[deku2026]

AF-CTR-03 companion 2: it records AF-CTR-03 as delivered (Cloud #118, #120, #121, #122, #123, #124 and #127, Contracts #121), fixes the non-blocking items carried from the reviews of Design #45, records the facts of the live mail adapters (Cloud #127), and adds the AF-CTR-04 inputs that are due before its Contracts part C0. It also adds one check to tools/check_design.py. Target and delivered behaviour stay marked separately; new target sentences say "(target)".

Changes

Delivered state

• decisions/AD-0021, Delivery state: AF-CTR-03 with its merges. Everything is dark in production (center.surfaces none). The acceptance environment (official-hosted mode) serves the account surfaces and the operator-grant page. The self-hosted default and the gate are proved by Go tests only; the gate is proved on test-only operations, because no gated operation is served before AF-CTR-04. Mail is disabled and no e-mail identity can exist. AR-23 is the owner's.
• architecture/10-cloud.md:
  • Line 5: the delivered state; the date is that of the last evidence merge.
  • Row 36: the mail adapters, tested MOCKED plus two REAL probes that deliver nothing. No real account can be mailed until e-mail enrollment is delivered (AF-ID-02).
  • Row 37: list by #118; rename, revoke and the cascade by #120; the remaining participants are AF-CTR-07 and AF-CLD-06.
  • §8: identity, pages and operations are delivered surface names; the rest are target names. The PR list "#118 to #122" is replaced by the PRs that delivered each clause (#118, #120). operations answers the Worker's 404 when it is off.
• data/cloud-store.md §6:
  • The part-B entitlement block (migration 0003).
  • The e-mail address bound: the column allows 320; the center admits 254 bytes (config.ValidMailAddress); Contracts still allows 320; 255 to 320 bytes is refused, where before #127 the center accepted up to 318. Tightening the Contracts bound belongs to AF-CTR-05's Contracts follow-up window.
• experience/web.md:
  • The heading credits each part to its PRs.
  • A new row for the operations page.
  • The acceptance environment now enables identity,pages,operations.
  • The Evidence bullet adds the --operator-grant mode (PASSED 2026-11-02 and 2026-11-03, MOCKED authenticator and catalogue), states that the hosted 403 for an account that is no operator is NOT evidenced, and names the mode --real-authenticator.
• architecture/16-testing-strategy.md §2:
  • New VirtualAuthenticator row (AF-CTR-03 used it; its Plan task already lists it).
  • New target rows FakeCenter and NodeProbe for AF-CTR-04.
  • FakeMailSender names its delivered form (mail.Fake, mailtest).

Mail facts (Cloud #127; plan-mail-decisions)

• web.md:29: the browser channel is passkey-only whatever the mail configuration (Cloud signin.go:108), and the pages have no e-mail route.
• 11-security-privacy.md §3: a secrets-table row and a paragraph for the e-mail credential.
  • Secret NAMES only; none is created.
  • A Postmark sender signature belongs to the account, so a Server token does not restrict the From address. Isolating production needs a separate account, which the owner decides at H-19/AF-PROD-01.
  • The outbound-handler question is decided again before AF-PROD-01.
• 14-commercial-operations.md:
  • EMAILS_SENT is a target meter (AF-PLAT-01, hooked into deliver.go); the delivered counter resets at every restart and is not that meter.
  • The only messages the delivered code can send are the sign-in and step-up codes, and mail is disabled in every environment, so nothing is sent today; the security notices are target (AF-ID-02).
  • The egress row says the delivered Container's egress is open.
• errors.md needs no mail edit.

