Skip to content

retire workers/participation-coordinator (lives in its own Foundry base) - #1

Merged
Diomandeee merged 55 commits into
mainfrom
participation/retire-coordinator-subtree
Oct 23, 2026
Merged

retire workers/participation-coordinator (lives in its own Foundry base)#1
Diomandeee merged 55 commits into
mainfrom
participation/retire-coordinator-subtree

Conversation

@Diomandeee

@Diomandeee Diomandeee commented Oct 23, 2026

Copy link
Copy Markdown
Owner

What

Removes workers/participation-coordinator from the monorepo. The MotionMix participation coordinator moved on 2026-10-22 to its own Foundry base, foundry-staging/participation-coordinator (mirror: Diomandeee/participation-coordinator, private), seeded from this subtree at 509f72d. There, every change lands through the gate and tools/deploy-from-base.sh refuses to deploy a SHA without a MERGE decision. Live: base 5709e09, Worker protocol v2.

The subtree here was frozen at 509f72d and had no commits from any other lane since; removing it leaves one source of truth.

Also in this change

  • package-lock.json regenerated (npm install --package-lock-only): drops the @foundry/participation-coordinator workspace. It also picked up the workers/fleet-signal workspace, which the lockfile had been missing.
  • IMPLEMENTATION.md, docs/INTEGRATION-STATUS.md, docs/APP-FLEET-ONBOARDING-2026-10-22.md: the lines that described the subtree now point at the base (and record that C1 is closed in code, not by the kill switch).

How to land

This branch is fix/lockfile-sync-20261020 @ 0c06cef + the coordinator's last monorepo commit (509f72d) + this retirement. Either merge here once the lockfix line has landed on main, or cherry-pick 39f9147 onto the lockfix branch so it rides along. The foundry lane owns that branch; the registry record for the new base is already in docs/app-fleet/apps.v1.json on the lockfix working tree (appended under the registry lock, uncommitted).

🤖 Generated with Claude Code

Diomandeee and others added 30 commits October 21, 2026 10:29
@Diomandeee @claude
feat(mac-worker,linux-pilot,compute): Mac5 host sealed + provisioned,…
6e79b86 
… Linux first job, staging authority

Mac worker (Mac5), all root steps run through fleet-authority with phone approval:
- capability-record.ts: observed guest + image manifest + helper hashes -> validated
  MacVmCapability (r2 sha256 d77f046a...).
- seal-capability.sh: one APFS volume per sealed tree, ownership enabled on the
  mounted volume, root-private populate window, fstab ro line, read-only mount,
  mac-tree-guard frame + receipt, operator-readable step log. Sealed 2026-10-21.
- seal-source-tree.sh: same mechanism for owner source trees under
  /Library/Foundry/VM/sources/<name>/tree (tree below the mount point because
  .fseventsd sits at every volume root). XcodeAgentTest sealed.
- provision-build-account.sh: hidden _foundrybuild account (uid/gid 520), owner-
  private input/work/journal/cache roots, mac-vm-io.py installed hash-locked.
- Evidence: docs/cloud-workspaces/mac-worker-2026-10-21 (guest observation,
  receipts, logs, worker config entries). Found: LaunchDaemons need Full Disk
  Access for the external T7 volume (TCC), diskutil reports ownership only for
  mounted volumes.

Linux pilot: first job PASS on the GCP VM (write-policy.py, run-attempt.py,
recipe-digests.ts, install-host.sh sync fix, python recipe tool with installArgs
in build-jobs + build-runtime, tests). Evidence linux-pilot-2026-10-21.

Compute authority: wrangler.toml + provision.sh for foundry-compute-staging
(builds off, enrolment + transport on); only bearer digests leave the host.

