[EPIC] Finish the flow suite and prove production-ready orchestration

[szmyty]

Outcome

Finish the four-tool Flow suite to a production-usable, independently releasable milestone and prove that Flow can orchestrate the holons without collapsing their boundaries.

This epic is the suite-level source of truth for sequencing work across:

• flow
• renderflow
• optiflow
• aniflow

What “finished” means here

The core finish line is not “no future ideas can ever be added.” It means:

1. Each holon is independently installable, testable, documented, and releasable.
2. Public provider/CLI contracts are versioned and usable without source coupling.
3. Flow can inspect, plan, execute, validate, explain, interrupt, and resume real multi-holon work.
4. The current known completion backlog is either shipped, explicitly superseded with evidence, or moved to a clearly named post-v1 milestone.
5. At least two representative end-to-end fixtures prove the suite:
   • a static publication/comic release;
   • a time-based media release with animation/audio analysis.
6. Releases, docs, sites, manifests, and CI all tell the same version/capability truth.

This epic also tracks the exhaustive closeout needed to finish renderflow#367; it must not be closed merely because one happy-path demo runs.

Live baseline snapshot

Observed on 2026-09-13. Re-query before every implementation branch; these SHAs are evidence pins, not permanent assumptions.

Repository	Observed main	Baseline truth	Active anchors
flow	3367fc3b9576d0102ea92df5cadf86d83c4ad854	No open PRs and no recent workflow-run evidence observed	#3, #10
renderflow	58aa2cad8ba9e2374d0e7a1bf5277052ae40838c	Main is red on Clippy and generated-doc drift	renderflow#407, renderflow#367, renderflow#406
optiflow	f04c82a0b0c677a2939ea351c4219602cd7181af	Main checks and the observed signed-binary release workflow are green	optiflow#51, optiflow#29, optiflow#28
aniflow	20ff9f87c2500a3b9727954d0e4b4758e2c9b3ea	Main validation is red on the product-name policy check	aniflow#15, aniflow#11, aniflow#8, aniflow#13, aniflow#10

No open pull requests were observed in any of the four repositories at the snapshot.

Non-negotiable architecture boundaries

• Flow owns cross-holon orchestration, run state, recovery, and explanations.
• Renderflow, Optiflow, and Aniflow remain independently useful products.
• Integration occurs through versioned public APIs/CLIs and immutable artifacts, never source-tree imports.
• A process exit code or file-exists check is not sufficient proof of success.
• Plans and manifests must state inputs, outputs, tool/provider versions, checksums, diagnostics, and provenance.
• Interruption and retry must not silently duplicate completed work.
• Upload, publication, mutation, signing, and other consequential side effects remain explicit authority boundaries.
• Every issue is implemented and reviewed as a bounded unit; this epic is not authorization for one cross-repository mega-PR.

Roadmap

Wave 0 — restore repository truth

Nothing later may claim a stable suite while a provider's default branch is red or its build evidence is absent.

• Finish renderflow#407: restore Clippy and generated-document checks without weakening gates.
• Finish aniflow#15: reconcile the lowercase product-name policy and restore validation.
• Reconfirm Optiflow's green build, tests, docs/site checks, security checks, and signed release from a fresh checkout.
• Reconcile optiflow#28 against the actual deployed site/DNS/TLS state; close with evidence if already delivered rather than rebuilding it.
• As part of flow#3, establish repeatable Flow CI evidence before declaring the vertical slice complete.

Wave 1 — stabilize the provider seams

Optiflow and Aniflow contract work can proceed independently once their own baselines are green.

• Finish optiflow#51: safe plugin/provider SDK for inspectors, analyzers, planners, and validators.
• Finish aniflow#11: provider SDK, temporal hooks, and the bounded pipeline migration it owns.
• Re-verify Renderflow's public provider/capability boundary under renderflow#367; open a focused follow-up only for a demonstrated gap.
• Record a Flow compatibility matrix that pins provider contract versions and capability negotiation behavior.
• Keep holon-specific algorithms in their repositories; do not “finish faster” by moving them into Flow.

Wave 2 — prove the orchestration kernel

• Finish Implement a versioned cross-holon orchestration vertical slice #3 using at least Optiflow and Renderflow as independent providers.
• Demonstrate inspect → plan → transform → validate with immutable input/output references.
• Demonstrate interruption, persisted run state, resume, retry, and a deliberate failure explanation.
• Add conformance fixtures for unavailable capabilities, partial output, invalid output, and provider-version mismatch.
• Ensure structured output and exit semantics are stable enough for automation.