Carried review items (Design #45)

• web.md:27, :30: a 503 with Retry-After: 2 is the Worker's answer for a Container that never started. Only a 499, a 504 and a 503 without Retry-After leave open whether the center saw the request.
• errors.md:20:
  • The credential-check parenthetical: a native bearer gets auth.credential_revoked, a browser cookie gets auth.unauthenticated.
  • INTERNAL/internal is the exception to the decision tree: NEVER with UNKNOWN for every method.
• errors.md:24, Delivered against target, restated:
  • The PR list is corrected.
  • arctest.Violations exempts INTERNAL/internal.
  • The E4-INTERNAL follow-up lands before AF-CTR-04's first center part.
  • The fixture is regenerated in the Contracts follow-up window (AF-CTR-05), with the extended pair form.
• errors.md:112 and web.md:30 point at that window (AF-CTR-05).
• 10-cloud.md §3.6: the fleet.proto gloss "passkey or recent authentication" is superseded. The proto copy itself is unchanged: it is byte-identical to Contracts, and C0 corrects it.
• Superseded identity owners (AF-ID-01 to AF-CTR-03, AF-CLD-05 to AF-CTR-05) in requirements.md (R-OPS-001), 11-security-privacy.md, 14-commercial-operations.md, contracts/README.md, reuse-map.md and reuse/inventory-and-classification.md.

AF-CTR-04 inputs due before C0

• requirements.md R-AUTH-002 and traceability/model.json: Android signs in through the center's mobile native authorization (AF-CTR-04). The app link applies to release builds; debug builds use a private-use scheme. R-AUTH-002 and R-CTR-017 list AF-CTR-04.
• reuse-map.md:
  • A §2 row for the new Contracts document of the mobile native authorization.
  • The DeviceService row is corrected: owners and the cascade.
• reuse-map.md §4 and android.md:46: AF-CTR-04 (part M) is to serve /app/callback and /.well-known/assetlinks.json behind the mobile surface, on the acceptance environment first. AF-PROD-01 adds the production routes when it activates mobile (decision Q15 of the AF-CTR-04 plan).
• model.json R-OPS-007: a disabled page surface is answered with the Worker's 404, not STATE/not_activated.

Tooling (tools/check_design.py, tests/test_check_design.py, README.md)

• check_error_pairs reads every row of the error-catalogue table and fails closed: a row it cannot read is an error, and so is a catalogued code outside the table.
• A row whose effect can be UNKNOWN fails when a clause of its retry advice (split at ;) names AFTER_TIME without naming DID_NOT_HAPPEN or HAPPENED, or names UNKNOWN. Words match with or without backticks.
• Limit: this is a word-level check. It cannot tell which effect a clause pairs AFTER_TIME with: "AFTER_TIME with DID_NOT_HAPPEN, or AFTER_TIME once" and "AFTER_TIME (even if not HAPPENED)" pass. The README and errors.md say exactly this.
• 10 new tests: the catalogue passes; conditional rows pass; each of the four rows of 44a86a9 fails; a clause naming UNKNOWN fails; a bad cell count fails; three bypass shapes fail (a qualified first cell, names without backticks, a row without a code); AFTER_TIME in another case or with a space fails; and a full main() run on a catalogue with the 44a86a9 provider_error row exits 1 (this test fails when the gate's call is removed from main()).
• AFTER_TIME is matched in any case and with a space or an underscore; the known effects (DID_NOT_HAPPEN, HAPPENED) only as the enum names, so prose such as "happened" never counts as a known effect.

What this does not change

• The proto copies (C0 changes them first), AD-0011 (ADR history), and the model.json rows that name AF-ID-01 (the Plan graph still lists them).
• The AF-CLD-01, AF-MCP-01 and AF-CLD-05 mentions in the D1-baseline and roadmap chapters, which are routed to their tasks' companions.
• The fleet/mobile renaming in the Plan's surface lists, which waits for AF-CTR-04 part D.

Coupling with the Plan PR

model.json adds AF-CTR-04 to R-AUTH-002 and R-CTR-017, and the Plan PR (plan/af-ctr-03-delivered) adds those requirements to AF-CTR-04.

• The Plan PR's linux-traceability step fails against Design main until this PR merges, and passes against this branch.
• This PR's own leg runs no --plan check.
• Merge this PR only when the Plan PR's review has no blocking finding; then re-run the Plan legs and merge the Plan PR at once.

