# AWP I1 Audit Remediation — Durable Plan and Progress

**Date:** 2026-08-24
**Status:** ACTIVE
**Branch:** `fix/i1-audit-remediation-20260824`
**Worktree:** `/home/user/Projects/.worktrees/awp-i1-audit-remediation-20260824`
**Base:** `origin/main@d7dddc24dc9113ed0d2ed7a7fcd392f50e70cab9`
**Audit:** `docs/progress/2026-08-24-awp-direction-progress-audit.md`
**Completion boundary:** this remediation is **not complete** until all applicable audit findings are either implemented or explicitly reconciled by binding scope amendment, exact-head gates pass on Debian buildboxes, the latest concurrent main-session work is safely converged, and the final exact green head is pushed to `origin/main` and remotely verified.

## Mission

Finish I1 at the proof/live/semantic layer without reopening the AWP architecture or pulling I2-I9 product scope forward. The goal is to convert the 2026-08-24 audit into concrete remediation, preserve the strong source architecture already landed, close the remaining binding owner-pain gaps, make the canonical GOLIVE harness executable and internally coherent, reconcile governing documents, then land the exact green result on canonical main.

## Non-negotiable guardrails

1. **Parallel isolation:** never modify the active main-session dogfood worktree `/home/user/Projects/.worktrees/awp-i1-dogfood-deploy`.
2. **Current collision zone:** main session is currently modifying `tests/golive/13-dependency-order.spec.ts` and adding `tests/golive/exact-journey.ts`; do not edit those paths until the main session checkpoints/pushes and the latest state is deliberately reconciled.
3. Always fetch/reinspect `origin/main` and the active dogfood lane before entering a likely-overlap phase.
4. Never force-push or overwrite concurrent work. Use fresh convergence commits/worktrees when necessary.
5. Heavy tests, Playwright/E2E, PostgreSQL and DBOS proofs run only on `debian1`, `debian2`, or `debian3`, never the workstation display.
6. Preserve ADR-0009 authentication, loopback privileged topology, automatic trusted Merge, independent reviewer AgentRun, exact-candidate verification, WIP durability, DBOS marker/outbox semantics, and current provider boundaries.
7. Keep `GOLIVE.md` at 0/30 until one real canonical owner journey produces fresh accepted evidence. Structural test success is not owner acceptance.
8. Do not deploy until the source/controller/bindings are converged and exact-head green.
9. Do not invent/copy an operator password or Argon2id credential. Owner-controlled credential provisioning remains an explicit deployment prerequisite.
10. Do not activate I2-I9 features to satisfy I1 ambiguities. Where a binding pain invariant conflicts with the increment roadmap, implement the minimum I1-safe contract or record an explicit binding applicability amendment.
11. Update this file after every material checkpoint, including evidence, blockers, overlap risks and next action.
12. Final `DONE` means the exact green convergence commit is on `origin/main` and a fresh fetch proves remote containment/equality as intended.

# Goals

## G1 — Make canonical GOLIVE executable and internally coherent

Close audit P0-1/P0-2 without weakening evidence discipline:

- introduce a real proof-unit readiness lifecycle rather than hard-coded `ready: 0`;
- implement `executeJourney()` as the canonical resumable controller;
- execute units only in declared dependency/barrier order;
- persist/validate journey stage transitions and receipts;
- reconcile proof file runtime dependencies with criterion-registry declarations;
- canonicalize manifest-selector environment aliases;
- distinguish controller-generated flags from external runtime inputs;
- add a mechanical registry-vs-proof-environment contract test;
- preserve exact repository/journey identity, lock behavior, UI receipts and fail-closed recovery;
- keep acceptance 0/30 until live receipts exist.

## G2 — Close remaining I1 owner-pain semantic gaps

### Configuration authority

Implement the minimum I1 realization of the binding Postgres/typed configuration contract:

- typed ConfigurationDefinition/override persistence;
- explicit bootstrap environment allowlist;
- read/write application/control-plane seam with audit;
- Workspace/execution configuration as projection, not alternate authority;
- explicit mechanism enable/disable semantics where active;
- tests for the binding configuration pain invariants.

Do not build the future broad Settings/policy product.

### VCS conflict autopilot

- distinguish trusted merge conflict from ambiguous provider failure/stale target;
- preserve exact candidate + target observations;
- create typed AWP-owned correction/conflict-resolution work rather than owner Git decisions;
- ensure deterministic branch/candidate strategy;
- rerun verification/review before trusted Merge;
- add `conflict-resolves-without-user` and deterministic-strategy regressions.

### UI owner-attention semantics

- Task `review` must not imply owner action in the default autonomous chain;
- `correction` must not imply owner action unless an actual authority-bound Decision/Approval exists;
- U1 “Needs Your Attention” must project real owner-actionable I1 state or have an explicit binding scope amendment;
- retain approved U1-U6 visual hierarchy.

### Verification / policy applicability

- reconcile I1 exact-candidate/provider evidence with the stronger future typed CI/acceptance-reference wording;
- reconcile default-autonomy/policy pain invariant with later generic I3 policy productization;
- implement minimum I1-safe tests/contracts, not future product UI.

