This is the filed review document, copied at 09:19 EDT. Its dated claims remain historical. See the current update before acting on an old sign-in request or delivery status. Reply in chat with decisions or feedback.

Domain memory is gated per record, and WOB-138 decides which record the gate reads

Mid-build review · 116 · prepared 20 October 2026 · source reads 04:20–04:34 EDT · current state added 06:21 EDT

Current state, read this first

The analysis below is dated. Its source reads predate the 05:21 EDT install of PR 320 and the later WOB-138 disposition, so the table here is the live picture. The body keeps its 04:20 evidence and marks where it has changed.

Original analysis (04:20–04:34 EDT reads)

Nothing can read or write Apple craft in production right now. Both memory flags are false, the Apple admission lists are empty, and at the 04:20 reads the six-domain component (WOB-115) was built but not merged. PR 320 merged it at 05:19 EDT and it was installed at 05:21 EDT, so the current-state table above is the live picture. The review question is narrower. Every check in the domain path, from admission to delivery, works on the Work record it is handed. The variable that picks that record is set in the helper's own environment. That is WOB-138, and it blocks WOB-116.

My reads were taken after PR 312 merged at 08:20:06 UTC. I used source at named commits, read-only GitHub and Linear, and the local state files named below. I ran no tests, no service or model calls, no memory reads, no watcher commands and no token reads. This review extends domain-contract.md in this folder, the original boundary record, through delivery and readiness. It does not add a second approval gate.

The card shows one contribution through the path. The two red steps are where the variable matters.

What changed since A's report

A's 08:13:56 UTC report had PR 312 open at baa5f324. It has since merged as 8972cd5 and, per A's report, was installed in window 4 at 04:21 EDT. Root read the install receipt directly: from 6c14a9b to 8972cd5, outcome installed, watcher running_new, finished 08:22:19 UTC. I did not read that receipt, and I did not check the watcher myself, because the brief bars watcher commands. My own evidence is narrower. The deployed checkout's reflog shows a fast-forward to 8972cd5 at 04:21:10 EDT, and the committed flags are both false. Those agree with root's reading. The earlier window-3 claim for 6c14a9b matches a reflog fast-forward at 04:00:03 EDT. A's "revision 7" is routing.revision in the deployed settings, which reads 7 in my local read of the working copy.

These readings are dated. Deployed HEAD moved after them, and the receipts show the chain: PR 319 (41d870cc) at 08:57Z (04:57 EDT, receipt 20261020T085547Z-4734), PR 320 (8a467995) at 09:21Z (05:21 EDT, receipt 20261020T091950Z-6057), and PR 318 (f66d4f2) at 09:31Z (05:31 EDT, receipt 20261020T093017Z-23597). So 8972cd5 is no longer deployed HEAD. It is an ancestor of the current one.

PR 306 (WOB-112) merged at 06:51:05 UTC as 06ad669 from reviewed head bdf1b75, and it is in the deployed history. Its description still says "not merged or installed" in its pre-merge text, so that line is stale. The disposition file at bdf1b75 records the limits that matter for WOB-116. The broader prompt rescore is still pending. The shell correction route was instructed in the proof rather than chosen unprompted. Its first shell attempt understood the correction but could not save it, and the cause was driver accounting, not a memory result. The model chose whole originals rather than the narrow clauses, so passage minimality remains a quality limit. WOB-114's diagnostic also overlapped the same shared test workspace around 06:08 UTC, and the disposition says it cannot make an unconditional claim that the overlapping run held no foreign message. WOB-112 is Done, but these are not an all-real-tests-green result.

PR 312's body header says it was installed at 04:21 EDT. A subsequently filed the permanent exact-head review record, which root read at 04:32 EDT. It records the actual Haiku LSP passes, Sonnet's blocking review, repairs through baa5f324, the nonblocking delta review and green CI. The earlier live proof predates the final PATH and notice repairs; those later changes have focused regression evidence, rather than a repeated live proof. WOB-138 and WOB-116's application rehearsal remain open.

WOB-113 is Done, and WOB-45 records its PR 299 as merged and installed on 20 October. I did not check that install independently.

The local state I did read: ~/.local/state/WobOS/memory-mode.json reads revision 1 with both flags false. The committed config/settings.json at 8972cd5 has memory.enabled and memory.remote_enabled both false. The deployed working copy carries an uncommitted diff of 28 added and 1 removed lines, which matches the preserved patch the runbook describes. At f66d4f2, the deployed HEAD now, the committed config/settings.json still has both flags false (lines 542–543).

