v5 readiness: verified execution, clear health, safe sync, and upgrade acceptance

[stuinfla]

v5 readiness brief and release acceptance

This is a coordination checklist for the v5 work requested by the affected user. It does not replace the defect reports or claim that a released v5 has been tested.

Evidence and detailed ownership:

• Sync and advanced dashboard health audit: repeated repairs, ownership conflicts, private Brain update, false drift and source readiness #237: sync, ownership, health reporting, and additional locally repaired Kit/AQE defects.
• Dashboard: Codex shown as 'Disabled' while it's the main host in use; Live omits running sessions in non-git folders; 6 more display/diagnostic defects (with screenshots) #238: dashboard discovery, host-state presentation, live acquisition, source diagnostics, and accounting scope.
• Track upstream Ruflo memory routing fix and safe integration for existing corpora #213: Ruflo memory-path integration and its upstream dependency.
• Five reviewable Kit/AQE patches and closure criteria.
• Worker early-warning design and scoped runtime evidence.

Verified local baseline and limits

Affected installed versions: Kit 4.0.0-alpha.55, AQE 3.14.3, Ruflo 3.45.0. Local installed-package corrections passed 80 focused checks through AQE's actual Node runner; two actual no-upgrade sync runs, provider/security checks, real coverage execution, post-exit result retrieval, real embeddings, and exact canonical memory read-back passed. Native Codex authentication and a real dashboard provider challenge passed; the rendered quota view was inspected.

This establishes the recorded local scenarios. It does not establish an unmodified upstream release, every task type, fleet test/scan, all browser compatibility, reboot recovery, Linux/Windows behavior, or production-scale performance. Historical measurements in #237/#238 are not fresh measurements. The intermittent native failure's original cause remains unknown because its diagnostic was discarded; misleading classification was the proven defect.

P0: truthful execution and preservation

• Validate worker input, handler availability, route capability, and ownership before launching. Registration and accepted submission must never count as completed execution.
• Record task/executor identity, start, meaningful progress, terminal outcome, expected result, and persistence evidence separately. Verify actual packaged CLI behavior, not just imported source.
• Add an early-warning monitor: bounded start, queue, execution, and operation-appropriate progress deadlines; parent-visible failures/stalls; persistent dashboard alerts and truthful CLI exit codes. A heartbeat alone does not establish useful work.
• Distinguish cancellation requested from execution stopped. Bound cancellation, fence late callbacks, and restrict retries to safely repeatable operations with a capped policy.
• Detect claimed success without valid results, lost post-exit results, missing handlers, failed dependencies, and worker leaks. Await child outcomes before cleanup. Test the notification reaching the parent/UI, then prove a real executor path.
• Preserve live RVF owners, locks, databases, private/custom configuration, foreign executable ownership, credentials, unrelated valid TOML, and externally managed tools. Contention must not trigger destructive recovery.
• Prove the intended per-project memory route through CLI and active MCP, exact keys, independent persistent-row checks, and reopened processes. Do not delete one of two valid corpora merely to clear a warning.

P1: consistent repair and health logic

• Share ownership predicates, explicit host intent, and configuration context across status, nudge, sync plan, execution, and postcondition checks. A helper's success is not a verified repair.
• Give sync an explicit component scope/exclusion. No-upgrade currently skips upgrades, but is not a permanent guarantee that every unrelated component will be untouched.
• Separate installed, enabled for routing, authenticated, reachable, capability-tested, and actively executing. Missing quota does not mean logged out. Do not silently enable a host because historical activity exists.
• Preserve diagnostic causes and distinguish failure, inconclusive check, expected contention, disabled optional capability, preserved external advisory, and stale/unreviewed evidence. A warning count must explain what needs action.
• Detect selected services that are installed but stopped. Explain machine/project readiness and foreground-process lifetime. Startup services, backend switches, corpus migration, and new memory stores require explicit intent.
• Distinguish host identity from actual provider identity. Configured routes and host diversity alone do not prove independent vendors; review claims need invocation-level provenance.
• Inventory executable ownership and required capabilities before installs. Avoid force-overwriting foreign bins, silently pinning user-owned tools, or repeating known-impossible repairs.

