feat: coordinate exact authorized Genesis apply through EP

.github/product-version-operations/forge-r57-genesis-ep-apply-20261016.json

@@ -0,0 +1,16 @@
+{
+  "baseline_version": "2.22.0",
+  "classification_rationale": "L3-GENESIS-EP-APPLY-COORDINATOR-V1-20261016",
+  "component": "product",
+  "event_lineage": "L3-GENESIS-EP-APPLY-COORDINATOR-V1-20261016",
+  "expected_head": "523a13f3196c096da217421e74130df474fadcc6",
+  "operation_id": "forge-r57-genesis-ep-apply-20261016",
+  "policy_revision": "forge-bootstrap-release-cadence-v2",
+  "product": "forge",
+  "projection_paths": "product-version.json",
+  "release_class": "MINOR",
+  "requested_bump": "minor",
+  "requested_version": null,
+  "schema_version": "1",
+  "target_version": "2.23.0"
+}

.github/workflows/ci.yml

@@ -10,10 +10,36 @@ permissions:
   contents: read
 
 jobs:
+  genesis-native:
+    name: Qualified macOS Genesis native execution
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+      - run: python -m pip install '.[validation]'
+      - name: Genesis qualified producer apply and separate OS recovery
+        timeout-minutes: 25
+        run: bash scripts/qualification/qualify_genesis_apply_ci.sh
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
+        with:
+          name: forge-genesis-apply-${{ github.sha }}
+          path: ${{ runner.temp }}/forge-genesis-apply-ci/proof-*/*.public.json
+          if-no-files-found: error
   test:
     name: Test and static validation
+    needs: genesis-native
+    if: ${{ always() }}
     runs-on: ubuntu-24.04
     steps:
+      - name: Require qualified native Genesis execution
+        env:
+          GENESIS_NATIVE_RESULT: ${{ needs.genesis-native.result }}
+        run: test "$GENESIS_NATIVE_RESULT" = success
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0

