Combine active RLGWO source with custody and lifecycle repairs (draft)

.github/workflows/validate.yml

@@ -15,6 +15,29 @@ jobs:
         with:
           fetch-depth: 2
 
+      - name: Observe the C5 setup prerequisite
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 1
+        run: |
+          set +e
+          sudo /usr/bin/python3.12 -I -S -B scripts/qualify-work-graph-c5-setup.py --provision-hosted-launcher
+          provision_status=$?
+          printf 'C5 launcher provision exit: %s\n' "$provision_status"
+          if [ "$provision_status" -ne 0 ]; then
+            exit "$provision_status"
+          fi
+          sudo /usr/bin/python3.12 -I -S -B scripts/qualify-work-graph-c5-setup.py
+          setup_status=$?
+          printf 'C5 setup observation instrument exit: %s\n' "$setup_status"
+          exit "$setup_status"
+
+      - name: Receive the C5 current input prerequisites
+        if: always()
+        continue-on-error: true
+        timeout-minutes: 5
+        run: sudo /usr/bin/python3.12 -I -S -B scripts/qualify-work-graph-c5-setup.py --receive-hosted-prerequisites "$GITHUB_SHA"
+
       - name: Install validation dependencies
         run: |
           sudo apt-get update

README.md

@@ -1229,6 +1229,27 @@ Choose the source deliberately:
 - a local archive is evidence only for the exact source tree from which it was
   built.
 
+The repository-owned release helpers require a **clean checkout at the
+archive's recorded build commit**, not just the same runtime version or tree.
+They compare the embedded contract, inventory source identity and complete
+payload with the checkout running the helper. Use the corresponding release-era
+helper for a published archive; use the local build route for current source.
+
+For the published `v0.4.0.0` archive, the build commit is
+`71a7101ade904f5482cbc25c5154e1eadea0c7be`. Its release tag targets merge commit
+`4414d897d40298bc3e0a7778b7ca1b05ca680621`: the trees match, but the commit
+identities differ. Run the published-asset helper commands below from the exact
+build checkout, for example:
+
+```bash
+git worktree add --detach ../IMPLEMENTAUDIT-v0400-installer 71a7101ade904f5482cbc25c5154e1eadea0c7be
+cd ../IMPLEMENTAUDIT-v0400-installer
+```
+
+Keep that checkout clean. The [release report](docs/audits/archive/v0.4.0.0-release-report.md)
+binds the historical build and public asset identities. A checksum alone does
+not replace this source-pairing requirement or establish provenance.
+
 The current product surface includes shipped-helper reachability, executor-ready
 work orders, bounded state-space convergence, engineering-value and
 informational-independence controls, evaluator and candidate-controlled

docs/audits/INDEX.md

@@ -137,6 +137,15 @@ Standing gate owners: `check-action-selection-contract.sh`,
   and truthful open/nonblocking R001C disposition. Retained prepublication rows
   in the archive remain historical qualification evidence.
 
+## R0033 / R0037 portable integration source milestone
+
+- `archive/r0033-r0037-integration/README.md` — separately maintained #207 and
+  #211 acceptance ledgers, current-source repairs, preserved original failures,
+  exact preimages and concurrent-owner composition [proof level: PL2 instructions
+  + PL4 structural consumers + PL5 constructed controls; native admission and
+  issue acceptance remain open]. Final publication/package/CI identities belong
+  to the associated draft PR and its terminal execution receipts.
+
 ## Boundary
 
