docs planning history P01_P09_PROGRESS_20260930 - AlexandreZanata/Abastevo GitHub Wiki
Current execution state
Updated: 2026-09-30, P08 INTEGRATED; P09 opened (P09-T01 release rehearsal next).
Branch: codex/phase-09-release-gate, based on 4ce5aaf; clean.
Phase P08 INTEGRATED: PR #9 merged 134d057 → 4ce5aaf (match-head-commit, Quick verification + fast/integration/test green); branch codex/phase-08-hardening deleted locally + remotely, verified; merge recorded in PR #9 metadata; wiki WIKI_PENDING. Includes fix 134d057 for community cache_test collision that blocked integration. Post-merge main CI runs automatically.
Phase P07 INTEGRATED: PR #8 merged c651b3e → 16cf91c (match-head-commit, Quick verification + fast/integration/test green); branch codex/phase-07-moderation-privacy deleted locally + remotely, verified; merge recorded in PR #8 metadata; wiki WIKI_PENDING. Post-merge main CI runs automatically.
Phase P06 INTEGRATED: PR #7 merged abd164e → cb38848 (match-head-commit, Quick verification + fast/integration/test green); branch codex/phase-06-consensus-trust deleted locally + remotely (auto-delete on merge), verified; merge recorded in PR #7 metadata; wiki WIKI_PENDING. Post-merge main CI runs automatically.
Phase P05 INTEGRATED: PR #6 merged 0e4d326 → 2213685 (match-head-commit, Quick verification + fast/integration/test green); branch codex/phase-05-private-evidence deleted locally + remotely (auto-delete on merge), verified; merge recorded in PR #6 metadata; wiki WIKI_PENDING. Post-merge main CI runs automatically.
Phase P04 INTEGRATED: PR #5 merged 19c2800 → 52e889a (match-head-commit, Quick verification + fast/integration/test green); branch codex/phase-04-observations deleted locally + remotely, verified; merge recorded in PR #5 metadata; wiki WIKI_PENDING. Post-merge main CI runs automatically.
Phase P03 INTEGRATED: PR #4 merged 762615a → 6a12dcd (match-head-commit, all checks green); branch codex/phase-03-anonymous-identity deleted locally + remotely, verified; merge recorded in PR #4 metadata; wiki WIKI_PENDING. Post-merge main CI runs automatically.
Main protection ACTIVE: strict, required [Quick verification], PR required, enforce-admins, no force/deletion.
P04 entry G03 satisfied. Exit G04 pending; no current-price claim at receipt.
P04-T01: LOCAL_DONE — community/domain immutable Observation (server IDs/times/attribution only, STANDARD sentinel, policy v1, freshness flags, PriceObserved event; stdlib-only with kernel cross-check test); invalid amount/unit/condition/identity/time cases, supersedes link, historical flags; RED proven by dropping the range check, GREEN on restore; manifest extended.
P04-T02: LOCAL_DONE — community/domain validation state machine (RECEIVED→VALIDATING→VALIDATED/REJECTED, VALIDATED→REJECTED moderation-only; persisted command proof on claim, worker-only admit/reject, stable reasons, privileged case-bound invalidation; immutable decisions with sequence + event names; freshness/confidence/disputes kept separate); exhaustive valid/invalid/actor/reason/command matrix; RED proven by dropping the admit guard, GREEN on restore; no new manifest packages.
P04-T03: LOCAL_DONE — db/migrations/000008 (observations with natural-key unique + price/contributor indexes, decisions with per-observation sequence unique, append-only) + db/queries/community (per-owner sqlc schemas) + adapters Store (fact+job atomic submit via injected enqueue closure, natural-key retry converging with divergent-payload conflict, machine-enforcing RecordDecision with exact sequence, readers); integration on real PostGIS: fact+job atomicity, retry/concurrency convergence, rollback on enqueue failure, out-of-order/forged-state refusal, history order, no destructive SQL paths; RED proven on the FromState guard (needed an exact known-pair case after a masking attempt), GREEN on restore; manifest extended.
