channel-delivery-skic/FULL-PROGRAM.md

# Full-program responsibility consolidation

Authorization: Piotras Board approval, [full approved program](https://discord.com/channels/1518726359512387766/1546489551235588138/1563064779772526616), as cited by the coordinating task. This local consolidation and canonical dependency binding makes no remote/runtime write, commit or publication. `SIMPLIFICATION.md` remains the historical minimum record.

The subsequent `contracts-audit.md` authority report was read in full and the coordinating instruction adopted its mechanical A05/A06/A08 mappings and A17 chronology. Only A02/A04 remain unresolved policy choices; A17 later-resumption evidence remains a bounded discovery gap.

## Effective baseline and publication gate

The installed `development-gates` 1.1.0 entry and review/CI reference carry complete-job-inventory, required aggregate and single-attempt safeguards; installed `devsecops-ci-cd-gitea-aerosim` 1.2.0 plus pipeline/conventions/Harbor references carry candidate image/chart packaging and aggregate inputs. Those inspected installed packages are the effective baseline, not unpublished additions in sibling worktrees. A separate worker reconciles their source packages. Before publication/adoption, verify complete published owner packages include these safeguards and record immutable revisions; this local result does not claim that reconciliation, publication or runtime refresh succeeded.

Exact-worktree/process-CWD checks and API task/run/UI identifier distinction remain in planning reconciliation: the inspected owners do not yet fully carry them. Likewise exact-context preflight and base-image consumer/repair contracts remain here. No unmatched safeguard was removed merely because a destination seems plausible.

## Clause-level disposition

| Finding | Implemented responsibility / retained clause / bounded remainder |
|---|---|
| A01 | Gate reference loads `development-gates` and its review/CI contract at candidate/CI/merge/integration decisions; attempt integrity and integration mechanics delegated. Six gate codes, all required validation classes, reviewer bindings, state transitions, deployment and handoff exits retained. A02/A04-sensitive sequence clauses retained rather than silently rewritten. |
| A02 | **unresolved**: substantive push-versus-review order. Existing stage 3 steps 5–6 retained; empty kickoff visibility is not a resolution. Await separate exact owner/Board resolution before affected extraction or conflicting execution. |
| A03 | Existing reviewer override preserved: main runtime reviews its candidate; AeroSim active worker reviews, main independently verifies evidence/remote effects. No second review worker or human-review dependency introduced; packet verification is not independent code review. |
| A04 | **unresolved**: harmless-base-drift clause versus generic synchronize/re-review. Stage 4 steps 2–3 retained and conflict explicitly bounded; no new harmless-drift exception inferred. |
| A05 | Removed stale “when practical” exemptions. AeroSim runtime binds observed product-reason unit RED, minimal GREEN/REFACTOR, isolated unpublished-delta discard only, preservation of unrelated/shared/integrated work, forward repair and honest historical missing RED. RootAtSkic alone grants a documented exception; no retrospective compliance. Central retains the same bounded discard/shared-work safeguard with its own project-authority exception; the generic owner update is coordinated separately. |
| A06 | AeroSim worker contract now distinguishes durable coordination of the complete frozen wave from executable per-Task claims: ledger includes blocked/unadmitted members without promotion, one live worker per eligible Task, canonical documentation persistence, verified lock ownership and orphan recovery. Per-Task gate ordering preserves authorized independent parallelism. No new status/admission gate or invented schema. |
| A07 | Planning/status/pitfalls load exact gates/integrity owners instead of repeating checkpoint algorithms. Retain Task-row semantics, current versus historical admission, non-approval interpretation, wave header/all-Task chapter, gate codes, source destinations and duplicate suppression. Full validator/build and exact-worktree residual checks retained. |
| A08 | AeroSim binds one focused repair attempt or one hour (whichever first) to sole-executor evidence handoff to main, existing-domain-owner advice, same-gate safe forward repair and continued independent Tasks. Advice is not a second implementer/reviewer; worker replacement needs verified ownership loss and durable handover. Central generic role mapping is coordinated separately; no project authority broadening. |
| A09 | AeroSim Actions reference is now overlay + exact CI owner/reference loads, not three duplicate workflow trees. Retains exact workflow names, all-app/code/image/chart/aggregate outcomes, credential and UAT boundaries. Runtime publication mechanics route to that owner; chart/GitOps integration bindings remain. Publication-ready owner verification is a hard prerequisite, not an assumption from sibling source edits. |
| A10 | Already resolved; preserve Delivery static/build-time artifact validations and candidate image/chart packaging. All functional non-unit suites remain UAT-owned; E2E never installs Helm or builds/publishes images. |
| A11 | Exact Task-release/unpadded-attempt branch naming, early visible PR, card links where applicable, `test` base, title equality and standing AeroSim merge delegation preserved. Generic branching cannot overwrite these project policies. |
| A12 | Board remains sole shared-login owner with decision-point load and fail-closed behavior. Specialist recovery load remains; exact own-account delegation, all stricter preconditions, transport interlocks, code guards and three-layer readback retained byte-identically. Recovery publication provenance remains unverified; no invented repository mapping. |
| A13 | Replaced repeated dataset/NFS/PV recipe with mandatory `home-v1--truenas` + `references/gondor-retained-application-storage.md` load before storage work. Durable non-deleting storage, environment isolation, approved authority and deployment-readiness remain. Selected Gondor skill and both AeroSim fallbacks retained; canonical GitOps, compatibility alias and generic base are installed and skill_view-tested by the parent, source `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`. No live StorageClass assertion. |
| A14 | Gate preflight now loads the one retained runtime preflight. Runtime loads scripts/monorepo owners for repository-root execution and committed versions. Task/cache isolation, every execution context and repository-native complete validation retained. AeroSim nested-pnpm recovery routes to its verified documentation owner; central fallback retained because global same-name source identity is unresolved. |
| A15 | Domain coverage remains Delivery-owned: five Ways of Working and five Engineering sections, verified not aspirational practice. Decision-point Docusaurus/Glossary loads own authoring/build/term mechanics. Removed duplicate synchronization enumeration in favor of entry/planning owners; no new documentation helper. |
| A16 | Duplicate evidence/toolchain pitfalls become owner loads. Retain project lock-holder verification and complete base-image contract including credential-free candidate checks, trusted publication, immutable digest consumption and last known-good forward repair. No CI-owner ownership of that unmatched contract asserted. |
| A17 | Authority audit found original RootAtSkic hourly/60-minute requests (1546990225669234820, 1550892376900509817) and explicit stop (1552094167901937676). AeroSim entry replaces unconditional scheduling with conditional mechanics and a versioned approval/stop/resumption record. Later bot-reported reconciler 6777dc7d3d82 does not prove reauthorization or current inventory; bounded resumption evidence remains outstanding. No scheduler mutation or unauthorized-job finding. See entry chronology for exact links. |
| A18 | Eight-channel wording corrected in AeroSim gates; authorized channel boundary unchanged. Worker cache diagram no longer places Playwright/PostgreSQL under Delivery. DEV tuple, UAT verdict and verified separate Releases-channel handoff remain distinct; no `DONE` or release authority moved. |

