[deku2026]

This PR records AF-CTR-04 as delivered, widens AF-CTR-05's task record before its work starts (execution-policy §1.6, part P0 of the reviewed AF-CTR-05 plan) and starts AF-CTR-05. It also records the deferred real-world validations of AF-CTR-04 in the acceptance register and two hand-overs (AF-AND-01, AF-PROD-01). It changes graph content, so it is reviewed like a task (execution-policy §4). States, sequence.md and every ledger line are written by tools/plan.py.

AF-CTR-04 -> delivered

• PRs and merges (every SHA read with gh api repos/ArcForges/<repo>/pulls/<n> --jq .merge_commit_sha):
  • Contracts #125 (C0, a5bc52f), #126 (.NET 10.0.14 repair, 1e0a5d6), #127 (CM, 5873dc2).
  • Cloud #129 (E4-INTERNAL repair, 602705f; already cited on AF-CTR-03's complete line as an AF-CTR-04 repair PR), #130 (E1a, 2aaac73), #132 (E1b, 3e2cf6b), #133 (.NET repair, b1c8c0d), #134 (E2, 940cb97), #135 (E3, 2686a73), #136 (vectors, 41c8a72), #137 (the /tmp leak and the scratch helper, 9085b12), #138 (the CI proof gate, 98e7389), #140 (the center lane, 3a13b97), #141 (M, c837860), #142 (M follow-up and D2, 34d9e60).
  • ArcForges maintenance: record MR-95 recovery repair and MR-12 publication result #61 (.NET repair, e105508), docs: record MR-99 durable attempt phase repair #63 (N1, fb9901c), docs: record MR-17 memory-notification recovery repair #69 (N2, 978d25d), docs: remove hardcoded reviewer model requirements #71 (Windows-safe CloudLink private files and the sign-in reservation race fixes, 0708e1b), docs: record MR-18 verification and stop after this item #70 (CloudSignInTests: real refreshes and the delivered center keys, 4bc33da).
  • ArcForges-Design Record MR-89 and MR-96 fixed; add MR-95, MR-97 and MR-98 #47 (C0 mirror, 7466181), Record maintenance handoff and renewed serial repair authorization #48 (D1, 5da245e). Plan plan: [AF-CTR-04] Scope: the prerequisites of the first gated operation move to AF-CTR-05 #80 (99b7bc6), plan: [AF-CTR-04] Scope: MobileProbe as an allowed fake; AF-AND-01 redirect wording #81 (af0e36e): in the ledger line only (scope records).
• Publications (each run checked with gh run view: success at the merge SHA):
  • Contracts cohorts and Go tags 1.0.0-ci.424.1 (run 41724651206), 1.0.0-ci.426.1 (42005833954), 1.0.0-ci.430.1 (42016941693).
  • Cloud production, dark, 11 deploys 0.1.0-ci.517.1 to 0.1.0-ci.563.1. #132's own main push (41774844734) failed in the image build on GHSA-p3jp-9v83-76w9 and deployed nothing; #133 deployed both.
  • Proof: 7 deploys 0.1.0-ci.518.1 to 0.1.0-ci.558.1 (since #138 the main-push artifact); surfaces identity,pages,operations,fleet,mobile.
• Labels in the delivered ledger line (as the evidence files state them):
  • REAL: X (logs/evidence/x-ctr04-2026-11-05/), N2-7, the keys rerun (keys-rerun/), H1 (logs/evidence/e3-h1-2026-11-04.md), H3 (logs/evidence/h3-mobile-2026-11-05.md, Cloud #141 comment 6660944407: PASSED on proof, all four mobile cases, assetlinks, the callback, Google's Digital Asset Links check and the regression; its two tooling defects were fixed in Cloud #142), the Go integration tests on real PostgreSQL, the 120 mobile vectors.
  • MOCKED: the virtual authenticator, the test-mode opener, node-probe and MobileProbe, the rehearsal edge platform.
  • NOT PROVEN: AR-23, AR-24 (opener; a node outside test mode on the owner's Credential Manager), AR-08/H-02 (Android App Link, Custom Tab hand-off, fragment, release identity), H-23, AR-11, bullet 2 with a real node, command keys on proof and private-half signing (AF-CTR-05), production.
• Delivered, not complete: docs: remove hardcoded reviewer model requirements #71 changed CloudLink product code after X, the hosted OS secret-store tier run and the keys rerun (all on ArcForges 978d25d). complete follows in a later state-only Plan PR recording the re-runs at ArcForges main 4bc33da or later: the Windows tier (PASSED at 4bc33da, run 42061577006), X item 1 (PASSED at 4bc33da, logs/evidence/x-ctr04-2026-11-05/rerun-4bc33da/) and the keys check.

