Qualification and remaining work¶

The 26.11.9 release notes describe the current package versions and requirements. This page retains the detailed qualification history, including the earlier release record, and separates it from checks on the owned management environment. Passing an isolated test does not deploy that change or qualify an external client.

Evaluation release 26.10.0-alpha.1¶

That release baseline used official pyfly 26.10.18 and the native server launcher, managed dependency injection, named datasource resources and framework transactions. The clean installed-runtime baseline passed 3,912 tests, with 48 existing opt-in or infrastructure skips, and 19 deployment-utility checks with one local nginx skip. Those full suites preceded the final self-profile route correction. The rebuilt release wheel then passed the new signed native self-profile and denied-other-person regression in a separate installed environment. The complete backend source suite for that baseline passed 1,466 tests, with 39 explicit skips; its deployment checks passed 22, with one nginx skip. All five installed namespace trees matched their wheel bytes; 33,564 environment files and their modes remained unchanged through the suites, with isolated Python, no source import path and no bytecode artifacts.

Area	Current evidence	Remaining acceptance
Immutable RAG and history	Source and installed tests cover retained version, extraction and exact-part bindings, historical reads and current authorization.	A fresh ordinary intake-to-chat model journey on the final deployed revision.
Organization directory	Independent backend review passes 145 tests; tenant visibility, current permissions, revision conflicts, hierarchy cycles and source ownership have explicit regressions.	Final deployed UI and provider synchronization acceptance.
Typed headless SDKs	188 canonical operations and 331 schemas. Python, TypeScript and Java suites pass 149, 43 and 1,120 tests. Installed Python/npm packages and an external Java 21 consumer pass.	Package-registry publication and configured-service acceptance of the release.
Retained-data PostgreSQL rehearsal	An owned database clone reached native directory revision 22 while document and structured histories remained at 20 and 17. Four new table grants and 20 read-only runtime-role probes passed. Existing data, owners, grants, roles and six object inventories were preserved; original services were untouched.	Deployment to the retained management services remains separate.
Migration regression	The first directory attempt exposed a 34-character revision identifier exceeding PostgreSQL's 32-character version column. A read-only comparison confirmed rollback to the exact prior clone state. The corrected 25-character identifier passed the real successor rehearsal; all three histories now have a width regression.	Further migrations require their own qualification.
Interface	488 unit tests and 266 controlled browser journeys pass, including management, custom elements and a fresh installed Angular host. Initial management assets are 499,040 bytes under the unchanged 500,000-byte guard.	Fresh deployed provider and model journeys remain separate.

The framework release is published with verified assets. The earlier koinon release was published with verified downloads; retained-service deployment remains separate. Product source, installed runtime, real-provider behavior, interface fixtures, retained-service deployment, external clients and package-registry publication remain distinct checks.

The following capabilities still require explicit qualification or implementation before they can be claimed as complete: curated-knowledge RLM, general durable bulk intake/query batches, complete retained-domain parity, external-provider/client acceptance and the current CIAM profile-synchronization expansion. Their configuration and integration guides must preserve those limits. The delivery pull request tracks implementation and hosted checks.

Earlier isolated candidate, October 30, 2026¶

The frozen isolated runtime uses official pyfly 26.10.16. Its four installed product packages passed 3,601 tests, with 48 existing infrastructure or opt-in skips. All 543 critical cases ran without skips, including 179 secure execution cases. Source, wheel, installed files, metadata and native payloads were reconciled before and after every suite. Earlier failed installations and model attempts remain preserved. The later ingestion lifecycle changes described below have source checks; they are not included in that frozen installation or deployed to the existing management services.

