Support authenticated legacy owner PR continuations

.agents/skills/atlas/assets/seed/records/12c5d5d40e9abe69ccc99cc5be3784c214305ff2165e74d82b3d9504927da5c9.json

@@ -0,0 +1 @@
+{"citations":[{"path":"tools/legacy-pr-update.py","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"34557a2c7ff791339e887d3a9ec9f444104809edbe5412a0d0fc0de4c066c501"},{"path":"tools/pr-lane-admission.py","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"acced39d9ab6aac1ecce9107ef6d26618a64364ede9271b5668dcf6bc29c2f30"},{"path":"tests/pr-lane-admission/test_legacy_update.py","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"4af9dc45bae77f13f972eaf2c500e2b0d0e169bd342d875d1692f14642770f1e"},{"path":"docs/coordination/legacy-pr-update.md","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"c1820e827fe16b3fc207b024fd39a5fafa6b37ad94c321f1d19d34e549d4adda"},{"path":"tools/legacy-pr-update.py","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"5773499da99cf8e0d4c82dc38e5439eaa463b85570abb543d3788ee65e6c38f2"},{"path":"src/FS.GG.Drivers/workspace-inventory.json","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"13dd28134211b416426c39877c6fd850ef5c839157aaa8ef7520127059e1134d"},{"path":"tests/pr-lane-admission/test_legacy_update.py","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"2b766d98419c148b801c0cb71b149fada000c9d8da49047a526c13440d3b73db"},{"path":"docs/coordination/legacy-pr-update.md","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"6036f92c7f52e18f227fe1c1ad687a628972bce43ba2cb91d4acad98c943c9e6"},{"path":"scripts/board-currency-rules.py","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"904706590286178790f843ecaeab28e0d3de61ac943bcc0e5637d3de5aba490f"}],"conflictsWith":[],"id":"github/legacy-owner-pr-continuation","kind":"boundary","recordedAt":"2026-11-03T08:14:29Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"An existing-owner body/title continuation is distinct from new admission or lane adoption. The separate --recover-legacy-update route binds a complete native roster of up to20 existing PRs, current default independently of historical PR bases, native owning Delivery references and exact issue bodies, existing source-change marker and pushed-head ancestry. It leaves lane metadata absent and preserves unrelated machine markers and reservations, so ordinary cap/unknown-reservation checks remain unchanged. One native Root operation comment binds repository/PR identity, owner, branch, previous/current heads and operation; REST/GraphQL comment identity and author/editor join the maintained board-currency Root trust, never caller-supplied login lists. The repository lock and adjacent rereads precede a single body/title PATCH. Fixed native-PR custody records intent, full deciding fingerprints and possible-send before effect, with complete independent roster readback. Uncertain reentry is read-only. Later operations require a fresh Root declaration explicitly resolving the exact prior journal hash/intent as delivered or not-sent and native text/head agreement; each prior journal remains intact. Source and pure tests do not prove deployment, a concrete native authorization, actual continuation or Delivery acceptance. Root policy decision is cited in the owning source document; it authorizes implementation only. Existing exact-two adoption, ordinary creation and SC2 admission remain separate.\n\nThe later prepared source also closes the actual Drivers dependency graph. The maintained workspace inventory delivers the admission entry point, its lazy legacy module and an exact projection of the canonical board-currency source to `.fsgg/legacy-pr-root-rules.py`. A source checkout keeps its canonical scripts path. The dedicated packaged alias supplies unchanged Root trust and reference parsing without making the ordinary Root-only board gate available in receiver workspaces. Actual maintained staging controls compare payload hashes/modes and exercise a complete valid six-PR plan through the staged CLI with inert provider data. Forged Root authorization and wrong owning references still refuse; removing either dependency fails closed. This is source/staging qualification, not a published or installed consumer claim.\n\nThe original ten-minute semantic job cancellation remains unaccepted. Its separately reviewed finite bound changes to fifteen minutes with every assertion, step and permission retained. Existing-owner scope still requires same-repository Delivery ownership; cross-repository ownership is not silently admitted. Fresh exact-source CI, native Root declaration, guarded first real continuation and any package publication/materialized adoption remain distinct acceptance. No draft-default or new-PR limit change follows from this repair.","supersedes":["c98c33b9137ffa25c66a9acae385fc41f9cbfe6d326944be0192b5657d38ac8e"],"tags":["pr","legacy","owner","continuation","custody","recovery","no-resend","package-closure","root-trust"],"title":"Continue an existing legacy PR owner without admitting a reservation"}