P04-T04: LOCAL_DONE — community/application submit/status/history use-case (validated submit, quota, idempotent replay, owner-scoped status/history; RECEIVED only, missing+foreign share one 404) + adapters/http handlers (strict wire parse with canonical integer amounts, status/history reads, no-store, sealed keyset cursors with nano precision) + contract-first OpenAPI paths/schemas/vectors + 000009 attribution-token ledger + cmd/api composition (real auth/quota/idempotency/attribution/enqueue closures, errors mapped onto community sentinels); full-stack integration on real PostGIS: receipt envelope, replay convergence, body-conflict, validation matrix, owner/foreign/unknown/malformed cases, cursor walk with tamper refusal, cross-contributor isolation; RED proven on the quota-sentinel unwrap, GREEN on restore; race + quick-verify green.
P04-T05: LOCAL_DONE — community/application Validate (claim with job-ID proof, station/trust/evidence/location ports, metadata-only admits, photo path pends to 24h timeout, transients retry, terminal idempotent, admit enqueues community-consensus) + adapters/jobs validate-observation handler + Store.RecordDecisionWithJob atomic decision+job + worker wiring (real station ports; evidence/trust deferred honestly to P05/P06); RED proven by inverting the station guard, GREEN on restore; unit + race/integration (incl. atomic commit/rollback) + quick-verify green; manifest extended.
G04: P04-T01…T05 INTEGRATED (entry G04 satisfied for P05).
P05-T01: LOCAL_DONE — evidence/domain upload session (JPEG-only, 1..3MiB declared, 64-hex hash claim normalized, server quarantine key, ISSUED→VERIFYING→READY/REJECTED + 24h ISSUED→EXPIRED, stdlib-only) + evidence/application Reserve (auth, quota-before-work with 429 delay, natural-key retry convergence, divergent-payload conflict, per-contributor isolation); RED proven by dropping the MIME guard, GREEN on restore; unit + quick-verify green; manifest extended. Presigned issuance/verification/binding stay in P05-T02…T04.
P05-T02: LOCAL_DONE — evidence/adapters/storage stdlib SigV4 presigned PUT (exact-key/content-type/expiry binding, q/ namespace, 1..15min TTL, no ACL grants, no logged secrets) proven against an independent spec reimplementation (round-trip, expiry, foreign-key/tamper refusal, size-unenforced-by-design, determinism); contract-first OpenAPI POST /v1/uploads, POST .../complete, GET ... + 5 golden vectors (vacuum 0 errors/warnings, apicontract green); no new dependency. Emulator + isolated R2 staging PENDING (no registry access for minio image, no staging credentials in this environment); adapter targets real SigV4 so both can run when available.
P05-T03: LOCAL_DONE — evidence/adapters/media stdlib snapshot pipeline (bounded size + server SHA-256, magic + strict segment walk with EOI-terminal enforcement, 12MP/8192px caps pre-decode, full decode, EXIF-free deterministic re-encode, server dHash, content-addressed f/ key) + evidence/application Verify (VERIFYING-only, exactly-once download, size/checksum/structure/dimension gates with stable reasons, transient transport errors, READY outcome with final key + signals); fixtures: checked-in 4x4 JPEG plus in-test EXIF splice, SOF bomb headers, polyglot tail; RED proven on unsigned-content-type (T02) and dHash test bug fixed (monotonic fixtures shared bits); storage tamper-test flake fixed (port-varying signature tail now flips deterministically; 20x + race green); manifest extended. Persistence/binding stay in P05-T04.
