Skip to content

UCCA — Engine Live Brief

What this is. The ordered run from where the build sits tonight to an engine that is, by its own definition, operating in Cloudflare: core wired → golden tests → deploy → proof job → two ADRs mint. Every step's mechanics already live in a frozen spec; this brief only sequences them and defines where it is safe to stop.

0. State check first (Alex reports before anything runs)

Position against the TM's two open core items — do not assume zero, do not assume done: 1. Engine-call wiring through the reasoner — status? 2. Envelope crypto (ENVELOPE-ASSEMBLY-SPEC §6; reuse /ns/ucco/v1 + keys worker) — status? 3. Has golden test §8.1 run at all, and if so, what mapping gaps did it surface? (The TM expected it to surface some — those gaps are work items, not failures.)

The answers set the entry point into §1. Report position, then proceed without waiting unless a contradiction with the specs surfaces.

1. The run (strict order — each step gates the next)

  1. Engine-call wiring through the reasoner. Per spec; direct-wire LLM adapter; no AI Gateway (ADR-0004's explicit exclusion — provenance needs unmediated calls).
  2. Envelope crypto — reuse /ns/ucco/v1 + keys worker per ENVELOPE-ASSEMBLY-SPEC §6. Strict order stands: assemble → validate → hash → sign → store. Signing last, attests provenance only.
  3. Golden §8.1 — assembler unit against the CHCPRT025 bundle. Expected to surface mapping gaps; fix forward against the frozen bytes. The generation-minted-ID tripwire (JOB_ENVELOPE_ASSEMBLY_ERROR on runs lacking them) must fire when fed a bad run — verify the tripwire trips, not just that good input passes.
  4. Golden §8.2 — spine integration, engine core stubbed. Gate → Queue → Container → D1 → R2 round-trips; 5-state job rows behave; gate rejects are not jobs.
  5. Golden §8.3 — live run on GLM-5.2. Verify by bytes: cost ledger rows written (insert-only, ABORT triggers intact) AND {run}/ai/trace_records.jsonl populated. A live run that produces no trace records is a FAIL even if output looks right — trace-by-construction is the property being proven.
  6. Deploy — gate worker, consumer, container. Only now. Deploy → verify healthy → smoke-check the gate rejects a malformed submission with a structural why.
  7. The proof job — one real job through the deployed spine, end to end, envelope whole-and-signed in R2.
  8. Mint. ADR-0002 and ADR-0004 flip ruled → minted, same event; canon register updated; the mint is dated to the proof job, not to this brief.

2. Gates that do not move tonight (the clock changes nothing)

  • Nothing non-functional deploys. Step 6 does not start unless §8.1–8.3 are green.
  • Envelope atomic: whole and signed, or failed + wreckage to diagnostics (keep, don't ship). No "mostly assembled" artefact exists.
  • Partial failure is failure. Gate rejects are not jobs. Job rows are permanent.
  • Two-lens error codes — material and engine state, never persons, never verdicts.
  • Account pin: e5a98302 confirmed before every command; f95d4537 never touched.
  • If a spec and this brief disagree, the spec wins and this brief is corrected.

3. Clock protocol (the part written for tonight specifically)

The session window is a hard external constraint. The protocol:

  • Safe stopping points are the step boundaries of §1. Stopping between steps is clean; stopping inside a step leaves an ambiguous position.
  • Step 6 (deploy) has an entry condition beyond green tests: enough remaining headroom to deploy AND verify health AND, if needed, roll back. If the window cannot fit all three, do not start the deploy. An undeployed green engine is a perfect overnight state; a half-verified deploy is tomorrow's first fire.
  • On any stop, Alex leaves a position note — five lines: last completed step, exact next action, any red test with its output pointer, anything half-done, HEAD SHAs. Filed beside the specs. Tomorrow starts warm regardless of where tonight ends.
  • The mint (step 8) can lag the proof job. If the proof job lands with minutes left, the paperwork flips tomorrow — dated to the proof job. Do not rush ADR edits; the register has had enough memory-born fictions this week.

Definitions of done tonight: - Full win: proof job through the deployed spine; mint paperwork tonight or tomorrow. - Good night: §8.1–8.3 green, deploy verified healthy, proof job first thing tomorrow. - Floor (still a win): core wired, §8.1–8.2 green, undeployed, position note filed. Anything at floor or above means tomorrow's window starts at productive work, not reconstruction.

4. Finding — ops.ucca.online (logged tonight, actioned in the cleanup lane)

The ops-v2 admin panel at ops.ucca.online is discovered still fully operational. One action tonight, off the critical path: - Verify Cloudflare Access sits in front of it (the docs sites are behind Access; confirm the ops panel is too). If it is exposed unauthenticated, that is tonight's only permitted interruption to §1: put Access in front of it, then resume. - Everything else about it (its rtopacks-db binding, its RTOpacks world code) is already owned by UCCA-RTOPACKS-CLEANUP-BRIEF-01 items 4.1 and 4.7 — add a line to that brief's item 4.1 noting the panel is live, so the audit treats it as a live surface, not a dormant config.

5. What closes this brief

The proof job's envelope in R2, whole and signed, plus the mint paperwork (whenever dated). On close: TM discipline — the next Time Machine records the engine as operating, and this brief flips DRAFT → EXECUTED with a pointer to the proof job's run bundle.

Sequence brief. The route was already true in the TM; this pins the order, the gates the clock cannot move, and the three grades of "done tonight" so the window closing anywhere still leaves a warm start. The engine gets to alive by passing its own tests — tonight if the window allows, tomorrow morning if it doesn't.