Wave 3 — complete the provider capabilities needed by real products

These can be developed in parallel where their issue dependencies allow.

• Finish renderflow#406: localization-ready layered page composition and locale render targets.
• Finish optiflow#29: stable CLI/module/performance polish after the SDK contract settles.
• Finish aniflow#8: Demucs stem separation.
• Finish aniflow#13: structured audio, lyrics, and MIDI extraction.
• Finish renderflow#397 only after Aniflow feat: freeze the federated extension contract #8 and Build cross-tool orchestration and failure fixture suites #13 expose the required analysis evidence.

Wave 4 — close Renderflow's exhaustive artifact roadmap

Track this work through renderflow#367, not through duplicate umbrella issues.

• Finish renderflow#378, then integrate it through renderflow#379.
• Finish renderflow#350: Slidev presentation profile.
• Finish renderflow#349: repository briefings and podcast derivatives.
• Finish renderflow#397: Sonic DNA.
• Re-run the maximal/exhaustive artifact profile against the golden corpus.
• Close renderflow#367 only after its remaining issue set and final Flow integration evidence are reconciled.

Wave 5 — prove real release workflows

• Finish [Publication] Orchestrate exhaustive comic finalization and multilingual release workflows #10: orchestrate comic finalization, layered/textless sources, optimization, localization, exhaustive artifacts, preflight, and ship-readiness evidence.
• Prove a static publication fixture through Flow + Optiflow + Renderflow.
• Prove a time-based fixture through Flow + Aniflow + Renderflow; include Optiflow where poster/frame assets make it semantically appropriate.
• Validate clean-room resume behavior by interrupting each fixture after at least one completed provider step.
• Validate negative cases: missing source, unavailable tool, invalid locale, corrupt artifact, insufficient print quality, and provider-version mismatch.
• Store expected manifests and normalized evidence as reviewable fixtures without checking in inappropriate large generated binaries.

Wave 6 — release and distribution truth

• Finish aniflow#10 only after its external policy/release dependencies are re-verified live.
• Confirm Optiflow's released version, install path, site, docs, and repository metadata agree.
• Define a bounded Flow release-hardening issue after Implement a versioned cross-holon orchestration vertical slice #3 exposes the real public contract; do not speculate its version surface prematurely.
• Define the corresponding Renderflow release closeout from renderflow#367 evidence.
• Smoke-test all four tools from immutable released artifacts, not workspace source imports.
• Publish a version/capability compatibility table and rollback instructions.

Wave 7 — governance convergence

The ADR backfill issues are deliberately gated. Do not execute them merely because they are old or open.

• Re-verify every external prerequisite on flow#9, renderflow#405, optiflow#60, and aniflow#14.
• Run the shared ADR backfill only after the common schema, index, validation, and repository-policy gates are truly available.
• Reconcile architecture, decision, roadmap, security, release, and operational documents after implementation truth is stable.

Recommended execution order

For sequential work, use this order unless a freshly observed dependency changes it:

1. renderflow#407
2. aniflow#15
3. optiflow#51
4. aniflow#11
5. flow#3
6. renderflow#406
7. optiflow#29
8. aniflow#8
9. aniflow#13
10. renderflow#397
11. flow#10
12. remaining renderflow#367 profiles
13. release closeout
14. gated ADR convergence

Items 1 and 2 can run independently. Items 3 and 4 can run independently after their repository baselines are green. Re-query repository state before relying on this order.

Suite definition of done

• All four default branches have required, reproducible green validation.
• Each tool installs and runs independently from an immutable released artifact.
• Public contracts and structured output have compatibility/version rules.
• Flow proves real multi-holon planning, execution, validation, explanation, interruption, and resume.
• Static-publication and time-based fixtures pass positive and negative acceptance suites.
• Manifests capture checksums, tool/provider versions, provenance, diagnostics, and validation evidence.
• Documentation, sites, release metadata, and observed binaries agree.
• The open issues named by this epic are closed, superseded with evidence, or explicitly assigned to a named post-v1 milestone.
• No provider depends on another provider's source tree.
• No consequential external side effect occurs without explicit authority.
• The final completion report links exact commits, releases, workflow runs, fixtures, and any intentional deferrals.

Working protocol

For each child issue:

1. Read the repository instructions and the architecture/decision/roadmap documents required by them.
2. Re-check main, open PRs, current CI, and the child issue's dependencies.
3. Pin the starting commit.
4. Implement one bounded issue on one branch.
5. Run repository-local checks plus the relevant contract/conformance suite.
6. Open one focused PR; do not merge it automatically.
7. Update this epic with links and newly discovered dependency changes after review/merge.

