Authorized cleanup completed, new execution remains held
Assignment ADR-0053/delivery/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local. The reviewed clock-independent creation sequence passed for unsigned UUID 8be1d3a1-c4ee-4eac-ac78-0d5c7b3b6a94: fresh baseline/source/cleanup and exact revoked-role checks, restricted login and five denial probes, seven exact response-ID creations, diagnostic staging and byte verification, then removal of only the seven project entries and restoration of the original business snapshot.
Diagnostic dpl_64ntamgc2zuyW1KQqKdWJRjxiiPm reached READY, exact source fb4bf54cf033cf47f2642bdcafe28e4498e5e951, with reviewed uploaded bytes, without changing the alias. At the invocation boundary, unscoped CLI promotion rejected before signing with Deployment belongs to a different team. The finally cleanup promotion hit the same CLI-context rejection, while its nested finally still revoked the role and proved zero sessions. Neither CLI rejection mutated the canonical alias, and no approval, audit row or acquisition POST was created. This unsigned attempt is permanently stopped.
Root explicitly authorized completion of only the prepared cleanup promotion with pinned team scope. Read-only API verification established both deployment owner IDs and the project account are team_byXeghD9Vv0Kd5UKuKWBqQb9, project prj_I26a7SyJnm5qwDdoaD9vZCP9gVY7, slug jack-allreds-projects. Exact cleanup promotion with --scope team_byXeghD9Vv0Kd5UKuKWBqQb9 succeeded, and API readback proves canonical delivery.sguildswim.com now serves READY cleanup dpl_6kMSVcQWqehL1sT6xAb78DjRrbPi, source 5c36fd2021069d766b17f97032b4266c8d0b4f5a. There was no retry of diagnostic promotion.
Final readback proves canonical POST 404 both without authorization and with an explicitly invalid unsigned-window header. No former signed header existed. Retained diagnostic and cleanup URLs return 302 deployment protection with either header case; this is not a route-404 claim. All seven exact created IDs and names are absent, all 28 business rows/settings retain their original hashes, role OID 13362275 is NOLOGIN/password NULL with its grants revoked, shared dependencies and role sessions are empty, and the unsigned window has zero audit rows and zero proof POSTs. Custody exited cleanly. Signed-window expiry is not applicable because no signed window existed. No Phase C or business call occurred.
Stopped and cleanup evidence in .tmp/production007/prepared-clock-fixed/:
final-cleanup-proof.json:25e51ff4c4c3a05721eca399225ee0c824f5015535cfc9484a479a2039c16473.state.json:d3d11c16c4221077d7462d5d98edd50a7434fdf3e967df716ebb7c2e93f6a411.scoped-cleanup-promotion.json:9fc4534587c182e03087637119645d0cd23f3bdc0908a7b75a1e4bfbb60eec2a.
Explicit scope correction and updated baseline
Root directed the local correction and another distinct unsigned plan, holding further production mutation until final pin review. Both deploy and promote now pass through one builder that appends exactly one explicit pinned --scope. Caller-supplied scopes, short-form scopes, duplicate scopes and unreviewed operations are rejected. The Linux child boundary independently rejects any deploy/promote request missing that exact single scope. No active CLI-team assumption remains in these operations. The before/after runner and child helper plus minimal diffs are pinned for review.
Actual read-only scoped CLI whoami returned sguild-admin, matching API identity. Scoped CLI project inspect returned the exact project and observed the team slug. API team ID/slug and project ID/account, plus the local cleanup checkout link, match. This was an actual CLI/API identity check, rather than an offline constructed-argument claim. .tmp/production007/prepared-scoped/cli-api-identity-proof.json SHA256 is 325a0e02cdccbf28f1a5f74be14c979c5ffaf6727ae70c4d29154404a4c727d7.
The canonical baseline is now the verified cleanup deployment above, not the original 51cf142 raw-source deployment. Preflight pins source 5c36fd2021069d766b17f97032b4266c8d0b4f5a, READY/owner/project/alias, and all 508 regular prebuilt uploaded source UIDs against artifact manifest SHA256 1540b1b4fff85a53a0a5fddb758131f12b33cc2b94fac72816b21f4b71330cda. The 118 contained links reuse accepted containment evidence. Config and executable files are among the exact hashed regular entries. The runner rejects all three stopped directories and the previous diagnostic deployment ID; the next attempt requires fresh memory credential/key and a fresh deployment snapshot using the same reviewed fb4bf54 artifact.
Fresh GET-only/local-byte preparation at 2026-10-03T08:36:07.706Z confirms canonical cleanup baseline, all 508 source UIDs, both unchanged application artifacts and original business snapshot, SHA256 4ea490efff7715579dd8ca41dabf22e8cc887876a818cffab9e748020148c66e. Fresh role READ ONLY snapshot at 2026-10-03T08:36:08.756Z confirms the same OID, flags, NULL password, exact creator-admin link, unchanged PUBLIC baseline, no direct grants/ownership/dependencies and zero sessions, SHA256 f9201e13f6c1ae8c8fef634f49d42841c4b52f6573ef5e5e08f58d1727d9a72e.
New planned unsigned UUID d6f098a6-4643-4d7c-93e1-e52c5cf47181 has no credential, key, deployment or signed approval. The 60 combined scope, exact-ID recovery and role fixtures pass, including 11 new scope-construction/child-denial cases. Syntax checks pass. No unrelated app-suite rerun or artifact rebuild occurred for this orchestration-only correction.
Final local pins in docs/adr0053-workload-proof/orchestration/:
fix-manifest.json:65ff9306235ebfaa7b6094f085ec2df0cec5ec83ac20cbe21e73980a1d6bffec.custody.mjs:504c0646ae8dd9b4117d0b1ce3f31bc409959998cf33706c00f323de76eeeb6d.cli-scope.mjs:57549a01156b33d827fafd11d4404f23d49a0ebfa21b9a229253a6b949727297.linux-cli-custody.cjs:4c118b0b9ab8e0b3cb6005ad3d53c44056288e99f4931ac1647f012fb93edf53.cli-scope.test.mjs:bf6ea7d08ac496fdff3574ef50a6e8ebbb7a5c3b77103a99e9c6658fff398ad6.role-reuse-plan.json:764db8a7eccb43fb10eab1e7b69d4a5f542d75a95fa31f721a2997385c4fbd25.
The next reviewed sequence remains exact role reactivation, actual privilege proof, seven journaled env entries, fresh diagnostic READY/exact bytes, only those project-ID removals and unchanged business snapshot before signing, one bounded acquisition POST, immediate verified cleanup and exact-role teardown, honest route/retained-URL observations, audit retention and expiry of that same signed window. No further production mutation occurred after the expressly authorized cleanup. Acquisition remains unproven. Root owns final review and sole publication; G2 evidence, old runtimes and both ADR deadlines remain preserved.