/fake CA/zombie-as-absence. Full56 also overlapped a whitespace-only assertion-helper edit after launch; therefore NOT held-byte custody/prerequisite proof.
Clock fixture corrected to ONE captured actual Date.now; SAME60sec and every assertion retained. Previous failure is an ORACLE/fixture clock-construction error, not repaired runtime RED. Agent59 now running complete unfiltered original config with --maxWorkers=2 and TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform, original watchdogs unchanged. No config/production cap change, tests omitted or acceptance launched. Pending is NOT passed evidence.

Original file-length/architecture checks57 Agent and58 SDK PASS, respective log SHA ed73d142605e4fb1a90eb7675a056c29b2dedead59bf0f0067b0adabfdd28923 /32e905f9c320e19d49ce9551bff67ab3b9beb31f25b607a42d065cf72e98f231; original diff check pass. New edits uncommitted: Agent HEADd496ce39e0a8335502120b9335879acaf813f21d /SDK HEADfd4e69e7f1a9b4e6c1f05362ec8125324df5eea5 unchanged. Diagnostic SDK node_modules symlink NEVER stage or install through.

Complete capacity/Agent doc coverage, strict source contracts, real provider/time/governance/whole schema/native all-attempt accounting and physical closure still OPEN. Relay CA readable authorized location previously requested, still unresolved. SDK/API full suites remain failed. No passing declaration from counts, helper optimization, local-component maps or draft PR pushes.

API branch published; terminal closure repaired — October 5

Capacity provider and Agent execution ONLY. No UI. Deleted automation remains absent; no new schedule/chat/goal. Objective remains OPEN; work continues.

API substantive commit aa0440a plus whitespace correction 7ee40fd is pushed and independently ls-remote read back exact. Protected staging freshly fetched and independently remains1817b0f0b817c6d6a211ecd11284c4bdda54ad2f. Draft #492 independently reports exact head/base, NOT merged/ready.141 scoped files in substantive batch; no node_modules/manifest/lock/product-neutral UI changes. Original cached diff check found two new trailing blank lines; historical aa0440a preserves that observation, subsequent ordinary whitespace commit fixes BOTH and cached check exits0. No history rewrite. PR attachment requested; app attachment100-identity limitation may prevent UI attachment, no unrelated artifact removed. SDKfd4e69e7/PR358 and Agentd496ce39/PR320 unchanged.

Owning repairs: completed result raw IDs cannot trim into a different identity; completed clocks bound to original attempt/start/deadline and actual report time. Native team/assignment/node transaction fences permit one matching terminal winner, reject moved graph/node authority, keep immutable ordinal and increment only retryable node revision. Return owns original native transaction, records original measured exactly-once settlement BEFORE terminal transition, requires finite nonnegative raw seconds, never fabricates post-completion charges. Terminal resources close through existing original TreeDX client then independently exact resource readback before SQL revocation. Workday cleanup includes already-revoked handles via stable assignment-ID keyset traversal; resource CLOSED read makes replay read-only and interrupted close retryable. No SQL-revoked/control CLOSED response is physical Kata/provider closure proof. Estimator store typing retains original instance methods and closed-proposal denial ordering; missing exact governing dependencies fail closed, no replacement service.

Preserved local observations, root /tmp/capacity-agent-focused-20261004-OB6xb5; counts OVERLAP neverSUM:

• terminal34:26/29PASS3FAIL, SHA c27025aae0a16d9d442201c27193fe2bc9d457243a86b491d1ae4b9d32d20eed. The stale-graph counterexample set literal2, which equaled canonical graph2 after original fixture authority repair; corrected to original+1 for BOTH graph/node fields. Historical false counterexample is an ORACLE error, not productRED. Remaining real missing returned settlement/native resource closure repaired.
• terminal-closure36:36/39PASS3FAIL, SHA27a0d61eba9f988b08318fd4b503fa089ffe36d8c10c66f853713ff5034cbdc9. Two real revoked-handle cleanup failures and retained unsupported literal reservation state 'settled'. Original schema/settlement authority is 'consumed', already asserted by completion; corrected SAME returned observation to 'consumed' with exact1usage/1ledger/replay/no rewrite controls retained. Literal correction is ORACLE correction, not fabricated productPASS; old failure retained.
• terminal-closure37:38/39PASS1FAIL SHA b94035661bc463fab17dfdfe7f0b2ca7a1cb5de228794b07ebf42ec8d9cc30fb: duplicate native close POST on replay, repaired by exact current resource read BEFORE optional close.
• terminal-closure39:39/39PASS0FAILSKIPTODO SHA796ea7988bc3ab8ba1d742df8ff09965bf9b011e74ce59b55be190a1ade671d1. COMPLETE original files: capacity/execution/assignment-result-completion; provider assignments lifecycle architecture terminal-performance,terminal-report-persistence,terminal-races; provider assignments architecture recovery-persistence,workspace-cleanup,workspace-cleanup-persistence. Command pinned PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --reporter=json --outputFile=/api-terminal-closure-repair39.json.
• source-offer-mapping42:78/84PASS6FAIL0skip SHA a46c7f2968c5ec8bb2bcacd6a792b1b4c39a4c7494cc675e601c3e3a5f8ce681. Complete original builder, new offer-freeze, living admission, source workspace, estimate integration, native Decision positive +denial files. Retained renamed-integration authorization, offer partial/qualification and frozen-deadline observations; actual native Decision row-without-content erroneously valid; native positive missing disposable TreeDX; introduced estimator dependency guard ordering failure subsequently repaired. Integration authorization now depends on explicit release grant, not class spelling; renamed unit NOT rerun yet, no newPASS claim. Clock observation remains open pending exact queue/preparation/productive authority review, no deadline extension or fitted expectation.
• terminal-admission-mapping44:49/49PASS0FAILSKIPTODO SHA a304e6561801a8d4a85ae61f8645a5db7bebf593b7d4463f8416bad19b225910. COMPLETE estimate integration; initial-admission; relocated admission/dependency-admission-authority+native; terminal-report-persistence; workspace-cleanup UNIT+native. Original CLI/config/watchdog unchanged, command same original Vitest config selecting these SEVEN full files, JSON /api-terminal-admission-mapping44.json. Includes closed-proposal denial and original renamed fixtures. NOT complete-owner prerequisites/acceptance.
• strict35 exit2 SHA46ebcc0c1c1d4a7adf4cdc219fdf472e1808e01403210c6365a3916c905008ef; strict38 log2f5965ab5601fb6a3ac8cd1d9fb313e8b2a8071a4b53408fe91cd338900e2d14 was actually tsc --noEmit -p tsconfig.json WITHOUT explicit --strict (original config strict:false), so NOT strict evidence; still exit2. strict40 original tsc --noEmit --strict -p tsconfig.json exit2 SHA207e115c77be7e78f69509507ddcfbec6aadc0de4a47603293666c4d83b99e7a, unwaived.
• layout43+45 exit0 SHA dd50c4448e119b3c0304f2074bb1eac87eaa7e58e55c6d0c21a78d119c0e8e24. Original npm run check:file-lengths AND check:file-architecture;27above350target, none>500 or>10direct files. No checker/config/allowance change.