## G3 — Reconcile governance/spec authority with actual implementation

- update `docs/plans/INDEX.md` current execution to current work;
- repair nonexistent/stale progress references;
- update durable-workflow architecture “Current Implementation State” to reflect marker/outbox/crash proof now implemented;
- mark stale dogfood handoff superseded;
- amend/supersede U5 manual-Merge interaction in the binding visual reference without regressing source;
- quarantine/remove legacy manual Review/Merge detail renderer or mechanically mark it non-production;
- strengthen AC-20 independent Review acceptance wording to match implementation.

## G4 — Converge safely with the simultaneously active main session

- let the main session continue independently;
- do non-overlap remediation first;
- periodically inspect its durable state/branch without mutation;
- when its GOLIVE work is checkpointed, merge/rebase conceptually via fresh convergence, never overwrite;
- preserve the better/newer implementation on both sides;
- resolve proof-controller conflicts semantically;
- rerun all exact-head gates after convergence.

## G5 — Live-proof current architecture and land canonical main

After source convergence:

- full `pnpm check`;
- architecture/dependency gates;
- disposable PostgreSQL migration/no-drift gate;
- real DBOS post-commit/pre-checkpoint SIGKILL proof;
- focused auth/session/GOLIVE/config/VCS/UI tests;
- deploy exact green candidate to Debian3 only when owner credential prerequisite exists;
- verify loopback listeners + Tailscale HTTPS + source/image/schema provenance;
- execute canonical authenticated owner journey if deployment prerequisite is available;
- advance GOLIVE only from that journey's fresh receipts;
- land exact green/converged commit to `origin/main`;
- fresh fetch verifies main contains all concurrent work and exact remediation;
- no further edits after final verification.

# Task ledger

## Phase A — Durable setup / authority reconciliation map

- [x] A0 Create isolated remediation branch/worktree from current `origin/main`.
- [x] A1 Carry the current direction/progress audit into this branch.
- [x] A2 Map each audit finding to exact source/spec/test files and likely overlap with the active main session.
- [x] A3 Identify which binding pain-invariant requirements can be closed in I1 versus which require explicit applicability amendments.
- [x] A4 Push this durable plan and establish recoverable branch state.

## Phase B — Non-overlapping governance and UI semantic corrections

- [x] B1 Update Plans Index current execution and progress references.
- [x] B2 Update durable-workflow implementation-status text/evidence.
- [x] B3 Mark obsolete dogfood handoff superseded.
- [x] B4 Amend U5 manual-Merge reference to automatic trusted Merge authority.
- [x] B5 Quarantine/remove legacy manual-Merge detail renderer.
- [x] B6 Correct FactoryRun `review`/`correction` owner-attention semantics.
- [x] B7 Make U1 Attention authoritative for current I1 owner prerequisites or record explicit scope amendment.
- [x] B8 Strengthen AC-20 wording and acceptance tests.

## Phase C — Configuration authority minimum I1 realization

- [x] C1 Inventory every production runtime tunable and classify bootstrap/secret vs authoritative config.
- [x] C2 Add typed configuration persistence schema/repositories.
- [x] C3 Add application/control-plane read/write/audit seam.
- [x] C4 Migrate active non-bootstrap tunables from direct environment authority to Postgres-backed configuration.
- [x] C5 Define bootstrap allowlist and explicit active mechanism off-switches.
- [x] C6 Add binding configuration pain-regression suite.
- [x] C7 Generate migrations and verify real PostgreSQL upgrade/no drift.

## Phase D — VCS autonomous conflict recovery

- [x] D1 Model trusted merge conflict distinctly from ambiguous retryable provider failures.
- [x] D2 Preserve candidate/target conflict evidence and create deterministic corrective work.
- [x] D3 Route conflict resolution through a new AWP Attempt without owner Git mechanics.
- [x] D4 Require new candidate verification + independent Review before retrying Merge.
- [x] D5 Add `conflict-resolves-without-user`, deterministic strategy, and replay tests.

## Phase E — Verification/policy applicability reconciliation

- [x] E1 Determine minimum binding I1 evidence-reference contract; implement tests/types if needed.
- [x] E2 Determine minimum I1 policy/HITL declaration contract without pulling I3 UI/productization.
- [x] E3 Update binding docs/tests to make increment applicability explicit and non-contradictory.

## Phase F — GOLIVE controller/binding convergence

**Concurrency rule:** do not enter overlapping files until the active dogfood/main session has checkpointed its current exact-journey work. Reinspect first.

- [x] F1 Fetch and inspect latest main-session GOLIVE checkpoint; record overlap.
- [x] F2 Reconcile criterion-registry proof lifecycle/readiness with latest exact-journey work.
- [x] F3 Reconcile all proof environment/runtime-input declarations and aliases.
- [x] F4 Add mechanical proof-env contract gate.
- [x] F5 Implement/resume canonical `executeJourney()` controller with barriers, manifest transitions, locks and receipts.
- [x] F6 Prove restart/resume and fail-closed ambiguous-evidence behavior.
- [x] F7 `test:golive:validate` shows structurally complete and semantically executable units without claiming owner acceptance.

