Capture original management genesis and complete retained lineage #2839

Parent-Issue: #2822
Blocked-By: #2826

Objective

Produce independently verifiable provenance for an explicitly selected ordinary management deployment from its original genesis through all attempted successors, while preserving unresolved outcomes and missing-history refusals.

Context

This is the missing original-provenance prerequisite discovered while implementing #2824. The current prospective history producer correctly treats the first predecessor as an external boundary, and its legacy verifier refuses unknown outcomes even when original stores are present. A later enrollment cannot prove the initial deployment's prior attempted branches. The new capability covers an explicitly selected ordinary local-system-Docker deployment from its original pre-start boundary. It does not change NEW/#2672 or create launch authority.

Inspected baseline: e742338. Relevant production sources are original_attempts.py, original_attempt_evidence.py, bootstrap_supervisor.py and exclusion_host.py. The current source-based findings and tests are recorded in Draft PR #2838. Existing missing incident journals remain unavailable; this is not a legacy conversion.

Requirements

REQ-501: Support only an explicitly selected prospective ordinary local-system-Docker profile; before any first child, independently verify the exact local engine, full created/never-started manager/proxy identities, immutable image/source/command/configuration/mount mapping, and new protected state/journal/history roots. Root authorization selects scope only; current emptiness, absent claims or stopped Docker must never convert an earlier deployment or old unknown root into genesis, and NEW/#2672 and unselected ordinary behavior remain unchanged.
REQ-502: Capture one protected, canonical, fsynced original genesis and history authority bound to the host producer lifetime, source, selected deployment and every observed root/container/configuration identity, with independent original ownership and exclusive one-time creation; existing, partial, changed or conflicting capture refuses without repair, relocation, re-enrollment or synthesis of history.
REQ-503: The selected actual ordinary bootstrap must independently verify its exact original genesis under its own exclusive owner lock before any management effect or child, record native identities of all four stores and an original first-launch boundary, and preserve those records; interrupted or missing expected originals remain unavailable, and existing receipts or claims cannot authorize a retry of an unknown first outcome or a new initial child.
REQ-504: All supported later fresh, upgrade and exclusion-cutover original admissions must preserve the genesis history binding and record every attempted successor in original order before effect or grant; reject omitted, foreign, aliased or advanced bindings, including failed branches, and never infer reverse completeness by following only successful predecessors.
REQ-505: An independent read-only verifier must derive genesis plus the full retained frontier from original bytes with currently held history and owner fences, match exact source/root/container/store identities, distinguish complete original facts with an unknown outcome from absent expected evidence, and preserve all unknown outcomes and #2823 key/target exclusions; legacy external baselines remain explicitly unavailable and outputs contain no epoch or grant authority.
REQ-506: Production-entrypoint isolated OS/Docker tests must cover genuine ordinary genesis through successors and a failed branch, independently verified unknown-versus-missing stores, removed/mutated/foreign genesis or ancestry, omitted history at each successor origin, two contenders with observable material overlap, and interruption before/after original durable boundaries; independent observations must demonstrate preservation and no refused launch/grant or repair, while component probes remain distinct from native acceptance.
REQ-507: Document the exact supported source/profile, original capture and verification interfaces, refusal/outcome distinctions and authority limits, and update affected production trace emissions, dashboard-observability entries and runnable tests without reporting original evidence as recovery success or readiness.

Acceptance Scenarios

• AS-G01 (REQ-501, REQ-502, REQ-503, REQ-506): Run the real original capture against new, exact, never-started local-engine objects, then the actual ordinary bootstrap. Independently read its original genesis, first-launch boundary and four store identities. A positive launch must traverse this production path; a fixture success flag is insufficient.
• AS-G02 (REQ-501, REQ-502, REQ-506): Use old, restarted, differently sourced, aliased or non-pristine selected objects/roots, and interrupt capture at each durable publication boundary. Refuse without converting missing prior history, repairing partial capture or launching a child. Establish actual competing ownership before asserting contention.
• AS-G03 (REQ-503, REQ-505, REQ-506): Preserve a complete original attempt with an unknown outcome, then separately remove a required store. The former is verifiable original evidence with an unchanged unknown outcome; the latter is unavailable. Neither yields launch permission or an invented never-created classification.
• AS-G04 (REQ-504, REQ-505, REQ-506): Drive genuine successors and a failed branch through fresh, upgrade and continuous-cutover admission. Omit or substitute the original history binding at each origin and remove/mutate a reverse branch. Reject the change before any effect/grant while preserving original bytes and exclusions.
• AS-G05 (REQ-502, REQ-503, REQ-505, REQ-506, REQ-507): Kill the original producer around record/claim/receipt publication and run a separate verifier under real current fences. Partial state never becomes reusable first-start authority; logs and documentation identify unavailable evidence without a recovery-success event.

Non-goals

No live enrollment, deployment, migration, containment operation, worker or OAuth change, recovery grant, old-root reset or history backfill. No private-engine NEW change, generic Docker authorization broker, global maintenance mode or stronger hostile-agent threat model.

Preflight ownership

One new original provenance producer/history lifetime owns genesis, original bootstrap receipts, propagation and independent derivation. Its host observation and bootstrap publication are causally joined stages of that original evidence. Existing #2826 supplies successor anchor/frontier machinery; #2823 supplies separate quarantined operation inspection. The output is independently useful as non-authorizing evidence. Current containment and the durable recovery issuance state machine remain independent owners, and #2824 retains all REQ-101 through REQ-108 integration obligations.