## Verification contract

Tests precede content edits. Whole-file hashes for intentionally thinned references are replaced with checks of exact protected clauses plus semantic routing/outcome tests, not with deletion of safety coverage. Unchanged metadata, authority blocks, self-recovery source and delegation guards retain original hashes. Run every test module (including standalone `main()` scripts), the recovery tests with their declared websocket dependency, local Markdown-link validation and `git diff --check`. Report local results only; no repository CI or publication is implied.

## Original consolidation verification result

- Command: `/opt/hermes/.venv/bin/python tests/verify_full_program.py` — **21 checks passed**, including standalone test functions/main scripts that unittest discovery alone misses.
- Local operational Markdown links: **29 resolved**; `git diff --check` passed.
- Entry + all references: **80,924 → 76,537 bytes** (4,387 fewer). References alone: **57,907 → 53,520 bytes** (4,387 fewer). Audit records and tests excluded; new authority chronology/mappings are included. This is a measured reduction, not a dramatic token-saving claim.
- Plain system Python lacked `websockets`; the existing Hermes venv supplied it. No dependency installation or runtime skill update was performed.
- No remote CI/publication, live deployment, scheduler or account mutation was attempted. Required dependency publication readback and A02/A04 owner choice remain coordinating gates.

## Canonical dependency acceptance update

The parent reports merged and installed owner packages: `development-gates` at `02e716ddff053c71a921839419ed2bd2334f1e67`, `development-integrity` at `3ca0fbb284b5eb194ad5ff1f2756f1fde0077c6a`, `development-method-ttd` at `d3d91be7bb2926b0f1bd16db60c0fe2250ed8d39`, and `development-durable-wave-execution` at `a180018ef3bc337bb1fbabd095fa7a4e13471fc5`. This supersedes their earlier pending reconciliation description above; it is coordinating evidence, not a runtime action performed here. GitOps canonical `development-gitops-argo-cd-home-gondor-v1`, alias and generic base were installed and skill_view-tested by the parent at source `7ceb741c5fecbe34eb06e10a72e3ae26e3cc6f14`. Conditional fallbacks remain for unavailable future installations. Other canonical owners are being published by the parent; no unverified publication success is inferred. Legacy source URLs and historical records remain provenance, not additional owners. `corp-v1-glossary` remains unchanged pending the public-to-private repository decision. A02/A04 still await human resolution.

