Add finite original-operation observer with preserved custody

.agents/skills/atlas/assets/seed/records/d52ca358246f638d0e11a061e97863697df44f43b093d6e8b84ba67b5838f2fb.json

@@ -0,0 +1 @@
+{"citations":[{"path":"src/FS.GG.Coord.Core/OperationObservation.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"44e047443bd8cff3b06c5004088bfaf19ecf1a555991965de7ddb6de5002bfc8"},{"path":"src/FS.GG.Coord.Core/OperationObservation.fsi","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"d7887574e43963f7f4b8405375700656c1eecfa3eadfa20e62cb2f7eeed23269"},{"path":"src/FS.GG.Coord.GitHub/OperationObservationReads.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"6c7be70de4fc56303147b84ebb650e634c3a8fd3615056d2aa90739fae771ba0"},{"path":"src/FS.GG.Coord.GitHub/OperationObservationReads.fsi","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"271f309420c9ee509353e03cc3caa4ee3f321a47a7215b4f6b5f3c869c00c5bc"},{"path":"src/FS.GG.Coord.GitHub/Transport.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"ae98e9b164642e9c664de8096c60815d39e296fa53f9dce1e1b8fbc566972aae"},{"path":"src/FS.GG.Coord.Cli/OperationObservationApplication.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"7975391b55f710dfbad5f61e505a1cf6eaf6e7600c92eb360cde21c214539f1c"},{"path":"src/FS.GG.Coord.Cli/OperationObservationApplication.fsi","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"3d5e0fb2377b963144bc623ba520347ff9d63ab5788f8ce22825d1e3fcd00c86"},{"path":".agents/skills/work-board/references/observation.md","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"829dd0cb8b0e19e4715f3cbf23402e472ac9138e35f75a7e1f249683b821a261"},{"path":"docs/roadmaps/2026-10-05-programme-context-efficiency.md","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"c4caf355fb6026011e2341268fb3ac2a69c9db495036f1d5865e37e4010132df"}],"conflictsWith":[],"id":"coordination/original-operation-observation-boundary","kind":"boundary","recordedAt":"2026-10-20T10:14:16Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"The selected F# source adds one finite read-only attention invocation for an explicitly identified, already-running GitHub Actions run/attempt. Core reduces observations; the GitHub adapter reads native facts; the existing engine CLI owns local continuation. Exact input retains owning issue/body update and digest, source, owner, slice/original attempt, PR/head, run/attempt, population revision and original Unknown identifiers. These attributed inputs and the cursor confer no authority. No scheduler, model callback per pending tick, arbitrary command recipe, dispatch, retry, Status write, reservation release or merge-readiness decision is added.\nThe original 1–600-second window includes a 500ms cleanup reserve; it starts with 384 requests and 4MiB accepted evidence/result output. Linux boot identity and monotonic ticks bind continuation. Resume retains absolute work/cleanup deadlines and remaining budgets, refusing changed identity/clock, backwards time, corrupt or expired custody before native reads. Requests are charged and persisted before sending; a crash may spend allowance without progress but cannot replenish it. Pending progress stays internal, with waits at most five seconds; actionable change, terminal observation, gap or deadline returns one compact attention result.\nAn ordinary complete sample uses two owning-issue reads, two PR reads, two run reads and two complete selected-attempt job sweeps: eight GETs through 100 jobs, ten for 101–128. Pages are constructed explicitly, complete counts and unique identities are checked, and each job binds run/attempt/head. Population disagreement, incomplete/unsupported observations or completion across the run/jobs barrier cannot become positive completion. This is the selected run population, not every required PR check. Each GET uses at most 30 seconds within remaining work time. The reused transport may transiently acquire 4MiB; only pages of at most 256KiB are accepted before parsing. The latter is not an acquisition cap or a process memory bound.\nFor a sample-derived terminal, output charge is persisted with Terminal/Evidence cleared, then evidence is written, then the terminal and evidence reference are persisted. A hard interruption before evidence custody resumes native observation from the retained pending cursor; it cannot replay an unretained positive sample. Durable terminal attention replays its stable identity only within the original window. Deadline checks after evidence/persistence and before final output prevent late completion delivery. Local checksum, exclusive lock and flushed file replacement do not establish hostile-tamper protection, directory/disk-loss durability or exactly-once delivery.\nThe original Unknowns and reservations remain untouched. Existing Python observation remains a separate bounded rollback route and cannot consume this cursor or renew an expired window. Source review is distinct from required CI, coherent publication, verified installed caller/instruction discovery and necessary real observation/restart/deadline/rollback acceptance. No native acceptance, whole-family economic benefit or current operational permission follows from this record.","supersedes":[],"tags":["coordination","observer","deadline","recovery","cursor","budget","unknown","source"],"title":"Finite original-operation observation retains clocks, budgets and uncertainty without execution authority"}

