Require confirmed questions before blocking attention

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: ['**']
+    branches: [main]
   pull_request:
     branches: [main]
   workflow_dispatch:

docs/ci.md

@@ -1,7 +1,8 @@
 # GitHub Actions checks and releases
 
 [CI](https://github.com/dk-code-factory/code-factory-plugin/actions/workflows/ci.yml)
-runs on branch pushes, pull requests to main and manual dispatch. Hosted Ubuntu
+runs on pushes to main, pull requests to main and manual dispatch. Feature
+branches require an open pull request for automatic verification. Hosted Ubuntu
 installs Go from go.mod, Node24, Python3.12, locked npm/Python dependencies and the
 matching Playwright Chromium. All actions are pinned to full commit SHAs.
 
@@ -12,9 +13,11 @@ Successful builds upload Linux x86-64 and portable plugin packages, SHA256SUMS a
 a CI manifest bound to the exact source commit. Failed browser evidence is kept
 separately. Verification has read-only repository permissions.
 
-Pushes compare their exact before/after commits; PRs compare their event base/head
-SHAs. A new branch compares its merge base with main. Manual checks use the current
-parent. Missing or mismatched commits fail; there is no guessed-ref fallback.
+Main pushes compare their exact before/after commits; PRs compare their event
+base/head SHAs. Manual checks use the current parent. Missing or mismatched
+commits fail; there is no guessed-ref fallback.
+Manual checks can fail when their parent comparison differs from the recorded
+reconciliation base.
 