docs/architecture/GENESIS_EP_APPLY_COORDINATOR_V1.md

@@ -0,0 +1,148 @@
+# Genesis EP apply coordinator V1 — selected original local effect
+
+R57/plan1. ASSIGNMENT_ID=L3-GENESIS-EP-APPLY-COORDINATOR-V1-20261016.
+JOIN_ID=L2-L3-GENESIS-APPLY-V1-20261016. Forge2.23.0/schema46 allocation.
+Implementation and qualification are OPEN. R56 and predecessors remain CLOSED.
+
+## Selected boundary
+
+One original R52 portable GENESIS authority proposal, its applicable original
+R54 BUSINESS AND ARCHITECTURE content decisions, an exact frozen R56 plan and
+separate currently applicable human effect decision can be explicitly offered
+to one separately owner-authorized EP CREATE_GENESIS_LOCAL operation.
+
+Forge controls exact binding, durable original dispatch intent, authenticated
+transport, readback and evidence interpretation. EP owns physical admission,
+absence, placement, identity reservation, document/Git/validation/B8R effects
+and their recovery. Forge never creates or modifies a target and never issues,
+renews or borrows an EP grant. COMPLETE is an original technical operation
+result, not project/Mission READY or human product acceptance.
+
+Only GENESIS/LOCAL_POSIX/authority/portable-docs1.0.0/DOCUMENT_ONLY/NO_PRODUCT_CODE,
+the exact original37 document files and a new local target are selected. No
+adoption/existing/unborn/child/remote/Managed/promotion, new renderer, scan,
+model/provider call, Action, Mission, publication or native GUI is selected.
+
+## Exact producer mapping
+
+| Forge owning snapshot | EP request/binding |
+| --- | --- |
+| Durable explicit apply operation_id | Original operation_id, not a generated retry ID |
+| R56 target.target_ref | Opaque target_ref; EP owner alone maps physical placement |
+| R56 plan_id / plan_revision / plan_digest | Identical effect_plan_binding fields |
+| Original separate positive R56 decision_id / decision_digest | Identical decision binding, never content approval substituted |
+| Original R52 plan_id | proposal_id |
+| Original R52 artifacts-array/result_digest | proposal_digest; distinct from EP-envelope digest |
+| Original Forge instance / dossier | source_instance_id / context_id |
+| Actual original human effect decision principal | source_actor_id as provenance, never EP authentication |
+| Original37 UTF8 document payloads and SHA256 | Lossless pb-render/1.0 RENDERED_PROPOSAL_EXAMPLE files-map |
+
+The fixed original R50 example EP-envelope digest remains
+0c2c0fb41a68793be0960bb4289d7590060c8092ebb976852e1c4674b0f66b1d.
+Original array digest, manifest semantic digest, file digest and request digest
+retain their distinct meanings. No file mode or executable-bit invention.
+
+Actual qualified producer routes are POST /v1/bootstrap/genesis/operations,
+GET /v1/bootstrap/genesis/operations/{operation_id}, and explicit POST to its
+/resume. Exact EP authorization uses a distinct CREATE_GENESIS_LOCAL bearer
+and EP-Bootstrap-Contract, EP-Instance-ID, EP-Host-ID, EP-Consumer-ID,
+EP-Principal, EP-Audience headers. Source actor never fills an auth header.
+GET and explicit resume carry no body; EP rejects any nonzero Content-Length
+on them. These routes are enabled only after the actual independently qualified L2
+final-main/schema/wheel handoff is pinned. A merged candidate is insufficient.
+Existing R55 EP inspection pins and L4 consumer pins remain unchanged.
+
+## Own HTTP and CLI
+
+Closed packaged contract: forge/api/genesis-apply-v1.json.
+Same existing Forge Server, separate finite GENESIS_APPLY_ONLY/1.0 bearer and
+X-Forge-Genesis-Apply-Audience (the existing unambiguous audience-header parser).
+No trusted arbitrary actor, viewer or role header.
+
+- POST /v1/genesis-apply/operations: explicit original apply request.
+- GET /v1/genesis-apply/operations/{operation_id}?dossier_id=...:
+  original intent plus live authenticated owning EP readback; never effects.
+- POST /v1/genesis-apply/operations/{operation_id}/resume:
+  explicit unique attempt_id plus exact original_request_digest and scope.
+
+Ordinary forge-genesis-apply CLI shares these services: request/read/resume.
+Owner init/issue/revoke/bind-peer/revoke-peer use private files; neither bearer
+nor root/host path, shell, validator command or uploaded approved bundle is
+part of user apply input. Existing R56 plan/decision routes stay non-executing.
+
+An apply grant is separate from all earlier grants, bound to exact retained
+source plans, dossier, principal, instance, audience, human/operator binding,
+finite expiry and READ/REQUEST_APPLY/RESUME. Effects require current R54/R56
+conditions before admission, before sending and protected publication. A
+replacement grant cannot launder an original revoked effect grant into resume.
+Private EP pairing is immutable and sealed, with qualified producer pins,
+exact original operation/request/plan/decision/target/placement binding and a
+separately installation-owner-issued finite EP credential. Forge cannot mint it.
+
+## Durable dispatch and publication
+
+Original request, EP request bytes/digest, original Forge grant and private
+pairing digest are durable before any effect POST. Under the owning boundary
+one CREATE sendclaim is persisted before transport. An original intent with
+no sendclaim can recover its first explicit dispatch after a healthy original
+GET404. Once a sendclaim exists, all identical submissions first recover by
+original GET; even GET404 after an uncertain send never causes another create.
+Changed input under the same operation ID conflicts. No unbounded retry.
+
+Explicit resume first verifies the owning original admitted EP operation and
+current original authority. GET/refresh never resumes. Attempt CAS fences late
+responses and late sends; older source_updated_at cannot overwrite newer
+observations. EP remains the source of effect truth; stored receipts retain
+original evidence and are not an independent execution database.
+
+Authority locks cover private state and current canonical checks, never network
+waits. Finite direct loopback transport has no proxy, redirects or ambient auth.
+A current-authority callback runs after connect immediately before sending;
+absolute deadline checks and a socket watchdog bound send and response success.
+Protected publication rechecks actual peer access and current own scope/epoch
+without holding own authority across the peer request. Missing/corrupt initialized
+stores or absent original peer evidence fail closed, never healthy empty history
+or cached COMPLETE. Revocation/expiry never triggers rollback, delete, force,
+credential replacement or rewriting original evidence.
+
+## Remaining delivery gates
+
+Source/unit/synthetic peer tests are not installed effect acceptance. First small
+noneditable installed Forge plus separately installed qualified EP must prove
+original37 bytes, separate real synthetic owner grant, HTTP POST/GET, independent
+Git commit/tree/trusted validator/B8R and replay without duplicate effects before
+heavy suites. Required negative/concurrency/lost-response/separate server OS
+restart/partial/corruption/authority/late-publication and restored-fault RED/GREEN
+proofs, strict >80.2% per changed production file, full CI, independent complete
+Quality/Security, actual unchanged observe-only TDE disposition, protected exact
+head implementation, own nonempty reviewed/protected finalization, NEW exact
+final-main installed chain and safe cleanup remain OPEN until exact receipts.
+No full PB-F3/PB-F7/HOB/readiness parent closure or automatic successor.
+
+## Qualified producer handoff
+
+L2 terminal handoff #142/6223927644 and #207/6223928601 binds EP2.3.123
+to source `4d0c0461d7a5ec7fb7a50aa42f775cc4be09faa5`, tree
+`b095ba006beccd79171115a7deab55ef7b7c4ff9`, response schema SHA256
+`3ccf4d3ba775c9f4503e986fce5416b33fe1d125d0b18244beeae562868aa231` and ordinary wheel SHA256
+`bc49e7a3b15c9021b16546a5ca96e5fbf280072d900d8d3dc173dee4b79d5b9e`.
+Own R57 installed integration and complete delivery remain OPEN.
+
+
+## Owning qualified host boundary
+
+The L2 final-main handoff qualifies the full installed native Genesis chain on
+macOS at finite short private placements; Linux's canonical wheel identity,
+component fixtures and general native controls are separate evidence. It does
+not qualify full native Genesis execution on Linux. The original three Ubuntu
+R57 native-start failures remain preserved, including actual BrokenPipeError32
+before PREFLIGHT completed. No Linux full-chain PASS is claimed.
+
+The same14 real native qualification cases run in a separate ordinary macOS CI
+job with the same25-minute boundary. The existing required Ubuntu Test and
+static validation job runs with always() and explicitly requires native job
+success before its unchanged tests, coverage and installed gates. A native
+failure, cancellation or skip cannot become a successful skipped required job.
+No sandbox profile, test assertion or producer contract is relaxed. Hosted
+operator fixtures remain explicitly modeled, separate from actual local Mac
+owner identity. This hosting correction is not a Linux capability delivery.

