Framework install machinery for the wake component (EPIC #892 W7, the last
build slice). ADDITIVE per #869: adds an `install.sh --component wake` early
dispatch that never enters the full-framework sync, never alters
framework-manifest ownership behavior, and touches nothing the #869
install-ordering-guard covers (no runtime-asset linking, no lease-enforcement
hook wiring).
(i) Idempotent component-manifest install + Gate A (wake-install.sh install):
the wake manifest.txt is VERSION METADATA ONLY; the component file set is
INTERSECTED-AND-VALIDATED against the single SSOT framework-manifest.txt.
A candidate the SSOT does not own is REFUSED fail-closed with no partial
write. Re-running writes zero files (no diff).
(ii) systemd/user/mosaic-wake.service — the long-lived detector daemon
(detector.sh run). Per-class SLO lives inside the daemon, not a systemd
interval; it is a SERVICE not a timer, so blank-reset does not apply.
(iii) blank-reset idiom on the legacy mosaic-heartbeat@<agent>.timer cadence
drop-in during the §5 overlap->retire lifecycle (empty OnUnitActiveSec=
reset before the new value => exactly one OnUnitActiveUSec), with a
reset->verify->retire acceptance path (retire LAST, only on §4-vector pass).
(iv) snapshot-guard — a reap/clean-checkout of a deployed unit is REFUSED
without a prior snapshot (the deployed-from-uncommitted failure class).
(v) fail-closed alarm-target + HMAC-key install-validation (G1/G2a): the
operator W6 alarm sink must be configured + reachable and the W3/W7 HMAC
key must resolve BY NAME; missing/unreachable => FAIL LOUD. The installer
ships/writes NO endpoint value and NO secret, and echoes neither.
Red-first harness test-wake-install.sh (6 groups) wired into test:framework-shell;
Gate-A parity extended to prove bash+TS both resolve the wake component paths
framework-owned. wake component manifest bumped 0.5.0 -> 0.6.0.
Part of #892
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
Separate, clearly-labeled commit for observation set (vi) from the #910 review.
The HMAC-verify half is a non-trivial blast radius (emit must sign, record must
verify-and-bind), so it is isolated here rather than expanding the installer diff.
Both changes are additive and backward-compatible (the legacy unsigned path and
emit_ts fallback are preserved when no key is configured).
(vi-a) Monitor-side ingested_ts: `record` stamps the monitor's own receive-time,
and `check` computes staleness from ingested_ts (falling back to emit_ts
only for a legacy record). A host shipping a far-future emit_ts to defer
its own staleness can no longer fool the off-host dead-man clock.
(vi-b) Beacon HMAC-verify at record: when a key name is configured
(WAKE_BEACON_HMAC_KEY_NAME / WAKE_HMAC_KEY_NAME), `emit` signs the beacon
core via the existing sign.sh sign-digest path and `record` verifies via
sign.sh verify AND binds the envelope to this beacon (content_hash ==
sha256(core), seq/emit_ts match). A spoofed or unsigned beacon is REJECTED
fail-loud and never advances the received clock. Key is by-name only —
beacon.sh inlines no key material.
test-wake-beacon.sh extended with B11 (ingested_ts staleness) and B12 (HMAC-verify
+ spoof/unsigned rejection); test-wake-install.sh gains I7/I8 for the same
invariants. Both harnesses shown red-first under targeted mutation, then green.
Part of #892
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
Substance review: independent subagent ac499d45 (opus, ≠ builder mosaic-coder) at prior head ce53b0e646fc231632187cf50a171ba764abff3a → APPROVE, all 9 criteria PASS, verified against runtime (not narrative): (1) scope/provenance; (2) idempotent component-install + Gate A two-pass no-partial-write, wake manifest authorizes nothing, parity 17 green; (3) mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); (4) blank-reset single-cadence retire-LAST on --vector-passed; (5) snapshot-guard fail-closed no-bypass; (6) fail-closed install-validate, HMAC key by-name never echoed + alarm reachability, no inlined secret/endpoint; (7) W6 hardening — monitor-side ingested_ts staleness + beacon HMAC bind/verify; (8) #869 additive, install-ordering-guard untouched (19 green); (9) gates. 4 red-first reproduced RED→GREEN: I2 (Gate-A de-authorized-path), I4 (snapshot-guard bypass), B11 (ingested_ts far-future), B12 (beacon HMAC spoof).
