[mark-e-deyoung]

Stacked source-only draft after #556. Offline Go file-staging primitive and negative tests. No merge, no deployment, no decryption or provenance promotion. Research authority: Search Adapters #240.

[mark-e-deyoung]

MCP GHA continuation (2026-10-27): ciphertext-only paired ingestion candidate is staged in stacked public DRAFT PR #557 (base #556), head 8180f0b. Native public GHA run 40557631029 SUCCESS (Go race -count=3, vet, build, read-only historical run observation). Offline Go stagePair preflights two independent arm receipts, snapshots exactly five fixed metadata/ciphertext files in a mode-0700 private directory as 0600 files, verifies copy, commits by same-filesystem rename, fsyncs directories, handles identical replay and rejects conflicts, symlinks and unexpected files. Go checkNativePairMetadata reads official pinned GitHub REST run/jobs/artifacts and checks source, attempt, successful arm jobs and nonexpired distinct artifact IDs; tested with HTTP test doubles, NOT with live retained pair artifacts. Native negative tests include stale attempts, altered SHA, duplicate/expired/wrong artifacts and conflicting concurrent stages. Intermediate source/test mismatch produced native failure run 40557041235, corrected; final run 40557631029 green. All changes source-only, no private host reached, no age identity decrypted, no actual stage from live GitHub artifacts, no real CPE projection or blind comparison. PRs #555, #556, #557 all remain drafts/unmerged. Next required: independently admitted workset/assignment, real GitHub-native artifact read and protected retrieval, approved private key custody, authenticated intake and durable DLE writeback before Stage P. Source design: https://github.com/SemperSupra/agent-dispatch/blob/feat/mcp-gha-private-ciphertext-stage-20261027/docs/mcp-gha-ciphertext-custody-mvp.md ; qualification https://github.com/SemperSupra/agent-dispatch/actions/runs/40557631029 .

[mark-e-deyoung]

2026-10-27 NEXT READY executed — true GitHub artifact upload/download/re-stage for dual synthetic arms

Current source and owner gates: Public runner draft PR #555 remains unmerged; read-only controller draft PR #556 remains unmerged; stacked custody draft PR #557 on branch feat/mcp-gha-private-ciphertext-stage-20261027 remains unmerged. No protected keys, no use of private GHA minutes, no release/deploy/merge, no genuine CPE-derived queries or blinded Stage P.

Authoritative native receipt: GHA run 40562713367 3/3 jobs SUCCESS. Reference job 122395739738 produced native artifact 12760379376, name mcp-gha-artifact-test-reference-40562713367-1; CPE-labelled job 122395740256 produced native artifact 12760628947, name mcp-gha-artifact-test-cpe-40562713367-1. Third job 122396260895 independently fetched GitHub native job and artifact metadata, resolved 2 unique native IDs, downloaded both ciphertext/receipt packages by exact artifact ID, checked byte-accurate receipt/ciphertext hashes with Go, staged the five files to a restricted local directory, then replayed and received IDEMPOTENT_CIPHERTEXT_ALREADY_STAGED. Positive markers: MCP_GHA_REAL_NATIVE_TWO_ARM_JOB_ARTIFACT_IDS_RESOLVED and MCP_GHA_GENUINE_GITHUB_ARTIFACT_DOWNLOAD_AND_CIPHERTEXT_STAGE_PASS. Connected GitHub artifact listing independently verified both IDs with 23,996/23,624-byte archived artifacts, nonexpired at observation and associated with run 40562713367. One-day retention; no long-term private archive.

Real provider path and split source custody: Each physical GHA VM ran fixed EN/DE/TH synthetic search queries through pinned Docker SearXNG and age-encrypted locally; only result.age + sanitized receipt.json uploaded. Age identities were disposable VM-local, never archived. Workflow source was PR #557 revision d0505fb; collector source was independently pinned from draft runner PR #555 at 330c65f. Because the test intentionally composes two distinct source revisions, it does NOT satisfy the intended production one-source native provenance contract. Both source roles must be independently frozen/admitted, or integrated into one reviewed source tree before private artifact re-intake. Qualified real GHA artifact transfer, NOT secure private ingestion or science.

First failures and fixes: First attempt 40561808435 attempted to invoke Stage R source absent from stacked staging PR, so both worker jobs failed before upload. Corrected via fixed SHA-checkout of actual Stage R source, preserving revision identity. Second run 40562235141 had both arm jobs SUCCESS and resolved two native artifact IDs but aggregator failed on download path: pinned download-artifact v4.3.0 expanded an extra nested directory. Corrected by pinning official download-artifact v8.0.2 full SHA 9000827ccba6bdab643e8b6fd33ac0654aef8333, which downloads by ID to the requested path and treats digest mismatch as error. Native third run 40562713367 PASS.

