threads-uqx.9: Nova sign-off — RFC round-trip, Gate-4 fail-closed proof, descriptor-not-authority review

[BunsDev]

Bead: threads-uqx.9
Phase: 5 — Approval semantics over the Phase-2 Ward
Spec: specs/PHASE-5-APPROVAL-SEMANTICS.md §7
Depends on: #8 (uqx.3), #9 (uqx.4), #10 (uqx.5), #11 (uqx.6), #12 (uqx.7)

Scope

Nova design review and sign-off before Val freeze. This bead is a gate, not an implementation bead.

Review checklist

• RFC round-trip: every design decision in specs/PHASE-5-APPROVAL-SEMANTICS.md §6 maps cleanly to a type or predicate in the implementation beads. No decision is orphaned or contradicted.
• Gate-4 fail-closed proof: every ApprovalPath ends in daemon re-materialization. No path allows apply without live revalidation at deadline.
• Descriptor-not-authority check: no Cave or client-side surface is enforced on. Every enforcement point traces to a daemon-owned predicate or audit row.
• Audit completeness: proposal_submitted → window_opened → close(reason) chain is present and no gap exists between open and close. Close event has reason field.
• evidence_replay_hash is present on ProposalClassification and enforced at deadline revalidation.
• min_visible enforced on VetoWindow — pending state was actually reachable before deadline could close.
• Label-variant mapping is a daemon load-time contract, not a Cave convention. Drift fails at load.
• Advisory probes (if present) are in a separate advisory_probes block — never mixed with deterministic evidence in probes. They feed Gate-3 only and are not sole authority for any gated path.

Output

Nova sign-off comment on this issue, or a list of blockers that must be resolved before freeze.

Engineering evidence status (2026-09-09)

This remains an independent human coherence gate. The recorded refusal from 2026-07-29 is not superseded by agent review, merged foundational code, or green draft CI.

Four engineering blockers remain: threads-okc (OpenCoven/coven#885), threads-980 (OpenCoven/coven#886, draft OpenCoven/coven#932), threads-dgg (OpenCoven/coven#887, draft OpenCoven/coven#933), and threads-zav (OpenCoven/coven#888). #31 and the merged E2E contract define their red-to-green closure evidence; draft OpenCoven/coven#931 supplies the shared harness foundation.

No review checklist item is checked by this metadata reconciliation. Historical #11/#12 implementation and release evidence is being reconciled separately from full daemon conformance. Val's freeze remains downstream of this gate.

[BunsDev]

The engineering evidence packet is ready in OpenCoven/coven#931 at 345d4cf0 and #36 at 1f66257. The integrated draft has green full hosted CI (OpenCoven/coven run 34396479737), including 15 nonzero Linux real-daemon journeys and the Windows workspace suite. The automated read-only authority review reported no high-confidence introduced bugs. This is NOT Nova coherence sign-off or Val freeze, and those gates remain open. The packet explicitly retains full runtime-binding/atomicity, Windows daemon-journey, Cave and reviewed stable-pin acceptance limits rather than treating CI as certification.

[BunsDev]

Nova engineering readiness review: keep Phase 5 active

This is the requested engineering review and blocker list, not Nova's independently attributable human sign-off or Val's freeze. No checklist item is checked.

Observation: 2026-09-11. Threads baseline: 5be96b0ecb8e0b9a98d2cfd04fc12ce5c0fcd4fd. Inspected daemon integration: OpenCoven/coven#931 at 8576f41e6d622f63a3576b85bd2d3142776e59ca. It remains an open draft with no submitted reviews; the latest query reports merge conflicts. Current Coven main 066727f1a34377f4dfff0f5a7f80898a3a1c1ea5 still requests Threads c102844 and lacks threads_e2e. The stable pin 39feb6de98816d10b490091e918f62035e6ce0df also lacks that target.

Findings that prevent a positive freeze recommendation

1. Supported auto-path reachability is missing in the inspected scheduled producer. threads_gate.rs:1318-1389 requires built-in region evidence and applies its floor. surface_regions.rs:370-491 assigns floors 0 or 1; proposal_scheduler.rs:66-78 rejects floor 0 and auto at floor 1. Both auto variants therefore need a supported production-route proof, not a test-only scheduled envelope or weaker protected floor.