## Phase G — Integrated verification

- [x] G1 Focused application/provider/UI/config/VCS/GOLIVE tests green on authorized Debian buildboxes.
- [x] G2 Full workspace build/typecheck/lint green.
- [x] G3 Real PostgreSQL migrations apply; Drizzle no drift.
- [x] G4 Real DBOS SIGKILL durability proof remains green.
- [x] G5 Full `pnpm check` exact-head green.
- [x] G6 Architecture/scope audit: no I2-I9 expansion, no trust-boundary regression, no default owner Merge.

## Phase H — Live dogfood / owner proof

- [x] H1 Reinspect Debian3 before deployment; record current provenance/topology.
- [x] H2 N/A for this run: owner Argon2id password hash is absent, so H6 applies and no credential was invented or changed.
- [x] H3 N/A for this run under H6: no new deployment was performed without owner authentication; pre-cutover live topology/health was inspected read-only.
- [x] H4 N/A for this run under H6: authenticated owner journey cannot run without the owner credential.
- [x] H5 Preserved fail-closed acceptance state: no criteria were advanced without fresh authenticated same-journey evidence; owner acceptance remains 0/30.
- [x] H6 Owner authentication credential is unavailable; only live owner proof is blocked, source remediation/landing continues, and GOLIVE owner acceptance stays 0/30.

## Phase I — Final convergence and main landing

- [x] I1 Fetch current `origin/main` and active main-session branch; identify commits not contained in remediation.
- [x] I2 Converge all durable concurrent work in a fresh/clean integration state, resolving conflicts semantically.
- [x] I3 Run exact-head G1-G6 again after convergence.
- [x] I4 Push remediation/convergence branch and verify remote SHA.
- [x] I5 Fresh race check: current main and the durable dogfood feature checkpoint are ancestors/contained; the active dogfood worktree remains isolated with only uncommitted controller WIP.
- [x] I6 Fast-forward exact green convergence to `origin/main`.
- [x] I7 Fetch remote and prove `origin/main` contains the exact source convergence plus all durable concurrent work included in scope.
- [x] I8 Final durable status checkpoint; exact-head `pnpm check`; push same checked commit to main; no further edits.

# Current state

**Checkpoint 6 — Phase E complete and exact-head green.**

- exact source head `77e01d7`;
- I1 `VerificationEvidence` now carries a structured immutable reference: trusted provider observation or attested Workspace checkpoint; bare required evidence cannot satisfy the Merge/Done gate;
- evidence-reference validation is centralized in the domain and shared by runtime MergeGate and UI read model; workspace references must bind the exact candidate digest, provider references must carry resolvable provider/resource/native identity;
- attempt-completion evidence automatically receives the already-attested Workspace checkpoint reference; repository-required-check evidence receives the trusted provider observation reference; manual required evidence requires an explicit immutable reference;
- migration `0019_yummy_mesmero.sql` persists the reference JSONB column; disposable PostgreSQL 16 verification gate PASS and Drizzle no-drift PASS;
- binding Chain 5 now states the thin I1 reference contract and makes first-class CIExecution/acceptance-run IDs an I5 extension rather than an impossible I1 prerequisite;
- binding Chain 3 now makes generic per-Project HITL editing an I3 activation gate while mechanically requiring I1 to have zero post-launch Approval/HITL gates;
- new named regression suite covers evidence reference resolvability/staleness, bare self-report rejection, no ritual CI start in I1, zero post-launch Approval writes, default no-HITL behavior, and I3 applicability;
- Debian2 Phase E full workspace build PASS; focused 6 files / 40 tests PASS; exact-head verification/read-model subset 24/24 PASS; formatting PASS. E1-E3 complete.

# Current state

**Checkpoint 5 — Phase C complete and exact-head green.**

- exact source head `e2ccf80`;
- existing config tables are now real authority via PostgreSQL repositories and `ConfigurationAuthorityService`;
- migration `0018_silent_mole_man.sql` adds one-authoritative-override uniqueness for `(definition_key, scope_type, scope_id)`;
- authenticated configuration API exposes definitions, effective values, override list/set/delete; every mutation is audited without copying values into audit metadata;
- Project/system `execution.enabled` and `execution.defaultModel` are the minimum active I1 registered settings; both resolve from the database only;
- new Plan approval resolves configuration in the same transaction that creates its FactoryRun; explicit owner model selection wins, config default otherwise becomes durable FactoryRun/Attempt provenance;
- changing `execution.defaultModel` affects the next FactoryRun without restart and leaves prior run provenance unchanged; `execution.enabled=false` is a real Project off-switch that prevents a new FactoryRun;
- direct control-plane env fallbacks for account, model, first-attempt failure and workspace storage are removed; account remains explicit durable selection, current workspace storage is fixed deployment-profile data, and synthetic/native failure injection remains harness/deployment behavior rather than user runtime configuration;
- Debian2 exact-head workspace build PASS; focused configuration/provenance/auth gate 7 files / 16 tests PASS; changed-file Prettier PASS;
- disposable PostgreSQL 16 integration PASS and Drizzle regeneration reports no schema drift. C1-C7 complete.

