[jaywedgeworth22]

Refs AFC-618, UM-1651

Summary

This PR salvages the reviewed Telemetry Hub activation and lifecycle work for Kimi Code and ZCode while preserving the original finite credential-use, ownership, custody, one-writer, and production-release gates. It adds a canonical secret/map controller, offline mounted-snapshot planning, finite Engine lifecycle models, and synthetic rehearsal evidence without activating production or changing the running hub. Kimi Code and ZCode telemetry therefore remains disabled unless the canonical controller is separately reviewed and released.

Functional changes

• Added activate-kimi-zcode.py, whose default mode produces a metadata-only plan with no network requests, credential consumption, token generation, or writes. A separately authorized execution requires an exact reviewed manifest digest, acknowledged AFC-600 and Clutch reservations, the four existing production-scoped grants, unchanged baseline digests and membership, and no pre-existing requested keys. It provisions four independent ingest/hub tokens, preserves existing root-map members and hub tuples, and reads back every write and map change. Private owner-only custody and intent, confirmation, and completion receipts are written before remote mutations, with no automatic retry or rollback.

• Added sync-mounted-sources.py to plan a mounted snapshot replacement that changes only the canonical hub map, preserves Sentry fields and existing producers, backs up the old snapshot, checks for competing changes, retains UID/GID 10001:10001 and mode 0600, and verifies journal continuity. The CLI rejects live execution, and the real stop and recreation operations remain intentionally unavailable.

• Added a pinned Engine lifecycle stack comprising pinned-engine-lifecycle.py, finite-pinned-lifecycle.py, host-proof-adapter.py, and offline-engine-runtime.py. These offline models define exact API 1.53 routes, bodies, statuses, request budgets, daemon identity checks, connection deadlines, wire limits, four one-shot proof phases, durable receipt requirements, recovery backups, journal fingerprints, and strict snapshot-archive decoding without filesystem extraction. The supplied real Engine transport remains GET-only, while the mounted reader and live mutation routes continue to refuse execution.

• Added resolved-mount normalization by unique destination while retaining every mount field and nested value, plus check-engine-invariant-predicate.py for source-only comparison of candidate invariant predicates.

• Added synthetic stopped-archive, exact-cleanup, and UID-custody rehearsal candidates. These cover stopped-container representation checks, archive upload/readback, cleanup ordering, UID 10001:10001 file custody, fault handling, and unarmed absence verification. The published copies are redacted or hash-fenced and do not authorize fixture execution.

• Added runbooks covering canonical activation, offline Engine runtime review, production-shaped rehearsal requirements, and isolated UID-custody preparation. The intent is to preserve prior review baselines rather than silently refresh them; audit 637271298, coordination request 637275091, controller requests 637276421 and 637276431, and historical runtime owner receipt 637291577 remain the recorded context, with current reservations still requiring refresh before any future execution.

Operational impact and safety

No production activation, hub restart, container stop/recreation, source-token deployment, Sentry delivery, or Usage Monitor ledger acceptance is performed or demonstrated by this PR. Unknown write outcomes terminate without retry, rollback, or automatic cleanup, and private receipts or remaining resources are retained for reconciliation. Snapshot replacement still relies on cooperative ownership and compare-before-rename; it is not atomic compare-and-swap against a writer that ignores the protocol.

The mounted and runtime candidates provide rehearsal and review evidence only. Synthetic success does not establish the production image or field set, Compose and environment provenance, host-network behavior, production UID custody, journal continuity, sender acceptance, stored Sentry receipts, or Usage Monitor acknowledgment and ledger evidence.

Tests and reported evidence

Added tests cover canonical activation boundaries, mounted snapshot replacement, finite lifecycle ordering, durable host proofs, strict archive parsing, Engine transport limits, stopped-archive representation, cleanup faults, and UID custody. The new tests use fake daemons, fake sockets, synthetic archives, and temporary files rather than live Engine or production resources.

No current test execution output was provided with the diff. The added runbooks report the latest full suite as 118 tests with 116 passes and two existing UID-assignment skips, while retaining an earlier scoped 98-test boundary with 96 passes and two skips. Rehearsal plans separately report 16 stopped-archive tests, nine prior rehearsal tests, six cleanup tests, and 17 UID-custody tests. The cleanup test module expects an intentionally unmirrored private manifest, so its public-checkout behavior must not be conflated with the private-package result.

