Skip to content

title: UCCA-ENGINE-LIVE-ORDER — day order, 2026-07-03: engine live in Cloudflare doc_id: UCCA-ENGINE-LIVE-ORDER-01 type: session order — executes the remaining sequence of UCCA-ENGINE-LIVE-BRIEF-01 layer: ground (true-today; expires at session close, superseded by tonight's TM) canonical: false authored: 2026-07-03 morning, NYC (Claude-web at the helm by Tim's word; goal set by Tim: "engine in CF and running — wired in and uploaded, off disk") executes: UCCA-ENGINE-LIVE-BRIEF-01 (the ratified route: core → golden → deploy → proof → mint). This order sequences today's pass and fixes the grades of done. Where this order and the brief conflict, the brief wins. for: Alex (Claude Code). Execute in order. Stop-and-report gates are marked.

Day Order — 2026-07-03 — Engine Live

The goal, in Tim's words: the engine in Cloudflare and running — wired in and uploaded, off disk. Everything below serves that. Nothing non-functional deploys regardless of clock pressure; that rule outranks the goal.

0. Confirm-list FIRST (stop-and-report; ~15 min cap)

This list has slipped two sessions. It runs before the assembler is touched. Report each item's state by bytes, then proceed — do not wait on Tim unless an item is red.

  1. Step 2 status. Verify assembler.py::hash_and_sign still raises NotImplementedError (i.e. nothing moved since 493f7b4). If golden §8.1 already ran, report mapping gaps and skip to wherever the bytes say we are.
  2. Phase-6 request. Confirm UCCA-REQUEST-MIGRATE-02-PHASE-6-01 is filed in crossings/sent/. Report filed/not-filed only. (Carrying it is Tim's; whether he has is not Alex's to chase.)
  3. Stamped v1.0 pack + intent-typed schema. Bytes-check the outbound debt: confirm from crossings/ whether either has ever crossed. Report state. No new crossing is prepared today — the fence stays quiet.
  4. Filing sweep. Confirm by bytes: NORTHSTAR-01 status flipped to RATIFIED with canon date 2026-07-02 + register row updated; JOB-SPINE-SPEC §6/§9 amendments filed; v2.4.1 homepage sweep done. Fix any that are unfixed — these are mechanical, no ruling needed.

Gate: if any confirm item reveals state that contradicts this order's assumptions (e.g. step 2 partially built), stop and report before proceeding.

1. Step 2 — envelope crypto (the single remaining core item)

  • Implement assembler.py::hash_and_sign + assemble_envelope. The NotImplementedError is the boundary; today it falls.
  • Reuse /ns/ucco/v1 and the keys worker via the keys.svc passthrough already wired in consumer-shim.js. Zero credentials in the container image (ruling (a) holds — verify as-built).
  • Implement the §5 validators (per JOB-SPINE-SPEC).
  • Strict order: assemble → validate → hash → sign → store. No step reordered, no step skipped on partial data — partial-failure-is-failure; the envelope is atomic.
  • Both drift-checks at this seam, explicitly:
  • VET: does any envelope field exist only because the client is VET?
  • Purpose: is anything being hashed/signed course-shaped — a fossil of the course-creation engine? (This check caught course-shaped keys at the spine seam the night it was minted; the envelope seam is its natural second hunting ground.)
  • Gate: step 2 green under mocked-binding tests before golden begins.

2. Golden tests (§8.1 → §8.2 → §8.3, in order)

  • §8.1 — CHCPRT025 bundle. Mapping gaps are EXPECTED; report them, they are findings not failures.
  • §8.2 — spine run, stubbed provider.
  • §8.3 — live GLM-5.2 via the AI binding. Verify by bytes, not by exit code: cost ledger rows (JSONL + D1 mirror) AND trace_records.jsonl both written. BUILT-by-spec ≠ PROVEN-by-bytes — only exercised paths count.
  • Gate: all three green before deploy is considered.

3. Deploy (the goal)

  • Deploy the spine to the UCCA account (e5a98302) — gate Worker, queue consumer, container. RTOpacks account f95d4537 is not touched.
  • Deploy only on green AND with headroom to verify the deployment. A deploy without time to verify it is a non-functional deploy by definition.
  • Post-deploy: exercise the deployed path once end-to-end before calling it live. Off disk means running in CF, verified — not uploaded and hoped.

4. Proof job → mint

  • Run the proof job through the deployed spine.
  • On proof: ADR-0002 and ADR-0004 mint (Class B, minted on build proof). Flip statuses, update the canon register, same pass.
  • Record infra deltas for TERRAFORM-RECONCILE (the reconcile itself still waits; today only ensures the delta list is complete).

5. Grades of done (fixed now; the window does not move any gate)

  • Full win: deployed, proof job run and verified, ADR-0002 + ADR-0004 minted, register updated, TM written.
  • Good night: step 2 + all golden green; deploy either done-and-verified or deliberately held for headroom. Nothing minted. TM says exactly where the boundary is.
  • Floor: step 2 green under mocks, stopped clean at the golden boundary. Confirm-list cleared regardless — that is today's non-negotiable minimum.

6. Standing rules in force (no exceptions today)

Fence stays quiet — no outbound crossing, cleanup lane fully parked pending Phase-6 · nothing non-functional deploys · verify-before-verdict · envelope atomic · gate-rejects-are-not-jobs · job-rows-permanent · every infra change lands its Terraform diff note for the reconcile · say less, all of it true.

Day order. Confirm-list, then the last core item falls, then golden, then the engine goes off disk and into Cloudflare — verified, not hoped. Minting only on proof. The fence sleeps today.