2026-10-06 — full suite completion roadmap refreshed

Draft roadmap PR #79 contains the updated map and new visual. This dated snapshot supersedes older implementation/review-status prose below where it conflicts; historical receipts remain preserved.

• Full roadmap and remaining finish paths
• Zoomable diagram
• Editable Mermaid
• Snapshot and source evidence

All 80 original nodes are retained. The current map includes all 78 open issues, every issue created since September 27 in the inspected live collections, and relevant completed foundations: 143 issues / 65 NUKED, plus seven longer-term Optiflow horizons. NUKED means bounded issue completion, not universal qualification or release readiness.

Flow foundations and the read-only Optiflow adapter are merged. Renderflow publication foundations and release preparation are merged, but #419 has no published release. Optiflow #94/#112 are merged; #111 remains draft PR #122, before native qualification/release #93, PNG replacement #95 and low-space workflow #121. Aniflow's corpus, release preparation, multi-artifact/native audio and #97–#103 toolchain checkpoints are merged; #104 remains draft PR #105, #64 retains deferred qualification, and #10 is unpublished.

The finish paths distinguish the first usable integration candidate, stable audited suite, and full retained product backlog. #11 stays open and closes last with evidence and explicit owned deferrals. No product execution, merge or release occurred; CI and other deferred checks were not run.

2026-10-01 — #32 implementation authored in draft PR #65

Draft PR #65 contains the completed implementation pass. Head e40d0ba077d3bda068693d0f7519e786393d6b60, tree 1c11b5eae155eac2ccf62d880e22bbbe78326f3f, based on merged PR #63 at 1b1d8c778d9eac04bb1c1e2376ac577ef35537dc.

Exact rational source/frame/packet clocks, explicit input-global stream selection and discards, typed unsupported/refusal profiles, generated-media source-time bindings and selection-aware resume are implemented. New segment/manifest/reconstruction records use v2; legacy state without exact evidence is refused. Five schemas, 30 generator-first protocol fixtures, twelve contract tests and two native synthetic FFmpeg tests are authored. Temporal guide · Implementation receipt.

No local tests, build/compiler/check runs, formatting verification, strict lint, schema qualification, full smoke, docs/package checks or hosted CI polling ran, following the maintainer's explicit credit-saving direction. Formatting was applied as an editing action. Authored coverage is not passing evidence; check-related acceptance stays unqualified. #64 retains accumulated validation and the earlier hosted cancellation failure.

#32 remains open until the maintainer reviews and merges PR #65. Next: #33 — layered validation and evidence-rich delivery, then #34 → bounded #24 → #10 → flow #51. No dependent implementation, real-media operation, model download, paid API, merge, tag or release was performed. Earlier execution directions/handoffs below remain historical context.

2026-10-01 — #51 merged; implementation pass continues

PR #63 merged at 1b1d8c778d9eac04bb1c1e2376ac577ef35537dc after explicit maintainer authorization. #51 and parent #13 are closed. Their bounded implementation and recorded local synthetic qualification are complete. The maintainer accepted deferring the known hosted alignment cancellation failure and broader validation/polish; this is not a claim that hosted CI passed.

Aniflow #64 retains the CI failure, exact historical evidence and later cleanup obligations. Future implementation checkpoints should preserve/add useful tests, defer broad test/lint/smoke/package runs as requested, record what was not executed, and avoid claiming unobserved green results. Source-media safety and typed refusal behavior remain in force.

Next: aniflow #32, then #33 → #34 → bounded #24 → #10 → flow #51. No #32 implementation was started during this merge/closeout turn. Earlier draft handoffs below are historical.

Maintainer-directed later suite cleanup

After additional bounded implementation checkpoints, loop back for deep audits of flow, aniflow, optiflow and renderflow: accumulated unrun checks and regressions, CI failures, architecture/refactoring, documentation and actual artifact/delivery behavior. Use each owning repository's existing trackers or bounded follow-ups; retain exact tested/untested evidence and keep releases gated on actual qualification. The known aniflow cancellation CI failure is aniflow #64. Broad checks are intentionally deferred during the current implementation pass; no audit was performed by this handoff.

2026-10-01 UTC — aniflow #51 locally validated in draft PR #63

All implementation and final evidence are pushed to draft PR #63. Head 7c5d66dfa7e223c805b2400130995518e7bef0ef, tree ef47848220fc34afe4c8a76131d0659d58dd1807. The final commits change documentation/evidence only; validated implementation remains 70ef699ac681194efa768d72367e7b2a97b0068a, tree 0a3c7c6583d6cf7de98e25fd11ca312ec3bc8b87.

Final local receipt: 364 Rust tests, strict Clippy/formatting/naming, 35 independent conformance/tampering tests, 93 family schema tests, docs/package checks and the complete repository synthetic smoke passed. The integrated slice completed 28 cases across 11 runs, retaining 423 documents, 44 outputs and 20 upstream links. Independent validation checked 354 public-schema documents, 64 internal reports by digest/semantics, five private documents by digest and 260 nested public contracts; external Mido readback matched the two-note export. Actual Task argument checks and the checker against the final capture passed.

The 14-item original acceptance matrix, 148-fixture index, workflow guide and consumer handoff reconcile the bounded audio surface. Original CI wording remains traceable with an explicit local-check disposition; hosted CI is unverified. The earlier strict musical-output failure is retained in the checkpoint/history. Scratch synchronization is a supported inference about its extra temporary sibling, not a proven writer attribution; complete qualification passed in an unsynchronized workspace without changing production behavior, harness code or output assertions.

PR #63 stays draft at the user's request. #51 and parent #13 remain open until review and merge; no dependent work has started. Real-model inference/accuracy, native-platform/full-MSRV breadth, native dependency closure/OS isolation, hosted CI and releases remain unverified. Next: #32 → #33 → #34 → bounded #24 → #10 → flow #51. Historical handoffs below are superseded.

Concrete normalized-audio/Sonic DNA ingestion remains renderflow #397; the released adapter remains flow #51 after aniflow #10. This handoff adds no sibling implementation.

2026-09-29 UTC — aniflow #49 paused at completed checkpoint

Maintainer requested a pause; PR #61 has been returned to draft. All four checkpoints and final validation evidence are already pushed. Implementation and local checks are complete; resume with review and any requested fixes. No next-issue work has started.

This handoff supersedes earlier execution-status notes below. The maintainer merged aniflow PR #60 at 01130266cd2d6f52fca72e357e01a5a854ad540b; #48 is closed. Fresh main and #42/#43/#47 prerequisites were rechecked before branching.

Aniflow #49 is implemented in draft PR #61. Final head 71ef2170cda940c3b696f963c4736d62e75c1463, tree effc05c8aed511aa064838e03549aea0d168395f; local and remote trees match. Four recoverable checkpoints are pushed. The last commit adds evidence/roadmap documentation only; production code, schemas, tests and scripts remain at validated implementation 39c6da114a78071aa526a3e76bcc475f36f117fd, tree 9838f1c392657b19289fc8f4e58272301729907b.

The optional pinned PocketSphinx 5.1.1 English CPU profile proposes word/cue timing while retaining exact reviewed lyric JSON/text, supplied review provenance and revision identity. Missing/ambiguous mappings remain untimed and partial. Pipeline v3 lifecycle, bounded private staging and dependency rechecks, CLI/tasks, strict schemas and source-bound loss-aware exports are implemented. Forced alignment cannot prove words occur in audio; review assertions are not independently authenticated and timing remains unreviewed.

Exact local receipt: 328 Rust tests, 29 focused Rust 1.85.1 tests, strict Clippy/formatting/naming, twelve schema tests, 70 published contract documents, docs/package verification, complete repository smoke and five actual Task argument checks passed. All twelve final alignment smoke documents validate independently; eleven alignment scenarios passed. The unchanged optional musical analyzer was skipped (ANIFLOW_MUSICAL_PYTHON unset). The receipt records the initial inventory-order failure, native default-LM discovery correction and strict-Clippy correction; final checks cover them without weakened assertions or retries.

