Housekeeping: Lab and Experimental-Sandbox evidence pack

operations/housekeeping/HOUSEKEEPING_2026_07/BASELINE_REPORT.md

@@ -0,0 +1,58 @@
+# Housekeeping baseline report — 2026-07
+
+status_authority: NONE
+
+## Scope and safety posture
+
+This is an evidence report for a conservative housekeeping operation over Natoshi-moto/Lab and Natoshi-moto/Experimental-Sandbox. No accepted state was rewritten. No frozen snapshot, tag, receipt, manifest, hash, STATUS.json, NEXUS.json, constitution file, branch-protection setting, PR state, branch, or tag was changed.
+
+The operator's Lab checkout was dirty before work began with exactly two untracked files: NEXUS_CODEX_HANDOFF__BUILDER__TSK-LABOPS-CTRL-001.md and verify_spine_candidate.sh. I did not reset, stash, clean, overwrite, or execute work against that checkout. A separate worktree was created from the cached origin/main tip for this housekeeping branch.
+
+## Exact baselines
+
+- Lab default branch: main
+- Lab starting commit: 50377abe84493a3f2c672c04cc689e5f94546f88
+- Experimental-Sandbox default branch: main
+- Experimental-Sandbox starting commit: e88520ec6a0bf5bcff09f8d99b961e71afaaebc6
+- Housekeeping branch: codex/housekeeping-controller-001, based on Lab starting commit; pushed only as a proposal branch for draft PR #116
+- Latest accepted Lab merge at baseline: PR #114, merge commit 50377abe84493a3f2c672c04cc689e5f94546f88
+- Prior accepted infrastructure merge: PR #115, merge commit 05223aaa09f0ea89c0e54afc672b2a2452d36335
+
+## Repository and authentication observations
+
+Both repositories are public and default to main according to the connected GitHub app. The app reports administrator access and no auto-merge permission. Local gh authentication is invalid for Natoshi-moto; gh auth status returned an invalid token. A read-only fetch was attempted in both local clones and failed with DNS/network exit 128. GitHub PR, repository, commit and branch facts below therefore come from the connector plus cached refs.
+
+Branch protection and rulesets were not accessible: local gh API calls failed because the host could not be resolved, and the connected app exposes repository metadata but not protection/ruleset details. Those settings are UNABLE_TO_VERIFY and must not be treated as absent or present.
+
+## Open PR inventory
+
+Lab currently has 31 open PRs: #14, #22, #23, #24, #40, #42, #43, #44, #45, #46, #47, #49, #60, #61, #62, #78, #93, #94, #95, #97, #98, #99, #100, #101, #107, #108, #109, #110, #111, #112, and #113. The requested housekeeping set is adjudicated in PR_ADJUDICATION_MATRIX.md; older open work is retained as open proposals in the branch inventory and is not silently closed.
+
+Experimental-Sandbox currently has two open PRs: #2 and #3. PR #1 is merged into Sandbox main and is part of accepted Sandbox state, not Lab state.
+
+## Verification commands and outcomes
+
+Lab isolated worktree:
+
+- ./nexus doctor — exit 0, PASS.
+- python3 -m unittest discover -s tests -v — exit 1; 190 tests ran, 9 failures and 2 errors. The failures/errors are caused by missing @noble/ed25519 when R013/R015/R016 independent Node verifiers run.
+- ./nexus verify — exit 2; same missing @noble/ed25519 dependency.
+- python3 -m unittest tests.test_control_plane -v — exit 0.
+- git diff --check — exit 0.
+
+Sandbox origin/main worktree:
+
+- bash scripts/verify.sh — exit 0, router PASS and experimental-sandbox PASS.
+- node --check assistant/app/app.js — exit 0.
+- jq empty assistant/router/routes.json reports/CHANNELS.json — exit 0.
+- git diff --check — exit 0.
+
+These are baseline results, not proof of correctness or safety. No dependency was installed and no failing test was repaired.
+
+## Known warnings and non-claims
+
+- Full Lab verification is blocked by the missing Node dependency; do not call Lab green.
+- GitHub checks for inspected PR heads returned an empty status-context list through the connector; CI pass/fail is UNABLE_TO_VERIFY.
+- Protection/ruleset differences are UNABLE_TO_VERIFY.
+- Public visibility means draft branches and PRs may expose content; drafts are not automatically safe.
+- No open PR is accepted state. Merge is not correctness proof.