Proof limit: private vault host was never used; the ingest/stage sandbox in GHA runner was ephemeral and destroyed on job exit; no durable private ciphertext owner custody, legitimate CPE projection, CPE identity/projection signatures, decryption or blind comparison. The post-hoc synthetic manifest is not an authorized independent assignment; matching hashes are only local-byte consistency. Do NOT mark INGESTED/VALIDATED. GitHub native artifact retention is 1 day in this qualification.

Next READY: Independently review PR #557 + #556 + #555, reconcile composite-source provenance without inventing SHA authority, qualify trusted host/capability admission for immutable native artifact download and stage, secure owner-controlled age identity/public-recipient distribution and durable DLE writeback, then separately qualify real frozen independent reference and authenticated CPE treatment. Full tested source+limitations in docs/mcp-gha-ciphertext-custody-mvp.md on PR #557; current docs head ae61bce (post-success documentation only). Preserve all owner approval gates.

[mark-e-deyoung]

Qualification recheck after documentation update: native 40563237325 ALL THREE JOBS SUCCESS at PR #557 HEAD ae61bce (reference 122397565698, CPE-labelled 122397565380, ID-based download+Go pair stage 122398505317). Native artifact listing confirms unexpired reference ID 12762535029 and CPE ID 12762415171, 1-day retention. The read-only contract run 40563237381 also SUCCESS. Both synthetic artifacts/keys remain entirely out of private custody; composite source and genuine CPE holds remain unchanged.

[mark-e-deyoung]

2026-10-28 parallel public GHA qualification — executed, verified and handed off

Live authority: public read-only PR #556 is MERGED on main. Public runner PR #555 remains DRAFT/UNMERGED (last observed head b582adffef09255e2d3bf00b5746d3f073a807bb). Public ciphertext custody PR #557 remains DRAFT/UNMERGED, base main, now head 19fdb30165df3e8a6a2907c3786a443fff452c2c, ahead 50/behind 0, 11-file review diff. No merge, release, private-hour spend, protected data transmission, credential or recipient configuration.

Work EXECUTED, no background assumption: Added .github/workflows/mcp-gha-parallel-custody-qualification.yml to #557 with four independent fresh standard ubuntu-24.04 public GHA jobs (no write token, exact SHA-pinned checkout): matrix 3x standalone Go-race negative controls (-count=12 each; admission/pair/receipt, concurrent ciphertext stage/replay/symlink, native GitHub + composite provenance); plus fourth independent static policy auditor (pinned actions, no Actions write, no secrets expression, synthetic single-day artifact retention). All jobs fail independently (fail-fast:false, max-parallel:3). Existing real two-arm reference vs synthetic CPE hosted workers and dependent artifact collector remain in parallel with these jobs. Added public three-audience method/evidence in docs/mcp-gha-parallel-public-qualification.md.

First failure: native parallel 40629498974 returned 3/3 Go workstream jobs SUCCESS, policy auditor FAILED because "secrets." not in body matched the audit script's own string literal—not any real forbidden Actions expression. Corrected to pattern-match actual YAML permission records and GitHub secrets expressions rather than its own source. No relaxation of public-only/credential controls.

Final native proof, corrected source 3208aa92246fa5f4aa9cd107bfdab2c513161620:

1. Parallel test wave 40629592489: 4/4 jobs SUCCESS, three repeat/race workstreams and one independent policy auditor, simultaneous on public GitHub-hosted VMs.
2. Actual two-arm synthetic transport 40629592463: reference, CPE-labelled, and ID-based re-download + restricted local ciphertext staging 3/3 jobs SUCCESS. Exact native artifacts unexpired at observation: reference 12790807229 (24,854 bytes), CPE-labelled 12790453635 (24,502 bytes). GitHub artifacts are one-day synthetic retention, not durable private custody.
3. Existing read-only Go/source qualification 40629592460: standalone Go race/vet/build, actual native observation SUCCESS.
4. Documentation-only follow-on PR MCP GHA two-arm ciphertext staging qualification #557 head 19fdb30165df3e8a6a2907c3786a443fff452c2c does not change the successfully executed code/workflow from 3208aa92.