P05-T04: LOCAL_DONE — 000010 sessions (guarded lifecycle + reasons + updated_at) + immutable objects with single bind claim + queries/evidence (sqlc) + adapters Store (reserve converge/conflict, complete claim+verify-job atomic with rollback, READY+object atomic with duplicate-key rollback, rejection reasons, bind set-if-unbound-or-same, daily counter, no-destructive-paths) + adapters/jobs verify-evidence handler (terminal idempotent, spurious-ISSUED fails, rejection/transient mapping) + storage PresignGET/bounded Get/Put + adapters/http reserve/complete/status (strict parse, 201/202/200, 404-sharing, 409/429/503, no-store, no key/URL leaks) + R2 config (all-or-nothing, loopback-http only, redacted) + 10/day reserve cap + community photo bind-at-validate (evidence-reused refusal) with real reader/claim wired in api+worker; integration on real PostGIS with race (store atomicity/rollback/bind matrix, community suite, config); manifest extended. Orphan sweep stays in P05-T05.
P05-T05: LOCAL_DONE — 000011 retention columns/indexes + sweep queries (sqlc) + Store inventory (idle expiry with keys, stuck/young verifying split, guarded stuck expiry with in-statement age cutoff, convergent delete markers, 90-day purge count, dHash lookup) + application Sweep (24h quarantine cap, live-lease skip, 14d/30d-cap final policy as pure FinalDue, best-effort storage with counts, fail-fast DB) + storage presigned DELETE/transport + jobs sweep handler (versioned, logged report) + worker evidence-sweep-hourly wiring (dedupe-aware live-lease check, namespaced deletes); deleted finals read unavailable with hashes to 90d; RED→GREEN on sweep matrix; no-destructive-paths guard extended honestly (bind claim + final marker + 90-day purge); integration on real PostGIS with race; no new manifest packages. Sessions ledger retained (erasure is P07).
G05: P05-T01…T05 INTEGRATED (entry G05 satisfied for P06).
P06-T01: LOCAL_DONE — versioned signals policy in community/application (NEAR/FAR/UNKNOWN proximity with centroid-never-precise B-BR-014, 6h/48h recency, capture flags, photo/duplicate classes, ±25% regional band as signal-only, stable risk codes + needs-review; single strong signals never certify) + 000012 bands-only projection (sqlc upsert/rebuildable) with schema-privacy test proving no coordinate/meter columns + loader DeriveSignals over station/photo/regional ports (unavailable fails, recompute converges) + ObjectSignals evidence read + post-admit Derive hook in validate-observation worker wired to real directory/evidence/official ports; claimant-position intake deferred honestly (proximity UNKNOWN live, NEAR/FAR matrix tested for activation); RED proven by dropping the centroid guard, GREEN on restore; unit + race/integration on real PostGIS; no new manifest packages. Consumed by P06-T04 consensus.
P06-T02: LOCAL_DONE — community/domain immutable Confirmation (author-vs-contributor self-ban) + Dispute (6-reason enum, OPEN state, replacement≠target) with events; 000013 confirmations (pair + natural uniques) + disputes (natural + partial OPEN-triple uniques) via sqlc; application Confirm (VALIDATED + 48h-eligible gate, quota, converge/conflict/amplify-refusal, recompute enqueue) + Dispute (non-rejected gate, active-repeat dedupe, replacement existence); adapters atomic Confirm/Report (insert+job, rollback, 8-way concurrency → one vote, insert-only guard); adapters/http confirm/dispute endpoints (strict parse, 201, 400/401/403/404/409/429, no-store) + contract-first OpenAPI paths/schemas/Forbidden + 4 vectors (vacuum 0 errors/warnings, apicontract green); api wiring with quota/enqueue closures; RED proven on self-ban, GREEN on restore; unit + race/integration on real PostGIS; no new manifest packages. Recompute consumer lands in P06-T05.
P06-T03: LOCAL_DONE — trust/domain tiers + immutable decisions (case refs required beyond NEW) + Evaluate policy (14d/10-reviewed/5-days, abuse withholds, BLOCKED never automatic) + latest-wins current + payment-invariance-by-construction test, stdlib-only; 000014 decisions + rebuildable current view via sqlc; adapters Store (decision+projection+recompute atomic with rollback, unknown reads NEW, concurrent appends keep every verdict with version bumps, append-only guard); application Record (auditor-driven, validation before work, recompute enqueue); worker Trust port wired to the real ledger (stub closed); RED proven by dropping the case guard, GREEN on restore; unit + race/integration on real PostGIS; manifest extended. Recompute consumer lands in P06-T05; operator auth in P07.
