KB-6ECB

Final Decision

5 min read Revision 1

c1stagingcodex-r2-fixfinal-decisionready-for-r32026-06-23

10 — FINAL DECISION

Verdict

C1_STAGING_CODEX_R2_FIXES_READY_FOR_CODEX_R3

Patched files + sha256

File	sha256
`bin/_common.sh`	`c31a1e5d04eeb1b808c15ede0778dc67b492fb7124ee0f8423e2608b8aee758f`
`bin/dot-staging-sandbox-create`	`3694a0b6d35cc761637826537bfb04375b12a2db4b98b13954beeec90e33d23e`
`plan/c1-staging-fast-dry-run.plan.sh`	`f1f5475c3a39d2aecfad6a0e263ee3b7925043851db7a2488385b18b9e4cb033`
`sql/p6-evidence-readback.sql`	`212ebc0e23c6f8996d76411f4f1e09a78b901dae1eb5bf1fd8f6c3da977c4118`
`registry/primitives.jsonl`	`ccfad13ac2ca1d5c2b2b9e2f7bda0b6669585bc08bd27c6503f26908b63437ca`
`ledger/dot_manage.jsonl`	`a2f2f68c7c79160bc1fec85e014ac53518283bd58c843bfd229c5a90e03d7760`
`README.md`	`d02b2d0c0abf07dd602e5ec6f32e6dd6c31f3f04e05edfdb1bdff90621d809b1`
`ROLLBACK.md`	`fb8bb6a338e0c9adb14bf051ca805fbd9667550caf34e4c8d256e8c53ac67948`

Fix summary (all four R2 blockers + #5)

R2-1 P1 partial-create self-cleaning: candidate validated pre-create; EXIT trap compensating-drops on failure before SANDBOX_JSON; created=true only after all postconditions; cleanup failure → exit 70. Plan preselects + passes the id so its cleanup target is always known.
R2-2 Plan never swallows P2 failure: primary rc + cleanup rc exit matrix; residual c1_staging_% count check; DRY_RUN_OK only after P2 + count=0.
R2-3 P6 digest spans canonical_operation AND c1_test_results; gate+ledger+digest in one SHARE-locked txn; persisted-then-readback; no digest/P6_DONE on gate failure.
R2-4 P1 --force disabled (fail-closed); existing sandbox → governed P2 cleanup (active-registry provenance). No blind drop in the create path.
R2 #5 remote-temp tracking moved from a subshell-discarded array to a host-side file so the EXIT trap actually cleans container temps.

Static / no-write validation summary

bash -n 8/8 OK; shellcheck warning-clean; injection scan clean (quoted $@ argv only); guard self-tests 9/9 (incl. --force DISABLED=4); subshell-tracker proof old=0 vs new=2; p6 dollar-quotes balanced ( $f$ =2, $g$ =2), BEGIN/COMMIT 2/2, LOCK present, digest covers harness; registry 6 lines valid; ledger 9 lines valid seq 1–9; local==remote sha256 7/7.

Official runtime unchanged proof

Before (09:14:09Z) == After (09:27:53Z) on all 12 metrics (file 09): dot_tools=309, contracts=2, table_registry=21, gba=0, appr=231, apr_action_types=14, APR-0415 pending, apr_approvals_415=0, abs=unimplemented, official_canonical_operation_tbl=0, staging_dbs=0, database list identical.

staging_DBs=0 proof

0 before, 0 after guard self-tests, 0 after. No CREATE DATABASE executed.

Updated dry-run plan

plan/c1-staging-fast-dry-run.plan.sh now: preselects + validates the sandbox id and passes it to P1; cleanup applies the strict exit matrix and a final staging-DB=0 readback; gate requires C1_STAGING_DRY_RUN_CONFIRM=CODEX_R3_PASS (was CODEX_R2_PASS). The plan was NOT executed.

--force status

Disabled (preferred R2-4 option). Destructive drops are delegated to the governed P2 path, which enforces the active sbx_meta registry / provenance gate.

Codex-style self-review result

8/8 rows PASS (file 08).

Readiness flags

ready for Codex R3 review: YES
ready to run dry-run without Codex: NO
ready for promotion: NO
ready for production: NO

Steps 0–6

0 foundations/search: complete (read R2 + R1 packages, inspected all staging files). 1 receive: complete. 2 design/review: complete (4 fixes + #5 designed, adversarially self-reviewed). 3 code: complete (patch-only under staging path). 4–5 deploy/dry-run/production mutation: not performed (no dry-run, no staging DB, official before==after). 6 eleven KB reports uploaded + read back.