# Productized State local golden-journey checkpoint

Date: 2026-08-05

Outcome: **local golden-journey acceptance passed for the combined uncommitted candidate; the
public-artifact and release gate remains open**

## Accepted contract

The additive `ace.productized-state.golden-journey/v1` contract binds the existing frozen K1–K3
receipt to a live extension-first Productized State journey. The live binding covers read-only G1
inspection, I1 decision identity, attributable adversarial I2 deliberation, I3 material-use
continuity, `ContextManifestV1`, surgical code context, database/API/worker restarts, immutable retry
lineage, the twelve-case failure matrix, and exactly eleven thin MCP tools.

The durable machine receipt (`state_engine_productized_journey_live_v1.json`, not present in this
checkout — the closest committed artifacts are `evaluations/results/productized_state_journey_v1.json`
and `evaluations/results/state_engine_product_journey_v1.json`) has file SHA-256
`599f83f44a243d05e12e854203903d155257a26e7fd35a975fe1c080a80ce4da`.
Its outer acceptance hash is
`2ba76eea9abf6cbaca8421ffb24f3417b85ff7719b13fada3ebe577e7a927e30`; the additive Productized
State acceptance hash is
`9f676628b3f817770cd52d5d19805b1cd3c6f449dd809d99a3bd2152ceb1cc97`.
Both hashes recompute and both validators pass with the frozen v2 configuration.

## Live receipt coverage

- Four distinct database, API, and worker processes plus two fresh thin clients prove restart and
  fresh-invocation continuity.
- The same live task binds I1 decision, I2 deliberation, and I3 material-use receipts. The
  deliberation has two named adversarial contributors, one explicit conflict, complete synthesis,
  and no hidden reasoning projection.
- The normalized context manifest contains cognition, deliberation, retained-intelligence, and code
  records; receiving agent/stage, budget, revision, freshness, coverage, and degradation metadata;
  and identical manifest ID and canonical hash before and after restart.
- Public and persisted projections exclude seeded prompt, transcript, private-source, ephemeral
  source, and chain-of-thought canaries. Source code is used only ephemerally; the receipt contains
  exact repository-relative anchors and hashes.
- The code answer selects the two Fjord source files, binds the exact registration and action
  anchors, records their dependency direction, includes decision and observation identities, and
  reports complete bounded coverage without falsely claiming code injection or material use.
- Both Fjord extension actions are identified by their public action and contract versions. The
  restart-interruption receipt records immutable predecessor/successor tasks, attempt number `2`,
  and retry/root lineage.
- Cross-product, identical-path foreign-product, foreign-graph, missing-index, stale-index,
  dirty-tree, partial-scan, deleted-file, renamed-file, restart-reference, clean-install-reference,
  and private-payload-redaction cases all pass.

## Production-path corrections

The first live run exposed SurrealDB v3 record-cast truncation for hyphenated product identities.
Living Product Graph, structured decision persistence, product code-scope resolution, code-context
observation lookup, and the affected existing impact query now bind typed `RecordID` values directly.
A separate disposable live-SurrealDB regression then exposed and corrected a decision-neighbor
`ORDER BY` projection error in the default composer path. That exact production scope/snapshot path
now passes against SurrealDB, in addition to typed-identity unit assertions.

## Verification

- Formatted-tree focused manifest, composer, landscape, I1, product-journey, and diagnostics suite:
  `107 passed`, `1 deselected`.
- Live default composer product-scope/snapshot regression against disposable SurrealDB: `1 passed`.
- Complete post-fix non-E2E regression: `7112 passed`, `48 skipped`, `262 deselected`.
- Separate kernel-boundary regression: `4 passed`.
- Ruff lint and focused Ruff formatting checks: passed.
- Local E1 matrix: current/N-1 compatibility, current-core/N-1 extension adaptation, N-1-core
  refusal of the current extension, both wheel/sdist mixes, independent-extension isolation, and
  zero-extension behavior passed. The installed current artifact exposes exactly eleven tools.
- Current and independent wheel/source archives passed full secret/privacy scanning with zero
  findings; the resolved candidate environment reported no known dependency vulnerabilities.

## Honest degraded state and open gate

The live G1 projection is `partial`, not complete, because `product_intent_missing` remains. Its
receipt says to capture a product direction or vision and does not synthesize missing intent.
Frozen v1 also omits the database process ID; the additive live receipt closes the evidence gap with
four explicit database process records without rewriting the frozen receipt.

This is a local compatibility and golden-journey pass over a combined dirty candidate. The
additive exact-artifact verifier now binds the selected dirty source fingerprint and Git identity,
hash-pinned runtime/build inputs, byte-identical wheel and source-archive rebuilds, separate clean
wheel/sdist installations, installed origins, privacy canaries, extension isolation, dependency
consistency, and exactly eleven thin tools. Its generated receipt stays outside the packaged source
tree so it cannot invalidate the artifact it attests. Tagged v0.2 N-1 compatibility archives retain
sixteen historical absolute-home-path findings and must remain local test fixtures. No hosted-model
quality, beneficial impact, distributed guarantee, public installation, public release, or
publication claim is made.

Productized State therefore remains **Next**. The next 0.3.x work is public-artifact verification of
the exact candidate, release and milestone reconciliation, and publication. The 0.4 cold-start
importer, agent-profile UI, document knowledge map, affected-test engine, and broader workspace
remain outside this packet.