Semantic test relocation only; every exact case name/assertion/ID retained and original registry testFile changed. THREE builder cases now tests/unit/control-plane/capacity/execution/architecture/offer-freeze.test.ts: api.golden.execution-integration-identity-unit-1, execution-offer-selection-unit-1/2; original builder remaining cases unchanged. TWO original Decision denial cases now tests/unit/control-plane/governance/proposals/architecture/proposal-decision-denial-native.test.ts; positive native publication stays original file, no native authority fabricated. Existing registry+component scene scope still local-component-tests, NOT production scene proof.
Initial-directory semantic relocation lookup (all source import refs and existing registry refs updated, NOT new cases/runner):
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-lease-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/leasing/dependency-lease-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-token-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/tokens/dependency-token-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-longpoll-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-longpoll-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-operator-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-operator-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-operator-postgres.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-operator-postgres.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-token-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/tokens/dependency-token-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-registration-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-registration-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-public-poll-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-public-poll-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-admission-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/admission/dependency-admission-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-poll-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-poll-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-registration-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-registration-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-admission-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/admission/dependency-admission-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-credential-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-credential-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-credential-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-credential-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-identity-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-identity-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-bootstrap-postgres.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/bootstrap/dependency-bootstrap-postgres.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-revocation-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-revocation-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-identity-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-identity-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-identity-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-identity-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-approval-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-approval-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-bootstrap-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/bootstrap/dependency-bootstrap-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-longpoll-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-longpoll-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-poll-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-poll-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-revocation-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-revocation-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-longpoll-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-longpoll-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-token-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/tokens/dependency-token-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-approval-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-approval-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-credential-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-credential-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-public-poll-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-public-poll-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-public-poll-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-public-poll-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-lease-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/leasing/dependency-lease-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-lease-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/leasing/dependency-lease-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-registration-fixture.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-registration-fixture.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-operator-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/enrollment/dependency-operator-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-poll-authority.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/polling/dependency-poll-authority.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-revocation-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/credentials/dependency-revocation-native.test.ts
tests/unit/control-plane/capacity/execution/architecture/initial/dependency-admission-native.test.ts -> tests/unit/control-plane/capacity/execution/architecture/initial/admission/dependency-admission-native.test.ts

Whole API314FAIL11SKIP/Agent9FAIL/SDK22FAIL and original strict failures remain OPEN; complete current candidate suites must run fresh after repairs, not reuse old receipt. Unknown/missing disposablePG/TreeDX/relayCA are blocked/unproven, no sudo/TLS/fake-env shortcut. No scene/campaign/model/Kata/activation/merge/release launched. Full canonical semantic equivalence, native all-attempt charges, managed clocks/continuations, physical descendant closure, real producers/accepted authority and SDK golden remain incomplete. Entire preceding body unchanged below.

SDK branch published; admission and lifecycle repair batch — October 5

Scope remains capacity provider and Agent execution ONLY. No UI, live acceptance, campaign, model, activation, merge, or release. Deleted schedule stays deleted. Full objective OPEN.

SDK commit fd4e69e7f1a9b4e6c1f05362ec8125324df5eea5 was pushed to codex/architecture-guideline-tests and independently read back exact. Protected staging was freshly fetched and independently remains 94094c39813618125266c1328c60e6c5ddaf569b. Draft treeseed-ai/sdk#358 targets staging; NOT merged or accepted. Forty scoped source/test/guarantee files committed; diagnostic node_modules excluded and manifest/lock unchanged. Latest SDK file-length+architecture check exit0, sdk-layout33.log SHA256 32e905f9c320e19d49ce9551bff67ab3b9beb31f25b607a42d065cf72e98f231. Whole SDK contracts22 failures and strict failures remain unwaived. App PR attachment failed because the thread exceeds100 identities; no existing attachment was removed. Agent d496ce39e0a8335502120b9335879acaf813f21d unchanged. API dc0f2ad plus uncommitted repair/tests; NOT pushed yet.

