Repository navigation
Support explicitly authorized PaperPilot runtime transitions without losing history #90
Description
Goal
Provide a documented, explicitly authorized runtime transition for a paused real PaperPilot without rewriting its original OPEN event, resetting its budget, or losing pending work. This is a completion prerequisite for #23 and belongs to epic #12.
Confirmed cause
At frozen commit 8d89c832cd856166ce000fc64344ba720c4bae6f, the pilot binds a 94-file implementation identity. Delivered main 4400fb9cbc94109038f08a7f1382138f01f77ced retains those 94 files byte-for-byte and adds trace_gc/paper_pilot_lifecycle.py as a 95th file.
trace_gc/paper_pilot.py:implementation_identity enumerates every Python implementation file and schema. PaperPilot.__init__ requires its immutable first OPEN value to equal the current code/runtime/application identity, and _step checks that identity again. Consequently the old run cannot reopen under current main. This guard is working as designed; broad code equivalence does not authorize substituting a runtime.
The real pilot remains paused before its first recorded model response with one existing reservation. The historical attempt marker and four response/outcome/import artifacts are absent, but the original executor launch/exit receipt establishing sole ownership was not found. The historical provider outcome is therefore UNKNOWN_UNATTESTED; a later executor marker contract cannot establish historical no-call proof. The pending old intent has no retry or reimport authority. Its pending request, source admission receipts, graph, checkpoint and failure history must remain intact. The private recovery harness depends on the delivered lifecycle module. The current completed-parent lifecycle helper is not an API for migrating a pending parent run.
Read-only causal audit SHA-256: ce17643e74b53dac6e27cb6fecc30129436112f08d5cfb5e01a03abf32b25e66. This is not a successful migration or real-model receipt.
Design requirements
- Define and review a versioned application-owned transition/export contract before implementation or live execution. Bind original and target implementation/runtime identities, original event-chain head, graph journal/state, catalog, source admission receipts, budget state/reservation, pending immutable requests, access/trust state and transition tooling identity.
- Preserve the original checkpoint OPEN and every historical event, response blob and failure receipt. Do not omit identity files, load a hidden module into the frozen namespace, overwrite an old approval, or treat a matching hash as owner authorization.
- Maintain one active controller and graph authority. Prove quiescence and ownership before export/backup; preserve parent history and make activation of the new phase atomic and resumable. Repeated identical transition requests must be idempotent; conflicting or stale requests must fail.
- Preserve application run/configuration identity and actual budget accounting. An existing reservation must not disappear or be charged twice. No model/provider call, source readmission, graph assertion injection or budget reset is part of the transition.
- If a new checkpoint phase is required, retain inspectable old/new event lineage and replay only supported checkpoint/cache operations. Preserve graph contents through verified reference-backend backup rather than direct graph SQL injection. Explicitly determine which execution contexts and source-open/stage approvals need new versioned bindings.
- Prefer an external source-checkout coordinator if existing public APIs can enforce the complete contract. If a public API change is necessary, implement it explicitly and repeat all affected identity and empirical gates. Do not weaken the original reopen guard.
Required verification
- Positive paused run with a pending immutable semantic request and an existing budget reservation survives transition and a fresh target-runtime reopen.
- Old history remains byte-identical; source catalog, graph assertions/journal, budgets, reservations, completed requests and pending request arguments remain accounted for.
- Reject wrong/stale code, runtime, chain head, source/catalog, graph, budget, ACL/trust or authorization; refuse a live parent, redirected output, existing conflicting phase and unknown ownership.
- Exercise interruption/resume at export, backup, checkpoint creation and activation boundaries. No fault may create two writable graph authorities or silently reset spend.
- Verify historical execution receipts and the delivered lifecycle helper on a source-bound nonempty parent. Synthetic mechanics alone cannot establish real paper-to-answer qualification.
- Review exact final code; run release/package checks; sign/push/CI/merge/post-merge verify. Keep Implement and validate a real paper-to-graph-to-cited-answer pilot #23 and Reliable paper extraction, retrieval and real GraphRAG qualification #12 open until their actual empirical acceptance gates pass.