Actual PocketSphinx/model inference and alignment quality, especially singing, native macOS/other platforms, full MSRV, broader languages/profiles, native dependency closure/OS isolation, hosted CI, broader audits and release qualification remain unverified. Version is a caller declaration bound to an executable digest, not a native version probe. Independent review found no remaining material blocker within this bounded scope. Synthetic fixtures only; no real-media access/mutation, model downloads, paid APIs, hosted-CI polling, merge, tag or release.

Remain paused until the maintainer resumes review/merge of #61. #49 stays open until merge; parent aniflow #13 stays open through #51 reconciliation. #50 remains the next independently ready checkpoint; #51 requires #49 and #50. Downstream product order remains #13 → #32 → #33 → #34 → bounded #24 → #10 → flow #51. Provider audits and final release closeout remain later. Re-query live GitHub, repository instructions and fresh main before the next branch; older suite gate snapshots and the linked holistic graph remain historical context.

• Aniflow #48 is implemented in ready-for-review PR #60. Head 69390400423770122b40aa1dcb6243e130006305, tree 5bcd0e62b5faa08e11074e5e8039a006df9fb88e; local/remote trees match. Four recovery checkpoints are pushed. Merged base PR [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 is 0fa06979fe717505f0dc922bf34bc71125b285b4.
• Optional pinned whisper.cpp 1.8.7 / local tiny.en CPU English profile: mono 16 kHz PCM16, exact observed segment timing, explicit unavailable word timing/confidence, source/stem scope, bounded private staging and dependency checks, existing Pipeline v3 lifecycle, and source-bound loss-aware exports. No review authority is inferred.
• Exact local receipt: 299 Rust tests, 21 focused Rust 1.85.1 tests, strict Clippy/formatting/naming, eleven schema checks, 66 contract documents, docs/package verification and final serial repository smoke passed. All nine final captured transcription documents validate. Optional unchanged musical analyzer skipped. Earlier validation failures and follow-up results are recorded; no retry policy or weaker assertions added.
• Actual whisper/model inference/accuracy, native macOS/other platforms, full MSRV, actual Task, native dependency closure/OS isolation, broader profiles, hosted CI and release qualification remain unverified. Independent review found no remaining material blocker. Synthetic fixtures only; no real-media access/mutation, model downloads, paid APIs, hosted CI polling, merge, tag or release.
• Stop for maintainer review/merge of [FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence #60. Parent aniflow #13 remains open; [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48 stays unchecked there until merge. [FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49 alignment does not require [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48; [FLO-3.5] Integrate an immutable Optiflow release #50 MIDI remains independently ready. Neither has started. Downstream: Build cross-tool orchestration and failure fixture suites #13 → [FLO-13.5] Prove the static publication workflow with released providers #32 → [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → bounded [FLO-3.1] Bootstrap deterministic extension resolution and a hermetic execution seam #24 → [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 → flow [FLO-3.4] Integrate an immutable Aniflow release #51. Provider audits stay later.
• Suite state refreshed before this branch: only optiflow #113 was open; #114 had merged into its stacked branch, not main; #94/#112 remained open. #111 → #93 owns native macOS/APFS/disposable-volume qualification; #95 needs #93/#94. Renderflow #419 remained open; no renderflow/aniflow release existed, blocking flow [FLO-3.6] Integrate an immutable Renderflow release #52/[FLO-3.4] Integrate an immutable Aniflow release #51. Optiflow latest v0.1.1 was read-only with API immutable: false. Re-query these gates before the next branch rather than treating this timestamped snapshot as permanent state.

• Aniflow PR #59 is merged, merge commit 0fa06979fe717505f0dc922bf34bc71125b285b4; #47 is closed. Its local validation receipt and all unverified gates remain unchanged; merging is not release qualification.
• Next recommended issue: aniflow #48 — offline timestamped transcription. Its prerequisites [FLO-3.2e] Launch and supervise bounded provider processes #42, [FLO-3.2e] Launch and supervise bounded provider processes #43 and [FLO-13.2a] Establish the immutable hermetic provider package and success path #47 are closed with merged implementations. [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48–[FLO-3.4] Integrate an immutable Aniflow release #51 are open; no new implementation has started.
• Parent aniflow #13 was found closed with the [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 merge and has been reopened; [FLO-13.2a] Establish the immutable hermetic provider package and success path #47 is checked complete. The parent must remain open until [FLO-3.4] Integrate an immutable Aniflow release #51 reconciles the remaining checkpoints.
• [FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49 reviewed-lyrics alignment does not require [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48; [FLO-3.5] Integrate an immutable Optiflow release #50 MIDI candidates is independent. Use a ready independent lane if a provider/model gate blocks another. Downstream order remains aniflow Build cross-tool orchestration and failure fixture suites #13 → [FLO-13.5] Prove the static publication workflow with released providers #32 → [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → bounded [FLO-3.1] Bootstrap deterministic extension resolution and a hermetic execution seam #24 → [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 → flow [FLO-3.4] Integrate an immutable Aniflow release #51.
• Continue with one coherent issue per PR, an early draft and pushed recovery checkpoints. Synthetic fixtures only; no real-media mutation, implicit model downloads or paid APIs. Meaningful local checks; no hosted CI polling. The maintainer owns review and merge.
• This sync refreshed aniflow PR [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 and issues Build cross-tool orchestration and failure fixture suites #13/[FLO-3.2e] Launch and supervise bounded provider processes #42/[FLO-3.2e] Launch and supervise bounded provider processes #43/[FLO-13.2a] Establish the immutable hermetic provider package and success path #47–[FLO-3.4] Integrate an immutable Aniflow release #51. Other repository gates below were not re-queried in this sync and must be refreshed before implementation.

• aniflow [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46 / PR [FLO-13.2c.3] Execute deterministic single- and multi-provider composition fixtures #58 is merged, base main 8ec3488a6a4cea6085af0bfc47610c0f0ad2c72a. feat: freeze the federated extension contract #8, [FLO-3.2e] Launch and supervise bounded provider processes #42, [FLO-3.2e] Launch and supervise bounded provider processes #43, [FLO-13.2a] Establish the immutable hermetic provider package and success path #44, docs: checkpoint the 2026-09-22 flow-suite live sweep #55 and [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #45 are also merged. Parent #13 remains open.
• aniflow #47 is implemented in ready-for-review PR #59. Head f39ac2f991ca5f151013592d82a3d70a99981db8, tree cbf88a4862858c21cacd89a5308bdd5943e3a34f; local and remote trees match. Three checkpoints are pushed. Public bounded plain/LRC/SRT/WebVTT/TTML/JSON conversion preserves exact supplied timing, source identity and review provenance, requires explicit known-loss permissions, and publishes source-preserving new output packages with complete reports last.
• Local receipt: 276 Rust tests, 42 focused Rust 1.85.1 tests, strict Clippy/formatting/naming, eleven schema tests, 62 contract documents, docs/package verification and complete repository smoke passed. Eighteen timed-text CLI cases passed; all 44 final captured documents independently validate. Actual published example bytes/digests match the CLI. The optional unchanged musical analyzer was skipped. Native macOS, full MSRV, actual Task invocation, broader interoperability, power-loss/hostile-filesystem behavior, hosted CI and release qualification remain unverified.
• Independent review found no remaining material blocker. Synthetic fixtures only; no real-media access/mutation, model downloads, paid services, hosted CI polling, merge, tag or release.
• Stop for maintainer review/merge of [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 before [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48/[FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49. No dependent checkpoint has started. Alignment [FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49 does not require transcription [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48; [FLO-3.5] Integrate an immutable Optiflow release #50 remains independent. Downstream order: aniflow Build cross-tool orchestration and failure fixture suites #13 → [FLO-13.5] Prove the static publication workflow with released providers #32 → [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → bounded [FLO-3.1] Bootstrap deterministic extension resolution and a hermetic execution seam #24 → [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 → flow [FLO-3.4] Integrate an immutable Aniflow release #51. Provider audits stay later.
• Other live gates remain: optiflow #113 open; #114 merged into its stacked branch, not main, so #94/#112 remain open. #111 → #93 owns native macOS/APFS/disposable-volume qualification; #95 requires #93 and #94. Optiflow #115 is a separate naming issue after compatible relay [Distribution] Install a verified Flow suite with a flow command and independent providers #71 support is released/pinned. Renderflow #419 is open; no renderflow/aniflow release exists, so flow [FLO-3.6] Integrate an immutable Renderflow release #52/[FLO-3.4] Integrate an immutable Aniflow release #51 wait. Optiflow v0.1.1 remains read-only; GitHub reports immutable: false, so host-enforced immutability is not claimed.

