feat(distribution): prepare evidence-gated Grok Build compatibility for Agent Reliability

[Sebastián Federico (fscfede-beep)]

Purpose

A review-only Grok Build / Claude interoperability adapter for the pre-existing public Agent Reliability skills-only package v0.1.6. No MCP credentials, private plugin v0.3.12, production code, or canonical RUMBO state is promoted.

Exact candidate

• Branch: feat/marketplace-grok-claude-adapter-20261015
• Exact reviewed head: 7ae2a53d4b932752fa8d47343bb488c37e17fc4b (update this value only after an independently verified new head)
• Files: Grok manifest, distribution playbook, offline validator, 6 adversarial regression tests, narrow static-only CI
• Static job run 38821423686: SUCCESS, including tests, actual candidate inventory, existing source-provenance tests
• Other GitHub checks may be pending and must be read at exact head

P0 PRIVACY FAILURE — FAIL CLOSED

Global Public privacy gate run 38821423859 FAILED at Run privacy gate regression tests. Direct GitHub commit readback proves that the commits added by the connected GitHub Contents API use an author display name not in RUMBO's explicit allowlist. test_full_ancestry_metadata_scan_passes_current_clean_history scans the commit chain. This is not a failure of the skills-only manifest itself. The GitHub create_file/update_file/create_commit connector lacks author/committer fields; an isolated Git Database commit probe showed the same identity, so repeating that approach does not resolve the gate.

Do not weaken verify_public_privacy.py, introduce broad metadata exceptions, or merge/promote the current commit chain. Recovery requires a trusted Git client or provider pathway able to create a new equivalent-tree commit with the previously approved public author/committer identity, based directly on the safe original parent; verify metadata, tree equality, source provenance, privacy regression and entire PR checks before an exact-head lease-protected replacement. Remote Desktop Commander quota is 0%; SentinelX presently offline. Recovery of host execution is a separate authorization/availability gate.

Other release gates

1. Organization owner explicitly ratifies distribution licensing. Existing public governance does not currently grant the plugin an external distribution license.
2. Client-native Grok Build installation and static/security review; no such install was performed.
3. External xAI PR requires exact public full commit SHA, verified license, generated index and CI; not submitted.
4. Claude/OpenAI/Google/Meta onboarding remain separate, and no external marketplace acceptance is claimed.

Authority

PR must remain DRAFT / UNMERGED / PRODUCTION_NO_GO / ZERO_NEW_SPEND. Never confuse structural tests with in-client or publisher approval.

[Sebastián Federico (fscfede-beep)]

Independent scoped privacy reconciliation — 2026-10-16 (ART) · REVIEW_ONLY

Scope: Public PR #360 only. This is evidence and a recovery contract, not approval, a canonical-state update, or a production claim.

Exact observed state

• main: a16c59802d696bf5d155e07c11d22347f3f88149
• PR head: 7ae2a53d4b932752fa8d47343bb488c37e17fc4b (DRAFT / OPEN / UNMERGED)
• 6 candidate commits, +5 paths, 0 behind main.
• Candidate final Git tree: eaaca70747f5cc73c8b4f00fbbda3a3bb1fbcb5c.
• Public privacy gate run 38821423859: FAIL (27/28 regression tests pass; one ancestry test reports 12 violations, 6 commits × author-name/committer-name). Each of the 6 commit objects was independently read and did not satisfy the approved display-name sets.
• RUMBO Grok Plugin Adapter (static only) run 38821423686: PASS for static checks only.

Critical extra dependency
The checked-in privacy-gate.yml uses fetch-depth: 0 and RUMBO_PRIVACY_SCAN_ALL_REFS: '1' in its secret-backed verifier. Thus repairing PR #360's HEAD ancestry alone cannot establish a global gate PASS while other fetched public refs still contain non-approved commit metadata. A separate public PR #359 head was independently observed with non-approved author/committer display names; its disposition must be assessed in its own governed lane. No secret contents were read.

Proposed safe remediation (NOT EXECUTED)

1. Inventory refs/ancestry from an exact readback and identify every violating reachable commit without exposing private names or emails in public logs.
2. Use an authorized, trusted Git client/provider route that explicitly controls approved author and committer metadata to rematerialize the same exact tree eaaca70747f5cc73c8b4f00fbbda3a3bb1fbcb5c directly on approved current main; compare exact parent, tree, changed paths, metadata and SHA. Existing GitHub connector commit creation does not expose these identity controls.
3. Preserve existing dirty refs until separately authorized, complete an impact analysis of other affected PRs/refs, then handle each via explicit governance and lease/CAS protections. Do not silently delete branches, rewrite history, weaken allowlists, or add broad exceptions. Rewriting references does not guarantee erasure of Git objects already publicly exposed.
4. Run the complete privacy regression, secret-backed --all verification and required exact-SHA CI, then independently read back check conclusions.
5. Require separate licensing, client-native validation, and owner/root authority before any distribution or promotion.