P06-T04: LOCAL_DONE — community/domain deterministic Compute over consensus-v1 (eligibility with key match + blocked/stale/self-confirmation handling, per-contributor latest reduction, exact-amount groups, weight/supporters/recency/amount/uuid ordering, 60% two-sided conflict, moderation flag, LOW/MEDIUM/HIGH gates with photo-independence dedup and strict 25% runner bound, 48h expiry + freshness, versioned, stdlib-only) proven by 21 golden fixtures in contracts/testdata/consensus (every spec case: unknown/low/medium/high, self/retry/switch/duplicate, disputed pair, geo/photo gates, qualifier separation, key mismatch, stale anchors, moderation, blocking, exact 60%/25% boundaries, version replay) each also replayed reversed for permutation invariance, plus input-validation, weight-boundary and no-paid-weight unit tests; RED proven on the 60% boundary, GREEN on restore; no DB/HTTP changes; no new manifest packages. Consumed by projection in P06-T05.
P06-T05: LOCAL_DONE — 000015 current-prices (composite key, nullable amount/rep, versioned) + restricted audit inputs + queries/community (advisory lock, eligible anchors with latest-state filter, confirmations by anchor, guarded versioned upserts, due list) via sqlc; application Recompute/RecomputeKey (key from trigger, vote assembly over ports, ineligible-anchor confirmations drop, representative + next-boundary computation with no-wake for stale) + NextRecomputeAt; adapters SaveProjection (lock+version+inputs atomic, 8-way concurrency serializes to exact versions), EligibleAnchors state filter, ConfirmationsForAnchors, DueProjections; jobs community-consensus consumer (observation/key triggers, drains jobs parked since P04-T05) + consensus-boundary sweeper (per-key dedupe); adapters/read indexed reads with query-time B-BR-008 expiry and HIGH decay; official prices endpoint fills the community section (nil-safe, existing null test untouched) + contract-first CommunityPrice schema/vectors (vacuum 0/0, apicontract green); worker wiring with shared recompute ports (directory/evidence/trust/official closures) + hourly boundary schedule; RED→GREEN across policy/loader/store/jobs/read; unit + race/integration on real PostGIS (migrations 000013…000015); manifest extended.
G06: P06-T01…T05 INTEGRATED (entry G06 satisfied for P07).
P07-T01: LOCAL_DONE — moderation/domain case queue (OBSERVATION/DISPUTE/CONTRIBUTOR/EVIDENCE targets, OPEN-only open, P1>P2>P3 rank, 200/500 reason/detail bounds, UUID evidence refs, moderation-v1, stdlib-only) + 000016 cases (open-target unique, priority/age queue index, no GPS/media columns) + queries/moderation via sqlc (insert-converge, open lookup, keyset list with INT/TIMESTAMPTZ/UUID casts) + adapters Store (duplicate converge preserving first reason, 8-way concurrency → one row, priority-then-age cursor walk, evidence-identifier-only, schema-privacy + no-destructive-paths guards) + application Open/List (worker-driven, contributor-P1 default, keyset pages); RED proven by accepting P0, GREEN on restore; unit + race/integration on real PostGIS + quick-verify green; manifest extended. Operator actions stay in P07-T02.
P07-T02: LOCAL_DONE — moderation/domain audited actions (REVIEW/INVALIDATE/BLOCK/RESOLVE/DISMISS, mandatory actor+reason, target gating, terminal-close, ModerationActionRecorded, stdlib-only) + 000017 append-only actions + queries/moderation (insert/list + single guarded TransitionCase) + adapters RecordAction (audit+status+job atomic, rollback on enqueue failure, post-closure refusal, guarded-UPDATE/no-DELETE + both-tables schema-privacy guards) + application Act (restricted-access caller, INVALIDATE→community-consensus / BLOCK→trust-recompute / else moderation-applied job mapping) + cmd/ops (act/invalidate/block with community Invalidate + trust BLOCKED downstream steps, case-bound 60s evidence-url with URL-never-logged audit, pure arg/operator/binding tests) + docs/operator/access.md runbook; no public admin path; RED proven on the operator guard, GREEN on restore; unit + race/integration on real PostGIS + quick-verify green; no new manifest packages. Export/erasure stay in P07-T03/T04.
