Track accepted E1 post-release security hardening (F1–F7)

[eamirian]

E1 passed for the exact v0.3.0 artifact set after an independent Claude Fable 5 review and release-owner countersignature. This issue tracks the accepted low/informational residuals; it does not reopen the E1 release gate unless a containment condition fails.

Evidence:

• Independent review: Release governed cognition 0.3.0 candidate #44 (comment)
• Release-owner countersignature: Release governed cognition 0.3.0 candidate #44 (comment)
• Release: https://github.com/augmented-cognition-engine/core/releases/tag/v0.3.0

Follow-up checklist

• F1 (completed in merged Core main 7013de62ae7320c51c3de9e9a03b049e768e4d84): add an in-transaction generation guard or real-database concurrency test; reconcile proposal state from receipts.
• F2 (2026-11-05): add direct observability for failed selection/use receipt persistence.
• F3 (re-dated to 2026-11-05 by the 0.6 release-owner disposition below): add trusted registration ceilings and explicit partial-registration rollback/reporting.
• F4 (next security bundle): embed the executed restart e2e receipt or immutable CI run identity in the bundle.
• F5 (completed in merged Core main 7013de62ae7320c51c3de9e9a03b049e768e4d84): pin the legacy optimizer query to self_optimizer_proposal.
• F6 (2026-11-05): retain strict owner-credential isolation and evaluate per-reviewer/step-up identity.
• F7 (before production traffic): enforce or operationally verify at least 32 bytes of JWT signing entropy.

Containment

The v169 activation-generation unique index, task-projected receipts, trusted-extension-only boundary, retained CI/deployment receipts, credential isolation, and setup-generated high-entropy JWT secret remain the accepted containment controls. Any release artifact change requires a fresh registry-to-matrix comparison.

F3 0.6 disposition — 2026-08-11

F3 is explicitly re-dated to 2026-11-05; it is not waived or resolved. ACE 0.6 does not expand the supported extension surface. Until the bounded atomic-registration packet lands, containment remains: trusted installed packages only, the ACE_DISABLE_EXTENSIONS=1 kill switch, the compatibility matrix, and operator disablement if unexpected partial registration is observed. The follow-up must stage every mutable registration surface, enforce ceilings, publish or roll back atomically, and emit a bounded failure report.

[eamirian]

ACE 0.6 merge-candidate audit: #92

The audit binds the direct-to-live-main World integration candidate
(augmented-cognition-engine/domain-world-intelligence#17), exact artifact
receipts, current code paths, and bounded choices for the three “next minor” items.

Recommended release-owner disposition:

• F1: implement before 0.6 closeout — add an in-transaction generation guard or two-connection
  real-DB concurrency proof plus exact receipt/head/proposal reconciliation.
• F3: explicitly re-date to 2026-11-05 unless 0.6 expands the extension surface — retain
  trusted-package-only scope, ACE_DISABLE_EXTENSIONS=1, compatibility checks, and
  disable-on-unexpected-partial-state containment. The full fix should stage all registrations and
  publish or roll back atomically with ceilings/reporting.
• F5: implement before 0.6 closeout — pin both load and projection to
  type::record('self_optimizer_proposal', $record_key) and add same-product foreign-table negative
  controls.

This comment does not waive, defer, resolve, re-date, or check off any item. F1, F3, and F5
remain open 0.6 release gates until the authenticated release owner records the decision and the
selected packets or containment evidence pass.

[eamirian]

0.6 follow-up: draft PR #93 implements bounded candidates for F1 and F5 over the Measured Intelligence merge-candidate audit.

• F1: proposal state and head generation are rechecked inside the durable transaction; ambiguous writes reconcile only from the exact review/proposal/revision/head; a forced two-connection real-SurrealDB race has one winner and zero losing partial state.
• F5: deprecated self-optimizer reads and projections are pinned to self_optimizer_proposal; foreign and malformed record coordinates fail before database access.
• Evidence: 102 focused tests, 2 disposable real-database tests, 7,470 locked-lane tests plus the 7-case ordinary-clone baseline, and boundary/local-host controls are green.

F1 and F5 remain unchecked until reviewed and merged. F3 is unchanged by PR #93 and still needs an explicit authenticated owner disposition; this comment does not waive, resolve, or re-date it.