Current state
Transition infrastructure is merged in PR #93, with reviewed signed commits and post-merge CI/checks. The actual historical source-bound parent was exported once through its frozen runtime using four SQLite online backups; source database hashes, event lineage, graph state and budget reservation were preserved. Immutable capsule SHA-256: 61e04bd083d1e1d6b63502a7976d3f36141315c85d3abbd25418bd74aa91992f. Independent actual capsule readback SHA-256: 7c40ae1ef18ad110d5b74bbb59f6c597fdc69808995937eb6da05e86d65fbb2a.
Historical executor audit SHA-256: bd97eef8dd95a17cc14f05977f9c0258ce1ae6765cdcaa1930238d076aa6bac3; provider outcome remains UNKNOWN_UNATTESTED, with no old retry authority. Held quiescence and namespace fencing completed through the delivered PR #101 helper: the original five state files were archived with exact byte preservation, their original effective ACLs were restored after the move, and the old fixed namespace rejects recreation. Root fresh fence readback: 41b725cf4d9669b598ce1c0bd7e93d7c17373d38f1d2e86fd5aabcdf69e3d170; scoped independent readback: 578feb3fa7addd90891912a66fd60d7ec404cd2ce931ce6835d21b43444aeb22. The archived files are not claimed to remain write-denied. Later-stage signing stopped on a private authorization filename collision after three valid signatures and the restore release; the exact partial batch is preserved and independently verified. Root partial readback: 29331eda818f2c51175c2cade82b324fb3b969f42e554f7a8a0e0a260df622d5; independent signature readback: c71e1fb1353da32a29c99d84dca7fcb6c5cb5093e20b32fce169080a268353ca. See the causal failure and recovery update. Actual target restore, import, activation and fresh reopen remain NOT RUN. No new model/provider call, source readmission, graph assertion injection or budget reset has occurred. This issue remains open for its actual transition criteria; #23/#12 remain open for empirical qualification. A distinct prospective fresh pilot is being implemented under separate preregistration and cumulative budgeting; it does not count as an old-runtime transition.
Activity
CompleteDotTech commentedon Sep 30, 2026
Design checkpoint: V2 passed scoped attributed assistant review. The original design HOLD and correction remain preserved; this is design approval, not runtime or model authority.
The actual pilot has OPEN=1, INTENT=19 and RESULT=19: no incomplete checkpoint intent. It has a completed COMPILE with one model-call reservation and 14,120 request bytes, plus a separate external application semantic intent. The reviewed executor fsyncs its attempt marker before model construction/execution; the five owned attempt/output files are absent. This supports no known attempt through that controlled path, conditional on exclusive executor ownership. Unknown or external attempts must still be reconciled.
Implementation is underway in an isolated checkout: explicit PaperPilot/controller phase-import contracts, immutable original history, verified backup restore, preserved reservation, and a durable old-launcher fence. No live database, source receipt, budget or runtime has been changed.
Two primary references guide the failure tests:
A disposable Windows ACL experiment will check legacy write denial after the transition process exits, while preserving read-only audit and target-phase writes. It grants no permission to modify the live phase. V2 design SHA-256:
bd486d084f4976d94039ffe4864359553187a4d150e4bc097107b0ade6df8efa; review:869800f120e1e84be9322b9feafe47924260d0e6007d01df7dbe59bde67a9bd3; actual state census:5dc5c634a281be371401df10205662135690ea9ef6b4dc6165cc0c9a64ec8ab3.CompleteDotTech commentedon Sep 30, 2026
Cutover mechanism progress — scoped feasibility only
A disposable authored pilot under unchanged frozen
8d89c832cd856166ce000fc64344ba720c4bae6fnow passed a closed-state namespace test. After an applying child denied creation beneath the old application parent and renamed the state directory, then exited, the unchanged old PaperPilot, SQLiteReferenceBackend and RunBudget constructors each failed. The original fixed path stayed absent; all five archived files retained exact bytes; read-only archive audit and a separate target write succeeded.Receipt SHA-256:
62c29cfc871b9968321d880075fae86de0359d9ee43cb10906c28834b84505b6. This is synthetic mechanism evidence, not a live transition, complete phase implementation or real paper-to-answer acceptance. The restoration removed the temporary deny; Windows normalized the inheritance control flag, so byte-exact original ACL restoration is not claimed.Earlier access-denied rename failures were caused by the fixture retaining SQLite handles. The corrected fixture explicitly closes connections: the Python SQLite context manager manages transactions and does not close the connection. Earlier failures remain preserved.
