UCCA Fossil Ledger¶
What this is. The honest record of the dig. UCCA's docs froze at the pre-boundary "working-locally" moment; many describe a reality that bytes or founder testimony now contradict. Under the yellow-tape rule (CLAUDE.md standing rules), a contradicted claim is stamped and ledgered, not investigated. This ledger stops the same fossil being re-discovered by every future session, and its "how we know" column keeps the day's lesson: "prepared from project memory" is a warning label, not a source; testimony is a source only when labelled as testimony and filed.
How we know is one of: bytes (verified on disk), testimony (founder/authoritative, dated + attributed), or document (a filed artefact).
Handling is one of: stamped (historical doc describing the old engine — taped, body retained) or removed (a claim of engine↔TGA connectivity dressed as current — deleted on sight, no parked fallback; standing ruling Tim 2026-07-01). Both are logged here identically.
| # | Where (doc/section) | What was claimed | What's true | How we know | Date | Handling |
|---|---|---|---|---|---|---|
| 1 | engine/ucca-engine/adapters/tga/INGEST.md |
The engine ingests TGA corpus internally ("canonical process") | The engine no longer ingests anything; corpus acquisition is world-side (RTOpacks) | testimony (Tim, 2026-07-01) + bytes (worlds/ residue in engine); RTOPACKS-CORRECTION-01 (received) |
2026-07-01 | stamped legacy; body retained as history |
| 2 | CLAUDE.md TGA-data rule · reference_tga_ingest memory · onboarding brief |
TGA corpus acquired via manual Power BI Excel exports; "no automation possible" | Acquired world-side (RTOpacks) via scheduled TGA REST-API sync into their regulated store, raw JSON archived to R2 (dated snapshots); engine touches nothing upstream | testimony (Tim, 2026-07-01) | 2026-07-01 | manual-Excel line corrected to true mechanism (all 3); memory corrected |
| 3 | CLAUDE.md TGA-data rule | "The TGA SOAP API is the only acceptable external data source… parked until needed" (engine↔TGA connectivity, dressed as current) | No engine↔TGA connectivity exists; disconnection is the architecture, no parked fallback — SOAP stays deleted | testimony (Tim, 2026-07-01) + ADR-0002 | 2026-07-01 | removed, not taped (remove-on-sight ruling) |
| 4 | FOUNDATION-01 §4 ("Real and working" — Generation) | "a real validated run exists (retail unit, Dec 2025)" — read as proven, on-disk | The proven, on-disk validated run is CHCPRT025 (care unit, 2026-03-09); the §4.1 schema was extracted from it. The Dec-2025 retail run did occur (JSON-only output) but its output did not survive the workspace move — attested history, not surviving proof. |
bytes (absence — no Dec-2025 bundle on disk, none in git history, SIR* hunt found nothing → deleted-presumed) + testimony (Tim, 2026-07-02: the run occurred, output likely deleted in move-tidy) | 2026-07-02 | Corrected in canon (attested, not fiction). FOUNDATION-01 §4 now reads "(CHCPRT025, care unit, March 2026)" plus an attested note on the Dec-2025 run; dated changelog line (light-touch, per ADR-0001 fix). SIR* recovery hunt run — none found. Closed. |
| 5 | engine/ucca-engine/docker-compose.yml (db service, postgres:16, ucca_engine_db) |
A Postgres container is the engine's datastore ("course storage" from the course-only era) | The engine's datastore is D1 (ucca-input-path) + R2 (ucca-artefacts); the Postgres container is a fossil. Nothing live-imports it — zero psycopg/sqlalchemy/asyncpg imports repo-wide; the reasoner container uses its own reasoner/Dockerfile, not this compose file. Consistent with "PostgreSQL wiped clean 2026-03-09" + "No SQLAlchemy. D1 access layer only." |
bytes (the compose file on disk + grep: no driver imports, nothing references the compose service) + testimony (Tim, 2026-07-03: recalled a course-era DB container, asked to confirm/kill) | 2026-07-03 | Stamped (yellow-tape header on docker-compose.yml; body retained — it's a local-dev artefact, harmless while unused). Found under the purpose drift-check. Actual removal is re-engineering scope, deferred — not tonight's spine. TEARDOWN 2026-07-04 (Tim ruling): a survivor ucca_engine_db container (restart:unless-stopped, from a defunct ~/Projects/ucca-engine/ layout) auto-restarted when Docker was started for a build; its ucca_engine DB was verified empty (0 tables, ~8 MB default) — no client-era data — then docker rm -f + volume ucca-engine_ucca_engine_pgdata removed. Container + volume + compose group confirmed gone. |
Loose ends (untracked orphans — noticed, not fossils)¶
Not contradicted claims — files/artefacts found uncommitted and unexplained during other work, logged so they are triaged rather than swept into an unrelated commit or forgotten.