Delta-re-review (MS-LEAD, independent diff):ce53b0e..fe923a59 = exactly one commit, a 4-line change in test-wake-beacon.sh only — an if ! command -v openssl; then echo SKIP; else <unchanged B12 subshell>; fi guard mirroring the W3 digest-HMAC harness. It touches NO beacon/installer logic and NO assertion; with openssl present B12 runs byte-identically to the reviewed head. Therefore the ac499d45 APPROVE carries. Builder-verified both paths (openssl-present: 12 groups pass; openssl-masked: B12 SKIPs, 11 groups, rc=0); full test:framework-shell rc=0; shellcheck clean; firewall clean.
Trust-layer CI note (honest, tracked)
B12 (beacon-HMAC) now SKIPs in CI because the CI image lacks openssl — consistent with the existing W3 digest-HMAC skip. The HMAC logic is independently verified locally (ac499d45 reproduced B12 RED→GREEN with openssl). CI-hardening to exercise BOTH legs (add openssl / hard-require-in-CI, keep dev-skip, pre-vector for §4 G6) is tracked as issue #912 per Mos order.
Non-blocking follow-ups (reviewer)
(a) component-install ships the test harnesses into the runtime dir — taste, follow-up (Gate-A permits; framework-owned). (b) pre-existing SC2115 at install.sh:584 — untouched by this PR.
6-check — GO on CI terminal-green
open/not-merged/mergeable base main ✓ · 2. CI terminal-green @ full-40 fe923a59775a541831fe4b24c1c357763f0f513a(pending — confirm green before stamp) · 3. reviewer(ac499d45)≠builder + MS-LEAD delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all fe923a59 ✓ · 5. body Part of #892 (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge. GO for id-11 + merge at FULL-40 fe923a59775a541831fe4b24c1c357763f0f513a on CI terminal-green. Non-executor.
# Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892)
**VERDICT: APPROVE** — GO on CI terminal-green. **REVIEWED-HEAD (full-40):** `fe923a59775a541831fe4b24c1c357763f0f513a`.
## Review basis (substance carried + delta-re-review)
- **Substance review:** independent subagent `ac499d45` (opus, ≠ builder `mosaic-coder`) at prior head `ce53b0e646fc231632187cf50a171ba764abff3a` → **APPROVE, all 9 criteria PASS**, verified against runtime (not narrative): (1) scope/provenance; (2) idempotent component-install + **Gate A** two-pass no-partial-write, wake manifest authorizes nothing, parity 17 green; (3) mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); (4) blank-reset single-cadence retire-LAST on --vector-passed; (5) snapshot-guard fail-closed no-bypass; (6) fail-closed install-validate, HMAC key by-name never echoed + alarm reachability, **no inlined secret/endpoint**; (7) W6 hardening — monitor-side ingested_ts staleness + beacon HMAC bind/verify; (8) **#869 additive, install-ordering-guard untouched (19 green)**; (9) gates. **4 red-first reproduced RED→GREEN: I2 (Gate-A de-authorized-path), I4 (snapshot-guard bypass), B11 (ingested_ts far-future), B12 (beacon HMAC spoof).**
- **Delta-re-review (MS-LEAD, independent diff):** `ce53b0e..fe923a59` = **exactly one commit, a 4-line change in `test-wake-beacon.sh` only** — an `if ! command -v openssl; then echo SKIP; else <unchanged B12 subshell>; fi` guard mirroring the W3 digest-HMAC harness. It touches NO beacon/installer logic and NO assertion; with openssl present B12 runs byte-identically to the reviewed head. Therefore the `ac499d45` APPROVE **carries**. Builder-verified both paths (openssl-present: 12 groups pass; openssl-masked: B12 SKIPs, 11 groups, rc=0); full `test:framework-shell` rc=0; shellcheck clean; firewall clean.
