THOTH-GQL-OPS-01: GraphQL mutation-guard runtime operations control record and prerequisite specifications - #793
Conversation
Exact-head CI recordHead: PASS and SKIPPED are classified independently. Every skipped job is a Rust or image job deliberately classified out by the repository's own classifier for a documentation-only diff; none was skipped by error and none is a failure. The implementation report records the identical result observed at the preceding head This PR remains DRAFT, unreviewed and unapproved. It requires fresh independent exact-head review and separate explicit CTO merge authorization, and must not be merged by its implementing agent. |
Deliver the approved THOTH-GQL-OPS-01 control work: the evidenced operational-control record, the PROVISIONAL mode-transition runbook required by ADR-0006 section 8.3.5, and the three prerequisite task specifications THOTH-GQL-OPS-02, -03 and -04, each DRAFT with implementation NOT AUTHORIZED and no branch created. Every operational conclusion carries a named evidence source and an evidence class. No deployed-state conclusion is attributed to repository evidence alone. Re-derived at the exact base and confirmed, not refuted: the mode is read once at process start with no reload path; no surface exposes the effective mode of a serving instance; and the image default 'init' command does not register the guard argument, so a guard-enabled release build started through it silently ignores the configured value. Execution capability is recorded as capability and is deliberately not relabelled as accountable runtime ownership. The accountable production runtime owner, the post-activation observation sign-off owner, the rollback approval authority and the live expected fleet population are recorded as missing work, so four acceptance criteria are FAIL/BLOCKED rather than converted into passes. The timed rollback rehearsal, the service-health/activation-threshold gate and the preview/staging acceptance gate remain downstream of THOTH-GQL-OPS-04, which closes only the runtime-operations gate. Every timing field stays marked TO BE MEASURED AT PREVIEW/STAGING GATE. The public security record states only the approved minimum fact: during authorized narrowly scoped read-only discovery the implementing agent encountered existing secret-bearing configuration in the private authoritative deployment source. No secret value was copied into any repository file, PR text, report, changelog, prompt or commit message; no credential was used, changed or rotated. The exposure remains a separate CTO-controlled security matter outside this task's scope. Terminal disposition C - insufficient operational capability/evidence; BLOCKED. The ADR-0006 runtime-operations gate remains NOT SATISFIED and CG-13 remains OPEN. OBSERVE, ENFORCE and BE-02 runtime remain NOT AUTHORIZED. No production action of any kind was performed.
491d67d to
175c647
Compare
Exact-head CI record — after independent-review remediationHead: The branch history was rewritten during remediation. The previously reviewed head PASS and SKIPPED are classified independently. Every skipped job is a Rust or image job deliberately classified out by the repository's own classifier for a documentation-only diff; none was skipped by error and none is a failure. History rewrite pre-checks, verified immediately before the force-push and all three holding: the branch contained only the implementing agent's own work; no third-party or concurrent commits had appeared (local tip == remote tip); and no other branch depended on the intermediate commits. The push used This PR remains DRAFT, unreviewed and unapproved. The new exact head requires fresh independent exact-head review and separate explicit CTO merge authorization, and must not be merged by its implementing agent. |
Rollback evidence. Remove the residual claims that a rollback shares the forward transition's latency and authorization. What is established is limited to the technical execution mechanism: rollback uses the same configuration/deployment mechanism and is technically executed by the same execution-capability team. Actual rollback latency/duration remains [UNVERIFIED], and whether rollback additionally requires CTO approval remains [UNVERIFIED]. No authorization equivalence is inferred from sharing the technical mechanism, in either direction. AC-13 remains FAIL/BLOCKED and no CTO decision is made here. Retention dependency. A retention remedy cannot be chosen before the observation-window duration it must cover is approved, and that duration is downstream. THOTH-GQL-OPS-04 therefore records the retention requirement, re-establishes that current retention is a finite configured duration, and records the window duration, the coverage question and any remedy as unresolved and downstream. It no longer selects, implements or confirms a remedy; a new section 3.4, a corrected AC-7, a new non-goal and the expected-report requirements all reflect that. The runbook's two-part status and unresolved-decisions table, and the control record, are aligned to the same dependency order. Cross-references. The control record's rehearsal is section 10; four references that meant the rehearsal still pointed to section 9, which now legitimately means rollback. Three references to capability gap 2 and the fleet-verification requirement pointed to section 6 rather than section 7. All corrected; section 9.3 and 9.4 references are left as rollback references. Validation metadata. Replace the brittle and mutually inconsistent evidence-count totals with the invariant they were standing in for: operational conclusions lacking an evidence class = 0. No change to the terminal state. Disposition C, runtime-operations gate NOT SATISFIED, CG-13 OPEN, OPS-02/03/04 DRAFT and NOT AUTHORIZED, OBSERVE and ENFORCE NOT AUTHORIZED, BE-02 runtime NOT AUTHORIZED. AC-1, AC-2, AC-7 and AC-13 remain FAIL/BLOCKED. The public security record is unchanged and remains at the approved minimum; the private deployment source was not re-read. No production action was performed.
