# FIELD-SEAL (v0.63.0) — milestone plan (doyle, 2026-08-25)

Operator directive (terminal, 2026-08-25): "round up the most pertinent outstanding bugfixes and
changes into a new milestone, write the plan, dispatch, commune across, and drive to release
publish." Selection delegated to doyle's judgment — that directive IS the greenlight; recorded on
the milestone issue. Bags checked: none as of 2026-08-25T10:29Z.

Milestone issue: releases#225 (kind: MILESTONE). Members: #222 #223 #219 #220 #221 #224 #216 #215.
Theme: everything the v0.62.0 field session measured broken, plus two small fresh-RCA'd defects.
Excluded by rule: needs-operator flagged items (cannot greenlit); WIP items riding prior lanes;
additions/ideas (operator asked bugfixes + changes; #207 addition explicitly not pulled).

## Waves (all product lanes = todlando; hertz on standby for test-defect fixups only)

### W1 — #222 seal enrollment backend swap (ANCHOR, design-fork lane)
The Passport/NGC KSP rejects plain key names (NTE_INVALID_PARAMETER) on open AND create —
measured 4-arm probe in #222; the raw-ncrypt route can never enroll on any box. Backend transport
must swap inside `mod hello` (crates/spt/src/authseam.rs); the seam contract
(REQ-SEAL-AUTH-BACKEND-SEAM) holds, callers unchanged.
- **Design fork, measure-first report BEFORE build:** webauthn.dll C API (natural for the FIDO2
  ceremony family, UV-gated, but COSE/CBOR pubkey shapes) vs WinRT KeyCredentialManager (supported
  Hello surface, needs windows-rs dependency). todlando probes BOTH minimally (can each mint+sign
  on this fleet's boxes?), reports, doyle rules the fork before the lane builds.
- Backend-kind token design anticipated this: new token (e.g. hello-kcm-rs256 or webauthn-es256),
  never a record migration (doyle W2 ruling 2026-08-24).
- Field acceptance: operator completes real enrollment on HFENDULEAM + a sealed send round-trips
  with the new backend.

### W2 — seal UX cluster: #223 + #219 + #220 (one small lane)
- #223: sealed-send answer carries the minted token (SENT:<target> seal=<token>); ceremony overlay
  clears from the PTY after admit (residue operator-observed). One-buffer identity invariant holds
  (cli.rs sealed_send_composes test) — answer surface only.
- #219: `seal describe` (and relevant wax-seal CLI): minter shows node NAME not 8-hex prefix;
  minted_at formatted YYYY-MM-DD HH:MM TZ host-local.
- #220: `seal verify`: strip (or also-test-against-stripped) trailing stdin whitespace; drop
  token/content_hash/ceremony_kind lines from verify output (describe keeps them).
- Requester for #219/#220 is the operator (discord:reavo) — spellings above are the ticket asks,
  verbatim scope.

### W3 — commune/psyche observability pair: #221 + #224 (one lane)
- #221: serialize per-project psyche ingest into the shared seed worktree (wait, not fail —
  single-writer queue or lock-with-wait at tracked/.seed.git); surface terminal (strike-3) ingest
  failure to the affected agent (durable message or next-brief warning). Evidence: 6
  PSYCHE_INGEST_FAIL across 3 agents, log lines quoted in the ticket.
- #224: read surface answering "where must my commune land" in ONE command (cwd/drop-dir field on
  `endpoint list --json` or dedicated verb). Acceptance pre-agreed with todlando (his probe arc).
- Hazard guard adjacency: F-032 commit-before-delete (REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE,
  spt-live/src/ingest.rs:223-246) is the GUARDED arm of the same seam — do not disturb; grep
  hazard tags before shaping (brief-fix-shape rule).

### W4 — small measured fixes: #216 + #215 (one lane)
- #216: composite update exit — last-nonzero overwrite lets a refusal mask a failure under
  --restart. Fix the exit composition ranking, keep refusal exit 3 distinct from failure exit 1
  (the #159/#213 opposite-pair contract).
- #215: local admission gate fed three value shapes; tier-1 rule silently cannot match on notify.
  Normalize the shape at the chokepoint, loud-refuse unmatchable rules.

### Assembly riders (doyle's gate, not lanes)
~~Four authored instrument lanes from the IR-30 family~~ — **MEASURED ALREADY LANDED 2026-08-25**
(doyle, `git merge-base --is-ancestor` all four tips into main): serve-window `17bbbd8`,
selection probe `695398ba`, resume taxonomy `58337879` all first-tagged **v0.54.0** (USHER
batch); attach-intent re-aim `37afa571` first-tagged **v0.55.0**. The "unlanded riders" claim
was carried forward stale from the 2026-08-04 ledger; nothing to carry this batch. Remaining
rider: generic attr-pass-through clause in the EVENT wire contract (overview.md) — the class
rule behind perri's 3rd-recurrence adapter fix (allowlist renders drop every new attr); doyle
authors, small, docs-drift-gated.

## Process (binding, unchanged)
- Per lane: worktree under .worktrees/, pool-claim from the lane's own tree, measure-first report
  before build shape, REQ activation in traceable-reqs.toml WITH the lane (no pre-fail), tags on
  evidence, traceable-reqs check green before lane-done.
- Gate battery per wave: targeted suites + compile-gate + BOTH-OS clippy arms (cross-OS clippy is
  in the battery since the v0.62.0 respin) + treqs. Exit codes from exit FILES, never wrapper/pipe
  status.
- Golden-head intake per PR #135 runbook: doyle assembles head, compile-gate + treqs pre-handoff,
  deployah verifies greenlit-form and runs golden; red goldens hand back to doyle RCA-first.
- GREENLIT recorded with operator citation; dropped members relocate-or-back-to-eval, never
  dangling.

## State at plan write
- #222 dispatched to todlando first (W1). W2-W4 dispatch at wave boundaries.
- perri's adapter seal-attr fix (claude-spt render_frames) is SEPARATE — his repo, his release;
  not a member. Coordinate field acceptance of #223 with his release so both surfaces show tokens.
- Publish target: v0.63.0, counter 98, deployah.