## Trust-layer CI note (honest, tracked)
B12 (beacon-HMAC) now SKIPs in CI because the CI image lacks openssl — **consistent with the existing W3 digest-HMAC skip**. The HMAC logic is independently verified locally (ac499d45 reproduced B12 RED→GREEN with openssl). CI-hardening to exercise BOTH legs (add openssl / hard-require-in-CI, keep dev-skip, pre-vector for §4 G6) is tracked as **issue #912** per Mos order.
## Non-blocking follow-ups (reviewer)
(a) component-install ships the test harnesses into the runtime dir — taste, follow-up (Gate-A permits; framework-owned). (b) pre-existing `SC2115` at install.sh:584 — untouched by this PR.
## 6-check — GO on CI terminal-green
1. open/not-merged/mergeable base main ✓ · 2. CI terminal-green @ full-40 `fe923a59775a541831fe4b24c1c357763f0f513a` **(pending — confirm green before stamp)** · 3. reviewer(`ac499d45`)≠builder + MS-LEAD delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all `fe923a59` ✓ · 5. body `Part of #892` (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.
**GO for id-11 + merge at FULL-40 `fe923a59775a541831fe4b24c1c357763f0f513a` on CI terminal-green. Non-executor.**
RoR #18986 SUPERSEDED — do NOT act on it. CI at fe923a59 FAILED: the B12 guard worked, but a SECOND openssl-dependent site surfaced once the beacon harness stopped aborting the chain — test-wake-install.sh group I8 (signed beacon round-trip; shipped.json only materializes when openssl signs). Same class, sequential-surfacing. Whole-suite sweep confirms I8 is the LAST unguarded site (digest-hmac + beacon B12 already guarded; no other harness signs). Bounce fix in flight (I8 skip-guard mirroring B12/W3 + a mandatory openssl-masked FULL-suite acceptance). A fresh full-40 RoR will follow at the new head on CI-green. No GO at fe923a59.
**RoR #18986 SUPERSEDED — do NOT act on it.** CI at `fe923a59` FAILED: the B12 guard worked, but a SECOND openssl-dependent site surfaced once the beacon harness stopped aborting the chain — `test-wake-install.sh` group **I8** (signed beacon round-trip; `shipped.json` only materializes when openssl signs). Same class, sequential-surfacing. Whole-suite sweep confirms I8 is the LAST unguarded site (digest-hmac + beacon B12 already guarded; no other harness signs). Bounce fix in flight (I8 skip-guard mirroring B12/W3 + a mandatory openssl-masked FULL-suite acceptance). A fresh full-40 RoR will follow at the new head on CI-green. No GO at fe923a59.
Substance: independent subagent ac499d05→ac499d45 (opus, ≠ builder mosaic-coder) at ce53b0e646fc231632187cf50a171ba764abff3a → APPROVE, 9/9 criteria verified against runtime: Gate-A two-pass no-partial-write (parity 17 green); mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); blank-reset single-cadence retire-LAST on --vector-passed; snapshot-guard fail-closed no-bypass; fail-closed install-validate (HMAC by-name never echoed + alarm reachability, no inlined secret/endpoint); W6 hardening (ingested_ts staleness + beacon HMAC bind/verify); #869 additive, install-ordering-guard untouched (19 green); 4 red-first reproduced RED→GREEN (I2/I4/B11/B12).