.agents/skills/atlas/assets/seed/records/540c718b8c0401e98b2b104efac54cdadf0c39c3baf408cb8f25ace687e29f0d.json

@@ -0,0 +1 @@
+{"citations":[{"path":"tools/legacy-pr-update.py","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"34557a2c7ff791339e887d3a9ec9f444104809edbe5412a0d0fc0de4c066c501"},{"path":"tools/pr-lane-admission.py","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"acced39d9ab6aac1ecce9107ef6d26618a64364ede9271b5668dcf6bc29c2f30"},{"path":"tests/pr-lane-admission/test_legacy_update.py","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"4af9dc45bae77f13f972eaf2c500e2b0d0e169bd342d875d1692f14642770f1e"},{"path":"docs/coordination/legacy-pr-update.md","repository":"FS-GG/.github","revision":"23be79f841f724cf4a64a9ff61a54cf55bcfa5d0","sha256":"c1820e827fe16b3fc207b024fd39a5fafa6b37ad94c321f1d19d34e549d4adda"},{"path":"tools/legacy-pr-update.py","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"5773499da99cf8e0d4c82dc38e5439eaa463b85570abb543d3788ee65e6c38f2"},{"path":"src/FS.GG.Drivers/workspace-inventory.json","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"13dd28134211b416426c39877c6fd850ef5c839157aaa8ef7520127059e1134d"},{"path":"tests/pr-lane-admission/test_legacy_update.py","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"2b766d98419c148b801c0cb71b149fada000c9d8da49047a526c13440d3b73db"},{"path":"docs/coordination/legacy-pr-update.md","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"6036f92c7f52e18f227fe1c1ad687a628972bce43ba2cb91d4acad98c943c9e6"},{"path":"scripts/board-currency-rules.py","repository":"FS-GG/.github","revision":"71d167e532f650fbd8c57353185adbccbc32ae00","sha256":"904706590286178790f843ecaeab28e0d3de61ac943bcc0e5637d3de5aba490f"},{"path":"tools/legacy-pr-update.py","repository":"FS-GG/.github","revision":"5d832dd4fcdbea9dea307f8e6007cd668d4e16b8","sha256":"67ed550440daef8b49622e1cdd614e581b2cb741a964774ab3a2b08bab9535ee"},{"path":"tests/pr-lane-admission/test_legacy_update.py","repository":"FS-GG/.github","revision":"5d832dd4fcdbea9dea307f8e6007cd668d4e16b8","sha256":"5e73ddd2776f27cc11cd7303d29f1f3426e5c6c025deb5f433f5b6d0a08474a1"},{"path":"docs/coordination/legacy-pr-update.md","repository":"FS-GG/.github","revision":"5d832dd4fcdbea9dea307f8e6007cd668d4e16b8","sha256":"e4291c39dfa6eaad01b9e21184629d9a96dca1232e5c880236de3207770aee89"}],"conflictsWith":[],"id":"github/legacy-owner-pr-continuation","kind":"boundary","recordedAt":"2026-11-03T08:33:18Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"An existing-owner body/title continuation is distinct from new admission or lane adoption. The separate --recover-legacy-update route binds a complete native roster of up to20 existing PRs, current default independently of historical PR bases, native owning Delivery references and exact issue bodies, existing source-change marker and pushed-head ancestry. It leaves lane metadata absent and preserves unrelated machine markers and reservations, so ordinary cap/unknown-reservation checks remain unchanged. One native Root operation comment binds repository/PR identity, owner, branch, previous/current heads and operation; REST/GraphQL comment identity and author/editor join the maintained board-currency Root trust, never caller-supplied login lists. The repository lock and adjacent rereads precede a single body/title PATCH. Fixed native-PR custody records intent, full deciding fingerprints and possible-send before effect, with complete independent roster readback. Uncertain reentry is read-only. Later operations require a fresh Root declaration explicitly resolving the exact prior journal hash/intent as delivered or not-sent and native text/head agreement; each prior journal remains intact. Source and pure tests do not prove deployment, a concrete native authorization, actual continuation or Delivery acceptance. Root policy decision is cited in the owning source document; it authorizes implementation only. Existing exact-two adoption, ordinary creation and SC2 admission remain separate.