chore: consolidate Ferrite backlog for review

[integrate-your-mind]

Delivery unit

PR #13 is the foundational Ferrite backlog consolidation and the dependency base for PR #18 and other focused follow-up work.

• Head: 62ac17da6271c2dbeaa6ddd174b6c14bfbb4bbe8
• Tree: 33447b4ce184532afd4675db000c8597300f31fe
• Base: main@1bebfcbd45dcf77cb941a9a04b3492b14f96a3fd
• State: open, non-draft, Git-mergeable, REVIEW_REQUIRED
• Disposition: READY FOR REVIEW / NOT MERGE ELIGIBLE

This PR does not authorize deployment, npm publication, release, repository-setting changes, or billing changes.

Scope

The consolidation includes:

• compiler-owned module graph, deterministic cycle diagnostics, invalidation, and artifact behavior
• bounded server/runtime behavior, navigation ownership, streaming budgets, and production signal handling
• strict HTTP/1 framing and proxy policy with normal/failure/odd-path socket tests
• Buildkite local-agent CI configuration and trust hooks, replacing GitHub Actions execution
• source onboarding, release verification, package integrity, atomic output publication, and cleanup boundaries
• governance, contribution, security, support, deployment, and rollback documentation
• Ferrite examples, docs workbench, site source, route/deep-link packaging, and public artifact validation

Four review findings resolved

1. Replay nonce saturation: the store purges only expired entries, refuses issuance at 4,096 live nonces, returns 503 with no-store, preserves earlier live nonces, and reuses capacity after consumption.
2. Navigation ordering: monotonic ownership and aborts prevent an older JSON or stream navigation from overwriting newer intent across shell/body/head/history, fallback, popstate, destroy, and onError recovery.
3. Atomic route types: same-directory private staging, flush/sync, destination-state revalidation, and no-clobber atomic persistence preserve the last valid file across write, permission, metadata, symlink, and replacement races.
4. HTTP-reachable route grammar: static segments are restricted to the request-target grammar shared with production routing.

Each inline thread contains the exact fix and regression evidence and is resolved. Independent exact-head review returned ACCEPT, with no P0-P2 findings.

Route-segment contract

This is the integration contract for PR #18:

• static/file segments contain only ASCII graphic bytes;
• % begins a complete two-hex-digit triplet;
• percent escapes may not decode ., /, or \;
• raw :, *, ?, #, [, and ] are reserved and rejected;
• [name] maps to :name;
• terminal [...name] maps to *name;
• terminal [[...name]] maps to *name?;
• parameter names use the ASCII identifier grammar.

Exact-head proof

All project-local evidence below is bound to commit 62ac17d, tree 33447b4, Cargo.lock SHA-256 7793dacc337257c9ba8e9ea0b41f5a74220c3adbe64185443082afc8048bd88a, Node v24.13.0, pnpm 11.7.0, Rust 1.95.0, macOS arm64.

The clean exact-head command ./.buildkite/scripts/ci.mjs all passed every recorded gate:

Category	Result
frozen install	PASS
format / Clippy / JS lint	PASS
TypeScript and Ferrite project checks	PASS
Rust / TypeScript / WASM / native build	PASS
full Rust, Node, browser, example, demo, normal/failure/odd tests	PASS
npm tarballs and clean consumer install/build/serve	PASS
all Cargo package dry runs and Cargo audit	PASS
Ferrite website lint/typecheck/build, 18 routes, 24/24 tests, package, production audit	PASS
Buildkite pipeline dry-run	PASS
full-history Gitleaks, 373 commits / 5.87 MB	PASS
native package generation and checksum verification	PASS
real nginx container, HTTP/1 and HTTP/2 proxy proof	PASS

Coverage floors and exact results:

• Rust lines: 91.13% (floor 90.00%)
• runtime JavaScript lines: 81.88% (floor 80.00%)
• native JavaScript lines: 83.23% (floor 78.00%)
• site tooling lines: 89.66% (floor 70.00%)

Real nginx proof:

• HTTP/1 normal/failure/odd matrix: 43/43
• HTTP/2 matrix: 7/7
• rejected requests with no upstream status: 5/5 framing and 9/9 target probes
• missing TLS material, default TLS verification, missing log evidence, response cap, deadline, and canary negative controls: PASS
• owned containers, network, image tag, log follower, and scratch cleanup: PASS

Targeted mutation packet:

• 46 router mutants evaluated
• 39 behaviorally caught
• 3 compile-unviable
• 3 loop mutants timeout-caught
• 1 skip-index mutant proved equivalent by exhaustive 484-case percent-escape enumeration

The initial proof setup redirected CARGO_TARGET_DIR, while the repository demo gate intentionally executes target/debug/ferrite; that setup-only run failed with ENOENT. The final clean run used the repository contract and passed all gates.