Area	Verified result	Limit
Document RLM with a real local model	Four provider calls read the document and returned the correct source figures, sum and difference. The first final response omitted citations and was rejected; the model then supplied the actual filing reference within the same execution.	Isolated native engine check; no deployed chat, organization selector, curated knowledge or recursive-subcall acceptance.
RLM evidence	Immutable source version, extraction, part, content digest, tool receipts, provider requests and token ledger agree. The unchanged budget allows six root calls, no subcalls and 1,000 output tokens per request.	Correct arithmetic followed real document reads; this does not claim that the failed Python calculation itself produced the answer.
OAuth concurrency on PostgreSQL	Independent connections observed tenant-first blocking during application disabling and secret rotation. Audit committed, affected credentials were revoked, and unrelated credentials remained valid.	A fresh private cluster; registration-row contention was not tested separately.
Native migrations	An empty database and a separate synthetic version-18 database reached native revision 21 through Alembic. Historical authorization rows remained intact, with unknown registration metadata left null. Role grants and rejected mutations were checked through SQL.	Native history only; no migration of the original managed database or combined execution of all three histories.
Typed SDK source	Python, TypeScript and Java expose 167 operations and 306 wire definitions. Their source suites passed 142, 41 and 1,026 tests respectively.	These are contract and source checks, not live coverage of every operation or a published SDK release.
Upload resource cleanup	Regressions cover compressed inputs, retention of stored originals, private Parquet permissions across all seven readers, repeated cancellation, graceful shutdown, failed cleanup and ownership transfer between stages. The complete structured unit suite passed 745 tests; 24 isolated format-reader tests also passed.	Four existing optional structured tests remain skipped. Native shutdown deadlines are soft; hard-stop cleanup and Windows behavior remain unqualified. The format-reader checks exclude the parent Docker fixtures.
Desktop MCP package	A clean private build passed 17 tests, type checking, relocation and bounded MCPB validation. Both generated archives match their checksums. Builds reject installed dependency versions that disagree with their lock entries or lack source and integrity pins.	No actual Claude or ChatGPT installation, account linking or hosted rendering acceptance.

Dependency checks reported no known advisories for the frontend production tree, TypeScript SDK production tree, desktop bridge production tree, 248 pinned Python dependencies and four resolved Java SDK runtime dependencies. These results describe the package versions and advisory databases checked; they do not prove the absence of vulnerabilities.

The development-only MCPB tool still requires Zod 3, which is covered by an upstream resource-exhaustion advisory. Its two audit findings describe that dependency and its parent package. The distributed bridge uses patched Zod 4.6.6 and excludes the development tool. Local validation accepts only the fixed generated regular manifest, rejects symlinks and files larger than 16 KiB, limits V8 old space to 128 MiB, and applies a 15-second timeout and 64 KiB output bound. The old-space setting is not a total process-memory limit. These controls contain validation exposure; they do not remove the upstream advisory.

Ordinary RAG now binds each versioned retrieval hit to its retained source version, extraction and exact part before model context is assembled. The document-history API and all three typed SDKs can read that exact part independently of the current search projection. Combined source checks passed 3,786 tests with 49 existing optional skips, including the deployment tests; independent reviews covered the immutable bindings and canonical authorization. A separate installed-package qualification, retained-data restoration rehearsal and normal intake-to-chat model check are still pending for this revision. Historical answers without recorded identities remain unrecorded. Curated RLM, hosted identity/client acceptance, complete capability parity and product publication also remain outstanding.

The candidate pull request records the implementation and hosted checks. The corporate-brain documentation has been published separately; that publication does not deploy the candidate application or API.

Earlier management qualification¶

The following records describe earlier checkpoints. Their package versions, test counts and deployment statements apply to those checkpoints, rather than every later candidate.

The owned local environment was checked with PostgreSQL 17.11, vector 0.8.7, Redis 8.2.3 and Keycloak 26.8.1. No shared service or global PostgreSQL installation was modified.

Observed check	Result
Native and both preserved knowledge migration histories	Applied through native profiles/personal-token revision and both preserved domain heads
Runtime PostgreSQL roles	Non-superuser, no RLS bypass; separate privileged provisioning roles
Document knowledge FORCE RLS	No scope hidden; foreign tenant hidden; matching scope visible; wrong-tenant insert rejected; local scope reset
Retained Structured knowledge service/repositories	Canonical workspace provision, conflicting tenant rejection, foreign/no-scope read denial, native outer transaction rollback
Real browser OIDC	Native state/PKCE/ID-token validation, canonical issuer/sub, cookie introspection
Session/bearer separation	Cookie-only API denied; real API access token accepted; wrong-audience ID token denied
Five fictional identity users	Expected tenant/role denials, editor write, last-admin protection, immediate membership revocation
CSRF and logout	Missing token denied; matching token logout; shared logout visible on both API instances
PostgreSQL sessions	Survived process restart; reused by two independent API processes
Redis	Authenticated ping and expiring write/read
Read-only operator diagnostics	Five existing native datasources, runtime/control role flags, both local storage roundtrips, tenant-bound physical HNSW index including predicate/dimension
Configured worker limits	Bounded parallel consumers drain on cancellation/failure; configured native job lease and explicit overrides verified
Concurrent PostgreSQL admission	Cap one admits one request across two threads; serialized count reads 0 then 1; provider/agent revision fences and owner-wide token cap rechecked
Renamed callback and integrated API	Existing identity realm/client/subjects preserved; real browser OIDC/CSRF/logout and separate signed bearer configuration verified after package rename
Headless Python SDK	Source and isolated installed wheel pass contract/stream tests without backend, framework or image dependencies
Backup and restore	Private custom archive restored into a new database; three recorded revision heads and fictional tenants inspected