 The index points to current proof owners only. Detailed historical narratives,

docs/audits/archive/r0033-r0037-integration/README.md

@@ -0,0 +1,224 @@
+# R0033 / R0037 portable source integration
+
+This is a source milestone for the original issues [#207](https://github.com/theislampill/IMPLEMENTAUDIT.md/issues/207)
+and [#211](https://github.com/theislampill/IMPLEMENTAUDIT.md/issues/211). It is not
+issue acceptance, a release, native host qualification or permission to merge.
+Both original contracts remain open. The two independent acceptance ledgers
+retain their original populations and amendment precedence:
+
+- [R0033 acceptance](R0033-ACCEPTANCE.md)
+- [R0037 acceptance](R0037-ACCEPTANCE.md)
+- [Same-PR continuation](CONTINUATION.md)
+- [Exact source identities and preimages](SOURCE-IDENTITIES.json)
+
+The branch is `pro/r0033-r0037-20261023`, based on main
+`e78f7cb21af4197d490f10bc95917a4c75f748aa`, tree
+`e0263d4455549a47243d82f45cf31101c6b94df2`. Publication and final package/CI
+receipts are recorded in the associated draft PR and the external execution
+evidence; they are not inferred from this pre-publication source ledger.
+
+## Successor to the published checkpoint
+
+The sole draft is [PR253](https://github.com/theislampill/IMPLEMENTAUDIT.md/pull/253).
+Checkpoint `61081882f95bcc8c40685195b0b26a98a3f99a5b`, tree
+`769eb5343bbbff511314c24253d7830017300ded`, passed hosted run `40030184800`
+and job `120676234611`. The tested merge commit
+`fba845896b26d5eb7f78b5ced34b77dc2202037b` has that same tree and the exact
+main/candidate parents. It also has two reproducible package builds and four
+official isolated installations. Those qualified results are preserved.
+
+The successor adds actual unchanged-owner pending durability tests: **17
+controls/38 owner processes**, including real before/after atomic replacement
+interruption, fresh reload/lock recovery, cheap nonobserving status, unresolved
+currentness/epoch persistence and exact nonconsuming native-selection refusals.
+The runtime pending/source peers and all private selection pins remain unchanged.
+
+The existing run-root validator adds **44** composed terminal/handoff/yield
+record controls. The original **77** TY controls and legacy branches remain
+intact. Independent review produced real counterexamples for blocked reviews,
+unproduced future captures, existing spelling compatibility and a directory
+swap that restored all original file identities. The successor binds packaged
+directory identities and bytes as well as actual record dependencies, preserves
+the original failures, and rejects those schedules. A constructed CRLF packet
+positive checks exact packet bytes; it is not Windows native qualification.
+
+This selector is a supplemental bounded profile. Full original final-audit
+owners remain normative for their applicable broader inputs. A portable
+out-of-profile refusal is not native unavailability and supplies no disposition
+or bypass permission. The governor retains its original direct structural-validation call immediately
+before closure. The governor/transcript clarification permits recurring
+nonterminal audit rounds while retaining single final closure. No second
+lifecycle engine or mandatory worksheet was added.
+
+On the integrated source, routing and run-root wrappers, finite-cap controls,
+bootstrap, registry and helper census pass. The governor is **21,099 bytes /
+396 lines**, reserve **901 >= 741**; the census is **29/29 helpers, 19/19 modes**.
+Exactly fourteen existing governor SHA fields were rebound without changing
+the semantic oracle values. Package limits, reserve, version and compatibility
+requirements remain unchanged. Final successor commit/tree, independent review,
+repeated packages, installed results and hosted CI belong to the final PR
+receipt; the earlier checkpoint's successful CI does not qualify new bytes.
+
+The initial blind installed bank supports 15/16 bounded interpretations, with
+one prephase-pause disclosure partial preserved. Later narrow installed checks
+have separate identities. No blind interpretation is native activation.
+The local full package run's fixture/cache contamination failure and its scoped
+successful recovery are retained separately from hosted CI. The original
+failure is not relabeled a full local PASS.
+
+Latest read-only owner heads are PR246 `04573f3f8c7e50c15255d213c185605681c1ffdd`,
+PR251 `488e5d14fc6fb4901690213a8b92d22ac7025ef9` and PR252
+`573ab36b522ba9fe9ade5e034ea47f8b0d19f5b1`. R35's actual default bootstrap
+composition with the current governor passes at **21,243 bytes**, reserve
+**757 >= 741** (16-byte margin), with exactly fourteen source-pin fields
+rebound. Final affected R39 composition is separately evidenced at its exact
+captured files; no clean text merge is treated as acceptance. The R39/PR251
+projection-loader overlap remains reserved and unapplied. Earlier composition
+results below remain historical, source-bound evidence.
+
+Both original issues remain **OPEN at full acceptance**. The supported portable
+durability and record composition are completed source work; native source
+selection, authentic physical occurrence/LOAD/result/acceptance/JOIN/consumption,
+effect ceilings and host-session-bound exit remain their genuine receiving-owner