[szmyty]

Wave 0 progress — renderflow#407

Implementation is ready for review in egohygiene/renderflow#408 and has not been merged.

Evidence pins:

• starting main: 58aa2cad8ba9e2374d0e7a1bf5277052ae40838c
• PR head: 15478e75862be680dc0e882aff3cafbe5aa56300
• validated tree: 3a967ce4babaadc4df1c94e6dc1a9e9a5b7d3d21

All repository-local equivalents passed: Rust fmt/Clippy/build/full tests, locked conformance, deterministic docs/schema generation, strict MkDocs + Mike preview, web format/lint/typecheck/tests/build, release examples, and installer checksum/version smoke testing. CI/workflow gates were not weakened.

Latest-head hosted checks are running: CI, docs, conformance, and commit lint. If hosted runs are blocked by account billing/quota, that is an explicit follow-up rather than a code-gate bypass.

Dependency outcome: no suite dependency or capability-contract change. #367 sequencing remains unchanged, and the roadmap's explicit independence means aniflow#15 can proceed while #408 awaits review. Leave the renderflow#407 checkbox open until merge and resulting-main evidence.

[szmyty]

Hosted-check follow-up for head 15478e75862be680dc0e882aff3cafbe5aa56300: Commit Lint and Artifact conformance are now green. CI and docs remain in progress; the PR remains open and unmerged.

[szmyty]

Wave 0 progress — aniflow#15

Implementation is ready for review in egohygiene/aniflow#16 and has not been merged.

Evidence pins:

• starting main: 20ff9f87c2500a3b9727954d0e4b4758e2c9b3ea
• PR head: 3c91bcaf6f875e5d201ec2fb1897952d052417a5
• validated tree: 754f9605ad55731f32128f7a8a9ccf1df0434ff4

Hosted CI is fully green at https://github.com/egohygiene/aniflow/actions/runs/34776328706: Linux stable, Rust 1.85 MSRV, macOS stable, and the complete Validate job all succeeded. Local equivalents also passed, including the strengthened production naming gate, all-four-name policy fixtures, strict Clippy, 20 contract/public-API/unit tests, locked packaging, and the deterministic FFmpeg smoke test.

Dependency review: no roadmap dependency change discovered. aniflow#15 remained independent of the unmerged renderflow#408 as authorized; renderflow#408 was not modified. aniflow#10, #11, #13, and flow#3 remain related or downstream rather than blockers for this bounded repair. The Wave 0 item should remain open until PR #16 is reviewed, merged, and green on the resulting main.

[szmyty]

Live merge confirmation, CI caveat, and deferred audit tranche

Re-fetched on 2026-09-13 after the Wave 0 PRs were merged.

Merge evidence

• renderflow#407 merged through renderflow#408 at 1eafaf54d33a984377a7a3e327ee87382da73307.
• aniflow#15 merged through aniflow#16 at e036ca23c3ee81ea1bd962c7a066012a0d74d887.
• No open PRs were observed in Flow, Aniflow, Optiflow, or Renderflow.
• Aniflow's post-merge main CI run 34776622873 is green.

Newly observed Renderflow main failure

Renderflow's post-merge docs run 34775426169 is green, but main CI run 34775426178 is red in the build-and-test job. Clippy and build pass; cargo test --all fails only:

• test_all_without_transforms_uses_builtin_capability_registry
• observed error: target selection resolved to no available branches

This is a real hosted test failure, not a billing/quota blocker. Do not weaken or repeatedly retry the gate. Reproduce and route it through a focused Renderflow issue (or reopen #407 if that is the chosen tracking policy) before claiming Renderflow's default branch is green. It does not change ownership of optiflow#51; flow#11 already permits Optiflow provider-seam work independently once Optiflow's own baseline is re-confirmed.

Deferred post-roadmap audits

Created one nonduplicative audit issue per holon:

• flow#12
• aniflow#17
• optiflow#61
• renderflow#409

These are deliberately blocked behind the active roadmap/release sequence. They require repository/backlog reconciliation, evidence-backed creation of bounded follow-up issues, and complete Identity v1 coverage. Missing creative assets must go through ChatGPT-assisted candidate generation plus explicit human selection, provenance, approval, deterministic generation, and validation; the audits cannot auto-approve imagery or become implementation mega-PRs.