Exact-head CI record — second remediation roundHead: This round added one bounded remediation commit on top of the existing branch. No history rewrite and no force-push — the previously reviewed head PASS and SKIPPED are classified independently. Every skipped job is a Rust or image job deliberately classified out by the repository's own classifier for a documentation-only diff; none was skipped by error and none is a failure. What changed this round, all documentation:
Terminal state unchanged: disposition C, runtime-operations gate NOT SATISFIED, CG-13 OPEN, OPS-02/03/04 DRAFT / NOT AUTHORIZED with no branches, OBSERVE / ENFORCE / BE-02 runtime NOT AUTHORIZED. AC-1, AC-2, AC-7 and AC-13 remain FAIL/BLOCKED. The public security record is unchanged and at the approved minimum; the private deployment source was not re-read. This PR remains DRAFT, unreviewed and unapproved. The new exact head requires fresh independent exact-head review and separate explicit CTO merge authorization, and must not be merged by its implementing agent. |
…1 report Two statements still contradicted the retention lifecycle established by the previous remediation. THOTH-GQL-OPS-04 section 6.1 made success depend on obtaining "every unresolved decision listed in control record section 14 and runbook section 10". Those sections deliberately list both part-1 and part-2 items, so as written the task could only succeed by absorbing downstream gates. Success is now obtaining every part-1 runtime-operations decision assigned to it, while leaving every part-2 decision explicitly unresolved and downstream. The section 2 authority wording is narrowed to match: control record section 14 lists unresolved evidence and identifies which items belong to this task versus downstream gates. The OPS-01 implementation report's unresolved-evidence table still assigned the observation-evidence retention remedy to THOTH-GQL-OPS-04. That row is replaced by the three real dependencies, each labelled with the part that owns it: the approved OBSERVE observation-window duration, whether current finite retention covers it, and any remedy that coverage proves necessary -- all [UNVERIFIED] and all downstream activation-gate work, not OPS-04's. The table now labels every row with its part, records that OPS-04 obtains items 1 to 6 only, and states the 7 -> 8 -> 9 dependency order. The surrounding known-limitations text is aligned. AC-7 is unchanged in substance: OPS-04 establishes the retention position, the duration, coverage and remedy remain unresolved and downstream, and selecting a remedy would fail the criterion rather than satisfy it. No change to the terminal state. Disposition C, runtime-operations gate NOT SATISFIED, CG-13 OPEN, OPS-02/03/04 DRAFT and NOT AUTHORIZED, OBSERVE and ENFORCE NOT AUTHORIZED, BE-02 runtime NOT AUTHORIZED. AC-1, AC-2, AC-7 and AC-13 remain FAIL/BLOCKED. The rollback model, the corrected rehearsal section references and the evidence-classification invariant are unchanged. The public security record is unchanged at its approved minimum and the private deployment source was not re-read. No production action was performed.