The complete implementation still requires quiescence and ownership proof, interruption/reconciliation before and after the namespace change, coherent four-store export, immutable historical lineage, exact pending intent/reservation preservation, current phase enforcement throughout direct supported mutations, and peer review of frozen code. Same-user deliberate ACL overrides remain outside the cooperative launcher threat model. No actual pilot ACL, database, model or budget change has occurred. The existing corpus producer retains its original deadline.
CompleteDotTech commentedon Sep 30, 2026
Reviewed transition implementation delivered
PR #93 merged to
mainate1fae9ef00109e55b9641682fc74f617f2dfae7a. The signed reviewed head was7b04bb3e94e84186d98ab21c5d19b92f5bebfebd; GitHub verifies both head and merge signatures. All push/PR hosted checks passed on Python 3.11/3.12/3.13. The owned integration checkout is synchronized cleanly to the merge.Full premerge validation: 1,336 tests run, 1,328 PASS, eight optional SKIP, zero failures/errors/provider calls/production graph writes. Public source ZIP: 598 members, SHA
59395628b37818610891505fe3a562fd8ec40b3e1946c6a36a704d09af3b144f, audited without private PDFs, model weights or environment secrets. Isolated package installation and CLI 0.4.0 passed. Eight phase-transition tests passed again on delivered main; main-branch hosted checks are being monitored.Earlier direct-import shared-lock and Windows junction pre-mutation findings were fixed and reviewed. Historical fixture failures were preserved outside the source checkout. Both independent code reviews are agent reviews; the cross-runtime fixture is authored, not the actual pilot.
#90 and #23 remain OPEN: the actual paused pilot has not transitioned, no genuine semantic call or graph publication occurred, and its exact source/runtime/release and recovery gates remain pending. Fresh source acceptance will bind the subsequent extraction repair to this delivered runtime before live use.
CompleteDotTech commentedon Sep 30, 2026
Actual historical backup verified
The reviewed historical-export-only worker ran once against the genuine historical PaperPilot runtime and the original paused real-paper run. It completed an actual four-store backup through the delivered PR #93 capsule helper.
61e04bd083d1e1d6b63502a7976d3f36141315c85d3abbd25418bd74aa91992f.The historical provider outcome remains UNKNOWN_UNATTESTED. The original one-call/14,120-byte reservation and absent attempt outputs are preserved; absence of an output does not prove no provider call occurred. The backup release grants no semantic retry, new model call, import, ACL change or cutover authority.
This resolves the actual historical-export step only. A live transition and real generated-answer acceptance remain pending. #90 and #23 stay open; fixtures and a successful backup do not establish the paper-to-answer pilot's quality gates.
CompleteDotTech commentedon Oct 1, 2026
Guarded admission helper delivered
Implementation PR #99 is merged as
d2c6c92e0c84cb3add16e47e7ec56e58b27fac0e. All six push/PR checks passed on reviewed headd6f9aa5b732a145beae63a5c37a238a297c3bd0f. The head and hosted merge signatures are verified; their delivered trees are identical.Post-merge Windows checks passed: nine guarded-handoff tests; 18 packaging/I/O tests with 17 passes and one explicit Windows symlink-privilege skip; legacy package validation passed. The owned integration checkout is synchronized. Default-branch CI is running at https://github.com/Jev-Engineering/jraphyte/actions/runs/36800210503.
