Protected work-client integration checkpoint

Report body

Protected work-client integration checkpoint

Date: 2026-09-12. Parent: bebd09b14fce6378059a408c5dcfbbda6d128a3c. State: local implementation and focused verification; not deployed, not whole-goal completion.

The preceding substantive goal turn made progress through native database restart/fallback evidence and resource primitives. The intervening rollback explanation and subagent acknowledgement were status-only, not engineering progress. This continuation rechecked the worktree, confirmed no earlier integration-test process remained, reran integration and corrected generation drift. No production rollback, deployment, restart or mutation occurred here.

Intake and implemented proof of use

Exact-hash review owners remain the strategy, protocol, boundaries and operations review reports, with originals in reports/input/v049-work-exchange-20260912/. This checkpoint implements selected operations-review G4/G5 requirements and protocol reliability recommendations. It does not verify all external assertions in those sources.

• scripts/concresca_work_client.py validates the actual wire contract over the existing Commons client: actor/scope/resource, original receipt/key and original event versus current projection. It returns an allowlisted body-free reference from one request, with no runtime import, new identity, store, automatic retry, artifact fetch or execution.
• scripts/concresca_work_controller.py holds exact HMAC-bound POST intents and cumulative accounting in the existing two-copy protected identity custody. Every physical attempt reserves fresh request/runtime capacity and saves unknown state before dispatch. Lost responses and save failures retain the original body/key and held exposure. Completed IDs cannot reset accounting. Withdrawal has separate reserved units/slots.
• scripts/concresca_autonomous_agent.py exposes optional configure/prepare/resume/status work methods and validates optional work state on load. Credential lifecycle remains separate; credential resume does not dispatch work. Authentication failure never authorizes replacement enrollment.
• Public source downloads and human/machine guides are generated together. The participant generator now preserves migration ordering and existing selected-memory review/source-boundary wording. The correction changes no migration SQL or server runtime behavior.

Main reviewed both delegated helpers and independently ran focused tests. Custody tests use fresh disposable directories only, never canonical WeaponizedAutonomy or prior live participant custody. HTTP-shaped integration calls enter actual owned WSGI/authentication/SQL handlers with SQLite as an explicitly synthetic database transport. Native Windows cases exercise actual machine-scope DPAPI, access restrictions and exclusive handles; others use the existing AES fixture backend. This is not native MySQL, Passenger or independent live-agent evidence.

Verification owners

scripts/test_concresca_work_client.py verifies strict wire binding and actual root workflow. test_concresca_work_controller.py verifies sealed save ordering, exact retries, cumulative bounds, Retry-After, credential guards and runtime-overrun halt. test_work_controller_owned_runtime.py covers real owned handlers and protected storage. test_work_client_public_contract.py verifies six download byte matches, no server imports, deterministic products, migration order, preserved wording and accurate API/cleanup/stage contracts. Existing test_concresca_work_budget.py, test_autonomous_agent.py, test_owned_work_root.py and test_owned_records.py remain regression owners. Final exact counts belong in the verification addendum below; previous narrower counts are not a claim about subsequent edits.

Direct integration demonstrated: no request before successful protected save; one committed effect after lost response or failed completion save; exact body/key after restart; withdrawal before replay remains withdrawn; revoked authority blocks dispatch without replacement identity; exclusive custody prevents competing dispatch; changed completed intent fails; two ordinary requests exhaust their pool while a reserved withdrawal succeeds; and saved references are explicitly historical. Correction/withdrawal independently reads canonical fixture state to confirm changed terms and then a payload-free tombstone.

Additional actual-handler tests exercise credential rotation while a committed work response is lost, established-proof same-identity recovery while work is prepared, and self-revocation while work is pending. The entire work state survives; rotation/recovery allow the same original request, while revoked authority cannot dispatch or recover. One rotation/work case also uses native Windows storage. These controlled tests are not actual ChatGPT acceptance or independent participants.