Receipt: dist/ci/62ac17da6271c2dbeaa6ddd174b6c14bfbb4bbe8/all/local-2cddb7bf-c2c0-4bca-85b8-1e29af32f7e3; results.tsv SHA-256 f6166f17a6a47e203a6b3e2d6a232b5ab6cef6f02100b99f757a49076e9821cd.

Package evidence

The local package verifier produced the five-package current-host set at 0.1.0-alpha.0, bound to the exact source commit and tree.

• package-set SHA-256: 380fc02490b59020d4a39e74a0f002b504d2886d07bc943e5e3f5f288b595704
• clean source-starter / consumer install, build, serve, and failure controls: PASS
• public registry publication: not performed and not claimed
• non-current-host native packages: not generated by this macOS arm64 lane

Risk and rollback

This remains a large consolidation change. Rollback is an ordinary Git revert of the consolidation merge; no migration, live state, deployment, or registry mutation is part of this PR. PR #18 must use the route contract above and be refreshed and re-proven against the eventual terminal PR #13 base.

Remaining external gates

1. Hosted Buildkite: the exact head currently has zero GitHub checks and no authenticated Buildkite execution receipt. The repository CI entrypoint and pipeline dry-run passed locally, but local execution is not relabeled as hosted CI. The existing Buildkite CLI credentials are present in the login keychain but unavailable to this non-interactive task, and the connected browser session is not authenticated.
2. Distinct eligible approval: branch protection reports REVIEW_REQUIRED. The independent agent verdict is technical review evidence, not a GitHub approval from a distinct eligible identity.
3. Reconfirm the exact head, current base, checks, approval, and merge tree immediately before any merge decision.

No merge, deployment, publication, or release was performed.

[integrate-your-mind]

Exact-head remediation receipt — a7a5f7f

• Remote PR head, local HEAD, upstream, and git ls-remote all match a7a5f7f50dafd2a0a3eaab301ab570d787deac2d; worktree clean.
• Independent exact-commit council verdict: ACCEPT, no P0–P2 findings. Reviewed patch SHA-256: e95432f1341cb7f012f95f83df9cb3660fdbe2622a0f64ad4bc0c3a4b3ed17ad.
• Static gates pass: Rust formatting, JavaScript syntax, CI Bash syntax/ShellCheck, diff integrity, and redacted one-commit Gitleaks (85,325 bytes; zero leaks).
• Synthetic merge tree against main@1bebfcbd is 7277c0be18b929cfc2a0c6514bf7c00cb90572b8, byte-identical to a7a5f7f^{tree}.
• Exact guarded ./.buildkite/scripts/ci.mjs verify launch exited 75 before execution: storage pressure is emergency. No test/build result is inferred.
• Exact Buildkite #30 is currently platform-limited with zero executed steps. Stale PR chore: consolidate Ferrite backlog for review #13 build #26 was canceled; unrelated builds were not touched.
• GitHub remains MERGEABLE but BLOCKED / REVIEW_REQUIRED, with zero checks and zero unresolved threads. Branch protection requires one distinct eligible approval; the repository currently has no second direct collaborator.

Disposition: ready for technical review at the source level, not merge eligible, not deployed, not published, and not released.

[integrate-your-mind]

Exact-head execution and review-boundary refresh — a7a5f7f

Local HEAD, upstream, the remote branch, and PR #13 all remain exactly a7a5f7f50dafd2a0a3eaab301ab570d787deac2d; the worktree is clean. The independent exact-commit source verdict remains ACCEPT with no P0–P2 findings.

One nonblocking P3 is explicitly retained: scripts/build-sites-source.mjs may wait indefinitely only if both SIGTERM and SIGKILL delivery fail and the child never emits close; the normal same-UID termination path is covered. This is not relabeled as an executed runtime result.