\n\nThe later prepared source also closes the actual Drivers dependency graph. The maintained workspace inventory delivers the admission entry point, its lazy legacy module and an exact projection of the canonical board-currency source to `.fsgg/legacy-pr-root-rules.py`. A source checkout keeps its canonical scripts path. The dedicated packaged alias supplies unchanged Root trust and reference parsing without making the ordinary Root-only board gate available in receiver workspaces. Actual maintained staging controls compare payload hashes/modes and exercise a complete valid six-PR plan through the staged CLI with inert provider data. Forged Root authorization and wrong owning references still refuse; removing either dependency fails closed. This is source/staging qualification, not a published or installed consumer claim.\n\nThe original ten-minute semantic job cancellation remains unaccepted. Its separately reviewed finite bound changes to fifteen minutes with every assertion, step and permission retained. Existing-owner scope still requires same-repository Delivery ownership; cross-repository ownership is not silently admitted. Fresh exact-source CI, native Root declaration, guarded first real continuation and any package publication/materialized adoption remain distinct acceptance. No draft-default or new-PR limit change follows from this repair.\n\nWhen present, the inventory-derived packaged alias determines legacy Root policy before a receiver-local canonical path; otherwise the canonical source path is selected. The loader executes captured bytes and records their relative path and SHA256 in existing inspection, intent and custody as rootRulesSource. Staged canonical-shadow and source-noalias controls retain Root trust and reference semantics; a synthetic retained-package epoch demonstrates that the actual selected hash stays distinct from a newer canonical source. This provenance identifies loaded bytes, not policy freshness or authority; join it to the actual selected caller/BOM and do not describe an older alias as current checkout policy.","supersedes":["12c5d5d40e9abe69ccc99cc5be3784c214305ff2165e74d82b3d9504927da5c9"],"tags":["pr","legacy","owner","continuation","custody","recovery","no-resend","package-closure","root-trust"],"title":"Continue an existing legacy PR owner without admitting a reservation"}

.agents/skills/atlas/assets/seed/records/a9e9de95b104c8b61624731355ca4888078a85332cefa21536307192cd9db1bd.json

@@ -0,0 +1 @@
+{"citations":[{"path":"tools/legacy-pr-update.py","repository":"FS-GG/.github","revision":"b7ec1bdcef31c484cc8b2fbe7aeaa7bfa59c38f8","sha256":"103ae8c3bde59b0a62864abc91b8b7c66277633128dfe2263e16454d7a26b275"},{"path":"tools/pr-lane-admission.py","repository":"FS-GG/.github","revision":"b7ec1bdcef31c484cc8b2fbe7aeaa7bfa59c38f8","sha256":"e21bb9674ca0757455e64a6b2c0adbae24c5df1a8c3c881314e9fc2415d11657"},{"path":"tests/pr-lane-admission/test_legacy_update.py","repository":"FS-GG/.github","revision":"b7ec1bdcef31c484cc8b2fbe7aeaa7bfa59c38f8","sha256":"1924ebe1cfb8a7ba89be691f89c73de4f2262b16c95f88e7583c49c21666d53b"},{"path":"src/FS.GG.Drivers/workspace-inventory.json","repository":"FS-GG/.github","revision":"b7ec1bdcef31c484cc8b2fbe7aeaa7bfa59c38f8","sha256":"0f8d604a58a0d6a343b8b853dd756445844ad2abbf3dc1afcebeb934ad1d2bde"},{"path":"docs/coordination/legacy-pr-update.md","repository":"FS-GG/.github","revision":"b7ec1bdcef31c484cc8b2fbe7aeaa7bfa59c38f8","sha256":"2fb47d9885537598ad9293eb51348c1b9a311783601f1fee53562c53f8cb10c2"},{"path":"scripts/board-currency-rules.py","repository":"FS-GG/.github","revision":"bcca401be4022aa66f81aca279691098b7c9a0a0","sha256":"f74ddd2884727fd1020c29a2051a8b0a5edf328f092351fc1a13b451a1784ff0"},{"path":"scripts/root-identity-policy.json","repository":"FS-GG/.github","revision":"bcca401be4022aa66f81aca279691098b7c9a0a0","sha256":"828dd54ca7ce74e2ffa3b2082b823537680aa8819a2a88143f359d103287174c"}],"conflictsWith":[],"id":"github/legacy-owner-pr-continuation","kind":"boundary","recordedAt":"2026-11-04T03:07:17Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"An existing-owner body/title continuation is distinct from new admission or lane adoption. The separate --recover-legacy-update route binds a complete native roster of up to20 existing PRs, current default independently of historical PR bases, native owning