• aniflow feat: freeze the federated extension contract #8 is implemented for review in PR #41, head 6d68dfcdd5ed2e7fdab53790289d1536896cecb1, tree 7430058530c5a456db37342da9bf621cecc9b51f. Two draft checkpoints were pushed before final validation; the final remote tree matches the local review tree. It adds a typed offline Demucs 4.0.1 / htdemucs_6s PCM WAV vocal/accompaniment provider through existing Pipeline v3 execution and checkpoints, plus canonical preparation/run/resume tasks, strict audio/provenance evidence and synthetic failure/recovery fixtures.
• Local evidence: Linux/Rust 1.94, 157 Rust tests, 18 Python tests, strict Clippy/formatting/naming/contracts, synthetic FFmpeg/CLI smoke, source-package compilation, and independent JSON Schema checks including 9 negative cases passed. Real Demucs/model inference, native macOS, Rust 1.85, OS-network-disabled real-model execution, Task binary execution and hosted CI remain unverified. No user media, downloads of models, tags, releases or merges.
• After maintainer merge and fresh dependency verification: aniflow Build cross-tool orchestration and failure fixture suites #13 → [FLO-13.5] Prove the static publication workflow with released providers #32 → [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → bounded [FLO-3.1] Bootstrap deterministic extension resolution and a hermetic execution seam #24 closeout → [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 → flow [FLO-3.4] Integrate an immutable Aniflow release #51. Stop before Build cross-tool orchestration and failure fixture suites #13 until [FLO-3.2d] Enforce authority and isolation profiles #41 merges. The generic public resume API needs a fresh external dependency check; the canonical audio task performs it. Synthetic conformance is not release qualification.
• Optiflow live merge truth: #114 is merged into the still-open #113 branch, not main. PR #113 now carries both fixture and #94 implementation changes into main and still awaits maintainer merge. #94/#112 are still open at this check; [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 remains the corpus umbrella. #111 → #93 remains the native macOS/APFS/disposable-volume gate; #95 still requires #93 and #94. Released v0.1.1 remains read-only.
• Independent release gates remain: renderflow #419 has no published release yet, so flow [FLO-3.6] Integrate an immutable Renderflow release #52 waits; aniflow [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 has no release yet, so flow [FLO-3.4] Integrate an immutable Aniflow release #51 waits. Flow [FLO-3.5] Integrate an immutable Optiflow release #50 is closed. Keep later adapters [Adapter] Orchestrate released Optiflow exact-dedup transactions with explicit authority #73/[Adapter] Consume released Optiflow lossless-PNG replacement profile #74 and provider audits / suite closeout behind their existing gates. Hosted CI was not polled.

• Flow #50 is implemented for review in PR #76, head 28a1fc0c0382e6b4a370857d9567d49a091abeaa, validated tree 4107f4495097e7b2113670ba89fa9eff738582dd. The direct-push fallback published a GitHub tree identical to the locally validated commit. The maintainer owns merge.
• It pins independently verified Optiflow v0.1.1 and exposes only scan, report, and exact-duplicate review planning through a public Flow library adapter. The native CLI result and committed member bytes are checked independently; a versioned local receipt persists attempt transitions. Dry-run, quarantine, restore, and finalization refuse as unsupported. The existing Flow JSONL and durable graph contracts are unchanged.
• Linux/Rust 1.85 validation: 189 tests passed, two existing subprocess entrypoints ignored; the 49 lifecycle recipes and 81 acceptance scenarios ran within the suite. The released-binary fixture passed on synthetic text and Unicode paths, and strict Clippy, formatting, repository validators, and a real receipt JSON Schema check passed. macOS native execution and hosted CI were not checked; no personal media was scanned.
• After [FLO-3.5] Integrate an immutable Optiflow release #50 merges, continue the parallel released-provider lanes #51 and #52 as their immutable releases qualify, then #53 suite CLI composition. #73 is the separate v0.2 mutation adapter after Optiflow #93/#111; it is not part of this read-only PR.

• 80 open issues at capture: Flow 30, Renderflow 28, Optiflow 7, Aniflow 15. The first installable suite converges on Flow [FLO-3.5] Integrate an immutable Optiflow release #50/[FLO-3.4] Integrate an immutable Aniflow release #51/[FLO-3.6] Integrate an immutable Renderflow release #52 → [FLO-3.7] Ship the supported Flow CLI and close the vertical slice #53/Implement a versioned cross-holon orchestration vertical slice #3 → [FLO-13.5] Prove the static publication workflow with released providers #32/[FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34/[Experience] Run supported Flow profiles on local files from a clean install #70/[Distribution] Install a verified Flow suite with a flow command and independent providers #71 → [Release] Harden and publish Flow's first immutable release #54; stable audited closeout is [Audit] Post-roadmap repository, backlog, and Identity audit #12 → [Release] Qualify a stable installable Flow suite after the provider and Flow audits #72. [EPIC] Establish suite-wide observability and CLI experience #14 requires an explicit release disposition. Renderflow #419 and Aniflow [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 are the missing immutable provider releases; Optiflow's signed read-only v0.1.1 is already available.
• Installability gaps now owned: #70 local-file use, #71 verified suite packaging and the flow executable, and #72 stable release after audits. The crates.io package name flow is occupied by an unrelated project; no claim of cargo install flow is valid. [Distribution] Install a verified Flow suite with a flow command and independent providers #71 owns a publishable package name and a verified independent-provider distribution path.
• Optiflow release truth corrected: PR #110 merged into main as 67439404c5b98da72d48d50c08c826dc99d0678c and auto-closed #93 despite explicitly shipping only qualification preparation. #93 is reopened; #111 owns the macOS/APFS mutation port before v0.2.0. The public v0.1.1 remains read-only; no v0.2.0 release exists.
• Later released capability consumers: Flow #73 for v0.2 exact dedup, #74 for v0.3 PNG, and #75 after Aniflow's music-video profile and its new #40 release. Renderflow #430/#406 feed Flow [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10. These optional extensions do not block the first Flow release.
• Work remains synthetic and permissioned. Do not infer user-media mutation authority from this planning update. Maintainer owns merges/releases; focused local validation is the current handoff preference, without waiting for hosted CI.

• Optiflow PR #108 merged as e50c3b206a243ce607d6863cca8b2423711cde2a; #92 is closed.
• Optiflow #96 is implemented for review in PR #109, head 6d9f41703de1c2b920de91eba96326175079b3ab, validated tree 422facfe8db0cdf33d13cab4bc0aa14933b6462b. It adds explicit, separately authorized Linux-only finalization of proven retained cross-filesystem quarantine copies, with immutable v4 pending/removed evidence and no physical-savings claim. The original source is never a finalization target; v0.1.1 remains immutable and read-only.
• Local validation: 251 Rust 1.85.1 tests passed, one existing stress test ignored, 32 PR-tier and 170 scheduled-tier corpus executions, strict Clippy/formatting, and 34 HTML documents. Synthetic fixtures only; no user media. Package tarball verification hit a local copied build-script permission error. Native macOS and hosted CI were not checked or polled.
• Maintainer owns PR #109 merge. After it merges and a fresh dependency check, the remaining Optiflow lane is #93, with #94 after the relevant [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 fixtures and #95 after #93/#94. Do not start #93 automatically.