Exact-head CI record — third remediation roundHead: One bounded documentation commit added on top of PASS and SKIPPED are classified independently. Every skipped job is deliberately classified out by the repository's own classifier for a documentation-only diff. What changed — two statements that still contradicted the Part-1/Part-2 retention boundary:
AC-7 is unchanged in substance. The rollback model, corrected rehearsal section references, evidence-classification invariant and public security record are all unchanged; the private deployment source was not re-read.
Intervening commits are the v1.6.2 release and a Crossref xlink namespace fix. The only file they share with this PR is The control record's conclusions survive the move, re-verified This PR remains DRAFT, unreviewed and unapproved. The new exact head requires fresh independent exact-head review and separate explicit CTO merge authorization, and must not be merged by its implementing agent. |
Synchronize the THOTH-GQL-OPS-01 implementation branch with current develop after the v1.6.2 hotfix. No task-scope or authorization change.
…cit deployment-actor separation Two material findings from the independent exact-head review of PR #793. FINDING 1 -- production-secret access boundary. Repository policy prohibits an implementing agent from accessing production secrets. The merged THOTH-GQL-OPS-01 specification treats an incidental encounter with secret material during an otherwise scoped read as "not a breach" until the value is copied onward, and the OPS-01 implementation report, the runtime-operations control record and the new OPS-04 specification repeated that interpretation. It is not an acceptable workflow for successor execution. The implementation report no longer claims the observed exposure was compliant because nothing was copied onward. It records, at the existing minimal public level and with no new detail about the material: that secret material was encountered; that no value was copied into repository, PR, prompt or output; that no credential was used, changed or rotated; that the required response is immediate stop of that source/read path, escalation at the minimum safe level, and no further secret-bearing production-source read by that agent for the task; and that the encounter is a control/process exception requiring escalation rather than an acceptable routine read pattern. The private deployment source was not re-read for this remediation. OPS-04 replaces the inherited direct-read model with a strict evidence boundary: external runtime and deployment facts reach the implementing agent only as sanitized metadata that structurally cannot expose a secret value, or as evidence supplied by an explicitly authorized operator or control owner. Neither available means BLOCKED. OPS-02 and OPS-03 carry the same boundary where they require external deployment facts -- in particular the OPS-02 execution-time re-confirmation of deployment configuration -- without broadening either task's scope. The already merged parent specification is not edited. Where the successors refer to the parent scoped-read rule they state that the stricter repository/project prohibition governs successor execution, and the parent-rule conflict is recorded as an OPEN control limitation that must be corrected before any successor requiring that access is authorized. FINDING 2 -- OPS-04 could not assign deployment to an implementing agent. Project control permits implementing agents to inspect, edit, test, commit, push and open draft PRs; it does not permit them to deploy. OPS-04 required the implementing task to deploy a guard-enabled candidate to a non-production environment, exercise OFF/OBSERVE/ENFORCE there, create a mixed fleet and exercise rollback. "Separately authorized" does not make the agent the deployment actor. A binding execution actor model is added and applied consistently across the objective, scope, section 3.1, authorization, concurrency and idempotency, the data and migration table, the acceptance criteria, manual verification, rollout, rollback, stop conditions, the expected implementation report and recommended execution. The implementing agent may prepare repository changes, run local and disposable tests, inspect allowed sanitized evidence, evaluate operator-supplied evidence and update the control record; it may not trigger a deployment, dispatch a deployment workflow, perform a mode transition in any real environment, or use deployment credentials. An authorized human operator or other independently controlled actor performs the non-production deployment, the mode changes, the mixed-fleet and rollback actions, and supplies sanitized evidence. OPS-04 evaluates those results and decides A or C, and returns BLOCKED where the actor or adequate evidence is unavailable. What the gate requires is unchanged: real non-production capability evidence must still exist, and no evidence requirement is relaxed. Only the actor performing the operational action is fixed. Unchanged by this remediation: the Part-1/Part-2 retention boundary; OPS-04 does not own the timed rehearsal or its four measurements; no rollback same-latency or same-authorization inference; operational conclusions remain evidence-classified; AC-1, AC-2, AC-7 and AC-13 remain FAIL/BLOCKED; disposition remains C; the runtime-operations gate remains NOT SATISFIED; CG-13 remains OPEN; OPS-02, OPS-03 and OPS-04 remain DRAFT and NOT AUTHORIZED with no implementation branch; OBSERVE, ENFORCE and BE-02 runtime remain NOT AUTHORIZED. Documentation and control only -- no runtime, schema, migration, Cargo or workflow file is touched, no secret or configuration value, resource identifier or new infrastructure detail appears in the diff, no private source was read, no deployment or workflow dispatch occurred, and no security issue was created or modified.