| # | Where | What | Noticed | Disposition |
|---|---|---|---|---|
| L1 | docs/ucca-docs/docs/standards/mode-system.md |
Untracked, never committed; unrelated to any current work. A docs/standards/ doc (CLAUDE.md TECHNICAL STANDARDS references a technical-excellence.md there — this is a different file). |
2026-07-03, during ORDER-04 close-out (stop-gate: not part of ORDER-03's record) | RESOLVED-DUPLICATE 2026-07-04 (B-OPS-SUCCESSOR-01 Unit 0b). The untracked docs/standards/mode-system.md was byte-identical to the already-tracked docs-site/docs/standards/mode-system.md (canonical). Stray dupe removed; empty docs/standards/ gone; canonical standard registered. Not lost content — a redundant copy. |
| L2 | infra/ucca-infra/scripts/backup/{cf-backup,cf-restore,cf-verify}.sh |
Three pre-existing uncommitted edits to the CF backup scripts, present before TERRAFORM-RECONCILE began — not authored by this agent. | 2026-07-04, during TERRAFORM-RECONCILE (stop-gate: not part of the reconcile's record) | Excluded from every reconcile commit; left uncommitted on disk. Needs a deliberate disposition later (Tim ruled: exclude + ledger) — review what the edits are, commit or revert intentionally. Not swept. |
| L3 | ucca-deploy API token — Access: Audit Logs: Read scope |
The scope is not useful for its intended purpose (D1-deletion records live in the account resource audit log, dashboard-only, not this Zero-Trust log). Carried since the ORDER-05 forensic. | 2026-07-04 (Tim ruling: ledger it) | Deliberate hold — no further chasing. Left as-is on the token; a considered disposition later (remove the scope, or leave it inert). Not investigated further. |
| L4 | ~/projects/ucca-project copy/ — a 12 GB duplicate of the entire workspace (not a git tree at root) |
Recon (contents-minimal, no rows/values into context). SQL dumps = course-era engine fossil, NOT client data: ucca_engine.sql/ucca-db-dump-20260309.sql carry the old local course-gen schema (course/framework/ucca_unit/training_packages) — 9 courses, 51 TGA training-package reference rows (public metadata, Tim ruled not client-era), no rto/leads/enrichment, 9 units vs rtopacks-db's 75,189. Credentials = full duplicate vault, EVERY key still-live (0 rotated, 0 copy-only) — CF/Stripe/Twilio/Anthropic/GitHub + 12 NSW/VIC vaults. |
2026-07-04, during the F5 teardown recon | CLOSED 2026-07-04 (Tim ruling). Dumps + copy = engine fossil, no fence action. Whole 12 GB copy (vault included) secure-deleted (rm on APFS/SSD; confirmed gone). Backup/sync scope: ~/projects in local Time Machine only (drive, not offsite/cloud) — TM snapshots retain the pre-delete copy (Tim's drive to decide). Rotated (exposure = local machine + local TM): UCCA_SIGN_SECRET (ucca-keys+reasoner, live-verified), KEY_SERVER_SECRET (ucca-keys+track+ir), UCCA_ADMIN_KEY (vault). Flagged for Tim's hands (provider dashboards): CLOUDFLARE_API_TOKEN, STRIPE_SECRET_KEY, ANTHROPIC_API_KEY, GITHUB_PAT — DEFERRED (Tim ruling 2026-07-04): dev-phase risk accepted; revisit pre-production. KEEP-CURRENT: none in Terraform. |
| L5 | Secrets live inside the project tree — the vault ~/projects/ucca-project/.credentials/ (gitignored, but on-disk in the workspace) |
Secrets should move OUT of the project tree → OS Keychain / 1Password CLI / a relocated vault outside ~/projects. The L4 incident is the argument: a 12 GB workspace copy duplicated the entire live vault (every key), and in-tree secrets are precisely what turned a stray copy into a credential exposure. |