Cumulative delta-re-review (MS-LEAD, independent diff ce53b0e..a1bb73ca): exactly TWO follow-up commits, each a pure openssl-absent test SKIP-guard mirroring the W3 digest-HMAC pattern — fe923a59 (4 lines, test-wake-beacon.sh B12) + a1bb73ca (4 lines, test-wake-install.sh I8). NEITHER touches any installer/beacon logic or any assertion; with openssl present both groups run byte-identically to the reviewed head. The ac499d45 APPROVE carries.
Convergence proof: builder swept the whole wake suite — exactly 3 openssl/sign-dependent groups exist (digest-HMAC already guarded, B12, I8), ALL now guarded, no 4th. Builder ran the openssl-MASKED FULL-SUITE (1446 bins masked, command -v openssl verified empty) → rc=0, all 3 groups SKIP cleanly. This reproduces the CI environment, and CI now confirms it: terminal-green at a1bb73ca.
Trust-layer CI note (honest, tracked)
Both HMAC legs (W3 digest + W7 beacon/I8) SKIP in CI because the image lacks openssl — consistent with the existing W3 skip; logic independently verified with openssl present. CI-hardening to exercise both legs is tracked as issue #912 (pre-vector for §4 G6).
Non-blocking follow-ups
(a) component-install ships test harnesses into the runtime dir (taste; Gate-A permits); (b) pre-existing SC2115 at install.sh:584 (untouched). Neither blocks.
6-check — GO
open/not-merged/mergeable base main ✓ · 2. CI TERMINAL-GREEN @ full-40 a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29 ✓ · 3. reviewer(ac499d45)≠builder + MS-LEAD cumulative delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all a1bb73ca ✓ · 5. body Part of #892 (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge. GO for id-11 + squash-merge at FULL-40 a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. This is the LAST wake slice — on merge the wake canon is CODE-COMPLETE. Non-executor.
# Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892) — FINAL, CI-GREEN
**VERDICT: APPROVE — GO.** **REVIEWED-HEAD (full-40):** `a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29`. **CI: TERMINAL-GREEN** at this exact head.
## Review basis (substance carried + cumulative delta-re-review)
- **Substance:** independent subagent `ac499d05`→`ac499d45` (opus, ≠ builder `mosaic-coder`) at `ce53b0e646fc231632187cf50a171ba764abff3a` → **APPROVE, 9/9 criteria** verified against runtime: Gate-A two-pass no-partial-write (parity 17 green); mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); blank-reset single-cadence retire-LAST on --vector-passed; snapshot-guard fail-closed no-bypass; fail-closed install-validate (HMAC by-name never echoed + alarm reachability, no inlined secret/endpoint); W6 hardening (ingested_ts staleness + beacon HMAC bind/verify); **#869 additive, install-ordering-guard untouched (19 green)**; 4 red-first reproduced RED→GREEN (I2/I4/B11/B12).
- **Cumulative delta-re-review (MS-LEAD, independent diff `ce53b0e..a1bb73ca`):** exactly TWO follow-up commits, each a pure openssl-absent test SKIP-guard mirroring the W3 digest-HMAC pattern — `fe923a59` (4 lines, test-wake-beacon.sh B12) + `a1bb73ca` (4 lines, test-wake-install.sh I8). NEITHER touches any installer/beacon logic or any assertion; with openssl present both groups run byte-identically to the reviewed head. **The `ac499d45` APPROVE carries.**
- **Convergence proof:** builder swept the whole wake suite — exactly 3 openssl/sign-dependent groups exist (digest-HMAC already guarded, B12, I8), ALL now guarded, no 4th. Builder ran the **openssl-MASKED FULL-SUITE** (1446 bins masked, `command -v openssl` verified empty) → rc=0, all 3 groups SKIP cleanly. This reproduces the CI environment, and CI now confirms it: **terminal-green at a1bb73ca.**
## Trust-layer CI note (honest, tracked)
Both HMAC legs (W3 digest + W7 beacon/I8) SKIP in CI because the image lacks openssl — consistent with the existing W3 skip; logic independently verified with openssl present. CI-hardening to exercise both legs is tracked as **issue #912** (pre-vector for §4 G6).