Disposition: PR_360=BLOCKED; PR_DRAFT=TRUE; MERGE=NO_GO; EXTERNAL_DISTRIBUTION=NO_GO; PRODUCTION=NO_GO; CANONICAL_WRITES=0. This comment is an append-only, noncanonical audit receipt.

Follow-up evidence: all-ref baseline and current host policy — 2026-10-16 · same scoped audit receipt

• Independently fetched original run 38820178291, launched with the clean main SHA a16c59802d696bf5d155e07c11d22347f3f88149 as a pushed ref. Its 28 privacy regression tests passed, while the next step, Verify public privacy invariants, failed with exactly 52 public-surface metadata violations on 26 distinct commits from --all; this failure predates PR feat(distribution): prepare evidence-gated Grok Build compatibility for Agent Reliability #360. No private deny hashes were inspected.
• Public GitHub branches were read across three pages: 258 heads. This is an inventory count, not proof that all branches are contaminated. Candidate clean-tree rematerialization alone cannot make a 52-violation all-ref baseline disappear.
• Fresh SentinelX observation on DESKTOP-QUGVQLB: host connected, operational, agent v0.18.3; strict allowlist contains only rumbo-dc-read-wrapper.mjs. Git, file editing, scripting, and general commands are expressly disabled. Desktop Commander separately reports 0% Remote MCP usage remaining. Host connectivity != permission for Git remediation; no host commands were run by this audit.
• The 6 exact Git commits were retrieved with GitHub REST and independently checked; their author and committer display names fail the approved-name lists; final tree eaaca70747f5cc73c8b4f00fbbda3a3bb1fbcb5c still provides a stable content-equivalence anchor.

Recovery ordering: First determine a provider-authorized Git writer that can explicitly set the approved identity without changing host permissions; then produce a separate proposed clean equivalent-tree commit on a fresh authorized branch. Before any impact on existing PR/ref or global gate, reconcile all remaining 26 offending commits by exact ref reachability and ownership. Do not weaken the policy, change canonical state, activate Make bridges, enable arbitrary host execution, force-push/delete public refs, or merge under this receipt. Conditions still LOCAL_PRIVACY=FAIL, GLOBAL_ALL_REFS=FAIL_AS_OBSERVED, PRODUCTION=NO_GO.

Dependency-mapping addendum — associated PRs · 2026-10-16 · REVIEW_ONLY

The 26 distinct metadata-violating commit SHA values enumerated by the actual main-head all-ref run 38820178291 were checked individually against GitHub's commit→pull-request association endpoint. 8/26 currently returned an association with PR #359 (OPEN, DRAFT, UNMERGED). The other 18/26 yielded no pull-request association in that API response, which is not evidence that those objects are unreferenced, deletable, or privately retained. Reachability from all public refs remains to be separately demonstrated, especially before changing PR #359 in its independent lane.

Two inactive Make on-demand GitHub bridges were inspected read-only; the REST bridge is presently configured for GET /user and the GraphQL bridge for a repository category query, not identity-controlled Git commit creation. Their execution requires activation and would change the automation's operating state, so none was activated or run.

A safer rematerialization strategy uses a separate trusted local Git client to construct an unattached commit directly from the immutable final tree of PR #360 and approved base parent, with exact approved GIT_AUTHOR_* and GIT_COMMITTER_*. Read back the entire commit object and compare exact tree/parent/identity before creating any remote ref. This alone does not remove historical all-ref failures or authorize publication. NO_GO remains.

Four-lineage exact reconciliation — 2026-10-16 · subordinate READ_ONLY

Independent GitHub Git Database GET /git/commits/{sha} for each of the 26 offending SHA values in run 38820178291 established four complete, linear, main-based ancestry chains (all 26 are accounted for exactly once):

Current branch	Exact branch tip SHA	Offending commits on main-to-tip chain
oss/siwc-multi-account-v0.2.0-r1-20261009	58e1efc8fc839b9759ea3e78836ab974ac38dfd4	8
whispera-r9-native-ci-20261008	48e21455137f93b6db9abf6e78f2fbc71313bfaf	7
feat/startup-ecosystem-staging-v1-3-20261008	841b0e3cf36b447c44a46c661f70b4824b5122e3	10
docs/open-lab-contribution-entry-20261008	a7d791d5eb2f09d7af76d1c9ba8e2db44e4c4bc0	1
Total		26 commits / 52 metadata violations

All four exact tips were read from GitHub refs; GitHub compare main...branch returned 8/7/10/1 commits ahead respectively and 0 behind. Do not interpret this as proof that only four refs reach these commits; other remote refs, tags or PR refs may share ancestry. The local PR #360 independently contributes six identity-invalid commits not included in the 26-commit clean-main all-ref baseline. The verifier scans the selected SHA plus --all, potentially counting the same commit violation twice when it occurs in both scanned sets, so raw violation counts must not be treated as distinct-commit counts without deduplication.

