Build Log

Prove the Acceptance Boundary Is Real

August 29, 2026

Traced the actual authority sequence for an Owner Loop candidate, found and closed the one gap that mattered (production deploy could happen before acceptance), and stopped there.

Owner LoopAcceptance BoundaryMedinaCHFOS Engine

unresolved questions answered with mechanical proof

real production-authority gap found and closed

regression tests, 0 failures, across the whole session

Timeline

Start

Charge received

Prove the acceptance boundary is real — three specific unresolved questions, explicit instruction not to extend the architecture unless evidence requires it

Traced the real authority sequence

Found promote-medinachf.mjs (production deploy) had zero acceptance gate — the Actor could deploy before any acceptance decision existed

Q1 fix

Closed the one real gap

Extracted shared classification logic, added it as promote-medinachf.mjs's own Precondition 3, verified live against the real fe93be33 specimen

Confirmed existing Layer-2 evidence is adequate

tsc --noEmit + live production curl, already independent, already reused — nothing built

Exercised accept-pending-candidate.mjs end-to-end

Real accept decision recorded durably even though the git-promotion sub-step correctly refused (base_diverged)

Stop

Wrapped — no further architecture pursued

Second gap (in-band deploy/resolve authority sequencing) surfaced by Zeb's wrap instructions, found to already be closed by the Q1 fix; reconciled honestly rather than silently accepting the stated framing

What shipped

forgekit-os/scripts/acceptance-signals.mjs — extracted the independent consequentiality-signal derivation (DERIVED_SIGNAL_PATTERNS, computeDerivedSignals) out of derive-and-accept-candidate.mjs into its own shared module, so a second caller (promote-medinachf.mjs) reuses the exact same logic instead of a divergent copy

forgekit-os/scripts/promote-medinachf.mjs — added Precondition 3: refuses to deploy a commit carrying a consequential derived signal unless a prior human-acceptance record exists for that exact commit SHA (resolved to the full 40-char SHA, not the literal argument text — a real bug found and fixed during live proof)

.github/workflows/actor-spawn.yml — writes a new, non-secret pre-run-sha reference file (same directory as the existing credential files) so promote-medinachf.mjs can diff against the correct base

forgekit-os/scripts/dispatch-owner-loop-requests.mjs — Charge template's Authority section now tells the Actor what a consequential-refusal from promote-medinachf.mjs means and what to do (write terminal result, stop — do not retry the deploy)

forgekit-os/scripts/derive-and-accept-candidate.mjs — refactored to import from acceptance-signals.mjs; no behavior change

forgekit-os/observations/pending-acceptance/ (ephemeral, not committed) — two real, live proof records generated and read this session against actual specimens (f0398ffc, fe93be33), preserved to scratchpad for the record, removed from the tracked path as ephemeral runtime state, same as last session's disposition