[M1] Pre-deployment Kernel integrity hardening

[samovers]

Outcome

Harden M1 before deployment so the Kernel is trustworthy under concurrency, tenancy, temporal queries, authority decisions, evidence promotion, corrections, materialization, and frozen outputs.

Review baseline: fc800d5a1be35c95a8f348fda9d8453b06e37018.

Tracker status (2026-08-29)

Native sub-issue and blocked-by relationships now mirror the live dependency map. Foundation issues #168–#174 are closed; remaining multi-capability children are classified as Tracking Epics and coherent single-capability children as Delivery issues. This tracker migration does not rewrite historical decisions or merged pull requests.

Non-negotiable boundary

• This epic hardens implementation of the accepted Kernel model; it does not amend OFARM law or contracts.
• Do not change manifests, active artifact sets, or profile activation here.
• Capability reporting is owned only by [M1/Truth] Ground capability reporting in exact code and executed evidence #183 and may become more conservative; affirmative claim upgrades remain separately evidence-gated.
• Keep M3/M4 issues M3.x/M4.0: Operational Action Surface descriptor layer #153, M3.x: Enforce ontology-as-application-layer discipline in PWA scenario tests #154, Backlog: UI / interaction ontology for governed application surfaces #155, and Backlog plan: Reconnect OFARM2 app surfaces to canonical Layer 6 archetypes/templates/interaction specs #156 parked behind their stated M3.1/PWA evidence gates.
• Keep the Serbia epic Serbia-first runtime implementation track #157 and its children intact. RS0: Define first Serbian runtime scope and standalone-vs-extension posture #158 may proceed in parallel; RS1: Add fail-closed profile-runtime provider seam with SI registered only #159 remains the country-provider seam and must not be duplicated here.
• Preserve Runtime elegance review: defer seam-hardening items after #137 #139 as backlog until its individual seams are implemented here/RS1: Add fail-closed profile-runtime provider seam with SI registered only #159 or deliberately retained.

Start now — no runtime behavior change

• [M1/Foundation] Pin a reproducible review baseline and evidence envelope #168 — reproducible review baseline and evidence envelope (first safe Codex handoff)
• [M1/ADR] Freeze tenancy and schema-migration architecture #169 — tenancy and migration ADR
• [M1/ADR] Specify valid-time and knowledge-time semantics #170 — valid-time/knowledge-time ADR
• RS0: Define first Serbian runtime scope and standalone-vs-extension posture #158 — Serbia RS0 decision record (parallel existing issue; not owned by this epic)

Foundation implementation

• [M1/Profile] Pin every decision to an immutable content-addressed RuntimeBundle #171 — immutable content-addressed RuntimeBundle
• [M1/Security] Enforce tenant isolation and record-graph integrity in PostgreSQL #174 — database tenancy/binding primitives, isolation, migrations, neutral graph carrier, and protected audit-storage slice
• [M1/Security] Make authentication modes explicit and fail closed in production #172 — explicit fail-closed production authentication and principal-binding lifecycle integration
• [M1/Correctness] Introduce a request-scoped UnitOfWork and explicit commit ordering #173 — request-scoped UnitOfWork, hardened binding integration, and commit ordering
• [M1/Security] Persist pre-tenant operational security audit safely #192 — end-to-end pre-tenant operational security audit
• [M1/Correctness] Implement dual-axis temporal storage and queries #176 — dual-axis temporal storage and queries
• [M1/Architecture] Define non-forking tenant-service recovery #193 — non-forking tenant-service recovery design; blocks recovery promotion and destructive migrations, not the safe V1 refusal posture
• Production security-audit composition and external custody #351 — production security-audit composition and external custody (parked; outside [M1/Security] Persist pre-tenant operational security audit safely #192 closure)

Governed semantics

• [M1/Security] Enforce the Authority Action Matrix through a governed control plane #175 — Authority Action Matrix and governed control plane
• [M1/Security] Enforce complete sharing and output-authorization semantics #177 — complete sharing and output authorization
• [M1/Correctness] Make command idempotency tenant-scoped, content-bound, and result-complete #178 — tenant-scoped, content-bound command idempotency
• [M1/Security] Add governed EvidenceRecord ingestion and a closed promotion matrix #179 — governed EvidenceRecord ingestion and closed promotion matrix
• [M1/Semantics] Unify review, contest, correction, and supersession lifecycle #180 — review/contest/correction/supersession lifecycle

Durable derivation, outputs, and truth

• [M1/Correctness] Separate immutable materialization proof from disposable derived caches #181 — immutable materialization proof; disposable caches
• [M1/Security] Persist digest-bound output assemblies and qualifications atomically #182 — atomic digest-bound frozen outputs and qualifications
• [M1/Truth] Ground capability reporting in exact code and executed evidence #183 — exact-code/executed-evidence capability reporting

Critical dependency spine

(#168, #169, #171) → #174 → #172 → #173 → #175 → (#177, #178, #179) → #180 → #181 → #182 → #183

#168 → #171 → (#179, #181, #182, #183)

(#169, #170, #172, #173, #174) → #192 → #176

(#169, #170, #172, #173, #174, #175, #177, #178, #182) → #193

Parallel work is allowed where each child issue's explicit dependencies are satisfied.

