The job rail: one spine, three hosts, and the fortnight that built it

Disposition: live. Human’s 2026-09-05 reading that the pipeline was nearly done remains part of its history. Subsequent work improved review, landing checks and the Codex route; it did not certify the entire lifecycle. Observed: 2026-09-07. This refresh reads the store and committed source at 86902d70d8d4f6125d67bd058365396f626ad6f3, plus verified PATCH-354’s exact repair at 761a242e432f0ae8bccc3471f40aade17028415e; it launches no provider job. Span: the 2026-08-28 to 09-05 construction, with the material review, landing and lifecycle developments through 09-07.

The question this account answers

How does one bounded piece of work travel from REQ to main, and what does each successful stage actually establish?

house/THE_PIPELINE.md is the drawing. Its dated verification sections remain dated evidence, and its later corrections matter. This account joins that drawing, the native-child rail, the role testimony, and the named work records so the next holder can recover the frontier without reading the whole fortnight. SQLite owns lifecycle and review; Git owns exact source.

Where the work stands

The spine can make a candidate, submit that candidate to independent Eyes and record the result. Moving an accepted candidate onto main still requires the holder’s integration work. Preserving a native session and returning attention to the actual creator are further claims with their own evidence.

REQ-358’s deferral does not release REQ-375 or REQ-376. Their dependency on it is now recorded in the store. FIND-1574 explains why the prototype board can omit that deferred prerequisite; absence from its blocked list is not readiness.

Why the rail changed

The first construction joined four changes that otherwise look like unrelated patches.

Transport became host-specific behind shared ingress. The native-child rail preserved the Codex and Grok protocol canaries; the Claude route added its stream-json seam while retaining the established CLI lane. A provider’s bundle and actual receipt identify which route ran. A schema or a supported adapter name alone does not prove a live job.

REQ and PATCH acquired shared lifecycle machinery. REQ-374 first copied the REQ lifecycle into a PATCH path. FIND-1251 exposed the duplication; FIND-1252 preserved Human’s correction: Hands and Eyes are the making and reviewing halves, with goblin and imp as PATCH profiles. PROP-274 became REQ-400; REQ-401 separated dispatch authority. REQ-444 later placed start/end lifecycle composition in tools/corpus_ops_v1/domains/shop/job.py. The dispatcher remains in tools/corpus_ops_v1/domains/shop/job_dispatch.py. The existence of that shared path does not mean every ordinary Troll goblin/imp used it; FIND-1346 records an early passage and its manual friction.

Candidate identity stopped depending on physical disk bytes. FIND-1398 and FIND-1406 separated Git identity, overlay state and line endings. A pristine checkout had failed to reproduce REQ-371’s earlier digest identity. The current model names a commit and tree and checks the overlay. Prepare, pre-launch and post-return reads on Claude Eyes catch different opportunities for change (REQ-413, FIND-1429). Git clean filtering can normalize a blob while physical CRLF remains a separate worktree-hygiene issue.

The worker’s packet began to describe the bench it actually receives. The 09-04 testimony led to REQ-410’s correct card names, REQ-411’s truthful return contract and REQ-412’s visible wall and other standing facts. Human’s four-card recut is preserved at 85c801d; FIND-1458 holds the drafts. REQ-448 carries the bound contract text into the brief without widening Claude Eyes’ shell. This answers the reviewer who could see a done-line but could not fetch its REQ.

What the provider proofs establish

The earlier live pins remain useful: Codex REQ-398, Grok REQ-416 with TRACE-1439 and TRACE-1440, and Claude’s REQ-411/412 passages in FIND-1427. They are observations of those jobs, not a standing certification of all hosts.

Codex. The native table binds the Hands product schema and Eyes verdict schema and records spawn/model witnesses. REQ-451 provides a newer ordinary MCP specimen: Hands TRACE-1618, Eyes TRACE-1619 and retained diagnostic candidate a7b7897c8c0da6c10275dbd4611f7bf7ecd703d4. It was fulfilled as a diagnostic; its preserved candidate was not installed as a permanent production test.

FIND-1581 clears the popup hold for the tested runtime and route. Its saved measurements and lifecycle audit should be read before another canary. The passive observer did not measure every possible flash or focus change, and Eyes reviewed the candidate, not that external observer. FIND-1584 found native IDs in receipts but absent from the canonical execution pointers; both ends used skip_session_import=true, and the ephemeral native threads had no recoverable rollout. The compact end reply also omitted archive outcome. PATCH-354 is now independently verified at 761a242 (Imp TRACE-1625): new Codex jobs bind validated native identity through the shared binder, and compact end replies expose bounded session_import status/reason. That local repair does not change the historical smoke records, create a rollout for an ephemeral thread, or establish automatic creator wake.