• Optiflow PR #105 merged as 559a54676ad9223c0e7858d1dea1b5510c912049; #91 is closed. The bounded CI repair #106 merged through PR #107 as 85e8208c1105f591166ba7b4c5e40fd9dac09b05.
• Optiflow #92 is implemented for review in PR #108, head c2bb9478d9fb322c7e242e16852e3cc654b14e47, validated tree 097f639304e9a16ac9edca47898a65e018f866c3. It adds Linux-only operator status, bounded resume, collision-safe restore, and empty owned-namespace cleanup with append-only v3 evidence. Historical v2 mutations remain inspection-only; v0.1.1 remains immutable and read-only.
• Local validation: 245 Rust 1.85 tests passed, one scheduled stress test ignored, 32 PR-tier corpus executions, strict Clippy/formatting, package verification, and 35 HTML documents. Synthetic failure/recovery fixtures only; no user media. Native macOS and hosted CI were not checked or polled.
• Maintainer owns PR #108 merge. After it merges and a fresh dependency check, the remaining Optiflow lane is #96 → #93, with #94 after the relevant [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 fixtures and #95 after #93/#94. Do not start #96 automatically.

• Optiflow PR #104 merged as 437fc326c37fd91b4c9f84a67efd097a17c6f0c6; #90 is closed.
• Optiflow #91 is implemented for review in PR #105, head 89916aad203c79e9315494f4a5f6d4afadaaf9e2, tree b1705388d3a9bd900a6a8eca5251cefa852d3f0f. It adds Linux-only bounded quarantine with v2 mutation evidence, keeping v1 dry-run and immutable v0.1.1 release guarantees intact.
• Local validation: 234 Rust tests passed, one scheduled stress test ignored, 32 PR-tier filesystem corpus executions passed, strict Clippy/formatting passed, and 34 HTML documents built. Synthetic same/cross-filesystem mutation and interruption were exercised. Native macOS and hosted CI were not checked; no user media was touched.
• Maintainer owns PR #105 merge. After that merge and a fresh dependency check, the remaining Optiflow lane is #92 → #96 → #93, with #94 after the relevant [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 fixtures and #95 after #93/#94. Do not start #92 automatically.

Verified Flow checkpoint

• PR [FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence #60 merged on 2026-09-24 as
  c653c3667dd1879bd7009f83a4906ab6ae9ba832, completing the hermetic
  provider-kit closeout.
• [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30 is complete: PR test(flow): prove compatibility and provider acceptance scenarios #61 merged as dfb16b347975e3292dc2928c8c48463f51dcf6d1; default-branch CI passed. Its 81 scenarios run twice with normalized evidence on Rust 1.85 and stable.
• [FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49 is complete: PR feat(flow): persist versioned plans, checkpoints, and recovery decisions #63 merged as 711fbe3c19c0e080ab6c67b74d7945cd29675a74; default-branch CI passed all five jobs. PRs [FLO-13.2a] Establish the immutable hermetic provider package and success path #47/[FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48 and issues [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46/[FLO-13.2] Build the hermetic orchestration provider kit #29/[FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30 are also complete.
• [FLO-13.4a] Revalidate dependency graphs before durable resume and execution #64 is complete: PR #67 merged as 83f1ea161aa5aba03da5de6b287005252000cd4b; main CI passed. It supplies fresh graph assessment and safe dependent execution, with eight graph regressions plus the existing 81 acceptance scenarios twice per toolchain.
• [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 is complete: PR #68 merged as 6db839facc822707e9e3a9d74dda044faac77fe7.
• [FLO-13.4c] Prove authority, duplicate-effect prevention, and recovery residuals #66 and parent [FLO-13.4] Prove interruption, retry, resume, and authority state transitions #31 are complete: PR #69 merged as 5416e8d4a9da2d0a986fe3aa59b6d2868d998eed; both issues are closed. Fifteen authority/effect/recovery-residual recipes brought the durable lifecycle corpus to 49, each exercised twice. Local validation retains the precise evidence. Build cross-tool orchestration and failure fixture suites #13 and FLO-Q03 remain open for real released-provider proofs.
• Optiflow #88 is complete: PR #101 merged as ddc4b010caf5ad51c3d3f4b04e6b967a87ff8eea; #88 is closed. Its filesystem/path/state/volume corpus remains the foundation, and Optiflow [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 remains open for later media/provider/perceptual/candidate families.
• Optiflow #89 is complete: v0.1.1 from b82599a2231e997d42fd9f26f4b59587f4ae14cf. Release run 36264382086 passed all eight jobs, including all 39 native pilot scenarios. Independent bundle signature/checksum/provenance/receipt checks and a fresh Linux install/scan/plan trial passed. Evidence was merged through docs closeout PR #103 as b0caef9d3b360302653c77a34ac5ff60fd055b81; #89 is closed.
• Optiflow #90 is ready for review: PR #104, head f4afb4e175c372b17c191b54c48c615779fe70ea, adds explicit execution selections, fingerprint-bound approvals and a fully non-mutating dry run with durable validation/recovery evidence. Local validation: 229 tests, 32 corpus executions, strict Clippy/formatting and 33-page docs build passed. Source mutation remains disabled. #90 closes on maintainer merge; #91 is next afterward.
• Handoff preference, 2026-09-26: the maintainer supersedes older CI-wait instructions. Hand back each bounded PR after focused local checks; do not wait for hosted/default-branch CI, and record unverified results honestly. Hosted and macOS/Windows results were not checked in this handoff. Maintainer owns merges; no automatic merges.
• Current Optiflow lane: #88 and #89 are complete; v0.1.1 is published/verified. Review and merge #90's PR #104, then #91 → #92 → #96 → #93, followed by #94 → #95. Re-query dependencies before beginning the next checkpoint; no automatic merges or ordinary hosted-CI polling.
• The central orchestration sequence is:
  [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30 → [FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49 → [FLO-13.4] Prove interruption, retry, resume, and authority state transitions #31 → provider adapters ([FLO-3.5] Integrate an immutable Optiflow release #50/[FLO-3.6] Integrate an immutable Renderflow release #52/[FLO-3.4] Integrate an immutable Aniflow release #51 as immutable releases
  permit) → [FLO-3.7] Ship the supported Flow CLI and close the vertical slice #53 / reconcile Implement a versioned cross-holon orchestration vertical slice #3 → [FLO-13.5] Prove the static publication workflow with released providers #32 and [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → [Release] Harden and publish Flow's first immutable release #54.
• [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 is the exhaustive comic/localization application lane. It consumes the
  maturing orchestration and Renderflow localization capabilities but is not
  silently added as a prerequisite to [Release] Harden and publish Flow's first immutable release #54.
• Observability [FLO-OBS-01] Define the suite observability, privacy, and stream contract #15–[FLO-OBS-08] Add accessible branded root-help presentation #22 remains a parallel/later lane; [Release] Harden and publish Flow's first immutable release #54 requires an explicit
  disposition for the remaining [EPIC] Establish suite-wide observability and CLI experience #14 scope.

Later documentation

• #62 — Visualize supported scenarios and their verification evidence: add a browsable scenario gallery/matrix, representative diagrams, plain-language outcomes, and links to canonical verification evidence. Build on [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30 / PR test(flow): prove compatibility and provider acceptance scenarios #61; distinguish synthetic coverage from real-provider support. This later documentation lane does not block [FLO-3.3] Persist versioned plans, runs, checkpoints, and recovery decisions #49, [FLO-13.4] Prove interruption, retry, resume, and authority state transitions #31, or the central execution sequence.