.agents/skills/atlas/assets/seed/records/e7ed299ecf44d4a96c228e9aa30312f405df34d6bea99d4b0f7074c79705a671.json

@@ -0,0 +1 @@
+{"citations":[{"path":".github/workflows/telemetry-host-package.yml","repository":"FS-GG/.github","revision":"4c39f34110ae98ced402d7ddcc39822b35011296","sha256":"0fd1410a5a7be6d64f6dae520089c446d5446bc6468cebf82eda9c4cfb28bcf8"},{"path":"tests/telemetry-collector-container/test_private_native_qualification.py","repository":"FS-GG/.github","revision":"4c39f34110ae98ced402d7ddcc39822b35011296","sha256":"8d9ed1f67249a16665ab08ee7f16e65b015b0090a03adb445f1ea325a1b104e2"}],"conflictsWith":[],"id":"github/hosted-exact-sdk-isolation","kind":"lesson","recordedAt":"2026-10-20T10:47:26Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"Installing an exact SDK into a multi-SDK root does not itself establish exact CLI selection under latestFeature policy. The maintained hosted workflow now preserves the image SDK tree by a guarded no-clobber same-filesystem sibling rename before the pinned setup action installs SDK10.0.401 into the unchanged /usr/share/dotnet root. Provider, real-directory/path, destination-absence and device checks precede rename; source absence and retained device/inode identity are read back before setup proceeds. Existing trusted-image/C-toolchain custody, exact SDK/path checks, normalization, native flags and job budgets remain. The pre-normalization probe requires successful exit plus exact10.0.401 and retains original stdout/stderr/exit in a fresh private directory, with a separate always-run diagnostic artifact route. Pure controls exercise preserved identity/content, refusal without clobber including a racing destination, exact setup ordering and wrong-version/failed-probe evidence before custody changes. This is source preparation with pure filesystem/shell validation only: no .NET/runtime execution, actual hosted CI success, published or installed adoption is established by this record. The original hosted refusal discarded its selected-version stdout, so that original version remains Unknown; later setup/image/source observations do not reconstruct it. Root owns exact final integration, required CI, final source/closure qualification and any applicable effects. No new SDK/image allowance, global policy change, reservation release, native activation or measured saving follows.","supersedes":[],"tags":["ci","hosted","sdk","isolation","custody","diagnostics","preflight"],"title":"Exact hosted SDK setup requires isolation from preinstalled resolver candidates"}