Delivery references and exact issue bodies, existing source-change marker and pushed-head ancestry. It leaves lane metadata absent and preserves unrelated machine markers and reservations, so ordinary cap/unknown-reservation checks remain unchanged. One native Root operation comment binds repository/PR identity, owner, branch, previous/current heads and operation; REST/GraphQL comment identity and author/editor join the maintained board-currency Root trust, never caller-supplied login lists. The repository lock and adjacent rereads precede a single body/title PATCH. Fixed native-PR custody records intent, full deciding fingerprints and possible-send before effect, with complete independent roster readback. Uncertain reentry is read-only. Later operations require a fresh Root declaration explicitly resolving the exact prior journal hash/intent as delivered or not-sent and native text/head agreement; each prior journal remains intact. Source and pure tests do not prove deployment, a concrete native authorization, actual continuation or Delivery acceptance. Root policy decision is cited in the owning source document; it authorizes implementation only. Existing exact-two adoption, ordinary creation and SC2 admission remain separate.\n\nThe later prepared source also closes the actual Drivers dependency graph. The maintained workspace inventory delivers the admission entry point, its lazy legacy module and an exact projection of the canonical board-currency source to `.fsgg/legacy-pr-root-rules.py`. A source checkout keeps its canonical scripts path. The dedicated packaged alias supplies unchanged Root trust and reference parsing without making the ordinary Root-only board gate available in receiver workspaces. Actual maintained staging controls compare payload hashes/modes and exercise a complete valid six-PR plan through the staged CLI with inert provider data. Forged Root authorization and wrong owning references still refuse; removing either dependency fails closed. This is source/staging qualification, not a published or installed consumer claim.\n\nThe original ten-minute semantic job cancellation remains unaccepted. Its separately reviewed finite bound changes to fifteen minutes with every assertion, step and permission retained. Existing-owner scope still requires same-repository Delivery ownership; cross-repository ownership is not silently admitted. Fresh exact-source CI, native Root declaration, guarded first real continuation and any package publication/materialized adoption remain distinct acceptance. No draft-default or new-PR limit change follows from this repair.\n\nCurrent-main integration exposed another transitive dependency: the canonical board-currency source now loads the shared sibling root-identity-policy.json. The old staged alias lacked that data, so its valid-plan test failed before native effects. The repaired inventory delivers the same canonical policy beside the alias. rootRulesSource includes both exact selected rule bytes and nested policy path/SHA256; the helper checks policy stability during load and rechecks the complete fingerprint at native population barriers. Receiver-local rule and data shadows cannot replace this package closure; missing/malformed data and valid but changed policy refuse. The staged controls exercise these cases and actual valid/forged/wrong-owner plans with inert native responses. Removing the trust recheck causes the changed-policy control to fail, and restoring it passes.\n\nThe current draft-creation helper also introduced an integration boundary: legacy validation's early return must not bypass --draft's create-only restriction. The composed guard rejects legacy plus --draft before reads, while preserving main's draft flag and exact native readback implementation. Removing this guard fails the legacy mode-injection control; restoration passes. The complete merged admission suite reports 75 passing tests after the retained missing-policy failure. This remains source and isolated-staging evidence, not actual GitHub continuation, package publication or installed adoption. Existing original operation histories and all full Delivery acceptance obligations remain open.","supersedes":["540c718b8c0401e98b2b104efac54cdadf0c39c3baf408cb8f25ace687e29f0d"],"tags":["pr","legacy","owner","continuation","custody","recovery","no-resend","package-closure","root-trust"],"title":"Continue an existing legacy PR owner without admitting a reservation"}