The runbooks also cite prior separately released synthetic Engine evidence, including receipt 637300465 for stopped public-image fixtures and confirmed cleanup. That evidence applies only to the selected synthetic configuration, image, daemon, and API and does not establish production equivalence.

The documented validation command is:

python3 -m unittest discover -s scripts/telemetry-hub -p 'test_*.py' -v

Automated review findings

The automated review reported nine findings that remain visible in the supplied changes:

• Critical: sync-mounted-sources.py emits mounted secret configuration through captured subprocess stdout.
• High: activate-kimi-zcode.py does not enforce the receiver's 64-member hub-map limit.
• High: activate-kimi-zcode.py writes collector token secrets under /telemetry, although no collector reads that path.
• High: The published stopped-archive-c4e91b27 review copies conflict with their own instruction not to publish those lane artifacts.
• High: uid-custody-73b4d9e0/fixture-base.py duplicates the API version instead of deriving it from the canonical prefix.
• High: sync-mounted-sources.py computes its container invariant digest from a different projection than the canonical resolved invariant, allowing mount ordering and normalization to disagree.
• High: The runbooks conflict on the current test count.
• Medium: The earlier stopped-archive-c4e91b27 comparison uses type-loose equality that can hide boolean, integer, and float configuration drift.
• Low: telemetry-hub-production-shaped-rehearsal.md cites a 113-test boundary while pointing to 118 tests.

These findings, together with the remaining production gates, block treating the current artifacts as an activation receipt or authorization for live mutation.

---

Summary

Salvages the UM-1651 telemetry-hub offline lifecycle work by tightening mounted-secret handling, supporting pinned-engine connection reuse, and expanding UID custody rehearsal coverage.

• Verifies the running container’s mounted configuration against the host snapshot using SHA-256 digests. The container now emits only the digest, while callers continue to receive the private host snapshot without the raw mounted secret traversing subprocess stdout.
• Explicitly closes pinned-engine metadata responses after reading them so supported runtimes can reliably reuse the connection.
• Refreshes the exact SHA-256 pins for the modified lifecycle and synchronization scripts and the absence verifier.
• Adds offline coverage for digest matches and mismatches, preflight verification, the stat-only custody collision boundary, and successful cleanup of generated temporary scopes.
• Updates the stopped-archive cleanup test to skip when the intentionally unmirrored private cleanup manifest is unavailable.

Test Evidence

The rehearsal plan reports a prior run of seventeen offline tests using fake daemon and wire responses with synthetic data. The two additional UID-custody tests are included in the patch but are not covered by that run evidence; the plan’s seventeen-test count is now stale. No new run result is provided by these changes.

Review Findings and Unresolved Risks

• High: The new custody test codifies payload tampering under a complete stat-signature collision as accepted behavior, while the plan describes this boundary as an open review question rather than an approval. Resolution remains required.
• Medium: The post-replacement mount-mismatch path uses a generic mismatch error and hides the required no-rollback instruction.
• Medium: The digest-only test’s raw-output assertion is vacuous and does not prove that raw snapshots never appear in command output; the test needs strengthening.
• Low: The rehearsal plan still claims seventeen custody tests after adding two.
• Payload custody remains stat-only: the host actor does not read or hash payload content, so a same-inode rewrite with an unchanged complete stat signature on a coarse-timestamp filesystem is undetectable. No timestamp-granularity guarantee is claimed, and acceptance for consequential cleanup remains open.
• The cleanup happy-path coverage uses generated temporary fixtures only. The private cleanup-manifest test is runnable only in the private review lane.
• Independent source review and a new exact release remain required. Production resource custody, read-only single-file fidelity, production image and host networking, journal continuity and recovery, and healthy runtime and sender, Sentry, and Usage Monitor acceptance remain unproven. The earlier discarded response remains unknown.

---

Summary

This PR salvages the UM-1651 telemetry hub offline lifecycle work without enabling production routes or releasing a production rehearsal. It corrects activation secret placement, hardens offline transport and snapshot verification, and updates the associated custody evidence.