…, not only the implementing agent Residual finding from the independent exact-head review of PR #793. The previous remediation assigned every real operational action to an "authorized human operator or other independently controlled deployment actor", and in most places stated only that the action is never performed by "the implementing agent". That is insufficiently precise. Project control prohibits AGENTS from deploying; the prohibition is not limited to the particular model implementing a task. A second Claude/Codex/helper/reviewer/ orchestrator agent must not become the deployment actor merely because it is independently controlled. The operational actor is now defined as an AUTHORIZED NON-AGENT DEPLOYMENT ACTOR with exactly two permitted forms: an authorized human/operator, or existing deployment automation and infrastructure executing under that authorized human/operator's own control or initiation. There is no third form, and no AI agent or model qualifies in any role, family or session -- implementing, assisting, reviewing, orchestrating, supervising, delegated or sub-agent -- whether or not it is separately or independently controlled. No AI agent or model may initiate, trigger, dispatch or execute a deployment; perform a real-environment mode transition; create, manipulate or restore real fleet state; execute a real-environment rollback; use deployment credentials; or substitute for the authorized human/operator by invoking deployment automation. An automated deployment system is an execution mechanism, not an AI-agent delegation: it must be initiated and controlled by the authorized non-agent operator under the relevant authorization. Applied consistently across THOTH-GQL-OPS-04 -- header/authorization, section 1, the section 2.2 actor model (now 2.2.1 definition, 2.2.2 implementing agent, 2.2.3 division of work), section 3 scope, section 3.1 prerequisite, the section 3.2 ownership note, non-goals, invariants, sections 6.1, 6.3 and 6.4, the section 7 table, AC-8 to AC-13 and the actor criteria AC-26 to AC-28, manual verification, rollout, rollback, stop conditions, the expected implementation report, recommended execution and approval -- and to the corresponding actor statement in the runtime-operations control record. OPS-02 and OPS-03 are swept for the same weak phrasing. Route B in all three successors now requires an authorized human/operator or control owner, or a sanitized artefact generated under that non-agent human/operator's own control; no AI agent is a valid Route B source, and evidence produced by an AI agent that itself inspected production runtime or secret-bearing configuration must be refused. Local, disposable and CI repository testing by implementing agents is explicitly unaffected and is called out as unrestricted wherever the prohibition appears. The restriction governs real operational environments, real operational actions and protected production evidence only. Unchanged: the secret-access evidence boundary and its Route A/Route B structure; the stop/escalate/no-further-read protocol; CL-1 OPEN and CTO/control-owner owned; the approved parent specification, which is not edited; OPS-04's requirement for real non-production evidence and its refusal of local or simulated substitutes; BLOCKED/C on a missing actor or evidence; Part-1/Part-2 retention ownership; the downstream timed rehearsal and its four measurements; no rollback same-latency or same-authorization inference; AC-1, AC-2, AC-7 and AC-13 FAIL/BLOCKED; disposition C; runtime-operations gate NOT SATISFIED; CG-13 OPEN; OPS-02/03/04 DRAFT and NOT AUTHORIZED with no implementation branch; OBSERVE, ENFORCE and BE-02 runtime NOT AUTHORIZED. Documentation and control only -- no runtime, schema, migration, Cargo or workflow file is touched, and no secret, configuration value, resource identifier or infrastructure detail appears in the diff.