API exact candidate changes: complete handler pagination fails closed on malformed/truncated/repeating cursor tails and duplicate YAML identities; exact canonical replay including original selector inputs; principal/executor/model bindings; exact native node source/authority/project/workday/class/current revision and completed predecessor Result/independent approval before reservation and in owning SQL fences; finite nonnegative counter limits. Original initial-admission fixture now uses canonical status created and existing original0002 lane migration, not widened copied CHECKs. Original legacy UNIT fixtures enriched with exact executor/principal/committed attempt/ready authority, without assertion removal.

Local diagnostics root /tmp/capacity-agent-focused-20261004-OB6xb5; overlapping counts NEVER summed. All commands below use pinned PATH and original vitest.control-plane.config.ts, JSON output and separate raw log. NOT full-owner prerequisites or acceptance:

• expanded24 eight COMPLETE files31/46PASS15FAIL, SHA e012d6339875d46dd3d43db2620a9beecc44d93d352869683c41596152edc418.
• expanded25 SAME46/42PASS4FAIL, SHA d3f5c0c700fceaa6104ec7a09d568cb0cfdff8931e999928416ba8ee8bbd79df.
• expanded27 SAME46/45PASS1FAIL, SHA f2688bbe1b2f81693c3caa5c44a35232cbe8d73216e6a13a4002d4ae9a8a9d8b: original admission counter0 versus frozen ordinal1 remained genuineRED.
• final admission31 NINE COMPLETE files52/52PASS0FAILSKIPTODO, SHA850277ad419d183eb81745d7716f575a8775af389fabe7b9aa43bac52025cb27. Files: tests/unit/control-plane/capacity/execution/living-execution-admission.test.ts; architecture/initial/{initial-admission,counter-scope,profile-inventory,dependency-admission-authority,dependency-admission-native}.test.ts; architecture/{admission-replay-authority,admission-replay-native}.test.ts; tests/unit/control-plane/capacity/agents/handler-inspection.test.ts. Command node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --reporter=json --outputFile=/api-admission-complete-files31.json.
• closeout28 TWO COMPLETE original tests/unit/control-plane/capacity/execution/living-workday-lifecycle.test.ts + graph/architecture/workday-closeout-persistence.test.ts38/38PASS0FAILSKIPTODO; SHA bb7e141c204f234f70def7423be105cd90be926947acb12c5388797d527210e5. Product single exact completed Reporter TreeDX reportRef; no plural replacement; missing/malformed/failed Reporter never ends the run. Conversation explicit-stop branch remains an open single-report semantic audit, NOT universal closeout proof.
• API strict26 exit2 original --strict --project tsconfig.json; SHA d340ea03349d475555ba4b0f5fef17b4ca3dc3d33b8f5c514996e3a6564ee833. Full diagnostics unwaived. API layout26 exit1 SHA e6056f0f2b05cc1aabe744994cfc7b8be5f8d134695bf49e16356be5a218fe17:552-line assignment-attempt-builder test and539-line proposal-decision-native test exceed500. Architecture stage unreached. git diff --check passed before later edits; not current whole layout PASS.

New exact UNIT maps in ORIGINAL source-workspace-service.test.ts:
1 "binds canonical source authorization to the unchanged frozen ordinal rather than incrementing an operational lifecycle counter" / api.golden.canonical-source-ordinal-unit / step canonical-source-ordinal-unit.
2 "denies a moved missing malformed or mismatched canonical source ordinal before credential acquisition without rewriting failed inputs" / api.golden.canonical-source-ordinal-denial-unit / matching step.
Existing golden registry/component scene scope local-component-tests; NOT managed E2E. Positive includes safe-integer maximum, exact repeated authorization without ordinal increment; negative0/2/-1/null/undefined/string/fraction/NaN/infinity retains all bytes and performs no credential/upstream/write. Existing readonly noncanonical source tests retained. Original terminal performance UNIT strengthened exact attempts; original native initial admission, terminal completion/failure/return/cancellation/recovery ordinal assertions retained. Agent managed original ordinal custody already mapped; NO scene executed.

ordinal-red29 FOUR COMPLETE files52/39PASS13FAIL0skip, SHA78bc629207f53f55e6c29708cacdd35790849a17edf81ab0e40cb512888f623b. Files original source-workspace-service, provider lifecycle architecture terminal-performance +terminal-report-persistence, provider architecture recovery-persistence. Genuine new source ordinal/rejection and projection RED, actual recovery18-vs19 parameter failure retained with all prior terminal clock/return/concurrency/cleanup failures.
ordinal-repair30 adds complete initial-admission and terminal-races files68/60PASS8FAIL, SHA0a11ca150d091e2596a8353437019ac4100b4a8b6f458d50a1a3532ffb38c22e. Canonical ordinal now persisted at admission, unchanged at terminal/recovery and source, exact terminal projection; unknown productive and coerced/negative seconds deny. Actual original recovery cutoff parameter repaired without productive deadline extension. Real native recovery regression passed. Remaining terminal concurrency/clocks/return settlement/open workspace are FAIL.
terminal-authority-repair32 FIVE COMPLETE files29/13PASS16FAIL, SHA a5b162a437a35991d4e4517a9de728c1beed4fb681960f881fee5c99b21739ac. New owning transaction fence refused incomplete old native fixture graph authority; not silently counted as productPASS. Missing-result diagnostic order and original canonical fixture graph_revision repaired without lowering checks. SAME batch34 currently underway after clock/raw identity and transaction/native node revision fences; no result claimed here.

Native PGlite SQL is NOT independent PostgreSQL connections; supplied authority/clocks/provider measurements/control HTTP are NOT signed enrollment/native model charges/governance production/Kata/physical teardown. Counter-init race with changed native authority after preliminary read remains an explicit concurrency gap. Full API314FAIL11SKIP, Agent9FAIL including unreadable relay CA and descendant physical closure, SDK22FAIL/strict failures remain OPEN. No controlled CLOSED response, revoked SQL, component totals, or fresh diagnostic process is full semantic acceptance. Every eventual scene requires fresh COMPLETE ALL exact participating-owner UNIT+REALintegration first with held heads/bytes and zero FAIL/SKIP/TODO/missing/filtered/inconclusive. No old receipt reuse.