A new focused exact-head JavaScript regression packet was submitted through the mandatory storage guard with input hash 2bfb1c652a531a4da1e1af6650487dc55c9f9770290c25a1570309b50f961ae6. It exited 75 before Node started:

heavy job denied for ferrite-pr13-focused-js-a7a5f7f: storage pressure is emergency

No retry or bypass occurred, and no test result is inferred. Buildkite #30 still has zero executed steps, so it is not CI evidence.

GitHub branch protection requires one distinct approval, dismisses stale reviews, enforces the rule for admins, and requires resolved conversations. The repository currently has only the owner account as a direct collaborator, so an agent source review cannot satisfy that distinct GitHub approval.

Disposition: source-review READY; not merge eligible; not deployed, published, or released. Remaining gates are an executed exact-head build/test/coverage/runtime path and one eligible distinct approval.

[integrate-your-mind]

Ownership ledger update — 2026-07-29

Sole mutable owner for PR #13 is now the Ferrite backlog coordinator. The prior owner has stopped without further source, branch, test, or GitHub mutation.

• Exact head: a7a5f7f50dafd2a0a3eaab301ab570d787deac2d
• Registered worktree: .worktrees/pr4-backlog
• Scope: exact-head executable proof, Buildkite execution evidence, PR evidence maintenance, and eligible-approval path only
• Explicitly excluded: server-actions work, PR feat(runtime): align React event prop bindings #14 branch changes, Cloudflare SSR branch changes, merge, deploy, publish, release, settings, credentials, and billing

The source-level ACCEPT, zero-step Buildkite #30 state, and distinct-approval requirement remain unchanged. This receipt is ownership/evidence metadata only; it does not claim executable proof or merge eligibility.

[integrate-your-mind]

Executable-proof and approval refresh — a7a5f7f

A scoped exact-head JavaScript regression packet was submitted through the mandatory guard:

node --test scripts/verify-buildkite.test.mjs scripts/build-sites-source.test.mjs scripts/verify-npm-packages.test.mjs

Input hash: b8b62e2cc925957f196168b35fa2aadf06beb8cacb8fd32840b00335819746d1. The guard returned exit 75 before Node started: heavy job denied for ferrite-pr13-exact-js-a7a5f7f: warning pressure with swap usage. No executable result is claimed, and the exact launch was not retried or bypassed.

Fresh remote readback:

• Buildkite #30 remains scheduled for exact a7a5f7f; its upload job has zero executed steps.
• The ferrite-local agent list is empty. No agent is connected to consume the queued job.
• main protection requires one approval, dismisses stale reviews, enforces protection for admins, and requires resolved conversations.
• The repository has one direct collaborator (the owner account), so an eligible distinct approval cannot currently be obtained.

Disposition remains: source-review ready, not merge eligible, not deployed, published, or released. The next technical gate is a guarded exact-head executable suite when admitted; the two current external prerequisites are a connected trust-pinned Buildkite agent and a distinct eligible reviewer.

[integrate-your-mind]

Consolidated ledger amendment — Cloudflare SSR

The independent Cloudflare SSR delivery branch is not at the older 4c19f161 checkpoint. Its owner remediated the two exact-head review findings and non-force pushed clean checkpoint 08a5e7a39c1652531c4d942a68d32ce50df05074 on codex/cloudflare-request-ssr.

Static syntax, diff integrity, and Gitleaks passed; executable gates remain unrun and an exact-head independent re-review is in progress. No PR exists for that branch. This is ledger evidence only: PR #13 does not incorporate, prove, or claim that SSR work.

[integrate-your-mind]

Exact-head preflight admission receipt — a7a5f7f

A distinct bounded local-agent preflight was submitted through the mandatory guard:

node .buildkite/scripts/ci.mjs preflight

Input hash: b5391510bb40304aeaf8c371ae54126c72f66679ed9ac95938df953e6671fb1f. The guard returned exit 75 before Node started: heavy job denied for ferrite-pr13-preflight-a7a5f7f: storage pressure is critical.

The preflight itself did not execute, so this does not prove or disprove toolchain availability, the exact local CI contract, lint, build, test, package, coverage, browser, nginx, or runtime behavior. It was not bypassed or retried. Buildkite #30 remains scheduled with no connected agent and zero executed steps.

