implementation-report · RPT-2A54C0E5FACA

Workspace custody audit — 2026-09-05

Research method, source claims and publication

The public copy has safety redactions: {'local_path': 8}. The original hash above identifies the private original, not this derivative.

Source identity

Record
RPT-2A54C0E5FACA
Original file
v048-workspace-custody-audit.md
Original SHA-256
5b4e2b4faf8b1695edf83ac1e719d81c6435727a57d8b26a7b72a359ca0c86c7
Source family
original-implementation-reports
Public copy SHA-256
fc3cfa9001321b25a520a32342c5b6fed5050c4b08ceb6960be214b6628cba64
Original custody
Exact bytes retained in the private project package under docs/_evidence/; not a public download.

Read the public source-text copy

Disposition and proof of use

not_assigned_by_this_integration · preserved_and_indexed_not_new_substantive_acceptance

Memory owners: .uai/file-handoff.uai, .uai/report-synthesis.uai, .uai/research-review.uai. These are private repository records, not public web routes.

Jump to a report section

Report body

Workspace custody audit — 2026-09-05

User concern: unprocessed intake, undocumented source copies and delayed commits. This inventory does not authorize indefinite retention of every copy. No folder was deleted, moved, repointed or used for new source copies in this audit.

Source and check-in

Concresca's canonical checkout is [PRIVATE LOCAL PATH], origin MichaelKappel/Concresca. Public MATM's canonical checkout is [PRIVATE LOCAL PATH]; its ownership remains separate. Private MemoryEndpoints is outside this audit and was not modified.

The 33 verified Concresca runtime/test/dependency/status paths waiting for check-in are now commit 05f7391dc9c7aa27f010c3aa37d0d8a19915865d. All 24 intake reports and both unfinished machine-controller drafts were excluded. Focused evidence is in V048-WIP-STATUS.md; this is not a completed release or live-deployment claim. No source copy was needed for the check-in.

Folder inventory

Location Evidence Current disposition
[PRIVATE LOCAL PATH] 23-path pre-change snapshot plus manifest: 24 files, 5,887,164 bytes; base 8dd2f9f. Historical-diff reconciliation pending. Not an editing authority; no further snapshots here.
[PRIVATE LOCAL PATH] Portable MariaDB, exact MATM extractions/archives, isolated test databases/TLS fixtures: 4,270 files, 1,835,270,552 bytes. No active process command line referenced it at scan. Retained privately, not packaged/uploaded. Earlier fixture deletion was denied by the host; do not bypass that denial through another shell/tool. Cleanup unresolved.
[PRIVATE LOCAL PATH] Registered clean detached Git worktree at 2afd0b0534d95044fac8564e3c7749f7d378257e: 482 files, 14,963,652 bytes. No active process command line referenced it. Candidate for coordinated Git retirement, not raw deletion. Recheck dependencies first.
[PRIVATE LOCAL PATH] Active scheduled task working directory and source of PID 23108 on port 8088. Do not move/delete while referenced. Restore health and reconcile layout through a bounded runtime handoff.
[PRIVATE LOCAL PATH], 5077d563b251, a0eb8a52f717 Older runtime releases, not independent editing checkouts. Check rollback/dependencies before retirement.
[PRIVATE LOCAL PATH], packages Runtime backup/package material. No content copied into Concresca and no credentials disclosed; retention unresolved.

Sizes are point-in-time file-length sums, not disk allocation. Lack of a command line reference does not prove absence of open handles or rollback dependencies. Public Git also lists two detached temporary worktrees under the local temporary directory. Their retirement requires Git/ownership checks too. Concresca itself lists only its canonical worktree.

The other active source owner confirmed no ownership or ongoing work in these three E: folder groups and confirmed the active runtime must not move. This Concresca task owns the local recovery/test material and its retention cleanup. New source copies are paused.

Health caveat

Presence of the LAN service does not prove it works. The other owner reports sqlite_unavailable and failed protected reads at deployed 2afd0b0. The release directory is an active dependency, not a healthy-service attestation. Neither private production nor LAN service was restarted in this audit.

Workflow correction

  1. Edit canonical source only. Before another sibling recovery/gate/release or alternate source directory, record its purpose, owner, revision, lifecycle and separately coordinated need. This audit grants no such exception.
  2. Test temporary state is not source authority. Keep credentials/databases out of Git, packages and public roots. Do not relocate private fixtures to a web root.
  3. Check in each verified bounded change after exact staged-path review; do not wait for a multi-day release. Exclude unfinished drafts from unrelated commits.
  4. Before removing intake, record the source hash, substantive disposition, owning destination, proof and removal state. Inventory/archive-only transfer is not processing. Pending reports remain explicitly unfinished.
  5. Retire a live runtime only after verified replacement, rollback checks and governed task repoint. Retire registered worktrees through Git after clean and owner checks. Do not delete shared folders merely to make them disappear.

Outstanding: review 23 reports; reconcile recovery snapshots/fixtures; retire unused worktrees/releases safely; restore protected coordination; complete WIP package/deployment gates. This audit does not close those tasks.