Opened in TM-B §5 (2026-07-04); landed here 2026-07-04 (Tim, mint-pack Edit 6.1) | Watch / plan — before production. Relocate the vault out of the tree; adopt 1Password CLI (aligns with ADR-0004's pre-prod checklist: "1Password CLI secret management before build-time secrets multiply"). Source: TM-B §5 — now filed, ground/UCCA-TM-2026-07-04-B.md (2026-07-04, mint-pack Edit 6.2 path A: Tim supplied the verbatim). |
| L6 | The one throat — GLM-5.2 via the Workers-AI binding (provider.svc in reasoner/src/consumer-shim.js → reasoner/adapter/providers) |
GLM-5.2 transient generation-failure rate ~1/5 observed on 2026-07-04. A generation step exhausts its 3-attempt budget → JOB_STEP_RETRY_EXHAUSTED; the same payload succeeds on resubmit (job e9b6a394 failed, resubmit 55810eb3 completed), so it is transient (rate-limit / malformed completion / timeout), not systemic. Not the wedge. |
2026-07-04, during the slot-release wedge-fix P1b proof (Tim ruling: open as loose end, number L6) | Watch item — no work now (Tim ruling). Characterize the rate + cause before production. Any fix belongs in the throat/adapter layer per the provider-dialect rule (provider quirks never leak past the adapter), not in the engine/spine. |
| L7 | surfaces/ucca-surfaces working tree — workers/{backup,cricos-sync,qual-enrichment,stats-cache,traffic-snapshot} modified + untracked workers/backup-large/ |
Pre-existing uncommitted diffs, not authored by this agent; noticed while committing the B-OPS-SUCCESSOR-01 Unit-0 admin scaffold (staged apps/admin only, left these untouched). | 2026-07-04, during B-OPS-SUCCESSOR-01 Unit 0d | Untouched; disposition owed under UCCA-RULING-GOVERNANCE-SURFACE-01 Rule 2 (uncommitted diffs = unminted decisions: summarize → rule commit-or-revert → resolve, never left standing). Tim ledgered 2026-07-04; resolve on its own pass. RESOLVED 2026-07-05. Two-stage close: (1) the cricos-sync/qual-enrichment/stats-cache dirs were deleted from HEAD under the enrichment fence-cleanup ([[fossil-ledger#L10]]) — their local wrangler mods went with them; (2) the remainder — backup (3 files) + traffic-snapshot mods committed, and the untracked backup-large/ adopted (git add, tracked as-is) — as post-hoc capture of the 2026-04-09 DB/world-isolation migration (UCCA-CLEANUP-01), surfaces f697840, under UCCA-RULING-GOVERNANCE-SURFACE-01 (Tim's L7-recon ruling: A/B COMMIT, C ADOPT, D closed-by-C). How we know: deployed-vs-local match on a live read of ucca-backup-large in engine account e5a98302 (deployed bytes == local source — the gap was untracked source, not divergence) + Tim's ruling, 2026-07-05. The substrate led the repo by ~3 months because the isolation boundary was enforced in running infra the day it was needed; the edits + suspended worker were deployed but never staged — this close is the paperwork catching up. |
| L9 | ucca-input-path.cognitive_cost.cost_usd — the production model is unpriced in the cost ledger |
Since GLM-5.2 adoption, every GLM-5.2 inference records cost_usd = NULL (byte-precise 2026-07-05: for model='@cf/zai-org/glm-5.2' → 91 rows, 0 non-null, 91 NULL, 0 zeros — NULL ≠ $0). The engine's pricing table (generator/course_generator.py:591) has no GLM-5.2 entry; only 13 course-era claude-sonnet-4 fossil rows carry a real cost ($0.167, no neurons). So the ledger's own cost_usd/cumulative_after_usd silently understate spend on the production model to zero. Neurons (36,483.988) are recorded correctly — the ground truth. How we know: live D1 GROUP BY/CASE WHEN reads, 2026-07-05. |
