diff --git a/ACCOUNT_PAIRING.md b/ACCOUNT_PAIRING.md index e5f62b3..6d5862d 100644 --- a/ACCOUNT_PAIRING.md +++ b/ACCOUNT_PAIRING.md @@ -9,6 +9,9 @@ Keep `VALIDATOR_PAIRING_ENABLED=0` until the cross-repo rollout is verified. Core's separate [scoped pilot change](https://github.com/AIPowerGrid/grid-core/pull/60) adds a default-empty, expiring account allowlist for native qualification. It requires a new reviewed Core deployment; it is not in the deployed `407f2984`. +Its immutable `f51875ce` candidate passed the production-backup scratch-restore +and schema proof on 2026-08-27 at 20:59 UTC, without cutover, restart or activation. +That removes the preparation gate, not the live native pairing gate. ## What It Means diff --git a/AGENTS.md b/AGENTS.md index 3698e7c..c64e494 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -104,6 +104,9 @@ generator here or imply that passing public templates proves model quality. probe-fingerprinting gaps, red-team acceptance tests, and economic gates. - **`ROADMAP.md`** — dev-manager build order from V0 preview through targeted validation, text/image/video policy work, and Base-anchored economics. + Its active ten-item milestone distinguishes published native runtime proof + from human desktop use, staged restore proof from cutover, and registration + from independently reviewed qualification. Keep those gates separate. - **`RELEASE_V0.md`** — cross-repo evidence-only release runbook: core migration/API, console scorecards, validator packaging, canary operation, and rollback notes. - **`PREVIEW_COHORT.md`** — public recruitment and qualification contract for diff --git a/PRODUCTION_BASELINE.md b/PRODUCTION_BASELINE.md index 402b3ea..45d1616 100644 --- a/PRODUCTION_BASELINE.md +++ b/PRODUCTION_BASELINE.md @@ -5,6 +5,38 @@ This is a dated rollout snapshot, not a live status page. Query `GET https://api.aipowergrid.io/v1/validator/capabilities` for current public state. +## 2026-08-27 20:59 UTC - Pilot Candidate Restore Proof, No Cutover + +The immutable Core candidate `f51875ce8fe550640008f1824625e2f5a071f88b` +passed a fresh production-backup restore and Alembic/schema check at 20:59:32 +UTC. The 71,656,136-byte custom-format backup was checksum/archive verified +and retained with root-only mode `0600`. Restoration and migration checks ran +only in the generated scratch database, reached head `0030` with no schema +drift, and removed that scratch database afterward. A separate read-only check +confirmed its removal. The candidate's read-only live schema check also passed. + +This is **staged and restore-tested, not deployed**. The running service remains +Core `407f29841988fd253afe867a1f5a07e23349219e`, continuously active since +19:00:23 UTC. Production environment bytes and payout/backup timer states +match their pre-proof snapshots. Pairing, its pilot allowlist, media issuance +and bond sync remain disabled. No production migration, restart, account +association, payout invocation or economic activation occurred. The current +release remains the rollback target for any later candidate cutover. + +Validator [PR #63](https://github.com/AIPowerGrid/grid-validator/pull/63) merged +as `35b4e04590daa7d5180af99aa3d0056090d3954a`. Its exact reviewed PR source +passed all four native builds, clean installs and assembled-payload verification +in [run 33115331270](https://github.com/AIPowerGrid/grid-validator/actions/runs/33115331270). +The [native pairing procedure](NATIVE_PAIRING_CANARY.md) remains unexecuted +against live Core. Public downloads are still preview.13. + +The final read-only operator check at 20:57 UTC found 33 verified signed reports +for the previously reported external registration and three for the new +preview.13 registration; both heartbeats were fresh. The latter's operator has +not been identified from independent confirmation. These are participation +facts, not a completed human Windows journey or an independence review. The +five-operator 72-hour qualification remains open. + ## 2026-08-27 20:49 UTC - Cohort And Pairing Qualification Status Read-only public health and production queries still report Core diff --git a/ROADMAP.md b/ROADMAP.md index de144b9..2f82235 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -14,13 +14,18 @@ longer architecture, not permission to activate paid audits or economics. 