The five states

How the path works, and where WOB-138 breaks

A helper runs as a worker process. At launch, the worker writes that process's own Work id into its environment as WOBOS_TASK_ID. Three places read that variable. I read them at PR 312's head (baa5f324), fetched read-only, because the 115 checkout predates PR 312.

# WobOS/worker.py:511-512 at baa5f324
if (args.domain or args.domain_sources) and os.environ.get('WOBOS_TASK_ID'):
    raise Failure(7, 'only the chief can admit a domain assignment or sources')

The chief is whoever has no such variable in its environment. The helper's shell controls its own environment, so the variable is a claim about the caller, not a verified identity. Unsetting it passes the gate. That is a reading of the source. I did not run it.

# WobOS/domain_craft.py:37-39 at baa5f324
task_id = os.environ.get('WOBOS_TASK_ID')
if not task_id:
    code, error = USAGE, 'domain craft requires WOBOS_TASK_ID'

Whatever id arrives here becomes the Work record that the rest of the path trusts. WobOS/memory_runtime.py:2293 and :2315 read the same variable for the older explicit lookup, which returns another Work's saved memory_context. That lookup refuses first unless selective memory is on.

Those line numbers are from PR 312's head. PR 320 changed worker.py, domain_craft.py and work.py after that point. At deployed HEAD f66d4f2 the same logic sits at WobOS/worker.py:552–553 (the chief gate), WobOS/domain_craft.py:45–47 (the Work id), WobOS/memory_runtime.py:2293 and :2315 (same line numbers), and WobOS/work.py:367 (domain_context_current), which is called for the delivery stage at line 568.

Three different things

So the access checks are sound about the record they receive. A forged id names a different record, and the checks pass on that record. From the source, a helper that named an assignment whose domain is jr would be read through justanother, with that record's sessions and audience. I have not run that. It is a reading.

Several conditions keep this latent today. domain_boundary raises PermissionError while the Apple lists are empty. Its caller refuses when selective memory is on or --domain-sources is requested (worker.py:560-563), and _boundary refuses as well. The older remember path refuses while both flags are false. Latent is not fixed, so A's activation must not happen before this closes.

The delivery check is different. domain_context_current (work.py:321 at PR 312's head, work.py:367 at f66d4f2) receives its task id from its caller (line 495 at PR 312's head, line 568 at f66d4f2), not from the environment. Whether that caller's id is trustworthy depends on the upstream delivery caller, which I did not trace. PR 312's own "Still open" notes say the JA-scope return hold applies only when a Work holds a craft packet, which matches the early return described under the undo notes below.

What closes WOB-138

No test at PR 312's head sets a forged WOBOS_TASK_ID (none in tests/test_domains.py or tests/test_worker.py), and none unsets it to test the chief gate. At the 04:20 reads A owned this narrow repair, and root's update said it had not started. The current status is in the handoff at the end of this document. PR 312's own "Still open" section names the same blocker and calls it latent while admission is empty and memory is off. The repair needs three things:

1. A test that a forged id naming another Work is refused.
2. A test that an unset id cannot pass the --domain chief gate.
3. A binding the helper cannot forge. At the 04:20 reads, A owned the concrete implementation through the existing worker and harness boundary; merely moving an identifier to another location the same helper can read would not establish this. Treating the boundary as cooperative controls would change the approved access outcome and needs Toberton's explicit choice. It is not accepted here.

The older remember path uses the same variable, so the fix should cover it too, or record why it doesn't need to.

The M03 scopes

The runbook (captain-workbench/integration/plan-2/m03-activation-runbook-2026-10-19.md) covers only base memory. The per-domain, JA seed and job scopes are separate effects. The 20 October authority names the two catch jobs, keeps the memory switches false, and holds JR deployment and seed writes. The older conditional WOB-45 instruction from 19 October, "if every real test passes, turn memory on", does not override that. The 20 October instruction is later, and it says the switches stay false.

Each scope is independent. Activating a catch job does not turn memory on. With the flags off, the personal scope's recall is not admitted, so the job runs without memory.