[integrate-your-mind]

Exact-head static, distribution, and SSR ledger refresh — a7a5f7f

Fresh non-heavy validation on the clean current PR #13 worktree passed:

• git diff --check HEAD^ HEAD
• git fsck --no-reflogs --no-dangling --connectivity-only
• node --check for .buildkite/scripts/ci.mjs, scripts/build-sites-source.mjs, and scripts/verify-npm-packages.mjs
• bash -n and shellcheck for .buildkite/scripts/ci-internal.sh
• synthetic merge tree against main@1bebfcbd is 7277c0be18b929cfc2a0c6514bf7c00cb90572b8, exactly equal to a7a5f7f^{tree}

Fresh unauthenticated registry reads for @ferrite/protocol, @ferrite/protocol-wasm, @ferrite/runtime, and @ferrite/node each returned HTTP 404. Checked-in manifests remain private: true at 0.1.0-alpha.0; this confirms absence from the public registry at probe time only, not ownership or publication readiness.

The independent Cloudflare SSR branch has advanced from the prior 08a5e7a ledger entry to a7605fa4bf9ec396405973e5d039def984308d94 (one focused digest-timeout regression in packages/runtime/test/cloudflare.test.mjs). PR #13 does not incorporate or claim SSR proof.

No executable test, build, coverage, hosted CI, deployment, publication, or release claim is added by this receipt.

[integrate-your-mind]

Focused Buildkite-contract admission receipt — a7a5f7f

A narrowed exact-head test was submitted through the mandatory guard:

node --test scripts/verify-buildkite.test.mjs

Input hash: f1d723ec966cd0378035309cb8e4bd24f38b8f678722d8b39858b29010101bab. The guard returned exit 75 before Node started: heavy job denied for ferrite-pr13-buildkite-contract-a7a5f7f: storage pressure is critical.

No test result is inferred and the launch was neither bypassed nor retried. This evidence does not change PR #13's source-review-ready, not-merge-eligible disposition.

[integrate-your-mind]

Buildkite agent credential-path correction

A read-only inspection of the installed agent configuration found:

• /opt/homebrew/etc/buildkite-agent/buildkite-agent.cfg contains an existing agent token (value not printed or copied).
• /opt/homebrew/etc/buildkite-agent/ferrite-agent.cfg contains the Ferrite queue, build path, and trust-hook paths but intentionally has no token.
• No Buildkite agent process or launchd service is currently active.

The installed agent supports loading the token from the standard config while overriding the Ferrite-specific name, tags, build path, hooks path, repository allowlist, one-job disconnect, idle timeout, and uptime bounds at launch. Therefore a new credential, token request, config edit, or Buildkite settings change is not required to consume exact build #30.

The agent launch still must pass the mandatory storage guard before it can start and execute any job. No agent was launched, no token value was exposed, and no Buildkite or repository setting changed.

[integrate-your-mind]

Bounded Buildkite #30 agent-launch receipt

The credential/config path is now known and does not require a new token or settings change: the existing standard agent config can provide the token while launch-time overrides bind the Ferrite queue, reviewed hooks, repository allowlist, one worker, one-job disconnect, 60-second idle timeout, and four-hour maximum uptime. The approved commit was fixed to a7a5f7f50dafd2a0a3eaab301ab570d787deac2d, and PYTHONPATH was removed from the child environment before agent start.

That exact launch was submitted through the mandatory guard with input hash cb824393602d08037e256a0ff9841f5a18cfe1820b6e1ecdbb0f775ec5b9c8d7. It returned exit 75 before the agent started: heavy job denied for ferrite-pr13-buildkite30-agent-a7a5f7f: storage pressure is emergency.

No agent connected, no job executed, no token value was exposed, and no configuration, repository setting, or Buildkite setting changed. Build #30 remains queued and reusable.

