[Edulynch]

Summary

Draft non-enabling technical checkpoint. This is not authority activation, native certification, SPEC-015 completion, or merge/release approval.

Tracking: #53 (reference only; this PR does not close it).
SPEC-015: https://github.com/Edulynch/Opencode-ChangeBudget/blob/ec653c876d9d9878ddc3dec79d575e605f5e3078/specs/015-guardian-v2-authority-foundation/spec.md
Checkpoint commit: ec653c876d9d9878ddc3dec79d575e605f5e3078.

The branch diff against master contains four existing Guardian V2/SPEC-015 commits and 75 paths. The checkpoint's approved set is 73 reviewed paths. The two additional earlier files are .specify/feature.json (feature locator) and specs/015-guardian-v2-authority-foundation/checklists/requirements.md (CHK016 remains unchecked). No implementation/source changes were made during publication.

Non-enabling status and pending gates

• HARD authority remains DISABLED.
• G0 native certification remains UNVERIFIED (0/24); no reattempt was made.
• G5 non-enabling transport is implemented; formal G5 acceptance remains PENDING.
• G6 remains PENDING / not started.
• Managed START/AMEND/CLOSE authorization is unchanged; no managed lifecycle ALLOW was added.
• CHK016 remains unchecked; T017 remains pending. This PR does not close SPEC-015 or issue [Tracking] Guardian V2: post-mortem, simplificación arquitectónica y autonomía útil #53.

Accepted validation (existing evidence; not rerun for publication)

Ubuntu 24.04.3 WSL2 Linux x64 validation used private official Node 24.22.1/npm 11.19.1 with verified official SHA-256. T009 symlink-exclusion: 1 passed, 0 failed, 0 skipped. Full npm test: 887 total, 886 passed, 0 failed, 1 skipped, 0 cancelled. npm ci, typecheck, canonical compile, package validation, CI-safe release gate, git diff --check, and clean isolated checkout all passed. Independent read-only evidence review passed. Package validation: 171 entries, 84 runtime JavaScript files, 84 maps, all 9 required, 0 forbidden.

The single skip is T005: on Windows a read-only directory handle fails fsync while a write-capable handle succeeds at tests/unit/authority-registry.test.ts:224-227, skipped on Ubuntu because process.platform !== 'win32'. The recorded reason is: “Windows handle-access behavior is platform-specific; POSIX uses the read-only directory handle.” T009 was not skipped. The null-limits test passed; it was not the runner skip.

Dependency warning triage — no fixes applied

The retained npm ci output reports 13 vulnerabilities (12 moderate, 1 high). Read-only original-cache/lock mapping matches 13 production dependency package names; 28 matching cache records include derived metavulnerabilities, not 28 distinct upstream advisories. No new npm audit, validation, or dependency update was run.

Locked package	Severity	Cached association
@opencode/plugin@2.0.12	Moderate	Derived via @opencode/util
@opencode/util@2.0.12	Moderate	Derived OpenTelemetry dependencies
@opentelemetry/core@2.6.1	Moderate	GHSA-8988-4f7v-96qf
@opentelemetry/exporter-trace-otlp-http@0.214.0	Moderate	Derived OpenTelemetry
@opentelemetry/otlp-exporter-base@0.214.0	Moderate	Derived OpenTelemetry
@opentelemetry/otlp-transformer@0.214.0	Moderate	Derived OpenTelemetry
@opentelemetry/resources@2.6.1	Moderate	Derived OpenTelemetry
@opentelemetry/sdk-logs@0.214.0	Moderate	Derived OpenTelemetry
@opentelemetry/sdk-metrics@2.6.1	Moderate	Derived OpenTelemetry
@opentelemetry/sdk-trace-base@2.6.1	Moderate	Derived OpenTelemetry
@opentelemetry/sdk-trace-node@2.6.1	Moderate	Derived OpenTelemetry
http-cache-semantics@4.2.0	High	GHSA-ch52-4w7c-c8xp / CVE-2026-93748
ip-address@10.7.2	Moderate	GHSA-rxp7-6hxx-x8q5

The high public advisory is GHSA-ch52-4w7c-c8xp (GitHub Reviewed): “http-cache-semantics max-stale handling can disclose cross-user cached responses,” affected range <=4.2.0, CVSS 3.1 7.5. No patched version was listed in the retained cache evidence as of 2026-10-23. The declared production dependency chain is @opencode/plugin@2.0.12 -> @opencode/util@2.0.12 -> @npmcli/arborist@9.4.0 -> npm-registry-fetch@19.1.1 -> make-fetch-happen@15.0.6 -> http-cache-semantics@4.2.0.

The locked affected version is confirmed; application reachability, shared-cache conditions, and exploitability were not assessed. No exploit or authority escalation is demonstrated. No fix or lockfile change was applied. This is not vulnerability closure or release clearance.

Deferred cleanup (separate from technical validation)

The isolated-checkout validation and clean-tree checks passed. The original tracked tree is unchanged and 33 untracked exclusions were preserved. Task temporary environments/evidence remain retained because process inactivity could not be proven; cleanup is deferred. No process inspection/termination, deletion, or ACL change was performed for this publication. Cleanup uncertainty does not turn the technical PASS into FAIL; no cleanup claim or private filesystem paths/logs are included.

GitHub CI

The local Ubuntu validation above is not GitHub CI certification. See PR Checks for the actual automatically triggered GitHub CI status; completion is not claimed until observed. No manual workflow dispatch, rerun, or cancellation was requested.