These observations do not establish live external model/connector acceptance, frontend visual acceptance, Docker image execution, production load/capacity, a published release, or a production restore. Provider readiness must be tested against each configured endpoint/model. The Compose, systemd and proxy files are deployment templates; Docker was unavailable in the local qualification environment.

Chat and source provenance¶

An earlier source follow-up pinned official pyfly 26.10.14, revision f777dceb061919722540df8db9787705ac8cb5b6. Its eight release assets were downloaded and matched their published digests and sizes; all seven checksum entries verified. That release corrected Ollama's output-token setting while preserving explicit provider-profile overrides. The secure execution follow-up below advances the source requirement to 26.10.15. Framework publication and a product source pin do not establish runtime adoption. The earlier management deployment recorded below used pyfly 26.10.13.

One owned private-text conversation was exercised with PostgreSQL and a local model. The browser observed incremental SSE, the persisted answer and the selected file metadata. Reopening that same answer is a read-only replay; it does not establish that every configured provider supports the same workflow.

Separate rollback-only PostgreSQL checks exercised native document hydration and actual Parquet/DuckDB query execution. They verified database identity, canonical and native dataset references, the snapshots actually read, changed current snapshots and foreign-snapshot denial. These checks used no model inference. Interface fixtures test how the audit renders recorded receipts; they do not establish live source-connector acceptance.

The additive structured lineage source has passed isolated PostgreSQL tests for immutable original artifacts, ordered transformations, snapshot bindings, scope isolation and failed-publication rollback. The canonical provenance/history controller has passed signed HTTP and native dependency-resolution tests. Constructor metadata has separate native factory regressions and independent review. The later controlled rollout below separately verifies adoption by the owned management services and read-only replay.

The source-coordinate reader and canonical API have separate tests for exact snapshot identity, selected cells, row/column pagination, native scope mismatches and token restrictions. Native parser tests cover spreadsheet offsets and multiple sheets, multiline CSV records, JSON paths and other supported structured readers. The mapping describes input positions, not the derivation of individual SQL result cells.

The coordinate-table migration passed 18 rollback-only PostgreSQL checks, including the real seven-reader ingestion path, replacement/reprocessing history and RLS. It stamps the manifest with its creation transaction and admits child mappings only in that transaction. A historical transaction stamp was simulated to verify later-append rejection; the test did not commit fixtures across two transactions. Schema, grants and fixture rows were absent after rollback. A later five-check PostgreSQL exercise used real committed transactions: native CSV intake published exact coordinates, then separate runtime and control transactions rejected additions to a sealed mapping. It used no trigger disabling, transaction-ID rewriting or model calls. The later controlled rollout below separately verifies adoption by the owned management services.

Rollback-only document migration checks have also exercised immutable originals, coherent version/extraction heads, committed knowledge-content guards, 512-character actor identities and the actual lexical-search index. Outbox publisher privileges were checked separately; an operating outbox relay was not qualified. Signed HTTP tests verify exact document version/extraction preconditions before replacement or reprocessing.

Historical origins without a recorded manifest remain unknown. Immutable raw-document integration and the curated publication/retrieval lifecycle are still being qualified. External ingestion-database connectors are not qualified. Current configuration must not fill historical origin gaps.

