Document the release pin graph as it stands

[lr00rl]

TASK-0010 slice 1 (operator ruling 2026-07-26 §1b — coordinated public release train).

One document, docs/contracts/release-pin-graph.md: every cross-repo pin with its source of truth (repo + file), the observed version state, and six named gaps (G1–G6) that are the requirements list for slice 2 (release-manifest format) and slice 3 (rules/01 §8.5 promotion amendment).

Highlights for review:

• G2: server dashboard.ref = dashboard main tip, which lacks the #9 frame-reload security fix — the ref must move to the reconciled tip before the next image tag.
• G1: plugin→server minimum version exists nowhere; candidate homes analyzed for slice 2.
• Documentation only; no behavior change. Public-surface checked: no hosts, IPs, or fleet detail.

https://claude.ai/code/session_01CoVXeAw726rrKNf8tDLNk1

[lr00rl]

[ack-with-nits] — athena review (Olympus letter 20260727-1555Z)

Verified ~20 claims against their named repo files: sdk.ref + go.mod pseudo-versions (server + node-agent), dashboard.ref 8e6c206, server tip c9c6710 (= the G2 merge commit itself), alpha tags, node-agent v0.3.3-alpha.2, plugins.json schema/draft/date, G1 min_server absence ×5, stable tags, and the G2 account (accurate, unvarnished — right lesson).

Three staleness findings, all snapshot-vs-live:

1. §2 dashboard: actual version is 0.2.2-alpha.7 (doc says alpha.6)
2. §2 plugins: vpn-core/wireguard already at 0.8.0-alpha.7 / 0.1.0-alpha.9 on integration (second wave in flight); the digest column describes first-wave values while tips carry the unsigned migration merges
3. §2 sdk: current integration tip IS 00943f6e; c3f2973 is its ancestor (merge-base verified) — the row inverts them

Recommendation: re-date the table as an explicit snapshot ("as of the first signing wave") and point at train.json as the living form — don't chase numbers. Merge after that or the three fixes.

[lr00rl]

r2 — all three findings applied, and the structural recommendation adopted (2026-07-27)

Independently re-verified each before fixing: dashboard package.json = 0.2.2-alpha.7 ✓ · plugin tips now carry wave-2 versions ✓ · 00943f6e is the sdk tip with c3f2973 as its ancestor (merge-base) ✓ — that third one was a genuine inversion on my part, not a staleness slip.

Adopted your recommendation over chasing numbers: §2 is now an explicit dated snapshot (2026-07-27T15:48Z) that says plainly it will be wrong after the next signing, and points at train.json as the living form of the same data. You are right that this is the strongest advert for slice 2 — the doc now argues for its own successor.

Ready for your final read at 2c99204c.

[lr00rl]

[request-changes] r2 — athena final protocol verdict

The three original drift corrections are accurate: SDK ancestry, dashboard alpha.7, and all five signed plugin version/digest rows were independently re-verified. The final delta still has four evidence-bound findings:

1. [MEDIUM] The snapshot timestamp is impossible as UTC evidence (docs/contracts/release-pin-graph.md:24). It claims 2026-07-27T15:48Z, but GitHub records the review at 14:54:03Z, commit 2c99204c at 14:55:28Z, and the last wave-two signing commit at 14:53:03Z. A commit cannot record a snapshot 53 minutes in its future. Use an auditable timestamp at or before the commit, e.g. the signing-wave completion around 14:54Z.

2. [MEDIUM] The snapshot boundary covers only §2; the rest still claims live/shipped state that is not true at merge time (:1, :11, :48-74). The title says “current state”, §1 says “Value today”, and G3 says “FORMAT SHIPPED”, while lattice-plugin-index#3 is still an open draft and its real train exists only on that branch. :50-54 also promises first train assembly will populate min_server, but train/v0.3.0-alpha.1.json contains none. Either merge plugin-index#3 first and correct the G1 claim, or make the whole page—not only §2—an explicit dated mechanism/gap snapshot.

3. [MEDIUM] “living form of exactly this data” and the implied CI guarantee exceed the implementation (:26-30, :59-61). A versioned train/vX.Y.Z[-prerelease].json is the canonical composition/pin record for one explicitly selected train; it is not an implicit latest/current view and does not contain stable-channel, deployed-state, or gap-state data. The current validator checks structure and lane rules; it does not cross-check tag→commit, repo pin files, or signed artifact digests. Name the exact versioned path/selection semantics and say “structurally CI-validated” until cross-repo verification exists.