The helper remains subject to the actual owning application proving continuous launch exclusion before the first barrier write. This delivery performed no historical namespace transition, ACL write, archive, restore, phase activation, source admission or model call. #90 remains OPEN for those real acceptance stages.
Separately reviewed bounded phase-reviewer and status-owner identities are now prepared and approved for identity enrollment only. A concrete stage consumer and release must verify that approval and the actual current code/phase bindings before any transition. Identity approval does not authorize a phase or model action.
CompleteDotTech commentedon Oct 1, 2026
PR #101 delivered; real historical transition remains pending
PR #101 merged at verified commit
32fd0ab2db99441b5c4bb66973aaefb9deff3decon 2026-10-01 at 03:28:07 UTC. All six Python 3.11/3.12/3.13 checks passed on reviewed head63099ec953d8d8ccbcf919720635ec1073088424. The signed merge tree is exactly the reviewed head tree:80963dbca6a9e10ecd21eee20e5fba7d0eb689d1.Postmerge Windows verification passed 17 tests, and the immutable 618-entry public source ZIP passed its audit and exact comparison with delivered files. The package contains no private papers, model weights or environment secrets.
Fresh receipt mapping rehashed all 87 method files, 129 image-related files including the Windows OCR helper, and 99 pilot implementation files. Their bytes are unchanged. The current source-verified 200-paper receipt therefore maps to this delivered code without another corpus run:
3f77057a0d845b71320003cfc64553cc429b762abfa75c2ec86becf19c507253. Its verified 97/111 result and preserved failing legacy receipt are reported in the current #91 outcome.Postmerge verification receipt SHA-256:
65e13239585af8e02afd66da8fae2b4ad8440f42a280a10b094ef6de4b45e5df.The public helper now retains the application-owned observer through the durable write-deny sequence and reobserves partial replay while the old root still exists. Actual historical quiescence, fencing, import, activation and reopen have not run. Their application-owned signer and exact effect releases are being reviewed separately. The historical unknown provider outcome and one reserved model call remain preserved, with no retry, new model call or source readmission. Issue #90 remains open.
The default-branch CI run is 36810643052; its result is still pending at this publication.
1 remaining item
CompleteDotTech commentedon Oct 1, 2026
Initial transition authorizations issued and verified; transition not executed
The corrected read-only ownership observation succeeded: all five historical state-file identities matched, four database read handles excluded writers while all three old locks were held, and no historical owner process matched the census. Runtime bytes were checked before and after the observation. This is preparatory evidence; the actual fence must repeat the observation continuously under its own locks.
The root-owned sign-only operation then completed with exit 0. Both Ed25519 authorizations were independently replayed against the enrolled public key and bound to the exact quiescence/fence release fingerprints and frozen capsule. Their validity window ends at
2026-10-01T05:51:25.133605Z. The operation stopped before invoking the owner transition.Evidence SHA-256:
5a37b89976901dd76d1f8c8471f369c0ecc6483ea14b56bc883f690490aec8e0.f0e4551240389bc9e78ead915abad0c6b6cbe64fb1faa7822d587be939cd03a8.c46fa7c3956351de4721d1e68e5fc4a58a74bd6a7075d562849e31abe8c45c47.Two earlier pre-effect failures are preserved: a second-handle read of the already locked controller file, repaired with a peer-reviewed held-handle reader and a real disposable Windows fixture; and ignored bytecode left by post-merge tests, moved intact to a reviewed quarantine with matching file hashes. The 99 reviewed application files remained unchanged. Neither failed attempt issued signatures or performed a phase effect.
No new model call, source admission or assertion publication occurred. The historical unknown model reservation remains consumed and is not retried. The owner-effect launcher is being reviewed separately; #90 and the empirical qualification issues remain open.
CompleteDotTech commentedon Oct 1, 2026
Actual held quiescence/fence completed; later stages remain outstanding
The root-owned operation completed with exit 0 under the exact reviewed owner release and two verified stage authorizations. It made a fresh live ownership observation while all three old locks were held, retained four database handles excluding writers through the durable admission fence, and archived the exact five historical state files.