 ## Public source import
 

docs/specs/reconciliations/flow-maintain-flow-contracts.json

@@ -1,16 +1,16 @@
 {
   "version": 1,
   "flow": "flow-maintain-flow-contracts",
-  "base": "9cd2c99bb972009ed2f5b5d35f0f2fa141077111",
-  "fingerprint": "7ad32f246c0d610a80ff4189b841fbc0b089043e62f3c0bdfd699c24acb23ff2",
+  "base": "cdf6df8f81b499f0b59a2b9e4e4ea2b48cfeeee2",
+  "fingerprint": "0c38d97288651bdf7b79aa3901c946acbe4db808cb0c9db34b5775e4a0ef02ed",
   "environment": {
     "CODE_FACTORY_REAL_CODEX": "0"
   },
   "review": {
     "kind": "structure",
-    "description": "S1-S4 layered registry ownership, generated documentation, reviewed fingerprints and fail-closed verification remain unchanged. New recovery terms/entities/scenarios/assertion anchors extend product contracts while preserving historical adoption base and list.",
-    "implementation": "Inspected registry additions and generated blocks against schema/tooling ownership. No runner, adoption policy, reconciliation implementation or required skill definition changed. Fresh records are generated against the public 9cd2c99 baseline, not copied from private pilot history.",
-    "tests": "Read schema/render/reference, stale-base/input/suite and behavior cochange regression coverage. Full tooling suite executes fresh and requires all affected subjects; mapped source/test changes and retained typed gaps are checked. Generated inventories are never treated as runtime acceptance."
+    "description": "S1-S5 retain comparison semantics, mapping ownership, stable IDs and pinned adoption. New classification/browser assertions are mapped under existing scenarios, with no gate policy changes. Reviewed the explicitly approved trigger coverage reduction. S5 continues to require exact selected-event verification and successful main-push artifact provenance; those existing contracts remain accurate.",
+    "implementation": "Reviewed unchanged specs tooling and current catalog mappings; rendered only registry-owned sections and kept glossary foundational. Reconciliation receipts are produced by the CLI against exact main after required verification. Approved CI trigger selection now runs pushes only on main and retains PR-to-main/manual events. Exact comparison, fixture, bootstrap and main-push release implementations are unchanged; feature branches without PRs and manual parent-base limitations are documented. Current cycle changes only failed synthetic delivery cancellation and disconnected awaiting-answer takeover in questions.go. Reviewed this consumer against those narrow changes; its authored behavior and implementation remain consistent, with existing gaps retained.",
+    "tests": "Existing schema/report/runner tests remain unchanged and selected. New source/test paths are covered by explicit flow/assertion anchors, and validate verifies all references before recorded reconciliation. Read HostedCITests exact push/PR/manual Git histories, bootstrap rejection, fixture-forcing runner and successful-main-push-only release assertions. Existing integrations were rerun after the trigger/docs edit. Direct workflow inspection verifies main-only push selection and retained PR/manual events; no test mirrors YAML spelling."
   },
   "verification": [
     {
@@ -19,7 +19,7 @@
         "scripts/test_user_flows.py"
       ],
       "exit_code": 0,
-      "seconds": 1.164
+      "seconds": 1.184
     },
     {
       "command": [
@@ -33,25 +33,25 @@
         "test_specs*.py"
       ],
       "exit_code": 0,
-      "seconds": 24.546
+      "seconds": 24.715
     },
     {
       "command": [
         "python3",
         "scripts/test_ci.py"
       ],
       "exit_code": 0,
-      "seconds": 0.442
+      "seconds": 0.462
     }
   ],
   "dependencies": {
-    "flow:maintain-flow-contracts": "9afedb996a15827666e5057acd3a1cfd42707bdb0c66a9dbdda42ef5239ac358",
-    "term:coverage-gap": "5439d412988ad17087a17eb704c07da38244d510612b7bc26bbc493a177c807d",
-    "term:entity": "0a3477a682965894be095ef8860e69adedfc1e911729e2925ca4a9023d469ead",
-    "term:glossary": "7a60b52f2328e64cfbe5477e5ef4353c600b464e1ce7566784c6904a7e31ff11",
-    "term:known-limitation": "488e665e326093ccdb0dee9a96d518e966eaf77ce35ed68bcd7d9e682a5ccd7e",
-    "term:reconciliation": "c8f7cf9360bfe22355f0c3925a43915b1c4d824bf2327d62df51546991626f56",
-    "term:unverified-behavior": "f2f4dca98d1595e41c32c5a73dddf26ba84c1d557f7d5956f2ca37b537d8596c",
-    "term:verification": "dac65c65e3e90aed22ed03f547bccdb33e8110143760d21fa7a3df7a43c78518"
+    "flow:maintain-flow-contracts": "23132833273c4bdf22cd0afab9fd9b0554e43e48c8557a37e6a1ff21f05af380",
+    "term:coverage-gap": "4a7577550d83ddf6e0f8de27dffbd5b26a23ef973d93e9d58685eee6b2a66de6",
+    "term:entity": "4f00791b58153c4a84e3a7723b37fe050d4b4f4955ce62d8d9ceb9cec344f3e5",
+    "term:glossary": "d25b090ccc1239f47d83c0cbe1acda97527b5a51038002f96deb2947b7563f80",
+    "term:known-limitation": "15fffe1efa009d53fa73c56a8075fea07d1ec94bcb15a731489f6c95aa747515",
+    "term:reconciliation": "7be02fb1ab229dc03d4f7a4d8f0ffb98188326b8a418963d7379acb35d6d0a6f",
+    "term:unverified-behavior": "36e7e9a3831e32de218b4cbee09bcd7b7d52b78070781da4a96ffa2f7046a25e",
+    "term:verification": "eb32301d216ca1e40f070bd1863b4aea8633b96fb0bb84bfc38a6bba764277bf"
   }
 }