.agents/skills/work-board/references/observation.md

@@ -133,3 +133,79 @@ clocks, report time, lineage/attribution coverage and omissions. Historical gaps
 configready, helper success and updated dashboards cannot certify operational recovery or
 cost/efficiency compliance. See `docs/reference/local-telemetry-store.md` for the existing
 commands and concrete recipe. No automatic reviewer, provider interception or backfill follows.
+
+## Finite original-operation attention
+
+The additive `observe-operation` source route observes one explicitly admitted, already-running
+GitHub Actions run and attempt. Use it only after its source, coherent publication, physically
+verified installed caller and instruction discovery have been qualified for the selected scope.
+Source availability alone does not activate the route. Root retains operation/resource admission,
+Status reconciliation and full acceptance. The observer performs bodyless REST GETs; it does not
+schedule, dispatch, retry, cancel, release reservations, mutate planning or evaluate merge readiness.
+
+Prepare one private `fsgg.operation-observation-input/1` JSON object with exactly `schema`, `identity`
+and `seconds` (1–600). `identity` has exactly `issue` (`OWNER/REPO#NUMBER`), `slice`, `attempt`, `owner`,
+`sourceRevision` (40 lowercase hex), `issueUpdatedAt` (exact native value), `issueBodySha256` (SHA256
+of the exact UTF8 native body), `repository` (`OWNER/REPO`), `pullRequest`, `head` (40 lowercase hex),
+`runId`, `runAttempt`, `populationRevision` and `unknowns` (the retained original Unknown identifiers).
+These are attributed root inputs, never authentication or a new execution grant. Preserve all original
+effects and reservations, including obligations outside the selected run. Missing identity is a gap;
+do not reconstruct unavailable originals or replace them with a fresh attempt.
+
+Invoke the genuine qualified installed caller once for the admitted attention window:
+
+```bash
+fsgg-coord-engine observe-operation start --input /PRIVATE/operation-input.json --cursor /PRIVATE/original-observer.json
+```
+
+The private parent directory must already exist and remain in the original operation's custody.
+`GITHUB_TOKEN`, falling back to `GH_TOKEN`, supplies read credentials. The live adapter uses
+`https://api.github.com`; other hosts and non-Linux clock continuation are unsupported. It binds the
+owning issue's native body digest/update revision before and after each sample, PR head barriers,
+selected run/attempt barriers, two complete job-population sweeps, and every job's original run/attempt/head. Empty or incomplete jobs,
+ambiguous native PR association, count drift, missing continuation, duplicate fields/identities and
+unsupported native states produce attention rather than success. Jobs are the complete selected-run
+population, at most128 across two explicit100-item pages; this is not all PR checks or required checks.
+
+The invocation retains pending observations internally and prints one JSON result, at most4096bytes,
+when a terminal observation, PR control change, identity/population drift, native-read gap, interruption
+or deadline requires attention. Unchanged ticks and ordinary pending job progress cause no model callback or stdout record. The result
+contains the original PR/head/run/attempt, stable attention identity, semantic revision, remaining
+request budget, retained Unknown count and private cursor/evidence references. `completed` describes
+native selected-run/job observations only. Readiness remains `not-evaluated`; no observation releases
+Unknowns or establishes source/publication/installed/native acceptance.
+
+The original window is at most600seconds including a500ms cleanup reserve, at most384 requests,
+30seconds per request and4MiB total accepted evidence/result output. Each accepted response page is
+at most256KiB before parsing; the reused transport may transiently acquire up to4MiB before this
+adapter rejects an oversized page. This differs from the Python watcher's256KiB acquisition bound.
+Ordinary samples cost eight GETs for up to100jobs, or ten for101–128jobs, with a maximum5second
+internal wait. Owning issue revisions and source timestamps are not renewed by local observation.
+Filesystem calls and the hosting process are not a separately qualified process-tree supervisor.
+
+Resume the same cursor and exact input after interruption:
+
+```bash
+fsgg-coord-engine observe-operation resume --input /PRIVATE/operation-input.json --cursor /PRIVATE/original-observer.json
+```
+
+The checksum-protected cursor retains Linux boot/tick clock identity, original absolute work/cleanup
+deadlines, remaining request/output budgets, population and semantic revision. Its checksum detects
+accidental corruption, not hostile modification or authority. Missing, corrupt, changed-clock,
+identity-drifted or expired custody refuses before native IO. Every request is charged and persisted
+before sending; a crash can lose allowance but cannot renew it. Terminal attention replays its stable
+identity within the original window. This does not promise exactly-once crash delivery. An attention is terminal for its original invocation; resume replays that result. A new
+`start` refuses an existing cursor. Never delete custody to bypass expiry or a refusal.
+
+Private files are created with owner read/write permissions and one process holds the cursor lock.
+The cursor is replaced through a flushed temporary file; directory durability and disk-loss recovery
+are not established by this source. On cancellation, an in-flight read may consume its remaining
+bounded allowance before the interruption result. A hard-killed observer leaves the original cursor,
+Unknowns and reservations intact. Root reconciles the original operation independently.
+
+Rollback keeps the existing `tools/routine-delivery.py --watch-checks` route for an independently
+admitted remaining observation. That helper cannot consume this cursor or renew its deadline. After
+an observer failure, retain its original custody and use fresh bounded native readback; do not start
+a fresh600second watcher for the same expired window. Report actual parent/worker/reviewer usage,
+coverage omissions and native request costs. Zero unchanged-tick model invocations follows from the
+finite code path; measured whole-family savings and installed acceptance require their own evidence.