Fresh root verification confirmed all five archived byte hashes, restoration of their original effective file DACLs, the exact parent deny-create change, and absence of the old fixed state path. A fresh attempt to recreate that path failed with Windows access denied (
WinError 5). The file denies protect the admission/rename sequence; the durable old-parent deny protects the old fixed namespace afterward. This is the documented cooperative application boundary.An independent assistant reviewer separately rehashed all five archived files and the quiescence/barrier/fence/owner receipts, with zero mismatches. The reviewer did not repeat the root's namespace-creation probe.
Evidence SHA-256:
41b725cf4d9669b598ce1c0bd7e93d7c17373d38f1d2e86fd5aabcdf69e3d170.133d37ba79379514d25cc2155385080f9bfe659bf308f51c132bcf5ec8edbf50.062fa6f0e6ec7d132962b491339832841855a462f6b65d2584f3dedb4508626c.8c313280b1dbb29b1a23645dae83537ce8bcb78f5e2ebe0169893270c9484e99.aec8d8cca76a0d7e04eb9cc7d9bc23abc17608a4096f85e14ed020e02b90b31d.578feb3fa7addd90891912a66fd60d7ec404cd2ce931ce6835d21b43444aeb22.The historical budget was reopened read-only and still contains the consumed model reservation of one. Its outcome remains
UNKNOWN_UNATTESTED_NO_RETRY. No new model call, source admission or assertion publication occurred. Restore, import, activation and reopened-state verification remain NOT RUN; their exact releases and authorizations are being prepared. #90 and epic #12 remain open.CompleteDotTech commentedon Oct 1, 2026
Later-stage signing: partial batch preserved; no transition effect
The committed held quiescence/fence remains verified. Restore, import, activation and fresh reopen have not run.
The first later-stage sign-only attempt exited before reading the key because an assistant peer fixture created ten Python 3.14 bytecode cache files in the owned target checkout. The files were moved to an external quarantine with exact hash readback; all 99 implementation files remained byte-identical. The failure and causal diagnostic are preserved (
bc80b45bfbda8a7660cbcb70742dfaf71c18ac7d38fb1500e0634b1425451d86).The separately approved retry exited after writing three valid signatures and the restore release. Its cause is a private orchestration filename collision: both the
PHASE_IMPORTauthorization and the historical import-stage authorization selectedimport-authorization.json. Exclusive write/readback correctly refused the different bytes. No state transition or provider/model call occurred.Root public-key verification confirms the existing import, activation and restore-stage signatures, their exact expected payloads, the canonical activation-pointer binding, and the absence of target state, active pointer and stage results. Partial-batch receipt:
29331eda818f2c51175c2cade82b324fb3b969f42e554f7a8a0e0a260df622d5. Independent causal readback:5c076ccac22c6572afa68afa67acec6312345181a35e36d17d61c934b294ad93.The repair is a versioned disabled reconciliation signer with distinct stage filenames. It must validate and reuse the exact existing signatures without overwriting or reissuing them, then sign only missing stage authorizations. A new root approval and review are required before that recovery runs. Each actual transition still requires its own subsequent root effect approval and verified predecessor.
This is incomplete signing preparation, not completed migration or paper-to-answer qualification. #90, #23 and #12 remain open; the historical unknown provider outcome and its one reservation remain preserved with no retry authority.
CompleteDotTech commentedon Oct 1, 2026
Later-stage signing recovered and verified; four effects remain pending
The versioned sign-only recovery completed with exit 0. It authenticated the exact four-file partial batch before key access, reused all three existing signatures byte-for-byte, and signed only the three missing stage authorizations. The import stage now uses a distinct filename from the phase import authorization. The original failed attempts, signatures and restore release remain preserved.
