P0 epic: Close the Threads verification boundary with real Coven daemon E2E

[BunsDev]

Outcome

Make coven-threads safe to treat as a stable public authority protocol by proving its critical invariants through the real Coven daemon boundary—not only through in-process Rust tests.

The required path is:

current coven-threads change
  -> pinned real coven daemon
  -> supported request boundary
  -> current Threads crate proven active
  -> ephemeral filesystem / coven.sqlite3 / pending state
  -> scheduler, replay, restart
  -> optional Cave live-daemon acceptance

Normative implementation contract: docs/testing/e2e-contract.md, merged in #34 (db0049be8c75db77efb5b79c6f72184e0e116449).

Why this is P0

The repository has a strong library/conformance estate, but a green library PR does not establish transport, lifecycle, dependency wiring, persisted audit/staging state, delayed scheduling, and restart recovery. Current daemon integration pins Threads at c3bd46b; the older release v0.4.3 pins c102844. Explicit current-checkout override proof and real-daemon journeys now exist, but the required reviewed pin and full acceptance remain open.

Phase-5 sign-off remains blocked by four findings whose original defects now have draft repairs, not completed acceptance:

• threads-okc — identity-predicate mutation/replay enforcement;
• threads-980 — complete typed terminal evidence for opened windows;
• threads-dgg — protected proposal-route prohibition;
• threads-zav — retired-Ward live schedulability and recovery.

Canonical boundaries

• Familiar Contract owns identity semantics.
• Threads owns protected mutation verdicts, approval/replay semantics, and the ward_audit schema contract.
• Coven owns authentication, request adoption, persistence, staging, scheduling, apply, recovery, and every side effect.
• Psyche consumes authority-bound snapshots; it does not create verdicts.
• Cave renders and forwards daemon truth; it is never approval authority.

No work item may create a second audit store or a second canonical writer.

Work graph

P0 — foundation and daemon proof

• Merge the repository-readiness/CI foundation PR (chore: establish Threads E2E readiness and authority governance #34, db0049be8c75db77efb5b79c6f72184e0e116449): machine-readable R4 manifest, deterministic bootstrap/checks, Nextest/JUnit, informational coverage, compatibility pin, CODEOWNERS, evidence template, E2E contract.
• Land a downstream coven-cli --test threads_e2e process fixture against a reviewed full Coven SHA.
• Prove the Cargo override uses the current Threads checkout before tests run (daemon d4653f14, Threads 2d21254, metadata checked; this is not the required stable-pin gate).
• Land permit/reject/drift smoke journeys.
• Close threads-okc, threads-980, threads-dgg, and threads-zav with red -> production fix -> green daemon evidence.

P1 — resilience, human acceptance, and enforcement

• Add deterministic scheduler time; no wall-clock correctness sleeps (implemented in the shared draft, reviewed landing still open).
• Add restart/recovery and committed-evidence drift journeys (implemented in the shared draft, full acceptance still open).
• Add nightly Linux/macOS/Windows daemon matrix.
• Add a three-journey threads-live-daemon Playwright project in Cave.
• Protect main with quality, Cargo compatibility, and daemon-E2E checks.
• Full-SHA pin reviewed third-party Actions (ci: pin external actions and preserve explicit Rust toolchain parity #38, af01361).
• Deploy checksum-pinned index/history secret scanning (ci: deploy checksum-pinned secret scanning independently #41, 2d21254; merged-main CI 34465519559).
• Resolve and enable independent privacy enforcement (Add clean-clone secret and privacy CI guards #39/ci: enforce independent privacy policy with sanitized source reference #40; frozen-reference policy ruling remains open).
• Establish a measured coverage floor after the baseline period.

P2 — ratchet and ecosystem conformance

• Stress critical tests and retain flake trend data.
• Exercise Channel::Deliberate once daemon reachability lands.
• Publish compatibility status and immutable downstream canary evidence.
• Add independent verifier vectors for public protocol claims.

Required journeys

1. bounded authorized write;
2. unsigned/unbound protected write;
3. out-of-band drift and non-executed proposal;
4. identity-invariant mutation and replay;
5. protected SOUL.md proposal-route prohibition;
6. complete veto-window terminal matrix;
7. retired-Ward schedulability and recovery;
8. committed-evidence drift across restart.

Evidence required per blocker

• failing black-box case against pre-fix behavior;
• production fix in the canonical owner;
• passing black-box case after the fix;
• lower-level regression test;
• named CI check and sanitized failure bundle;
• migration and rollback notes when persistence changes.