Exact-head CI —
|
…he accepted remediations Delivery-record finding from the independent exact-head review of PR #793: the operating model requires the implementing agent to update the implementation report during accepted-finding remediation, and the report still carried transient delivery wording and an incomplete branch-history description. Repository-state wording is now durable under ADR-0005. The transient line "opened as DRAFT; not marked ready, not approved, not self-reviewed, not merged" is replaced by the pull-request identity plus an explicit delegation of live review, readiness, authorization, exact-head and merge evidence to GitHub PR #793. The durable rule that the implementing agent may not approve or merge its own work is preserved and restated as a property of the delivery rather than a snapshot of the pull request's state, so the committed text stays true before and after review and before and after merge. The section 15 self-assessment is corrected the same way. Base terminology is corrected in a new section 1.0. The original authorized branch-creation base develop @ 8b144a6 is preserved as a historical fact, and is now distinguished from the later develop synchronization checkpoint develop @ f9d8167 that the branch was brought up to date with before the later remediation rounds. Section 1.1 keeps the historical observation that develop stood at the authorized base at branch-creation time but no longer implies current develop is unmoved. The synchronization is recorded as changing no task scope, no acceptance criterion, no disposition and no production authorization. The branch-history narrative in section 3.1 preserves the single deliberate rewrite and its three verified hygiene preconditions, and now states that every round after it proceeded by bounded fast-forward remediation commits with no squash, rebase or force-push, and that develop was merged into the task branch in that period. The report no longer implies a single-commit branch and deliberately records no commit count, since the next remediation commit would falsify one. The exact commit sequence is delegated to PR #793. A new section 3.2 records what the later remediation rounds established: the secret encounter as a control/process exception rather than an acceptable read pattern; stop / escalate / no-further-read with dependent criteria BLOCKED; CL-1 OPEN and CTO/control-owner owned with the parent specification untouched; the Route A / Route B successor evidence boundary with no AI agent as a valid Route B source; the AUTHORIZED NON-AGENT DEPLOYMENT ACTOR model; the prohibition binding every AI agent and model rather than only the implementing agent; deployment automation as an execution mechanism under authorized non-agent human/operator control; BLOCKED/C where actor or evidence is unavailable; and the conduct record for every remediation round -- no private-source read, no deployment, no real-environment mode transition, no deployment-automation dispatch, no production action, no security issue touched. No security detail beyond the existing approved minimum is added. The section 11 CI text no longer explains the absent head by saying the history was rewritten or that such a commit no longer exists, and no longer asserts a CI verdict. It now states the durable division of authority -- the committed report holds the historical bases, local checks, scope and substantive evidence; GitHub holds the exact final review head, exact-head CI and its per-job classification, review, authorization and merge -- and notes that the recursive-transcription problem is structural, applying to a fast-forward commit exactly as to a rewrite. Scope: this commit changes only the implementation report. The approved parent THOTH-GQL-OPS-01 specification, the accepted OPS-02/03/04 specifications, the runtime-operations control record, ADR-0005, AGENTS.md and the templates are untouched, and no accepted actor-boundary, secret-boundary, retention, rehearsal, rollback or architecture decision is reopened. AC-1, AC-2, AC-7 and AC-13 remain FAIL/BLOCKED, disposition remains C, the runtime-operations gate remains NOT SATISFIED, CG-13 remains OPEN, OPS-02/03/04 remain DRAFT and NOT AUTHORIZED with no implementation branch, and OBSERVE, ENFORCE and BE-02 runtime remain NOT AUTHORIZED. Documentation only -- no runtime, schema, migration, Cargo or workflow file is touched, and no secret, configuration value, resource identifier or private infrastructure detail is introduced.
Exact-head CI —
|
| Workflow | Conclusion | Jobs |
|---|---|---|
check-changelog |
success | check-changelog success |
build-test-and-check |
success | classify success; build, test, lint, format_check skipped |
run-migrations |
success | classify success; run_migrations skipped |
publish-to-dockerhub |
success | classify success; build_and_push_staging_docker_image skipped |
All four workflow runs completed success at this exact head. The six skipped jobs are the repository classifier's documentation-only route — this head changes docs/ and CHANGELOG.md only, with 0 runtime, schema, migration, Cargo or workflow files. A classifier skip is not a failure and no job was skipped by error.