Root and independent assistant public-key verification confirm all six authorization signatures, all four exact stage-release fingerprints, unchanged original files, current authorization windows and the canonical activation-pointer hash. The activation file formatting hash is correctly distinct from its canonical pointer-wire hash.
f2c1e2c5b5d5406387b652df94999f153f3b5fab64d8509cd4121f8ca5ca6806.a193e67a4935b38f67cbe0a743361ef9047ecfd858699cee5839dab0310df09a.debb18feefcfee986d1f7b3117842c8ddb7d0f45868fb5e4d94baf4c22238c98; scoped review:7ef248510a2a6ff9b1fe43321ab905b1f21ac6687fc0ab3428acf5d4b66aa28c.No target state, active pointer or later-stage result exists. Actual restore, import, activation and fresh reopen require separately reviewed root approvals and sequential actual predecessor verification. Their disabled launcher also passed scoped review after adding a native live-owner SID check and exact predecessor-result status checks (
4e70f61f6ef61dc80de76ba1803a016763133b2110093cea3a6f5076e2e219f2). These static checks are not actual transition evidence.No model/provider call, source readmission, assertion injection or budget reset occurred. The historical unknown provider outcome and one reservation remain preserved without retry authority. #90, #23 and #12 remain open.
CompleteDotTech commentedon Oct 1, 2026
Actual inactive restore completed and independently verified
The separately root-approved restore stage completed with exit 0 through the reviewed V6 coordinator and delivered public SQLite backup API. Fresh root and independent assistant read-only connections verified database integrity, exact historical graph/budget logical contents and the added exact phase-binding marker.
4d0e158e35e2aea312f5640b9bda5d1586e4404bb5f52f23cf7374295b1e6574.fa636a3b07679d78f0972dfc1e0b2fd50bf975d2c61f498316f594a693d5f871.d9a03b5f009ca3ea6480c3a6379fdddc9f60dc1f1fd23d44779e3697797ba52f.The five archived original files and four export backups retain their pinned bytes. The target retains graph version 1, zero assertions and the original model-call reservation of one. No new model call, source readmission, assertion publication, budget reset or old-attempt retry occurred. The active pointer remains absent; import, activation and reopen have not run.
The target also contains SQLite's zero-byte graph WAL and 32,768-byte SHM. The initial root inventory verifier expected only three files and rejected this observed layout; that verifier is preserved. Its versioned successor checks the exact five-file inventory, empty WAL, integrity and all logical contents using immutable read-only connections. Neither root nor peer deleted or altered the sidecars. A separate disposable reproduction is checking whether these sidecars affect interruption recovery; no complete migration/recovery claim is made yet.
This is actual inactive restoration, not actual model execution or paper-to-answer qualification. #90, #23 and #12 remain open. Import requires its own root approval against this verified predecessor.
CompleteDotTech commentedon Oct 1, 2026
Actual import failed before tokenizer/pilot construction; reviewed recovery pending
The completed restore and its verified graph/budget contents remain preserved. The separately authorized import terminated with exit 1 at the factory's exact tokenizer inventory guard: the configured model directory contains 12 files, whereas its signed tokenizer-only inventory contains five. The seven additional files are model weights, model index and accompanying metadata/license. The inventory guard correctly rejected this mismatch before
AutoTokenizer.from_pretrainedand before graph backend, budget, pilot or controller construction.Fresh root readback verifies that the target graph and budget still match the restored capsule logically, the historical reservation remains one, and no new model call, source admission or assertion publication occurred. Import copied the pinned ACL before the guard failed; that partial effect is retained in the six-file target inventory. No import result, checkpoint, application journal or active phase pointer exists. The failed command and its original signed release are preserved; it has not been retried unchanged.
Recovery uses an owned, separate tokenizer-only snapshot containing byte-identical copies of the five pinned files. All 12 original model-directory files were hashed before and after copying and remain unchanged. Three successor stage proposals preserve the existing phase binding and completed restore, changing the tokenizer path and future stage output namespace. Those proposals require newly reviewed stage signatures; the original import/activation authorizations and restore receipt are not reissued.