Assignment lanes

• Sage: contract, compatibility ledger, conformance/evidence mapping.
• Cody: Rust regressions and deterministic seams.
• Nova integration lane: daemon process fixture and boundary implementation.
• Echo: predicate/audit/replay invariant review.
• Charm: Cave live-daemon acceptance.
• BunsDev: authenticated GitHub accountability, merge policy, and human freeze.

Agents must not simulate Nova's independent review or Val's freeze.

Exit criteria

• 8/8 journeys pass through the real daemon boundary.
• 4/4 named Phase-5 blockers have red-to-green E2E proof.
• Required tests use a full-SHA Coven pin and prove the local Threads override is active.
• First-attempt E2E pass rate is at least 99.5% over 30 days; retry-success still fails CI.
• Duplicate/missing terminal close records remain zero.
• No correctness journey uses real wall-clock sleeps.
• main is protected by the required authority checks.
• Human sign-off remains independently attributable.

Evidence reconciliation (2026-09-10, acceptance continuation)

Foundation #34, immutable Actions #38, and secret scanning #41 are landed. The checked implementation/override items distinguish work that exists from reviewed runtime landing and full acceptance. The shared daemon draft is not missing implementation, but it is not a reviewed required-pin gate.

Work	Current evidence	Next obligation
Shared real-daemon harness	Draft OpenCoven/coven#931 at d4653f14; 15 local default-parallel daemon journeys with proven current Threads 2d21254. Latest hosted run 34466364843 passes Windows workspace/clock units but fails four daemon startups (11/15)	Repair/diagnose Windows lifecycle, retain exact-head evidence, then reviewed integration and required-pin gate
Identity predicates	Component OpenCoven/coven#969 / OpenCoven/coven#885; integrated intake/replay and final-binding repairs in OpenCoven/coven#931	Retain final snapshot/commit evidence through exact-head acceptance and reviewed landing
Terminal closes	Component OpenCoven/coven#932 / OpenCoven/coven#886; OpenCoven/coven#931 exercises all five terminal families and supersession/restart idempotency	Retain complete typed closes through remaining commit-boundary failure cases and reviewed integration
Protected routes	Draft OpenCoven/coven#933 at 3d2c06d067584cd4133ea573a0df9c88ac8b13a0, issue OpenCoven/coven#887; current-Threads daemon refusal/audit cases are green in OpenCoven/coven#931	Land and independently accept route/recovery matrix without widening proposal authority
Retired corpus	Draft OpenCoven/coven#972 at e139023f6175a41d4a3c99cb6c2b28ca1d812875 and clock draft OpenCoven/coven#968; real migration, supported intake, minimum visibility, deadline, restart, and unsupported input exercised in OpenCoven/coven#931	Land prerequisites and satisfy cross-platform/full-contract acceptance
Windows daemon parity	OpenCoven/coven#978 merged into the shared draft. Head fd610f6 passed 15 native journeys, including final-commit drift, at synthetic merge 6daed594 using committed Threads c3bd46b; later d4653f14 has startup failures	Resolve the later startup failures; previous green and local override proof are not transferable
Final validated-snapshot binding	OpenCoven/coven#979 merged into the shared draft; its final-commit drift case is wired and executed. Bounded independent authority review found no significant introduced correctness issues	Reviewed integration and full acceptance; automated review is not Nova/Val approval
Runtime authority	Upstream OpenCoven/coven#953 consumer projection and OpenCoven/coven#975 receipt reads are merged; trusted adapter owner remains OpenCoven/coven#857	Consume canonical trusted binding, never infer authority from the projection or client strings
Immutable CI actions	Merged #38 at af013612c699b0adff918da3fd2bb7d0964cf0b3, issue #37; full hosted run 34411042660 passed with per-step Rust parity checks	Action pinning landed; keep branch protection, scanning, coverage, and daemon acceptance separate
Secret/privacy hygiene	#41 deployed secret scanning; actual PR CI 34465028325 and main CI 34465519559 pass. #40 is now a separate privacy job/documentation delta	Resolve the frozen source-reference conflict without an unauthorized exemption or spec edit

Supported publication, deterministic scheduling, and the eight-case restart loop are implemented in the shared draft, not absent prerequisites. At d4653f14, 41 selected adoption/identity/commit cases and 15 current-checkout daemon journeys pass locally. Test-only cancellation diagnostics and store-ready concurrency fixtures landed separately through OpenCoven/coven#993 and OpenCoven/coven#996. The latest Windows failures are production-startup timeouts whose setup artifacts lost available diagnostics; evidence retention is being repaired before a runtime fix is claimed. These results do not certify signed authorization, changed runtime bindings, every commit interleaving, Cave acceptance, or the reviewed required pin.