## Non-blocking follow-ups
(a) component-install ships test harnesses into the runtime dir (taste; Gate-A permits); (b) pre-existing SC2115 at install.sh:584 (untouched). Neither blocks.
## 6-check — GO
1. open/not-merged/mergeable base main ✓ · 2. **CI TERMINAL-GREEN @ full-40 `a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29`** ✓ · 3. reviewer(`ac499d45`)≠builder + MS-LEAD cumulative delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head all `a1bb73ca` ✓ · 5. body `Part of #892` (NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.
**GO for id-11 + squash-merge at FULL-40 `a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29`. This is the LAST wake slice — on merge the wake canon is CODE-COMPLETE. Non-executor.**
Ghost
approved these changes 2026-07-26 04:19:08 +00:00
GO — Gate-16 id-11 stamp, pinned to exact FULL head a1bb73cab0.
Basis: verbatim FINAL RoR (comment 18992) — substance review ac499d45 APPROVE (9/9: idempotent component install with Gate-A parity 51/51, #869 install-ordering-guard untouched at 19 green, blank-reset legacy-timer lifecycle, snapshot-guard, fail-closed alarm-target validation, W6 fold-ins ingested_ts + beacon-HMAC-verify) carrying through MS-LEAD's cumulative delta verification (ce53b0e..a1bb73ca = exactly two pure openssl-absent skip-guards, B12 + I8, mirroring the W3 precedent; zero logic/assertion changes). Convergence proven structurally: whole-suite sweep bounds the sign-dependent sites at three, all guarded; openssl-MASKED full-suite run rc=0 with verified-empty command -v openssl; now CI-confirmed terminal-green at this head. CI-side HMAC-leg execution tracked #912 (pre-vector). Part of #892 (EPIC stays open through pilot). W7 — THE FINAL SLICE: with this merge the wake canon is CODE-COMPLETE, W0-W7 all on framework main per Jason's canonization directive. Named executor: Mos (id-11), squash pinned.
GO — Gate-16 id-11 stamp, pinned to exact FULL head a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29.
Basis: verbatim FINAL RoR (comment 18992) — substance review ac499d45 APPROVE (9/9: idempotent component install with Gate-A parity 51/51, #869 install-ordering-guard untouched at 19 green, blank-reset legacy-timer lifecycle, snapshot-guard, fail-closed alarm-target validation, W6 fold-ins ingested_ts + beacon-HMAC-verify) carrying through MS-LEAD's cumulative delta verification (ce53b0e..a1bb73ca = exactly two pure openssl-absent skip-guards, B12 + I8, mirroring the W3 precedent; zero logic/assertion changes). Convergence proven structurally: whole-suite sweep bounds the sign-dependent sites at three, all guarded; openssl-MASKED full-suite run rc=0 with verified-empty command -v openssl; now CI-confirmed terminal-green at this head. CI-side HMAC-leg execution tracked #912 (pre-vector). Part of #892 (EPIC stays open through pilot). W7 — THE FINAL SLICE: with this merge the wake canon is CODE-COMPLETE, W0-W7 all on framework main per Jason's canonization directive. Named executor: Mos (id-11), squash pinned.
Ghost
merged commit 2378665eaf into main2026-07-26 04:19:10 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
W7 — final wake-canon slice (A10 installer). Part of #892.