docs/specs/reconciliations/flow-operate-installation.json

@@ -1,16 +1,16 @@
 {
   "version": 1,
   "flow": "flow-operate-installation",
-  "base": "9cd2c99bb972009ed2f5b5d35f0f2fa141077111",
-  "fingerprint": "c2b04c71af41cdeb983ab6dacba90e9704446437704497c07d0a91eb8fd061d5",
+  "base": "cdf6df8f81b499f0b59a2b9e4e4ea2b48cfeeee2",
+  "fingerprint": "48168e4d7c3bc566ab86671270c6d4ccfcb8eadbea6a1818a930e43f28606e8d",
   "environment": {
     "CODE_FACTORY_REAL_CODEX": "0"
   },
   "review": {
     "kind": "structure",
-    "description": "S1-S4 installation, rollback, scoped routes and version-bound evidence remain accurate. This task builds/tests source and packages but performs no deployment, service restart, live-provider call or desktop session change.",
-    "implementation": "Compared installer/setup/gateway/service sources and package workflows with baseline: no changes. Runbook/acceptance additions document recovery behavior and actual source-check scope without importing private host identifiers or claiming an installed binary version.",
-    "tests": "Read installer rerun/rollback/interrupted-upgrade and scoped Tailscale ownership tests plus evidence ownership/version checks. Required release fixture suite and smoke remain mapped and rerun; actual installed-host, soak and login acceptance remains open."
+    "description": "S1-S4 retain upgrade/rollback state preservation, private data retention and version-bound diagnostics. Recovery changes do not modify installed services, shared routes, browser sessions or acceptance evidence.",
+    "implementation": "Installer, setup checkpoints and operational handlers are unchanged; shared build/domain inputs conservatively select this contract. Fixture release build remains separate from installation or host authentication. Approved CI trigger selection now runs pushes only on main and retains PR-to-main/manual events. Exact comparison, fixture, bootstrap and main-push release implementations are unchanged; feature branches without PRs and manual parent-base limitations are documented. Current cycle changes only failed synthetic delivery cancellation and disconnected awaiting-answer takeover in questions.go. Reviewed this consumer against those narrow changes; its authored behavior and implementation remain consistent, with existing gaps retained.",
+    "tests": "Existing package, installer rollback, checkpoint and route preservation suites remain mapped. Read deterministic package private-state exclusion assertions; no source fixture result is used to close installed-host, soak or login gaps."
   },
   "verification": [
     {
@@ -22,39 +22,39 @@
         "./..."
       ],
       "exit_code": 0,
-      "seconds": 3.853
+      "seconds": 8.788
     },
     {
       "command": [
         "make",
         "build"
       ],
       "exit_code": 0,
-      "seconds": 3.493
+      "seconds": 2.93
     },
     {
       "command": [
         "python3",
         "scripts/package.py"
       ],
       "exit_code": 0,
-      "seconds": 2.729
+      "seconds": 2.489
     },
     {
       "command": [
         "python3",
         "scripts/test_installer.py"
       ],
       "exit_code": 0,
-      "seconds": 20.977