Entire prior Issue body unchanged below.

Complete API diagnostic and exact replay/inventory repair — October 4

Capacity provider and Agent execution ONLY; UI remains out of scope. Deleted automation remains deleted. No acceptance, campaign, model, activation, merge, or release launched. All prior body bytes retained below.

Local diagnostic root: /tmp/capacity-agent-focused-20261004-OB6xb5. Candidates API dc0f2ad plus UNCOMMITTED changes; SDK c1c61930dda573ba5eebf46eee768390fbeee77e plus UNCOMMITTED changes; Agent d496ce39e0a8335502120b9335879acaf813f21d unchanged. No new SDK/API commit or push this checkpoint.

• COMPLETE original API control-plane configuration, command: PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts --reporter=json --outputFile=/api-complete-private20.json; exit1, 1792 total /1467 passed /314 failed /11 skipped. SHA256 5ad783b08425a3e1120af84d527d704b520a9844b0e7435f4ae4a0af052f8943. Complete diagnostic FAILURE, NOT passing prerequisites. Missing disposable PostgreSQL/native TreeDX environments and old skips remain unproven; product/fixture failures separately retained. Initial report printing was truncated; narrower file-level and exact targeted observations recovered, not a whole failure-cause audit.
• SDK original strict candidate12 exit2; log SHA256 d6b15ff33b742e34f211c7f6f64510dbe5b6a2736d339bb0819da7b007472468. API private strict19 exit2; log SHA256 4bef4d77accd075546562686c246c7f0e1919047ea248afccc4f1de79eb32b47. Type-only annotations removed some introduced errors, neither strict run passes; no disabled checks.
• Agent descendant native21 exit1, 6 total /5 passed /1 failed, SHA256 15b779aca3acf4fd3466a1584708fe2132cf1e8c5a32ac3735bb360c56e7d223. Original cleanup refuses an unproven descendant identity; physical absence NOT established. No signal to unproven PID, no zombie-as-absence waiver. Relay CA EACCES remains external authority boundary.

Owning API repairs, historical assertions retained

Original agent-query-service.ts acceptedAgents now walks ALL original keyset pages, decodes original SDK cursor and denies absent/malformed/incomplete/repeated cursor observations instead of returning partial handlers. Original handler-inspection UNIT3 strengthened in place with eight invalid tail shapes and exact successful retry/byte immutability; original native persisted public-operation and >200-class SQL tests retained. Existing api.golden.execution-handler-inspection-unit-1..3/native-1..2 bindings unchanged.

Original living-execution-admission.ts validates exact supplied principal team/provider plus existing nonempty IDs/executor/model before admission. Replay requires native isDeepStrictEqual of ENTIRE stored AssignmentAttempt plus original root team/provider/node/revision, including post-batch winner readback; no node-only replay authority. No new schema, runtime policy, receipt, runner or role hardcoding. Existing complete admission replay UNIT9 + native SQL8 mappings api.golden.architecture-admission-replay-unit-1..9/native-1..8 retained.

Exact focused command (all three COMPLETE original files): PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/capacity/agents/handler-inspection.test.ts tests/unit/control-plane/capacity/execution/architecture/admission-replay-authority.test.ts tests/unit/control-plane/capacity/execution/architecture/admission-replay-native.test.ts --reporter=json --outputFile=/.json.

• red22 BEFORE product repair: exit1,22 total /6 passed /16 failed, SHA256 cc17f7666a60d67c6045c6ab4ad2e112cb7e7badac9b6d391a890567a449179e.
• repair23: exit0,22/22 passed /0 failed/skip/todo, SHA256 2510b87e51205617ed7a531ef8b82f264dc73356a58ba7aecae7c97eb8c9566c.
  Counts overlap, NEVER sum. Original local-component-tests scene declarations are NOT managed acceptance or executed scenes. Supplied profiles/principals and retained replay rows NOT native governance/authentication/all-attempt charges/Kata/physical closure.

Complete API run also exposed a fixture error: initial-admission-fixture.ts passed status pending to STRICT canonical AssignmentAttempt whose original enum requires created; corrected ONLY that supplied input to created. Actual admission still creates the original pending operational row; no public enum widening/assertion removal/deadline extension. Prior Zod failures preserved as fixture failures, NOT product RED. Expanded24 eight-complete-file run underway; no result claim. Git diff --check exit0; no full strict/layout/coverage PASS.

Remaining full314 failures/skips, SDK strict/schema/record custody, Agent native clock/physical descendants/full-load fairness, native PostgreSQL/TreeDX and whole managed scene/SDK golden remain OPEN. No completion claim.

Execution admission and SDK archive repairs — 2026-10-04 (OPEN; no acceptance)

Capacity-provider/Agent execution only; no UI edits or scheduled updates. All histories below retained. SDK golden NEVER passed; no scenes, campaign, activation, model/Kata run, release or merge. New source/test bytes below are UNCOMMITTED, not in API dc0f2ad or SDK c1c61930dda573ba5eebf46eee768390fbeee77e. Agent d496ce39e0a8335502120b9335879acaf813f21d remains the independently pushed candidate.

Verified local diagnostics (not Actions or acceptance prerequisites)

All reports/logs under /tmp/capacity-agent-focused-20261004-OB6xb5; JSON SHA256 below. Counts overlap, NEVER sum.