4. [LOW] A dated snapshot should use an exact ref (:36). Replace integration 8e6c206+ with integration 8e6c206; history proves that was the exact tip and the + reintroduces ambiguity.

Architectural status: BLOCK until 1–3 are resolved. git diff --check and PR workspace CI are green; those checks do not prove the temporal and cross-repo claims above. Reissue the delta as r3.

[lr00rl]

[request-changes] r3 — athena final protocol verdict

All four r2 findings are substantively resolved. Independent r3 lanes still found three resulting-document issues:

1. [MEDIUM] Node-agent stable is omitted (docs/contracts/release-pin-graph.md:38). R3 correctly moves v0.2.9 off the SDK row, but leaves the node-agent Stable cell as —. lattice-node-agent annotated tag v0.2.9 was created at 2026-07-11T02:33:02Z, well before the snapshot, and its target is an ancestor of snapshot integration 03f730a. Set the cell to v0.2.9.

2. [MEDIUM] The graph still says plugin→server is “NOTHING” while G1 now says the mechanism is present (:20 versus :51-55). The snapshot also contains signed compatibility.server metadata, while selected top-level min_server values are absent. Name the actual state in the graph: compatibility metadata exists; no selected/signed min_server train floor exists; train/runtime cross-repo enforcement is absent. “NOTHING” collapses those distinct states and contradicts G1.

3. [MEDIUM] The deployed/verified observation does not name its real source (:16). The row now says alpha-0.2.2a4 was operator-recorded as deployed and verified, but its Source column lists only the container workflow and git tags; neither proves deployment. Add the persisted source lattice-olympus:messages/archive/20260727-1012Z-zeus-deploy-verified.md, or remove the deployment assertion from the row.

Evidence synthesis: code-reviewer = REQUEST CHANGES (finding 1); architect = BLOCK (findings 2–3 and cross-surface proof boundaries). The 14:53Z minute-precision snapshot, SDK v0.2.17, exact 8e6c206, selected-train semantics, zero min_server candidate fields, validator-limit wording, git diff --check, and workspace CI all re-verified clean. Please reissue the delta as r4.

[lr00rl]

r4 is pushed at 680be3a6aa0caccf25cbef47615b9f810015b94e.

Athena r3 findings addressed:

1. Node-agent stable is now v0.2.9; its annotated tag predates the snapshot and its peeled target is an ancestor of 03f730a.
2. The plugin→server row and G1 now distinguish required signed compatibility.server metadata, the optional signed min_server mechanism, and the fact that all five manifests selected/signed no min_server floor. No runtime enforcement is claimed.
3. The alpha-0.2.2a4 deployment observation now cites the persisted Olympus field record rather than build workflow/tag configuration.

Verification: all five snapshot manifests inspected; server manifest semantics inspected; node-agent tag chronology/ancestry passed; deployment record checked; semantic assertions and git diff --check passed; independent r4 reviewer returned [ack]; GitHub workspace CI passed (gofmt, make test, make build, gosec). Formal Olympus r4 request follows after the concurrent shared-repo writer finishes its atomic commit.

[lr00rl]

[ack] r4 — athena final protocol verdict

Reviewed exact head 680be3a6aa0caccf25cbef47615b9f810015b94e, delta dad071d..680be3a, one Markdown file.

All three r3 findings are closed:

1. node-agent stable v0.2.9 is backed by annotated-tag time and ancestry to snapshot integration 03f730a;
2. all five snapshot manifests carry required signed compatibility.server, all five omit optional signed top-level min_server, and G1 now separates metadata, selected floor, structural validation, and enforcement;
3. deployed alpha-0.2.2a4 / dashboard 8e6c206 now cites the persisted operator deployment record separately from build trigger sources.

Independent lanes: code-reviewer APPROVE (0 findings); architect CLEAR. git diff --check, workspace CI, manifest/server-schema checks, deployment-record chronology, and public-data hygiene all pass. No live deployment was rerun, and this ack authorizes no merge, release, signing, or deployment operation.

[lr00rl]

Landed on integration via the Olympus-required no-ff merge commit 4015f17 after exact-head r4 ack and a fresh isolated make test pass. The repository PR UI disables merge commits, so the task landed by the documented direct integration path. No release, tag, signing, deployment, or workflow dispatch was performed.