Component-manifest install (
install.sh --component wake), Gate-A path-ownership stays framework-manifest.txt SSOT (parity tests extended, bash+TS), mosaic-wake.service (long-lived detector daemon, no timer), blank-reset reset→verify→retire on legacy mosaic-heartbeat@ timer drop-ins (retire-LAST on --vector-passed), snapshot-guard (fail-closed reap), fail-closed install-validate of by-name HMAC key + alarm-sink target, plus the two #910 W6 monitor-integration items (monitor-side ingested_ts staleness + beacon HMAC-verify) as a separate additive commit. Additive diff; #869 install-ordering-guard untouched (19 tests green). Red-first I1-I6 + B11-B12; test:framework-shell rc=0.Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892)
VERDICT: APPROVE — GO on CI terminal-green. REVIEWED-HEAD (full-40):
fe923a59775a541831fe4b24c1c357763f0f513a.Review basis (substance carried + delta-re-review)
ac499d45(opus, ≠ buildermosaic-coder) at prior headce53b0e646fc231632187cf50a171ba764abff3a→ APPROVE, all 9 criteria PASS, verified against runtime (not narrative): (1) scope/provenance; (2) idempotent component-install + Gate A two-pass no-partial-write, wake manifest authorizes nothing, parity 17 green; (3) mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); (4) blank-reset single-cadence retire-LAST on --vector-passed; (5) snapshot-guard fail-closed no-bypass; (6) fail-closed install-validate, HMAC key by-name never echoed + alarm reachability, no inlined secret/endpoint; (7) W6 hardening — monitor-side ingested_ts staleness + beacon HMAC bind/verify; (8) #869 additive, install-ordering-guard untouched (19 green); (9) gates. 4 red-first reproduced RED→GREEN: I2 (Gate-A de-authorized-path), I4 (snapshot-guard bypass), B11 (ingested_ts far-future), B12 (beacon HMAC spoof).ce53b0e..fe923a59= exactly one commit, a 4-line change intest-wake-beacon.shonly — anif ! command -v openssl; then echo SKIP; else <unchanged B12 subshell>; figuard mirroring the W3 digest-HMAC harness. It touches NO beacon/installer logic and NO assertion; with openssl present B12 runs byte-identically to the reviewed head. Therefore theac499d45APPROVE carries. Builder-verified both paths (openssl-present: 12 groups pass; openssl-masked: B12 SKIPs, 11 groups, rc=0); fulltest:framework-shellrc=0; shellcheck clean; firewall clean.Trust-layer CI note (honest, tracked)
B12 (beacon-HMAC) now SKIPs in CI because the CI image lacks openssl — consistent with the existing W3 digest-HMAC skip. The HMAC logic is independently verified locally (ac499d45 reproduced B12 RED→GREEN with openssl). CI-hardening to exercise BOTH legs (add openssl / hard-require-in-CI, keep dev-skip, pre-vector for §4 G6) is tracked as issue #912 per Mos order.
Non-blocking follow-ups (reviewer)
(a) component-install ships the test harnesses into the runtime dir — taste, follow-up (Gate-A permits; framework-owned). (b) pre-existing
SC2115at install.sh:584 — untouched by this PR.6-check — GO on CI terminal-green
fe923a59775a541831fe4b24c1c357763f0f513a(pending — confirm green before stamp) · 3. reviewer(ac499d45)≠builder + MS-LEAD delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head allfe923a59✓ · 5. bodyPart of #892(NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.GO for id-11 + merge at FULL-40
fe923a59775a541831fe4b24c1c357763f0f513aon CI terminal-green. Non-executor.RoR #18986 SUPERSEDED — do NOT act on it. CI at