At that SDK checkpoint, the shared Python, TypeScript and Java contract contained 144 canonical operations and 271 schemas, with 10 separately qualified retained glossary operations. Source mapping and generated-reference checks agreed. An earlier SDK checkpoint covering 142 operations and 258 schemas passed 108 Python tests, 35 TypeScript tests and 852 Java tests; its isolated installed wheel, npm archive and external typed Java 21 consumer also passed. Those historical results do not establish a fresh installed-client qualification of later changes or complete replacement of every original domain capability.

The canonical file-append endpoint retains an existing dataset identity and appends all materialized sections as new tables, with a bound of 128 sections. Append mode refuses existing table-name collisions without changing the previous native table, and any materialization failure prevents successful publication. Private intake claims and completed idempotency receipts survive catalog edits and cannot be physically deleted through the catalog API. Exact request replays recheck permissions without repeating native work; changed payloads or file-version inputs are rejected. Pending or failed intake blocks canonical query/schema and affected retained reads. Native sections still commit independently: prior snapshots and files remain preserved, while explicit reconciliation recovery, full native/provider append acceptance and async/bulk intake remain unqualified.

Eleven additional PostgreSQL checks exercised append claims and publication using real primary database transactions and a controlled native port. Separate connections observed row-lock waits, competing claims, durable replay, cancellation, membership/token revocation and rollback of a partially projected result. An independent reviewer reran all eleven checks. This proves canonical transaction behavior; it does not qualify the complete native ingestion pipeline.

The coordinate, exact document-part/revision and current curated contracts are included in that installed-client gate. Managed backend rollout remains a separate acceptance step. Interface fixtures test presentation independently. The standalone structured unit suite passed 592 tests. Its full suite also attempted 126 Docker-dependent integration tests, which failed during environment setup because Docker was unavailable. The isolated PostgreSQL checks above are distinct from that original container-based suite.

Twelve opt-in PostgreSQL regressions passed in a dedicated owned database clone using existing non-superuser roles without RLS bypass. They exercised exact consent, actual native commit, controlled acknowledgement loss, receipt-only reconciliation, primary acknowledgement and retrieval through the lexical corpus. The conversation input was a controlled snapshot over real immutable source parts; no model was called. A second integration reviewer reran all twelve tests and checked their source hashes.

The same checks exercised authorized document parts across workspaces, rejected missing or denied source admission, restored scope after nested reads, exceptions and cancellation, and retained source locks until the destination transaction committed. Direct destination-scoped reads could not see source-workspace rows; foreign-workspace writes were rejected. Revoked originating tokens and changed final source revisions prevented publication. The private fixture database received its own migrations and object grants; managed databases and API processes were unchanged.

These results cover immutable document-part evidence, not every historical citation representation or a live HTTP/browser conversation. The current curated implementation still blocks sharing/export and further derivation from published knowledge until transitive source permissions are qualified.

Earlier publication checkpoint¶

The October 28 publication candidate passed 886 backend tests with 31 explicit infrastructure skips. The default run excludes opt-in PostgreSQL tests; a separate dedicated database run passed 14 checks for durable application authorization, concurrent reconnect/revoke and transaction rollback. That concurrency check exposed a lock-order deadlock, which was fixed and rechecked with independent connections. Retained databases and application processes were unchanged. Unfinished bulk-intake foundations are excluded from this candidate.

The current frontend passed 259 library and 31 management unit tests, 175 Chromium tests, configured lint/type checks, all builds and a fresh packed Angular consumer. Account management uses full pages with direct standalone links, browser back/forward support and a validated one-time return destination across sign-in. Embedded components do not read or change their host URL. Screenshots use controlled API fixtures. Management's initial bundle is 495,282 bytes against the unchanged 500,000-byte guard; Elements is 451,176 bytes and the catalog is 456,554 bytes. Chat defers the OpenUI renderer until an artifact appears. These measurements cover the built entry points, not production network performance.

The management proxy template has a dedicated native nginx CI gate for deep links, asset media types, backend routing and incremental SSE. Local qualification skipped that test because nginx was unavailable; template publication and a successful hosted gate are separate checks.

A private backup restored into a new database with all 99 recorded table counts and the three original migration heads intact. The clone alone advanced to primary revision 0014, document revision 0020 and structured revision 0017. Seven rehearsal checks covered RLS, immutable guards and exact runtime object capabilities. An isolated current API then passed 14 authenticated SDK read checks with model calls disabled. That rehearsal did not modify the existing services. Their scheduled session and expired private-file cleanup remained active; the retained conversation and its evidence were checked separately. The subsequent managed rollout is recorded below; neither exercise establishes production acceptance or ownership recovery.