.claude/skills/atlas/assets/seed/records/d52ca358246f638d0e11a061e97863697df44f43b093d6e8b84ba67b5838f2fb.json

@@ -0,0 +1 @@
+{"citations":[{"path":"src/FS.GG.Coord.Core/OperationObservation.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"44e047443bd8cff3b06c5004088bfaf19ecf1a555991965de7ddb6de5002bfc8"},{"path":"src/FS.GG.Coord.Core/OperationObservation.fsi","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"d7887574e43963f7f4b8405375700656c1eecfa3eadfa20e62cb2f7eeed23269"},{"path":"src/FS.GG.Coord.GitHub/OperationObservationReads.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"6c7be70de4fc56303147b84ebb650e634c3a8fd3615056d2aa90739fae771ba0"},{"path":"src/FS.GG.Coord.GitHub/OperationObservationReads.fsi","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"271f309420c9ee509353e03cc3caa4ee3f321a47a7215b4f6b5f3c869c00c5bc"},{"path":"src/FS.GG.Coord.GitHub/Transport.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"ae98e9b164642e9c664de8096c60815d39e296fa53f9dce1e1b8fbc566972aae"},{"path":"src/FS.GG.Coord.Cli/OperationObservationApplication.fs","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"7975391b55f710dfbad5f61e505a1cf6eaf6e7600c92eb360cde21c214539f1c"},{"path":"src/FS.GG.Coord.Cli/OperationObservationApplication.fsi","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"3d5e0fb2377b963144bc623ba520347ff9d63ab5788f8ce22825d1e3fcd00c86"},{"path":".agents/skills/work-board/references/observation.md","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"829dd0cb8b0e19e4715f3cbf23402e472ac9138e35f75a7e1f249683b821a261"},{"path":"docs/roadmaps/2026-10-05-programme-context-efficiency.md","repository":"FS-GG/.github","revision":"7478705a4841750833a7237469f79251f69c71ea","sha256":"c4caf355fb6026011e2341268fb3ac2a69c9db495036f1d5865e37e4010132df"}],"conflictsWith":[],"id":"coordination/original-operation-observation-boundary","kind":"boundary","recordedAt":"2026-10-20T10:14:16Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"The selected F# source adds one finite read-only attention invocation for an explicitly identified, already-running GitHub Actions run/attempt. Core reduces observations; the GitHub adapter reads native facts; the existing engine CLI owns local continuation. Exact input retains owning issue/body update and digest, source, owner, slice/original attempt, PR/head, run/attempt, population revision and original Unknown identifiers. These attributed inputs and the cursor confer no authority. No scheduler, model callback per pending tick, arbitrary command recipe, dispatch, retry, Status write, reservation release or merge-readiness decision is added.\nThe original 1–600-second window includes a 500ms cleanup reserve; it starts with 384 requests and 4MiB accepted evidence/result output. Linux boot identity and monotonic ticks bind continuation. Resume retains absolute work/cleanup deadlines and remaining budgets, refusing changed identity/clock, backwards time, corrupt or expired custody before native reads. Requests are charged and persisted before sending; a crash may spend allowance without progress but cannot replenish it. Pending progress stays internal, with waits at most five seconds; actionable change, terminal observation, gap or deadline returns one compact attention result.\nAn ordinary complete sample uses two owning-issue reads, two PR reads, two run reads and two complete selected-attempt job sweeps: eight GETs through 100 jobs, ten for 101–128. Pages are constructed explicitly, complete counts and unique identities are checked, and each job binds run/attempt/head. Population disagreement, incomplete/unsupported observations or completion across the run/jobs barrier cannot become positive completion. This is the selected run population, not every required PR check. Each GET uses at most 30 seconds within remaining work time. The reused transport may transiently acquire 4MiB; only pages of at most 256KiB are accepted before parsing. The latter is not an acquisition cap or a process memory bound.\nFor a sample-derived terminal, output charge is persisted with Terminal/Evidence cleared, then evidence is written, then the terminal and evidence reference are persisted. A hard interruption before evidence custody resumes native observation from the retained pending cursor; it cannot replay an unretained positive sample. Durable terminal attention replays its stable identity only within the original window. Deadline checks after evidence/persistence and before final output prevent late completion delivery. Local checksum, exclusive lock and flushed file replacement do not establish hostile-tamper protection, directory/disk-loss durability or exactly-once delivery.\nThe original Unknowns and reservations remain untouched. Existing Python observation remains a separate bounded rollback route and cannot consume this cursor or renew an expired window. Source review is distinct from required CI, coherent publication, verified installed caller/instruction discovery and necessary real observation/restart/deadline/rollback acceptance. No native acceptance, whole-family economic benefit or current operational permission follows from this record.","supersedes":[],"tags":["coordination","observer","deadline","recovery","cursor","budget","unknown","source"],"title":"Finite original-operation observation retains clocks, budgets and uncertainty without execution authority"}