Record correction (ledger note on AF-CTR-04)

Computed from GitHub's file list of every PR against AF-CTR-04's repositories[].paths:

• Task PR outside the paths: ArcForges docs: record MR-99 durable attempt phase repair #63, .github/workflows/os-secret-store-tier.yml (described in its body). No Plan record widened the paths beforehand; the note records it now.
• Repair PRs (execution-policy 1.6 routes a repair outside the paths to its own PR), named for completeness: Contracts #126 global.json and the packages.lock.json of eight src/internal/dotnet/ packages (the body counts the lock files without naming them); Cloud #133 and ArcForges maintenance: record MR-95 recovery repair and MR-12 publication result #61 global.json.
• ArcForges docs: remove hardcoded reviewer model requirements #71 and docs: record MR-18 verification and stop after this item #70, rechecked at their merges: nothing outside the paths (docs: record MR-18 verification and stop after this item #70's diff against main is three ClosedLoop test files).
• Every other file is inside the paths. Design and Plan PRs are records in repositories that are not write paths.

Acceptance register

• AR-08: the mobile native authorization on a phone; prepared by AF-CTR-04 for the center side. A new §3 section hands the emulator checks (a) to (c) and the app rules to AF-AND-01 (no register entries), and gives the phone procedure with H-02.
• AR-23: prepared by also names AF-CTR-04 (the node approval pages and the mobile authorization page); §3 addition.
• AR-24 (new): a real node sign-in by a person outside --test-mode (OS opener, Credential Manager, CNG key, logout); §3 section with the procedure and the Credential Manager status of X (REAL in the hosted tier run 41994995309; the owner's local opt-in not run).
• H-02: "Needed by" and "Blocks" name the mobile surface's asset links; notes name the proof test statement.
• H-04: "Needed by" and "Blocks" name AF-PROD-01 for the upload certificate fingerprint in the asset links; AF-PROD-01's human_prerequisites gains H-04.
• AF-CTR-04 acceptance_register: AR-08, AR-23, AR-24.

AF-CTR-05 widened and started (P0)

• fakes_allowed (was empty): the nodetest channel client and the FakeCenter channel peer (Q3); also the virtual WebAuthn authenticator and IsolatedSecretStore, as AF-CTR-04's list has them.
• Paths: Contracts src/internal/dotnet/** (Q4); Cloud .gitleaks.toml, .dockerignore, biome.json, tsconfig.json, deploy/** and ArcForges .github/** (the files AF-CTR-03's and AF-CTR-04's PRs changed outside their paths).
• Acceptance: bullet 1 records the venues (Q5, decision delivery-1); bullet 3 STATE/node_offline (added by part D0; Q2).
• Scope: the e-mail bound tightens the protobuf constraints to 254 while the frozen public/http/v1 documents stay at 320 (Q12).
• Routed (ledger note): the six D3 annotations (C1); ArcForges docs: remove hardcoded reviewer model requirements #71 N-8 to N-12 (N1); nothing from H3 (its tooling defects are fixed in Cloud #142).
• State active with a started line naming the part order P0, D0, C1, E0, C2, E1a, E1b, E2, N1, N2a, N2b, N3, E3, X, D.