**Checkpoint 4 — Phase C authority substrate drafted and verified.**

- C1 inventory complete. Existing `configuration_definitions` / `configuration_overrides` tables have existed since migration 0000; the missing layer was repository/application/API authority and production consumption, not table creation.
- registered I1 runtime settings are intentionally small: `execution.enabled` (Project/system future-run off-switch) and `execution.defaultModel` (Project/system future-run model default).
- account selection remains an explicit owner choice persisted on FactoryRun; direct control-plane `AWP_AGENT_ACCOUNT_ID`/`AWP_AGENT_MODEL` fallbacks are removed rather than promoted to settings.
- legacy `AWP_FORCE_FIRST_ATTEMPT_FAILURE` is no longer read from control-plane environment; the string that remains is a projected synthetic workload variable used by the old fixture command. Current native dogfood failure injection remains deployment-mode gated.
- `AWP_WORKSPACE_STORAGE` is removed as a runtime env knob and the current profile size is fixed deployment profile data; future configurable resource sizing must become a database definition rather than another env setting.
- closed bootstrap/deployment wiring catalog now distinguishes DB/ports/credential files/provider endpoints/image/namespace/executor/test-dogfood harness inputs from registered user runtime settings.
- persistence repository ports + PostgreSQL implementations are drafted over the existing config tables; a composite unique index for `(definition_key, scope_type, scope_id)` is drafted and requires migration generation.
- `ConfigurationAuthorityService` is drafted with definition registration, scoped resolution, audited set/delete, and same-transaction Project execution resolution.
- authenticated control-plane read/write/effective/override API routes are drafted.
- Plan approval now resolves `execution.enabled` and `execution.defaultModel` in the same transaction that creates a new FactoryRun; explicit owner model wins, prior FactoryRun provenance is unaffected by later setting changes.
- binding tests are drafted for Postgres authority, closed bootstrap allowlist, working API, runtime projection/provenance, and the execution off-switch.
- no active main-session collision file was modified.

**Checkpoint 3 — Phase B complete and focused-green.**

- exact source head `4a1f999`;
- full workspace build passed before the final formatting-only patch;
- exact-head UI focused gate: 6 files / 19 tests PASS;
- exact-head Prettier check for all Phase B changed files PASS;
- B1-B8 complete: current plans/spec truth, superseded handoff, automatic-Merge U5 authority, legacy manual detail renderer quarantine, autonomous review/correction semantics, authoritative minimum I1 Attention, and stronger AC-20 contract;
- no active main-session GOLIVE collision file was modified.

**Checkpoint 2 — Phase B implementation drafted and verified.**

- Plans Index now points current execution at I1 closure/live proof rather than already-completed branch convergence;
- durable-workflow binding status now records the implemented marker/outbox seam and exact DBOS SIGKILL proof;
- interrupted dogfood handoff is prominently marked superseded/historical;
- owner-approved U5 reference now reflects automatic trusted Merge rather than a manual default Merge button;
- legacy `live.ts` detail renderer has been reduced to the only production-used Projects list/create surface, removing dead manual Review/Merge forms;
- Task `review` and `correction` now project as AWP-owned automatic lifecycle stages rather than invented owner action / WAITING_USER;
- U1 Attention now derives current owner prerequisites from authoritative I1 state: missing execution account or a draft Plan ready for the explicit owner launch boundary;
- AC-20 wording now requires dedicated reviewer AgentRun/Attempt, distinct Principal/AgentRun identity and exact candidate binding;
- source diff check passes and no obsolete manual ChangeSet approval/Merge controls remain in production web source or the U5 reference;
- Debian2 workspace build PASS after the behavior changes; exact-head focused UI 19/19 and formatting PASS after final formatting commit.

