Implementation Notes

Parent-owned execution record for the approved direct plan. Issue #215 is the context issue; T1-T12 remain planning-only execution identities and do not map to provider Tasks.

Execution and Reconciliation

Summary

CI provenance correction: workflows 35185839278 and 35185839490 checked out PR merge commit a223bdb4602ad70d7aa15f158d872b60ec86d339, whose tree 0eb4a6d09f989fa0278cb4b968977f1e6bfe9a5a is identical to head commit 3928e1de91c7ec4539a5e0fed04d1f83f764b512. Their retained results are therefore merge-tree-equivalent evidence, not exact-head execution. Provider-retained artifacts are Cache Witness IDs 10482585836, 10482252258, 10482242221, and 10482197428, plus Behavior Contract tree artifact 10483835411.

• Earlier trusted runs 35169090936 and 35169496396 remain historical producer/consumer evidence under evidence/cache and evidence/cli; their own executable identities and conclusions are retained, not relabeled as final-build evidence.

• The historical full local suite (67/68 files, 722/723 tests, and 75/76 portfolio tests; SHA-256 8710300cc46295cb7263e8cbc88d99ee1066a91f2228206fc699585e5d80fe40) is diagnostic only. Exact repair commit 3928e1de91c7ec4539a5e0fed04d1f83f764b512 produced final CLI SHA-256 e1c9bdf97ce2e502492794e1a91c98e074799c2dbe913185077b50ddb60f931a.

• The repaired 10-sample lifecycle proof /tmp/issue215-lifecycle-cacheoff-repair.json has SHA-256 a2f793ef714bf23536680caefd44230144aede428ab46cf310726c5019dcd215, failures: [], and cleanup: true.

• The final repair fails executable-config inputs closed as uncontrolled-validation-inputs, so lint runs fresh rather than reusing an under-represented result. Candidate children strip cache/signing/publication credentials while retaining required package-manager registry/Git authentication; package-manager/executable identity is content/capability based, not raw-PATH based.

• Cache Witness 35185839278 is terminal merge-tree-equivalent success on 3928e1de91c7ec4539a5e0fed04d1f83f764b512: all four jobs passed, downloaded artifacts confirm the final CLI digest and final macOS evidence, and the later consumer recorded 44 Linux and 13 macOS GETs. Behavior Contract 35185839490 is also terminal success on that head; root static, trusted affected verification, and stable aggregate all passed.

• Delivery resumed cold from approved commit 8686550f4a342a9ebfbec5325fbc9b3216307706.

• Implementation branch: team/stefan/issue-215-manifest-driven-update.

• No provider-task lifecycle mutation applies; no product release or publication is authorized by this plan.

• T4's post-GREEN simplify pass derived JSON-mode state once and narrowed progress rendering without changing behavior; its focused suite and aggregate typecheck remained green.

• T6's post-GREEN simplify pass ordered readiness denials and consolidated single-line validation; its 8-test policy suite remained green.

• T1 initially exposed only reconciliation reuse; parent review kept its gate open. The repair added desired-output reuse before planScaffoldOutput, with independent settings, topology, managed-state, relevant-input, and generation-option invalidation. Its post-GREEN simplify pass consolidated snapshot hashing/freezing.

• T3's post-GREEN simplify pass merged duplicate cache-port signatures and extracted structural identity comparison; filesystem and policy checks remained green.

• T5's post-GREEN simplify pass consolidated fixture cleanup and removed an unused CI subprocess wrapper; identity and restoration checks remained green.

• T2 initially proved bounded copying but still accepted arbitrary executable-config I/O and could under-represent a contained directory symlink. Parent review held the gate open. The repair now accepts only a bounded declarative lint-config subset, rejects unproven executable behavior before subprocess execution, and reports required directory symlinks as typed unsupported inputs. Its post-GREEN simplify pass factored the bounded parser operations.

• T7 added a provider-neutral signed v8 transport using the pinned Turbo 2.9.14 HMAC contract and the updater's own envelope/hash domain. The adapter fails closed on authority, redirect, signature, digest, inventory, transfer-bound, timeout, and interruption problems; local/cold fallback remains feature policy. Its post-GREEN simplify pass consolidated response classification and the bounded transfer lifecycle.

• T8 initially reused complete validation but keyed it partly by raw PATH and executable locations; parent review held the gate. The repair uses executable-content/runtime capability identity, preserves semantic CI/NODE_ENV/TZ, and keeps dynamic environment-driven configurations fresh. Candidate children preserve dependency registry/Git authentication while cache/signing/publication credentials are excluded. Its post-GREEN simplify pass centralized credential filtering and removed duplicate restoration state.