+and native obligations. The active same-PR continuation has been narrowed
+accordingly, without erasing original populations or prospective-scope limits.
+
+## Preserved hosted regression and repair
+
+Successor `c0573094fc67219fce40ecff0e31198ca33f4eef` / tree
+`2685a10706afd557663fd9c54c7eae4e56a5fe7b` retains the independently reviewed
+portable additions. Hosted run `40036017402` failed because its governor
+reference wording removed the exact direct structural caller required by
+`check-planner-stages.sh`. The original hosted log and a same-source local RED
+are retained. The correction restores the two existing caller lines; the
+checker, workflow and supplemental-profile limits are unchanged. Its focused
+planner GREEN and the complete canonical static prefix pass. These are scoped
+results, not a replacement for the final full hosted run.
+
+The final governor is 21,099 bytes, SHA-256
+`14cdbc87dece8fa16c3e329abc135c0cbe4eb18e7f4b637517a5d9bc1e8d19c6`.
+Its fourteen semantic SHA fields are rebound, with all other oracle values
+preserved. The record validator, PROTOCOL and transcript hashes are unchanged
+from the v5 independent review. Earlier R35/R39 receipts retain their original
+source identities; final PR evidence gives the focused changed-governor
+composition/budget join without claiming unchanged runtime tests were rerun.
+
+## Actual changes and semantic owners
+
+| Owner | Demonstrated gap and change | Evidence boundary |
+|---|---|---|
+| Existing `audit-implement` child and governor route | Add the accepted evidential-support v2 branch for realised implementation/release and non-release propositions; preserve six legacy mappings and two refusal mappings, and recheck exact current envelope before result consumption. | Both branches retain package maintainer admission. The deterministic return validator checks typed values and equality. It cannot authenticate evidence or replace semantic judgment. |
+| Existing transcript contract | Own the progressive schema, capability-specific preflight, subordinate recovery limits, and observation/reservation/OPEN/LOAD/RETURNED/ACCEPTED/JOINED/consumption distinctions. | Instructions and constructed controls do not install or authenticate a native event observer. |
+| Existing L4 PROTOCOL | Return to the interrupted L1, L2, L3 or L5 owner and invalidate only affected evidence. Preserve phase-step prerequisites and exact-candidate re-audit. | Four paired cold reads clarify old ambiguity; the old reader was already safe. No fabricated unsafe baseline. |
+| Existing run-root validator | Add an explicit read-only nonterminal-yield predicate. Validate typed progress, clarification, owner wait, external wait, user pause and interruption records; reject false terminal claims and record drift. | A validated record grants no native Stop permission, currentness, effect authority or closure. |
+| Existing finite-cap checker | Restore the exact accepted PR217 checker/test delta from its accepted integration ancestry, absent from main. | Preservation of completed work, not a new retry mechanism. |
+| Existing helper registry and semantic fixtures | Add real consumer reachability and mode census, preserve executable inventory, and rebind fourteen existing governor source hashes. | No package limit or semantic reserve is relaxed. |
+
+There is still one governor and exactly four children. No fifth child, generic
+executor, second observer/router, new lifecycle engine or task-custody owner is
+introduced. Shared files were integrated by one root writer.
+
+## Focused evidence retained before publication
+
+| Programme | Observed result | Limit |
+|---|---|---|
+| Exact inherited terminal-cap repair | 28 controls | Source checker, not original whole R0037 acceptance. |
+| Evidential-support validator | 153 real CLI invocations (149 original plus four admission negatives) | Typed/precondition consumer tests; no native cognition or authenticated evidence claim. |
+| Required-child observation oracle | 19 controls, including missing projection after a completed boundary | Test-oracle correction; not durable runtime admission. |
+| Existing pending owner | 16 controls on actual unchanged pure functions | No native I/O, event authentication or JOIN admission. |
+| Physical source selection | Five focused existing source regressions | No relabeling of the full historical bank as newly executed. |
+| Cognition/lifecycle composition | 17 controls | Constructed value/pending/yield/Stop inputs, not an authenticated cross-owner execution chain. |
+| Nonterminal yield | 77 controls | Record validation, with real scheduled legacy STATE and plain/quoted phase mutations. Native Stop remains unverified. |
+| L4 cold reads | Four paired source-consuming cases | Clarification and selective return, not a native full L1–L5 programme. |
+| Candidate helper census | 29/29 helpers; 18/18 modes | Exact source/helper reachability. |
+| Governor bootstrap | 21,075 bytes, 396 lines; reserve 925 >= 741 | Existing 22,000-byte and 450-line limits retained. |
+
+Independent R0033 review exposed a false zero-child oracle verdict when a proved
+completed boundary lacked a separate projection. That defect was corrected and
+the original failing observation retained. Independent R0037 review exposed