AF-AND-01, AF-PROD-01

• AF-AND-01 notes and a ledger note: the emulator checks (a) to (c) and the MobileNativeAuth app rules.
• AF-PROD-01 scope bullet and a ledger note: the edge rate limit in front of /.well-known/assetlinks.json must not refuse Google's or Android's verifiers (Cloud #141 review B N-8); the release identity (H-02, with H-04's upload key).

Review round

Independent review at 0891264 (plan82-verdict.md): APPROVE, 0 blocking, 6 non-blocking. Taken in a new commit, rebuilt from the base with the same scripts:

• N-1: the delivered line records that acceptance bullet 6's real-browser part ran on proof (H3), not against a local center; the local closed loop is the Go integration tests on real PostgreSQL (pages handler, virtual authenticator, no browser). The coordinator decided the divergence, and the venue is stronger.
• N-2: N2-7 is mapped to bullet 4 (its node contacted only its self-hosted center), and X's limit is stated: a refresh's success is inferred from the node staying signed in.
• N-4: the H-04 row and AF-PROD-01's human_prerequisites name the upload certificate fingerprint of the asset links; AR-08's section 3 now says these prerequisites block complete, not delivery, of AF-PROD-01, and that AR-08 itself blocks nothing.
• N-5: AF-CTR-05 bullet 3 reads "STATE/node_offline (added to ArcForges-Design errors.md by part D0)".
• N-3: kept as is.
• N-6: no wording change; the complete condition now names the keys check with the Windows tier and X item 1 (coordinator decision).

Checks

• python3 tools/plan.py validate --design <ArcForges-Design main 5da245e>: 0 errors; 63 tasks, 17 milestones.
• python3 <Design>/tools/check_design.py --plan delivery-graph.json: 0 errors, 3 notes.
• python3 -m unittest discover -s tests: 48 tests OK (QUIET-HOST absent).
• git diff --check: clean.
• The ledger diff against main is 7 appended lines; sequence.md and the ledger were written by tools/plan.py only (rebuilt from the base; build.py and register.py in the coordinator's scratch directory).

🤖 Generated with Claude Code

https://claude.ai/code/session_01H6Cf6kHnz1ZkfURhVWvGjP

[deku2026]

Review record for Plan #82 (AF-CTR-04 delivered; AF-CTR-05 started with P0).

Independent review at 0891264: APPROVE. It found 0 blocking and 6 non-blocking findings.

• Merge SHAs: all 22 match gh api, as do Plan plan: [AF-CTR-04] Scope: the prerequisites of the first gated operation move to AF-CTR-05 #80 and plan: [AF-CTR-04] Scope: MobileProbe as an allowed fake; AF-AND-01 redirect wording #81.
• Record corrections: the reviewer recomputed the file lists of all 20 code PRs. The list is exact.
• Labels: REAL, MOCKED and NOT PROVEN match the H1, X, keys and H3 evidence files.
• Ledger: append-only, and every line is byte-identical to tools/plan.py output.
• Checks: validate reports 0 errors and the unit tests pass (48 OK).

Review round at ec7056e: one new commit, rebuilt with the same scripts.

• N-1: bullet 6's real browser ran on proof (H3), not against a local center. The PR states this divergence.
• N-2: N2-7 is mapped to bullet 4, and the PR adds X's limit that a refresh's success is inferred, not observed.
• N-4: the H-04 upload-key fingerprint is named for AF-PROD-01, and the AR-08 wording is fixed.
• N-5: node_offline is noted as added by D0.
• N-6: the coordinator added the keys check to the complete condition.

complete is recorded separately. It is a state-only Plan PR, because #71 changed CloudLink after X, the tier run and the keys run. Its three conditions have now passed at ArcForges main 4bc33da:

• OS secret-store tier: run 42061577006, success.
• X item 1, the Windows node against proof: PASSED. Evidence: logs/evidence/x-ctr04-2026-11-05/rerun-4bc33da/.
• Keys check, on the local official-hosted rehearsal as originally recorded: PASSED. Evidence: logs/evidence/x-ctr04-2026-11-05/keys-rerun-4bc33da/.

Legs at ec7056e: arcforges/linux and arcforges/windows both succeeded.

---

Generated by Claude Code