Independent assistant review found a timing defect in the proposed private signer: authority could expire during lengthy inventory checks before signing. The proposed signer remains disabled while a versioned fix adds checks immediately before sensitive operations. No recovery signature or stage effect is claimed here.
e38d936d536b6d2099f192bebdc1b7634f499a069ba4b2b1a17aaf91f9bfa0b9.2642a24ea8f4f48caa0ae7d82e6d3b0a8b92e11deb10b768f35d98cff0a29e2f.ea97a8e2daae50929cb2c2c70216c12b65a61b59ae6d22d4e0fcb85cadd3b151.7b519bf7b75632702443ed26055c53a2cc518e5e7b31c5c11796412e1a8be4a4.e202499fa1601fb2fb4459a76f1562e870edc436b985bd9f4f810d7ae31ae398.Separately, #102 tracks the reproduced public SQLite sidecar interruption-recovery defect. Its repair is being implemented in an isolated checkout; the current signed phase source and actual target remain untouched. Issue #90 and the empirical #23 gate remain open.
CompleteDotTech commentedon Oct 1, 2026
Recovered import completed and freshly verified; activation is separate
The reviewed five-file tokenizer snapshot resolved the inventory mismatch. Three newly signed successor stage releases preserve the existing phase binding and completed restore. The sign-only process exited 0, and fresh root plus independent public-key readbacks verified all three signatures while preserving all 11 earlier signed files.
The separately approved recovered import also exited 0 with
IMPORTED_INACTIVE/PHASE_IMPORTED_HELD. Fresh immutable SQLite inspection verifies:WAIT_SEMANTIC_RESPONSE.OPENandIMPORT_PHASE; the application journal containsFREEZEandAPPLICATION_PHASE_IMPORT. Their hash chains and references to the historical 39 checkpoint events and 11 application events are verified.UNKNOWN_UNATTESTED_NO_RETRY; no old request was retried.Evidence SHA-256:
d40106dc245a2687f714c875c5c4d8b07b6e28a3868441127515a9b603b80e53.d0a191ed8e06811d753365e78c910546c5da897f641bf9f79ea4bacdefc1e2a1.5d245ec726ceffa09856b4ce680e8bc52185422f0d2b47d0098a2033774f1ad0.c376bbabdffac350843410d7a631c4332d5e3d8fc1547c5f12af88da8e6059df.47b45fe6b6f697e50f3e581d73a91432b85ed6154300c426a1d393204ae6df27.Activation has now been separately approved and launched; it is not yet claimed as complete. Reopening and status bootstrap require subsequent result review. No real GraphRAG answer qualification is inferred from these transition steps.
Separately, PR #103 delivers the #102 SQLite interruption-recovery repair. It passed independent review, full local validation, package audit and isolated installation; exact-head hosted CI is running. It does not hotpatch this signed phase.
CompleteDotTech commentedon Oct 1, 2026
Actual historical phase reopened and verified
The separately authorized import, activation, and fresh-process reopen completed successfully. Root verification and a separate assistant read-only review confirm:
Actual reopen result:
9596c663d92f5b172b01528ce753a2284e1f65239db1d78549d9a11555b27a05. Root fresh readback:d60bb8c769dc51613afcbea0b0dd351fff25c1919bde3fdc2f4ecf53bdb97ad4. Separate assistant readback:5535b30114ba04d1424d9234a5e1f71a6f77a791fde88b095dd02cc9f0260cb6.The status bootstrap remains disabled pending its separately reviewed enrollment and operation. This establishes historical phase recovery, not a completed real GraphRAG answer or all nine recovery proofs. #90 and #23 remain open. The frozen signed phase checkout has not been updated to PR #103's implementation.