Tests: workers/compute 123/123, build-runtime + build-jobs 120/120.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fix(mac-worker): first real-app builds on Mac5; VM start, intake and …
d6b226f 
…guest runner fixes

Root causes found on Mac5 today, each reproduced before fixing:
- mac-vm-host: Virtualization.framework takes its own exclusive flock on the
  boot/output disks and auxiliary storage at start and refuses while the helper
  holds one ("storage device attachment is invalid", "Failed to lock auxiliary
  storage"). The helper now releases its locks right before vm.start and, after
  a successful start, proves VZ holds each one (EWOULDBLOCK). A VM left in
  .error after a failed start exits as UNKNOWN instead of observing forever.
  Auxiliary storage limit 16 -> 64 MiB (real VZMacAuxiliaryStorage is ~32 MiB).
- mac-vm-io.py: hdiutil now prints deprecation warnings into the merged output;
  parse exactly one plist document. Intake envelope 8 MiB -> 4 GiB + 128 MiB,
  image hash bound 8 GiB.
- guest runner v3 (mac-vm-guest.py): path rule matches the host tools ('+', '@'
  allowed: ModelContext+Save.swift); owner-prefetched Swift packages from
  .foundry/spm.tar.partNNN are checked and unpacked into the dependencies dir;
  -skipMacroValidation/-skipPackagePluginValidation for owner-trusted projects;
  CFFIXED_USER_HOME + -packageCachePath keep SwiftPM writes inside the attempt;
  results up to 4 GiB with a separate 64 MiB log cap; lchown for package links.
- Host requirements learned: macOS guests need the build user's GUI login
  session (sessionless = VZErrorDomain -9), so foundrybuild is a real non-admin
  login user kept logged in via fast user switching; fleet-authority needs Full
  Disk Access for the external T7 volume; boot disks must be fully allocated.

Tooling: build-job.sh (parameterised job + verified delivery for Mac1),
install-helper.sh, dense-master.sh, make-build-user-loginable.sh,
seal-source-tree.sh (mode column), direct-boot-proof.sh; evidence and request
scripts in docs/cloud-workspaces/mac-worker-2026-10-21 (sources sealed for
Mo en Movimiento, Air Deck, Coltivare). First XcodeAgentTest build passed
end to end at 18:47Z; runner v3 proven by an in-guest Air Deck build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
feat(fleet-authority 1.2 + fleet-signal): Fabric approval transport
d78c41e 
fleet-authority 1.1.2 + 1.2.0:
- 1.1.2: plain reply lines, 1800 s default expiry, approve-without-id
  (single pending request shown within 5 min), pipe EOF fix.
- 1.2: P-256 node key (node-key.raw, root 0600). When signal.json names a
  relay, staged requests are published as node-signed canonical payloads
  (script, args, template, run_as, timeout: the phone recomputes fp),
  device-signed decisions are polled and fed to approve_signed, and the
  receipt chain is mirrored. Outbound HTTPS only.
- approve_signed accepts the exact signed string, requires issued_at
  within 600 s; a signed decision counts as the show.
- Enrolled keys move to keys.json (outside the policy hash), so enrolling
  no longer kills pending requests. Root-only keys-add / keys-revoke /
  relay-config, meant to run inside an approved staged script.
- Test mode (non-root, FLEET_AUTHORITY_TEST_ROOT) and test/fabric-e2e.sh:
  publish, phone verify, approve runs once, deny, replay refused, forged
  signature refused, receipts mirrored. Passes against staging.

workers/fleet-signal: relay Worker (Durable Object SQLite), node/device
signed auth with replay table, APNs push, 8 unit tests. Deployed as
fleet-signal-staging.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-signal: two-key devices (Face ID decision key), device push-tok…
16e6130 
…en endpoint, hide revoked Macs' requests; enroll-phone.sh

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
rotation ledger: Vast retirement + stopped instance as pending decisions
b33d02e 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
repo-hygiene: inventory/doc-status/ref-ledger/boundary-receipt schema…
8e6525d 
…s, read-only scanner, ratchet boundary check (R1-R6), first scans

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
repo-hygiene doc: pin verified_commit
f5a2016 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
repo-hygiene: R5 counts a doc's own commit as re-verification; Comp-C…
aaf6dc9 
…ore worktree scans

