Build Log · October 20-21, 2026
Software Requests Releases 1-3 for MedinaCHF, data changes, and an Actor that no longer judges itself
Reconstructed from commits on 2026-10-23; no transcript. Oct 20 to Oct 21 afternoon. MedinaCHF's requests became a conversation and then an inbox; the Actor can propose data changes; anything outside an app's own folder goes to a person; and the Actor now runs on a machine with no authority to accept its own work.
- Owner Loop
- MedinaCHF
- Reconstructed
- open MedinaCHF requests found waiting on a coordinator who had never been told (oldest 52 days)
- 5
- Software Requests releases shipped to MedinaCHF (conversation, inbox, Ready to try)
- 3
- chained HIGH findings an independent review found in the trusted-judge split, all fixed before relying on it
- 3
open MedinaCHF requests found waiting on a coordinator who had never been told (oldest 52 days)
Software Requests releases shipped to MedinaCHF (conversation, inbox, Ready to try)
chained HIGH findings an independent review found in the trusted-judge split, all fixed before relying on it
Timeline
Oct 20 08:30
Kelly's sign-in
Logins linked to members at sign-in, serialized per login; one login links to at most one adult (unique index, production checked first)
Oct 20 17:45
Alloy R4
Alloy reads a request's text through the read-only login
Oct 20 20:20
Release 1
Every ForgeKit message kept; a reply starts ForgeKit at once; the requester is emailed when ForgeKit waits on her
Oct 20 21:10
Data changes v1
Format and executor, org-fenced; the Actor proposes a data change instead of saying it can't; audit findings fixed
Oct 20 23:10
Out-of-scope candidates
A candidate changing anything outside its own app goes to a person, before any classifier
Oct 21 08:30
Releases 2 and 3
An inbox with short answers; Ready to try, Looks right / Not quite, honest closes
Oct 21 10:50
Trusted-judge split
The Actor job holds no authority; review findings fixed; proven by live probes
What shipped
products/medinaCHF account linking: d245c7cd (link at sign-in), 499284b0 (serialized per login in one transaction), 73dfcba5 (unique index adults_one_adult_per_login, created by SQL after confirming 0 duplicates), ea2865fe + 431f0bf3 (confirm before switching a member to an existing sign-in; plain message on a race)
d0d26aed: Alloy reads the owner's request text through the read-only login (R4)
Software Requests Release 1: ba92a9f9 (a trigger keeps every ForgeKit message; a reply starts ForgeKit at once), a03755a9 (conversation, follow-ups on finished requests, View all), 1a4bd50d (email the requester when ForgeKit waits on her), 5ed97bab (audit findings: atomic follow-up), 937671cf (trigger fills requester_email whatever path created the request)
Owner Loop data changes v1: 5894359c (format, executor, and a 'waiting on you' only when the message asks something), 8b8f4259 (only the request's own organization), 441751c2 (the Actor proposes data changes), 40c39345 (log table upgraded in place), c2f9d0d3 (audit: undo could delete RSVPs and claims, timestamp checks and undo never worked, a change could assign authority or reach another org — fixed, rehearsed on a throwaway copy)
e671e9ed: a candidate that changes files outside its app, terminal result or Charge is parked for human acceptance for every app, before any classifier runs
Software Requests Releases 2 and 3 for MedinaCHF: 8c330ca3 (inbox grouped by who moves next, short answers), 76947bab (Ready to try, Looks right / Not quite, Closed automatically never reads as confirmed), 40aaeae9 (Looks right confirms only a request that is Ready to try)
65cf6fb7: actor-spawn.yml split into spawn-actor (no authority: read-only token, no deploy token) and a trusted judge; f4314b06 closed three chained HIGH review findings (renames hiding deletions, among them); probes d6b1dc5f and 2516cea8 showed the Actor's writes to forgekit-os refused, its push refused, and an out-of-scope commit parked under Gate A