CompleteDotTech commentedon Oct 1, 2026
Progress update: #102 is closed after the SQLite WAL/SHM restore-readback fix merged in PR #104 at
7f01f338. Postmerge Python 3.11, 3.12 and 3.13 CI passed. The final release gate recorded 1,395 passes in 1,403 tests, eight documented optional skips, no failures or errors; PDF coverage passed and all 619 package files matched signed Git.The delivered helper verified the actual closed historical capsule read-only: all four backup databases retained their pinned bytes and logical states, along with 39 checkpoint events, 11 application-journal events, 19 completed requests, eight source statuses and the existing one-call / 14,120-byte reservation. The historical provider outcome remains
UNKNOWN_UNATTESTED; the old semantic intent has no automatic retry. The original frozen phase, old sidecars, signatures and receipts remain preserved. The earlier actual restore completed, but its interrupted coordinator result and old-runtime sidecars still require separately reviewed reconciliation under the new implementation identity. Subsequent import, activation and fresh reopen have not been qualified by #102's synthetic restore tests.The current application status-signing step is a sign-only operation whose terminal outcome was pending readback when this draft was prepared. It is not phase or model authority. The 200-paper source-verified 97/111 result preserving the original 91 is historical; the current-code mapper is reviewed but disabled and unrun. #20, #22 and #23 remain unqualified. The separate 10,000-paper producer stopped with 2,333 preserved rows and an expired original cutoff; it has not been restarted. #90 remains open for the actual transition and replay gates, independently of this repaired public helper.
Separate actual predecessor receipts already verify the recovered import, activation and fresh historical reopen. They preserve the old reservation and UNKNOWN provider intent. The public #102 repair does not replace those receipts or authorize a repeat restore. The initialized status anchor remains revision zero with no committed event; the sign-only step is a separate pending operation.
CompleteDotTech commentedon Oct 1, 2026
First reviewer-status commit recovered and independently verified
The actual commit-only recovery exited successfully. Root and separate assistant readbacks verified the enrolled owner's public Ed25519 signature, the exact revision-1 event and pointer, and the closed durable high-water SQLite anchor at revision 1. All seven historical target files remain byte-identical to the reopen baseline.
The first attempt failed before writing an event because its status binding omitted
valid_through. That failure and its unchanged-state receipt remain preserved. The versioned repair requires matching explicit validity windows before execution and around the complete runtime scans; ten focused checks and separate code review passed. Recovery committed the same signed receipt, without signing again or retrying the historical unknown provider request.Evidence SHA-256:
79130023be09855dedb820705c5acf388452c44d8ce16be848a882bc7728aeb9.0844180d14d7d342fd4a88c1d7297230c5a0a9a032d4566390d024b461dbb327.00e096664fbcc1d2b6d99160b86f8503945131da615fb9f248c81fbe1d0caf14.12c7f48913a004004b27ccd6824b5e7526b06cc886a3448556d843b14d546b1b.This step made no model call, source action, graph write, or phase transition. The status receipt has a fixed expiry and grants no future-stage execution authority. #90 and #23 remain open. The current-source pilot dispatch and strict historical readback guard are being implemented and reviewed separately; unseen qualification, the complete retrieval experiment, and actual generated-answer acceptance remain outstanding.
CompleteDotTech commentedon Oct 1, 2026
Historical imported-state readback completed
The reviewed, single-owner read-only audit completed successfully. It checked the captured runtime and both source identities before and after execution, then held the existing source-stage and phase-authority locks while replaying the imported historical state. Root and separate assistant readbacks verified that all seven target files remained byte-identical and the owned process tree exited.
The readback found the preserved eight source statuses, 19 historical requests, 12 imported blobs, and the imported checkpoint and application-journal chains. The graph remains at version 1. The historical budget still counts one model-call reservation and 14,120 request bytes, with zero retries. The earlier provider outcome remains unknown and unreattempted.
This was a provenance and state-integrity check. It made no model call, source admission, graph write, or phase write, and grants no authority for a fresh model stage. Current reviewer status and stage releases require their own review before any later execution. #90 and #23 remain open.
Evidence: root terminal readback
7b3ffe0cfb7d7c9ff38bf5012e4c101cc232f845371a29ae081a7288c36f3d95; independent readback74c9bdf90afef3c88320a426a1b26d7fe0f2188cd8282b615e3266b4351e7cd6.Merge pull request #109: portable native Windows admission-fence fixt…
Repair Windows fixture descriptors and preserve strict denial diagnos…