operations/housekeeping/HOUSEKEEPING_2026_07/HANDOFF_ANY_AI.md

@@ -0,0 +1,25 @@
+# Housekeeping handoff — any AI
+
+status_authority: NONE
+
+This folder is a proposal/report pack on branch codex/housekeeping-controller-001, published only through draft Lab PR #116. Lab main remains canonical accepted working state; Experimental-Sandbox main remains public, reversible and noncanonical. Nothing in this pack promotes Sandbox material.
+
+Read in order:
+
+1. BASELINE_REPORT.md — exact commits, dirty-worktree protection and tests.
+2. PR_ADJUDICATION_MATRIX.md — relevant PR facts and dispositions.
+3. VERIFICATION_REPORT.md — blockers, negative cases and Hermes claim classification.
+4. OPERATOR_DECISION_CARDS.md — one phrase per consequential action.
+5. BRANCH_INVENTORY.md — no deletion was performed.
+6. HOUSEKEEPING_RECEIPT.json — machine-readable receipt.
+
+Safe continuation rules:
+
+- Do not merge, close, delete, push, publish, alter settings, install Hermes, or execute experimental agents unless the operator uses the exact card phrase.
+- Re-fetch before any remote mutation. The current local gh token is invalid and the network fetch was blocked during this round.
+- Keep status_authority: NONE in all housekeeping analysis.
+- Do not edit frozen snapshots, historical audit targets, signed receipts, manifests, hashes or tags.
+- Passing tests are not proof. Same-account AI agreement is not independent corroboration.
+- Drafts may be public and difficult to retract; no draft is automatically safe.
+
+The recommended eventual path is: Sandbox board merge, Lab pointer merge, repair/review promotion gate, close superseded #113 if authorized, then decide #109 privacy separately. Hermes is first post-housekeeping experiment only after its documentation says clearly that the design is uninstalled/unverified and the operator separately authorizes experimentation.

operations/housekeeping/HOUSEKEEPING_2026_07/HOUSEKEEPING_RECEIPT.json

@@ -0,0 +1,208 @@
+{
+  "operation_id": "HOUSEKEEPING_2026_07",
+  "repository": [
+    "Natoshi-moto/Lab",
+    "Natoshi-moto/Experimental-Sandbox"
+  ],
+  "starting_lab_commit": "50377abe84493a3f2c672c04cc689e5f94546f88",
+  "starting_sandbox_commit": "e88520ec6a0bf5bcff09f8d99b961e71afaaebc6",
+  "housekeeping_branch": "codex/housekeeping-controller-001",
+  "files_added_or_changed": [
+    "operations/housekeeping/HOUSEKEEPING_2026_07/BASELINE_REPORT.md",
+    "operations/housekeeping/HOUSEKEEPING_2026_07/PR_ADJUDICATION_MATRIX.md",
+    "operations/housekeeping/HOUSEKEEPING_2026_07/BRANCH_INVENTORY.md",
+    "operations/housekeeping/HOUSEKEEPING_2026_07/VERIFICATION_REPORT.md",
+    "operations/housekeeping/HOUSEKEEPING_2026_07/OPERATOR_DECISION_CARDS.md",
+    "operations/housekeeping/HOUSEKEEPING_2026_07/HOUSEKEEPING_RECEIPT.json",
+    "operations/housekeeping/HOUSEKEEPING_2026_07/HANDOFF_ANY_AI.md"
+  ],
+  "commands_run": [
+    "git status --short --branch",
+    "git remote -v",
+    "git fetch --no-tags origin (Lab and Experimental-Sandbox; exit 128, DNS/network unavailable)",
+    "gh auth status (invalid local token)",
+    "./nexus doctor (exit 0)",
+    "python3 -m unittest discover -s tests -v (exit 1; 190 tests, 9 failures, 2 errors)",
+    "./nexus verify (exit 2; missing @noble/ed25519)",
+    "python3 -m unittest tests.test_control_plane -v (exit 0)",
+    "bash scripts/verify.sh (Sandbox exit 0)",
+    "node --check assistant/app/app.js (Sandbox exit 0)",
+    "jq empty assistant/router/routes.json reports/CHANNELS.json (Sandbox exit 0)",
+    "git diff --check (exit 0 before report edits)",
+    "connector PR/repository/commit/branch reads",
+    "isolated promotion-origin negative-case simulation",
