Chris0Jeky · Chris0Jeky · Jul 31, 2026 · Jul 31, 2026
diff --git a/docs/IMPLEMENTATION_MASTERPLAN.md b/docs/IMPLEMENTATION_MASTERPLAN.md
@@ -1,6 +1,6 @@
 # Taskdeck Implementation Masterplan
 
-Last Updated: 2026-07-27
+Last Updated: 2026-07-31
 <br>
 Planning Horizon: the revival waves in `docs/REVIVAL_PLAN.md` (truth + safety → transcript engine → open-beta launch → generalist expansion [Phase 4, ADR-0046 Accepted]), then a maintainer checkpoint on beta traction — _(historical: 2026-06-13→2026-07-10 this was the finite archive-pivot waves; before that an open "Next 8 to 12 weeks" release horizon)_
 Companion Active Docs:
@@ -10,10 +10,10 @@ Companion Active Docs:
 - `docs/MANUAL_TEST_CHECKLIST.md`
 - `docs/GOLDEN_PRINCIPLES.md`
 
-## Active delivery checkpoint (2026-07-27, proxy-safe direct egress)
+## Delivery update (2026-07-27, proxy-safe direct egress)
 
-- **`#1513` local review-fix implementation:** the registered OpenAI, Gemini, Ollama, and outbound-webhook handlers set `UseProxy = false`, keeping the configured origin as the connect-time validation target. Just before send, protected registrations mask the URI seen by outer .NET HTTP diagnostics; the inner handler restores the real URI for transport and re-masks it for retry/completion. Public caller-owned provider clients keep normal `HttpClient` behavior. The four protected clients remove default request loggers, disable distributed-trace header propagation, and use a private HTTP metric scope; Taskdeck's configured OpenTelemetry provider drops their marked activities and scope. Enabled Sentry removes its outbound factory handler only from these four client pipelines, so unrelated clients retain instrumentation and server-side exception tracking remains active. The proven boundary includes pre-handler `System.Net.Http` EventSource path/query suppression, but excludes independently installed process-global activity/meter listeners and transport-stage host/IP observers. Existing localhost opt-ins and automatic-redirect blocking remain unchanged. No proxy-aware outbound mode exists; corporate proxy-only deployments fail closed.
-- **Current evidence boundary:** the exact documented filters pass 66/66 API and 158/158 Application tests (151 provider/policy compatibility plus seven constructor/remasking controls); registered EventSource and scoped-Sentry controls pass three fresh-process repetitions. At pre-documentation head `dad8d22a`, the full serialized backend passed 7,539 tests with five intentional skips and no failures, including Architecture 20/20 with one intentional skip and Integration 35/35. The independent security review was clean; the correctness review found only the now-corrected seven-test evidence omission. The merged Dockerless Testcontainers repair is absorbed, and the only later issue-scope change is this verification-document correction; the current-main merge touched only the independently reviewed `#1522` frontend/docs slice. Signed publication, exact hosted Required CI, CodeQL, and merge remain outstanding, so this is not yet a shipped delivery entry.
+- **`#1513` shipped implementation:** the registered OpenAI, Gemini, Ollama, and outbound-webhook handlers set `UseProxy = false`, keeping the configured origin as the connect-time validation target. Just before send, protected registrations mask the URI seen by outer .NET HTTP diagnostics; the inner handler restores the real URI for transport and re-masks it for retry/completion. Public caller-owned provider clients keep normal `HttpClient` behavior. The four protected clients remove default request loggers, disable distributed-trace header propagation, and use a private HTTP metric scope; Taskdeck's configured OpenTelemetry provider drops their marked activities and scope. Enabled Sentry removes its outbound factory handler only from these four client pipelines, so unrelated clients retain instrumentation and server-side exception tracking remains active. The proven boundary includes pre-handler `System.Net.Http` EventSource path/query suppression, but excludes independently installed process-global activity/meter listeners and transport-stage host/IP observers. Existing localhost opt-ins and automatic-redirect blocking remain unchanged. No proxy-aware outbound mode exists; corporate proxy-only deployments fail closed.
+- **Delivery evidence:** PR `#1516` published head `dc2a099c` and merged as `840874ac`. The exact documented filters passed 66/66 API and 158/158 Application tests (151 provider/policy compatibility plus seven constructor/remasking controls); registered EventSource and scoped-Sentry controls passed three fresh-process repetitions. At pre-documentation head `dad8d22a`, the full serialized backend passed 7,539 tests with five intentional skips and no failures, including Architecture 20/20 with one intentional skip and Integration 35/35. Independent security and final correctness review were clean. Exact-head Required CI passed 16/16 jobs, CI Extended completed with four successes and 11 intentional path-based skips, and CodeQL passed 4/4 before merge.
 