**Checkpoint 1 — Phase A mapping complete.**

### Finding-to-file / overlap map

| Finding | Primary implementation/spec targets | Main-session overlap assessment |
|---|---|---|
| P0 GOLIVE readiness/controller | `tests/golive/criterion-registry.ts`, `tests/golive/run.ts`, proof files | **DEFER F-phase**: active session is currently changing dependency/exact-journey proofs. |
| P0 proof-env contract | criterion registry + proof files + orchestrator tests | **DEFER F-phase** for same reason. |
| P0 live deployment | `infra/dogfood/*`, Debian3 runtime | Source/deploy work deferred until F/G complete; no current workstation overlap. |
| Config authority | `packages/config`, persistence schema/UOW, application config seam, control-plane composition/tests | **LOW overlap**; safe parallel lane. |
| VCS conflict autopilot | `packages/application/src/trusted-merge.ts`, `execution.ts`, VCS provider contracts/GitHub adapter, focused tests | **LOW overlap**; safe parallel lane. |
| FactoryRun Review attention | `apps/web/src/approved-live.ts`, `render-factory.ts`, UI/read-model tests | **LOW overlap**; safe parallel lane. |
| U1 Attention projection | `apps/web/src/render-project.ts` plus approved Project read model/tests | **LOW overlap**; safe parallel lane. |
| Plans/spec drift | `docs/plans/INDEX.md`, durable-workflow architecture doc, stale dogfood handoff, U5 mockup note | **NO runtime overlap**; safe first. |
| Legacy manual renderer | `apps/web/src/live.ts` import graph + tests | **LOW overlap**. |
| AC-20 wording | `GOLIVE.md` + independent-review proof assertion | Text change safe now; proof-file enhancement may be deferred if collision emerges. |
| Verification/policy applicability | pain-invariant + realization matrix/authority docs + minimum tests | **NO source collision expected**; no I3/I5 product expansion. |

### Binding applicability decisions for this remediation

1. **Configuration — close in I1, minimum authority only.** The realization matrix already says typed configuration is I0 and Project/Workspace/runtime behavior exists in I1. Therefore Postgres-backed definitions/overrides, bootstrap allowlist, audited API seam, projections and off-switch semantics are an I1 obligation. Broad future Settings UX is not.
2. **VCS conflict recovery — close in I1.** Repository/VCS and autonomous trusted Merge are active I1 flows; safe refusal alone does not satisfy the binding owner-pain contract. Implement typed autonomous correction work without exposing Git mechanics to the owner.
3. **VerificationEvidence — narrow binding amendment.** I1 must retain exact candidate binding, immutable provider evidence identity, stale-evidence invalidation and resolvability for the evidence types it actually owns. Typed first-class CIExecution/acceptance-run entities belong to I5 full control plane and are not invented here. The binding pain invariant must say those reference kinds become mandatory when those entities activate.
4. **Policy/HITL — narrow binding amendment plus default tests.** I1 must prove the shipped default chain contains no invented interactive gates, and any actual early protected owner boundary maps to a declared narrow hook. Per-Project generic hook editing/API/UI remains I3 productization; do not build the full policy editor here.
5. **U1 Attention — close the active I1 minimum.** The panel must reflect owner-actionable prerequisites that already exist in I1 (e.g. draft Plan approval/start, account/setup blocker) rather than remain hard-coded zero. Future generic Decision/Approval projection may extend it in I3.
6. **AC-20 — close in I1.** Independent reviewer AgentRun/Attempt/candidate identity already exists; acceptance wording should match the stronger implemented contract now.

### Safe implementation order while main session continues

`B docs/UI -> C configuration -> D VCS recovery -> E scope reconciliation -> re-inspect main session -> F GOLIVE convergence`.


**Checkpoint 0 — remediation lane initialized.**

Observed immediately before lane creation:

- canonical `origin/main@d7dddc2` is the audited baseline;
- current audit is committed here as `a97b63c`;
- active main-session dogfood worktree is **ahead 53 commits** of its stale remote and currently dirty with:
  - modified `tests/golive/13-dependency-order.spec.ts`;
  - new `tests/golive/exact-journey.ts`;
- therefore F-phase GOLIVE controller work is intentionally deferred until that session checkpoints;
- no blocker exists for B/C/D/E non-overlap remediation.

# Evidence log

- 2026-08-24: fresh remote inspection confirmed `origin/main=d7dddc2`.
- 2026-08-24: active dogfood/main-session work inspected read-only; no mutation performed.
- 2026-08-24: isolated branch/worktree created from `origin/main`.
- 2026-08-24: current 1,165-line audit cherry-picked into remediation branch as `a97b63c`.
- 2026-08-24: Phase B governance/UI semantic implementation drafted across 11 files; `git diff --check` PASS; focused buildbox verification pending.
- 2026-08-24: first Debian2 Phase B build found only one unused legacy type after dead-renderer removal; repaired in `86e3201`.
- 2026-08-24: Debian2 workspace build PASS and Phase B UI tests 19/19 PASS; Prettier-only cleanup committed as `4a1f999`.
- 2026-08-24: exact `4a1f999` focused UI 19/19 + changed-file Prettier PASS. Phase B complete.
- 2026-08-24: C1 inventory confirmed config tables are existing substrate; authority/use are absent. Classified active env surfaces and chose minimum I1 database settings `execution.enabled` + `execution.defaultModel`.
- 2026-08-24: Phase C2-C6 draft implemented locally across config/application/persistence/control-plane/tests; `git diff --check` PASS. Migration, lockfile, compile and focused tests pending.
- 2026-08-24: Drizzle generated `0018_silent_mole_man.sql`; workspace build PASS; Phase C focused suite 16/16 PASS.
- 2026-08-24: disposable PostgreSQL 16 config integration PASS; Drizzle no-drift PASS; final exact `e2ccf80` workspace build + 16/16 + formatting PASS. Phase C complete.
- 2026-08-24: Phase E introduced structured I1 VerificationEvidence references and binding I1/I3/I5 applicability reconciliation; migration `0019_yummy_mesmero.sql`.
- 2026-08-24: Phase E Debian2 build PASS; 40/40 focused evidence/persistence/policy tests PASS; disposable PostgreSQL verification gate + Drizzle no-drift PASS; exact `77e01d7` 24/24 + formatting PASS. Phase E complete.