Sections 6-7 require relevant authority changes between validation and commit to fail closed and bind the same validated snapshot. This is not an added requirement for globally simultaneous multi-file visibility; J1 separately requires atomic intended-file changes.

#27 was closed without merge on 2026-09-06 because null close evidence would weaken the invariant. Its retained branch is not a fix to merge. The stale completion of threads-76z has been reopened for explicit prevention/repair work.

The 2026-09-10 GitHub query reports main.protected=false and no repository rulesets. Action pins and secret scanning landed in #38/#41. Required-check policy, privacy enforcement (threads-t6t), coverage ratchets, and OS/Cave acceptance remain outstanding. These are not satisfied by CODEOWNERS, secret scanning, or informational coverage jobs.

Coven release v0.4.3 resolves to 8baa9c9b722a3a9553c6ed39b7e1ba2296ced95a and pins Threads to c102844; the older claim that no released source contains Threads is obsolete. Release ancestry does not establish complete enforcement or current-checkout compatibility.

Coordination: execution epic threads-8pz and acceptance task threads-8pz.5 remain active. #42 reconciles the explanatory delivery ledger after #36. Already-implemented daemon slices are blocked on reviewed acceptance rather than offered as duplicate ready work. Further engineering approval does not close Nova's independent review or Val's freeze, authorize the required pin, or certify deployed binaries.

[BunsDev]

Cody comprehensive review handoff - 2026-09-09

Five parallel execution lanes completed under threads-av3: shared daemon
harness, terminal recovery, protected routes, promotion-seam language, and
identity/corpus prerequisite analysis. This completes the scoped review pass,
not the Phase-5 implementation or any human gate.

Local code follow-ups and exact evidence are recorded on
OpenCoven/coven#931, OpenCoven/coven#932, and OpenCoven/coven#933. They remain
uncommitted/unpushed and the remote PR heads are unchanged. The harness now has
current-Threads real-process smoke/lifecycle evidence with the local Cargo
override proven; it still does not satisfy the required stable-pin J1-J8 matrix.

The source audit separated two missing runtime seams from already-present
scheduler/recovery code:

• threads-okc / P0 threads-okc: Wire identity predicates into mutation intake and deadline replay coven#885: activate existing compiled identity
  invariants in the live Ward path and bind complete candidate facts at intake
  and replay. Backup-only migration is not enforcement.
• threads-zav.1 / P0 threads-zav: Prove retired-Ward proposals are schedulable and recoverable end to end coven#888: publish the existing scheduled envelope
  from supported production intake rather than test-only constructors.
• threads-zav.2: provide deterministic daemon-boundary scheduler time without
  client-controlled authority or correctness sleeps.

Tracking and documentation corrections:

• Bodies of threads-uqx.6: daemon integration — classification, delayed-apply scheduler, deadline revalidation, audit in coven.sqlite3 #11, threads-uqx.7: Cave contract amendment — ProposalView for Phase-5 approval paths, blocked fixtures for veto states #12, threads-uqx.9: Nova sign-off — RFC round-trip, Gate-4 fail-closed proof, descriptor-not-authority review #13 and this issue were reconciled with current evidence;
  all remain open. Only the merged chore: establish Threads E2E readiness and authority governance #34 foundation item was checked.
• docs(threads-ot6): draft promotion-write ↔ weave seam contract #25 now states language-only scope and an unresolved coven-memory mirror.
  Local document corrections also distinguish human/no-window ceremonies,
  typed terminal obligations, and daemon-owned persistence.
• threads-76z was reopened: fix(audit): permit human-path window close in proposal approval trigger #27 closed without merge, so its old completion
  claim was unsupported. Its null-close approach must not be resurrected.
• An isolated local docs refresh corrects obsolete unreleased/unclaimed claims,
  release-source provenance versus runtime conformance, closed historical
  follow-ups, current runtime prerequisites, and missing repository governance.

All 11 remote Threads branches were classified. These five are exact
merged-head retirement candidates, with their merge commits confirmed on main:
chore/corpus-verifier-followups (#22),
chore/e2e-readiness-foundation (#34),
feat/phase5-corpus-salvage (#21),
feat/phase-5-uqx3-approval-types (#15), and
spec/phase5-cave-contract (#16).

Retain main, active #25's docs/threads-ot6-seam-promotion-contract, and the
unmerged/unique-history branches cody/apply-audit-v014,
docs/pr23-merge-readiness, feat/phase5-retired-corpus, and
fix/threads-76z-window-close-human-path.
No branches or worktrees were deleted; no commits, pushes, or merges were made.

