Roadmap item 3: Add the inactive canonical state scanner

[yihanzhu]

What changed

• Add the prepared canonical state scanner and its focused proof.
• Preserve both prepared scanner commits, then merge the exact current main as the second parent.
• Add concise inactive-use and restore notes.
• Append all five scanner and test paths to the restore-critical manifest.
• Add only the four scanner paths that carry the selected v2 generation identity to the closed v2 path guard, and only the scanner jq program to the closed schema-import guard.
• Stream canonical document bytes through Bash builtin printf into the existing SHA tool, so valid large documents never become an external-process argument.
• Rebind the exact driver identity and add a relation-valid request above 131072 bytes plus a proof that neither product hash helper calls external printf.

Exact delivery tuple

• Base: 022c786
• Head: 123d177
• Driver SHA-256: 3f0b14cddd27ef7638b3227159af686defa5f5662c893096cc6711a692d57d1a
• Merge commit: 575015a
• Merge parents: 3b998c6, then 022c786
• Branch: codex/orchestrator-state-scanner-v1

Exact files

• README.md
• RESTORE.md
• ci/required-files.txt
• orchestrator/v1/scan-state.sh
• orchestrator/v1/state-scanner-driver.sh
• orchestrator/v1/state-scanner-launcher.sh
• orchestrator/v1/state-scanner.jq
• scripts/test/orchestrator-state-scanner.test.sh
• scripts/test/portable-core-schema.test.sh

Inactive boundary

The scanner reads one bounded canonical snapshot bound to an explicit Git repository and commit. It emits deterministic pending, stranded, and other state classifications with recovery messages. The messages are data, not commands.

It does not deliver events, schedule, dispatch, retry, reconcile, write state, use a credential or network, activate a profile, publish, or touch a real target. Later Roadmap item 3 work owns delivery, retry, and reconciliation.

Proof at the exact head

• Scanner proof: 38/38 checks passed, retaining all prior 36 cases and adding builtin-only hashing plus a relation-valid request above 131072 bytes within the unchanged 1 MiB limit
• Portable core schema proof: owned rules 47/47; direct cases 141/141; private route probes 13/13; registry 8/8; activation guards 39/39; numeric boundaries 8/8; review findings 8/8; legacy assertions 44/44; failures 0
• Driver identity recomputation and all four bound references: passed
• Bash syntax for all five shell files: passed
• ShellCheck 0.11.0 with -x -S style for all five shell files: passed
• Manifest append-only check: all 219 base lines preserved
• Required-file structure check: passed
• Exact path check: the nine files listed above
• Closed-set sync remains exactly 13 additions and 0 deletions in the schema guard test
• git diff --check: passed
• Rename check: passed
• Worktree: clean

A fresh required GitHub CI run is pending for this exact head. This PR is not reviewed or merge-ready.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	123d177
Status:	✅  Deploy successful!
Preview URL:	https://f14639a1.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-orchestrator-state-sca.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 123d177
Reviewed-base: 022c786
reviewer: review_scanner_216 @ high

CLEAN — zero unresolved Important findings.

Bugs

• The Linux argument-size blocker is closed. Driver and launcher stream document bytes through Bash builtin printf into the SHA tool; documents do not cross an external-process argv boundary.
• The 1 MiB input limit and jq semantics are unchanged.
• A relation-valid request above 131072 bytes exercises the full scan and launcher postflight path.
• Exact envelope, identity, completeness, ordering, uniqueness, timestamp, retry, and classification precedence checks remain deterministic and fail closed.
• Driver SHA-256 3f0b14cddd27ef7638b3227159af686defa5f5662c893096cc6711a692d57d1a matches all bound references.

Security

• Fixed-format builtin printf does not evaluate document content; external hash tools receive data only through stdin.
• Environment clearing, no-follow snapshots, private scratch, pinned component validation, fixed errors, and postflight checks remain intact.
• No credential, network, candidate execution, target write, dispatch, retry, reconciliation, publish, activation, or external effect was added.

Compliance

• Exact nine-path diff, clean worktree, local/remote head, base, and merge ancestry match.
• Restore manifest remains append-only.
• Schema guard stays closed: four exact scanner paths enter the v2 generation sets, and only state-scanner.jq enters the exact schema-import allowance; no glob, prefix, or fallback widened.
• The scanner remains inactive, observation-only, deterministic, restorable, and authority-free.
• Required CI run 33628755110, check 100242710051, completed successfully from app 15368.
• Focused scanner proof passed 38/38; portable-core schema groups, including 39/39 activation guards, passed with zero failures.

[yihanzhu]

Construction publish receipt

• reviewed head/base: 123d177 / 022c786
• required CI: app 15368, check 100242710051, success
• independent review: comment 5509767340, zero unresolved Important
• squash merge/main: 1f99263
• reviewed/merged tree: 58c88adb0b5faeb56b4f275b09da71ef087a93ae
• canonical receipt SHA-256: 5392491b255e45c0a7d66f311c9ffc785acb7751c760941266fa4aa3c627838c
• local main: clean and fast-forwarded
• Roadmap item 3 scanner unit: complete