+      "seconds": 21.388
     },
     {
       "command": [
         "python3",
         "scripts/smoke.py"
       ],
       "exit_code": 0,
-      "seconds": 0.161
+      "seconds": 0.182
     },
     {
       "command": [
@@ -70,7 +70,7 @@
         "scripts/test_connection_probe.py"
       ],
       "exit_code": 0,
-      "seconds": 0.683
+      "seconds": 0.662
     },
     {
       "command": [
@@ -96,7 +96,7 @@
         "scripts/test_user_flows.py"
       ],
       "exit_code": 0,
-      "seconds": 1.164
+      "seconds": 1.184
     },
     {
       "command": [
@@ -110,59 +110,59 @@
         "test_specs*.py"
       ],
       "exit_code": 0,
-      "seconds": 24.546
+      "seconds": 24.715
     },
     {
       "command": [
         "python3",
         "scripts/test_ci.py"
       ],
       "exit_code": 0,
-      "seconds": 0.442
+      "seconds": 0.462
     }
   ],
   "dependencies": {
-    "flow:operate-installation": "071baef46de8b7d210f51eea22eef981a1c32ed355c6c918ec0a13ce34e910bb",
-    "term:connection-refreshes": "f192145ae1abb22ab1b4e0ae741cf6f2f70fe02cd91f999b607be44e5cd36096",
-    "term:connection-submits": "513893c6dbce7b8bb2ffc22af73802055ec7ce8f68071ff741dc09f9387cfb6b",
-    "term:coverage-gap": "5439d412988ad17087a17eb704c07da38244d510612b7bc26bbc493a177c807d",
-    "term:element-w-browser-lab-key-controls": "55ed362da3b7243aeab624750c5546d926d45cada9cdf27c8693f4f74763c2df",
-    "term:element-w-browser-lab-location": "1f8c1aa6163b2cbe7c4923fbdd5b4175dae990c845300d5fa052ac67fb81c234",
-    "term:element-w-browser-lab-message": "47e720ac92364b2b85874202c979806f1ffca38d3d710e1b3b23e79256358f27",
-    "term:element-w-browser-lab-navigate": "924d53ce472f167cb3b418db7e2a425eaedd44fdba239e7471d59c9954da2979",
-    "term:element-w-browser-lab-refresh": "2654dd74b8a2d123570cca9852df891cd04534679fbc91ed2d9a066ff40e3229",
-    "term:element-w-browser-lab-screenshot": "ae1f328bbe7bfef4b7f21720db204da37141cde36c9b90de6b2140647ca7c6a0",
-    "term:element-w-browser-lab-scroll-up-down": "c6593b17f846d76ce221af9358207193a8f1b9e6f87c4c879c6a3b22655405db",
-    "term:element-w-browser-lab-send-text": "e8a2ea64aa8ecfc0db83d8dc9b528dc5028202e6c414cf0a2996c353577843b9",
-    "term:element-w-browser-lab-sign-in-boundary-notice": "9012895f23c691b306c5a22ce3cddd0ff7529cea4657fba602eb761c073955d9",
-    "term:element-w-browser-lab-text-to-send": "1746969ac57df2f2c2da6669e45625fc4a4933a82e0319095973d0888da2c8fe",
-    "term:element-w-browser-lab-url": "4075a627ca7e8031e501ecfe41c9b1593e335bbead99d9ee17d2295a1b503c12",
-    "term:element-w-diagnostics-check-connection": "a46625d4ea65de7a2b8062573c5dfcc137dfa0ca47ca19017fca6176957ffee2",
-    "term:element-w-diagnostics-check-id": "6f2477ee3eef9941cf149ea1cf9925f20a042ab11ae865bba51d226cc0b84462",
-    "term:element-w-diagnostics-check-state": "17fd8045142c2225abdb1ed29ac319f12126ad83e2701282803d93b285c58c1c",
-    "term:element-w-diagnostics-detail": "f5867929f9ec6f04e1ec1e9f3af94f257d3eaa8be53bd6846329d32e416dde48",
-    "term:element-w-diagnostics-provider-sign-in-help": "ee042adbcc1790cdc997429f758b12bc4859421d873dfda644a611850c1dfe3c",
-    "term:element-w-diagnostics-timestamp": "ff985f153472fdc12700c4dd7abe944c9043f55600c8d6a9273336d2a5c14845",