Provider lanes feeding Flow

• Optiflow: #88 → #89 → #90 → #91 → #92 → #96 → #93. The immutable
  read-only #89 release can feed the first Flow [FLO-3.5] Integrate an immutable Optiflow release #50 adapter; mutation-capable
  integration must wait for the separately proven #93 contract. #94 follows
  relevant [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 fixtures; #95 joins #93 + #94.
• Renderflow: #415 → (#416 and #417) → #418 → #419 → Flow [FLO-3.6] Integrate an immutable Renderflow release #52. #406 is the
  parallel/later localization lane; #412/#413 are downstream corpus consumers,
  not blockers for the first production exporters.
• Aniflow: feat: freeze the federated extension contract #8 → Build cross-tool orchestration and failure fixture suites #13 → [FLO-13.5] Prove the static publication workflow with released providers #32 → [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → bounded [FLO-3.1] Bootstrap deterministic extension resolution and a hermetic execution seam #24 closeout → [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10 →
  Flow [FLO-3.4] Integrate an immutable Aniflow release #51.
• Creative artifact forest: Renderflow #421 coordinates #422–#430. Its #430
  release/handoff feeds Flow [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10's richer orientation-everything workload with
  screenplay, recovery, timed-text, and speech-transcript derivatives. This lane
  is parallel/later and does not block Renderflow #419, Flow [FLO-3.6] Integrate an immutable Renderflow release #52, or Flow's first
  immutable integration release.

The hermetic Flow #31 lane is complete. Optiflow's signed v0.1.1 is published and independently verified. PR #103 is merged and #89 is closed. #90 awaits maintainer review/merge in PR #104; #91 follows that merge. #88 / PR #101 is complete. Renderflow #415 and Aniflow #8 remain recorded ready fronts; re-query their live dependencies before starting provider work.

The 2026-09-26 sweep found no open provider PRs and no Renderflow or Aniflow releases; Optiflow had only v0.1.0 at that historical sweep. Its verified v0.1.1 release now supersedes that release snapshot. Renderflow main a2baa082850a323bb8c0c3cbe14a712eb861be9c has green CI. Optiflow main cc9b4aff492e340220dabcba1fc5242a74e035c6 has failing CI, and Aniflow main 8a88b0e96c2ac89da9b26b579300e84aa80aa762 has failing CI. These are historical hosted-CI observations. The maintainer's focused-local-check preference above supersedes waiting on those runs.

Suite closeout

After the active provider/product lanes and Flow integration/release work,
perform provider post-roadmap audits (Optiflow #61, Renderflow #409, Aniflow
#17) before the final suite-level Flow audit #12. Audit findings should become
bounded remediation issues rather than silently expanding an in-progress
feature issue.

Verified live Flow state

• main remains 3d854c79756b1dee5d3ca267a08ae27b76673a4b, with default-branch CI run 35633394688 green.
• Draft PR #47 closes #44. It is green and mergeable, and remains intentionally unmerged for maintainer review.
• Draft PR #48 closes #45. It is stacked on PR [FLO-13.2a] Establish the immutable hermetic provider package and success path #47, green, mergeable, and remains intentionally unmerged for maintainer review.
• #46 is next after those reviews and PR [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48's retargeting to main following PR [FLO-13.2a] Establish the immutable hermetic provider package and success path #47's merge.
• This sweep changed roadmap issue surfaces only. It made no code changes and merged or modified no pull request.

Current Flow execution order

1. Review and merge PR [FLO-13.2a] Establish the immutable hermetic provider package and success path #47 / close [FLO-13.2a] Establish the immutable hermetic provider package and success path #44.
2. Retarget, review, and merge PR [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #48 / close [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #45.
3. Complete [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46, then reconcile and close parent #29.
4. Complete #30.
5. Complete #49, the durable plan/run/checkpoint-state foundation.
6. Complete #31.
7. Integrate released providers as immutable artifacts permit: #50 Optiflow, #52 Renderflow, then #51 Aniflow. Exact readiness may allow independent adapter work without changing their ownership boundaries.
8. Complete #53 and reconcile/close #3.
9. Complete #32, then #33, #34, and #10.
10. Complete #54, Flow's first immutable integration-candidate release.
11. The observability sequence #15 through #22 remains a parallel or later lane where dependencies permit; reconcile parent #14 before final release disposition.

Provider priority lanes

• Optiflow: #87 → #88 → #89, then #90 → #91 → #92 → #96 → #93.
• Renderflow: #415 → (#416, #417) → #418 → #419.
• Aniflow: #8 → #13 → #32 → #33 → #34 → #24 → #10.

Flow Suite Completion Roadmap

Active checkpoint

• Current item: Sync checkpoint after completed Step 6; flow#29, the hermetic orchestration provider kit, is next but has not started.
• Step 6 merge: PR #43 merged review head 6615287a9e57e6b381c298da6b98efd3b775e03f as 3d854c79756b1dee5d3ca267a08ae27b76673a4b. PR CI run 35632038827 and merged-main CI run 35633394688 are green.
• State: Step 6 is complete. Issue [FLO-3.2e] Launch and supervise bounded provider processes #42 is closed, parent [FLO-3.2] Specify external process transport and provider trust boundaries #25 is closed as completed with all acceptance criteria reconciled, main is green, and there are no open suite pull requests.
• Verified base: Flow main is 3d854c79756b1dee5d3ca267a08ae27b76673a4b, with default-branch CI run 35633394688 green on Rust 1.85.0, stable Rust, and all repository validators.
• Step 5 evidence: PR [FLO-3.2d] Enforce authority and isolation profiles #41 merged from review head e179f8257c8cf9f79409ae892725b447eb85ec48; PR CI run 35608819734 is green.
• Step 6 result: the exact locked executable is freshly re-observed and launched directly with scrubbed process state, opaque authorized secrets, independently bounded streams, timeout/cancellation grace and escalation, direct-child reaping, and the existing Flow acceptance gates.
• Claim boundary: the initial local runner may execute only explicit trusted-unconfined authorization. It must reject sandboxed profiles until a real enforcing backend exists and must not claim containment, publisher authenticity, or accepted artifacts from launch or exit alone.
• Deferred: durable run/checkpoint state, real provider adapters, provider-native artifact validation, and public product CLI.
• Next action: sync with the maintainer at this completed checkpoint. After explicit approval, start Flow [FLO-13.2] Build the hermetic orchestration provider kit #29 on one clean issue-specific branch and stop at one green review PR; do not merge it automatically.
• Invariant: one issue and review PR at a time; do not merge automatically.

Execution protocol

1. Re-query default-branch SHA, CI, open PRs, issue state, releases, repository instructions, and external gates before each branch.
2. Work on exactly one bounded issue at a time, on a clean issue-specific branch.
3. Record diagnosis, before/after evidence, validation, residual risk, and rollback in the PR.
4. Open the PR for review and stop; the maintainer decides when to merge.
5. After merge or disposition, update this body: check the inventory item, update the active checkpoint, and advance the strict next-up queue.
6. If live evidence invalidates an ordering assumption, update this epic explicitly before implementing the changed order.

Live open-issue inventory

Live re-query: 2026-09-21 after Step 6 merged and parent #25 closed. Flow has 21 open issues and no open pull requests. Across Flow, Aniflow, Optiflow, and Renderflow there are 41 open issues and no open pull requests. Re-query live state again before starting #29 because repository state can change.