The Library metadata projection passed signed HTTP, current-permission and typed-client regressions plus an independent PostgreSQL rollback exercise. Visible child counts use the same access boundary as the list. Numeric metadata rejects booleans, negative or unsafe values; unknown values remain null. Tags admit recorded strings only and preserve custom display case. The catalog uses four fixed SQL statements per nonempty page and one batched author-profile lookup, independently of page size; authentication and permission checks remain separate. This query-count check does not establish production capacity.

The two owned local management API instances were subsequently updated to the merged application source and official pyfly 26.10.13. Before migration, the primary instance was drained, its database was archived privately and restored into a new database with all 99 recorded table counts and three migration heads preserved. The exact migration source was rehearsed against that restore before the managed database advanced to native revision 0016, document revision 0020 and structured revision 0017. Existing roles, memberships and object capabilities were preserved; only the rehearsed capabilities on newly introduced objects were added. Original object stores and operator configuration were retained.

Actual browser OIDC login, Library, profile and application pages were exercised against these services without intercepted responses. Retained conversation message identities, text and run references matched across both API instances. A foreign workspace read was denied. The saved answer opened with its Sources and Execution audit, including the recorded private-file digest. That file had expired, so the interface correctly distinguishes a retained receipt from available original bytes. This is saved-answer replay; it is not new model inference or live external-client acceptance.

The organization-navigation frontend follow-up passed 276 library units, 43 management units and 190 Chromium tests using controlled API fixtures, plus lint, type checks, all entry-point builds and an independent packed Angular consumer. It fixes a delayed organization load overwriting a later navigation, restores only currently authorized organization choices for the same signed-in subject, and removes technical agent selection from the ordinary composer. Embedded components retain host-controlled navigation. Management's initial bundle is 497,001 bytes against the unchanged 500,000-byte guard. Independent review found no actionable source issues; deploying compiled assets and checking the live browser remain separate acceptance steps. Persistent organization chat configuration is a subsequent backend capability and is not established by hiding the selector.

Organization chat and cloud storage source follow-up¶

The organization default is a separate persisted setting with scoped reads, organization-level agents:write, atomic revision checks and actor/time audit. Standard chat uses exactly that saved runnable default; clearing, disabling or losing access does not choose another agent. Explicit SDK calls and Settings trials retain their chosen agent identity. Native revision koinon_0017_org_chat follows revision 0016 and preserves the existing agents and run references. See the organization default qualification for source and installed SDK checks, four additional PostgreSQL migration/FK/concurrency tests on a dedicated restore, and the separate runtime-role acceptance boundary.

Azure Blob Storage and Google Cloud Storage are integrated across original documents, structured objects and private attachments through an independent storage package. The isolated publication candidate passed 901 backend tests with 31 explicit infrastructure skips, configured Ruff/Pyright and all 51 storage tests in its backend environment. A fresh isolated installation of all four publication-candidate wheels separately passed 107 tests without source imports, including actual Azure/GCS SDK HTTP operations, real Parquet, governed native DuckDB execution and the snapshot-provenance regression. Candidate, wheel and installed copies matched 777 Python files, 16 resources and six legal files; 807 source/configuration inputs remained unchanged. Independent storage review found no actionable issues and passed 71 controlled tests. These are controlled HTTP services, not live cloud accounts. The storage guide records immutable-key behavior, 64 MiB object/aggregate query scratch bounds, private temporary-file cleanup and credential/IAM acceptance limits.

A new actual local-model conversation subsequently completed through the managed API and independent worker: a private text upload, original-byte SHA-256/download verification, extraction, search_private_attachments, incremental SSE and a persisted answer with a complete recorded private-source receipt. The browser reopened that answer and its digest at desktop and mobile sizes without API interception. No organizational knowledge was added or updated. An official MCP client also initialized against the managed endpoint, discovered all eight fixed tools and read actual scoped context, catalog, schema and the new answer audit. This qualifies those local operations; it does not establish an external Claude/ChatGPT client connection or live cloud-provider acceptance.