Identity planning reference at creation: stable v1.0.0 resolves to commit aaad8839104704cf57bfa846539b3b875421e03d. Re-query it when an audit actually begins.

[szmyty]

Wave 1 progress — optiflow#51

Implementation is ready for review in egohygiene/optiflow#62 and has not been merged.

Evidence pins

• pinned starting main: f04c82a0b0c677a2939ea351c4219602cd7181af
• PR final head: fdbe629e82fcd53ec42c5fabf2323f35f45ddc6f
• validated tree: ca9dab8ba2d3e620a00d49b33a5c2ee4e372326e
• branch: feat/51-safe-plugin-sdk
• GitHub comparison: one commit ahead, zero behind, 42 focused files; no open/overlapping OptiFlow PR or branch was present before publication

Delivered boundary

The PR adds typed Rust registration for inspectors, analyzers, normalization/policy contributors, planners, validators, report/export providers, and read-only lifecycle observers. It also adds exact manifest/operator-lock selection, deterministic precedence and explicit fallback, bounded trusted-process invocation, provenance/result revalidation, honest partial coverage, extensions list|inspect|doctor, examples, generated capability documentation, and adversarial fixtures.

SDK v1 grants no source-mutation, destructive, signing, or publication authority. Plugin plan contributions cannot execute and must retain observation revalidation, full hashing, byte confirmation, plan identity, explicit authorization, and provenance. There is no arbitrary executable, $PATH, directory, environment, network, or sibling-repository discovery. A trusted process is documented as an explicit operator trust decision, not an OS-sandbox claim.

Local validation

All applicable repository gates passed:

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo +1.85.0 check --locked --all-targets --all-features
• cargo test --locked --all-targets --all-features: 145 passed
• locked debug all-target/all-feature build, locked release all-feature build, and locked example build
• cargo doc --locked --no-deps --all-features
• every checked-in JSON Schema via jq empty
• python3 scripts/generate-extension-docs.py --check
• both checked-in reference manifests reproduced byte-for-byte from the Rust examples
• ./scripts/smoke-test.sh
• ./scripts/run-adversarial-tests.sh properties faults: all seven slices passed
• both bounded 15-second cargo-fuzz 0.13.2 targets passed
• Cargo deny advisories/bans/licenses/sources checks passed for the root and fuzz manifests (only the existing duplicate/unmatched-license warnings)
• all seven deterministic release-evidence tests passed
• Identity source validation passed; the exact workflow sequence generated and verified 18 projections and passed all six integration tests
• frozen uv 0.11.33 strict documentation and composed-site builds passed
• git diff --check passed

The extension adversarial coverage includes SDK incompatibility, malformed input/output evidence, unknown fields, unsafe plans, exact-lock mismatch, executable-byte changes, timeout, cancellation, partial coverage, precedence/replacement/fallback conflicts, embedded panic, process crash, and checkpoint-bound recovery.

Hosted workflow conclusions

All PR-head workflows are green:

• CI run 34784078188: Ubuntu validation, macOS validation, and Rust 1.85 MSRV all succeeded; schemas, strict Clippy, full tests, generated references, examples, and smoke passed
• Adversarial tests run 34784078122: Linux/macOS properties and faults plus bounded nightly fuzzing all succeeded and uploaded evidence
• Security and dependency policy run 34784078097: root/fuzz dependency policy, PR dependency review, verified/unknown secret scan, and release-evidence contract all succeeded
• Documentation run 34784078111: strict static-site build succeeded
• Publish site run 34784078112: repository intelligence and composed Pages artifact succeeded
• Identity v1 run 34784078120: immutable source/gitlink, generation, verification, integration tests, and evidence upload succeeded

No workflow was blocked by billing or quota.

Public contracts and dependency/order outcome

Additive identifiers are optiflow.extension-sdk.v1, optiflow.extension-manifest.v1, optiflow.extension-lock.v1, optiflow.extension-invocation.v1, and optiflow.extension-result.v1. Existing CLI, configuration/effective-policy, command-result, run, report, plan, artifact-set, and database contracts remain unchanged. No Cargo dependency and no sibling-source dependency was added.