1. Reconcile reviewed source, published artifacts, deployed versions, and local work. Preserve the unfinished video-decoder fairness patch separately. + The reviewed harness/docs are merged as `35b4e04`; public binaries remain + preview.13. Live Core is `407f2984` with migration `0030`. Pilot-capable Core + `f51875ce` is staged and passed a fresh backup/restore proof, but is not live. 2. PR #48's Windows launcher/identity fix shipped in preview.11; preview.12 - includes the local app. Native build/install checks pass; ordinary-user live - Windows qualification remains open. Window persistence alone is not enrollment. + introduced the local app, retained in current preview.13. Native build/install + and published Windows Server runtime tests pass; ordinary-user double-click + qualification remains open. Window persistence alone is not enrollment. 3. Ship explicit dedicated-account enrollment without private-key/API-key juggling. Source canary authentication through verified stored evidence is proven. Published preview.12 also completed clean Linux ARM64 enrollment - through three accepted reports; packaged Windows live qualification remains. + through three accepted reports. Published preview.13 completed the Windows + Server journey through two verified reports; no human desktop claim follows. 4. Build expiring authenticated pairing for an existing account, without account merging or payout-wallet changes. Dedicated-node signup is not pairing. Core PR #58 and Console PR #21 are merged and deployed dark; six real @@ -28,24 +33,37 @@ longer architecture, not permission to activate paid audits or economics. pass. The matching local app remains an unpublished build candidate. Windows/Linux live pairing proof, immutable client release and supervised association/removal remain required. Pairing is still disabled. + PR #63's manual native harness is merged and its offline safety suites pass + on all four platforms. This is preparation, not a completed pairing canary. 5. Make start/stop, registration, heartbeats, assignments, submitted evidence, errors, redacted diagnostics, and recovery understandable without a shell. - The opt-in local `app` ships in preview.12 with native package checks and + The opt-in local `app` ships in preview.13 with native package checks and desktop/mobile browser QA. Its packaged child protocol completed Linux ARM64 - live operation and outage recovery; native user-interface qualification remains. + and Windows Server live operation and outage recovery; ordinary-user native + interface qualification remains. 6. Prove clean first-run through accepted signed evidence on Windows and Linux, including cancellation, offline recovery, restarts, and upgrades. The Linux ARM64 binary passed those lifecycle paths on 2026-08-27. A misleading network-error label found live was corrected in preview.13 and its published - Linux binary passed the real outage/recovery check. Windows remains open. + Linux binary passed the real outage/recovery check. Published Windows + preview.13 also passed cancellation, accepted evidence, bad credentials, + restarts, upgrades, real firewall outage/recovery and credential retirement + in run `33110290699`. Hosted HTTP-driven controls do not prove human UI use. See [PRODUCTION_BASELINE.md](PRODUCTION_BASELINE.md). 7. Qualify at least five independently controlled operators for 72 hours; registration, wallets, and first-party canaries do not prove independence. + At 20:57 UTC on 2026-08-27, Peteq's node was healthy with 33 verified reports; + another preview.13 node had three. Its identity still needs confirmation + before calling it Donli's. No independent qualification window has started. 8. Maintain hostile-worker tests for template solvers, replay, fabricated evidence, substitution, and probe-aware switching. Generated challenges are protocol/capability evidence, never automatically quality evidence. 9. Finish decoder fairness, then independent-reference deterministic image and video pilots. Local failures and reference disagreement are inconclusive. + Fairness fixes are reviewed and merged in `5de518b0` with native test coverage, + but are not in preview.13. Original local work is preserved separately. + Independent reference operators and supervised image/video pilots remain open; + media issuance and bond synchronization remain disabled. 10. Keep DOX, public claims, release links, and rollback records synchronized; distinguish merged, released, deployed, and verified at every milestone.