[AyobamiH]

Current native CI delivery — 21 October 2026

Signed source is delivered on this PR; native Cloudflare activation is not yet accepted. Current head: 1f9053b7748a9edb6b5ff4e436f39c355dfe60f2. GitHub verified the owner signature. No merge, production recovery deployment or release publication was performed.

The three existing isolated Pages projects were read back with no configuration drift, no deployment and automatic builds disabled. The source now contains pinned Node 22/24 Linux job manifests, exact-commit/base checks, isolated child environments, bounded process cleanup and static engineering receipts. Existing required check providers remain unchanged until genuine native execution and matching check identity are accepted. AgentProof's real macOS requirement remains separate and unproven.

Repository root checks passed for all three source candidates; shared runner fixtures pass 34 cases and Pages admin fixtures pass six. The corrected full OpsTruth local runner completed verification, deterministic maintainer review, release-verifier tests and the high-severity dependency audit on exact commit 5313fce23b7b20b78c8a5a2c0d9bcedac4ba549f, using pinned Node 24.22.0. This is local engineering evidence, not a hosted Cloudflare result. Its initial extraction failure is retained; the corrected bounded extraction and phase diagnostics are recorded.

Actual activation blocker: a fresh read-only Cloudflare capacity-inspection invocation was refused by the execution tool's safety check before any Cloudflare response. No native build was triggered and no required-check rule was relaxed. This is not evidence of missing Cloudflare infrastructure or a requirement to pay GitHub billing. Resume with the permitted capacity readback, one exact-head native run and independent deployment/receipt/check readback, then the reviewed provider-policy transition and separate macOS coverage.

Canonical E-141 checkpoint and delivery/test evidence preserve the source, failures, outcomes and precise continuation. Ledger rendering, documentation closure and 40 CI/admin fixture cases passed for the final DoneState change. PiHarness remains deferred, and original-release acceptance remains PENDING.

Earlier PR description and historical checkpoints

Problem

GitHub run 39124373253 published the disposable release once, then failed at independent receipt signing with public_readback_unavailable. The original completion freshness window expired. Recovery must finish observation and evidence without creating another publication attempt.

Changes and resulting behavior

• Add private named ReleaseRecovery.observe() and ReleaseRecovery.sign() bindings, gated by explicit run/transaction/workflow/completion/authorisation pins and disabled by default.
• Validate the stored completed publication, original signed grant and permanent fence before fresh GET-only observation. Store a separately signed five-minute readback sidecar without changing the original execution record.
• Require the distinct receipt signer to perform its own public readback before first issuance. Preserve original Receipt V2 semantics, receipt identity, execution timestamps and idempotent retrieval.
• Bound metadata reads to 64 KiB and 12 seconds, retain safe provider status/rate-limit diagnostics, and classify transient body/RPC failures for durable retry.
• Record the accepted deterministic Cloudflare Durable Objects strategy and defer PiHarness in the existing direction/status/decision documentation.

This branch includes the diagnostic work from #23; that PR remains open until a successful coordinated merge. Existing production services remain disabled.

Owner and boundaries

Human project owner: @AyobamiH, who explicitly approved this recovery implementation and documentation on 2026-10-20.

The original release, workflow d74a0d6c6b712d3ecfb428997f24d264175c20c1, five identities, namespaces and publication fence remain unchanged. Missing or ambiguous execution evidence blocks. There is no new publication authority, workflow rerun, key rotation or npm publication.

Validation

• Root npm run check: passed (76 core and 20 script cases).
• Release-provider suite: 21/21 passed, including transport, stalled-body, immutable-evidence and idempotency regressions.
• Both Wrangler dry builds passed.
• Actual workerd named binding reached the original SQLite fence path, refused a missing predecessor and returned public HTTP 404 for the private route.
• Final cross-service fixture recovered after an injected outage and reconstruction between stages to DoneState VERIFIED, with the original completion intact and zero publication requests.
• Separate final peer review found and fixed two transport availability edge cases.

Delivery status

Related OpsTruth #44 required CI could not start: GitHub reported an account billing lock. Required checks must pass before merge; no protection bypass or live recovery deployment has been attempted. Canonical acceptance remains PENDING under DoneState AGENTPROOF-001.

This PR's observed CI refusal

GitHub returned the same account billing lock for this exact head, 704f10d78e63707834fcec002a76b97aafe76071: validate (ubuntu-latest, 22), run 39456984167 / job 118746319199. The required job did not start. The local checkout is clean and its tree exactly matches the GitHub commit. Coordinated controller and canonical evidence: DoneState #201.

[AyobamiH]

@codex review

Please review the complete recovery change at exact head 1f9053b. Focus on the original release/run/transaction/workflow and five trust roles, immutable completion and receipt identity, fresh signed observation, GET-only independent readback, private RPC boundaries, replay/fencing and refusal paths. The native Cloudflare Linux manifest has passed on this exact head; independently read deployment 9dd74aca-6f9c-4307-9fdb-794f85b894dd and GitHub App 85455 (Cloudflare Pages) corroborate it. Existing branch requirements remain unchanged, and real AgentProof macOS coverage remains separate and unmet. This requests source review; it does not claim release acceptance or authorise another publication.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T12:03:02.700825Z	1f9053b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 1f9053b774

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".