P07-T03: LOCAL_DONE — privacy/domain request ledger (EXPORT/DELETION types, REQUESTED→READY/FAILED, 24h window derived at read, 1MiB archive cap, identifier-only rows, stdlib-only) + 000018 requests (owner natural unique, owner/expiry indexes) + queries/privacy via sqlc (insert-converge, guarded MarkReady/MarkFailed, no DELETE) + adapters Store (retry converge ignoring minted IDs per B-BR-005, divergent-payload conflict, hash-verified bounded complete, owner-only reads sharing one not-found shape, rollback on enqueue failure, 8-way concurrency → one row) + application Request/Build/Status/Download (proof-derived owner, redacting inventory port, terminal replay, expiry refusal) + adapters/jobs export-build consumer + identity Profile reader + worker wiring (real identity/community/trust inventory closure, 100/page 5000 cap); evidence metadata joins T04 with erasure; signed HTTP endpoints stay for the P09 rehearsal slice; RED proven on the owner guard, GREEN on restore; unit + race/integration on real PostGIS + quick-verify green; manifest extended.
P07-T04: LOCAL_DONE — privacy/domain erasure ledger (5 scopes, CompleteDeletion receipt without bytes, identifier-only rows, stdlib-only) + 000019 deletion ledger (per-contributor/scope unique) + queries/privacy (ledger insert-converge/list/replay-mark, archive purge, deletion-ready guard) + per-module narrow erasure: identity DeleteContributor (deleted status, token cleared, keys revoked), community EraseContributor (facts unlinked to anon, votes unlinked per row, consensus jobs per affected key, atomic), evidence EraseContributor (best-effort storage purge + session expiry + object marks), trust EraseContributor (current dropped → NEW, decisions unlinked) + privacy Erase/ReplayLedger (scope-ordered with ledger-after-success, FAILED receipt on scope error, convergent replays) + adapters/jobs erasure consumer + worker privacy-erasure wiring (real stores, R2 deletes) + ops privacy erase/replay + docs/operator/recovery.md (traffic-closed restore, ledger replay, post-snapshot re-issue); cross-module integration on real PostGIS proves link/media removal, fact preservation, converged repeat, stale-restore replay with stamps, and purged-download refusal; no new manifest packages. Retention scheduler stays in P07-T05.
P07-T05: LOCAL_DONE — retention policy (500-row batches, 12mo closed-moderation, 35d ledger horizon, expiry-driven purges, observation metric-only) + owned purges: identity challenges/idempotency (boundary + 1200-row batch), moderation closed cases+actions, privacy expired archives + old ledger, community oldest-fact metric + privacy/application Retain (per-category reports, failure still reports others) + adapters/jobs retention consumer (versioned payload, structured metrics log) + worker privacy-retention-daily wiring across real stores + docs/backend/PRIVACY_NOTICE.md draft (rights + full purpose/retention/access/deletion matrix) + docs/operator/retention.md (schedules, metrics, failure handling); 24mo observation purge needs FK-consistent cascade design (metric visible, enforcement follows); unit + race/integration on real PostGIS + quick-verify green; no new manifest packages.
G07: P07-T01…T05 INTEGRATED (entry G07 satisfied for P08).