Remaining acceptance includes cross-PR integration, identity activation,
supported scheduled publication, deterministic time, the complete terminal and
retired-Ward matrix, required-check/secret/privacy governance, and independent
Nova/Val decisions. None is waived by this review.

[BunsDev]

Execution checkpoint: OpenCoven/coven#931 is now the integrated draft at 345d4cf0, not just the old smoke harness. Real-daemon/current-Threads evidence covers all five typed terminal families, canonical retired-Ward migration/intake/minimum visibility/restart, identity intake and replay, live policy/binding drift, and valid/contradictory human paths. Expanded selected authority/intake tests: 218 passed; feature-enabled daemon target: 15 passed on three consecutive runs. Source-adjacent references and #36 delivery ledger are refreshed. Linux/macOS CI now invokes the feature-enabled target. The stable required pin is unchanged. Signed authorization/runtime-binding proof, aggregate atomicity, Windows daemon-journey parity, Cave acceptance, protection/rulesets, measured coverage/flake gates, and Nova/Val human decisions remain open. Current integration CI is running; no main merge or freeze is claimed.

[BunsDev]

Cody current-head reconciliation (threads-3fm): the published integrated draft OpenCoven/coven#931 at 345d4cf0 remains green in run 34396479737. Do not transfer that result to the newer local continuation: OpenCoven/coven#976 records 299afacf at 11 passed / 4 failed daemon cases (one startup home/identity mismatch and three os error 35 request failures). A serial rerun passing those four is diagnosis, not a repair or first-attempt acceptance. Existing threads-8pz.12/.13 lanes retain ownership of transport/lifecycle and snapshot binding; the .13 daemon support case was still unwired at the recorded checkpoint, with only test seam 24fff607 integrated.

Identity activation, supported publication, deterministic time, protected-route refusal and terminal/supersession handling already have draft implementations. Beads threads-okc/dgg/980/zav and zav.1/.2 now distinguish implemented draft evidence from reviewed landing and required-pin acceptance. Avoid rebuilding those seams. OpenCoven/coven#932/#968/#969 are ancestors of the published integration; OpenCoven/coven#933, OpenCoven/coven#970, OpenCoven/coven#972 and OpenCoven/coven#973 have divergent component history despite documented incorporation of relevant changes, so reconcile patches before declaring supersession.

All 13 remote Threads branches were classified: five exact merged-head retirement candidates, three active draft branches, main, and four unique-history branches to retain. Nothing was deleted. No main merge, blocker closure, or Nova/Val decision is implied.

[BunsDev]

Downstream continuation is published in OpenCoven/coven#978 at cfe8757a88ff246d975ae61d44af2826d7e171e8, stacked on OpenCoven/coven#931. It retains all14 actual daemon journeys, replaces the Unix-only custom parser with negotiated coven-client transport, adds Windows verified crash/lifecycle support and hosted failure-artifact retention. The removed fifteenth test exercised only the old custom parser; framing rejection is now covered by production-client regressions. Current Threads16ad832 local override was proven,46 client tests and14 default-parallel daemon journeys passed, and feature-on/off Windows cross-target lint is clean. Independent staged review found no significant issues. Actual hosted Windows execution is still pending in run34424934851, so threads-8pz.12 and all root acceptance/human gates remain open. The active OpenCoven/coven#977 owner was notified and its worktree was not edited.

[BunsDev]

Windows parity engineering is no longer an absent prerequisite: OpenCoven/coven#978 is ready for review, backed by full hosted run34424934851 and14 actual Windows daemon journeys with no ignored/filtered cases. Its 27 retained scenario manifests were inspected and all report passed/windows at synthetic merge cfd4bcaf (basead0153bf + headcfe8757), committed Threads c3bd46b/no local override. Separate local runs proved currentThreads 16ad832 override. Closed only the completed implementation/native-proof subtask threads-8pz.12; OpenCoven/coven#976 and threads-8pz.5 retain reviewed landing/integration obligations. The existing snapshot owner has published OpenCoven/coven#979. Next acceptance combines 978/979 into 931 and proves the additional final-commit cases at that exact integrated head; no root. Phase5 required pin or human gate is closed.

[BunsDev]

Cody production-readiness continuation: shared Coven draft OpenCoven/coven#931 now integrates OpenCoven/coven#978 and OpenCoven/coven#979 plus main24774353 at a9347cc. Final-commit identity drift is no longer unwired: it executes/passes with current Threads16ad832 proven by metadata, alongside15focused units. Overall default-parallel daemon result remains14/15 because a startup identity race recurred; specialist diagnosis is active, and no inherited green is claimed. Native Windows-GNU compilation covers the same15journeys; exact-head hosted execution pending. Independent Threads secret/privacy guard implementation is active underthreads-t6t in an isolated worktree, reusing established OpenCoven policy. Stablepin, fullE2E acceptance, Nova/Val human gates remain unchanged.