 ## Delivery update (2026-07-27, test substrate, Windows API diagnostics, and realtime reconciliation)
 

diff --git a/docs/REVIVAL_PLAN.md b/docs/REVIVAL_PLAN.md
@@ -1,6 +1,6 @@
 # Taskdeck Revival Plan — Free Open Beta → Commercial Horizon
 
-Last Updated: 2026-07-13
+Last Updated: 2026-07-31
 
 **Status:** Active planning spine (maintainer-decided 2026-07-10, **ADR-0044**; supersedes the archive pivot).
 **Authority:** work not on this plan's ratified wave list is, by definition, not taken (the finite-work discipline from `COURSE_CORRECTION.md` §1.1 carries over unchanged). New backend surface is allowed only where §7 grants it.
@@ -92,9 +92,9 @@ Dogfooding (`#1271`) runs through everything from day one — including WhisperX
 
 Bounded finish-or-close slices from the archive plan (#1134, #1135, #1128, #1175, #1138, #1222/#1227) continue as capacity allows, unchanged.
 
-### Phase 4 — every artefact, everyone (v0.4; ADR-0046 **Proposed**, tracker `#1327`)
+### Phase 4 — every artefact, everyone (v0.4; ADR-0046 **Accepted**, tracker `#1327`)
 
-Seeded 2026-07-13 from the maintainer's twin-app evaluation (decision: extend the single app, defer the twin behind the GEN-12 evidence gate). **Ratification pending on GEN-00 `#1327`** — until the maintainer ratifies ADR-0046, only lane **G-A** foundational work is authorized (per maintainer instruction 2026-07-13); lanes G-B/G-C wait for ratification in addition to their technical dependencies. **Strictly subordinate to the v0.1 ship gate** — lane **G-A** is parallel-safe immediately (stays off the transcript-lane files while PR #1312 is open), lane **G-B** waits for REVIVAL-08 M1 (`#1312`) to merge, lane **G-C** follows Phase 1.
+Accepted 2026-07-13 after the maintainer's twin-app evaluation (decision: extend the single app, defer the twin behind the GEN-12 evidence gate). The GEN-00 `#1327` tracker and each lane's technical dependencies remain binding. **Strictly subordinate to the v0.1 ship gate** — lane **G-A** is parallel-safe, lane **G-B** follows REVIVAL-08 M1 (`#1312`), and lane **G-C** follows Phase 1.
 
 | Item | Issue | Lane |
 |---|---|---|

diff --git a/docs/STATUS.md b/docs/STATUS.md
@@ -1,10 +1,10 @@
 # Taskdeck Status (Source of Truth)
 
-Last Updated: 2026-07-27
+Last Updated: 2026-07-31
 
-Proxy-safe direct egress implementation checkpoint (2026-07-27, `#1513`):
+Proxy-safe direct egress shipped checkpoint (2026-07-27, `#1513` / PR `#1516`):
 - **The registered OpenAI, Gemini, Ollama, and outbound-webhook primary clients preserve the validated direct origin without exporting protected path/query data through Taskdeck's configured telemetry.** Each primary handler sets `UseProxy = false`, so ambient/system proxy settings cannot replace the `OutboundWebhookConnectCallback` target. Immediately before `SendAsync`, registered providers and webhook delivery mask the request URI from outer .NET HTTP diagnostics; the protected inner handler restores the configured URI for transport and re-masks it for retry/completion. Public caller-owned provider clients do not opt into this mechanism and retain ordinary `HttpClient` URI/body/auth behavior. The four protected clients remove default `IHttpClientFactory` request loggers, disable distributed-trace header propagation, and use a private HTTP metric scope; Taskdeck's OpenTelemetry configuration drops marked activities and that scope. When Sentry is enabled, its outbound handler is removed only from these protected clients; unrelated clients such as `GitHubConnectorProvider` retain Sentry instrumentation, while server-side exception tracking remains enabled. The proven boundary covers pre-handler `System.Net.Http` EventSource path/query data and Taskdeck's configured exporters, not independently installed process-global activity/meter listeners or transport-stage host/IP observation. Existing localhost opt-ins and automatic-redirect blocking are unchanged. Proxy-aware outbound support does not exist, so corporate proxy-only deployments fail closed.
-- **The current-main review-fix working tree is local and not yet shipped:** the documented exact filters pass 66/66 API and 158/158 Application tests (151 provider/policy compatibility plus seven constructor/remasking controls) across registered pipelines, proxy canaries, delivery, EventSource, OpenTelemetry, and scoped-Sentry boundaries. The registered EventSource and Sentry positive/negative controls passed three fresh-process repetitions. At pre-documentation head `dad8d22a`, the full serialized backend passed 7,539 tests with five intentional skips and no failures, including Architecture 20/20 with one intentional skip and Integration 35/35. The independent security review was clean; the correctness review found only the now-corrected seven-test evidence omission. The only later issue-scope change is this verification-document correction; the current-main merge touched only the independently reviewed `#1522` frontend/docs slice, so `#1513` source behavior is unchanged. Signed publication, exact hosted CI, and CodeQL remain outstanding.
+- **The repair shipped in PR `#1516`:** published head `dc2a099c` merged as `840874ac` after exact-head Required CI passed 16/16 jobs, CI Extended completed with four successes and 11 intentional path-based skips, and CodeQL passed 4/4. The documented local filters passed 66/66 API and 158/158 Application tests (151 provider/policy compatibility plus seven constructor/remasking controls) across registered pipelines, proxy canaries, delivery, EventSource, OpenTelemetry, and scoped-Sentry boundaries. The registered EventSource and Sentry positive/negative controls passed three fresh-process repetitions. At pre-documentation head `dad8d22a`, the full serialized backend passed 7,539 tests with five intentional skips and no failures, including Architecture 20/20 with one intentional skip and Integration 35/35. Independent security and final correctness review were clean.
 