• The activation controller now rejects empty or over-capacity receiver source maps, including the producers it appends.
• All four generated collector tokens are written and verified at /, where collectors resolve secrets; /telemetry now contains only the hub source map.
• The read-only Engine transport retains its buffered reader when a response is closed, preventing a pipelined second response from being lost for content-length, chunked, or mixed framing.
• Mounted-source inspection now uses the shared resolved invariant projection and canonical digest encoding, while stopped-archive checks use JSON-aware equality.
• Post-replacement snapshot readback failures explicitly instruct operators to reconcile without rollback.
• UID custody pins were refreshed for the changed dependencies, the fixture API version is derived from its configured prefix, and the coarse-timestamp collision case is quarantined as skipped rather than treated as accepted behavior.

Validation

Coverage was added or strengthened for root-level token placement and mutation detection, pipelined Engine responses, canonical digest handling, and preservation of the no-rollback instruction.

The updated runbooks report a 122-test full suite with 120 passes and two existing UID-assignment skips, including five mount-normalization regressions. The UID custody plan separately reports 19 offline tests passing with fake daemon/wire responses and synthetic operator files. No production Docker operation, production rehearsal, or production mutation was run, and all production runtime routes remain disabled.

Open Review Findings

The automated review reported five findings that remain unresolved in the shown changes:

• High: The receiver source-capacity limit is duplicated as a literal in the activation controller.
• Medium: The UID custody test converts every evidence.check() failure into a skip, potentially hiding unrelated custody failures.
• Medium: The mounted-source controller may relabel inspection or command failures as post-replacement readback mismatches.
• Low: The runbook still states that the four collector tokens are created under /telemetry, contrary to the new root-level placement.
• Low: The new digest assertions validate the test fixture’s expected digest rather than independently verifying the implementation.

Production binary readers and mutation transports remain unwired. Production recovery, journal and custody evidence, real Engine archive acceptance, and sender/Sentry/Usage Monitor acknowledgement and ledger acceptance remain separate gates; cooperative compare/rename races, nonpreemptible kernel I/O, and the stat-only timestamp-collision boundary also remain open limitations.

---

Summary

This PR salvages the telemetry-hub offline lifecycle work for UM-1651 by correcting the Kimi/Zcode activation guidance and tightening rehearsal safeguards around receiver limits, custody integrity, and post-replacement failures.

• The activation runbook now documents the four Kimi and Zcode ingest/hub tokens under the root / scope instead of /telemetry.
• The controller now uses a named 64-source limit that is pinned to the limit implemented by otlp-receiver.mjs; the current receiver limit remains unchanged.
• Recorded dependency and reviewed-source digests were updated for the changed activation, mounted-source sync, and custody artifacts.
• Custody test handling no longer converts identity drift, unreadable receipt, or signature failures into skips; other stat-only residuals remain quarantined as skips.
• Mounted-source sync now adds the no-rollback reconciliation guidance only for confirmed host/container digest mismatches. Other post-replacement Docker failures retain their original unknown-state guidance to reconcile private receipts.

Test changes

• Added a receiver-capacity parity test that checks the controller’s source limit against the receiver implementation.
• Added a post-replacement command-failure test that verifies the original stop is preserved without the no-rollback instruction.
• Updated the custody test to re-raise identity, receipt, and signature failures.
• Updated the mounted-source test to remove an assertion that only rechecked the fixture’s own digest; the existing check that raw snapshot data is excluded from command arguments remains.

The supplied changes do not report test execution, deployment, or runtime verification.

Unresolved review findings

The automated review reported four findings that are not shown as resolved in the supplied patches:

• High: The custody dependency fence pins a digest of sync-mounted-sources.py from before its latest change.
• Medium: The runbook records stale SHA-256 digests for rehearsal artifacts.
• Medium: The quarantine re-raise list blocks the documented skip on custody strengthening.
• Medium: Post-replacement failures omit the no-rollback instruction.

---

Summary

Updates the UM-1651 Telemetry Hub offline lifecycle work so readback failures after mounted sources have already been replaced always direct operators to reconcile without rollback, avoiding a potential custody fork. The custody rehearsal remains hash-pinned, offline, and separate from production enablement.

