[adrianwebb]

Outcome

Workday admission now resolves one configured closeout Reporter, records that selection before activation, and publishes exactly one reporting node. Cooperative filters retain the standing reporting activity while preserving the selected planning contributors. Missing, ambiguous, foreign or moved authority fails admission.

Work authority

• Work item / Issue: Complete accounting transition observations for strict Agent acceptance #553 continuation of SDK exploratory source custody and canonical workday closeout repair #515; Agent Keep addressed communication within its parent workday allocation #368; Continue strict acceptance binding delivery — 109 complete / 68 open sdk#424 contract and Continue strict acceptance bindings: exact remaining checklist and installed delivery sdk#408 checklist.
• Proposal / decision: Human-approved strict acceptance plan and explicit exception allowing only canonical Reporter-selection API/SDK contract repair.
• Assignment / checkpoint: Criterion127 producer authority. Dependent Agent/installed/staging verification remains required.
• Actor: Codex implementation agent.
• Human authority: Adrian / @adrianwebb.
• Agent / capacity provider: Codex; no managed campaign invocation claimed.
• Exact base ref: staging24150e2236a443e98b2b80f77bbb05a307e37365.
• Exact head ref: codex/single-reporting-selection-127 8b013c2; tree34f87ae158722fc0b67becdd06ee5ee7232acaa9.

Contributor mode:

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Run fresh2140API+200held executingReviewer assertions before949component steps, retaining all native PostgreSQL supplements and all-language TreeDX prerequisites. Independently audit exact source, report and produced archive; require current verify/validate/AGPL authorization and ordinary staging read-back. Agent then consumes that checked archive with its selected SDK guards and actual installed-owner proof. Criterion127 remains OPEN until dependent delivery.

Changes and commits

The existing participant resolver selects one configured reporting profile from participating projects. Explicit selection must resolve exactly once; omission is allowed only when unambiguous. The existing scheduler and public preflight retain reportingAgentId in the canonical applied plan and original parameters. The original sourceRef digest includes the resolved identity, so changing the selected Reporter changes immutable graph authority.

Seal automatic resolution before create can observe changed profiles. Missing Reporter activation fails before receipt/admission mutation. Preserve the original unknown/empty cooperative-selection denials, then reserve existing configured reporting activity independently of planning filters. Excluded Reporters receive reporting activity only; selected planning contributors remain unchanged. Preserve duplicate definitions as ambiguous authority. No role name, prompt, provider dispatch, runner, catalog, migration or second reporting representation is introduced.

The public nested recurring schedule retains the same selected identity and exact original project ordering without changing existing Workdays, graph, attempts or accounting. Existing graph-birth assertions prove ready planning and blocked condition/reporting states rather than treating all nodes as ready.

Seventeen files total: five owning source files, existing tests/helpers, eight appended component selections, and the required SDK dependency/lock/build-action pin. Adopt checked protected SDK53bdc4d1deeeb78ce8c54a96539f311b2ac361ae/run39013755469/archiveSHA25650ccbdb0b6e2b92922edf5cf4234d2ade28e277c443c975264c532ebc9fd37ad. Isolated npm lock generation changes only root SDK dependency and its resolved SDK entry; all other locked packages remain unchanged. No SDK source changes occur in this PR; the reserved non-enumerable defect remains in the simulated chain.

Retained test-first lineage:

• c21bad6:2failed/11passed, dropped selection and duplicate joint reporting.
• 8be8217:3failed/12passed through original public preflight; bounded allowlist/retention repair precedes passing owning checks.
• 277ac12:1failed/15passed, automatic Reporter changed after fresh preflight; sealing repair0f7722863391cdcd3821a14d5579ee33c0c8a39d.
• 3f8bdac:3failed/23passed, zero Reporter activation and cooperative filtering dropped standing reporting authority. dd32cdc repairs those boundaries; d871c48 strengthens exact original birth/profile evidence.
• e32f3ad ordinarily integrates checked API562 without losing any941parent component steps or original regression commits.
• 4e3a952 adds public recurring read-back; its wrong sorted-project test expectation failed1/42 and remains retained. b4736c0 requires exact original caller order.
• Native39017142484/job117351497649 failed2/145 across32early prerequisite files before full verification or scenes. Shared fixture now includes standing closeout nodes; the earlier helper incorrectly compared current revision/state with immutable birth revision/state. Local original reproduction2failed/43passed across5whole files retained. Regression41562e74ec4f3e505b031441be7c7f650b2ea6f6 strengthens the original two native planning-history cases and reproduces both failures before repair68f7676c690cf467372c6e67b52f1296ea7bdc16. Births are exact revision1 with initial planning-ready/closeout-blocked states; later state/revisions are independently checked. Every original planning cancellation, interrupted generation, four-round repetition, replay, deadline and financial assertion remains. Closing additionally proves the selected Reporter ready and closing condition complete, without a second report. Full484077character failed log retained; native cleanup succeeded. No test count or deadline changed.
• Earlier setup, typing and missing local PostgreSQL-environment failures remain retained; none supplies passing prerequisites.

The next complete native invocation39018163513/job117354435200 failed4/2140 before any scenes: three existing handler-inventory expectations omitted the newly configured Reporter; the native proposal Decision fixture lacked a governed closeout profile. All2136other assertions and raw1250173character logs remain retained. Cheap focused reproduction on68f7676c retained3failures/49passes. Test-only89d6da82597d6e6e973f73d9ac9121d426339e05 updates only those three exact complete inventories and publishes one genuine controlled Reporter profile alongside the original library inputs. It additionally asserts persisted preflight selection/applied-plan identity. Its local native invocation correctly failed for missing disposable TreeDX; the over500line source check also failed. e537117 moves that original input-construction block intact into the existing ready-proposal fixture, retaining every original assertion. Final52assertions/6whole local files and strict production/evidence types/length/architecture PASS. Native PostgreSQL/TreeDX execution stays pending in CI; no skip or fallback.

Native39020599647/job117361460958 retained1failure/2139passes before scenes. The new test incorrectly expected the applied plan inside the stored preflight request; that request owns the frozen selector, while the existing public owning method returns the applied plan as a read-only projection. Full1240351character log and original failed candidate remain retained. af4e020 preserves the stored selected-ID assertion and verifies the same selected-ID through the actual owning preflight projection; no product field, storage or authority is added. A strict evidence check caught its collision with the existing graph variable before another CI invocation. 8b013c2 names that observation independently and passes52assertions/6whole local files, strict production/evidence TypeScript, length and architecture. The existing early native boundary command now also executes this exact native governance file before complete verification, so missing environments or native regressions fail early. All existing native commands, complete suites, supplements and949component steps remain mandatory and unchanged.

Verification

Exact8b013c29c19b7f57fb3e93ae9d425b6be5368c8e:52assertions/6whole local files PASS using original Vitest control-plane config against actual protected SDK archive bytes, without SDK source aliases. Strict production/evidence TypeScript, original file-length and architecture policies PASS. Isolated fixture/index cleanup passed; primaryd79c48c79b3ae17a73a576a6c5461b9506e81027, dependencies and running services remain unchanged.

The public service integration uses real owning preflight/scheduling/profile/graph/event repositories with embedded PGlite and controlled loopback TreeDX inputs. It does not claim native PostgreSQL concurrency, operator authentication, provider dispatch or managed products. Complete native PostgreSQL and TreeDX prerequisites/supplements remain required in fresh CI. All941checked parent components retain their exact order; append eight existing-case selections to949.

Fresh2140API+200Reviewer/949, independent artifact audit and checked staging delivery are pending. No prior, filtered, skipped, empty, partial or historical receipt substitutes for this invocation.

Risk and rollback

Ambiguous or absent reporting configuration now fails Workday activation; configure one explicit selected profile through the existing governed definitions. Ordinary planning participation and conversations preserve their existing behavior. Roll back through an ordinary checked staging PR with coordinated SDK/Agent archive custody. No release, tag, deployment, main promotion, permissions expansion, storage reset or service interruption.

Completion summary

Focused owning repair, complete selected case mapping, strict typing/policies and actual-SDK archive checks pass. Fresh native/archive/staging delivery and dependent Agent installed proof remain pending. Criterion127 OPEN;108completed/69open original bindings. No SDK-ready or managed golden pass claimed.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.