P2: trustworthy observability and diagnosis

• A configured event source is not an ingested source. Show present/readable files, awaiting-file state, accepted/rejected events, last accepted timestamp, collection limits, and actual producer health separately.
• Cover paths with spaces, non-Git launch folders, source rotation/recreation, malformed/schema-invalid events, denied reads, and capped discovery. Do not report complete acquisition when capped.
• Use explicit shared time ranges, timezone, filters, project identity, and accounting basis for dashboard comparisons. Surface partial historical parsing instead of implying a login/model failure.
• Diagnose unsupported/new event types and bounded clipping without fabricated records or unbounded reads. Refresh guidance must identify the real degraded source rather than endlessly suggesting refresh.
• Keep detailed catalog/footprint data lazy or paginated; disclose freshness and collection coverage. Treat the historical large-payload observation as a workload to remeasure, not a current benchmark.

Upgrade and release gate

• For every correction, identify the owning upstream project, fixing commit, first published package/dependency version, and remaining limitations. The prior Ruflo cache fix and the later local handler/embedding-path corrections require separate evidence.
• Test clean and upgraded installations with custom MCP entries, foreign bins, disabled-but-installed hosts, existing data, and concurrent processes.
• Test positive and negative outcomes: accepted-never-started, alive-without-progress, slow-valid work, missing handler, failed child, empty result, persistence failure, deadline expiry, cancellation refusal, late completion, live lock, and real I/O failure.
• Upgrade the affected installation, restart affected processes, verify actual host/provider/memory/embedding/task paths and the rendered dashboard, then run sync twice to prove convergence.
• Do not replay old local patches over a newer release. Compare upstream incorporation first; retain version/hash-bound recovery and preserve unknown user edits.
• Keep external telemetry opt-in and redacted. Local alerts should contain task ID, state, elapsed/deadline, error category, and safe next action; never prompts, transcripts, credentials, private paths, or raw results.

Please treat #237/#238/#213 and the attached patches as one evidence set. Close this readiness tracker only against release-level evidence, not a passing local workaround or a reduced warning count. Brain remediation is outside this pass; the general component-preservation boundary still matters for safely running Kit alongside other work.

[pacphi]

Progress after #241 (merged 2026-09-27 as 476717b). This comment maps what shipped against the sections above without ticking boxes: several items are only partly covered, and some belong to Agentic QE or Ruflo rather than ak.

Covered by #241, fully or in part

• P0, await child outcomes before cleanup: ak's MCP tool calls now return only after a killed server has exited. Windows CI exposed this.
• P0, memory route proof: ak x verify memory proves the CLI and MCP routes with exact keys in an isolated store and cleans both stores. Setup's probe row is removed from both.
• P1, shared ownership predicates: status and registration use one legacy-Ruflo ownership predicate. Every status row says whether ak sync or the user repairs it, and sync reports repairs that did not converge. Sync's exit code covers only what it can repair; failing or warning hand-fix rows are listed as "needs your action".
• P1, explicit component scope: ak sync --skip <subsystem> and ak sync --json.
• P1, installed / enabled / reachable: every host shows "managed by ak", "found, not managed" or "not installed". Free checks run for unmanaged hosts too, and their problems are reported as information.
• P1, diagnostic causes: the native-module probe keeps its cause and separates unavailable from inconclusive. A busy AQE store is not reported as a failure.
• P2, non-Git launch folders: Live correlates sessions by exact folder.
• P2, source state: Discovery shows sources that are not installed, and Limits say why Codex data is unavailable.
• P2, lazy catalog: the System page uses a slim summary endpoint, about 1/20 of the full payload.
• Upgrade gate, owning project and first published version: the upstream constraint registry now carries a watch list of 83 upstream threads with "done when" conditions, and a check script reports releases.

Planned in the remediation program

• The worker early-warning monitor (design first).
• One evidence store and one refresh vocabulary, so every check's age and source are shown.
• Session surface and provider identity (ADR-0060, Proposed).
• Real-state hermeticity for the test suite.
• The Ruflo support window.
• AQE store integrity.

Not yet scoped: execution identity, terminal-outcome recording, cancellation semantics, and the upgraded-installation and positive/negative outcome test matrix. Those will be scoped against Agentic QE and Ruflo before any plan.

Verdicts and decisions: the verification and decisions record.