docs/roadmap/PROJECT_BOOTSTRAP_V1.md

@@ -119,3 +119,22 @@ handoff/terminal readback and cleanup. The owning terminal is the closure
 receipt; candidate artifacts do not close R56. Full PB-F2/PB-F7/HOB parents,
 PB-F3 apply coordinator, actual Genesis readiness, adoption effects, Managed,
 promotion and broad onboarding remain OPEN. No automatic successor.
+
+## R56 terminal reconciliation and selected R57 original effect coordinator
+
+[R56 terminal](https://github.com/pcvantol/forge/issues/207#issuecomment-6215404997)
+closed its bounded pre-admission plan/separate effect-decision subset on
+Forge2.22.0/schema46, final main523a13f3196c096da217421e74130df474fadcc6,
+implementation PR296 and separate protected finalization PR297. The earlier
+stage checkpoint above remains historical. Its failures, original producer pins,
+702-open-finding observe-only TDE FAIL and counters remain retained.
+
+[R57 selected contract](../architecture/GENESIS_EP_APPLY_COORDINATOR_V1.md)
+adds only explicit exact original local Genesis-effect coordination over R52,
+R54 and R56. Forge2.23.0/schema46 is allocated; source/independent assurance,
+qualified L2 producer handoff, installed HTTP/Git/B8R/recovery, normal protected
+delivery, own finalization and NEW exact-final-main qualification remain OPEN.
+Actual EP completion is not project/Mission readiness. R56 and predecessors
+stay CLOSED; full PB-F3/PB-F7/HOB/readiness/Managed/promotion remain OPEN.
+L4-plan108/Forge2.21.0/EP2.3.121 consumer pins and budgets are unchanged.
+No automatic successor.

docs/roadmap/project-bootstrap-v1.json

@@ -241,5 +241,18 @@
     "candidate_installed_proof": "https://github.com/pcvantol/forge/actions/runs/38790025378/artifacts/12000150726",
     "finalization_effect": "NO_BUMP",
     "closure_gate": "Own finalization checks/reviews/required CI/protected merge; NEW exact-final-main installed HTTP/restart/readback/cleanup and terminal register"
+  },
+  "r57_selected_effect_coordinator": {
+    "assignment_id": "L3-GENESIS-EP-APPLY-COORDINATOR-V1-20261016",
+    "join_id": "L2-L3-GENESIS-APPLY-V1-20261016",
+    "status": "IMPLEMENTING_PENDING_QUALIFICATION",
+    "contract": "docs/architecture/GENESIS_EP_APPLY_COORDINATOR_V1.md",
+    "version_allocation": "2.23.0",
+    "schema_version": 46,
+    "predecessor_terminal": "https://github.com/pcvantol/forge/issues/207#issuecomment-6215404997",
+    "predecessor_final_main": "523a13f3196c096da217421e74130df474fadcc6",
+    "parents_unchanged": true,
+    "readiness": "NOT_ASSESSED",
+    "automatic_successor": false
   }
 }