• SDKcloseout-events-repair8 complete original workday-closeout UNIT + command-tree + workday-allocation: 33/33 PASS, 0 skip/todo, 92d689601c6adf69ef0aee1c47d0b78dcb963be2d6db1c84f88b79acb8cf14f7. Repair7 invocation omitted required TREESEED_DEVELOPMENT_WORKSPACE_ROOT and failed 1; not product RED/waiver.
• SDKreview-gate-repair9 complete original golden-product UNIT + command-tree: 24/24 PASS, 21997146b4891e46bce5d5c3ff3f466c8e78f89ec8504f6a9a29a2f4196f4b10. Independent Reviewer requires all three measured release commands, own result/predecessor and exact candidate/repository; NOT actual managed review evidence.
• SDKcomplete-contracts10 original full config: 440/418 PASS/22 FAIL, 0 skip/todo, 2ef55d0ad0467e2eb09e33b2188d412e479e6669f076d7af68a4ebad212726d2. Remaining whole-schema semantic equivalence, canonical record joins, missing generated standards bundle and archive defects remained fatal. Unnecessary MCP exposure added one catalog failure; removed that exposure, existing REST/CLI events retained, no assertion weakened.
• SDKarchive-custody-repair11 complete original package-archive + control-plane-operation: 14/14 PASS, 70e0c4e70dbf04bb1e57df51ac451e4636b982edd87d57d1995d312186bb9feb. Public standards:acceptance now compares the declared export map and every declared JS/d.ts target's untrimmed bytes with the original held candidate. Portable workspace fixtures now consume actual candidate output bytes, not synthetic stub declarations. Existing cases/negative assertions retained. This is NOT all transitive file/dependency/published-installed closure.
• APIprovider-priority-repair13 complete timestamp + start-native + living-graph-contract: 29/18 PASS/11 FAIL, 3e1902ca48642a69162d6315b837f733b5553a99483f78cb2879ccbe6d947d1c. Old diagnostic SDK dependency was insufficient for priority. Other admission/graph failures not waived.
• APIpreflight-authority16 complete selection-preflight + start-authority + start-native: 40/36 PASS/4 FAIL, 6667faec626682798162fa3a2be08909533f7d500dc21a796a9b65203ef97195. Original explicit-selector UNIT and real public-service/native SQL denial cases pass after using EXISTING validateDecisionAuthority for every selected ID and rejecting malformed raw array members before trim/dedup. API repeated-selector positive retained; shared SDK normalization orders code points. Native invalid governance rows are deliberate INPUTS, not a genuine accepted Decision creation.
• APIadmission-custody-red17 complete selection-preflight: 23/21 PASS/2 genuine FAIL, 4a16d9e1a97289e016c2e33fc1aaedff4aebf21aadedf136aab2b4d5092f12be. BEFORE repair, original start admitted queued/failed/terminal existing runs and changed library/profile authority.
• APIadmission-custody-repair18 complete same three original files: 42/42 PASS, 0 skip/todo, cee0e5d13e78f0d3e9631c7c824632cb77fcefb132ec62cb0d6407cae879fbdf. Original receipt now binds project repository/exact library/profile revisions; start denies original elapsed window and retained nonrunning run without new receipt. Native exact-ref intake denies substituted resolved commit. Original event-failure history/failed run retained and same-input retry denies; interrupted successful receipt recovery remains valid. Demand priority now comes from canonical node priority (default0), not array index.

Exact added behavior maps / original owning harness

Original API tests/unit/control-plane/capacity/workdays/selection-preflight.test.ts:
1 UNIT "denies expired original admission and every nonrunning retained run without a start receipt or changed authority" / api.golden.architecture-start-custody-unit-1 / step architecture-start-custody-unit-1.
2 UNIT "binds preflight to exact project library and agent profile revisions before any start write" / api.golden.architecture-start-custody-unit-2 / step architecture-start-custody-unit-2.
Original guarantees/verifiers/golden.verifiers.yaml + guarantees/agent/golden/scenes/component-boundaries.scene.yaml bind both. Existing REAL start-native cases/bindings for stale membership/profile/library/policy, content faults, required-event failure/history, interrupted successful receipt recovery and original expiry retained. Component scene scope local-component-tests, NOT managed E2E; scenes unexecuted. Existing managed start/profile/context custody remains mandatory, NOT satisfied by supplied UNIT projections, native PGlite or controlled HTTP. Genuine accepted classed Decision production, nonempty authority digest provenance, provider charges and physical closure still OPEN.

Exact commands / candidate isolation

Pinned PATH /tmp/sdk-native-node2412-PjB5qe/bin:$PATH throughout. SDK original command: node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts [complete named files above or none for full10] --reporter=json --outputFile=/.json; TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform for canonical/closeout/full suites. API: node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/capacity/workdays/selection-preflight.test.ts [plus tests/unit/control-plane/capacity/workdays/scheduling/architecture/workday-start-authority.test.ts and workday-start-native.test.ts for16/18] --reporter=json --outputFile=/.json. Separate same-basename logs retain stdout/stderr.

API original node_modules diagnostic symlink recoverably moved ONLY to /api-original-node-modules-link; npm ci --ignore-scripts creates private dependencies (private-dependencies14.log). SDK original build:dist passed (sdk-build-candidate3.log), npm pack --ignore-scripts --json into fresh /tmp/capacity-sdk-candidate3-rkIfyu (sdk-candidate-pack3.json); installed ONLY API private tree --no-save --package-lock=false --ignore-scripts (api-private-sdk-candidate15.log). Package manifests/locks unchanged. Same-version local archive is diagnostic candidate, NOT published release/dependency lock closure or latest Agent installed SDK. Npm reports 6 vulnerabilities (1 moderate,5 high); no audit-fix bypass. SDK primary dependency symlink still NOT private closure.