2. Classification-time identity commitment remains narrower than P0 threads-okc: Wire identity predicates into mutation intake and deadline replay coven#885 requires. The producer assignment calls evidence_replay_hash(diff, region_evidence), which does not separately commit the predicate/configuration or unedited candidate identity sources. Later live identity evaluation and final applying/recovery binding are important but do not establish that earlier commitment. Prove rejection when identity evidence changes yet still satisfies the current predicates. This is a source/acceptance gap, not a freshly executed unauthorized-write claim.

3. Reviewed landing and full boundary acceptance are absent. All four root issues remain open: P0 threads-okc: Wire identity predicates into mutation intake and deadline replay coven#885 (threads-okc), P0 threads-980: Require one typed terminal close for every opened veto window coven#886 (threads-980), P0 threads-dgg: Remove protected SOUL.md from the proposal/approval pipeline coven#887 (threads-dgg), and P0 threads-zav: Prove retired-Ward proposals are schedulable and recoverable end to end coven#888 (threads-zav). Complete the terminal/recovery and protected-route matrices and the per-blocker pre-fix red -> production fix -> exact-head green dossiers before treating the draft as closure.

4. Latest native green is real, but provenance and startup reliability remain bounded. Run 34489425644 is successful. Its Windows target comprises 15 daemon journeys plus five artifact regressions, not 20 authority journeys. Artifact 10157780426 contains 28 manifests at synthetic merge 0d8ccfca1725475b5e45f2ec47d8c4c2c45bc89d, using older Threads c3bd46bcadb6396db8436c47411a4d0eac17192b, with override false and a recorded Threads dirty flag. Explain that flag and record the actual feature-enabled invocation. Earlier startup failures in run 34482201141 remain unexplained; a later green does not establish a repair or the 30-day reliability target.

Eight-item coherence mapping

#13 item	Engineering disposition
RFC round-trip	Types and the eight recorded defaults have substantial mapping; the two source gaps above prevent complete runtime acceptance.
Every ApprovalPath revalidates	Familiar-review and human-review process evidence exists. Auto reachability and full rationale-required process proof remain open.
Descriptor is not authority	Inspected core/runtime chains use predicates and authoritative bytes; no full Cave/client acceptance is claimed.
Exactly one typed terminal close	Five typed families and duplicate guards exist. Full failure/recovery coverage and explicit ambiguous-applying resolution still need acceptance.
Replay hash present/enforced	Diff/region commitment is reconstructed at scheduled load with live apply checks. That is not proof of the complete classification-time identity binding.
Minimum visibility	Supported pending/restart journey exists. Exact deadline, publication/visibility boundaries, and browser reachability remain separate proof obligations.
Label/variant mapping	Typed envelope and lower-level negative cases exist. Retain a real-daemon malformed-load proof rather than inferring it from Cave labels.
Advisory separation	Core model-advisory types are separate; inspected daemon probes are deterministic. This does not certify an unimplemented model-probe integration.

Unblocking sequence

Resolve the identified production/proof gaps and draft conflicts; obtain reviewed exact-head integration; establish the current-Threads override against a reviewed full-SHA daemon pin; complete OS/Cave acceptance and the four blocker dossiers; then request the independently attributable coherence decision followed by Val's freeze.

Baseline main protection is now active under ruleset 22910327, but it does not require daemon E2E. Do not change the stable pin, lower authority floors, relax terminal SQL, or infer signed runtime authority from profile/reference-vector success to make acceptance appear complete.

This refresh re-read live issue/PR/ruleset state, exact producer/scheduler/hash source, and the hosted artifact; it carries forward the earlier same-day detailed source mapping at the same immutable integration head. No new daemon run or exhaustive code/security audit is claimed. Signed principal proof, trusted-runtime changes, all commit/crash interleavings, and full Cave behavior remain uncertified.

This comment changes no public contract, schema, migration, release, or gate state. Preserve Ward backups and unresolved pending/applying evidence; rollback must not restore the original unvalidated routes or discard claims that an older daemon cannot recover.