Flow — 21 open

• flow#3 — Implement a versioned cross-holon orchestration vertical slice
• flow#9 — Backfill repository ADR history and enable continuous decision capture
• flow#10 — [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows
• flow#11 — [EPIC] Finish the flow suite and prove production-ready orchestration
• flow#12 — [Audit] Post-roadmap repository, backlog, and Identity audit
• flow#13 — Build cross-tool orchestration and failure fixture suites
• flow#14 — [EPIC] Establish suite-wide observability and CLI experience
• flow#15 — [FLO-OBS-01] Define the suite observability, privacy, and stream contract
• flow#16 — [FLO-OBS-02] Prove the observability profile in two holon CLIs
• flow#17 — [FLO-OBS-03] Prove opt-in OpenTelemetry logs, metrics, and traces
• flow#18 — [FLO-OBS-04] Decide shared observability crate and repository ownership
• flow#19 — [FLO-OBS-05] Build the selected reusable observability package
• flow#20 — [FLO-OBS-06] Migrate the suite and enforce observability conformance
• flow#21 — [FLO-OBS-07] Add privacy-safe diagnostics and operator runbooks
• flow#22 — [FLO-OBS-08] Add accessible branded root-help presentation
• flow#29 — [FLO-13.2] Build the hermetic orchestration provider kit
• flow#30 — [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios
• flow#31 — [FLO-13.4] Prove interruption, retry, resume, and authority state transitions
• flow#32 — [FLO-13.5] Prove the static publication workflow with released providers
• flow#33 — [FLO-13.6] Prove the temporal release workflow with released providers
• flow#34 — [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion

Renderflow — 11 open

• renderflow#349 — Evaluate repository briefings and podcast derivatives from canonical content
• renderflow#350 — Add a Slidev-backed product presentation publication profile
• renderflow#367 — Roadmap: universal artifact forest, maximal Renderflow profile, and Flow orchestration readiness
• renderflow#378 — 🤖 Add Medium-style article Copilot agent for generation and polishing
• renderflow#379 — 📝 Add long-form editorial article template/profile paired with the Medium-style Copilot agent
• renderflow#397 — Add Sonic DNA normalization and semantic audio descriptions
• renderflow#405 — Backfill repository ADR history and enable continuous decision capture
• renderflow#406 — [Publication] Add localization-ready layered page composition and locale render targets
• renderflow#409 — [Audit] Post-roadmap repository, backlog, and Identity audit
• renderflow#412 — Build a comprehensive adversarial rendering fixture corpus
• renderflow#413 — Add a synthetic comic fixture and reusable document-type fixture packs

Optiflow — 3 open

• optiflow#60 — Backfill repository ADR history and enable continuous decision capture
• optiflow#61 — [Audit] Post-roadmap repository, backlog, and Identity audit
• optiflow#65 — Build a deterministic adversarial file and media corpus

Aniflow — 6 open

• aniflow#8 — Add an offline-first Demucs vocal-stem separation workflow
• aniflow#10 — ci(releases): pilot the Rust CLI and binary release convention
• aniflow#13 — Add typed audio feature, lyrics, and MIDI extraction
• aniflow#14 — Backfill repository ADR history and enable continuous decision capture
• aniflow#17 — [Audit] Post-roadmap repository, backlog, and Identity audit
• aniflow#24 — Build a deterministic adversarial temporal-media corpus

Repositories: flow, renderflow, optiflow, and aniflow
Snapshot: 2026-09-20
Suite coordinator: flow#11
Execution model: one bounded issue, branch, and reviewable pull request at a time; re-query live state before every branch.

Executive conclusion

The suite is much closer than the raw backlog suggests.

• The provider architecture is substantially implemented. Aniflow's provider/runtime/Pipeline v3 sequence has landed, Optiflow's safe extension boundary and read-only product are mature, and Renderflow's universal artifact foundation is broad.
• The true critical path is now Flow's production process boundary, durable run state, released-provider adapters, and two clean-room end-to-end proofs.
• The largest polish gap is release truth: Optiflow is the only repository with a GitHub release. Flow, Renderflow, and Aniflow advertise package versions in source but have no GitHub releases.
• The immediate default-branch truth blocker is resolved: Optiflow PR #86 preserved every budget, added inspectable three-trial sampling, and all six workflows are green on merged main 7de8483b64387542a05214004c19a9cd05628908.
• Several issue bodies and repository roadmaps are stale relative to merged work. They must be reconciled as work proceeds so the roadmap, README, release, and CI surfaces report the same reality.

The recommended finish line is a polished suite v1, not “every future idea implemented forever”:

1. Each holon is independently installable, documented, tested, and releasable from immutable artifacts.
2. Public CLI/provider/artifact contracts are versioned and compatibility-tested without sibling source coupling.
3. Flow can inspect, plan, execute, validate, explain, interrupt, retry, and resume real multi-holon work.
4. One static-publication workflow and one temporal-media workflow pass positive and negative clean-room suites.
5. Corpora, observability, diagnostics, security, provenance, sites, and release metadata tell the same truth.
6. Every current issue is shipped, evidence-closed, superseded, or assigned explicitly to a named post-v1 milestone.
7. Provider audits run first, Flow's suite audit runs last, remediation lands, and final stable releases are smoke-tested from clean hosts.

Optiflow may truthfully reach this suite finish line as a polished, stable, read-only intelligence and planning product. Its future transactional mutation and replacement milestones remain visible post-v1 work and do not block Flow's first production-ready orchestration release.

Live baseline

The suite-wide re-query after Step 6 records 41 open issues: Flow 21, Renderflow 11, Optiflow 3, and Aniflow 6. All four repositories currently have no open pull requests. Re-query again before the next branch.

Additional repository-level polish gap: none of the four repositories currently exposes branch protection or a repository ruleset for main. Required-check enforcement belongs in the release/governance closeout, not in feature PRs.

Dependency shape

flowchart TD
    A["Restore live truth"] --> B["Finish Flow process boundary"]
    B --> C["Prove hermetic state and failures"]
    C --> D["Finish provider capabilities and corpora"]
    D --> E["Publish integration-candidate releases"]
    E --> F["Prove real static and temporal workflows"]
    F --> G["Observability, governance, and audits"]
    G --> H["Final stable suite releases"]

Ordered execution roadmap

Wave 0 — Restore and reconcile repository truth

This wave is mandatory. No later phase should call the suite stable while a default branch is red or roadmaps describe already-merged work as pending.

1. Completed optiflow#85 through merged PR #86.

   • Diagnosis: the failed run showed whole-host contention across discovery, cold hashing, and warm hashing rather than a discovery-only code regression.
   • Repair: three independent trials, correctness checks in every trial, raw samples, median wall time, and worst-case artifact/RSS enforcement without raising a budget.
   • Exit evidence: #85 is closed; merged main is 7de8483b64387542a05214004c19a9cd05628908; all six default-branch workflows are green.

2. Completed aniflow#11 through merged PR #31.

   • Children #18, #20, [FLO-OBS-08] Add accessible branded root-help presentation #22, [FLO-3.2] Specify external process transport and provider trust boundaries #25, #27, and [FLO-13.2] Build the hermetic orchestration provider kit #29 are closed.
   • The parent checklist and ANI-Q03 now reflect the landed sequence while quotas, release, corpus, and broader provider work remain explicit follow-ups.
   • Exit evidence: [EPIC] Finish the flow suite and prove production-ready orchestration #11 is closed; merge commit 47c9798e78fd9a268e4584974948a11e81d9e7bb; all four PR jobs were green.

3. Refresh the authoritative status ledgers without creating a documentation mega-PR.

   • flow#11: mark delivered Wave 0/1 work and Flow #28 accurately; preserve open product gates.
   • renderflow#367: record the green main repair plus #406/#412/#413 in the remaining map.
   • Flow ROADMAP.md: #28 is merged, not a candidate gate.
   • Renderflow ROADMAP.md: current main is green; release remains absent.
   • Aniflow ROADMAP.md: provider conformance has landed; release remains absent.
   • Optiflow ROADMAP.md: keep the read-only v0.1 boundary and record post-release capability drift; #85 is complete and current main is green.