2026-07-05, discovered building B-OPS-SUCCESSOR-01 Unit 4 (Tim ruling: file the data-quality line now, dated) | Filed. Remediation SUBSUMED by UCCA-CAPTURE-COST-LEDGER-01 (its own build lane, queued behind the console — pre-prod "spend price basis" item points here). Dashboard interim: spend shown as derived (neurons × labelled list-rate), never the NULL cost_usd. ✎ CLOSED (live-proven) 2026-07-21 — F2 (UCCA-F2-COST-MINT-2026-07-21; engine 2699bac+253bfb8; live reasoner image db9280a3/version 8a2b67f8, account e5a98302): GLM-5.2 now priced by neurons ($0.011/1,000, Cloudflare-doc-verified) on both generation (course_generator._compute_cost_usd) and diagnosis (consumer._record_diagnosis_cost, previously all-NULL) paths — new rows carry cost_usd + pricing_source="workers_ai_neurons" + climbing cumulative_after_usd (proven: gen 6925e3bf=$0.0298, diag a844ee83=$0.0026). Historical NULL rows stay NULL (insert-only ledger) → the read-time derived view (Unit C of UCCA-CAPTURE-COST-LEDGER-01) remains the way to see historical dollars; that unit stays open. |
| L8 | ucca-input-path.jobs — status='failed' count (the admin Engine dashboard's loudest number, 25) |
The 25 failed jobs are entirely build/debug-era artefacts, not live production failures — decomposes exactly (11+6+5+3=25), all within 2026-07-03 15:12 → 2026-07-04 14:34 (the wedge saga + diagnosis Unit-4 build/proof window): QUEUE_WEDGE_CONTENTION×11 (instance-cap wedge, cured by slot-release ADR-0006) · JOB_STEP_RETRY_EXHAUSTED×6 (transient retry-exhaustion, [[fossil-ledger#L6]]) · STUCK_QUEUE_TIMEOUT×5 (detector sweep of jobs stranded during the wedge) · QUEUE_PURGED_CONSUMER_WEDGE×3 (queue purge during consumer-wedge remediation). How we know: live D1 GROUP BY failure_code with MIN/MAX(created_at), 2026-07-05. The 2026-07-05 00:03 traversal burst added zero failures. |
2026-07-05, at B-OPS-SUCCESSOR-01 Unit 3 mint (Tim: "the dashboard's loudest number must have a filed explanation") | Filed explanation — no work owed. A future Cognition/Engine view may band failures by era so the live-era rate (currently 0 since the wedge fix) reads distinct from the historical debug tail. Not a code task now. ✎ AMENDED 2026-07-31 ON A LIVE D1 READ — the count and the era claim have DRIFTED; the decomposition has NOT. status='failed' is now 26, not 25, and the era runs to 2026-07-21 03:05:21, not 2026-07-04 14:34. JOB_STEP_RETRY_EXHAUSTED is 7, not 6. The other three codes are unchanged at 11 · 5 · 3, and this row's 2026-07-05 statement was correct when made — six of the seven sit inside 3–4 July and the sixth completes at exactly the upper bound recorded above, which is why the window was right and is why it is amended rather than replaced. THE SEVENTH IS THE ONE THAT MATTERS: e61b41fa-18ca-4b2e-b22e-e7182385d274, created 2026-07-21 03:05:21, a generation job carrying client_id = rtopacks — seventeen days past the era, and it wrote its failure.json correctly, so the code path behaved. The clause above is therefore FALSE as written: the live-era rate is 1, not 0, and the engine's only live-era failure to date was on client-attributed work. That sentence is load-bearing for the engine-state crossing and is why this row was read before it was rewritten (Tim's ruling, UCCA-RULING-RECORD-2026-07-31 ruling 4(b)). Evidence and the three errors that led here: UCCA-CORRECTION-SILENT-RUNS-2026-07-31. Disposition changes from no work owed: a future era-banded view must now show a non-zero live-era rate. |
| L12 | Lost Time Machines (declared under R-TM-3, UCCA-CAPTURE-TM-LIFECYCLE-01) — (a) continuations 27th–30th; ~~(b) UCCA-TM-2026-07-10-A~~; (c) UCCA-TM-2026-07-06-B (general); (d) the true UCCA-TM-2026-07-07-A paste (S1-defect-cascade / polish TM). |