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-authority 1.3 + fleet-signal: security review 2026-10-22 fixes
9764c17 
Daemon 1.3:
- H1 root PATH is /usr/bin:/bin:/usr/sbin:/sbin (no login-user-owned /opt/homebrew/bin)
- H9 SIGPIPE ignored + SO_NOSIGPIPE, 10 s send/receive deadlines, pending caps
  (30 total, 10 per uid), refuse stage under 1 GiB free, GC after 24 h,
  running requests marked orphaned on restart (never re-run)
- M1 control/bidi/zero-width characters refused in description and script;
  render is one-line JSON description, line count, sha256, fenced by request id
- M2 decisions need the full 16-hex id (or >=16 hex of fp) and a unique match
- C2 render flags UNPINNED references to user-owned paths; payload carries them
- C3 signed decisions only from keys enrolled as biometric
- C4 enroll_key typed op: daemon writes the script and renders its own SHA256
  fingerprint; free-form scripts touching keys/policy/authorized_keys refused
- H5 signed payload lists approver_key_ids
fleet-signal: devices must enroll a biometric decision key; decisions only from
approver_key_ids in the node-signed payload; decisions keyed per approver key
(decisions2) so another device cannot squat a request.
Tests: test/hardening-1.3.sh (13 checks) and test/fabric-e2e.sh pass; relay 10/10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
orchestrator: intake refuses tasks without allowedRoots unless unrest…
b5339bc 
…ricted:true (review H4); deployed staging 714775ec

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
install-host-helpers: approved sha256 per helper, hash the root-only …
1d2e526 
…copy (review H6)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
participation-coordinator: temporary kill switch for actor recovery (…
8901867 
…review C1); NOT DEPLOYED, needs Mohamed's word

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-authority 1.4: attachments (review C2)
afde504 
stage --attach name=path: files travel with the request, are stored root-only in
pending/<id>/files (0400), hashed into the fingerprint (key present only when
non-empty, so older fingerprints are unchanged), re-hashed before run, shown in
the render (text in full, binaries by sha256) and in the signed relay payload.
Scripts reach them as $FLEET_FILES/<name>; nothing under /Users needs executing.
Protected-change and display-trick checks apply to attachment text too.
Relay body cap 2 MiB (deployed 0eb5259c). Tests: hardening.sh (attachments run
from the root copy, change the fp, tamper refused, smuggled keys-add refused) and
fabric-e2e.sh (attachment verified by the phone stand-in through the relay) pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
build-job: validate every input (H7), fixed LAUNCH; root-owned delive…
66b8a00 
…red-outputs receipt (H8) + fetch-verify-results.sh that trusts only it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
Foundry builds re-cut for fleet-authority 1.4: three requests (cap+Mo…
e1c1abe 
…, Air Deck, Coltivare) that run only attached, fingerprinted scripts (review C2); split to fit the 3600 s daemon cap

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
foundry-audit: base-ref audit (review H3 detective): every first-pare…
cc7cdbd 
…nt commit on each base main must be a gated merge or pre-gate history; self-tested with a throwaway ungated push (flagged); LaunchAgent every 6 h on Mac1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-signal: owner-only GET /v1/admin/receipts?host= (operator view …
ee70abb 
…of a Mac's mirrored receipt chain); deployed staging 33ced1fb

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
Mac5 Tailscale watchdog (TEMPORARY): LaunchAgent reconnects the App S…
64e8858 
…tore Tailscale within 60 s when it is found stopped; tested 03:23Z (down -> back in 38 s). Real fix: headless tailscaled LaunchDaemon.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-authority 1.4.1: explicit ad-hoc signature (identifier fleet-au…
0feba51 
…thority) via build.sh

swiftc leaves only a linker-signed ad-hoc signature (flags 0x20002). macOS will not keep a
Full Disk Access grant for it: on Mac5 the System Settings toggle switched itself off twice
(2026-10-22 03:37Z, 03:38Z), so the approved Foundry build died writing to the T7. 1.0 was
explicitly ad-hoc signed (flags 0x2) and kept its grant. build.sh now always re-signs.
1.4.1 binary 01cd5c53; Mac5 update script drops the policy.json edit (1.4 refuses free-form
policy changes; expiry is already 1800 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-signal: device pending list shows only requests it is an approv…
b5e1d9b 
…er for; owner GET /v1/admin/devices (no keys/tokens)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fleet-authority 1.4.2: sign with an Apple Development identity (team …
06c42c8 
…8643C988C4) so macOS 27.2 keeps Full Disk Access