# Blockers

None for source remediation.

Potential future live-proof prerequisite: owner-controlled `operator-password-hash` was absent on Debian3 during the audit. This does not block source remediation or main landing; it blocks authenticated live owner acceptance only if still absent at Phase H.

# Next action

Reinspect the active main-session dirty set, then execute Phase D VCS autonomous conflict recovery in trusted-merge/provider code. Keep owner vocabulary Task/Change/Review/Merged, preserve WIP, create deterministic corrective work, and do not collide with active GOLIVE proof files.

### Checkpoint 7 — Phase D exact-head verification complete

- Exact pushed remediation head: `ae6fa17` (`fix/i1-audit-remediation-20260824`).
- Debian2 recursive workspace build: **PASS**.
- Debian2 focused durability/VCS gate: **8 files / 49 tests PASS**:
  - `tests/application/trusted-merge.test.ts`
  - `tests/integration/verification-merge-gate.test.ts`
  - `tests/regressions/i1-vcs-invariants.test.ts`
  - `tests/application/execution-retry.test.ts`
  - `tests/application/kubernetes-acp-recovery.test.ts`
  - `tests/integration/persistence.test.ts`
  - `tests/integration/dbos/workflow-dbos.test.ts`
  - `tests/integration/workflow-step-seam.test.ts`
- Autonomous repository divergence/conflict behavior is now covered end-to-end at the application/persistence boundary:
  - original collected candidate Workspace remains immutable/preserved;
  - correction allocates a fresh Workspace/Attempt;
  - source Change patch is durable correction input;
  - correction side effects use named DBOS workflow steps;
  - corrected Change receives a new candidate digest, new checkpoint evidence, and a distinct independent Review;
  - merge is refused until that fresh Review is submitted;
  - no Git-kind Approval row is created.
- Deterministic trusted publication refs are provider-owned and sanitized (`changeset:deterministic` -> `refs/heads/awp/changeset-deterministic`).
- The VCS vocabulary regression now scans owner-rendering sources rather than HTTP/server implementation identifiers, avoiding false positives such as an internal variable named `upstream`.

**Next:** audit Phase E against current owner-surface and recovery coverage without editing the active dogfood/GOLIVE worktree; then converge only non-overlapping gaps.

### Checkpoint 8 — Phase F inspection + preliminary integrated gates

- Remediation head after lint checkpoint: `ae947df` (exactly pushed when verified).
- `origin/main` remains the direct base of the remediation lane: **0 behind / 21 ahead** at this checkpoint.
- Latest inspected dogfood local checkpoint: `92c05a6` (`test(golive): bind completion and restart proofs`), seven commits ahead of `origin/main`.
- The dogfood worktree is **not yet convergence-ready**: 30 dirty paths remain, including `packages/application/src/execution.ts`, `packages/application/src/golive.ts`, persistence, approved live UI, criterion registry, exact-journey controller, and many GOLIVE criteria. Its remote branch also trails its local checkpoint. Per the concurrency rule, no overlapping remediation edits were made.
- Remediation GOLIVE registry validation on Debian2: **PASS** structurally (`registry structure: 30/30`), with expected pre-convergence state `semantic readiness: 0/30`, `owner acceptance: 0/30`. Diagnostic listing is also structurally valid.
- Preliminary repo-wide `pnpm check` on Debian2:
  - recursive build/typecheck: **PASS**;
  - lint initially found one type-only import and was repaired/pushed as `ae947df`;
  - test suite reached **57 passed files / 258 passed tests**, with only two failures from stale tests that still import removed legacy `renderLiveProject`;
  - those tests cover AC24 tool/diff and recorded failure visibility. The governing audit explicitly requires the legacy detail renderer to remain quarantined/removed, so the correct convergence is to bind these proofs to approved production renderers, not restore the obsolete manual Review/Merge renderer;
  - dogfood currently modifies `apps/web/src/approved-live.ts`, so that migration is intentionally deferred until its current checkpoint is clean.
- Architecture gate on Debian2: **PASS** (`6/6` architecture tests; dependency-cruiser: 119 modules / 214 dependencies, zero violations).
- Format check currently reports five remediation files. One is `packages/application/src/execution.ts`, actively modified in dogfood; formatting/convergence is deferred to avoid unnecessary conflict expansion.

**Next:** wait only in the logical sense—not by idling—for the dogfood lane to checkpoint: continue read-only inspection and non-overlap verification; once its dirty exact-journey work is durably checkpointed, create an isolated convergence worktree from `origin/main`, combine dogfood + remediation semantics, migrate AC24/failure proofs to approved renderers, format, and run full exact gates.