Disposition: PUBLIC_PARALLEL_4_OF_4_GREEN / SYNTHETIC_GHA_TWO_ARMS_PLUS_COLLECTOR_3_OF_3_GREEN / READONLY_CONTROL_GREEN / FIRST_POLICY_SELF_MATCH_FIXED / PRIVATE_DURABLE_INGEST_NOT_OPERATIONAL / REAL_CPE_AND_BLIND_STAGE_P_NOT_RUN. Standard public GitHub-hosted runners are $0 for standard public repos; do not use larger paid runners, private GHA hours, or confidential source. Neither age encryption nor separate GHA VM is confidential computation. Persistent age public recipient/approved private identity, independent source rights/admitted workset, real native provenance and private host/decrypt/ingest, independent reference and true CPE treatment remain separate owner/merge/deployment gates. Preserve existing holds.

Next READY: Independent review of #557 11-file diff, eliminate redundant CI where feasible without losing distinct negative controls, then compose a bounded trusted-private-host ingest with owner-controlled vault; test complete run/artifact/assignment integrity and recoverable storage, only with approved private authority. Do not promote synthetic results to scientific evidence.

[mark-e-deyoung]

2026-10-28 concurrent public/private custody reconciliation — public hardening executed, private exact-head admission held

Authoritative GitHub state: public SemperSupra/agent-dispatch PR #556 MERGED on main; public dual-track PR #555 still DRAFT/UNMERGED, last observed head 862ef9dda674c44227a3f1ec473a350f143756a2; public ciphertext PR #557 still DRAFT/UNMERGED (tested code head 1ac6f0808ad570bf93d6f1fc01daaddd1d1bc6b9, docs-only continuation 952cac2ad9515a96937d40889d175226d0d0bf98, base main, currently 13-file review diff); private Agent Dispatch host-only inner verifier PR #701 exact head f40f57fb2599be47530c6525a49a9d7e91b0a09a DRAFT/UNMERGED.

Independent parallel public GHA execution, real receipts: Public #557 source changed in bounded Go stage/receipt/manifest/verification seam. Old path Lstat/noSymlinkFile → os.Open/ReadFile permitted file substitution or FIFO hang after pathname check. Added Linux-specific FD open O_NOFOLLOW|O_NONBLOCK|O_CLOEXEC, bounded one-link regular-file checks, post-read fd inode/size/mtime/ctime and pathname consistency. Added TestPinned* negatives for symlink/FIFO/hardlink/oversize/path replacement, append and same-size mutation. Four independent Go-race negative workcells (-count=12 each), one independent public Actions policy auditor, read-only regression suite and two actual public synthetic SearXNG arm workers plus native-artifact collector all executed in separate standard public Ubuntu GHA VMs.

• Native 40643819633: 5/5 jobs SUCCESS: admission/pair, staging/concurrency, native provenance, FD substitution negative tests and policy.
• Native 40643819591: 1/1 SUCCESS: full read-only Go/race/vet/build + native historical observation.
• Native 40643819606: 3/3 SUCCESS: reference and CPE-labelled synthetic SearXNG, age ciphertext upload, read-only GitHub ID resolve, two-arm ciphertext stage/replay. Native artifacts observed unexpired, one-day retention: reference ID 12796711806 (24,848 bytes); CPE-labelled ID 12795684839 (24,521 bytes). Public test age identities remain disposable/never uploaded. No private decrypted results or real CPE.

Scope and red-team limitation: FD binding reduces malicious symlink/path-swap/FIFO/hardlink risks for local Go read, but not all directory/mount attacks, an authenticated publisher signature, or immutable source rights. Public GHA is not confidential; no protected prompt, rights-limited source, live private identity, private decrypt, or blind experimental oracle entered public CI. A synthetic CPE-labelled arm still is NOT genuine CPE-projected treatment. Native GitHub green != private INGESTED or scientific VALIDATED.

Separate private PR #701 frontier: Source-only host-only verify-mcp-gha-stage-r-pair.py uses its own FD checks and staged-copy age decryption, and reports DECRYPTED_LOCAL_INNER_CONSISTENCY_ONLY_NOT_INGESTED. Existing legacy private conformance run 40638101845 PASSED 164 unrelated tests but did not execute test_mcp_gha_stage_r_pair.py. Its current exact-head eight-case private suite is still NOT_RUN. Do NOT copy the private source or keys into public GHA or spend private GHA minutes without a sanctioned placement. The remaining REQUIRED admission is a bounded trusted private executor (sovereign host or separately approved sealed cell) to run exact-head eight offline tests without age key; record native receipts, first failures and DLE baton before any decryption.