1.4.1's explicit ad-hoc signature still lost its FDA toggle on Mac5 within ~70 s (17:07:55Z on,
17:09:08Z off), with no MDM and a valid on-disk signature. A team-identity signature gives TCC a
stable designated requirement (identifier fleet-authority + team), which also survives future
updates. build.sh takes SIGN_IDENTITY; hardened runtime on. 1.4.2 binary 7239042e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
build-job: run driver+helper at nice -15 (fence-timeout under Live/ec…
f6c24c3 
…helon load on Mac5, 2026-10-22 17:20Z); request 1 skips the already-sealed capability; attempt ids -d

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
base-ref-audit: also audit every foundry_base recorded in docs/app-fl…
58ad63e 
…eet/apps.v1.json

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: registry builder, ASC sync + rename, Foundry seeder (text-…
d1d055c 
…only orphan seeds), plan doc

Registry from GitHub + ios-apps.md + library r3 + backup manifest; App Store Connect joined
(80 records, none live); OpenClaw removed from ASC names/fields and 4 repo names; onboard.py
seeds one text-only commit per base with .foundry/assets.json; receipts for every change.
apps.v1.json follows in the next commit once the seeding batch finishes writing it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
docs: Foundry security review 2026-10-22 (C1-C4, H1-H11, M1-M11, dire…
3b98e6e 
…ct protocol)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
docs: storage ledger (lane B), caches batch 1 on Mac1 and Mac4
07eab00 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
Foundry: request to install the fixed intake tool (MAX_TREE 4 GiB+128…
0c3518b 
… MiB; installed copy was the 8 MiB one, refusing the 912 MB Mo app) and rebuild Mo en Movimiento (attempt -e)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
build-job: deliver from intake payload/ (verified intake layout), not…
63d8ff2 
… files/; deliver-intake.sh re-delivers an already-intaken attempt without a rebuild

Mo en Movimiento attempt mo-581552c-e: intake ACCEPTED the 912 MB app (17:34Z) after the io fix,
then delivery failed reading files/ in the intake tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
fetch-verify-results: run the remote root-ownership check under /bin/…
6b49dd4 
…sh (zsh did not word-split); first verified Foundry app: Mo en Movimiento mo-581552c-e, 226 files / 912 MB match the root receipt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: registry with 51 seeded scaffold bases + seed receipts
3d81a58 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
Diomandeee and others added 25 commits October 22, 2026 13:44
@Diomandeee @claude
app-fleet: seeding rules + batch 1 result in plan; seeder refuses exi…
c54d83b 
…sting bases

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
base-ref-audit: registry rows live under "records"
98d761b 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: storage ledger (MotionMix classification, Mac4 archive job…
27dd7b4 
…) + registry snapshot mid batch 2

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
mac-worker evidence: capability v5 record + runner v3 observation, im…
96554dc 
…age r4 manifest, seal script; superseded request17/18 launchers kept as history (replaced by requests-1.4 attachments, review C2); authority-lane handoff

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: onboard.py re-reads the registry under flock before each w…
121b20f 
…rite-back (fixes the two-lane write race); storage ledger Mac5 batch 1 + archive job

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
app-fleet: per-record seed_branch for stale GitHub defaults; landing …
a2fc697 
…guide for seeded bases (MotionMix family)

motionmix reseeded from panel/lan-mirror-and-subset-recording (GitHub main is an
April line with no shared history). Trial replay of 17 lane commits onto the seed: clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: registry foundry_base for the MotionMix family (restored a…
560f57f 
…fter the batch-2 write race) + seed receipts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: registry after batch 2 (32 seeded; supervisor's 5 bases re…
eb338a3 
…-applied; nko-speech recorded)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
storage ledger: Mac4 and Mac5 archive-only jobs verified; HD2 job lau…
d83f762 
…nched