### Checkpoint 9 — Debian3 pre-cutover inspection

- Read-only Debian3 inspection completed; no deployment or service mutation performed.
- Current live control-plane listens on `:8787`; web listens on `:4173`; both run from `/home/user/services/awp-i1/repo`.
- Control-plane `/health`: **200**, PostgreSQL authoritative, **14/14 migrations applied**, `pending: 0`, `drift: []`.
- Web root responds and redirects to the current live Project route.
- K3s support services are healthy: Fabro, model gateway and Subrouter are Running; the historical `awp-golive` worker pod is Completed.
- The deployed service tree is a copied source snapshot with no `.git` metadata. Therefore H3 must obtain exact deployed-source identity from deployment receipts/digests; it is not acceptable to infer a commit SHA from the filesystem.
- The active dogfood session remains dirty at local checkpoint `92c05a6`; convergence/cutover remains intentionally deferred.

**Next:** continue non-overlap checks and re-inspect dogfood for a clean durable checkpoint; when available, build an isolated combined candidate and resolve the approved-renderer AC24/failure proof gap there.

### Checkpoint 10 — Fresh PostgreSQL migration proof

- Exact remediation head: `0db5933`.
- Fresh PostgreSQL 16 disposable database on Debian2 exposed and fixed a real migration-status bug: Drizzle wraps PostgreSQL `42P01`, so an empty database previously threw instead of reporting zero applied migrations.
- Fix: `packages/persistence/src/database.ts` now walks wrapped causes and recognizes `42P01` without suppressing unrelated database failures.
- Real fresh-schema proof after the fix:
  - before migrate: `applied=0`, `expected=20`, `pending=20`, `drift=[]`;
  - health after migrate: PostgreSQL `ok`;
  - after migrate: `applied=20`, `expected=20`, `pending=0`, `drift=[]`.
- Focused verification on Debian2: persistence typecheck **PASS**, ESLint for `database.ts` **PASS**, persistence + configuration authority **2 files / 12 tests PASS**.
- Disposable PostgreSQL container was removed by trap after the proof.

**Next:** continue monitoring dogfood checkpoint status while advancing remaining non-overlap G4/G6 evidence.

### Checkpoint 11 — Clean dogfood checkpoint and isolated convergence started

- Active dogfood worktree became clean at `a501c1c` (`test(golive): converge canonical journey controller`) and was pushed to `origin/ops/i1-dogfood-deploy`.
- `origin/main` advanced independently to `30b1644` with Node 24 plus published agent/system image digest pins. Those commits are not present in either side lane and must be preserved.
- Created isolated convergence worktree `/home/user/Projects/.worktrees/awp-i1-final-audit-convergence-20260824` on branch `converge/i1-final-audit-20260824` from exact current `origin/main@30b1644`.
- Merged dogfood checkpoint `a501c1c` into current main with no conflict.
- Began merging remediation `23a2fdb`; every production/application/persistence/GOLIVE file auto-merged cleanly. The only textual conflict was `tests/ui/approved-live-authoring.test.ts`.
- Conflict resolution preserves both contracts:
  - dogfood durable journey-stage history on the canonical Project surface;
  - remediation authoritative `Needs Your Attention` owner-prerequisite projection.
- Auto-merged `packages/application/src/execution.ts` contains both dogfood retry/FactoryRun lifecycle events and remediation autonomous repository-correction workflow steps.
- `git diff --check` is clean after the semantic conflict resolution.

**Next:** complete the convergence merge commit, push the branch, then run exact-head build/type/lint/focused suites, GOLIVE controller/registry tests, real PostgreSQL migration proof, real DBOS crash-window proof, architecture, formatting and full `pnpm check`. Repair any convergence failures before considering main landing.

### Checkpoint 12 — Approved AC24/AC25 evidence-surface convergence implemented

- Combined convergence exposed two stale unit tests and two GOLIVE specs still bound to the retired legacy `renderLiveProject` Project-detail renderer.
- Corrected the production contract instead of restoring legacy manual Review/Merge UI:
  - `I1AttemptDetail` now carries optional durable failure reason + tool-call evidence;
  - `factoryDetail()` projects those fields from authoritative Attempt state;
  - approved FactoryRun renderer exposes `data-agent-run-id`, `data-run-health`, `data-attempt-id`, visible failure history and named tool-call evidence;
  - approved Review renderer marks source diff lines with semantic `.diff-line.added` / `.diff-line.removed` classes while retaining existing code-line styling;
  - AC24 now navigates canonical FactoryRun detail for tool evidence and ChangeSet detail for source diff;
  - AC25 now navigates canonical FactoryRun detail for explicit failed-Attempt/retry evidence;
  - stale unit tests now target `renderApprovedLiveFactory` / `renderApprovedLiveReview`.
- `git diff --check`: **PASS**.
- Verification is pending on Debian2; do not mark G1/G5 complete yet.

**Next:** checkpoint/push these approved-surface corrections, run workspace build + focused UI/GOLIVE/controller tests, repair any failures, then continue real DBOS crash proof and full repository gates.