Dependency reconciliation found no new roadmap-order change:

• OptiFlow [FLO-3.2a] Freeze stdio process framing and transcript validation #26 and [FLO-3.2a] Freeze stdio process framing and transcript validation #27 remain completed safety/release prerequisites.
• Flow [Extensions] Define the federated plugin, adapter, and hook contract #7 remains the released suite-envelope ownership boundary; OptiFlow owns its native semantics and Flow may adapt released contracts only.
• OptiFlow #29 remains separate downstream CLI/performance work after the SDK settles.
• OptiFlow #28 remains independent site-delivery work.
• The deferred audit tranche ([Audit] Post-roadmap repository, backlog, and Identity audit #12/[FLO-OBS-03] Prove opt-in OpenTelemetry logs, metrics, and traces #17/#61/#409) remains deferred.
• Leave optiflow#51 and the Wave 1 checkbox open until PR #62 is reviewed and merged.

Separate Renderflow caveat

Renderflow main is not green: docs run 34775426169 passed, but main CI run 34775426178 remains a real test failure in test_all_without_transforms_uses_builtin_capability_registry with “target selection resolved to no available branches.” It is not billing/quota, was not changed by optiflow#62, and remains separate Renderflow work.

[szmyty]

Roadmap checkpoint — clean-host CI repair and OptiFlow site truth

Re-fetched and implemented the first two checkpoints from the 2026-09-14 completion roadmap. Both PRs are open, mergeable, fully green, and intentionally unmerged.

1. Renderflow clean-host --all regression

• tracking issue: [CI] Fix builtin capability fallback for --all on clean hosts renderflow#410
• review PR: fix(planner): preserve unavailable all-target plans renderflow#411
• pinned base: 1eafaf54d33a984377a7a3e327ee87382da73307
• final head: 9a83038fd90f82c49ddf438497445c59a116abe1
• final tree: edbaf6c6a87fcb03e3c8cd600822dd9bbc666358

The planner now separates policy-allowed, provider-available, and unavailable targets. A clean-host --all --dry-run keeps blocked branches inspectable and marks them unavailable; non-dry execution still fails provider preflight with zero steps and zero outputs. CLI tests force an empty PATH, pure tests cover mixed/zero/exact-target availability, and the CLI documentation now matches the built-in registry contract.

Final-head gates are green:

• CI: https://github.com/egohygiene/renderflow/actions/runs/34905427915
• generated docs/schema: https://github.com/egohygiene/renderflow/actions/runs/34905427909
• conformance: https://github.com/egohygiene/renderflow/actions/runs/34905427924
• commit lint: https://github.com/egohygiene/renderflow/actions/runs/34905427907

Renderflow main should still be treated as red at run 34775426178 until #411 merges and the resulting-main run is green. #410 deliberately remains open for that confirmation.

2. OptiFlow production-site reconciliation

• delivery issue: Deploy the composed product site to optiflow.egohygiene.io optiflow#28
• review PR: feat(site): harden production delivery optiflow#63
• pinned base: c9cf7c8572591c0ebcf72e2fbe3ccf1fcdfc5d69
• PR head: aa6dcc3976a73682534dec8cca1b372799b3065a
• final tree: c20e28bcaa1ec0ff69aa2fe499fd6bf28b1f2e7e

Independent live checks proved the custom hostname, DNS CNAME, TLS verification, HTTP-to-HTTPS redirect, default-Pages-to-product redirect, and landing/architecture/docs/intelligence/schema routes. The only material repository gap was missing canonical links on the hand-authored landing and architecture pages, plus stale preview/rollback documentation.

#63 adds those links, enforces canonical/SEO/accessibility/reduced-motion entry-point contracts in the deterministic site build, uploads a seven-day PR preview artifact, prevents production deployment from non-main refs, and documents verification and reviewed-revert rollback.

All five hosted workflows are green:

• CI: https://github.com/egohygiene/optiflow/actions/runs/34904190771
• docs: https://github.com/egohygiene/optiflow/actions/runs/34904190266
• security/dependency policy: https://github.com/egohygiene/optiflow/actions/runs/34904190625
• Pages preview artifact: https://github.com/egohygiene/optiflow/actions/runs/34904190518
• adversarial matrix: https://github.com/egohygiene/optiflow/actions/runs/34904190578

The preview artifact is github-pages ID 10372645382, digest sha256:fc7ea55d9050ad69b5c41f9b973467a35aa4f8ac2415a5ebdfeec594337419c0, retained through 2026-09-21. #28 deliberately remains open until #63 merges, the resulting main Pages run deploys, and canonical links are rechecked on production.

