---
name: v0460-published
description: "v0.46.0 published 2026-07-30 (counter 81, @8f3e10b) — milestone A W0-W3 access control; first golden-CI release, tested sha == shipped sha"
metadata: 
  node_type: memory
  type: project
  originSessionId: ac2494c3-24d6-4d9b-9b66-f7dfefde022b
  modified: 2026-07-30T02:10:03.441Z
---

**v0.46.0 PUBLIC 2026-07-30T02:07:18Z, counter 81, REL_SHA `8f3e10bc05400d133b4eb0a1a48c388490f38cb7`.** Ships milestone A **W0-W3** — access-control core (ACL), two-key subnet, sender stamp, engine room — plus the `spt ring` endpoint-loss fix (#117). **W4 (knocking) / W5 (trust warning + monic store) are NOT in it**; milestone A stays WIP on the board for exactly that reason ([[alchemy-formal-milestone-process]]).

**First release under golden CI ([[golden-ci-strategy]], ADR-0050), and the doctrine it proved:
tested==shipped OUTRANKS bump-in-PR.** The bump rode the batch; my gate was a recorded out-of-band
audit at the ruled tip, not a bump-in-PR. Chain: golden run 30504054460 @8f3e10b green 9/9 →
doyle ff-only advanced main → tag → `release.yml` 30507165865 → publish. Tag sha == tested sha ==
origin/main == published tree, each re-derived by me rather than accepted from doyle's read.

**⭐⭐ The check that outranks the others: `git rev-parse <sha>^{tree}` taken BEFORE the merge, compared
to the API's `commit.tree.sha` after the push.** Sha equality alone passes over a re-minted commit;
tree equality is the only one that answers *which tree did I publish*. Generalises [[verify-the-subject-not-just-the-measurement]].

**⭐⭐ Both time-varying checks must be re-read INSIDE the publish window, and the counter must come
from the artifact twice.** Counter: decoded `update-set.json.metadata_json.version` = **80** out of the
published v0.45.0 before signing, **81** out of the published v0.46.0 after — never from `gh release list`.
Date: re-measured inside the publish command itself (`local=2026-07-29 utc=2026-07-30T02:06:23Z`), because
local midnight = 07:00Z and crossing it would break the `## [0.46.0] - 2026-07-29` heading — which is a
STOP-AND-REPORT, never a fix ([[release-standard-bump-in-pr]]: no post-golden edits, ever).

**Human-facing artifact audited FIRST, by diff not by eye:** published body == tagged CHANGELOG section
across all 84 content lines, differing only by the stripped `## [0.46.0]` heading (assemble omits it; the
release title carries it) and one trailing newline. **KNOWN DEVIATION shipped as-is:** exactly ONE
second-person line ("Endpoints you may not reach... advertised to you") vs zero in each of
0.45.0/0.44.0/0.43.1/0.43.0/0.42.0 — new drift, fix next batch, and **never edit a published body**
([[release-notes-enduser-voice]]).

**Quiet-window instrument, corrected mid-release:** a bare rustc/cargo count during `release.yml` is a
SAMPLE of a churning population, not a state — chert measured 11 → 1 in sixteen seconds on the same box
with the same probe. So the primary predicate is **"no non-terminal CI run"** (a run-level state), with
parent-chain attribution only for survivors, and chains walked **within one pid snapshot** — re-querying
by name between count and walk returns empty for an exited pid, and empty is indistinguishable from
unattributable. My window: 0 non-terminal runs @02:06:02Z, then 574 procs / **0 targets** @02:06:06Z.
Supersedes the count-based reading in [[quiet-window-predicate]].