This comment is GitHub evidence only; it creates no repository commit. Fresh independent exact-head review and separate explicit CTO merge authorization remain required, and this comment is not an approval.
CTO merge authorization — APPROVEDI explicitly authorize merge of PR #793 at the reviewed exact head:
Base at authorization: This authorization follows the independent external exact-head review decision APPROVED and the verified exact-head CI result (4 PASS / 6 classifier-SKIPPED / 0 FAIL). The PR remains documentation/control work only; its intended terminal state remains disposition C / BLOCKED, CG-13 OPEN, runtime-operations gate NOT SATISFIED, OPS-02/03/04 NOT AUTHORIZED, and OBSERVE / ENFORCE / BE-02 runtime NOT AUTHORIZED. This is merge authorization only. It does not authorize deployment, production activation, any real-environment mode transition, OBSERVE, ENFORCE, BE-02, or any operational action. The implementing/AI agent must not perform the merge. An authorized human/non-agent merge actor must merge with an expected-head guard against the SHA above. If the PR head moves from Note: GitHub would not accept the external review as a formal |
Independent external exact-head review — APPROVEDDecision: APPROVED Reviewed exact head: Independent review inspected the live PR state, final remediation diff, full base-to-head scope, implementation-report durability changes, exact-head CI workflow/job evidence, security and operational boundaries, migration/runtime effects, and the accepted remediation controls. No remaining P0, P1 or P2 defect was found at this exact head. The final remediation is bounded to the OPS-01 implementation report. The full PR remains documentation/control only, with no runtime, schema, migration, Cargo or workflow change. Exact-head CI is 4 PASS / 6 classifier-SKIPPED / 0 FAIL. The implementation report durably distinguishes the original authorized base from the later develop synchronization and delegates exact-head lifecycle evidence to GitHub under ADR-0005. The intentional terminal state remains AC-1, AC-2, AC-7 and AC-13 FAIL/BLOCKED; CL-1 OPEN; disposition C; CG-13 OPEN; runtime-operations gate NOT SATISFIED; OPS-02/03/04 DRAFT / NOT AUTHORIZED; OBSERVE, ENFORCE and BE-02 runtime NOT AUTHORIZED. This is independent review evidence only. It does not authorize merge, deployment, production activation, mode transition, OBSERVE, ENFORCE or BE-02. If the PR head moves, this review no longer applies and fresh independent exact-head review is required. GitHub's formal |
CTO specification approval and implementation authorization — THOTH-GQL-OPS-02CTO approval recorded for the exact Approved task: Implementation is authorized subject to the specification's exact scope, non-goals, invariants, acceptance criteria, required tests, stop conditions, security/evidence boundary, independent exact-head review, and separate CTO merge authorization. This authorization does not authorize deployment, any real-environment mode transition, If |
1 participant
THOTH-GQL-OPS-01 — GraphQL mutation-guard runtime operations
Implements the approved, merged
THOTH-GQL-OPS-01specification, under the CTO implementation authorization recorded on merged PR #792 naming the exact original authorized basedevelop @ 8b144a6de75ad6289f481c4e17e02c4c5f0f6328.develophas since moved; the branch was later synchronized withdevelop @ f9d816744ac7adc3764860d6422855cc42e1dc66, which widened no authorization. The current PR base and exact head are live GitHub evidence.This PR is DRAFT. It authorizes nothing, activates nothing, and performs no production action.