 Realtime column reconciliation (2026-07-27, `#1522`):
 - **A successful create-column response can no longer duplicate or overwrite a fresher same-id SignalR update.** Reconciliation now preserves the existing realtime object and its identity when that id is already present, and appends the HTTP response only when the column is absent. The store regression races a newer realtime column against the older POST payload and pins its identity, name, position, WIP limit, card count, and timestamp. The board E2E helper waits for the matching successful POST and the completed form lifecycle before asserting one scoped lane; collision-name mobile coverage selects exact lanes/cards instead of hiding duplicates with `.first()`. Exact local verification passed 13/13 focused store tests, 3,915/3,915 full Vitest tests, 5/5 focused mobile tests on each of Chromium and WebKit, typecheck, build, and lint (zero errors; six pre-existing warnings).

diff --git a/docs/TESTING_GUIDE.md b/docs/TESTING_GUIDE.md
@@ -31,7 +31,7 @@ Verification note:
 
 ## Proxy-Safe Direct Egress Checkpoint (`#1513`)
 
-Local issue-branch verification on 2026-07-27 covers the direct-only primary
+Issue-branch verification shipped in PR `#1516` on 2026-07-27 and covers the direct-only primary
 clients for OpenAI, Gemini, Ollama, and outbound webhook delivery:
 
 ```powershell
@@ -76,8 +76,9 @@ The full serialized backend passed at pre-documentation head `dad8d22a` with **7
 5 intentional skips, and 0 failed** (Domain 1,636; Application 3,577; API 2,171 + 4 skips;
 CLI 100; Architecture 20 + 1 skip; Integration 35). The only subsequent issue-scope change is
 this verification-document correction; the current-main merge adds the separately reviewed
-`#1522` frontend/docs slice and leaves the backend subtree identical. Required CI, CodeQL, and
-final exact-current-head publication evidence remain required before merge.
+`#1522` frontend/docs slice and leaves the backend subtree identical. Published head `dc2a099c`
+then passed exact-head Required CI 16/16, CI Extended with four successes and 11 intentional
+path-based skips, and CodeQL 4/4 before merging as `840874ac`.
 
 ## Roadmap v4 Verification Spine (Seeded 2026-04-25)
 

diff --git a/docs/decisions/ADR-0046-generalist-expansion-single-app.md b/docs/decisions/ADR-0046-generalist-expansion-single-app.md
@@ -52,7 +52,7 @@ The governing constraints: ADR-0044's finite-work discipline (a ratified wave li
 - Prompt-injection rails (GEN-09) become a **merge prerequisite** for wiring artefact text into LLM prompts (GEN-04) — the review gate stops being the only defense layer before hostile documents flow in.
 - The scope-regrowth risk named in REVIVAL_PLAN §9 grows: mitigated by lane subordination to the v0.1 gate, the unchanged ~8-week checkpoint, the GEN-12 gate, and this wave being seeded complete (admission ticket discipline — new GEN work requires a plan amendment, same as REVIVAL).
 - `.codex/memories/00_ACTIVE.md` (the Codex active-gate snapshot, which still declared the superseded archive pivot) is refreshed to the revival + generalist direction so overnight autonomous agents do not execute against stale framing. The Claude-side direction snapshot lives in out-of-repo session memory and is refreshed there, outside this change.
-- Ratification: this ADR ships as **Proposed**; the maintainer ratifies via the GEN-00 (`#1327`) checklist. Foundational lane G-A execution was authorized by maintainer instruction on 2026-07-13 pending ratification.
+- Ratification status: **Accepted**, matching the canonical status above and the ADR index. GEN-00 (`#1327`) remains the execution tracker; its human-owned checklist is not modified by this documentation reconciliation.
 
 ## References