+foreign interruption matching, an action-verb whitelist, incomplete external
+pause containment, contradictory pause steps, read-set drift and mode-census
+omission. The original counterexamples and subsequent held-outs remain in the
+execution evidence. Later literal-index and quoted-phase cases led to the final
+77-control consumer. These are engineering reviews, not authenticated
+`audit-assess` acceptance or closure authority.
+
+The canonical package programme, final clean-source packages, official isolated
+installations and hosted CI must be read from their actual terminal receipts.
+An earlier package at a dirty source identity is retained only as an earlier
+observation. Building or copying a package is not native discovery, invocation,
+marketplace behavior, public release or universal host support.
+
+## Concurrent composition and ownership
+
+Read-only heads at qualification:
+
+- R0035 PR246: `c62b6342692b2a83bf5415918cd64ff9069c5337`.
+- Prior four-Rockstar PR251: `488e5d14fc6fb4901690213a8b92d22ac7025ef9`.
+- R0039 PR252: `586418e9fba576b1b685dc6169a5e25a0c2a92ba`.
+
+The R0035 scratch composition retains its dependency/dispatch/JOIN owner. Its
+merged governor is 21,224 bytes with reserve 776 >= 741; only fourteen existing
+source-pin fields were rebound, leaving all other semantic fields unchanged.
+The final R0039 scratch composition passes the 77 yield controls, existing
+run-root wrapper and measured 30/30 helper, 21/21 mode census. Mechanical test
+count conflicts were resolved in scratch while retaining both native-input and
+yield mutation families. These copies are explicit composition evidence, not
+imports or writes to the other branches.
+
+The R0039/PR251 projection-loader conflict remains reserved: the existing
+canonical reader/rotation owners must reconcile payload pins and path-scoped
+module custody. This branch does not change `claim-run.sh`, native pending
+peers, canonical rotation, native host binding/Stop or R0035 graph dispatch.
+PR251's large completed programme was not repeated.
+
+## Remaining acceptance and rollback
+
+Native required-route durability, exact authenticated physical occurrence and
+first-original-result admission, real LOAD/acceptance/JOIN/consumption,
+capability/effect ceiling enforcement, host-session-bound terminal disposition,
+and the original issue-specific native populations remain unproved. The live
+host Stop owner continues to return its qualified unsupported-authentication
+result. A host-forced ending does not complete an audit object. The portable
+yield predicate does not supply the full terminal/handoff/disposition adapter.
+That native-owner integration must not accept caller-authored attributed values
+as authenticated effect admission.
+
+The source/evidence commits are logically separated by issue. Reverting R0033
+v2 requires reverting its child, validator, shared route/schema references and
+dependent source pins together. Reverting the R0037 yield mode also retires its
+registry entries and dependent composed controls. Reverting tests never
+discharges an original obligation. Existing earlier evidence stays bound to its
+unchanged source; evidence for reverted or changed consumers is retired or
+requalified explicitly. No merge or issue closure is authorized by this ledger.
+
+## Subsequent marker-instrument repair
+
+Checkpoint `40baa43e792c95f8ad49cea8dccfd85ac42b94d7`, tree
+`504ef813aed1056bb77fbbb114415be3abf87e40`, has exact two-build/four-install
+qualification and four fresh bounded installed interpretations (native zero).
+Its full hosted run `40037118624` nevertheless failed: two continuity-test
+assertions still required the obsolete blanket once-per-run marker sentence.
+The complete original hosted log (SHA-256
+`b764be72258389fb4fa05dc8d8c005af1936c5fa8c6c2ad7b7c7100ef97041fa`)
+and the exact local 2/39 RED remain preserved.
+
+Direct audit-andon localized the defect to the test consumer. The repair checks
+nonterminal markers per audit round and terminal markers once per run, retaining
+both no-completion-replay assertions. The existing marker bank adds the actual
+preimage-supported two-round positive and reversed-final-order negative.
+Focused continuity checks pass **41/41**; the complete marker bank and unchanged
+validation registry pass. No runtime checker, skill payload, workflow or package
+limit changes in this repair. The lightweight order checker is not promoted to
+a complete missing-marker validator. The final successor needs its own exact
+source/inventory binding and full hosted CI; earlier PASS receipts keep their
+original identities, and unchanged payload evidence is reused explicitly.
+
+Read-only final composition inputs include R39 PR252
+`8fd58276a50ae069ed71d52be01c775047ce692a`: its successor changes one fixture
+lifecycle test only, with 1,402 other Git entries unchanged and the new disposal
+control passing. Prior runtime composition is reused at those unchanged bytes.
+The restored-caller R35 composition is **21,248 bytes**, reserve **752 >= 741**.
+The earlier measured compositions above remain historical results. Reserved
+projection/authority work, both original issue populations and native gates
+remain open; this test correction grants no acceptance or closure.