The follow-up query check also found that versioned schema retrieval omitted a recorded snapshot identifier from its SQL projection. A regression failed before the projection fix and passed afterward; missing evidence still blocks generation. Existing direct-SQL policy was left unchanged. A successful fresh natural-language dataset query after deployment remains a separate acceptance step.

The organization-default frontend source and compact-action follow-up passed 290 library and 43 management unit tests and 198 controlled Chromium cases, all builds, lint/type checks, packed-consumer and bundle gates. The unchanged 500,000-byte guard admits its 499,223-byte management entry point. The compatible build-tool patch also leaves npm audit with zero reported vulnerabilities. Answer actions use 32-pixel desktop controls and 44-pixel mobile targets; keyboard focus remains inside the scrollport. The subsequent owned deployment applied revision 0017 and this frontend after the separate backup and migration rehearsal below.

Managed organization default and action-layout acceptance¶

The owned deployment subsequently advanced to native revision 0017 while preserving document revision 0020 and structured revision 0017. A fresh quiesced exported-snapshot backup restored into another database with its complete row counts intact. The rehearsal was bound to the exact source, complete migration inventory, dump, capability baseline and stopped-process window; the same checks preceded managed DDL. Existing agent/run/job fingerprints, datasource role capabilities, role flags and memberships were preserved. Only SELECT/INSERT/UPDATE on the new organization-setting table was added to the existing primary role. The other four datasource roles have no rights to that table. Future private-file expiry jobs remained scheduled and unchanged.

Both API instances and the independent conversation worker now run four separately qualified installed wheels without source imports. Through the actual administrator interface, the organization default was saved once at revision one. A new standard chat used that exact agent, accepted a private text file, returned local-model SSE and retained a complete private-source receipt. Desktop/mobile replay checked all three action targets at 32/44 pixels, aligned controls and a fully contained keyboard focus ring. Both API instances returned the same saved message identities/text, and the original download matched the uploaded SHA-256. These browser checks used no response interception. All 66 document/structured domain tables also matched the fresh restore by complete row fingerprints after these operations.

Independent installed Python, TypeScript and Java SDK consumers each completed three actual GET operations: organization settings, dataset schema and that answer's source audit. All nine requests returned HTTP 200. This is three live reads per SDK, not live coverage of all 142 operations. The two temporary verification tokens were revoked; a subsequent bearer request returned HTTP 401. The post-merge Product, SDK and Pages workflows succeeded, and the published Azure/GCS guide, Foundation footer and local Manrope assets were read back from Pages.

Source regressions identified two additional cases. A late provider-metadata response could overwrite a selected Settings section, or clear an earlier Agents failure. The initialization now starts metadata without delaying section selection and never navigates afterward. The editable frontend passed 296 library units, 43 management units and 204 controlled Chromium cases, plus its existing build/type/lint/packed-consumer gates; the unchanged initial budget remains 499,223 of 500,000 bytes.

Successful canonical queries must not publish reusable examples as a side effect. Their borrowed native authority remains read/execute only, even for an administrator. Optional native draft learning now requires an enabled policy and explicit author authority; drafts remain outside retrieval and indexing until approval. Approval computes a compatible vector before changing state and publishes it in the same transaction. A private PostgreSQL row-version snapshot, source and review-state checks prevent a later committed rejection from being overwritten, including repeated rejection of an already rejected example. Public DTOs and database schema remain unchanged; explicit reapproval remains available.

Four tests on a fresh private Unix-socket PostgreSQL 17.11 fixture verified row-version concurrency, both starting states, fresh reapproval and private-field isolation. That fixture did not include pgvector. Native transaction/vector publication and full retrieval joins were separately exercised through a controlled SQLite SQL protocol adapter, including source/active-space fences, failed-write rollback and rejection retaining historical vectors. These observations do not establish live external-provider behavior or PostgreSQL pgvector approval acceptance. No existing examples or vectors were deleted, approved or backfilled by the qualification.

The subsequent navbar polish exposes the existing section icons and retains the native organization selector with a labeled, bordered 44-pixel control. Two focused controlled browser cases verified desktop/mobile composition, long organization names, selection and keyboard navigation. Library/application units, lint, types and production builds passed. Its management entry point is 499,940 bytes under the same 500,000-byte guard; no icon or menu dependency was added. These source checks are separate from deployment and actual browser acceptance.