SDK build/package-tool implicit types and provider JWK/CLI option literal typing repaired without disabling strict checks. Strict SDK candidate12/API private19 and Agent native descendant21 are underway; no passing claim until exact results. Prior SDK/API strict failures remain unwaived. A read-only report-inspection node -e syntax error occurred, corrected; not tests/compiler/product RED. Wrong-owner/absent-path READ errors retained as read errors only, no whole-source audit claim.

No allowance/deadline extension, skipped checks, fabricated authority/citations/usage/PASS, failed-history deletion, UI change, direct heartbeat/TOML mutation or new coverage channel. Every eventual scene still needs fresh complete all participating-owner UNIT+REAL integration on exact held candidates FIRST. Remaining Agent CA permission boundary has no supplied authorized readable path; do not bypass TLS/permissions. Whole delivery OPEN.

Verified repair transport and native concurrency — 2026-10-04 (delivery still OPEN)

Agent commit d496ce39e0a8335502120b9335879acaf813f21d was pushed to the existing architecture-guideline-tests branch; independent remote ref read-back was exact. Existing Draft Agent PR320 was updated, not merged. Original full typecheck, original file-length/architecture checks and diff check passed before that commit. Complete Agent suite18 remains 801/792 PASS/9 FAIL, no skip/todo; the later complete arbitration-native20 file is 13/13 PASS but does NOT waive the two full-suite startup failures. Full-suite and focused counts overlap, never sum. Five authorized relay-CA reads and physical descendant closure remain unproven; no TLS/permission bypass or deadline extension.

Native API protected-event regression: two competing private payloads with one event ID were both acknowledged while only one row persisted (concurrent-red9: 7/6 PASS/1 genuine FAIL, SHA256 e0208bfe3efa4af178b2b1ff5b6a5fbd65fc704e08fb0c4752cc2645fcde4b7d). Original public service now validates the winning native row's exact encrypted AAD, decrypted private bytes and public fields; concurrent-repair10 complete original file: 7/7 PASS, SHA256 451e0064edf9a82464594e9a2eadd08000096d470a5b3f19ac0a0e5ecbf205a0. The unchanged 3-second productive authority was used. PGlite overlap is NOT independent PostgreSQL connections, authenticated HTTP, provider-produced usage or physical closure. Earlier planning failure was a real fixture batch-result omission, then an executor FK/class-ID fixture error; they were not relabeled product RED. Actual native start and SQL writes now execute; supplied executor row is controlled input, not qualified authority.

SDK original catalog now rejects own retired modeRunId (including undefined) and malformed protected-event authority before JSON/fetch; valid native transport and exact retry remain. Single exported WorkdayIntent validation/normalization is consumed before both direct/nested body transport: rejects malformed/trim-duplicate selectors and all four derived fields; code-point ordering preserves case/canonical distinctions and omitted selections. provider-intent-repair6 complete three files: 51/51 PASS, SHA256 2b95f1f25d6e64d16b8141f655985e230e643519ae9e72032e1638338fe8f14d. No caller digest/governance authority invented.

Exact focused commands (NOT acceptance prerequisites), diagnostic root /tmp/capacity-agent-focused-20261004-OB6xb5:

• Agent: PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts tests/modern/provider/architecture/arbitration-native.test.ts --reporter=json --outputFile=/agent-arbitration-native20.json. SHA256 4a087fc32045e96e432eba7a0922055ebe38dd957cd61f1c6247041e2e499ee3.
• API: same pinned PATH, node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/providers/provider-assignment-timestamp.test.ts --reporter=json --outputFile=/api-protected-event-concurrent-{red9,repair10}.json.
• SDK: same pinned PATH, node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts tests/unit/control-plane-client.test.ts tests/unit/operator-contracts/workday-lifecycle.test.ts tests/unit/agent-capacity/capacity/providers/capacity-provider.test.ts --reporter=json --outputFile=/sdk-provider-intent-repair6.json.

API and SDK new repairs remain UNCOMMITTED; their original typechecks failed (619 API diagnostic lines /109 SDK before latest repairs). This does NOT classify every diagnostic as preexisting. Diagnostic dependency links are not staged or complete candidate closure. Original scene/guarantee mappings retained; native managed protected observations/canonical custody/golden acceptance NOT run. No acceptance, campaign, activation, model, merge or release. Schedule remains deleted. Entire prior Issue body retained below.

Canonical priority push and current continuous repair evidence

Platform canonical schema ONLY committed and pushed 42a67d98207211f3b84018d04af8c58090645d97 on existing codex/architecture-oracle-corrections; independently exact remote read-back. Draft PR625 treeseed-ai/platform#625 against verified staging e550b0172e0f6be86f9c1317b3e1ffc25265204a. Parent51eab9b retains resolved single-report/expected-maximum decisions. Dirty architecture/assignment prose untouched. Required app PR attachment attempted but attachment identity count exceeds100; PR exists, no unrelated attachments removed.

Actual tracked canonical authority now consumed by Agent original record-custody tests. Six genuine custody14 failures repaired in test-only owning verifier: raw SDK parse cannot launder supplied identity; exact RFC3339/calendar validation; represented aggregate inventory/unique measurements; every supplied failed result exact owning attempt/status/native usage; unique results/original result clocks; lease/reservation closure not before acquisition. ONE target-derived shape implementation extracted to tests/acceptance/workday/support/canonical-record-shape.ts because original record-custody.ts was486lines before repairs and500 hard maximum; no copied schema/new runtime policy. Exact tracked target custody checked before/after traversal. Complete two-file canonical-custody15 26/26PASS, SHA256 a8d0031cb3101816d9e1fccf053f7c8418d0cac2dad36bb626ef3d55b82497d3.

