[deku2026]

This PR records AF-CTR-03 as delivered and widens AF-CTR-04's task record before its work starts (execution-policy §1.6), then starts AF-CTR-04. It also records two gaps found with the AF-CTR-03 mail adapters. It changes graph content, so it is reviewed like a task (execution-policy §4). The Design companion is ArcForges-Design design/af-ctr-03-companion-2.

AF-CTR-03 -> delivered

• PRs and merges:
  • Contracts #121 (62ccef1).
  • Cloud #118 (d4e1110), #120 (5ee9ea1), #121 (204f47a), #122 (2f2a3b3), #123 (48bcbf2), #124 (025eb91), #127 (4f7dfe8).
  • Cloud #128 (474017f; no product change). It restored the proof dispatch: #127's larger test suite had pushed that dispatch's Source job past its 15-minute cap.
  • The required host statuses passed at every merged head (arcforges/linux for Contracts; both legs for Cloud).
• Publications:
  • The Contracts cohort 1.0.0-ci.416.1 and Go tag (run 40776894391).
  • Eight production deploys, dark (0.1.0-ci.459.1 to 0.1.0-ci.512.1).
  • Eight acceptance deploys (0.1.0-ci.464.1 to 0.1.0-ci.513.1).
  • All 17 runs were checked with gh run view: success, at the merge SHA.
• Labels in the delivered ledger line:
  • REAL: the hosted real-browser runs on proof from the Windows host, with a virtual authenticator as MOCKED hardware. The automated run enrolled the proof owner account on 2026-10-30, and the returning and --operator-grant modes passed, last on 2026-11-03. Also REAL: the Go integration tests on real PostgreSQL and two mail probes that deliver nothing.
  • MOCKED: the mail provider and the plan catalogue. The self-hosted default and the gate are proved by Go tests only.
  • NOT PROVEN: AR-23, live e-mail and any e-mail to a real account (AR-14), and the hosted 403 of the operations page.
  • The resolver parity line states what "every C# test vector" covers: 284 resolver and 61 admission vectors from the six covered classes; the persistence suites are listed with reasons.
• Why not complete: delivered code still answers INTERNAL/internal with UNKNOWN and AFTER_TIME (arc.Internal()), which the Contracts arcError rule rejects. complete follows the E4-INTERNAL repair, as set-state AF-CTR-03 complete with no new --pr/--merge, citing that PR in its ledger line.

Record correction (ledger note on AF-CTR-03)

Five root files that AF-CTR-03's Cloud PRs changed are outside its recorded write paths: .gitleaks.toml, .dockerignore, tsconfig.json, biome.json and a monitoring runbook. The PR bodies describe most of these changes: #118's scope notes describe its .gitleaks.toml blocks and every PR body its gitleaks blocks; #121 describes the Docker context, #123 biome.json, #127 the runbook and .dockerignore. Three changes are mentioned in no PR body: the .dockerignore lines of #118 and #123, and #121's tsconfig.json include. No Plan record widened the paths beforehand, which execution-policy 1.6 asks for first. The note records it now. AF-CTR-03's paths are not rewritten; AF-CTR-04's paths name the files before its work starts.