[BunsDev]

Secret/privacy CI slice is now tracked in #39 / threads-t6t, with an isolated uncommitted implementation and sanitized evidence there. Synthetic guard/pin regressions pass (32/32); indexed and full HEAD-history secret scans pass. The strict privacy gate currently blocks one pre-existing runtime-path example in a frozen spec. This requires a maintainer policy/change-control decision; no allowlist weakening, frozen-spec edit, or gate closure was performed. No downstream integration overlap or branch-protection change.

[BunsDev]

Independent hygiene lane is published: draft#40 a6d51c2 implements checksum-pinned secret/privacy guards and sanitized synthetic coverage under#39/threads-t6t. It remains explicitly blocked by the proposed privacy rule matching a pre-existing example in the frozenPhase5spec; no bypass or unauthorized specedit was introduced. Secret scanning is clean, but repository-hygiene acceptance is not closed. Downstream daemon/lifecycle work continues independently.

[BunsDev]

Lifecycle blocker advanced from diagnosis to proven repair: OpenCoven/coven#931 now publishes42f5e71/fd610f6. macOS socket canonicalization had retained the deleted staging hard-link name; the client now preserves the published leaf under the canonical home without weakening ownership/identity. Exact committed42f5e71 with currentThreads16ad832 override runs all15daemon journeys successfully, defaultparallel, including final-commit drift. ComponentPRsOpenCoven/coven#978 andOpenCoven/coven#979 are merged into that draft, notmain. NativeWindows exact-head acceptance remains pending; independent workspace timeoutOpenCoven/coven#992 is tracked. Stablepin andhuman gatesunchanged.

[BunsDev]

Branch/queue reconciliation: seven remote branch heads exactly match merged PR heads (#15,#16,#21,#22,#34,#36,#38); they are historical retirement candidates, not new work. Active branches are #25 and #40. Four other historical branches remain preserved; old fix/threads-76z-window-close-human-path is explicitly not mergeable work (#27 was closed unmerged because it weakens opened-window terminal evidence). No branches/worktrees deleted. Six already-implemented daemon slices were moved out of the ready-work queue to blocked-on-reviewed-integration status, preventing duplicate implementations; #11 now records the combined checkpoint and remaining E2E gates.

[BunsDev]

Integrated nativeWindows milestone: OpenCoven/coven run34461979876 executes15/15realdaemonjourneys (70.06s), including finalcommitdrift;23downloadedscenario manifests allpassed. Actualsyntheticmerge6daed594 = main efaf948a + headfd610f6. WindowsusedcommittedThreads c3bd46b (overridenotactive); separate local42f5e71 runprovedcurrentThreads16ad832 override. OverallCI/PRgateremainsred on2Windowsadoption-lane channeltimeouts, coordinatedwithOpenCoven/coven#855. #11 andOpenCoven/coven#931 nowrecordthisdistinction. No stablepin/mainmerge/humanacceptance claim.

[BunsDev]

Repository secret scanning is now deployed: #41 merged as2d21254 with actual PRCI34465028325 and mainCI34465519559 green. #40 is reduced to a separate11-line privacy job plus rollout docs; its frozen-reference policy decision remains open without waivers. After mainadvanced, current-checkout E2E was rerun: local Coven2d5eec83 + proven currentThreads2d21254override ->15/15default-parallel journeys. That local reconciliation is not yet published; nativeWindows evidence remains explicitlybound to publishedfd610f6/synthetic6daed594. Isolated adoption-fixture remediation continues before the next combined publication.

[BunsDev]

Combined OpenCoven/coven#931 checkpoint 0883d6dd passed native CI34477970475 (actual merge63d1f339fb32ab53e6ab3cf18bd85b921bd184de): Windows18/18 target cases, including15 real-daemon journeys and3 artifact regressions. Local current-Threads fdcd755 override separately passed18/18. Hosted Windows still uses committed Threads c3bd46b, not that override. The atomic schema correction landed separately as OpenCoven/coven#998 / ce5e7b1. Evidence audit caught old manifests restored by the target cache: artifact10152986441 contains28 current passed manifests plus28 historical manifests. Count only exact-current-merge evidence; OpenCoven/coven#1000 now tracks isolated run/attempt storage. Phase maxima remain valid after provenance filtering, but one green run does not establish timeout causation or stability. Full integration, stable pin, Cave acceptance, and human gates remain open.