### Checkpoint 13 — Combined controller/DBOS/full-suite verification

- Combined exact source head before formatting: `2ef3885`, Node `24.19.0`, project pnpm `9.7.0`.
- Canonical GOLIVE controller validation on authorized buildbox:
  - `registry structure: 30/30`;
  - `semantic readiness: 30/30`;
  - `owner acceptance: 0/30` (correctly unclaimed).
- `tests/application/golive-orchestrator.test.ts` proves the Phase F controller obligations: exact runtime-input declarations, fresh allowlisted environments, missing-input failure, causal barriers/deduplication, mutation locks, staged manifest identity, durable run-scoped receipts, crash-after-receipt repair, exact recovery closure, and fail-closed ambiguous evidence.
- Real DBOS crash-window proof on Debian1/PostgreSQL 16: **1/1 PASS** (`tests/integration/dbos/durable-seam-crash.test.ts`). The child is actually SIGKILLed after the domain commit and before DBOS checkpoint; recovery re-enters without duplicating Project/event/audit/outbox/marker effects, and consumer receipt dedupe remains exactly once.
- Full repository `pnpm check` on Debian2 reached the final formatting phase:
  - typecheck/build: **PASS**;
  - lint: **PASS**;
  - Vitest: **59 files passed / 263 tests passed**, 5 files / 9 tests intentionally skipped because live opt-in environment was absent;
  - architecture: **6/6 PASS**, dependency-cruiser **0 violations** across 119 modules / 214 dependencies;
  - only failure: Prettier on six files.
- Those six files were formatted with the repository Prettier; `git diff --check` is clean. Formatting is semantic-neutral, but the final exact-head full gate must still be rerun after checkpointing.
- Buildbox storage pressure was isolated from source correctness by moving test temp files to `/dev/shm`; no unrelated project caches/builds were deleted. Only stale, unused AWP disposable run/build artifacts from this remediation were removed.

**Next:** commit/push the formatting-only checkpoint, resync exact head, rerun full `pnpm check`, rerun fresh PostgreSQL migration proof on the final head, then perform final race/convergence checks before main landing.

### Checkpoint 14 — Final source convergence landed; live owner proof correctly withheld

- Exact source convergence `ce987d9662ac1bb6f48f2674086edbedb22e0aa4` passed the complete repository gate on Debian2 under Node `24.19.0` / pnpm `9.7.0`:
  - recursive build/typecheck **PASS**;
  - ESLint **PASS**;
  - Vitest **59 files / 263 tests PASS**, with only 5 live-opt-in files / 9 tests intentionally skipped because live credentials/environment were absent;
  - architecture **6/6 PASS**; dependency-cruiser **0 violations** across 119 modules / 214 dependencies;
  - Prettier **PASS**.
- Exact `ce987d9` fresh PostgreSQL 16 proof: before migrate `0/20`, after migrate `20/20`, `pending=0`, `drift=[]`, health `ok`.
- Exact `ce987d9` real DBOS SIGKILL proof: **1/1 PASS** with no duplicate authoritative effects on recovery. Disposable proof database/container was removed afterward.
- GOLIVE controller state on the converged source: `registry structure 30/30`, `semantic readiness 30/30`, `owner acceptance 0/30`.
- Debian3 current config `/home/user/.config/awp-dogfood` has no `operator-password-hash`; no plaintext owner-test credential source was present. Per the explicit H6 contract, no credential was invented/rotated, no authenticated deployment/journey was claimed, and acceptance remains fail-closed at 0/30.
- Fresh race check before landing:
  - prior `origin/main@30b1644` is an ancestor of the convergence head;
  - durable dogfood feature checkpoint `a501c1c` is an ancestor of the convergence head;
  - the later dogfood-only commit `c45cadc` is merely a merge of that same `origin/main`;
  - two active dogfood controller files remain uncommitted and were intentionally not touched or claimed as landed.
- `origin/main` was fast-forwarded from `30b1644` to exact green source convergence `ce987d9`; fetch-back proved `origin/main == ce987d9` before this final documentation checkpoint.
- This documentation checkpoint is the final planned repository edit. It must itself pass exact-head `pnpm check` and then be pushed unchanged to both the convergence branch and `origin/main`; after that, no further edits are allowed in this lane.

### Checkpoint 15 — Final race resolution against latest main

- The first final-push race check detected that `origin/main` advanced from `ce987d9` to `35d80d4` while the final documentation checkpoint was being verified. The push was correctly aborted before touching main.
- The new main delta is limited to immutable published system-image locks:
  - `infra/dogfood/model-gateway-image.lock`;
  - `infra/dogfood/subrouter-image.lock`.
- There is no semantic overlap with remediation or GOLIVE controller logic. The latest main was merged cleanly into this convergence branch with no conflict and without touching active dogfood WIP.
- This merge plus checkpoint is now the final planned repository edit for this lane. The exact resulting commit must pass full `pnpm check`; only then may that same commit fast-forward `origin/main`.
- If main advances again before push, repeat the same fail-safe race check rather than overwriting concurrent work.