Dependency reconciliation

• renderflow#407, aniflow#15, and optiflow#51 remain merged at the SHAs already recorded above in this epic;
• REL-04 and HOL-03 are complete;
• the live OptiFlow hostname is no longer blocked on ORG-03; organization-wide hostname/DNS/certificate governance remains in 🌐 [platform] Configure GitHub Pages with verified domain egohygiene.io .github#2;
• the OptiFlow deployment reference requested by HOL-03 is recorded on Package reusable landing, docs, and architecture site blueprints holon#4;
• no provider contract, schema, sibling-source dependency, or suite ownership boundary changed.

No later roadmap issue was started. After maintainer review/merge and resulting-main verification for these two PRs, the next independent implementation checkpoint remains aniflow#11.

[szmyty]

Added the separately bounded suite observability and CLI experience epic #14, with staged children #15–#22.

The track covers structured local logs, privacy/redaction and stream ownership, OpenTelemetry logs/metrics/traces, controlled cross-process context propagation, the evidence-backed shared-crate/repository decision (including explicit evaluation of egohygiene/observatory), suite migrations/conformance, diagnostic bundles/runbooks, and presentation-only root-help branding.

It remains separate from the current provider/runtime and Pipeline v3 checkpoints. Telemetry is explicitly non-authoritative and excluded from deterministic plans, fingerprints, cache keys, artifacts, validation, and resume evidence.

[szmyty]

The next aniflow provider-roadmap checkpoint is now tracked in egohygiene/aniflow#25 (ANI-11.4): deterministic, read-only Pipeline v3 planning and capability resolution. The observability epic remains separate in #14 so telemetry cannot enter plan identity or execution evidence.

[szmyty]

Deferred fixture follow-up captured at Alan's request: renderflow#413, an original mock comic and a reusable convention for document-type fixture packs. It extends renderflow#412 and the existing golden corpus, with minimal/larger publication recipes, explicit artifact/validator evidence, and positive/negative cases. This is planning only; no implementation started. Cross-tool orchestration stays in #13/#10, and this does not add a blocker to incomprisllc/comics#93.

[szmyty]

Optiflow's next bounded PNG checkpoint is ready for review: optiflow#78 → PR #79, head 9be28ed1a9742860d63246412419ae6be440a06a. This adds only the provider/candidate evidence contract and a pure consistency checker with synthetic positive/refusal fixtures; it does not deliver compression, runtime PNG validation, media outputs, or replacement authority. Local full suite (177 tests), final affected ten groups, strict Clippy/formatting and site composition pass. Final-head Documentation and Publish site workflows pass; CI, adversarial and security workflows are still running at this update. The PR is intentionally unmerged. After review/merge, scope real source-preserving candidate production, independent byte validation and media publication as a separate checkpoint; transactions/batches remain later work.

[szmyty]

Optiflow's next bounded optimization checkpoint is reviewable in egohygiene/optiflow#82 (closes optiflow#80): actual PNG source/candidate byte validation, following merged contract PR #79. It verifies complete stream decoding, exact samples/metadata and encoded reduction for an explicit subset. All 193 local tests and docs/Clippy checks passed; final-head hosted CI is running. This does not deliver candidate generation, provider execution, file replacement or Flow orchestration. After human merge, the next optimization checkpoint is a separately scoped source-preserving producer with host observations, bounded execution/cleanup and media-output publication, subject to the existing architecture/release boundary. Renderflow's mock-comic/document fixture idea remains separately captured in renderflow#413.

[szmyty]

Optiflow checkpoint ready for human review: egohygiene/optiflow#82 (issue #80) is OPEN and mergeable at 19c76bb13a4c9011cdaaea32447a469c45f7f366. All 193 local tests and all five final-head workflows passed: Documentation, Publish site, Security and dependency policy, CI, Adversarial tests.

This completes the bounded real PNG byte-validation implementation, preserving concurrent dependency and ADR-inventory merges. Candidate generation remains the next separate optimization checkpoint after merge; replacement and wider Flow orchestration remain later work.

[szmyty]

Optiflow #83 is ready for review in egohygiene/optiflow#84 at 69b53865ddcc7545f7472342c55c0f3aaa2a0f26. It adds the README media capability matrix and a source-pinned optimizer strategy, making inspection/review/validation versus planned production/apply explicit. OxiPNG remains the first planned producer; image_optim is prior art, not a new runtime dependency.

Documentation-only, with no sequence or authority change. Strict docs/site verification passed (30 HTML documents), 44 source paths/anchors checked, and all five final-head workflows passed: Documentation, Adversarial tests, Publish site, Security and dependency policy, CI.

The PR remains OPEN and mergeable for human review. Source-preserving OxiPNG candidate generation is the next separately scoped optimization checkpoint after merge.