+    "git diff --check after report creation (exit 0)",
+    "added-file trailing-whitespace scan (no matches)",
+    "explicit added-file secret-pattern scan (no matches)",
+    "explicit added-file local-path scan (no matches)",
+    "frozen-path diff check (no matches)"
+  ],
+  "test_results": {
+    "lab_doctor": "PASS",
+    "lab_full_unittest": "BLOCKED: 190 ran; 9 failures, 2 errors due missing @noble/ed25519",
+    "lab_verify": "BLOCKED: exit 2 due missing @noble/ed25519",
+    "lab_control_plane": "PASS",
+    "sandbox_router_verify": "PASS",
+    "sandbox_node_check": "PASS",
+    "sandbox_json_parse": "PASS",
+    "diff_check": "PASS after report creation",
+    "added_file_trailing_whitespace": "PASS",
+    "added_file_secret_scan": "PASS: no matches",
+    "added_file_local_path_scan": "PASS: no matches",
+    "frozen_path_check": "PASS: no frozen paths changed"
+  },
+  "prs_inspected": {
+    "lab": [
+      101,
+      107,
+      108,
+      109,
+      110,
+      111,
+      112,
+      113,
+      114,
+      115
+    ],
+    "sandbox": [
+      1,
+      2,
+      3
+    ],
+    "housekeeping_draft_pr": 116,
+    "open_lab_pr_count": 31,
+    "open_sandbox_pr_count": 2
+  },
+  "branches_inspected": [
+    "Lab:agent/ctrl-001-control-plane-reconciliation",
+    "Lab:agent/experimental-sandbox-promotion-gate",
+    "Lab:agent/r012-bounded-work-exchange",
+    "Lab:agent/r012-r013-promotion-closeout",
+    "Lab:agent/r013-pcx-conserved-claim",
+    "Lab:agent/r014-pcx-durable-replay",
+    "Lab:agent/r014-pcx-durable-settlement",
+    "Lab:agent/r014-promotion-closeout",
+    "Lab:agent/r015-pcx-independent-durability-verifier-model",
+    "Lab:agent/r015-promotion-closeout",
+    "Lab:agent/r016-pcx-integrated-custody-gate",
+    "Lab:agent/r016-promotion-closeout",
+    "Lab:agent/r017-replication-fork-evidence",
+    "Lab:agent/r018-pq-hybrid-admission",
+    "Lab:audit/ingest-r002-claude-results",
+    "Lab:chatgpt/r008-r010-foundation-closeout",
+    "Lab:chatgpt/r011-hard-vertical-slice",
+    "Lab:chatgpt/r011-promotion-closeout",
+    "Lab:claude/agent-resources-skills-draft-001",
+    "Lab:claude/beneficial-genesis-design-001",
+    "Lab:claude/bgen-econ-redteam-001",
+    "Lab:claude/external-web-audit-001",
+    "Lab:claude/full-history-review-001",
+    "Lab:claude/loom-first-proper-chat-001",
+    "Lab:claude/loom-test-c4-001",
+    "Lab:claude/loom-test-c5-001",
+    "Lab:claude/loom-v0-1-park-001",
+    "Lab:claude/noted-adversary-block-001",
+    "Lab:claude/pub-build-plan-roadmap-001",
+    "Lab:claude/pub-noted-frontend-privacy-assault-001",
+    "Lab:claude/r005-retest-20260713",
+    "Lab:claude/r007-remaining-adjudication",
+    "Lab:claude/r017-gitbraid-proposal",
+    "Lab:claude/recovery-workspace-001",
+    "Lab:claude/reddit-test-anchor-001",
+    "Lab:claude/sync-operator-disclosure-001",
+    "Lab:codex/adversarial-audit-recent-break-001",
+    "Lab:codex/beneficial-genesis-diff-repair-002",
+    "Lab:codex/bgen-dev-culture-challenge-001",
+    "Lab:codex/bgen-mechanism-audit-001",
+    "Lab:codex/bgen-r1-retest-001",
+    "Lab:codex/bgen-technical-audit-001",
+    "Lab:codex/noted-ods-1-p0-complete",
+    "Lab:codex/noted-phase-2-agent-prompt",
+    "Lab:dependabot/github_actions/actions/checkout-7.0.0",
+    "Lab:docs/open-gate-v0-claim",
+    "Lab:fable/bgen-dev-culture-memo-001",
+    "Lab:fable/bgen-epistemic-audit-001",
+    "Lab:fable/bgen-integration-tribunal-001",
+    "Lab:fable/break-test-rigor-review-001",
+    "Lab:fable/commons-foundation-001",
+    "Lab:fable/handoffs-operator-and-helper-001",
+    "Lab:fable/language-and-operating-standard-001",
+    "Lab:fable/learning-record-20260723",
