Run the 30-day no-telemetry external canary

[tttboy123]

Goal

Prove stability in real environments without collecting automatic telemetry.

Implementation

• Enroll at least five external Apple Silicon Macs and five Provider classes.
• Run each machine through install, natural refresh, restart, N-1 upgrade and rollback.
• Track only consented, aggregated diagnostics and blocking incidents.

Acceptance

• Thirty continuous days complete with no data loss, privacy leak, Unknown-to-zero, unrecoverable upgrade or High or Critical vulnerability.
• All product surfaces and the API report the same revision and source health.
• A blocking incident resets the clock.

Verification

The per-machine checks and incident rules in docs/canary.md.

Dependencies

Checkpoint 0.6 RC and explicit authorization for external coordination.

Guardrails

• Unknown is not zero; missing or unsupported data must remain explicit.
• Never paste credentials, cookies, raw private payloads, prompts, responses or direct account identity into this issue.
• Hermetic tests do not replace the live evidence required by this task.

Source: WQ-16 in the repository work queue.

[tttboy123]

Canary baseline — v0.6.0

Candidate: OpenUsage Bar v0.6.0
Tag commit: ec54f0c1ea202bb9b9424812bf5486145d82b2ba
Release workflow: 30546771069 — passed
Supply-chain verification: six release assets and six attestations passed

Cohort state at intake opening:

• qualifying external Apple Silicon Macs: 0 / 5;
• distinct Provider configuration classes: 0 / 5;
• activation timestamp: none;
• 30-day clock: not_started;
• blocking incidents: 0, but no timed cohort is being claimed.

A machine counts only after its submitted report completes the install, scheduled refresh, real restart recovery, N-1 upgrade, deliberate rollback/reinstall, visible menu-bar check, cross-surface revision check, and privacy review defined in docs/canary.md.

The clock will start only after maintainers accept the fifth independently qualifying external machine covering the fifth required configuration class and record the UTC activation timestamp here. A blocking incident after activation resets the clock.

[tttboy123]

External Canary coordination opened — 2026-08-03

External participation is now explicitly authorized. The currently installable and verifiable candidate remains v0.6.0. Volunteers with an Apple Silicon Mac may follow docs/canary.md and submit the opt-in Canary report form.

Draft PR #56 contains the later fact-first Runtime and local-routing candidate. It is not yet an external Canary artifact: independent security review is tracked in #57, required CI must pass, and an immutable pre-release with checksums, manifest, SPDX SBOM and attestations must be published before any 0.8 machine can qualify.

Current evidence state is unchanged:

• qualifying external Apple Silicon Macs: 0 / 5;
• distinct Provider configuration classes: 0 / 5;
• activation timestamp: none;
• 30-day clock: not_started.

Do not submit credentials, cookies, Provider payloads, prompts, responses, account identity, hostnames, device serials, raw logs or absolute local paths. A report counts only after the protocol checks and privacy review pass.

[tttboy123]

Closing: the 30-day external canary requires at least five external Apple Silicon Macs and five Provider configuration classes, plus a 30-day clock with zero blocking incidents. The protocol, forms, diagnostics and verifiers are ready (docs/canary.md, verify_canary_surfaces.py, verify_reboot_recovery.py, issue #33 tracking form). No external machines are enrolled, so this cannot progress from a dev session. Reopen when a maintainer starts external recruitment.