Undo, and what it leaves behind

• Base memory. The runbook's window sets both flags back to false (§3). The record moves to a new revision and generation. Work stamped under the on-generation is held for reframing. The old off-generation is not revived. Writes already in Honcho stay there. Removing remote data is a separate action. scripts/memory/export.py takes snapshots, and scripts/memory/delete.py deletes one approved export. The runbook describes delete as a dry run unless --apply is given.
• Each domain. The runbook has no per-domain undo step. Clearing an admission list does not move the generation, because the generation hashes only the revision and the two flags (runbook §1). PR 312's delivery check compares the frozen boundary with current admission (work.py:321-347), so removal is caught when packets exist. When a Work has no packets, the function returns early, so I cannot say removal is caught for a fresh Work. WOB-116 must test that.
• JA seed. No undo is defined. Flag changes do not remove a written seed, and removal would be its own approved action.
• Catch jobs. apply refuses an owner-disabled job and does not clear holds (WobOS/schedule.py:301-305). Disabling goes through launchctl disable (schedule.py:319). A will record the exact supported named-job disable and hold-restoration commands with the activation receipt. This is part of the already authorized catch-job delivery, not a new dependency on memory activation or a new approval gate.

The common thread is that disabling a scope stops future reads and writes, and it holds work stamped under that scope. It does not remove remote data, and it does not revive old permissions.

Commands: proposed, checked, not run

Each command below comes from the current source or runbook. I did not run any of them.

Current handoff

Written at 06:21 EDT. It replaces the 04:20 list kept below.

1. Keep PR 327 an evidence draft (A). Do not merge it or treat it as a fix. Its change set is only new tests and evidence documents, and the shared runtime files were returned unchanged to A.
2. Decide the boundary before any admission change (A proposes; Toberton decides). Inbox q-cd2a2ae9 asks whether to build a separate OS identity or sandbox with trusted admission as its own slice, or to keep cooperative checks. Until that is answered, do not accept cooperative controls, and keep WOB-116 activation and both memory switches held.
3. Keep the unmet contracts red (A). They are the evidence of what is not yet enforced. Do not weaken, delete or edit them to make PR 327 pass.
4. Test admission removal before WOB-116 changes any admission (WOB-116 owner). The 04:20 review put this check in the 115 integration, which is now merged, so it belongs to WOB-116. Admission edits do not move the generation, and a Work with no packets skips the delivery check.
5. Preserve the remote CI disposition (root). Its Linux prelaunch failures and 15 unmet contracts are recorded separately from the local Mac run. No repair or passing-CI claim follows from this evidence draft.

Original 04:20 handoff (superseded, kept as written)

1. WOB-138 blocks WOB-116. You own the narrow trusted-binding repair, which has not started. Make no admission change and no base switch until it closes. The lines involved are worker.py:511-512, domain_craft.py:37-39, and memory_runtime.py:2293 and :2315, at baa5f324. Keep it to that scope and do not widen it into general hardening.
2. Add the two tests described above. Neither exists at PR 312's head.
3. Do not mark cooperative controls accepted. Root and Toberton decide that.
4. In the 115 integration, from your separate worktree on 8972cd5, test admission removal on a Work that has no packets. Admission edits do not move the generation.
5. PR 312's permanent review record is now filed and root has read it. Carry its remaining limitations into the integration and morning handoff.

Render checks

Initial render checked: source at named commits; reflog ancestry; Linear and GitHub read-only; the earlier card rendered at 1080 pixels wide (2160×1200 PNG) and inspected, with no clipping. Phone width was checked inside a 390-pixel frame (780×3000 PNG), because headless Chrome will not shrink its window below its own minimum. The layout is one column there, with nothing clipped.

Re-rendered at 06:21 EDT with scripts/render-card after the card update. The desktop card is 1080 px wide (2160×1272 PNG). Dark mode was checked with a scratch copy that sets data-theme="dark". Phone width was checked in a 390-px iframe frame (780×3000 PNG, scratch only). All three read clean, with nothing clipped.

Not checked: the loaded watcher; launchd hold state; schedule status; Honcho state; any test run.

Footprint and authority

The source reviewer ran no tests, service or model calls, memory reads, watcher commands, token reads, Linear or GitHub writes, or PRs. Temporary fetch files were removed. The reviewer read the install receipt only through the lead's update, not its directory. At the 04:20 read, the three files in this folder were committed. The 06:21 update was then incorporated into the 15-file candidate 022671e5ced50ce1aef2d37d7feb55e2366ba19c, reviewed and merged through agent-setup PR125. Render scratch files remain in the session scratchpad. The 20 October authority in astra-status.md is the current grant; earlier approval records were not edited.