Binding terminal state — the expected outcome, not a failure
Task identity
thoth-pub/thothdevelop @ 8b144a6de75ad6289f481c4e17e02c4c5f0f6328— the base named by the CTO implementation authorization on merged PR #792, and the commit this branch was created from. A historical factdevelopsynchronizationdevelop @ f9d816744ac7adc3764860d6422855cc42e1dc66—developmoved after branch creation and was subsequently merged into this branch, before the later remediation rounds. Changed no task scope, acceptance criterion, disposition or production authorizationADR-0005— not transcribedfeature/shared-architecture/graphql-runtime-opsdevelopdocs/, plusCHANGELOG.md) — 0 runtime filesWhat is delivered
docs/engineering/repository-map/graphql-mutation-guard-runtime-operations.md, answering specification sections 3.1–3.10. Every operational conclusion carries a named evidence source and an evidence class; all four classes ([REPO],[EXTERNAL],[REPO + EXTERNAL],[UNVERIFIED]) are in use. Exact totals are deliberately not quoted — they drift with every editorial pass. The invariant is what matters: operational conclusions lacking an evidence class = 0.docs/engineering/repository-map/graphql-mutation-guard-mode-transition-runbook.md, required byADR-0006§8.3.5. Marked NOT EXECUTABLE, with a two-part status (§0.2) separating the runtime-operations procedure from production transition readiness.THOTH-GQL-OPS-02,-03,-04, eachDRAFT/NOT AUTHORIZED. No branch exists for any of them, verified locally and on the remote.C),environments.md, decision register, both indexes,CHANGELOG.md.developsynchronization (§1.0), the branch-history record (§3.1) and the accepted-remediation record (§3.2). Lifecycle facts — exact head, exact-head CI, review, authorization and merge — are delegated to this pull request underADR-0005rather than transcribed.Acceptance criteria: 26 PASS / 4 FAIL/BLOCKED
The matrix was not optimised for a high PASS count. A task terminating at disposition C is expected to retain failed criteria — the failures are the evidence for the disposition.
Execution capability is not relabelled as runtime ownership. An access record establishes who is technically able to apply a change; it does not establish an accountable owner, and what is missing there is a designation no further reading can supply. The sign-off owner is recorded as a proposal with its reasoning shown, so the CTO has something concrete to confirm or reject — not as an established fact.
Dependency order preserved
THOTH-GQL-OPS-04closes one gate and no other:The timed rehearsal and its four measurements, the service-health/threshold gate and the preview/staging acceptance gate are all downstream and are not absorbed into OPS-04. Every timing field stays marked
TO BE MEASURED AT PREVIEW/STAGING GATE, and populating them is explicitly not a condition of resolving the runtime-operations-specific provisional state.[REPO]findings — re-derived independently, confirmed not refutedThe mode is read once at process start with no reload path anywhere; no surface exposes the effective mode of a serving instance;
initdoes not register the guard argument, and pinnedclap_builder4.6.0'sverify_argerrors only undercfg(debug_assertions). Reproduced in an isolated probe outside this repository:Deployment-state model
Both production and test run a pre-guard release — no guard in the binary, therefore no guard mode at all, never described as
MutationGuardMode::OFF.[REPO + EXTERNAL]; no deployed-state conclusion is attributed to[REPO]alone.The two capability gaps — both OPEN
a specification for a verifier != a verifier != a verified fleetEvidence precision
[EXTERNAL]. The approvedOBSERVEobservation-window duration is[UNVERIFIED], and therefore so is whether retention covers it. The dependency order is now explicit and all three downstream steps belong to the activation gate, not toTHOTH-GQL-OPS-04: approve the window duration → determine coverage → only then select, implement and verify a remedy. A remedy cannot be chosen for a target nobody has set, so OPS-04 records the requirement and the unresolved dependency and selects nothing. The binding requirement stands: evidence must be retained for at least the complete approved window and remain available through sign-off.[UNVERIFIED]and belongs to the downstream rehearsal, and whether rollback additionally requires CTO approval remains[UNVERIFIED]. No authorization equivalence is inferred from sharing the mechanism.init-path changes are recorded as intentional —OBSERVE/ENFORCEceasing to be silently ignored, and an invalid value ceasing to start successfully — each pinned by a required test.Migration boundary preserved
initruns migrations first and aborts on failure;start graphql-apiruns none. No remediation altering migration execution is selected or specified, and every mention of a production container-command override carries the §13.1.1 classification.Security and operational control
The earlier secret encounter is a control/process exception requiring escalation — not an acceptable read pattern.
During narrowly scoped read-only discovery, the implementing agent encountered existing secret-bearing configuration in the private authoritative deployment source. No secret value was copied into any repository file, PR text, report, changelog, prompt or commit message; no credential was used, changed or rotated.
