docs: pin upstream sync campaign and record verified intake

Author: codex

BACKLOG.md

@@ -271,4 +271,4 @@ Native Windows qualification and fresh Jenkins51 result remain separate.
 
 ## External Luna worker CLI cache resolution — 2026-10-05
 
-- [ ] Investigate `codebase-memory-cli: secure CLI coordination could not be created (cache-resolve)` in prepared external Herdr workers. Observed on `cbm status --project ttm-jenkins-repair-20261005 --json` / exact-project status/projects probes in Tax Machine runs `ttm-jenkins-repair-20261005` and `ttm-jenkins-verify-20261005`; installed parent CLI reports `dev`. Both exact worktrees under `/home/nate/.local/share/agent-workflow/worktrees/the-tax-machine/jenkins-{repair,verify}-20261005` were fully indexed with persistence false, ready at 2026-10-05T14:27:42/43Z, source `efa9b0a1971ec6d9a33457401ddeb337c1eeea3b`, and unchanged empty Git porcelain. Parent status/projects succeed; worker calls fail before graph query despite launch args approval never / danger-full-access. Expected workers to access those ready graphs. Runtime/environment cause remains unproven. Workers preserve unchanged porcelain and use exact source/config fallback; issue remains open. Durable evidence: `/home/nate/.local/state/agent-workflow/runs/ttm-jenkins-verify-20261005/output.log` and both runs' `evidence/launch-preflight/`. Do not reset the shared daemon or widen allow-roots as a workaround.
+- [ ] Investigate `codebase-memory-cli: secure CLI coordination could not be created (cache-resolve)` in prepared external Herdr workers. Observed on `cbm status --project ttm-jenkins-repair-20261005 --json` / exact-project status/projects probes in Tax Machine runs `ttm-jenkins-repair-20261005` and `ttm-jenkins-verify-20261005`; installed parent CLI reports `dev`. Both exact worktrees under `/home/nate/.local/share/agent-workflow/worktrees/the-tax-machine/jenkins-{repair,verify}-20261005` were fully indexed with persistence false, ready at 2026-10-05T14:27:42/43Z, source `efa9b0a1971ec6d9a33457401ddeb337c1eeea3b`, and unchanged empty Git porcelain. Parent status/projects succeed; worker calls fail before graph query despite launch args approval never / danger-full-access. Expected workers to access those ready graphs. Runtime/environment cause remains unproven. Workers preserve unchanged porcelain and use exact source/config fallback; issue remains open. Durable evidence: `/home/nate/.local/state/agent-workflow/runs/ttm-jenkins-verify-20261005/output.log` and both runs' `evidence/launch-preflight/`. Do not reset the shared daemon or widen allow-roots as a workaround. Reproduced 2026-11-01 in AW-owned headless Luna runs `cbm-sync-{security,ci,13a}-20261101` on clean isolated CLI worktrees at `ff8b8906`; all full persistence-disabled parent preflights were ready, with 63,168 nodes, 142 parse-partial files and no porcelain changes. Parent projects/status succeed; workers fail projects/status before query, despite danger-full-access in recorded launch. Exact runtime cause remains unproven. Receipts: each run owns `evidence/launch-preflight/`; worker failures are in `output.log` and `executor-events.jsonl`. Source fallback used; no shared daemon reset, cache-root switch or widened authorization.

docs/UPSTREAM_308_CANDIDATE_AUDIT_20260912.md

@@ -1,5 +1,20 @@
 # Upstream merge progress — canonical ledger
 
+## Pinned synchronization campaign — 2026-11-01
+
+The [campaign plan](upstream-sync/PLAN.md), [machine ledger](upstream-sync/ledger.json)
+and [933-commit inventory](upstream-sync/commits.tsv) extend this canonical ledger.
+Fork baseline is `ff8b8906c6807953336609cc7f464e7e4ef3cf7b`; common ancestor
+`8df0639c6268afe9888979e72b9797aa2cc1de7c`; pinned upstream target
+`6c0ce230ee26ab8d263eb5235ebf73755558344e`. Live upstream inventory reached
+`edc2301b022b1f5e1e0ec11e291917e22e9736aa` (nine additional commits deferred).
+All historical checkpoint ancestor/count checks passed. The security hotfix,
+policy guard and first true merge batch have separate receipts and gate status.
+Unresolved older semantic dispositions below remain unresolved unless a new
+receipt explicitly reconciles their exact behavior. No PR merge or main push
+is authorized by this campaign.
+
+
 ## Five-slice upstream ancestry trial — 2026-10-03
 