Superseded/owed, unfiled, uncited-as-anchor — declared lost with no recovery hunt (zero-cost loss). (a) 27th–30th: existence attested only by the 31st's supersede line (UCCA-TM-2026-07-08-A:3 "Supersedes the thirtieth continuation"); no bytes on disk, nothing filed cites them. ~~(b) 07-10-A~~ — ✎ STRUCK 2026-07-11 (mid-relay race): declared lost when the first ledger line was written (~00:19Z) because its bytes were not yet on disk; the amended handoff packet landed ~00:21Z (two minutes later) carrying 10-A — so the loss was true when written and false two minutes on. Now FILED at ground/UCCA-TM-2026-07-10-A.md (digest 103a1daba7c30c5041ef653bdd814c15d4d2c77ac9ab7496fd5734e5735f4408, RECEIPT-CHECK passed) — it files under its own doc_id, the -A letter for 07-10 having never been assigned elsewhere, which makes the UCCA-TM-2026-07-10-B parent citation resolve true. (c) 07-06-B general: its -TECH twin UCCA-TM-2026-07-06-B-TECH is filed; the general voice never was and no bytes surfaced. (d) true 07-07-A paste: a distinct document from the two filed 07-07 Downloads continuations (25th/26th) — UCCA-TM-2026-07-10-A's type line records receiving it in-session as a Tim paste, "authoritative on the S1 defect cascade and the polish unit"; not recovered at this relay. It is cited by UCCA-CAPTURE-QUALITY-GATE-01:79 (§4 RPL-capability) and by 10-A's succeeds: line — both currently mis-resolve to the file chronologically filed as -A (the 25th); a dated QUALITY-GATE amendment is owed to Tim (not made this window). How we know: Downloads + packet + ground/ live reads 2026-07-10/11; 10-A frontmatter attestation + Tim testimony; the (b) timestamps from the relay race. |
2026-07-11, UCCA-BRIEF-TM-RECOVERY-01 §5.3 (first application of R-TM-3; (b) struck + (d) added same day on the 10-A recovery race) |
Declared lost — no hunt, ever (R-TM-3). If (c) or (d) later surfaces it files under the next free letter for its date (true 07-07-A → UCCA-TM-2026-07-07-C, since -A/-B are taken by the 25th/26th); nothing already filed renames. (b) is discharged — filed. No follow-up owed beyond the QUALITY-GATE citation amendment Tim carries. |
| L11 | infra/ucca-infra/scripts/backup/{cf-backup,cf-restore,cf-verify}.sh — uncommitted working-tree diffs removing rtopacks-db from the UCCA-side backup rotation |
Migration-day orphan. All three files written 2026-04-09 04:21–04:22 EDT (mtime=ctime=birth, one editing session, the day after MIGRATE-02 2026-04-08); left uncommitted 92 days. HEAD versions still carry rtopacks-db (cf-backup 1714e5d 2026-03-26; cf-restore 4a8adaf, cf-verify 625ad65 2026-03-03). No stash, no session/handover note, no ~/.zsh_history reference. Sibling of [[fossil-ledger#L7]] (same 2026-04-09 migration, ucca-surfaces side) — but in the infra repo and NOT committed: this edit is the last, C-6-gated backup-removal step of the retirement, not a post-hoc capture. How we know: stat mtime/ctime/birth + git log/git show/git status + ~/.zsh_history grep, live 2026-07-10. |
2026-07-10, "resume" provenance read (Tim ruling: file the orphan, disposition below) | Dispositioned — working tree restored to HEAD; nothing committed to ucca-infra. Diff captured as annotated patch ground/UCCA-RETIREMENT-UNIT-BRIEF-01--backup-removal-candidate-2026-07-10.patch, attached to UCCA-RETIREMENT-UNIT-BRIEF-01 (§2 step 7, ucca-backup last) as candidate content — re-verify against HEAD before use. canon-register.md:198 status conformed (bytes cite RTOPACKS-RESPONSE clearance + FI-01); 2026-04-08 memory note replaced with a live-read pointer. Retirement execution stays gated on C-6 — this changes nothing there. |
| L10 | Three UCCA-repo worker sources — workers/{qual-enrichment,stats-cache,cricos-sync} — bound rto-nrt-db (1249760d), an RTOpacks-account (f95d4537) D1; the enrichment family was carried as platform-repo code |