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
app-fleet: seeder records symlinks, tree limit lifted after gate M7 f…
cf52461 
…ix; port oid tree diff (same as hotfix 2ebf8fa)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: motionmixapp seeded from pre-direction trunk 096805f (trun…
5573ac9 
…k/build128-20261021)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: seed-fix-symlinks lands symlinks early seeds dropped into …
21abf2d 
….foundry/assets.json via the gate

Applied to motionmix (7), motionmix-ableton (5), sharedservices (1): all MERGE, forks deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: seeder withholds secrets (name + content rules, path/rule …
8778e5a 
…only in assets.json) and can seed from a local commit; base-secret-scan

Scan of 161 bases: 25 files in 18 bases (paths + rules in the receipt, no values).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: path-scoped seeds; comp-core seeded (echelon-live closure,…
7fb1e0f 
… 7 subtrees, local 17e34234, .env withheld)

Full Comp-Core is 6958 files / 161 MB text, past the merger's in-memory clone budget.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: F12 seeded-secrets finding classified (liveness-tested, ha…
6b03373 
…shes only); Mohamed's batch listed in the plan

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
app-fleet: lume-commerce seeded, stage scope (472 files; hardware/doc…
1945f36 
…s/unity/viz/stage-k11 left on GitHub)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
docs(app-fleet): landing guide lists motionmixapp, comp-core, lume-co…
2227a66 
…mmerce bases and path scopes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A2E8WZwbFhtyW7vas2k5UN
@Diomandeee @claude
app-fleet: registry after batch 3b, purges 1+2, orphan pass, batch 4;…
12a7693 
… second secret scan + classification in ledger

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
app-fleet: bwb orphan reseeded, batch 4b (milk-men-), scan 3 of resee…
da41f53 
…ded bases; storage ledger HD2 re-run

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
app-fleet: bwb scan clean; seed holds recorded (uctm-harness, meshcon…
fc6611c 
…trol, hyevo); plan next-steps refreshed

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
storage ledger: HD2 MotionMixLanding verified; lane B batch 1 totals
a951d39 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
storage ledger: lane B batch 2 (MotionMixData) archive-only launched …
e859d5d 
…on Mac1/Mac4/Mac5

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
storage ledger: sa3_motionmix recipes archived, audio delete staged a…
0c06cef 
…nd held for Mohamed's words

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SStkiqVHpPcVTNT2iarBBu
@Diomandeee @claude
participation-coordinator: v2 security core (review C1 closed in code)
509f72d 
Recovery needs a single-use grant (vouched by a bound device via
issue_recovery_grant, or issued through the operator route whose bearer the
server holds only as a sha256); the display-name lookup and the actor upsert are
gone, and the C1 kill switch with them. Device keys are insert-only, keyID must
equal sha256(pub), and a bearer may only introduce its own key. Admission needs
a server-issued invitation (create_invitation / revoke_invitation; only the
hash is stored; scopes, role, uses and expiry come from it); a guest with no
actor gets one at admission with the invited role. Membership is checked
against the authenticated principal and the stored device session. The handoff
exchange binds the full app's new key; resume requires a bound key. Organizer
objects need the organizer role. Every mutation writes audit_log. Expired
nonces, challenges and grants are collected hourly (scheduled handler).

Schema: migrations/0002_v2_security_core.sql (invitations, recovery_grants,
challenges.recovery_grant_id, join_attempts.invitation_id/device_key_id).
Tests: 53 unit (16 new in test/v2-security.test.ts); tools/coordinator-smoke.sh
runs client, flow, recover and admit over HTTP with the real issuer and the
operator route. WIRING.md §13 documents the v2 contract and the app changes
build 130 needs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@Diomandeee @claude
retire workers/participation-coordinator: the coordinator lives in it…
39f9147 
…s own Foundry base

The MotionMix participation coordinator moved on 2026-10-22 to the base
foundry-staging/participation-coordinator (seeded from this subtree at 509f72d; mirror
github.com/Diomandeee/participation-coordinator), where every change lands through the
gate and every deploy requires a MERGE decision for the SHA it ships. This subtree was
frozen at 509f72d and is removed so there is one source of truth. The lockfile drops
the workspace; the three docs that described the subtree now point at the base.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@Diomandeee
Diomandeee merged commit cbd88b2 into main Oct 23, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Diomandeee