-    "term:element-w-diagnostics-version": "bf83c7895f458e53e20190c3ab5316c5a6de37c1a22dd07c386f41a0bc3aba10",
-    "term:owner": "3779c62be248d7cc616784b6f1af27700f70424aa0b74c8141a192d61bbb0d7e",
-    "term:state-failed": "78217d476c53e940fe0f51854c95545e5e6cf55361a384dc7cec293ffd266e3b",
-    "term:state-unverified": "afdf90526f9ac66867f7a4ddab8306bbdd39e835156a4161d0f7b6f07095ef66",
-    "term:state-verified": "da3134750f825727c05beb951e88ff2ef7284cdf533526d406757be725d8fb59",
-    "term:ui-c-browser-lab": "606dd33e33b2fb89107ec9059765fc8c69116ca8130485416620d9eb89c76d36",
-    "term:ui-c-diagnose": "e5b9495d0c8198a8ad088b7f374b0ff263ddd9fc4b6c40478080c11708436725",
-    "term:ui-p-browser-lab": "2aa99ff876550b12b6368ede11aad614ccd0e6b70f6bea2873cb318531d645a7",
-    "term:ui-p-diagnostics": "ef8c5e52e16a525a97f8e2b4cf4c1e845c14b2190a40d39a9e7b4867456086f9",
-    "term:ui-page-browser-lab": "d5e8b1ffaddd0fa93d28c61ad4c502c1b2a54213426c91db4a869388fee0464a",
-    "term:ui-w-browser-lab": "2a78afbef51321c0f92c74d1973cae9ce880e3c93fd83d8f47e89a901a595f95",
-    "term:ui-w-diagnostics": "fa2b2f79675da863cad356b525753e83bf1e324b049e25deb035d3efeb38da2d",
-    "term:unverified-behavior": "f2f4dca98d1595e41c32c5a73dddf26ba84c1d557f7d5956f2ca37b537d8596c",
-    "term:verification": "dac65c65e3e90aed22ed03f547bccdb33e8110143760d21fa7a3df7a43c78518",
-    "ui:C-BROWSER-LAB": "e453a9b6a413f724c9e4eae113a41118570fe5f93c4fe989797424c148d9c2e9",
-    "ui:C-DIAGNOSE": "908234e5f2ad9c32ba1dfb38e1d1cd93025bcf3e4c3a770af0b14ce45e3de3af",
-    "ui:P-BROWSER-LAB": "6147ee0374528402b84cc39ff3b2be45ca83897f0f19c97335b5a19a42be110e",
-    "ui:P-DIAGNOSTICS": "3c8af12332b5ae91742e4cce284cb114ee4e8e6886142d561d4ac5b33244ece8",
-    "ui:PAGE-BROWSER-LAB": "aa52bd729b27df8c74cc7f052837b36a241a4c2399b0e9d3b88f087970f95100",
-    "ui:W-BROWSER-LAB": "3f1a5952f5aef7829cd4f073d1d412bb51fba9c6c9445a491f91905c4396b954",
-    "ui:W-DIAGNOSTICS": "78f5dd48442f33d00a3d5799f0477abb25fa1958f4b72d77a2ba754faac46b66"
+    "flow:operate-installation": "9b8a64911b10cd80d3334bd2f89b7a35db5f42b3fa78a1481094e4c718ca2ee1",
+    "term:connection-refreshes": "9aec84247316f08b45343a5df51fdb7ab67fc96c4b25e0fd673330c15b709f54",
+    "term:connection-submits": "936fe3512ff42748c5952360cd6be85044cf8d1b396f623fcfe43494d5cb16b8",
+    "term:coverage-gap": "4a7577550d83ddf6e0f8de27dffbd5b26a23ef973d93e9d58685eee6b2a66de6",
+    "term:element-w-browser-lab-key-controls": "842e8d13987347d2fa25cd231b2751534261cf986ca1a0888890ac0656986d62",
+    "term:element-w-browser-lab-location": "763bd60c587d22161b4dd5909f8730f03c9d55fe01709f604739b6d8cbebe13b",
+    "term:element-w-browser-lab-message": "ff374e9bec08b9e40f4f095108e0016bba71288a37b46f34e03ca24b35d7a46e",
+    "term:element-w-browser-lab-navigate": "1340db71b0b9f9136c3a7967f3953324ea4a8722e6ec89368a17b0d43fd3b007",
+    "term:element-w-browser-lab-refresh": "1dcafcff1392c23ef0d11b4c632c972667aca7873e7cd20205728611c190bdd4",
+    "term:element-w-browser-lab-screenshot": "7f3fcbdcdaccde34758428467b8893125f7875837e8ad5a691c06c6ee61a934b",
+    "term:element-w-browser-lab-scroll-up-down": "e145cd319fdbf2be4071bc1dbbb3e080ff24948739da6bfea7acdf66e394e8be",