Enrichment (RTO + JSA labour-market + qual coverage) is VET client-domain substrate wearing a platform-repo location. All three workers bound a fenced RTOpacks-account DB; none was deployed in the engine account; rto-nrt-db and the rtopacks-db copy (334ac8fb) are both absent from the engine account → they live in f95d4537. An initial "live gate-neutrality violation in the engine account" framing was a source-file existence claim, corrected on a live read — repo-level fossil, not a live violation. How we know: live CF D1 + worker API list of engine account e5a98302, 2026-07-05; Tim's RETIRED-FENCE ruling (TM-J §4). |
2026-07-05, enrichment fence-cleanup (Tim ruling + GO, UCCA-TM-2026-07-05-J §4) |
Resolved (in-house). Three source dirs deleted from HEAD (recoverable from git history; RTOpacks rebuilds on its own side if wanted — nothing crosses); ENRICH_SECRET retired (vault-commented + AUDIT-FINDINGS.txt struck); census row → RETIRED-FENCE; DB fence-dispositions filed (stop-binding, NOT delete — not ours; f95d4537 untouched); terraform plan keep-current no-op. Seam: ground/UCCA-B-OPS-SUCCESSOR-UNIT8-SEAM-01.md. |
Numbering note (2026-07-04): L5 (secrets-out-of-tree) landed via mint-pack Edit 6.1, sourced to TM-B §5. TM-B is now filed (
ground/UCCA-TM-2026-07-04-B.md, Edit 6.2 path A — Tim supplied the verbatim), so L5's provenance is a filed artefact, not a conversation. Gap closed.
Terraform fossils removed (TERRAFORM-RECONCILE 2026-07-04)¶
Declarations removed from infra/ucca-infra because their subject left the account or never existed —
noted here per the reconcile brief §2.1 (yellow-tape, not silent deletion; revivable from this row).
| # | What (Terraform declaration) | Why it left | How we know |
|---|---|---|---|
| TF1 | cloudflare_zone.rtopacks + 22 rtopacks_* DNS + 9 rtopacks_* zone-settings + cloudflare_d1_database.rtopacks_db + cloudflare_r2_bucket.rtopacks_media (+ outputs + zone_id_rtopacks var) |
RTOpacks residue: rtopacks.com.au left e5a98302 at the 2026-04-08 migration; the dead zone id errored terraform plan. rtopacks.com.au is a separate handover (RTOpacks house), not UCCA infra. |
bytes: plan 400 "Invalid zone identifier"; 34 stale state entries; forensic UCCA-FORENSIC-RETAINED-DBS-01 |
| TF2 | cloudflare_zone.ttca_edu_au (+ 12 DNS) |
Fossil zone — ttca.edu.au does not exist live; terraform would have created it on apply. Australia-side in any case. Ruling 2 (Tim, 2026-07-04): out of config. |
bytes: not in the account; plan showed "will be created" |
| TF3 | cloudflare_zone.ucca_edu_au (+ 11 DNS) |
Aspirational zone — ucca.edu.au does not exist live; terraform would have created it. Ruling 2: out of config. |
bytes: not in the account |
| TF4 | cloudflare_workers_kv_namespace.leads (LEADS) + kv_leads_id output |
Aspirational — no live LEADS namespace (account has reg-intel, MCP_API_KEYS, BACKUP_HEARTBEAT, UCCA_KEYS only). Mail/leads never set up. Removed per ruling ①, not created. | bytes: KV namespace list (live) |
Revival, if ever wanted, is authoring the declaration afresh from this row — never as a reconcile side
effect. f95d4537 was never touched.
Related (fictions — handled by the cull spec, not this ledger)¶
Marketing fictions with no artefact ("schema v2.4.1", "13,000 built") are corrected, not
stamped — fiction isn't history. They are handled by CANON-CULL-SPEC-2026-07-01.md, recorded here
only as a cross-reference so a future session doesn't mistake them for un-taped fossils.
Living ledger. Add a row whenever a UCCA-side claim is contradicted by bytes or testimony. Load-bearing finds escalate to Tim; the rest are two-minute stamps.