Claude. The current Hands builder has no product schema. The legacy return classifier distinguishes process failure and Claude Eyes protocol failure, but can still return process_success for a non-Eyes return without validating a Hands product. REQ-411 removed the false promise that it would validate one. Architect’s MSG-2680 declined a general Hands schema under Human’s no-general- Hands-return-store ruling; it left the empty-success residue for Troll. The 09-05 edition’s recommendation to copy Codex’s schema onto both other lanes was therefore not current direction and is withdrawn from this account.

Claude Eyes has a structured verdict, bounded shell and candidate checks. REQ-439 moved its current bundle from version 4 to 6 and removed --no-session-persistence; legacy argv remains available. That is a source change permitting capture. Its fulfillment note explicitly left the first post-landing archive witness to a later Eyes dispatch. This account does not turn that note into an observed archive result.

Grok. ACP completion is classified by grok_job.classify_native_outcome; its success class is protocol_success, not the legacy classifier’s process_success. It does not validate a Hands product schema. Grok Eyes has a four-field return plus required-read evidence (REQ-430/432). FIND-1470 and FIND-1472 show why fixing the schema or required-path list alone was not proof of a substantive review. REQ-416’s recorded PASS still carries FIND-1473’s specific limit: the native witness binds a session ID but no first-turn model, and the host-observed model differed from the advertised slug kept in the TRACE. The current callback still provides no model witness; this is not a claim that REQ-416 is unfulfilled.

Completion has several gates

REQ-427 made dispatch return a running handle while a Corpus supervisor waits. REQ-414 replaced stale imported MCP code with a fresh interpreter per job call; REQ-407 supplied explicit reconciliation of stranded reservations. Those are useful deliveries even though a running handle cannot establish that its supervisor will outlive every caller.

FIND-1464’s Grok CLI specimen died after Windows refused breakaway. The current _popen_supervisor still retries without that flag and records the result. FIND-1468 corrects the proposed workaround: a TUI launcher is permissible, but a holder-side polling wrapper that must stay alive is not evidence that Corpus owns the wait. This refresh found no closure of that specific lifetime gap.

FIND-1415 records a child killing its controller. The packet warning and longer wall reduced the immediate pressure; they did not establish containment. The later bounded-capture and cleanup work described in FIND-1562 likewise does not prove that every descendant is fenced or reaped. No destructive replay is needed to preserve that limit.

The seal’s tests answer a narrower question than Eyes’ contract judgment. FIND-1537 records a walled REQ-337 tree whose declared tests passed although contract work remained; the holder closed it degraded, so no candidate was sealed. REQ-448 makes the contract available, and REQ-449 adds a reachability check. Neither turns a green subset of tests into completion of the whole ask.

Landing is the remaining integration boundary

FIND-1525 preserves the Human-directed deferral of REQ-358 revision 9: its designated canary was already spent, implementation paths had moved, and the three-lane bootstrap had never become a supported landing mouth. The need for guarded integration survived that contract.

REQ-449’s accepted landing at 83c95cb demonstrates the current route: a reviewed candidate was cherry-picked and tested on the resulting main tree. PROP-312 proposes a smaller operation for an already-reviewed REQ candidate whose parent is current main, with recoverable intent, guarded advancement and a receipt before fulfillment. It deliberately excludes constructing a fresh candidate, PATCH and standing-office landing. Its predecessor REQ-449 is now fulfilled; PROP-312 remains open. PROP-315 separately proposes binding one host policy revision across consumers. Neither proposal is delivered infrastructure.

Outcome, scope and next reading

What survives is a usable, inspectable chain of candidate creation and review, with live proofs whose limits can be recovered. The durable lesson is to keep transport completion, product validation, contract acceptance, integration, archival and creator attention distinguishable. Success at one gate is useful without being evidence for all the others.

Membership is explicit in entry.json: the original construction and the named changes that alter this account’s frontier. The mailbox replacement, office sweeps, general store decomposition and standalone encoding work keep their own accounts. The 09-05 version and its aggregate queue counts remain in Git; this entry is not a replacement work board.

Reopen when guarded landing or the shared host declaration is enacted or disposed of; when the recorded REQ-358 dependency boundary changes; when PATCH-354’s evidence moves; or when a new witness changes the unvalidated-return, supervisor-lifetime, Grok-model, archival, containment or creator-return reading. Use story first, then read the exact changed source and receipt. Refresh the account when the meaning moves, not for every job arrival. A new holder alone does not justify repeating the Codex smoke.