Existing-issue overlap and ownership

• Evidence/manifest honesty review: preserve #126/#127 boundaries #138 remains the honesty-boundary record; this epic does not repurpose it.
• Runtime elegance review: defer seam-hardening items after #137 #139 remains backlog. Its provider/policy fallback seam belongs to RS1: Add fail-closed profile-runtime provider seam with SI registered only #159/[M1/Security] Add governed EvidenceRecord ingestion and a closed promotion matrix #179; mutable reference/runtime identity belongs to [M1/Profile] Pin every decision to an immutable content-addressed RuntimeBundle #171; cache/unknown-trigger hardening belongs to [M1/Correctness] Separate immutable materialization proof from disposable derived caches #181. Reconcile only after implementations land.
• M3.x/M4.0: Operational Action Surface descriptor layer #153–Backlog plan: Reconnect OFARM2 app surfaces to canonical Layer 6 archetypes/templates/interaction specs #156 remain parked M3/M4 work. No action catalog, PWA, UI, manifest, active-set, profile-activation, or capability expansion is pulled into M1.
• Serbia-first runtime implementation track #157 remains the Serbia-first epic. RS0: Define first Serbian runtime scope and standalone-vs-extension posture #158 can run now. RS1: Add fail-closed profile-runtime provider seam with SI registered only #159 should integrate with [M1/Profile] Pin every decision to an immutable content-addressed RuntimeBundle #171 and [M1/Security] Add governed EvidenceRecord ingestion and a closed promotion matrix #179 instead of creating alternate profile/evidence mechanics.
• RS2: Make profile-runtime service contracts executable and validate injected service graphs #160–RS8 / MP7.7: Deliberately enable, select, and route Serbia #166 remain Serbia-scoped and keep their existing blockers. These M1 tickets may become prerequisites but do not absorb their law, evidence, provider, conformance, or activation scope.

Exit criteria

• Adversarial multi-tenant and concurrent tests exercise the deployed application topology.
• Every governed result is reconstructable from immutable records pinned to exact code, schema, policy, reference inputs, temporal cuts, and RuntimeBundle.
• Unsupported or ambiguous authority/evidence/profile states fail closed.
• No higher capability or country-compliance claim is made merely because this epic closes.

M2 integrated closeout discovered by whole-system review (2026-07-10)

These are shared Core/Kernel prerequisites, not Serbia implementations:

• [M2/P0] Close the Core semantic reference graph #184 — close the Core semantic reference graph. Its decision work can begin after [M1/Foundation] Pin a reproducible review baseline and evidence envelope #168; implementation follows its stated M1 dependencies.
• [M2/P0] Add governed commands for bindings, extents, verification, and reference imports #185 — add governed commands for ReferenceSnapshot imports, verification/bindings, and PartialExtent. This is the shared ingestion mechanism consumed later by RS4: Implement governed Serbian reference and evidence ingestion #162.
• [M2/P1] Implement scheduled source acquisition—or formally defer it #186 — either implement provider-independent scheduled acquisition after [M2/P0] Add governed commands for bindings, extents, verification, and reference imports #185 or formally narrow/defer the claim.

Additional dependency spine:

#168 → #184 (decision work)

(#170, #171, #173, #174) → #184 (implementation and forward migration) → #180 → #185 → #186

(#171, #172, #173, #174, #175, #176, #178, #179) → #185

#159 remains the SI-parity provider seam and should coordinate with #171/#184/#185 without absorbing them. #162 remains blocked Serbia work and must consume #185 rather than create an alternate country-specific write path.

The original first safe Codex handoff remains #168. These additions do not unpark #153-#156, change #139's backlog posture, or authorize law, contract, manifest, ActiveArtifactSet, profile-activation, or capability-claim changes.

First claim/read delivery alignment — 2026-09-11

Renewed canonical Phase A approval at exact PR #11 head 4494924998183fe3fa7bc1b63b76a85893335044 supplies the first authorization scope, with no promotion or runtime effect. The claim/read precursor and later true temporal child are separate milestones. #178's first Delivery covers the common protocol with one real claim consumer; integration of all other command families remains open here. No child may close on stubs or absorb an independent authority. The original broader M1 outcomes and acceptance criteria remain unchanged.

The wider programme dependency spine above is not a requirement to complete the whole #175 epic before the amended first #178 delivery. Use the concrete authorization, identity, representation and source capabilities required by that consumer. Provider and write/read transaction producers must have a valid ordering before implementation; do not replace the broad epic edge with a cyclic blanket #353 edge.

#353 still needs complete selected-rule coverage, canonical binding/promotion/extraction and real input/read/guard producers. #178 retains common identity, atomic result, single use, truthful recovery and current disclosure limits. The later #176 child must prove independent valid/knowledge cuts; ordinary readback or retry does not complete it. CP2A-DEP01 and the unresolved history proof remain open. This note changes no checkbox, other child scope, deployment gate or parked programme.

What is next: align and review existing #359's first-release design and settle real producer ordering; do not close this epic or start implementation from this note.