Review findings and open engineering

1. A definite non-401 HTTP rejection currently becomes work_attempt_unknown; pending remains occupied. Rejected-intent reconciliation/retirement is unimplemented. Do not retry automatically, edit custody, replace the key or bypass protected accounting. Protocol-level new requests do not establish an implemented controller recovery path.
2. Wire descriptors mark refusal/cancellation as cleanup, but the accounting pool covers only opportunity withdrawal and withdraw_terms, withdraw_delivery, withdraw_decision. Refuse/cancel use ordinary capacity. A reserve cannot bypass pending, halted or unauthorized state.
3. Twenty thousand milliseconds per physical attempt is conservative accounting, not a hard wall-clock transport cap or measured usage. An observed overrun halts dispatch without releasing exposure. Socket timeout is not total response deadline enforcement.
4. The configured task cannot yet be safely retired for subsequent tasks. Current-state GET/readback and credential lifecycle requests are unmetered here. Reconciliation, immutable retirement, metered reads/lifecycle and hard transport deadlines remain implementation gates.
5. Results describe the last verified response, not refreshed consent or authority. Receipt, truth, execution, payment and memory are separate propositions.
6. A read-only lifecycle audit found that work could consume lifecycle storage headroom and that the continuity summary considered historical 401 state instead of current credentials. These require bounded storage admission and current-state status fixes plus regression evidence; see the final addendum for their disposition.

These are open engineering requirements, not completion by labeling features unavailable. Broader source-rights/dependency handling, fallback work-retention maintenance, actual Passenger operation, responsive visual QA and public-doc-only production acceptance remain separate gates. The generic work helper does not close the existing ChatGPT connector goal.

Live and intake observations

At 2026-09-12T23:36:18.8156304Z, certificate-validated anonymous GETs of /api/concresca/readiness and /api/matm/commons/capabilities reported operational availability true, production readiness false, backend mysql and no workExchange capability. This is read-only observation, not deployed-byte attestation. Production was not changed.

Startup intake sync passed integrity: 16 active fully reviewed files, 718,981 bytes, 67 closed records, 83 ledger records. No source was removed. Reliability/resource records receive specific implemented proof and remaining actions; review or test counts do not close unfinished work. Both committed repository/root packages must use -wip.zip while mandatory gates remain open.

Next work toward the unchanged goal

Implement exact rejected-intent reconciliation and safe task retirement without losing unknown exposure or restoring authority; integrate metered readback and bounded transport behavior. Finish source-specific rights/dependency and release gates, publish the tested committed artifact, and run the useful public-doc pilot with disposable cleanup. Keep the full intake, usefulness, memory distribution, deployment and testing objective active.

Lifecycle audit repairs

The controller now limits work state to 64 KiB of custody-encoded JSON and requires 32 KiB of free space in the full 128 KiB envelope on each work save. Preparation sizes an actual projected first unknown attempt, its envelope revision and bounded completion allowance before accepting the intent. Oversized requests therefore fail without occupying pending state or consuming cleanup capacity. Each later attempt rechecks bounds. This is a defined allocation, not a proof of space for arbitrary future profile/principal growth, unrelated state or interrupted recovery chains; worst-case chain sizing remains a specific gate.

Continuity summaries now evaluate current local phase, pending lifecycle, expiry and current credential versus the previously rejected credential. A historical 401 remains separately indicated without publishing its credential ID. A legitimate active successor no longer appears blocked solely because of old 401 evidence; local terminal/revoked/expired states no longer appear ready. This is not a fresh remote /me check and does not imply revoked identities can recover.

Additional regressions cover both bounds before effects, custody-encoded Unicode expansion, current-state status boundaries, and rotation/recovery preserving a large pending request and unknown charge in real encrypted fixture files. These transport fixtures are distinguished from the actual-owned-handler lifecycle tests above.

A local PowerShell launch failed with System.OutOfMemoryException before running its requested commands. Subsequent no-profile shell startup succeeded; the machine reported roughly 850 MiB free physical memory and 724 MiB free virtual memory at that observation. Verification was kept sequential. No service failure, production mutation, test success or cleanup is inferred from the failed shell launch.

Final checkout verification

One sequential combined run using Python 3.14 completed 340 tests, zero failures/errors, zero skips in 64.674 seconds after the final controller admission/status changes. Counts by module: wire37, controller67, ledger48, autonomy39, actual-owned/custody19, public-contract8, work-root20, records15, owned-work58, existing-root20, UAIX-strategy9. Five of the19 integration cases used native Windows custody. No production network was used by these tests. Generated documentation/download parity is included in the eight contract tests; the work guide validates sixteen labeled fictional requests.

Intake remains incomplete with16active sources. This checkpoint is progress toward the unchanged goal, not independent acceptance or production readiness. Package extraction verification and exact ZIP checksums are recorded separately with the release artifacts so their identity is not circularly embedded in the commit that generates them.