Parallel lanes still useful:
A) public source/security review and CI for PR #557 / evolving runner PR #555 on standard public GHA;
B) independently admitted private executor placement + exact eight private offline tests for PR #701 (no public-source cross-copy);
C) private owner approval of immutable native assignment, persistent age public recipient and sovereign key-vault host; no secret or key creation initiated here;
D) after A/B/C gates, genuine two-arm reference vs authenticated CPE projection and postfreeze independent Stage P under Search Adapters #240 / CPE #229.

Current hold: NO draft merges, deployment, credential changes, private-minute expenditure, true CPE ingestion or scientific validation performed. Full public qualification record in docs/mcp-gha-parallel-public-qualification.md PR #557. NEXT HIGHEST-RETURN: private task-specific admission/executor placement for exact-head PR #701, then official native provenance and persistent ciphertext-custody round trip; avoid more redundant synthetic transport tests.

[mark-e-deyoung]

2026-10-28 bounded continuation — parallel public custody correction and adversarial native artifact join

Discover/Observe: Reconciled live public Agent Dispatch PR #555 (DRAFT, unmerged, head 862ef9dda674c44227a3f1ec473a350f143756a2), merged read-only PR #556, public custody #557 (DRAFT/unmerged; exact tested code f7f747f9d48cfaf4ef25f3a0f0d6383023c852de; documentation-only follow-up c0f86289073204541f0d2b7fe24c95c9724a33d1), and private #701 (DRAFT/unmerged, f40f57fb2599be47530c6525a49a9d7e91b0a09a). Checked Search Adapters #240, private Agent Dispatch #485, #701, #700, #110 and CoS admission notes. Existing private Sidecar caller denial in #110 is an effective admission hold; did not attempt another delegation, authorization escalation or private dispatch. The private #701 eight focused tests remain NOT_RUN on an admitted private executor; old green conformance selects zero of them.

Parallel source-only APPLY on public PR #557: Identified a specific remaining race: after Lstat(target) reported absence, ordinary Linux os.Rename(tmp,target) could overwrite a concurrently created empty destination directory. Introduced Linux-only renameDirectoryNoReplace() using renameat2(RENAME_NOREPLACE), qualified syscall numbers for amd64 and arm64, and fail-closed on unsupported arch/syscall. Updated stagePair to use this no-overwrite atomic primitive, retaining repeat-identity conflict and idempotence checks. Added negative Go tests for occupied empty destination, 12 concurrent distinct writer winner exclusivity, and already-occupied stage identity. No external dependency or write token.

Independent parallel real-artifact adversarial qualification: Updated existing public synthetic mcp-gha-artifact-lifecycle-qualification.yml to run a two-worker collector matrix, accept and tamper, after two separate reference/CPE-labelled Stage-R provider VMs complete. Each independent collector resolves actual GitHub job/artifact IDs and downloads the two encrypted synthetic archives from native IDs. Accept tests committed ciphertext and exact replay; tamper collector changes one CPE ciphertext byte and requires stage rejection with empty destination. Neither job writes private keys, real CPE plans, secret queries or protected evidence. All work on standard public hosted GHA.

Native VERIFY receipts on exact source f7f747f9d48cfaf4ef25f3a0f0d6383023c852de:

• Public parallel race + source-policy GHA run 40730371641 5/5 SUCCESS (Go -race -count=12 in four independent workcells plus policy auditor).
• Read-only full Go/vet/native observation 40730371627 1/1 SUCCESS.
• Native SearXNG real synthetic two-arm and dual parallel collector run 40730371605 4/4 SUCCESS. Reference job 122964736044, synthetic CPE job 122964736660, tamper collector 122965426719, accept collector 122965426820. Native proof marker MCP_GHA_NATIVE_ARTIFACT_CIPHERTEXT_TAMPER_FAIL_CLOSED. Short-lived GitHub encrypted synthetic artifacts: reference 12834688346 (25,037 bytes), synthetic CPE 12834288490 (24,560 bytes), both nonexpired at observation with one-day retention.
• Prior first-pass three-job run 40730068720 and five-job race 40730068479 also SUCCESS; final combined-head receipts supersede for current code. Not a secret recipient/decryption test.

Three audiences: Human reviews native matrix runs, source difference and DLE; automation uses typed Go arm/pair/native/ciphertext stage and fail-closed status codes; agents observe via existing project-native Agent Dispatch worksets, with no newly created controller or unauthorized source projection. Public stage is still not trusted private INGESTED or scientifically VALIDATED. FD-safe local reads and Linux no-replace mitigate filesystem races but do not authenticate owner admission, source rights, or complete malicious mount/ancestor directory control.