[integrate-your-mind]

Exact-head review receipt — 74e3fa1

• Local, upstream, and GitHub remote branch all match 74e3fa1269f8ec3c77d86cc5f9578470eeae262f.
• Independent final review: ACCEPT, no remaining P0-P2 findings.
• Full local CI-equivalent verify, packages, coverage-rust, coverage-js, and native modes pass.
• Coverage: Rust 90.93%; runtime JS 81.72%; native JS 83.23%; site tooling 89.66%.
• Clean consumer install/build/serve, all Cargo package dry runs, Cargo audit, 18-route Ferrite site build, Chromium 11/11, demos, and full-history Gitleaks pass.
• Synthetic merge tree against main@1bebfcbd is byte-identical to head tree bbbee408ae187887101546496e739840387828ab.

The PR body now contains the full current proof and non-claims. Remaining merge gates are exact-head Buildkite execution, real nginx/container proof, and the distinct eligible GitHub approval required by branch protection. No merge, deployment, publication, or release was performed.

[integrate-your-mind]

Remaining external-gate refresh — 74e3fa1

• Docker daemon preflight: curl --max-time 5 --unix-socket ~/.docker/run/docker.sock http://localhost/_ping timed out after 5.005 seconds with zero bytes. The nginx container gate was not started and no container state was changed.
• Buildkite CLI: browser OAuth reached token exchange, then failed because the CLI requires an available system keychain to persist access and refresh tokens. bk auth status remains unauthenticated; no exact-head hosted build was created or claimed.
• GitHub: head is exact, mergeable, non-draft, zero unresolved threads, zero checks, and REVIEW_REQUIRED. The collaborator API returns only integrate-your-mind, so the required distinct eligible approval cannot currently be produced without an external collaborator/reviewer.

No protection was bypassed and no merge, deployment, publication, or release was performed.

[integrate-your-mind]

Reviewed the exact head 74e3fa1269f8ec3c77d86cc5f9578470eeae262f. I found four issues that should be fixed before merge: live replay nonces can be evicted by page traffic, overlapping client navigations can commit out of order, route-type output is not published atomically, and the router accepts static paths that the HTTP server cannot receive or match. Inline comments include the failure cases and suggested fixes.

[integrate-your-mind]

Exact-head remediation and integration receipt

Candidate 62ac17da6271c2dbeaa6ddd174b6c14bfbb4bbe8 (tree 33447b4ce184532afd4675db000c8597300f31fe) is pushed and matches local HEAD, upstream, git ls-remote, and the live PR head.

• four independently reported defects reproduced, fixed, and locked with normal/failure/odd regressions;
• all four inline threads have exact-SHA replies and are resolved;
• independent exact-head reviewer: ACCEPT, no P0-P2;
• ./.buildkite/scripts/ci.mjs all: PASS for all 29 recorded gates;
• coverage: Rust 91.13%, runtime 81.88%, native 83.23%, site 89.66%;
• real nginx: HTTP/1 43/43, HTTP/2 7/7, no-upstream rejection evidence 5/5 framing plus 9/9 target probes;
• mutation packet: 46 evaluated, 39 caught, 3 compile-unviable, 3 timeout-caught, 1 exhaustively proven equivalent;
• full-history Gitleaks: 373 commits / 5.87 MB, no leaks;
• current base main@1bebfcbd45dcf77cb941a9a04b3492b14f96a3fd;
• synthetic merge tree: 33447b4ce184532afd4675db000c8597300f31fe, byte-identical to the candidate tree;
• git diff --check: PASS.

The PR is ready for human review but remains not merge eligible: exact-head hosted Buildkite still has no execution/check receipt, and branch protection requires one distinct eligible approval. No merge, deployment, publication, or release was performed.

[integrate-your-mind]

Hosted Buildkite control-path receipt

A fresh exact-head hosted-CI attempt was made for 62ac17da6271c2dbeaa6ddd174b6c14bfbb4bbe8 without changing pipeline or repository settings.

• Buildkite organization roman-mondello is already configured locally.
• The existing Buildkite keychain entry is present, but the login keychain is locked to this non-interactive task; bk auth status remains unauthenticated.
• A new OAuth login requested only read_only plus write_builds.
• OAuth reached GitHub sign-in. The connected browser had no GitHub session, reported partial passkey support, and the CLI callback timed out before authentication.
• No API token, password, passkey, or other credential was read or exposed.
• No Buildkite build was created or claimed.
• The exact PR head still has zero GitHub checks.

Therefore the full local CI-equivalent receipt remains valid local evidence only. An authenticated Buildkite control session is still required to create and execute the exact-head six-job pipeline.