• A3 built-runtime evidence exposed two bounded candidate gaps after T8's original gate. The repair now inventories complete contained directory-link targets (including generated .claude/skills aliases), keeps missing/escaping/cyclic/special targets typed failures, and emits phases only at actual candidate execution boundaries. A second focused repair accepts grouped trusted-preset expressions such as (core.ignorePatterns ?? []) through the existing depth-bounded declarative grammar while grouped calls, ambient reads, dynamic imports, and I/O remain blocked. The repaired four-suite surface passed 114 tests in worker evidence; the parent cumulative run later covered the same behaviors.

• T1's A3 repair moved generation-input evidence collection out of update/run.ts and into the shared scaffold boundary. The bounded collector observes nested authored scopes, configuration/lock inputs, local assets, and contained generated links; unclosed evidence disables reuse. Invocation-local reuse removes repeated generation/materialization while retaining the metadata observation needed to detect new nested guidance.

• T4's A3 contract repair adds a fixed-code local updater cache-clear fact to progress and final results. It reports scope: local, namespace: updater, and explicitly retains remote artifacts without exposing provider diagnostics.

• T9 now composes the shared resolved plan, fresh managed/generation witnesses, filesystem cache, optional signed remote transport, cache bypass/clear, and readonly live-tool readiness through the existing platform boundary. It rechecks live evidence immediately before validation, avoids install/bootstrap on ready unchanged runs, forwards actual phase events even when legacy output is disabled, and preserves recovery, adoption, and receipt authority.

• T9's production fixture adopted 389 planned / 386 completed file operations, wrote a successful 335-entry receipt, repaired controlled prompt drift, then produced a zero-change repeat with no install or lint phases. Local cache clear emitted one matching event/result while explicitly retaining remote artifacts. The fixture receipt SHA-256 was 1bb46b1af77f184b4b49b0596fef3bc6a0418428ed3b8284d648cc6d84d2de8e.

• T10's final Linux evidence uses the retained immutable baseline and a fresh built CLI. Identical warm inputs preserve findingCount=903, all 20 published diagnostics, truncation and warnings while executing zero install, lockfile, patch or lint operations. Source/configuration/lock/settings/workspace changes validate fresh; matching corruption rebuilds; configured remote failure reports transport-unavailable and safely executes two installs/two lints.

• A4 local proof exposed and repaired bounded integration defects without weakening acceptance: precise required-special-file diagnostics, irrelevant delivery/cache pruning, canonical-root pinning, separate configuration references, runtime prepared-installation envelope decoding and limits, and exact allowlisted propagation of TURBO_API, TURBO_TOKEN, TURBO_TEAM, and TURBO_REMOTE_CACHE_SIGNATURE_KEY without outputting values.

• T11's local witness and policy surface passed 19 tests / 212 assertions. Provider metadata confirms actor dev-6868, canonical team slug dev-punks, team id team_0QvyOroTH1I7k8hWMqSRCOqH, OWNER membership, and remote caching enabled. Local capability remains authentication-missing; only trusted PR CI may close provider restoration and macOS proof.

Deviations From the Plan

• The implementation worktree was detached at the approved commit while the prior planning branch remained checked out in another worktree. A new isolated branch with the exact plan-authorized name was created here; no commit or user change was reset.

Surprises and Decisions

• The available Bun runtime is 1.4.0 rather than the plan discovery observation of 1.3.5. The lockfile install is frozen; runtime identity must remain part of cache evidence and cross-runtime reuse must miss unless equivalence is proved.

Sanity Checks

| T10 local built-command proof | pass locally | 2 Issue 215 portfolio tests, 7 preservation/safety tests, 16 before/current samples, 10 lifecycle samples, 3 platform samples, and 8 final recovery samples passed. Final post-team-ID-repair build SHA-256 28f905b551b7906d782283a43de2b28534923124c1e7952f63ec35e5e618e850; trusted macOS readback is retained in run 35169090936. | | T11 local witness proof | pass locally | Witness, cache identity, and trust surfaces passed 19 tests / 212 assertions. Local capability is explicitly authentication-missing; no provider artifact restoration is claimed before trusted PR CI. |

Skill Application Evidence

Worker Task Results populate one row per unchanged implementation_skill_guidance entry before the corresponding Task Gate can pass.

