Skip to content

Engine Live — Position Note

✅ THE ENGINE IS OFF DISK (2026-07-03)

Proof job 0dda7509-595f-414f-b727-82c12bfea3ce ran gate→engine→signed-envelope to terminal on the deployed Cloudflare spine. ADR-0002 (remedy) and ADR-0004 MINTED. Deployed to e5a98302: ucca-gate 7afd429c, ucca-reasoner container df946c75, ucca-keys 61aa8427. Whole signed UCCO envelope in R2 (RSA-PSS-SHA256, attests provenance-only); cost ledger rows written (insert-only); GLM-5.2 via the AI binding. Deploy note + infra deltas: [[UCCA-DEPLOY-NOTE-SPINE-01]]. Follow-ups (provenance refinements, not integrity): cost-ledger model field records the generator default not the actual GLM; neurons not captured (tokens are: 2104 in / 3265 out); physical worlds/ dir deletion (runtime already severed).

History below — the path to live.

Stopped at the container-push boundary — one blocker, and it needed Tim: the UCCA deploy token lacked the Containers permission (added; done). Everything up to the push was done and verified.

  1. Last completed (ORDER-02): §0 Phase-6 request filed verbatim (canon/sent/, filed-not- crossed) · §1 pre-deploy — Docker started; the wrangler OAuth default is the RTOpacks account f95d4537, safe path = the vault UCCA token (verified → e5a98302) · keys worker REDEPLOYED to e5a98302 (version 61aa8427, carries the /v1/sign content_hash change) + account-pinned · gate worker config validated (dry-run) · reasoner container IMAGE BUILDS clean (fa8f8f09, context fixed via image_build_context=.. + .dockerignore, all deps install). Prior windows: Steps 1 & 2 DONE/green, golden §8.1 green on real bytes, ADR-0005 minted (envelope drift finding closed).
  2. THE BLOCKER (needs Tim): the container push fails 403 at /accounts/e5a98302…/containers/me — the UCCA deploy token (in .credentials/cloudflare.env) has Workers Scripts: Edit (keys+gate deploy fine) but not the Containers permission. Add Account → Containers: Edit (a.k.a. Workers Containers/Images) to the ucca-deploy token, or issue a token with it. Cannot proceed without it; cannot mint/modify tokens myself (credential rule).
  3. Exact next action (once the token is fixed): push the reasoner container → deploy gate Worker → wrangler secret put UCCA_SIGN_SECRET --name ucca-reasoner (from engine.env) → §8.2 round-trip → §8.3 live GLM (first neuron spend — note the number) → proof job → mint ADR-0002 + ADR-0004 (ADR-0002 mint language cites ADR-0005). All wrangler cmds MUST source the vault token (never the OAuth default = RTOpacks).
  4. Red tests / output: none. The image builds; the push is a permissions 403, not a code fault.
  5. HEAD SHAs: ucca-engine b025820 · ucca-docs <this commit>. Deployed this window: ucca-keys 61aa8427 (e5a98302). Declared-not-pushed: ucca-reasoner (Worker uploaded, container image fa8f8f09 built but not pushed), gate Worker. Provisioned: D1 ucca-input-path, R2 ucca-artefacts, Queue ucca-jobs.

Grade (ORDER-02): below Floor for the off-disk goal — Floor wanted §8.2 green, which is behind the container push. But Phase-6 is filed, keys is redeployed+verified-deployable, the container proves it builds, and the ONLY remaining gate to "off disk" is a one-line token-scope change. Nothing minted (no proof job). Account e5a98302 throughout, f95d4537 never touched, fence quiet.