4. Create the missing bounded child issues listed under “Issue creation needed.” This preserves the one-issue/one-PR protocol and prevents Flow [FLO-3.2] Specify external process transport and provider trust boundaries #25 or Implement a versioned cross-holon orchestration vertical slice #3 from becoming mega-PRs.

Wave 1 — Complete Flow's external-process trust boundary

flow#25 is closed as completed. Its framing and trust boundaries were delivered as separate children in this order:

1. Complete — FLO-3.2b through merged PR #37: validate artifact bindings and host observations.

   • Immutable input/output bindings, root-relative locators, deterministic file/directory identity, and exact host/provider correlation are merged.
   • Exit evidence: merge commit 55341605968d3343e74d8bdd2b188c99a855aca0; PR CI run 35545386170 and main CI run 35546410096 are green.

2. Complete — FLO-3.2c through merged PR #39: verify locked packages and executable subjects.

   • Closed v1 contracts and an opaque match token keep digest observation, lock equality, cryptographic verification, publisher declaration, operator trust, and transparency status distinct.
   • Fresh package and executable observations must exactly match the lock before request encoding or transcript validation.
   • Merge commit 9cbe58eff5174faa9511a64211e8119e5c7bda6d; PR CI run 35557639881 and main CI run 35558851556 are green.

3. Complete — FLO-3.2d via merged PR #41: enforce authority and isolation profiles.

   • Separate requested effects, granted permissions, and host-enforced guarantees.
   • Explicit allowlists for argv, environment handles, filesystem, network, subprocess, GPU, publication, signing, and telemetry propagation.
   • A requested sandbox profile must fail closed when the host cannot prove it.

4. Complete — FLO-3.2e through merged PR #43: launch and supervise bounded provider processes.

   • Direct executable-plus-argv invocation; no shell strings.
   • Timeout, cancellation, grace, direct-child termination/reaping, output/frame limits, cleanup, redacted evidence, and Unix conformance.
   • Exit zero and file existence remain insufficient for acceptance.
   • Exit evidence: merge commit 3d854c79756b1dee5d3ca267a08ae27b76673a4b; PR CI run 35632038827 and main CI run 35633394688 are green.

5. Complete — reconcile and close flow#25.

   • All 12 parent acceptance criteria are checked.
   • Rust 1.85, stable Rust, contract, hermetic, package, architecture, skill, and agent validation are recorded green.
   • Residual non-goals remain explicit: no sandbox, authenticated enforcement, descriptor-bound launch, process-tree containment, durable state, real adapters, or public product CLI.

Wave 2 — Build the hermetic orchestration kernel and durable lifecycle

1. Complete flow#29: hermetic orchestration provider kit.
2. Complete flow#30: compatibility, artifact, diagnostics, and provider-failure matrix.
3. Create and complete FLO-3.3 — Persist durable plan, run, checkpoint, and provenance state under flow#3.
   • Atomic state transitions, immutable references, exact configuration/provider locks, accepted artifacts, partial results, and content-aware invalidation.
   • State is authoritative; telemetry is not.
4. Complete flow#31: interruption, retry, resume, and authority state-transition proof.
5. Keep flow#3 open until the released-provider adapters and real vertical slice in Wave 6 land.

Wave 3 — Finish provider capabilities required by the product proofs

These issues are provider-owned and may be implemented independently after their own live baselines are green. The following is the preferred sequential order.

1. Complete renderflow#406: localization-ready layered page composition and deterministic locale targets.
2. Complete aniflow#8: offline-first Demucs vocals/accompaniment separation.
3. Complete aniflow#13: typed technical, musical, lyrics/timed-text, and MIDI analysis artifacts.
4. Complete renderflow#397: Sonic DNA normalization and semantic audio description, consuming Aniflow evidence without source coupling.
5. Create and complete Aniflow's already-documented stream-aware temporal correctness issue.
   • Rational time, CFR/VFR, timestamps, stream identity/selection, synchronization, and explicit multi-stream support/refusal.
6. Create and complete Aniflow's already-documented layered validation and evidence-rich delivery issue.
   • Component, intermediate, candidate-master, and delivery validation; success only after structural, timing, synchronization, decodability, and checksum gates.
7. Create and complete Aniflow's already-documented content-addressed reuse and operational controls issue.
   • Cross-run reuse, targeted reruns, invalidation, cache inspection/pruning, storage preflight, retention, and concurrent-writer safety.

Wave 4 — Complete deterministic provider corpora and Renderflow's current product queue

1. Complete aniflow#24, preferably through bounded children:
   • timing/container/stream families;
   • runtime/provider/cancellation failures;
   • audio and timed-text families after feat: freeze the federated extension contract #8/Build cross-tool orchestration and failure fixture suites #13;
   • final drift, coverage, and CI-tier reconciliation.
2. Complete optiflow#65: deterministic adversarial file/media corpus.
3. Complete renderflow#412 through bounded corpus families rather than one enormous PR.
4. Complete renderflow#413: original synthetic comic plus the reusable document-type fixture-pack convention. Use #406 for layered/localized coverage where applicable.
5. Complete renderflow#378, then renderflow#379: agent/content contract first, canonical long-form profile second.
6. Complete renderflow#350: Slidev-backed presentation profile.
7. Complete renderflow#349: evidence-backed repository briefing/podcast derivative, after Aniflow audio evidence is available.
8. Keep renderflow#367 open until Flow's real integration proof and release closeout are complete.

Wave 5 — Publish integration-candidate provider releases

Flow's real-provider tests should consume immutable release artifacts, not mutable main branches or sibling worktrees.

1. Complete aniflow#10 after its remaining external dependency, egolint#29, is complete and reverified.
2. Create and complete “Publish the first verified Renderflow release.”
   • Resolve README/package promises against actual supported channels.
   • Produce checksums, provenance, SBOM/notices, clean-install tests, rollback guidance, and artifact smoke tests.
3. Create and complete “Publish the current Optiflow read-only contract release and freeze the v1 scope.”
   • Restore green main first.
   • Decide and document whether the next tag is a compatible 0.1.x, a pre-v1 minor, or the read-only v1 candidate.
   • Keep candidate production and source mutation outside this release unless separately approved and fully recoverable.
4. Record exact provider versions, schemas, capabilities, required tools, effects, and compatibility results in Flow's capability matrix.

Wave 6 — Implement real Flow adapters and close the orchestration proof

Create these bounded children under flow#3:

1. FLO-3.4 — Integrate an immutable Aniflow release.
2. FLO-3.5 — Integrate an immutable Optiflow release.
3. FLO-3.6 — Integrate an immutable Renderflow release.
4. FLO-3.7 — Ship the first supported flow doctor, inspect, plan, run, status, and resume experience.
5. Close flow#3 only when a real inspect → plan → transform → validate slice proves persisted state, immutable artifacts, explanation, interruption, and deterministic resume while every provider remains independently usable.
6. Complete flow#32: static publication proof with immutable Renderflow and Optiflow artifacts.
7. Complete flow#33: temporal release proof with immutable Aniflow and Renderflow artifacts, with Optiflow only where semantically appropriate.
8. Complete flow#34: clean-room compatibility matrix, CI tiers, coverage claims, and regression promotion.
9. Reconcile and close flow#13.
10. Complete flow#10: generic exhaustive comic finalization/localization/publication orchestration. Ordinary fixtures remain synthetic and redistribution-safe; the private Orientation profile is opt-in and consumer-owned.
11. Reconcile and close renderflow#367 after its remaining profiles, maximal artifact proof, and Flow evidence are linked.

Wave 7 — Establish suite-wide observability and CLI polish

Execute the children of flow#14 in dependency order:

1. flow#15: normative observability, privacy, correlation, and stream contract.
2. flow#16: prove the profile in Renderflow and Aniflow through repository-owned PRs.
3. flow#17: opt-in OpenTelemetry logs, metrics, traces, and bounded cross-process propagation.
4. flow#18: evidence-backed ownership/packaging ADR.
5. flow#19: conditional shared package only if #18 selects it; otherwise close or reshape with decision evidence.
6. flow#20: migrate all four holons and enforce conformance.
7. flow#21: privacy-safe diagnostic bundles and operator runbooks.
8. flow#22: accessible branded root-help presentation, without contaminating machine output.
9. Reconcile and close flow#14.