Architecture Conformance Evidence

A1 boundaries (T1-T6) -> A2 cache execution (T7-T8) -> A3 composition (T9)
  -> A4 public/provider proof (T10-T11) -> A5 documented closure (T12)

A1 ownership and dependency view

CLI command/presenter ──> scaffold-update public contracts
                                │
              ┌─────────────────┴─────────────────┐
              v                                   v
  scaffold-state + scaffold/output      runtime/scripts
        shared desired plan                 │       │
                                            │       └──> Validation Candidate resolver
                                            └──> validation-cache ports
                                                        ^
                                                        │ public contract only
                                      filesystem adapter┘

Turbo identity launcher ──> package-owned tasks
trusted cache action ──────> signed provider boundary (access proof remains T11)

A2 delta: runtime ──> cache ports <── filesystem adapter / signed remote adapter
          candidate children exclude cache/signing/publication credentials

A3 delta: runUpdate ──> shared resolved plan + fresh witnesses
          platform ──> local cache / optional signed remote / readonly readiness
          completed operations ──> adoption ──> receipt publication

Conclusion: A1–A3 match the approved ownership topology and dependency direction; no undeclared seam or migration blocks the recorded local/PR proof.

UI Evidence Links

No UI surface is changed by this CLI/cache plan.

Runtime Validation Evidence

| T10 | Built hi update lifecycle, safety, recovery and output | Run retained baseline/current CLI against isolated disposable consumers | Baseline SHA-256 6503971a…f84ac5; earlier 28f905b5…e850 reports retain their identity; final CLI SHA-256 e1c9bdf9…f931a | Prove exact outcomes, warning replay, zero-work warm reuse, invalidation, recovery and cleanup without timing thresholds | Focused repaired 10-sample lifecycle has failures: [] and cleanup true; final macOS reports are indexed; merge-tree-equivalent Behavior Contract 35185839490 passed | Owned fixture/cache roots removed; candidate residue empty; retained baseline preserved for comparison | RAC-9 evidence met; A4 blocker is T11 matrix only | | T11 | Shared-cache witness and provider authority | Run harness locally, then trusted same-repository PR producer/consumer/later-run jobs | Cache Witness 35185839278; a PR merge tree identical to head 3928e1de91c7ec4539a5e0fed04d1f83f764b512 | Attribute signed PUT/GET/restoration for Turbo and updater artifacts without exposing credentials | All four jobs passed; downloaded artifacts confirm 44 Linux and 13 macOS GETs plus final CLI/macOS evidence | Isolated local roots removed; provider artifacts rely on retention and are not globally cleared | PR witness complete; actual main/release and authenticated local↔CI matrix pending |

Final evidence corrections

CI readback

Behavior Verification Evidence

Visual Evidence Acceptance Map

No visual product evidence applies to this CLI/cache implementation.

Acceptance Criteria Status

Manual Review Checklist

Pre-existing Issues

• Historical readiness failures from planning did not reproduce: the current and retained pre-change CLI distributions both built.
• A pre-PR secret scan found expired tracked JWT fixtures in apps/api/.tmp/api-production.env and apps/backoffice/.tmp/backoffice-production.env. Both files are byte-identical to base 1ee7f8b7, so Issue #215 neither introduced nor changes them; their values were not printed.

Out of Scope Observations

• The inherited expired JWT fixtures remain repository security hygiene outside Issue #215.

Superseded closeout snapshot

• T12 documentation is complete: source runbooks describe the manifest-driven update contract, isolated candidates, cache modes/clear scope, progress, trusted-witness boundaries, and inherited hook limitations. Exact wiki runbook mirrors were regenerated from those sources. Documentation does not close parent architecture evidence.
• The later trusted run 35169496396 selected producer 35169090936, made zero PUTs, performed 44 isolated-Linux and 13 isolated-macOS GETs, matched exact artifact/output digests, and retained normalized evidence. The parent must now perform cumulative A4/A5 architecture, requirements/standards, graph, migration-ledger, and release-classification review. Closeout remains without publication unless separately authorized.

Remaining Work

• A4 is blocked only on the actual post-merge main/release and authenticated local↔CI matrix after completed PR producer/consumer/later-run proof. Cache Witness 35185839278 already succeeded on the exact repair head in all four jobs.
• Behavior Contract 35185839490 is terminal merge-tree-equivalent success; no PR-head behavior gate remains.
• A5 documentation and migration-ledger work is complete and follows A4. Docs-ingest remains a verified no-op because this folder has no SPEC.md; ingested: false and last_ingested: null remain unchanged, and no wiki log/routes/meta change is needed.
• Closeout includes no release or publication claim.

Steering