Decision: No force update, cleanup, deletion, merge, permission bypass, deployment, or policy weakening has been performed. Next technical gate is a trusted author/committer-controllable Git writer and isolated exact-tree candidate; other four lineages remain separate root/owner-governed remediation. PR_360=BLOCKED, GLOBAL_PRIVACY_PASS=NOT_PROVEN, PROD=NO_GO.

Offline deterministic candidate object — independently executed · 2026-10-16 · additional technical evidence (NO REMOTE CODE EFFECT)

An isolated local Git object was actually created without remote Git access, using the 44 authoritative root-tree entries fetched via GitHub's nonrecursive Git Tree API and git mktree --missing:

• Trusted original PR HEAD 7ae2a53d4b932752fa8d47343bb488c37e17fc4b unchanged on re-read.
• Approved main parent SHA a16c59802d696bf5d155e07c11d22347f3f88149.
• Root tree reconstructed and independently matched the original exactly: eaaca70747f5cc73c8b4f00fbbda3a3bb1fbcb5c.
• Deterministic locally hashed unreferenced and incomplete Git commit object 33e3db33449a1dff89cdbe7c6d417ede5818d4cd; the author and committer values use the exact approved name/email in scripts/verify_public_privacy.py. Git cat-file byte-for-byte readback matched generated input.
• Original verify_grok_plugin_adapter.py Git blob 9b3ff57a57fffadc540bad41c34188261d9aa492 and six-case test source Git blob 541dfa01e49373b8dde1385b8af1215fdb321e85 independently matched provider blob SHAs; original python -m unittest -v scripts.test_verify_grok_plugin_adapter: 6/6 PASS in isolated fixture mode.
• Newly written offline-builder regression suite: 4/4 PASS, including mutated-tree rejection, deterministic re-run, byte/metadata check and detection of missing object dependencies.
• Evidence ZIP (held as conversation artifact, not published to this repository): RUMBO_PR360_OFFLINE_CANDIDATE_REVIEW_ONLY_20261016.zip, SHA-256 d55b9d734c91bdd11d19e6b97564630120578165e7b260a307b9570e90535cb5, verified ZIP CRC and member checksums.

Strict qualification: This object is NOT a complete Git clone, checkout, transportable bundle, pushed branch or exact-head CI pass. Its base parent and descendant blobs/subtrees have not been hydrated in the isolated environment because it cannot resolve github.com. No remote refs were updated; no branch was created; no merge, force-push, permissions change, repository policy change, secret-backed gate, or deployment occurred. Other reachable dirty lineages and licensing/client tests remain open. Status: CANDIDATE_OBJECT_LOCAL=PASS, REMOTE_PRIVACY_FIX=NOT_APPLIED, ALL_REFS_PRIVACY=FAIL_AS_LAST_OBSERVED, PRODUCTION=NO_GO.

[Sebastián Federico (fscfede-beep)]

Superseded by privacy-clean successor #362.

The clean candidate is one commit d0df9155567c23eaf7c3fd459888ce26505adc48 directly on protected main@a16c59802d696bf5d155e07c11d22347f3f88149, authored/committed as RUMBO Privacy Automation <41898282+github-actions[bot]@users.noreply.github.com>.

Verification run 38949543026, job 117137154958:

• targeted privacy PASS;
• Grok adapter adversarial tests 6/6 PASS;
• structural verifier PASS with external_distribution=NO_GO_UNTIL_LICENSE_AND_CLIENT_TEST preserved;
• Agent Reliability publication tests 9/9 PASS;
• four files byte-identical to this PR source;
• documentation differs only by one privacy-required phrase normalization;
• public main mutation NONE; spend USD 0.

This PR should remain historical evidence only; closing without merge allows its non-compliant side ref to become an authorized cleanup candidate once branch deletion is performed through a supported admin/UI surface.

SUPERSEDED_BY=#362
OLD_HEAD=7ae2a53d4b932752fa8d47343bb488c37e17fc4b
CLEAN_HEAD=d0df9155567c23eaf7c3fd459888ce26505adc48
MERGE_OLD_PR=NO
PRODUCTION=NO_GO