P08-T01: LOCAL_DONE — infra/compose.staging.yml + compose.prod.yml (isolated projects/networks/volumes, private DB with no published ports, one-shot migrate profile, pinned postgis/caddy digests + immutable release tags, resource limits, restart policies) + infra/caddy/Caddyfile (admin off, TLS 1.2/1.3, trusted_proxies private_ranges only, /v1+health proxy with canonical origin headers, 404 default, no metrics/admin/db route) + env.{staging,prod}.example (placeholder-only templates) + scripts/check-infra-config.sh gate (render asserts: exactly 2 published ports, no dev defaults/latest, pinned images, per-env volume, edge rules, placeholder examples; never prints values) + scripts/tests/test-infra-config.sh harness (2 accepts + 5 mutant refusals) + scripts/infra-smoke.sh (static topology smoke; --live edge/TLS at deploy) + Makefile check-infra/test-infra + infra README staging/prod section; RED proven by gate refusals on real files before fixes plus per-class mutants, GREEN after; docker compose config both envs + harness 7/7 + quick-verify green; review-only, nothing provisioned. Deploy/rollback stays in P08-T02.
P08-T02: LOCAL_DONE — infra/scripts/deploy.sh (immutable release + previous-required + clean-tree revision prechecks, backup-manifest gate, builds, one-shot migrate, rollout, readiness/smoke gates, automatic return to previous compatible release with honest rolled-back/rollback-failed receipts, exit 0/1/2 contract) + scripts/tests/test-deploy.sh harness (9 stubbed docker/curl scenarios: happy, migration/readiness/smoke rollback, missing release/tag/backup refusals without mutations, build refusal, failed-rollback honesty) + docs/operator/deploy.md runbook (sequence, prechecks, rollback decisions, receipt keeping, CI publish design, staging drill) + Makefile test-deploy + infra README pointer; no destructive down migration by construction; RED proven by harness failures during development (set -e capture, curl-fail-all masking rollback, over-strict mutation asserts), GREEN at 9/9; live staging drill stays for the provisioned host. Backups stay in P08-T03.
P08-T03: LOCAL_DONE — infra/scripts/backup.sh (AES-256-CBC/PBKDF2 dumps via container pg_dump, roles+extensions manifest with SHA-256, verify with decrypt + catalog-list proof, 7 daily + 4 weekly prune, stale-age alarm, dev-topology guard, secret-free manifest) + scripts/tests/test-backup.sh harness (10 real scenarios on the disposable dev DB: run/verify, secret-free manifest, corruption/passphrase/credential refusals, stale alarm, prune) + docs/operator/backup.md runbook (schedule, transport, credential scope, recovery linkage) + Makefile test-backup + infra README pointer; recovery passphrase stays outside the VPS; RED proven by trap/set -u exit-code bug, misplaced env prefixes and real pg_hba trust discovery, GREEN at 10/10. Restore drill stays in P08-T04.
P08-T04: LOCAL_DONE — infra/scripts/restore.sh (artifact verify-first, drill-pattern-guarded fresh target, container pg_restore, ledger/extensions/counts/orphan verification with pending-replay report, forensic keep/drop) + scripts/tests/test-restore.sh drill (9 real scenarios on the disposable dev DB: backup, corrupt refusal without creating, verified restore with source-equal counts, real ops-binary ledger replay with unlink+stamps, erased-state preservation, guarded drop) + docs/release-evidence/p08-t04-restore-drill.md + Makefile test-restore + infra README pointer; RED proven by UUID-LIKE scrub bug, stale dev DB missing new migrations, and trap/set -u exit-code handling, GREEN at 9/9; staging acceptance repeats on provisioned infra. Metrics/alerts stay in P08-T05.
P08-T05: LOCAL_DONE — telemetry/metrics (bounded-label registry with series cap, Prometheus exposition with no-store, chi middleware counting by method/route-template/class) + telemetry/alerts (rules with cooldown dedupe, log + webhook notifiers, fixed-field payloads) + platform JobBacklog (queued/dead/oldest, no payload reads) + ANPFUEL_METRICS_ADDR (loopback default, empty disables) + api wiring (private listener with shutdown, request middleware, pool/jobs scrape collectors with NaN-on-unknown) + ops monitoring eval (db/jobs/backup rules, exit 1 on firing) + docs/operator/monitoring.md (endpoint, PromQL, alert catalog, notification route, leak response); live proof: bad-DSN eval fires db_down, healthy eval quiet, booted api serves bounded series with no IDs; RED via cardinality/name/shape rejections, GREEN after; unit + race + quick-verify green; manifest extended. Cache/proxy stays in P08-T06.