Next baton / holds:
(1) Preserve draft review/merge holds for #555 and #557 and inspect inter-PR source merge/ancestry before activation; #557 now has ~15 changed paths (including docs, tests and Linux syscall primitive) and requires independent source/security review.
(2) Owner-approved private executor placement for exact-head #701 focused eight-case test without private GHA minutes or public source copying. The previously recorded Sidecar caller rejection is not permission to guess alternate worksets.
(3) Independently freeze authentic reference and private CPE treatment, source rights, immutable assignment and persistent age public recipient/private host vault. Then native artifact ingest/decrypt with trusted receipts and atomic private storage; Stage P later. No auto-merges, private credential creation, release, deployment or scientific acceptance performed.

Disposition: PUBLIC_NO_REPLACE_RACE_FIX_NATIVE_PASS / GHA_PARALLEL_ACCEPT_TAMPER_COLLECTORS_4_OF_4_PASS / PUBLIC_RACE_POLICY_5_OF_5_PASS / READONLY_GAUNTLET_PASS / PRIVATE_701_EXACT8_NOT_RUN / PRIVATE_INGEST_AND_TRUE_CPE_NOT_ADMITTED. Public detailed report: docs/mcp-gha-parallel-public-qualification.md on #557; project-native source and DLE own all decisions.

[mark-e-deyoung]

Source-level review: two bounded public negative-test opportunities (2026-10-29)

In the unmerged public Go custody source, tools/mcp-gha-control/pair.go::readPairPlan uses encoding/json.Decoder.DisallowUnknownFields but no duplicate/case-alias rejection before typed decode. Source-free Go 1.23.2 reproduction confirms both repeated exact schema keys and the case-variant schema/Schema form decode successfully and select the last value. This is a parser-differential risk / missing negative test, not proof of bypass of the subsequent v1/v2 fixed-policy validation. Reuse the already qualified duplicate/case-fold JSON field scanner from the separate public synthetic PR #559, subject to independent review; include nested alias, unknown-field, and v1↔v2 no-promotion tests. Do not merge or activate from this observation.

Separately, the public Stage-R source in draft PR #555 computes each hit derived_hash over unescaped url + ':' + title + ':' + snippet. Two distinct triples with colon-containing fields can have identical hash preimage bytes without any SHA256 collision. Treat current field as non-authoritative metadata; propose a versioned length-framed/canonical structured hash with historical v1 preserved and independently verified Go golden vectors, rather than silently changing existing receipt identities.

Both are public-safe synthetic/source-only reviews. No protected CPE source, private DLE, secret, private code, live dispatch, merge or deployment was sent here. Governing task-specific DLE remains with its existing owner.

[mark-e-deyoung]

2026-10-29 pinned-input correction at exact head 0e7eae7

A local review reproduced TestPinnedRegularDetectsPathSwapAndChangedInode/same-size-edit failing on prior head c0f8628 despite hosted green. Metadata can retain the same size/time values after an in-place write. The current source captures a bounded SHA-256 digest from the pinned descriptor and compares it after the consumer read, while retaining inode/path checks and the original file offset.

Offline Go 1.26.2 container, network disabled: go test -race -count=10 ./... PASS, then full go test -race -count=3 ./... and go vet ./... PASS in tools/mcp-gha-control. Public hosted CI for the new head is still pending observation. This remains synthetic/source-only custody; no protected recipient, private decrypt, native artifact join, CPE acceptance, or Stage P authority is implied.

[mark-e-deyoung]

Public synthetic-source qualification (updated after Unicode simple-fold falsification), 2026-10-29. Draft PR #557 head 9338b012b7e92788b669131ab1a5043eb8dce59e: 32-depth bounded recursive predecode scanner rejects exact, ASCII case, Unicode-escaped and Go strings.EqualFold aliases (e.g. schema / long-s ſchema), plus trailing JSON. Per-object key count capped at 64, existing 32KiB file bounds and strict typed checks retained. A source-only independent Go 1.23.2 probe showed encoding/json accepts that long-s alias while strings.ToLower equality does not; added discriminative negative test, not a claim of exploited release. Native standard public Actions 40919208403 5/5 parallel race/policy SUCCESS; 40919208073 full read-only Go PASS; 40919208040 4/4 synthetic two-arm/independent accept-tamper collector PASS. No private data, identity/key, privileged admission, scientific validation, release or merge.