Changes

• Updates mounted-source reconciliation so digest mismatches continue to identify a changed in-container snapshot, while other post-replacement readback failures are reported as unverified and retain their original cause. Both outcomes now prohibit rollback because the snapshot has already been replaced.
• Updates the existing post-replacement command-failure test to require the unverified-readback classification, preserve the underlying failure, and include no-rollback guidance without incorrectly claiming a content mismatch.
• Narrows the custody rehearsal test quarantine to receipt-related failures; identity-change and signature-mismatch stops now produce the documented custody-strengthening skip.
• Refreshes the custody dependency pin, the unarmed absence reader’s reviewed-source pin, and the runbook’s executor, test, and reader digests. The private exact-plan digest remains unchanged, and the lane plan remains redacted and intentionally fails the fence.
• Updates the rehearsal runbook with the refreshed artifact digests and the existing reported test evidence.

Testing

The runbook reports 17 offline custody tests passing in both the lane and private package, including fake success at 27 wire requests/three mutations and a separate unarmed five-wire absence readback. It also reports the top-level telemetry suite at 118 tests with 116 passes and two existing UID-assignment skips.

These are documented results rather than independently verified execution. The automated review’s outstanding low-severity finding notes that the runbook test counts conflict with the refreshed artifact digests, leaving the reported pass status for those refreshed artifacts unverified.

Boundaries and Remaining Work

Reported validation used fake daemon/wire responses, temporary operator files, and test-only UID metadata substitution; no chown, real socket, fixed RAM scope, or installed-daemon query occurred. The probe’s evidentiary scope remains limited to synthetic UID-10001 host custody. Independent review and a separate exact release remain pending, and no production gate is weakened or enabled by this implementation.

[linear-code]

AFC-618

UM-1651

[swu-wise]

@kody start-review - new head 0d9c37c repoints the uid-custody rehearsal pins at the top-level scripts (fixing the author-noted collection failure); please review the full salvage diff.

[swu-wise]

@kody start-review - second fix commit b904ccd makes the rehearsal fixtures deterministic (forced stat-signature delta in the custody rewrite test; explicit private-lane skips for the unmirrored cleanup manifest). Please review both fix commits on the current head.

[kody-ai]

Runbooks conflict on the current test count

offline-engine-runtime-review.md and kimi-zcode-activation-controller.md establish 118 as the current boundary, with 116 passing and two skipped, so labeling 113 as current sends reviewers to the wrong verification record. Preserve 113 as historical evidence and identify 118 as the current boundary.

Kody rule violation: Preserve verification records

Prompt for LLM

Runbooks conflict on the current test count

This runbook calls 113 tests the current boundary, but the linked runtime review and activation runbook both record the current boundary as 118 tests, with 116 passes and two skips. Conflicting verification records can send the next agent to trust the wrong test set. Preserve 113 as historical evidence and identify 118 as the current boundary.

Kody rule violation: [Preserve verification records](https://app.kodus.io/settings/code-review/global/kody-rules/115a575d-3700-4ec6-b6fa-d7518615f969?teamId=69360e3a-6b41-45d2-9e49-fde78fe49457)

​

[kody-ai]

Found critical issues please review the requested changes

• Mounted secrets are emitted through subprocess stdout

[swu-wise]

@kody start-review - head 1dc511d resolves the mounted-secret stdout finding: the container now emits only the snapshot SHA-256 and the host compares digests, returning the private host snapshot. ReadOnlyEngine also closes fully read responses for cross-runtime connection reuse. Suites green (138 passed, 2 skipped).

[swu-wise]

@kody start-review - head 0cbfd65 carries the three revised-finding fixes (receiver-capacity parity, runbook path, quarantine signal discrimination) with re-derived fence pins; please review this head.

[swu-wise]

@kody start-review

Follow-up review request for the new head 842de32: it addresses the medium finding on the post-replacement except Stop relabeling (now re-raises non-digest Stops unchanged, with a regression test) and the low finding on the vacuous fixture-digest assertions (removed, comment revised).

[swu-wise]

@kody start-review

New head cae17a9 addresses the four follow-up findings: post-replacement Stops keep the no-rollback guidance with the unverified-readback label, the PINS/runbook/verify-absence digests are regenerated from final bytes, and the custody quarantine re-raises only receipt failures.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

Jay