+    "Lab:fable/operating-framework-and-record-001",
+    "Lab:fable/prerelease-ai-draft-redteam-001",
+    "Lab:fable/publish-unsealed-truth-audit-001",
+    "Lab:fable/toddler-proof-safety-kit-001",
+    "Lab:fix/r003-secret-scan-env-coverage",
+    "Lab:fix/r004-audit-integrity-scan-transparency",
+    "Lab:fix/r006-bind-snapshot-payload-to-git-tree",
+    "Lab:fix/visibility-policy-reconciliation",
+    "Lab:grok/agent-resources-round-publication-001",
+    "Lab:grok/backup-tip-e6f5324-001",
+    "Lab:grok/beneficial-genesis-breaker-repro-001",
+    "Lab:grok/beneficial-genesis-diff-retest-002",
+    "Lab:grok/bgen-econ-breaker-001",
+    "Lab:grok/bgen-econ-retest-003",
+    "Lab:grok/bgen-mechanism-audit-001",
+    "Lab:grok/bgen-r1-synthesis-001",
+    "Lab:grok/bgen-technical-audit-001",
+    "Lab:grok/break-session-1-receipt",
+    "Lab:grok/comms-research-clearance-001",
+    "Lab:grok/de-stale-t06-after-pr66",
+    "Lab:grok/emergency-operator-clarification-001",
+    "Lab:grok/emergency-stop-audit-001",
+    "Lab:grok/full-spectrum-vision-pack-001",
+    "Lab:grok/hygiene-control-plane-backup-reconcile-001",
+    "Lab:grok/noted-membrane-hardening-001",
+    "Lab:grok/post-audit-unseal-and-control-plane-001",
+    "Lab:grok/remove-accidental-fetch-head",
+    "Lab:grok/reorient-sync-backup-001",
+    "Lab:grok/session-close-t0-001",
+    "Lab:grok/truth-audit-seal-and-prep-001",
+    "Lab:grok/whoopsie-log-001",
+    "Lab:lab/operator-public-board-001",
+    "Lab:main",
+    "Lab:play/operator-abuse-sandbox",
+    "Lab:remove-board-moved-to-sandbox",
+    "Lab:seat/break-session-2-card-04",
+    "Lab:seat/break-session-2-card-06-07",
+    "Lab:seat/break-session-2-card-08-09",
+    "Lab:seat/break-session-2-card-11",
+    "Lab:seat/break-session-2-card-13",
+    "Lab:seat/emergency-truth-audit-grok-001",
+    "Lab:state/r005-audit-retest-adjudication",
+    "Sandbox:add-operator-board",
+    "Sandbox:agent/mithub-adjacent-assistant",
+    "Sandbox:main",
+    "Sandbox:sandbox/experiment/hermes-prototype",
+    "Sandbox:sandbox/thought/pcx-noted-review-proposal"
+  ],
+  "mutations_performed": [
+    "Created local isolated worktree and branch codex/housekeeping-controller-001 from Lab origin/main cache",
+    "Added housekeeping reports only on the housekeeping branch",
+    "Pushed codex/housekeeping-controller-001 to Lab",
+    "Opened draft Lab PR #116; it remains unmerged"
+  ],
+  "mutations_deliberately_not_performed": [
+    "No merge",
+    "No PR close",
+    "No branch or tag deletion",
+    "No direct push to main",
+    "No branch-protection or ruleset change",
+    "No release or visibility change",
+    "No history rewrite",
+    "No Sandbox-to-Lab promotion",
+    "No Hermes install or execution",
+    "No secrets/provider configuration change"
+  ],
+  "known_limitations": [
+    "Remote fetch blocked by DNS/network",
+    "Local gh token invalid",
+    "Branch protection/rulesets UNABLE_TO_VERIFY",
+    "PR checks returned no status contexts through connector",
+    "Lab verification dependency absent in clean worktree",
+    "Hermes docs internally contradictory and not executed",
+    "Branch inventory based on cached refs and requires fresh fetch before deletion"
+  ],
+  "final_recommendation": "Keep Lab unchanged except through small, separately authorized merges. Make Experimental-Sandbox the live board/play area only through the two explicit board approvals. Keep #110 blocked until repaired. Close #113 only with authorization; park broad proposals; keep #109 behind a privacy decision; keep Hermes as a documented, uninstalled design candidate until a separate experiment card.",
+  "status_authority": "NONE"
+}