[scbrown]

Clients sharing one signing key can supply different actors, but 0.7.1 refuses those writes and also refuses signed non-bearer HTTP traffic. This restores compatibility with a user/host actor_principal_mode = "off" | "observe" | "enforce", defaulting to observe. Observe preserves the claimed actor, records actor/principal/verb/time with a cumulative counter and 64 bounded events, and warns; explicit enforce retains the mismatch refusal. Project configuration cannot change the host policy. The observer records attempts, not committed writes; a corrupt/unavailable counter warns UNKNOWN without refusing the write. Counter-lock contention is bounded to about one second, then proceeds with UNKNOWN; the held-lock CLI control completes without releasing the lock. Enforce requires a verified remote signing identity and refuses local/unkeyed writes before a store is opened.

The plain-HTTP check again covers bearers only, exactly restoring 0.6.7's signed-request exposure. Signatures bind method/path/content-type/body, with server time/nonce replay controls, but do not encrypt traffic or bind its destination: an interceptor can read or relay a captured request within its validity window. HTTPS write routing and CA trust are a separate rollout. The existing destination-trust, key-file, identity-binding and no-bearer-fallback checks remain in place.

Validation: just check plus repository-knowledge controls passed under the HOME/resource guard. The actual CLI fixture uses two agents under ONE synthetic host key and verifies preserved update actors, a positive counter of two, matching/mismatching enforce, off, corrupt-counter UNKNOWN, and bearer refusal before even /health. Its signed-only URL takes the conservative non-exempt HTTP branch while canonicalizing to a private loopback listener; no DNS, host allowance or real board participates. Unit controls cover host-only/default/invalid modes, 8 concurrent writers / 80 total counter increments and 64-event retention. Only the existing config source-witness hash changes.

Demo: caption and replay instructions, actual transcript, raw recording. Target is an isolated HTTP protocol fixture; candidate explicit-enforce is the refusal control, not a run of the base binary. The recording's binary SHA256 is d516378a79352816b02d32cba96ced88b1a0e203b8348d12aab81a7833a42e2d. Native scriptreplay playback passed; no inline player is claimed. The fixture does not validate server-side cryptography or establish deployment.

Source head: 56df0484f432292a2e26b89753894b4bd6a49e12, base 39bfcdb83fc577b82e40f34a0e2fc6585be5b62a. This is the source fix intended for the normal 0.7.2 release lane; it does not change the package version or installed configuration. One independent post-green review is required. Canary promotion/release admission, per-agent principals, the measured observe interval and enforcement activation remain separate gates.

Normal current-main integration only: the complete original proposal replays forward and inverse with three-way context to the exact merged/base trees. All actor-policy native source blobs and the actual CLI regression fixture remain identical to the recorded 6f9300ad proposal; fresh merged-head just check and knowledge controls pass under the HOME guard. The retained demo identifies its original local candidate, not an installed or newly built binary. Current native T2 classification is available; independent post-green source review is still required.

Bead: aegis-k67o

Overlap preflight: bb4df5dadf760d64b57375ce741c4b9df9f02cbec117b317ceef8b0607b4cb16

• PR perf(remote): prefer compatible board projection counts #187 @ a8aae0e: independent — Independent: this candidate changes signed-client transport admission and host actor policy; this PR adds a projection module and configurable private server fixture. No projection/count module or server-fixture-config edits here. Preserve its draft and existing capability/release gate.
• PR feat(projection): prepare committed board read views #193 @ 1b8288c: independent — Independent: this candidate changes only the config.rs witness; this PR changes the src/lib.rs witness for board read views. Different JSON records; no lib.rs, view declaration or runtime activation edits here. Preserve its separate release/runtime gates.

Current-base validation: normal merge of release main 39bfcdb8 followed by a narrow parallel-counter test correction. The fresh full suite first failed because the stress test unwrapped permitted one-second lock-busy outcomes. The repaired test accounts for all80 attempts, distinguishes busy attempts from successful records, and requires stored total to equal every successful record; unrelated errors still fail. No product deadline or actor behavior changed. Fresh full just check and knowledge checks PASS, HOME157 paths +5 UID resources clean. Original proposal forward/inverse parity was exact before the explicit test-only repair. Fresh hosted CI/current strict admission and Ian review remain owed; prior refusals and red result retained. Existing release tag does not deliver this proposal; release/canary gates remain.