Canonical-binding verification: see [naming-delivery-review.md](naming-delivery-review.md) for the subsequently executed complete standalone harness results and unchanged golden-hash strategy.

## Final bounded owner consolidation

This supersedes the earlier A14/A16 statements that reusable preflight/base-image mechanics lack an owner. Delivery retains the project bindings and outcomes; only the matched mechanics moved. A02/A04 and their golden clauses remain unchanged and unresolved.

| Moved reusable clause | Exact source-owner section |
|---|---|
| version resolution, executable/version comparisons | `development-scripts/references/runtime-preflight.md` — Required inputs; Procedure 1–2 |
| presence-only environment and repository identity/state checks | `development-scripts/references/runtime-preflight.md` — Procedure 3–4 |
| same-context activation, inheritance failure classification and complete retry | `development-scripts/references/runtime-preflight.md` — Procedure 5; Failure and repair |
| image folder/metadata, digest/tool/platform/user/workspace/trust assertions and lockfile parity | `devsecops-ci-cd-gitea/references/base-images.md` — Construction and static contract |
| credential-free candidates and isolated trusted publication | `devsecops-ci-cd-gitea/references/base-images.md` — Candidate isolation and trusted publication |
| full-source tags, direct Harbor readback, immutable retry and aggregates | `devsecops-ci-cd-gitea/references/base-images.md` — Immutable publication and direct readback |
| digest consumer verification and forward repair mechanics | `devsecops-ci-cd-gitea/references/base-images.md` — Consumer verification and forward repair |
| negative trigger/tag/secret/interpolation/digest/setup regression cases | `devsecops-ci-cd-gitea/references/base-images.md` — Fail-closed regression matrix |

Immutable CI-owner acceptance: source `669e28eadfe79ac7cb3c10ccdea318dd5296d481`; installed/source base-image reference SHA-256 `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`, independently compared locally. `owner-responsibility.json` covers both callers. Scripts source was inspected at HEAD `5960d5e74713e6b95a403962f479b2b97cb76286`, with reference content SHA-256 `07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462`; the content hash, not HEAD alone, identifies the inspected working-tree contract. Scripts semantic reconciliation/publication/install remains a parent gate before Delivery publication/adoption. Record the final immutable published revision and source/runtime equality there; no pending result is claimed here.

Retained locally: every foreground shell/worktree/background process/worker/main review/CI context, stop-on-failed-preflight, selected Task containment/repository/revision/namespace and allowed command scope, complete repository CI, trusted `test` branch and named project base-image repository, immutable consumer evidence, separate UAT acceptance, forward repair and last known-good digest. All unique project chart/runtime/storage/recovery boundaries remain unchanged.

Test manifest: `tests/owner-consolidation-manifest.json` preserves inspected owner text/hash and exact clause-to-section moves. Only the two intentionally moved runtime section hashes are retired into that manifest; semantic regression checks replace them. All unrelated golden hashes and canonical identity normalization are unchanged. New tests first failed on missing decision-point loads in both packages, before content edits.

## Published owner adoption checkpoint

The final preflight owner is `global-skills/development-scripts` at `0e36552938da94c0539e39b35256b8effe34c25d`; the base-image owner is `global-skills/devsecops-ci-cd-gitea` at `669e28eadfe79ac7cb3c10ccdea318dd5296d481`. Both complete packages were authenticated-readback verified and installed byte-for-byte. The preflight hash is `07306382b8afe5c2d2e83e2955a04a1523d008e7e39cead7c7a1797bb6640462`; the base-image hash is `1fb0e24ec5789b195be9ae35fbb9529fa1cab56112dae5baf9455284ca490e53`. Earlier preparation-stage pending-owner statements above are historical and superseded by this checkpoint. Generic scripts preserves the existing Home/SKIC adoption body in a scoped reference; it does not silently replace the adopted bootstrap convention. No remote CI was configured for these two owner repositories; local contract tests and independent source review passed. This checkpoint resolves the owner-publication prerequisite only, not A02/A04, scheduler reauthorization, remaining organization visibility or other-project adoption decisions.