Evidence and review

• python3 tools/check_design.py --require-protoc: 0 errors, 3 notes; 225 methods, 19 state machines.
• python3 -m unittest discover -s tests: 57 tests OK.
• Mutation: the four rows of 44a86a9 put back into errors.md give 4 errors in a full run; after restoring, 0 errors.
• Bypass probes:
  • Fail: a qualified cell, two codes, a code with a digit, names without backticks, "unknown" in prose, an escaped pipe.
  • Pass (the stated limit): the two word-level shapes above.
• python3 eng/verify.py run --rev HEAD (Linux, full profile): LEG PASS, 3 steps, 38 s at e63bff3; 47 s at ec7bfe4 (fix round 1).
• Fix round 1 mutations: with the gate's call in main() replaced by pass, the new full-run test fails; with AFTER_TIME matched case-sensitively again, the new case test fails in all three subtests.
• Plan review: lenses design, plan and a critic. The decisions file of the coordinator (B1 to B5 and seven decisions) is applied.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H6Cf6kHnz1ZkfURhVWvGjP

[deku2026]

Review record 1: Design #46 at e63bff3323d2593ab18b11937c7d259f6ac58e4f

Result: APPROVE (0 blocking, 4 non-blocking). Preceded by a plan review of the literal edits (three lenses: design truth, Plan record, critic; 5 blocking plan findings, all fixed in this PR per the coordinator's decisions file: the app-link routes per decision Q15, the error-pair gate made fail-closed, the AD-0021 clause about what the acceptance environment serves, two ledger statements in Plan #78).

Independent reviewer (not the author): check_design --require-protoc 0 errors (225 methods, 19 machines); tests 55 OK; the gate code equals the reviewed fixed form; the four pre-#45 rows of 44a86a9 restored into errors.md give 4 errors and exit 1 (0 after restoring); bypass probes (qualified first cell, two codes, digit in code, names without backticks, prose "unknown", escaped pipe, split table, moved row, repeated header) all fail; the only passing shapes are the word-level limit the PR body states. Replaying the plan's edits on 8b0aa6b: every difference from the head is a decision item; nothing changed meaning silently. Every new Cloud claim checked true at Cloud 474017f. Legs: arcforges/linux success (3 steps, 34 s), arcforges/windows success (3 steps, 23 s).

Classification test: BLOCKING = security/privacy/integrity defect, weakened check, a statement that inflates what the evidence proves, a must-fix not really fixed, a regression of a recorded decision; everything else non-blocking.

Findings (non-blocking)

1. PR body: "The messages sent today are the sign-in and step-up codes" (mail is disabled everywhere: nothing is sent). Corrected in the body by the coordinator.
2. No test covers the gate's call from main() (removing the call leaves 55/55 green). Taken in fix round 1.
3. AFTER_TIME matched case-sensitively while UNKNOWN is case-insensitive (after_time passes). Taken in fix round 1.
4. Plan AF-ID-02 still says "the remaining cascade" (Design now names AF-CTR-07, AF-CLD-06). Routed to a later Plan change.

Merge order: this PR merges only after the Plan #78 review has no blocking finding; then the Plan legs are re-run and #78 merged at once (model.json R-AUTH-002/R-CTR-017 coupling).

---

Generated by Claude Code

[deku2026]

Review record 2: Design #46 fix round 1 at ec7bfe4199302d4fec7b440feb8644e8cf4a4b6b

Result: APPROVE. One commit ec7bfe4 on e63bff3 (fast-forward; 2 files: tools/check_design.py, tests/test_check_design.py). Coordinator verification (one review per step; this round adds tests and one regex):

• Finding 2 FIXED: a test runs main([]) on the real catalogue with the provider_error row in its 44a86a9 form and expects exit 1; with the gate's call in main() replaced by pass the test FAILS (author's mutation run), restored it passes.
• Finding 3 FIXED: AFTER_TIME is matched as \bAFTER[ _]TIME\b in any case (after_time, After_Time, AFTER TIME now fail; a test with three subtests fails when the match is made case-sensitive again); the known-effect names still match only in capitals (docstring states it).
• check_design --require-protoc 0 errors; 57 tests OK; the four 44a86a9 rows still fail (1 error each). Legs at ec7bfe4: arcforges/linux success, arcforges/windows success (3 steps, 20 s).
• Plan #78's blocking finding is fixed at 7a2ebdc (see its record); merging this PR first is the planned order (the model.json coupling), then the Plan legs are re-run.

---

Generated by Claude Code