Original Agent complete private18:801/792PASS9FAIL/0SKIPTODO; SHA25659bd108f6f3404ceefd512b0c233a543bc0aac7eea868e02bed43f33fa669d0f. Five actual host relayCA EACCES remain pending readable authorized CA; two native arbitration startup timeouts; native malformed-quota child failure; descendant physical residue/safety identity failure. Mixed real Vitest cases now pass after parallel independent children (each maxWorkers1), allSettled retains all outcomes before cleanup; source prompt wording assertion matches same generic exact-source contract. Native startup17 complete23/23PASS is focused evidence, NOT substitute for complete failures. No deadlines/allowances extended. No acceptance.

Original SDK complete contracts4:440/404PASS36FAIL/0SKIPTODO, SHA256857761b1ed38a6ee75f107a8fa4abeb56a9c129550ff93ef51c8f28d2ee4772f. Includes genuine immutable-assignment/whole canonical schema/reportRef/decision normalization/golden release/event-command and provider request failures; absent standards bundle remains absent, not skipped. Latest original provider protocol file repair5:15/15PASS, SHA256609b5ed96ab7463145e068a917bb97c8168738660056339b1e22a2128732bbc7. Four original UNIT/native HTTP protections retain all invalid/own-undefined/negative/concurrency-free retry assertions; additional empty-object denial. Existing authoritative operation catalog now rejects own modeRunId before serialization and requires nonempty protected object/exact lease+runner/nonnegative safe integer sequence. No new provider transport/policy path.

API original protected ordinary event regression red2:7/5PASS2FAIL; genuine UNIT encryption/lease bypass, native blocked EARLIER planning start. Existing service repaired with original DiagnosticEnvelopeService + WorkdayEventRepository only: exact team/member/current lease/expiry/runner/sequence, bounded immutable JSON private payload, encrypted-only event metadata/AAD and retained matching sequential replay/changed-byte conflict. Start6:7/6PASS1FAIL SHA256b2123872b0bf410e6285ad94806c2d25bba7f893bed2aafaee4a7461cf6ca7bb. Native original start fails Cannot read properties of undefined(reading0) in WorkdayRunWriteRepository.update:30; actual delegated source failure + failed native run row retained. No seeded successful replacement or native diagnostics persistence PASS. Investigating exact owning batch fixture contract next. SDK/API original strict checks still fail (existing diagnostics unwaived), no passing typecheck claim.

Commands (exact owner cwd, pinned PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH):
Agent complete: TREESEED_DEVELOPMENT_WORKSPACE_ROOT=/home/adrian/Projects/platform node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/agent-complete-private18.json
SDK complete: node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts --reporter=json --outputFile=/tmp/capacity-agent-focused-20261004-OB6xb5/sdk-complete-contracts4.json
SDK focused: same original config tests/unit/agent-capacity/capacity/providers/capacity-provider.test.ts -> sdk-provider-protocol-repair5.json
API focused: TREESEED_SDK_SOURCE_ROOT=/home/adrian/.local/state/treeseed/worktrees/architecture-guideline-tests/sdk node node_modules/vitest/vitest.mjs run --config ./vitest.control-plane.config.ts tests/unit/control-plane/providers/provider-assignment-timestamp.test.ts -> api-protected-event-start6.json
All reports under /tmp/capacity-agent-focused-20261004-OB6xb5 LOCAL diagnostics, not Actions artifacts/acceptance/prerequisites. New owner changes uncommitted; Agentdf9/API dc0/SDKc1 HEADs unchanged. No live campaign/model/Kata/activation; full objective OPEN. Entire previous Issue body preserved below as historical evidence.

Qualification and canonical-input follow-through

SDK-owned UNIT added in original tests/unit/agent-capacity/capacity/providers/capability-ontology.test.ts: “requires current unique qualification at the declared core tier before advertising any unchanged provider offer”, sdk.golden.execution-qualification-unit-1 / original component-boundaries execution-qualification-unit-1. Complete original file sdk-qualification-unit3:4/4PASS, all14 malformed/missing/duplicate/tier/status/time/ref/evidence observations independently immutable; supplied signature/suite inputs NOT executed conformance evidence. Corresponding existing Agent native offer publication / public managed qualification read-back obligations remain necessary, no scene PASS.
Agent qualification signature custody retains EVERY signature/evidence negative and independently signs controlled failed/revoked history; the actual publisher now denies those templates, never advertises them. Initial custody12 two failures were new fixture errors (shared source receipts and foreign key-id), not product regressions; corrected before custody13 complete4/4PASS. Old unsafe failed-advertisement positive is retained in predecessor commit/history, explicitly superseded by deny-before-publication security contract.
Strict8 PASS. Native capacity/custody/broker native11 complete47/38PASS9FAIL: all native capacity tests now PASS; five host relayCA EACCES and four exact canonical-source-input failures remain. Terminal fixture repair passes, zero-window tool-pump fixture corrected, no source authority fallback. Original fixture-authority-repair9 complete39/39PASS.
Only dirty Platform canonical schema diff is the directly human-authorized optional safe-integer work-item priority / unchanged node projection. It must become a real tracked specification commit before exact canonical-input tests can consume it. Fetch verified Platform staging e550b0172e0f6be86f9c1317b3e1ffc25265204a; existing codex/architecture-oracle-corrections HEAD51eab9b remains prior authority. Will commit ONLY docs/agent.schema.yml on that existing branch; unrelated dirty architecture/assignment historical prose retained, no manufactured temporary Git authority. No functional Platform implementation. Complete local suites remain diagnostics, acceptance gates still held.