 The user authorized a trial of five upstream verticals, followed by release-tooling

docs/upstream-sync/PLAN.md

@@ -0,0 +1,37 @@
+# Upstream synchronization campaign — 2026-11-01
+
+This campaign supplements the [canonical integration ledger](../UPSTREAM_308_CANDIDATE_AUDIT_20260912.md); it does not supersede older unresolved semantic dispositions. Machine status and per-checkpoint acceptance live in [ledger.json](ledger.json). [commits.tsv](commits.tsv) enumerates all 933 reachable campaign commits once, including 578 merges and 355 non-merges. Subsystem tags derive from changed paths; they are triage, not proof of implementation.
+
+## Verified baseline
+
+- Fork `origin/main`: `ff8b8906c6807953336609cc7f464e7e4ef3cf7b`.
+- Common ancestor: `8df0639c6268afe9888979e72b9797aa2cc1de7c`.
+- Observed upstream: `edc2301b022b1f5e1e0ec11e291917e22e9736aa`.
+- Pinned campaign: `6c0ce230ee26ab8d263eb5235ebf73755558344e`; nine subsequent commits deferred.
+- `git rev-list --left-right --count origin/main...upstream/main`: **348 fork-only / 942 upstream-only** after fetch.
+- All consecutive handoff checkpoints and the final nine-commit extension pass `git merge-base --is-ancestor`; historical batch counts are correct.
+- One open PR: #25, public documentation cleanup; no sync PR at inventory time.
+- Classic branch-protection endpoint returns 404. Active `protect` ruleset prevents deletion/non-fast-forward of default branch; it requires no status checks. No gate was bypassed or weakened.
+- Main checkout contains pre-existing untracked local artifacts and the handoff. Implementation uses separate clean worktrees; unrelated artifacts remain intact.
+
+## Sequence and acceptance
+
+1. Finish narrow security/dependency fixes and verify actual advisories, versions and fork applicability. Preserve installer download/extraction limits and explicit workspace authorization.
+2. Harden the local/Jenkins Actions policy guard and add ancestry verification with positive/negative checks.
+3. Complete true merge of upstream `5dc83ac9fa363d51706a70977840b61ea59ce9db` (13A, 79 commits); reconcile reviewed hotfix/guard commits, retaining upstream merge ancestry. Publish only sanitized draft branches.
+4. Later batches 13B–13K must build on the previous reviewed integration result. Open stacked draft PRs with explicit dependency targets, or leave subsequent checkpoints locally planned. Never open independent PRs based on stale main.
+5. Run focused checks after each completed batch, then full exact-SHA Jenkins qualification before recommending merge. Native Windows, >4 GiB SQLite offsets, graph determinism and sanitizer/recovery checks remain explicit gates when affected. Pending gates are not successful gates.
+
+Every batch must preserve CLI JSON/compact contracts, native HTTP, daemon ownership, durable storage and source provenance. No MCP server, transport/session registration or mandatory MCP dependencies. Retain useful shared changes via native CLI operations. Record every material exclusion/adaptation and schema migration in its batch receipt.
+
+## CI venue and operator gap
+
+PR #26's Jenkins-only policy remains mandatory. `Jenkinsfile` executes the Actions policy guard; every pushed branch must pass it before publication. Do not dispatch GitHub workflows.
+
+Read-only live Jenkins inspection found `codebase-memory-cli-main` (local `refs/heads/main`) and `codebase-memory-cli-release-tooling` (local `refs/heads/release-tooling`), both with no configured triggers. The release-tooling job's latest pre-campaign build was #83 SUCCESS; it does not validate campaign code. No CLI multibranch PR-discovery job was present in the inspected job list.
+
+To verify PRs automatically, an operator should configure a Jenkins GitHub Branch Source multibranch job for the fork, enable draft/regular PR discovery as intended, register GitHub webhook delivery to Jenkins, expose branch/PR-specific status contexts, and configure the default-branch ruleset to require those Jenkins contexts after a successful trial. Do not substitute Actions checks or weaken protection. A dedicated exact-commit job can qualify this campaign without changing existing jobs. Record actual build URLs and source revisions in receipts.
+
+## Platform and benchmark follow-up
+
+Use the existing pinned corpus at `benchmark-runs/linux/20260911T045124Z/BENCHMARK_CORPUS.frozen.json` for Linux/Windows parity: codebase-memory-cli `0c6d00d6011c1fdb50b90c53538f536cc3b5e4d9`, specgen-aw `466debfec788c7aeeee858c6b51e98b1b9afe653`, agent-workflow `e84925205301ff7169aff5a8cb14d10680c3739c`, agent-workflow-spec-contracts `0b32e556ef33bd00c0111d30a8b9225eb5196fcd`, and herdr `61ca85d5895bb530b59da85beeccdd767f4720d2`. Preserve these manifest pins; candidate version and platform evidence are separate. No current benchmark or Windows result is implied by this inventory.