AF-CTR-04 widened and started

• Paths:
  • Contracts: public/http/**, src/public/dotnet/**, .gitleaks.toml (decision contracts-1).
  • Cloud: .gitleaks.toml, .dockerignore, biome.json, tsconfig.json, deploy/**.
• Scope:
  • First, before C0: the E4-INTERNAL Cloud repair, recorded as this task's repair PR under 1.6.
  • SignOutNode, the eleventh NodeEnrollmentService method.
  • The fleet and mobile surfaces.
  • The mobile native authorization, with /app/callback and /.well-known/assetlinks.json served behind mobile on the acceptance environment first. AF-PROD-01 adds the production routes (decision Q15).
  • The part-B prerequisites before the first gated operation.
• out_of_scope: the Android client (AF-AND-01), production activation and the production app-link routes (AF-PROD-01), and key custody, recovery and rotation (a later task decides).
• fakes_allowed: the virtual WebAuthn authenticator, FakeCenter, NodeProbe and IsolatedSecretStore, each catalogued in Design 16 §2 by the companion.
• acceptance:
  • The Windows node signs in against the acceptance center (decision delivery-1, Q13).
  • Credential Manager evidence comes from the hosted tier run or the owner's opt-in run; otherwise it is recorded as not run in the acceptance register (decision node-7).
  • New: the mobile authorization closed loop.
• Requirements: + R-AUTH-002, R-CTR-017. design_refs: + 7 documents. Risks: + the unverified Windows-to-Linux data path.
• State: active, with a started ledger line. The parts and their order are in the ledger note, including a second scope Plan PR before CM and part D last.

AF-CTR-05, AF-AND-01, AF-PROD-01

• AF-CTR-05 owns the Contracts follow-up window before AF-PROD-01:

  • the error-catalogue fixture with the extended pair form;
  • the e-mail fields' maxLength from 320 to 254;
  • ResponseMeta on the Worker's generated replies;
  • the WebBrowserSession error body.

  Its Contracts paths gain public/http/**, src/public/dotnet/** and .gitleaks.toml (ledger note, 1.6).

• AF-AND-01:

  • depends_on gains AF-CTR-04.
  • Its debug callback is the private-use scheme (Design android.md:50), not a loopback.
  • Its notes name the mobile native authorization.

• AF-PROD-01:

  • Prerequisites before identity is enabled: E4-INTERNAL, AF-CTR-05's Contracts window, and AF-PLAT-01's retention sweeps.
  • User decisions before production e-mail: an outbound handler or the open egress, the naming of production mail secrets, and Postmark sender isolation.
  • It adds the production app-link routes when it activates mobile.

AF-ID-02 owns e-mail enrollment (gap)

No task owned the enrollment of an e-mail identity, so no production code creates one and no real account can be mailed.

• AF-ID-02 now owns: e-mail identity enrollment, with e-mail change and the account security notices of Design 14 §4.
• Record changes:
  • It carries AR-14 and H-19, and may use FakeMailSender and the virtual WebAuthn authenticator (its enrollment needs a passkey step-up).
  • It gains an acceptance line for enrollment and one for a security notice.
  • Its Cloud paths become AF-CTR-04's list (the Go center and the shared repository files; the list keeps src/** and tests/**); they were src/** and tests/** only, although its objective is the Go center.
• AF-ID-02 is outside the implementation range authorized on 2026-10-28 (AF-CTR-01 to AF-CTR-11). This PR records ownership only and starts nothing. Until AF-ID-02 is delivered, no real account can be mailed.

Acceptance register

• AR-14 row rewritten:
  • A sign-in code, and once AF-ID-02 sends them a security notice, reach a real inbox.
  • Prerequisites: H-19 and AF-ID-02 delivered.
  • Prepared by AF-CTR-03 and AF-ID-02.
• H-19 row:
  • "Needed by" gains AF-ID-02.
  • Notes: the adapters exist (MOCKED); no mail secret exists (checked 2026-11-03); the acceptance secret NAMES, with "create none until the coordinator asks"; the production decisions.
• New §3 sections:
  • AR-14: the three-part procedure; "stays Open until parts 2 and 3 have a result"; proven now; residual risk.
  • AR-23: Cloud docs/ar-23-owner-procedure.md.