Capacity-provider and Agent execution — continuous scoped delivery

Continuation of #490 (body independently retained260962 chars/261271UTF8 bytes; only873bytes room), not a new task or coverage side channel. #490 and all predecessor history immutable. Scope: docs/agent-assignments.md, docs/agent-architecture.md and linked acceptance for capacity provider/Agent execution ONLY; related SDK/API/CLI owning boundaries in scope, UI deferred. Scheduled heartbeat deleted, no recreate. Authoring gate released for scoped implementation/verification. Optional governed work-item integer priority projects unchanged onto derived Actor/Reviewer nodes; missing=>0, higher first, exact existing tie-breaks. No further human choice needed.

Full objective OPEN; SDK golden NEVER passed/API jointly gated. Unit+real integration+native managed scenes/guarantees required. Before EVERY acceptance invocation fresh COMPLETE participating-owner unit+real integration on exact held candidates, zeroFAIL/SKIP/TODO/missing/empty/filtered/inconclusive; old receipts cannot admit scenes. No deadline/allowance/check weakening/fake charges/citations/PASS. Settlement precedes completion. Genuine failed evidence retained.

Exact current candidates and remote evidence

Agent branch codex/architecture-guideline-tests HEAD df9a9038a54334373cd11d401b1d4d74a5ff3991 already pushed; PR320 draft treeseed-ai/agent#320. Protected staging6c0f0bf8ffe22c1bd20ca7034d8a2a5fa225d41c fetched unchanged. Existing Actions37241468533/job111550873936 completedFAIL798/762PASS36FAIL; typecheck/length/architecture passed, scenes/pack/artifact upload skipped. Logs inspected, no rerun/merge/release. New successor edits UNCOMMITTED.
API dc0f2ad; SDK c1c61930dda573ba5eebf46eee768390fbeee77e; CLI00afef41cf4ddfcc638ffe80fdc7e2fc6c72c737, existing dirty authoring preserved. PrimaryAgent319 held unchanged.
Evidence root /tmp/capacity-agent-focused-20261004-OB6xb5. Local JSON/logs NOT Actions artifacts. Private Agent npm dependencies consume separately rebuilt original SDK npm archive (qualification pack2 supersedes pack1 archive bytes); no manifest/lock/published dependency closure claim.

Completed local repair observations, OVERLAP never sum

• Strict7 and original Agentbuild2 PASS.
• One shared ALL-sample usage reduction Kernel+terminal runner: diagnostic samples retained informational zerocharge; unrounded native sum; one terminalaggregate before delivery. Genuine terminal-samples-red1 retained. Complete runner/Kernel/review terminal-samples-repair2 50/50PASS; boundary/runner/Kernel cutover-terminal5 61/61PASS.
• Direct managed v5 clean cutover removes original legacy-manifest.ts; malformed/retired/translated authority denies before identity/accounting/status writes. Same18packaged plan oracles executed in independent concurrent inputs, unchanged original5000mswatchdog.
• Exact original fairness ranker under existing store lock retains preclaim metadata; idle slot polls remaining eligible teams. Old native selection/idle tests now PASS focused; complete concurrent suite still has timeout/accounting cases.
• Recovery exact canonical observed/frozen authority before releasing local custody; no foreign/current JSON fallback.
• Agent complete-private7 originalfullVitest config799/779PASS20FAIL0pending/TODO exit1. Remaining includes host relayCA EACCES5, native qualification/preclaim timeouts2, native descendant teardown1, capacity accounting race1, canonical source-input/fixture failures5, conflicting legacy signing tests2, malformed lane fixture1, source-read assertion after pending deletion1, invalid elapsedclock fixture1, duplicate prompt instruction1. No acceptance launched.

New exact receipt regressions and original binding

UNIT tests/modern/lease-recovery.test.ts — “requires an exact returned assignment receipt before finalizing recovery and retains every malformed successful transport reply” — agent.golden.execution-recovery-receipt-unit-1.
REAL owning recovery+SDK/native HTTP+durable files tests/modern/provider/architecture/recovery-native.test.ts — “native recovery retains exact failed lease and output after malformed successful return receipts and releases only the unchanged confirmed retry” — agent.golden.execution-recovery-receipt-native-1.
Original golden.verifiers.yaml/component-boundaries.scene workflow exact IDs (steps omit agent.golden.), local-component-tests NOT managedE2E. All older cases/assertions retained.
Exact command: PATH=/tmp/sdk-native-node2412-PjB5qe/bin:$PATH node node_modules/vitest/vitest.mjs run --config ./vitest.config.ts tests/modern/lease-recovery.test.ts tests/modern/provider/architecture/recovery-native.test.ts --reporter=json --outputFile=/agent-recovery-receipt-{red1,red2,repair3}.json. Logs matchingnames. red1 UNITgenuine released-on-absentreceipt; native initialretry fixture wrongfrozenleaseID notproductRED. red2 correctednativefixture BOTHgenuinefail12/10PASS2FAIL. Product now requires returned.id===heldassignment and statusreturned before finalize. repair3 complete12/12PASS no skips/todo; exact failedcause/output/lease/history retained, samebody retry finalizesonce. Controlled response INPUT not API-native charge/authentication/physical closure; full managed slot/settlement/native producer scene still required.

Next finite work, no artificial checkpoint stopping

Finish known20residuals without replacing mandatory native inputs/faking authority; SDK-owned qualification regression/tier/time/digest; native ALL-attempt usage/wholecanonical schemas; protected private provider diagnostics through API original envelope; original timing/continuation/native provider-managed dispatch and all17 fairness; Deployment exact broker/Kata source/physical closure; priority owning graph projection/revision/ready gates. Keep existing unit/integration/native scene mappings aligned; complete all-owner fresh prerequisites before SDK acceptance. Missingenvironment stays unproven, no skip/source fallback/host authority bypass. No UI or unrelated authoring.