"Not copied onward" does not make the original access acceptable. The absence of onward copying limits the consequence of the exposure; it does not make the access itself permissible. Earlier PR and report wording describing this as authorized narrowly scoped read-only discovery, or as compliant because nothing was copied, is superseded and must not be relied on.
The required response — applied here and binding on every successor — is: stop that source/read path immediately, escalate at the minimum safe level, and perform no further secret-bearing production-source read for the task. No further secret-bearing production-source read was performed for any remediation round, and no security issue was created or modified. The exposure remains a separate CTO-controlled security matter, outside this task's scope.
Successor evidence boundary.
THOTH-GQL-OPS-02,-03and-04obtain external runtime and deployment facts through exactly two routes: Route A — a sanitized metadata-only source that structurally cannot expose a production secret value; or Route B — evidence supplied by an explicitly authorized human/operator or control owner, or a sanitized artefact generated under that non-agent control. No AI agent is a valid Route B source. Direct implementing-agent reads of secret-bearing production configuration are forbidden. If neither route can supply a fact, the criterion isBLOCKED— never satisfied by widening access.CL-1 — control limitation, OPEN. The merged
THOTH-GQL-OPS-01§2.2.5 still treats an incidental encounter as "not a breach" until the material is copied onward. The stricter repository/project prohibition governs successor execution, and each successor says so explicitly. The approved parent specification was NOT amended — that requires its own explicit authorization. CL-1 must be corrected before any successor requiring secret-bearing production-source access is authorized. Owner: CTO / control owner; not closable by an implementing agent.Operational actor boundary — no AI agent may deploy
THOTH-GQL-OPS-04requires real non-production operational evidence: a guard-enabled candidate deployed to a non-production environment,OFF/OBSERVE/ENFORCEexercised there, a mixed fleet created and detected, and a rollback exercised and the starting mode restored.None of those actions may be performed by an AI agent.
Absence of that actor, or of adequate evidence, produces
BLOCKEDand dispositionC— never expanded agent authority, and never a local or simulated substitute for real non-production evidence. An AI agent offering to act in its place does not make an actor available.Ordinary local, disposable and CI repository testing by implementing agents is explicitly unrestricted; the boundary governs real operational environments, real operational actions and protected production evidence only.
This changes no production authorization.
OBSERVE,ENFORCEandBE-02runtime remainNOT AUTHORIZED; CG-13 remainsOPEN; the runtime-operations gate remainsNOT SATISFIED; disposition remainsC.Validation
git diff --checkclean · relative links resolve (0 broken) · anchors resolve (0 broken) · task-template completeness (17/17 sections + 5/5 subsections × 3 specs) · implementation-report template (15/15) · AC matrix (30/30 rows, every row classified) · 0 runtime files, 0 prohibited paths · secret/configuration-value/public-detail scan: 0 · evidence-classification sweep: 0 unclassified conclusions · pre-guard provenance: 0[REPO]-only deployed-state claims · CG-13 OPEN · gate NOT SATISFIED · OPS-02/03/04 DRAFT/NOT AUTHORIZED · prerequisite branches absent locally and remotely · 0 invented durations.Not done, deliberately
No production deployment, configuration change, mode change, restart, workflow dispatch, credential use/rotation or database access. No deployment or real-environment mode transition of any kind, in any environment, production or not.
OBSERVEandENFORCEnot activated.BE-02not implemented. PR #788 and issue #765 untouched. No OPS-02/03/04 implementation. No change to the private infrastructure repository, and no read of it in any remediation round. CG-13 not closed. The approved parentTHOTH-GQL-OPS-01specification not amended (CL-1 OPEN).Merge controls
Not self-reviewed, not marked ready, and must not be merged by its implementing agent. Each new exact head requires fresh independent exact-head review and separate explicit CTO merge authorization — both still outstanding. Merge authorization is not production activation authorization.
Exact-head CI, with the per-job PASS/SKIPPED/FAIL classification, is recorded as a PR comment against the current head.