P08-T06: LOCAL_DONE — cache allowlist pinned in handlers (public search/detail/prices/history with bounded TTLs + ETag/304; nearby/writes/owner-reads/errors no-store) + new cache_test.go invariance suites (identical bodies with Authorization/Cookie, no Vary on identity, bodiless 304, error no-store) + Caddy request_header stripping of Cookie/Authorization on the shared-cacheable GET set (signed traffic never matches) enforced by the infra gate + docs/operator/edge-cache.md (allowlist table, key policy, Cloudflare rules, purge procedure, signature-through-proxy, rollback) + scripts/cache-regression.sh live matrix; live proof against booted api: 10/10 (missing-fixture 404s and short-query 400 diagnosed as fixtures, fixed with seeded station + valid query); unit + quick-verify green. Load/failure campaign stays in P08-T07.
P08-T07: LOCAL_DONE — backend/testdata/load/seed.sql (deterministic idempotent stations) + infra/scripts/load/run.sh (seed assert, api boot, origin-read RPS with p95/5xx budget gates, seed scrub) + faults.sh (db outage fail-closed + recovery, storage-outage 401 with no costly grant, capped disk pressure) + stats.py (percentiles + self-test) + scripts/tests/test-load.sh harness + Makefile test-load + docs/release-evidence/p08-t07-load.md (54,951 reqs, p95 8.1 ms, 0 5xx, faults 7/7, explicit non-claims); RED proven by comment-eaten SQL, uuid/format specifiers, unset-trap vars and missing cleanup fn, GREEN after; staging 30-minute matrix stays in P09. Security review stays in P08-T08.
P08-T08: LOCAL_DONE — scripts/check-security.sh (static pins/provenance/edge/placeholder/secret review + govulncheck + 18 focused replay/IDOR/SSRF/oversize/role/secret suites) + scripts/tests/test-security.sh harness (10/10: static accept, 7 mutant refusals, live govulncheck, adversarial selection) + Makefile check-security/test-security + docs/release-evidence/p08-t08-security.md (no critical/high, inventory, non-claims); scanner exclusion for the new gate literal in scan/quick/fast gates; RED per fault class via mutants, GREEN full gate + quick-verify green; manifest unchanged.
G08: P08-T01…T08 INTEGRATED (entry G08 satisfied for P09).
P09-T01: LOCAL_DONE — backend/testdata/e2e (candidate 4ce5aaf, BUC-001…008 chain, B-BR-001/002/008/011, synthetic c000… stations) + infra/scripts/rehearse.sh (candidate/clean/core-tree gates, PostGIS, seed 2, API boot, 6 reads + 4 denied, source-separation + no-secrets checks, scrub) + scripts/tests/test-rehearse.sh (happy + 3 mutant refusals) + Makefile test-rehearse + docs/release-evidence/p09-t01-rehearsal.md; full go test -race -tags=integration ./... 57 ok/0 FAIL on disposable DB; RED via search-term/JSON-key bugs, GREEN on restore; quick-verify 8s green; deployed staging matrix stays pending.
P09-T02: LOCAL_DONE — contracts/testdata/compat/legacy-deltas.json (frozen A01-A13 fuel/CNPJ/precision/FTS/schema/parser/policy deltas for P10) + scripts/check-compat.sh (vacuum 0 errors, fixture + wire-enum + runbook gates) + scripts/tests/test-compat.sh (happy + 2 mutant refusals) + Makefile check-compat/test-compat + docs/release-evidence/p09-t02-compatibility.md (A01-A13 table, vacuum 0 err/9 info + apicontract ok, Android baseline BUILD SUCCESSFUL 11s up-to-date, no Kotlin-Go harness claimed); RED via mutants, GREEN; docs-only, no Android edits.