Wave 8 — Release-candidate and governance convergence

1. Create one release-hardening issue in each repository that does not already have an adequate owner. Each must prove:
   • clean installation from immutable artifacts on every supported platform;
   • version/help/completion/manual consistency;
   • checksums, provenance, SBOM, notices, and rollback;
   • schema/CLI compatibility policy and migration fixtures;
   • docs, site, repository metadata, and binary version agreement.
2. Create one suite-governance issue, preferably in egohygiene/.github and linked from Flow [EPIC] Finish the flow suite and prove production-ready orchestration #11, to enable repository rulesets/branch protection and required checks for all four main branches.
3. Execute the gated ADR backfills only after all live external prerequisites are satisfied:
   • optiflow#60
   • aniflow#14
   • renderflow#405
   • flow#9

As of this snapshot, Hygiene #15, Holon #6, and Relay #30 are complete; Relay #5, Relay #27, Relay #33, and Pace #5 remain open. Those external gates must not deadlock independent product work.

Wave 9 — Provider-first audits, remediation, and final stable releases

Run the deferred audit issues only after the active roadmap and release-candidate sequence is complete:

1. aniflow#17
2. optiflow#61
3. renderflow#409
4. flow#12 last, so it can reconcile the provider audits and the full suite.

Each audit PR records evidence and creates bounded remediation issues; it does not mix fixes into the audit. Execute resulting issues in this order:

1. data-loss, corruption, authority, privacy, security, or false-evidence risks;
2. contract, compatibility, recovery, and reproducibility gaps;
3. release/install/site/version drift;
4. accessibility, identity, onboarding, and presentation polish;
5. optional convenience improvements.

Then:

1. run clean-room installation and positive/negative workflows exclusively from immutable release candidates;
2. publish the final stable versions of all four tools;
3. publish the suite compatibility table and rollback guide;
4. confirm required checks/rulesets on all four default branches;
5. close the remaining child/parent issues with exact evidence;
6. close flow#11 with one final completion report linking commits, releases, workflows, corpora, docs/sites, and intentional post-v1 deferrals.

Strict next-up queue

For one-issue-at-a-time execution, the immediate queue is:

1. COMPLETE — optiflow#85 / merged optiflow#86: performance-budget/main repair
2. COMPLETE — aniflow#11 / merged aniflow#31: provider SDK roadmap reconciliation
3. COMPLETE — flow#36 / merged flow#37: FLO-3.2b artifact binding and host acceptance
4. COMPLETE — flow#38 / merged flow#39: FLO-3.2c package/executable integrity
5. COMPLETE — flow#40 / merged flow#41: FLO-3.2d authority/isolation profiles
6. COMPLETE — flow#42 / merged flow#43: FLO-3.2e bounded process runner
7. COMPLETE — Close Flow [FLO-3.2] Specify external process transport and provider trust boundaries #25
8. NEXT — Flow [FLO-13.2] Build the hermetic orchestration provider kit #29
9. Flow [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30
10. NEW Flow FLO-3.3 durable state
11. Flow [FLO-13.4] Prove interruption, retry, resume, and authority state transitions #31
12. Renderflow #406
13. Aniflow feat: freeze the federated extension contract #8
14. Aniflow Build cross-tool orchestration and failure fixture suites #13
15. Renderflow #397
16. Provider v1-hardening issues and corpora from Waves 3–4
17. Provider integration-candidate releases
18. Flow real adapters and Implement a versioned cross-holon orchestration vertical slice #3 closeout
19. Flow [FLO-13.5] Prove the static publication workflow with released providers #32 → [FLO-13.6] Prove the temporal release workflow with released providers #33 → [FLO-13.7] Add clean-room compatibility, CI tiers, and regression promotion #34 → [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10
20. Renderflow remaining profiles and #367 closeout
21. Flow observability [FLO-OBS-01] Define the suite observability, privacy, and stream contract #15 → [FLO-OBS-08] Add accessible branded root-help presentation #22 and [EPIC] Establish suite-wide observability and CLI experience #14 closeout
22. ADR convergence when externally unblocked
23. Aniflow [FLO-OBS-03] Prove opt-in OpenTelemetry logs, metrics, and traces #17 → Optiflow test(flow): prove compatibility and provider acceptance scenarios #61 → Renderflow #409 → Flow [Audit] Post-roadmap repository, backlog, and Identity audit #12
24. Audit remediation, final releases, then Flow [EPIC] Finish the flow suite and prove production-ready orchestration #11 closeout

Issue creation needed

The live issue set does not yet represent every bounded step needed to reach the documented finish line. Create these before implementation, duplicate-checking first.

Current open-issue disposition

Every open issue is represented below so none disappears between the live backlog and the ordered plan.

Flow — 21 open issues

Renderflow — 11 open issues

Optiflow — 3 open issues

Aniflow — 6 open issues

Explicit post-v1 lanes

The following work remains valid but should not silently expand the completion gate:

• Optiflow transactional duplicate application, quarantine/restore, permanent deletion, lossless candidate production, and source replacement.
• Optiflow broad image/audio/video optimization profiles beyond the stable read-only evidence boundary.
• Distributed/remote Flow execution, hardware-aware scheduling, and hosted orchestration.
• Aniflow arbitrary temporal DAGs, remote providers, and real-time processing.
• Renderflow managed services, marketplaces, and enterprise controls.

Move each surviving item to a named post-v1 milestone with an explicit owner and rationale. “Deferred” must remain visible; it must not mean forgotten or implied as shipped.

Final definition of done

• All four current default branches are protected and required validation is reproducibly green.
• Each tool installs and runs independently from an immutable stable release artifact.
• Public schemas, CLI behavior, exit semantics, provider contracts, and compatibility rules are versioned.
• Flow proves real multi-holon discovery, planning, execution, validation, explanation, interruption, retry, and deterministic resume.
• Static-publication and temporal-media workflows pass clean-room positive and negative suites.
• Provider and Flow corpora are deterministic, redistribution-safe, generator-first, and tiered by cost.
• Manifests retain content digests, exact tool/provider versions, configuration/authority identities, provenance, diagnostics, validation, and partial/unavailable outcomes.
• Telemetry remains optional, privacy-safe, and non-authoritative.
• Documentation, sites, release metadata, READMEs, CLI help, and observed binaries agree.
• ADR ledgers are converged once their shared external platform is actually ready.
• Identity, accessibility, security, licensing, recovery, and rollback pass provider-first audits and the final Flow audit.
• Every issue named here is closed with evidence, superseded with evidence, or assigned deliberately to a named post-v1 milestone.
• The final Flow [EPIC] Finish the flow suite and prove production-ready orchestration #11 completion report links exact commits, releases, workflows, fixtures, compatibility tables, and intentional deferrals.

Music-video workflow extension — 2026-09-27

Aniflow #35 captures the observed selective-repair → resumable-upscale → verified-delivery workflow. Focused gaps are #36 existing frame import/selective repair, #37 bounded Upscayl recovery, #38 optional toolchain profiles, and #39 a prototype-first invisible-watermark evaluation.

These consume the existing Aniflow #32/#33/#34/#13/#24/#10 foundations and preserve the current execution order. They are not new implicit release blockers. #39 requires a separate short-clip experiment and actual quality/effectiveness evidence before optional provider integration; it does not block ordinary delivery. Broader synthetic test-video work is being planned separately and should coordinate through Aniflow #24 rather than duplicate its corpus. Cross-artifact publication hygiene remains Renderflow #361; Flow consumes released providers via #51.