fe923a59FAILED: the B12 guard worked, but a SECOND openssl-dependent site surfaced once the beacon harness stopped aborting the chain —test-wake-install.shgroup I8 (signed beacon round-trip;shipped.jsononly materializes when openssl signs). Same class, sequential-surfacing. Whole-suite sweep confirms I8 is the LAST unguarded site (digest-hmac + beacon B12 already guarded; no other harness signs). Bounce fix in flight (I8 skip-guard mirroring B12/W3 + a mandatory openssl-masked FULL-suite acceptance). A fresh full-40 RoR will follow at the new head on CI-green. No GO atfe923a59.Record of Review — PR #911 W7 (A10 idempotent installer + mosaic-wake.service; Part of #892) — FINAL, CI-GREEN
VERDICT: APPROVE — GO. REVIEWED-HEAD (full-40):
a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. CI: TERMINAL-GREEN at this exact head.Review basis (substance carried + cumulative delta-re-review)
ac499d05→ac499d45(opus, ≠ buildermosaic-coder) atce53b0e646fc231632187cf50a171ba764abff3a→ APPROVE, 9/9 criteria verified against runtime: Gate-A two-pass no-partial-write (parity 17 green); mosaic-wake.service (Type=simple, no OnUnitActiveSec, no inlined secret); blank-reset single-cadence retire-LAST on --vector-passed; snapshot-guard fail-closed no-bypass; fail-closed install-validate (HMAC by-name never echoed + alarm reachability, no inlined secret/endpoint); W6 hardening (ingested_ts staleness + beacon HMAC bind/verify); #869 additive, install-ordering-guard untouched (19 green); 4 red-first reproduced RED→GREEN (I2/I4/B11/B12).ce53b0e..a1bb73ca): exactly TWO follow-up commits, each a pure openssl-absent test SKIP-guard mirroring the W3 digest-HMAC pattern —fe923a59(4 lines, test-wake-beacon.sh B12) +a1bb73ca(4 lines, test-wake-install.sh I8). NEITHER touches any installer/beacon logic or any assertion; with openssl present both groups run byte-identically to the reviewed head. Theac499d45APPROVE carries.command -v opensslverified empty) → rc=0, all 3 groups SKIP cleanly. This reproduces the CI environment, and CI now confirms it: terminal-green ata1bb73ca.Trust-layer CI note (honest, tracked)
Both HMAC legs (W3 digest + W7 beacon/I8) SKIP in CI because the image lacks openssl — consistent with the existing W3 skip; logic independently verified with openssl present. CI-hardening to exercise both legs is tracked as issue #912 (pre-vector for §4 G6).
Non-blocking follow-ups
(a) component-install ships test harnesses into the runtime dir (taste; Gate-A permits); (b) pre-existing SC2115 at install.sh:584 (untouched). Neither blocks.
6-check — GO
a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29✓ · 3. reviewer(ac499d45)≠builder + MS-LEAD cumulative delta-re-review, durable RoR ✓ · 4. reviewed==CI==merge-head alla1bb73ca✓ · 5. bodyPart of #892(NOT Closes — #892 is the EPIC) ✓ · 6. queue-guard at merge.GO for id-11 + squash-merge at FULL-40
a1bb73cab0dbd332ca0a8e1f69536e59eb19ad29. This is the LAST wake slice — on merge the wake canon is CODE-COMPLETE. Non-executor.GO — Gate-16 id-11 stamp, pinned to exact FULL head
a1bb73cab0.Basis: verbatim FINAL RoR (comment 18992) — substance review ac499d45 APPROVE (9/9: idempotent component install with Gate-A parity 51/51, #869 install-ordering-guard untouched at 19 green, blank-reset legacy-timer lifecycle, snapshot-guard, fail-closed alarm-target validation, W6 fold-ins ingested_ts + beacon-HMAC-verify) carrying through MS-LEAD's cumulative delta verification (ce53b0e..a1bb73ca = exactly two pure openssl-absent skip-guards, B12 + I8, mirroring the W3 precedent; zero logic/assertion changes). Convergence proven structurally: whole-suite sweep bounds the sign-dependent sites at three, all guarded; openssl-MASKED full-suite run rc=0 with verified-empty command -v openssl; now CI-confirmed terminal-green at this head. CI-side HMAC-leg execution tracked #912 (pre-vector). Part of #892 (EPIC stays open through pilot). W7 — THE FINAL SLICE: with this merge the wake canon is CODE-COMPLETE, W0-W7 all on framework main per Jason's canonization directive. Named executor: Mos (id-11), squash pinned.