Checks

• python3 tools/plan.py validate --design <ArcForges-Design design/af-ctr-03-companion-2>: 0 errors; 63 tasks, 17 milestones. Against Design main: also 0 errors.
• python3 <Design branch>/tools/check_design.py --plan delivery-graph.json: 0 errors.
• Against Design main: 2 errors (the R-AUTH-002 and R-CTR-017 task sets). This is expected until the Design PR merges, so this PR's linux-traceability step fails until then. After the Design merge, both legs are re-run (the summaries record design-main).
• python3 -m unittest discover -s tests: 48 tests OK.
• git diff --check: clean.
• sequence.md and the ledger were written by tools/plan.py only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H6Cf6kHnz1ZkfURhVWvGjP

[deku2026]

Review record 1: Plan #78 at def69de523daae571f6ac1b9fb4e399ba0cec77a

Result: CHANGES REQUIRED (1 blocking statement; everything else holds). Preceded by a plan review (design truth, Plan record and critic lenses) whose decisions this PR applies.

Independent reviewer (not the author): re-ran the author's scripts and plan.py sequence --write on ffe9c5c: graph, sequence.md and the register byte-identical to the head, the ledger identical except the at timestamps (no hand edits); ledger append-only (+7/-0; 176 lines parse); plan.py validate 0 errors against Design e63bff3 and 8b0aa6b; check_design --plan 0 errors with e63bff3, the expected 2 with Design main until #46 merges; 48 tests; plan.py next = AF-CTR-04 the single active task. Evidence re-checked: 9 merge SHAs, required statuses (both for Cloud heads, arcforges/linux for Contracts #121), 17 publication runs, the cited tests and labels, no MAIL* secret anywhere (names only). Every Plan-side decision item applied.

Findings

1. BLOCKING (c): the AF-CTR-03 record-correction ledger line and the PR body say "The PR bodies describe these changes"; false for three: the .dockerignore lines of #118 and #123 and the tsconfig.json include of #121 appear in no PR body (coordinator confirmed by grepping the bodies). The sentence came from the coordinator's decision B4. Fix: name what the bodies describe and which three they omit; regenerate the ledger lines with tools/plan.py in a new commit (final diff stays append-only).
2. Non-blocking: AF-ID-02's enrollment acceptance needs a passkey step-up, but its fakes_allowed lists only FakeMailSender. Taken: add the virtual WebAuthn authenticator.
3. Non-blocking: the AF-ID-02 paths wording ("the Go center's" vs "the C# host's") is inexact. Taken.
4. Non-blocking: maxLength 320 also appears in the frozen CON.07 constraint files and public/http/v1 schemas; tightening to 254 is a compatibility decision for AF-CTR-05's Contracts window brief. Routed.

Legs of this PR run after Design #46 merges (its traceability step needs the Design model.json change).

---

Generated by Claude Code

[deku2026]

Review record 2: Plan #78 fix round 1 at 7a2ebdcf12544bedaaa78436ec2f549d3e81c845

Result: APPROVE (the one BLOCKING finding is FIXED). One commit 7a2ebdc on def69de (fast-forward). Coordinator verification:

• Finding 1 FIXED: the AF-CTR-03 record-correction note now says the PR bodies describe most of the changes (every PR its gitleaks blocks, #118 in its scope notes; #121 the Docker context; #123 biome.json; #127 the runbook and .dockerignore) and names the three no PR body mentions (.dockerignore lines of #118 and #123; #121's tsconfig.json include), matching a grep of the eight PR bodies. The ledger was restored to ffe9c5c and regenerated with tools/plan.py: the diff against main is again append-only (+7/-0).
• Findings 2 and 3 FIXED: AF-ID-02 fakes_allowed adds the virtual WebAuthn authenticator (catalogued in Design 16 §2 by Record MR-76 fixed #46); its paths note is exact. Finding 4 routed to the AF-CTR-05 Contracts window brief.
• plan.py validate --design <Design ec7bfe4>: 0 errors (63 tasks). Design Record MR-76 fixed #46 merged at 6ae5904; legs at 7a2ebdc re-run after that merge: arcforges/linux success (4 steps incl. linux-traceability, 26 s; summary design-main = 6ae59041320bae536c67972a9301ced48654a21e), arcforges/windows success (4 steps, 5 s).

---

Generated by Claude Code