# I2 / I7a Authority Drift Cleanup — 2026-08-24

**Status:** COMPLETE — I2/I7a authority truth reconciled and landed
**Branch:** `fix/authority-drift-i2-i7a-20260824`
**Worktree:** `/home/user/Projects/.worktrees/awp-authority-drift-i2-i7a-20260824`

## Baseline

- Review started from canonical `origin/main@f466db26cc12f085affcba4bdc0525a350a338dc`.
- Live Debian3 is receipted to that exact SHA/tree, PostgreSQL is `23/23`, pending `0`, drift `[]`.
- Subrouter contains one owner-authorized Codex account.
- I2 Vision Recovery is complete and live-proven.
- I7a Machine Enrollment is explicitly owner-authorized, landed, deployed, and ready for onboarding.
- I1 GOLIVE remains `0/30`; repository-scoped publication authority and plaintext operator-login input remain separate owner trust boundaries.

## Drift found

1. `docs/plans/INDEX.md` still described the original premature I2 tip as “preserved without activation” even though corrected I2 recovery is now active/complete under explicit owner authority.
2. The same Current Execution section said I2 was the only sequencing exception even though the Index itself also lists I7a as an owner-authorized acceleration.
3. The I1 deployment rule hard-coded historical PostgreSQL `20/20`; canonical live is now `23/23`. The durable invariant is zero pending/drift plus exact receipted source identity, not a fixed migration count.
4. `docs/specs/ui/planning.md` still said Planning was target-only/inactive until I2 after I2 had been restored and live-proven.
5. `I7A-MACHINE-ONBOARDING-RUNBOOK.md` said manual onboarding remains fallback “until I7a is landed and deployed” even though it already is; fallback retirement requires a separate decision.

## Correction

- Current execution now names exactly two narrow parallel exceptions: completed I2 Vision Recovery and I7a worker enrollment MVP.
- The remainder of I7 plus unrelated I3-I6/I8-I9 remains blocked until normal sequencing/owner amendment allows it.
- I2 preserved branch is explicitly historical audit/recovery material, not the active I2 authority.
- Deployment proof uses exact receipt + `pending=0` + `drift=[]`; no fixed migration count.
- Planning UI spec now records the live model-backed implementation state.
- I7a manual fallback remains supported until separately retired.
- Scope regression locks these authority statements and the major Full-I7 deferrals.

## Completion ledger

- [x] A1 Inspect current main/live I2/I7a authority and evidence.
- [x] A2 Correct Plans Index sequencing and deployment-proof truth.
- [x] A3 Correct Planning UI implementation-state drift.
- [x] A4 Correct I7a fallback wording and append current live revalidation.
- [x] A5 Add regression locking the two narrow exceptions and full-I7 deferrals.
- [x] A6 Focused scope/docs tests and formatting green.
- [x] A7 Full exact-head `pnpm check` green on authorized buildbox.
- [x] A8 Fresh race check; converge any compatible concurrent main work.
- [x] A9 Fast-forward exact green closure SHA to canonical main and verify fetch-back equality.

## Guardrails

- Do not touch the account-login session or rotate operator/publication credentials.
- Do not reinterpret I7a as full-I7 authorization.
- Do not count I2/I7a completion toward I1 GOLIVE acceptance.
- Do not deploy from this documentation/authority cleanup unless source changes later require it.

## Verification checkpoint

- Semantic correction commit: `4a57c1f`; repository-format checkpoint: `a2e768a`.
- Debian2 / Node 24 / pnpm 9.7.0 focused authority regression: `tests/regressions/i1-scope-invariants.test.ts` **2/2 PASS**.
- Exact-head full `pnpm check` at `a2e768a`: **PASS**.
  - Vitest: **75 files / 314 tests PASS**, 5 files / 9 tests skipped;
  - typecheck/lint/build: **PASS**;
  - architecture: **6/6 PASS**;
  - dependency-cruiser: **0 violations** across 134 modules / 263 dependencies;
  - Prettier: **PASS**.
- Fresh post-gate fetch: `origin/main@f466db2` and `origin/ops/i1-dogfood-deploy@144bfe6` are both ancestors of `a2e768a`; no main-only/dogfood-only durable commit is outside this candidate.
- Live dogfood remains exact-main receipted at `f466db2`, PostgreSQL `23/23`, pending `0`, drift `[]`; all three cluster nodes are `Ready`. No deployment is required for this documentation/authority-only correction.

**Next:** commit this evidence-only checkpoint, verify that exact SHA, then fast-forward it to canonical main and close A9.

## Landing

- Exact green evidence-bearing candidate `d3c0d997d807e23a4bd81aa13f18708b6ab68af5` passed full Debian2 `pnpm check` with **75 files / 314 tests PASS**, 5 files / 9 tests skipped, architecture **6/6**, dependency-cruiser **0 violations**, and clean formatting.
- Immediate pre-push fetch proved `origin/main@f466db2` and the durable dogfood branch were ancestors of the candidate with no main-only work.
- Canonical `origin/main` fast-forwarded normally to `d3c0d99`; fetch-back returned the same SHA.
- No live product code changed in this lane. Debian3 remains behaviorally identical to its receipted `f466db2` deployment; before any I1 GOLIVE proof resumes, the dogfood deployment receipt must again be refreshed to the then-current canonical main SHA so proof identity remains exact.
- I1 GOLIVE remains 0/30. I2 completion and I7a readiness remain separate authorized progress and do not count toward I1 acceptance.
- This final closure edit is documentation-only and is verified as an exact head before its SHA is advanced to canonical main.