Assets 11 = the seven from the draft + three `*.release.json` + `update-set.json`. Signed metadata:
key_id `rel-primary-2026`, key fingerprint `54188f127f9c…`, channel stable, `broker_resource_abi: 1` /
`brain_ipc_version: 1` (matching `frame.rs:27` / `update.rs:42` at the tip), sig 64 bytes. Artifact
sha256: win `0e9b2b7d…`, linux `d828eb41…`, musl `baed39ab…`, docs `7cba4bef…`. Docs ride as
`spt-docs.tar.gz`; **`docs-publish.yml` was retired and folded into `release.yml`** — a driver waiting for
it in the Actions list waits for a workflow that no longer exists (runbook step 3 says so in words).
Seed via the recorded HFENDULEAM hex-env exception: `SPT_RELEASE_SEED_CMD` **unset** at invocation.

---

## ⬇ Merged 2026-08-03 from the other memory root (store A) — [[two-memory-roots-diverged]]

Both stores held a note under this name, written by different sessions. Neither is wrong;
they record different facets of the same cut. Everything below is store A's version
**verbatim**, appended rather than reconciled, so nothing is lost to a summarizing pass.

⚠ **Apparent date conflicts between the two halves are the local-vs-UTC artifact, not a
disagreement:** this box is PDT (UTC-7), so a cut published after 17:00 local carries the
NEXT day's UTC date. v0.25.0 `2026-07-04` local == `2026-07-05T02:33:10Z`; v0.31.0
`2026-07-10` local == `2026-07-11T04:21Z`. Same class as the `ls -l` LOCAL vs traded-UTC
trap in [[commune-drops-orphaned-box-wide]]. Prefer the UTC stamp when quoting.

---

**v0.46.0 published @`8f3e10b` (counter 81), 2026-07-30.** Board settled: #20 ACCEPTANCE closed · #15 DONE · #9/#10/#13/#24 detached at WIP awaiting their own milestone. Nothing is mine on the board.

**PR #126 (golden/ci-traceable-pin) LANDED on main @`d26a2b2`** — doyle executed his own mechanical criteria (run 30509109149 all green incl twohost-a/b, ff-only, tested==merged, tree `7912004f` verified). **Push hold LIFTED** at that moment; deployah `6777f59` and chert `spec/access-model` rebase on fresh main. Traceability green, pin matches runners (kitsubito 0.2.0).

**Operator state:** weekly cap hit ~2026-07-29 19:55 PDT, but operator returned 2026-07-30 and ran the FF grill live — the ~48h block did not hold. Commune-tier-untrustworthy caveat stands (summariser leg failing on ≥3 of us): bank substance to memory index first.

**FF grill COMPLETED 2026-07-30 (operator + doyle):** rulings in `docs/ff-grill-rulings` @a2e9c7f (ADR-0052 §2 entry-UX + §4a create-unelevated/reset-elevated/agent-deny-env+pid; CONTEXT.md "access entity") + ACCESS-CONTROL-JIT.md §FF (untracked, main tree). FF wave dispatched to todlando (T1 ceremony verb, T2 TOTP prompt, T3 roster access views superseding `access list`/`rules`, T4 admin-seed rotation). No `spt subnet access`; no remote rule-read (node-sovereign). Doyle gates FF golden; publish before A-2. flynn answered (QUEUED).

**v0.46.1 inheritance:** candidate pool = my next-batch register ([[next-batch-register-v0461]]); **group A stays marked reconstructed/UNVERIFIED — marking not to be stripped.** Admin-seed rotation authorized into the fast-follow, its ONLY security item, own gate, never rides another diff. Five empty worktree skeletons pinned at `crates/spt-daemon` = retry-when-quiet. `InvUniqueTierMatch` killed-by-no-variant zero-fidelity pin = doyle's to dispatch. Register 12b(a): git preserves real newlines in argv — "message-via-argument" is NOT the discriminator, causal boundary is upstream serialization; fix the message-builder, never the invocation style.

**lia:** scoring 177,906/177,906 pairs complete, zero NS; Gate 4 S1 60% hold-rate finding (calibration failures on merits, not interruption damage); gate refusal written into state file; deadband frozen at 10, 0.75 minimum stands; all resumable cold. See [[commune-drop-dir-info-cwd]], [[psyche-fail-log-instrument]], [[gh-run-poll-jobs-not-status]].