FLOW-08 — catalog-backed background workflow release

Date: 2026-09-23. Parent ae03b6f5-8495-413e-931c-b6bff044dfdf; release 58ead387-f58a-49a3-9a08-355f6460c510.

Result and responsibility boundary

The selected FLOW-08 scope is implemented, merged, installed and exercised through public production HTTPS on the ordinary enrolled Mac node. It connects versioned catalog definitions and pinned Git instructions to background pickup, native provider execution, independent verification, correction and server-owned acceptance. The test does not seed a separate Bridge identity or transport token and does not manually launch workflow or execute.

The server chooses only the explicitly selected profiles, freezes the contract, assigns attempts and owns lifecycle/acceptance. Bridge enforces local permissions and budgets, supervises native processes and transports evidence. Agents perform implementation and verification. Tests and release publication remain separate quality/operations activities; task acceptance itself never implies a Git push, merge or deployment.

Released revisions

Component	Exact revision / evidence
Production server	a2b0a6cef86e7b65be5a141f38f1c96f3173fc49, PR 28
Bridge background integration	d053faafc7cff6c382f3f5f51374f8c25a6b6901, PR 4
Final installed Bridge source	bc13310379d95b6539fa1a179b0cf23dde4e56ff
Keychain hotfix merge	eabee78f452858c547f407aaf47d4169a2250753, PR 5
Installed CLI SHA256	65bdfb4d048dcbce5d5428901a9a8b6fc669bcc439e5d936a7763996435e32eb

Server identity matches the expected resource https://mcp.heyaira.eu/mcp, instance heyaira-prod-f72d308011034fb3b50f32ff49c57fd5, and project 75573220-a2eb-4b99-aab2-71cade5ae03e. Deployment used an immutable standalone checkout, the existing app Compose project and mandatory OpenBao overlay. OpenBao was unsealed after recreation; the backup/runtime monitor returned healthy with no alerts. Previous server release and Mac package are retained for rollback. The Mac package is locally ad-hoc signed, not notarized.

Production acceptance on the final installed package

Synthetic task eff9289a-6c0f-4bf3-8d9f-6b662d96d460, temporary project and catalog were deleted after validation. The normal enrollment identity was 736f0746-b4eb-4620-a9b2-3a10b1c64e94; its local display/node ID is ac7598cf-dceb-455c-aee4-17ca06a74b7e. These IDs are not interchangeable.

Actual result from scripts/production_catalog_background_canary.py:

• Public MCP provisioned active roles, a skill and pinned agent versions; dispatch resolved five actual Git documents at the released server commit.
• Background daemon picked up the task with its own current Keychain credential.
• Codex gpt-5.6-luna submitted deliberate answer 41 with failing test evidence; a fresh Claude sonnet verifier rejected it. A fresh Codex session committed answer 42; a fresh Claude session accepted the unchanged test and evidence.
• Four distinct native sessions, two agent commits, one acceptance receipt, five total work receipts, clean Git and unchanged independent test. Final independent output: PASS answer=42.
• Four persisted reservations consumed the four-attempt budget. Restarting the normal LaunchAgent while authorization remained enabled and exhausted produced zero additional attempts or receipts. Exactly one app and one daemon remained.
• Complete elapsed time 151.45 seconds. Thirteen foreground project reads during execution ranged from 0.124 to 0.350 seconds.
• The first successful run before the Keychain hotfix also passed in 151.91 seconds; its foreground reads ranged from 0.093 to 0.167 seconds. That earlier result is supporting evidence, not a replacement for final-package acceptance.

Work Center was inspected through the actual installed macOS UI: the synthetic task showed worker/verifier identity versions, native sessions, candidate commit, criteria and the complete 19-event history including rejection, correction and acceptance. Task details are an on-demand server snapshot. The custom workflow journal is not automatically part of the legacy local Sessions list.

Failures discovered and resolved or bounded

1. Initial harness OAuth scopes omitted memory:read, required by server_identity. Both attempts stopped before dispatch and cleaned their exact synthetic projects. The harness now requests the scope and preserves synthetic local artifacts on future failures.
2. CI exposed a file-lock race when concurrent child creation retained a duplicate descriptor. Explicit unlock in the lock guard and a duplicate-descriptor regression test fixed it. A subsequent bounded-HTTP compile error was fixed before the green merge and installation; no failed build was deployed.
3. The ordinary node had an expired transport token after earlier network errors. Supported operator recovery and rotation restored it. Its bootstrap allowlist contained only codex-primary, while actual authenticated profiles were default. An explicit, narrowly asserted operator change added default without removing existing permissions (HeyAira decision 5ef23735).
4. Actual installed stack sampling found a native Keychain read waiting inside SecKeychainFindGenericPassword while holding the credential lifecycle lock. The hotfix makes ordinary commands noninteractive and adds a read-only explicit user authorization command. Denied foreground access returned in 0.017 s rather than hanging for more than 25 seconds. The user approved macOS dialogs; token authorize-keychain then returned success. No ACL bypass, credential deletion or loss of pending rotation evidence occurred.
5. A final-package attempt was interrupted by physical clamshell sleep at 15:13:02 Europe/Warsaw; the Mac fully woke at 15:22:59. Server lease expiry blocked the task without acceptance or replay. This is observed safe interruption evidence, not a successful workflow run. The subsequent awake final-package run is the successful result above.
6. Normal daemon logs show automatic token renewal after authorization; token expiry advanced from 13:27:44 to 13:38:14 UTC without a manual rotate command.

Validation and remaining boundaries

Complete local PostgreSQL/MCP suite: 294 passed, zero skipped tests (latest 23.62 seconds). Generated MCP contract, 25-tool documentation contract and runtime checks passed; website consent tests: 12 passed. Final Bridge: 102 Rust tests passed, rustfmt and clippy with warnings denied, plus full macOS CI including Swift warnings-as-errors typecheck and Work Center regressions. All three implementation PRs were green before merging.

The separate real ChatGPT/Claude continuity task is complete. Its report qualifies model self-attribution and the coordinator's administrative closure after the Claude CLI task-update failure; it does not pretend that write succeeded. See live-client evidence.

This release is awake-Mac, one explicitly registered local policy per node and finite authorized attempts. Hardware wake remains owner-deferred. Catalog writes require explicit OAuth scope, project administration and an account editor grant; existing connectors are not silently granted broader permissions. Local ad-hoc binary updates can require a new macOS Keychain approval. Server phase reads in Work Center are refreshed on demand. Unrelated historical backlog is not included in this completion claim.

The synthetic authorization was disabled after acceptance. No arbitrary project was left enabled for background execution. See the operator guide for normal setup and recovery.

Final installed performance snapshot

After the final canary and restart, a 30.01-second idle sample measured app CPU 0.033% (96.48 MiB RSS) and daemon CPU 0.133% (15.23 MiB RSS). These are parent-process CPU deltas; transient diagnostic children are excluded, so this is not a claim about total machine or provider CPU usage.

Installed command	Elapsed	Exit
doctor	0.667 s	0
work-center projects	0.142 s	0
project-scoped work-center snapshot	0.572 s	0
heartbeat run --once	0.304 s	0
token status	0.026 s	0

Both idle processes remained stable across the sample. The post-restart daemon also logged proactive renewal. These measurements establish responsiveness for this installed configuration and test workload, not a long-duration load SLA.