Organization knowledge behavior candidate¶

Organization administrators can configure document RAG/RLM and bounded retrieval, analysis and structured-query parameters through Settings and the typed API. A policy revision is captured with each new chat run; queue execution, retries, direct search/query and answer audits use that recorded identity. Workspace permissions do not grant organization configuration rights. Historical answers without a policy receipt remain unknown.

An isolated installation of all four candidate wheels passed 679 application tests, 30 document runtime/reader tests and one structured pipeline test without source imports. Four additional PostgreSQL 17.11 cases exercised the real additive native18 migration, retained history and foreign keys, independent-connection create/update races, audit rollback and tenant isolation in a fresh private Unix-socket cluster. The predecessor schema was source-derived; this is not a restored managed-database rehearsal. Installed artifacts matched 786 Python files, 16 resources and six legal files, with 816 runtime/configuration inputs unchanged during qualification.

The combined RLM regression passes the admitted policy through the native adapter, CQRS handler, subprocess analysis engine and immutable document reader, then verifies exact citations and source-part identities. Its model is controlled and makes no network request. Separate regressions cover concurrent request policies, preserved model-factory/datasource bindings, token-ledger isolation and multiple-workspace receipt boundaries. RLM requires recorded immutable document views and remains unqualified for curated knowledge; neither limitation triggers an automatic fallback or source reprocessing.

Those subprocess regressions do not qualify code isolation. A subsequent test using an owned synthetic file and loopback listener demonstrated that restricted CPython execution could access host capabilities. That finding led to the isolated persistent execution candidate below. At that checkpoint, real local-model trials had not produced an accepted RLM answer; valid action syntax and respected token limits alone did not establish successful source use or a correct answer. The operating organization remains in RAG.

That SDK checkpoint exposed 144 canonical operations and 271 schemas. The new policy methods, bounds and applied snapshots passed source and installed consumer checks: 122 Python tests, 37 TypeScript tests and 878 Java tests on each of JDK 21 and 25. These tests did not establish live coverage of every operation. Managed migration, deployment, actual administrator saves and live-provider RLM acceptance were separate steps.

The final Settings build passed 317 library units, 43 management units and the complete 214-case controlled browser suite, plus configured lint/type checks, all entry-point builds, a packed Angular consumer and locale checks. Browser geometry and read-count assertions wait for the final visible view without relaxing their limits. Both locale registration orders preserve all 1,294 canonical Spanish translations; five affected Spanish browser cases passed after the label correction. Its initial management bundle is 499,801 bytes under the unchanged 500,000-byte guard. Source screenshots use controlled responses; they are not captures of a deployed organization policy.

Secure iterative execution candidate¶

The follow-up requires pyfly 26.10.15 at official revision bd613b9d17788354864b43f87d92d05ea48a12fb. Its published wheel is byte-identical to the independently reviewed candidate; anonymous downloads, release checksums and all 1,146 framework namespace files were reconciled with source and the source archive. Hosted installed-wheel tests exercised the native runtime on Linux separately from local Darwin checks.

The first four-package installation passed 3,226 tests without source imports, plus 117 focused execution and protocol cases without skips. Its installation preceded publication, and its exact archive bytes were subsequently verified against the public release; no installation-origin metadata was rewritten.

A fresh installation using the official download also rejects blank finals through trusted validation feedback within the existing turn limit. It passed 3,255 tests and another 146 focused execution and protocol cases without critical skips. The full-suite result includes 48 infrastructure or opt-in skips, including five PostgreSQL container cases where Docker was unavailable; it does not establish those cases or production capacity. Source, wheels, installed metadata, legal files and native runtime payloads matched before and after testing.

The required engine now rejects legacy execution, unexecuted plaintext and unrestricted forced-final fallback. Independent review also exercised authority changes, callback deadlines, source-read preconditions, terminal cleanup and both action protocols. A real local-model run reached the isolated document reader and a traced final response, but failed the semantic answer check. Real-model and HTTP/browser RLM acceptance remain pending; the operating organization remains in RAG.

Product acceptance still required¶

The original capability review still contains partial and missing product workflows, including dataset-append recovery/async/bulk intake, the remaining curated lifecycle transitions and semantic authoring. Complete migration parity, external identity-provider acceptance, production capacity and a production release remain separate acceptance steps. The original projects must remain available until the replacement has passed those steps.