+    "term:element-w-browser-lab-send-text": "87b755ab1c1be907a23fb68d782c2b23164f2fd713d7283b0ffb8d2883821bab",
+    "term:element-w-browser-lab-sign-in-boundary-notice": "f851b33934bff34f37fbdfb3423a6c8f717ae8a504fc0b2bc771ce11fcea3a90",
+    "term:element-w-browser-lab-text-to-send": "845745615a9f54f8ac21d3fd41c4c657aef79de8db507d0c8e5f5b081b491240",
+    "term:element-w-browser-lab-url": "c721f36372d1bb85e2cf99110b6d39bd4a49432857ede47fbc269db1d8b87bf9",
+    "term:element-w-diagnostics-check-connection": "d22c1849b821ef09c5c75227e82a822abe224055565b40c5218cd19142ead06c",
+    "term:element-w-diagnostics-check-id": "a83f6bf3a4520a6f630ec80182135ec6ff52b871834ab3b629becf257da464cb",
+    "term:element-w-diagnostics-check-state": "000869bbd04bf153a52152195cd44149cc00dcf6cd7ecc49bd168b80b6ed3293",
+    "term:element-w-diagnostics-detail": "8d48d1171eaeb4504ec9a96e425954c242d68adaba71d215a3273ef5b25e20f9",
+    "term:element-w-diagnostics-provider-sign-in-help": "2c528fd6219670543b9e56bc6d93866165b14b51bfd0da74e608201ce49f2490",
+    "term:element-w-diagnostics-timestamp": "a5d6fbd89d8d1c0a27763d24e44be3bd4e1bfe761b5c57d99ab5c8a9f7ed577c",
+    "term:element-w-diagnostics-version": "66feb70e1e704238784671e35a5845405d11069494867700e057c1c908d7551c",
+    "term:owner": "ca8a15122351e48051fd13cc151c55ea370a9c31481a7e17430ca6d1bce11b53",
+    "term:state-failed": "4102b75dcc0f4ed14d9f3189bd139ba4697f6ad953ef505d4736ceae6f456e5b",
+    "term:state-unverified": "fad99253710c70cc7cea15655e59dfdf379250ee3cb08fb6da5166984cb39947",
+    "term:state-verified": "6bb1af77875e5e8ec28563d0fa9b023babee4e026cee3365c9bcbc3e5e720398",
+    "term:ui-c-browser-lab": "0c38a559bc773957f56e1bb67068e84ebe5e3612484e60633d73ca4b203b42f1",
+    "term:ui-c-diagnose": "e59f2ab01d99696089e815f2e619b52ce5c84a643017849ad5acbe6b39c278b2",
+    "term:ui-p-browser-lab": "da2f35b6896c205b65ee2deaf1a26057bcb68b4350350bf87e09d8df06d25ceb",
+    "term:ui-p-diagnostics": "20e92cb0e434e01177862344be0637aec7250313eebb4bef6d7c6e5439f03171",
+    "term:ui-page-browser-lab": "276554943defd8e2ce3c546d24b71fa507f5874769723629e145a5d56aaa32d6",
+    "term:ui-w-browser-lab": "606ff06fd9322d2ad5450ff22a5694fce90c6cacf86cbb6a9df144bf99047b96",
+    "term:ui-w-diagnostics": "8ac2a2ea5121972ea71b70b3d2e4e61387f1085b926fe3ae0c75385c7de0990c",
+    "term:unverified-behavior": "36e7e9a3831e32de218b4cbee09bcd7b7d52b78070781da4a96ffa2f7046a25e",
+    "term:verification": "eb32301d216ca1e40f070bd1863b4aea8633b96fb0bb84bfc38a6bba764277bf",
+    "ui:C-BROWSER-LAB": "bb383f4416455e578a5b58465bc49f4ba1e911270a54f4b8d9ca3d4f8a101b6b",
+    "ui:C-DIAGNOSE": "2bc432b400df02ce4cb0ba56d05a22ee24ade5e1979c7dbc7b78c4c6cdfecd82",
+    "ui:P-BROWSER-LAB": "83c7579a5b2f0544adb87bd99956de7f0a69555df97e457e6008ad815c9bda01",
+    "ui:P-DIAGNOSTICS": "f8974dce99d616e1563a48511e2d18eb64475c0f4c309a62d90cb8d57efa4acd",
+    "ui:PAGE-BROWSER-LAB": "f1af1ab2fda3720af1ad0ebdaad673541c56b3bf2f3ac8d5623da9540bcc4cf3",
+    "ui:W-BROWSER-LAB": "12d7fce34b2a1835714181aad684b6fc5c9bcd8c18e800143376a1452a66f587",
+    "ui:W-DIAGNOSTICS": "a5517b83a4a2756896d01f3dba023fa3e7a8956907bee6bdd4030ced7063ca6c"
   }
 }