> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase20-session11-release-evidence-and-event-privacy/release-evidence.md). # Phase 20 Release Evidence Matrix **Session ID**: `phase20-session11-release-evidence-and-event-privacy` **Phase**: 20 - Orchestration Actionability Execution **Created**: 2026-06-29 **Scope**: Local Command Center execution evidence and broad-surface privacy. *** ## Release Rule Phase 20 may claim local orchestration execution only for executor families with source-owned contracts, local runtime execution or truthful unavailable behavior, manager-owned state transitions, compact broad summaries, focused tests, browser evidence, and stable docs. Do not use action verbs for metadata-only, proposal-only, preview-only, record-only, approved-not-executing, unsupported, hosted, remote, Worker-bridge, or production-channel paths. *** ## Shipped Local Paths | Path | Claim Allowed | Evidence Sources | Privacy Boundary | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Truthful capability baseline | Non-executing states use unavailable, proposal-only, approved-not-executing, record-only, or tracking copy. | `.spec_system/specs/phase20-session01-truthful-capability-baseline/validation.md`; `apps/web/tests/commandCenterUi.test.ts`; `apps/server/tests/executorRegistry.test.ts` | Broad rows expose labels and ids only; no raw prompts, commands, output, paths, or provider payloads. | | Terminal queue execution | Local terminal queue rows can create, dispatch, execute, observe, retry, kill, timeout, and report `pty_unavailable`. | `.spec_system/specs/phase20-session02-queue-terminal-execution/validation.md`; `apps/server/tests/taskExecutionCoordinator.test.ts`; `apps/web/tests/QueueWorkbench.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Raw command text and terminal output stay scoped to terminal detail; broad queue rows and events expose compact state, summary, and scoped links. | | Git queue execution | Local Git queue rows can run status, stage, and unstage; push remains policy-blocked unavailable. | `.spec_system/specs/phase20-session03-queue-git-execution/validation.md`; `apps/server/tests/taskExecutionCoordinator.test.ts`; `apps/web/tests/FileGitWorkbench.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Broad surfaces exclude raw Git output, diffs, patch bodies, commit bodies, tokens, and broad absolute paths. | | Campaign executable dispatch | Approved campaign executable tasks dispatch through queue entries and execution runs while planning-only tasks remain non-executing. | `.spec_system/specs/phase20-session04-campaign-executable-dispatch/validation.md`; `apps/server/tests/planCampaignExecutableDispatch.test.ts`; `apps/web/tests/CampaignWorkbench.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Campaign rows expose task ids, safe labels, queue links, execution ids, and states only. | | Campaign DAG recovery | Campaign dependencies run in deterministic order; failed or unavailable prerequisites block dependents and retry only failed/unavailable executable work. | `.spec_system/specs/phase20-session05-campaign-dag-recovery/validation.md`; `apps/server/tests/planCampaignDagRecovery.test.ts`; `apps/web/tests/CampaignWorkbench.test.tsx` | Dependency and recovery summaries exclude command bodies, output, diffs, payloads, tokens, and raw paths. | | File mutation core | Local file previews, apply, audit, backup, stale-hash checks, conflict handling, and rollback execute through `FileMutationManager`. | `.spec_system/specs/phase20-session06-file-mutation-core/validation.md`; `apps/server/tests/fileMutationManager.test.ts`; `docs/api/README_api.md` | Broad evidence exposes relative path labels, counts, hashes, backup labels, and rollback state, not file contents or patch bodies. | | File executor integration | Guarded, queue, and campaign file execution route through the file mutation manager with compact results and rollback affordances. | `.spec_system/specs/phase20-session07-file-executor-integration/validation.md`; `apps/server/tests/taskExecutionCoordinator.test.ts`; `apps/web/tests/FileGitWorkbench.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Guarded and queue summaries do not expose raw content, raw patch, absolute path, terminal output, or provider payloads. | | Managed hero lifecycle | Stop, restart, and message actions execute only for FactionOS-owned local process or PTY sessions; observed provider sessions stay unavailable or record-only. | `.spec_system/specs/phase20-session08-managed-agent-lifecycle-control/validation.md`; `apps/server/tests/managedAgentSessionManager.test.ts`; `apps/web/tests/HeroLineageWorkbench.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Lifecycle rows expose safe action labels, result labels, ids, and summaries only; no transcripts, prompts, command bodies, process internals, or provider payloads. | | Container dispatch | Bounded local isolated-spawn container payloads can dispatch through queue and campaign flows when runtime/image gates pass, or return truthful unavailable evidence. | `.spec_system/specs/phase20-session09-container-dispatch-decision/validation.md`; `apps/server/tests/taskExecutionCoordinator.container.test.ts`; `apps/web/tests/QueueWorkbench.test.tsx`; `apps/web/tests/CampaignWorkbench.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Broad container evidence exposes runtime labels, image labels, cleanup posture, state, and recovery copy only; no raw Docker output or command details. | | Templates and channel intake | Source-owned templates can create bounded local executable queue tasks; webhook/channel intake remains proposal-first until local conversion. | `.spec_system/specs/phase20-session10-templates-and-channel-intake/validation.md`; `apps/server/tests/channelCommandRoutes.test.ts`; `apps/web/tests/ChannelCommandPanel.test.tsx`; `tests/e2e/orchestration-command-center.e2e.ts` | Webhook and channel rows exclude raw headers, raw bodies, cookies, auth material, secrets, provider payloads, and untrusted executable claims. | *** ## Unsupported And No-Claim Paths | Path | Release Wording | Required Future Evidence Before Promotion | | ----------------------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Hosted identity | No claim. | Account lifecycle, authorization, revocation, audit, local-only fallback, protocol/server/web tests, docs, and deployed evidence. | | Hosted storage or public replay hosting | No claim. | Storage boundary, upload/download auth, takedown, consent, redaction, tests, docs, and production-hosted validation. | | Trusted unified erasure | No claim. | Full boundary inventory, authority checks, dry-run and confirmation, verification, audit, failure modes, and legal/privacy approval. | | Remote access and Cloudflare Tunnel control | No claim. | Tunnel auth, operator consent, least-privilege command boundary, rate limits, redaction, tests, docs, and hosted validation. | | Worker command bridge or hosted execution | No claim. | Worker command contracts, identity, permission, audit, replay-safe redaction, recovery, and deployed validation. | | Generic webhook or chat command auto-execution | Proposal-only. | Trusted source auth, idempotency, command allowlists, human approval, execution evidence, abuse controls, and docs. | | Provider model, permission, or isolation mutation | Unavailable. | Provider-specific mechanism, permission model, failure recovery, observed-only fallback, and contract tests. | | Git push through queue/campaign | Policy-blocked unavailable. | Explicit policy change, protected branch controls, preview, audit, rollback guidance, tests, and docs. | | Arbitrary Docker commands, builds, mounts, or remote images | Unsupported. | Threat model, image policy, mount policy, resource caps, cleanup, result redaction, tests, and docs. | | Production-hosted Command Center validation | No claim. | Deployed app shell, authorized credentials, hosted smoke, privacy scan, and release-candidate record. | *** ## State Semantics Evidence | State | Queue Meaning | Campaign Meaning | Release Check | | ------------- | ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | `queued` | Executable work is accepted and waiting for dispatch. | Dispatchable task is waiting for dependencies or operator action. | Rows must not include raw executable payloads. | | `in_progress` | A coordinator-owned execution run is active. | At least one executable task is dispatching or running. | Duplicate dispatch must reuse or block in-flight work. | | `completed` | Execution run finished with `executed`. | All dispatchable executable tasks completed and non-executable tasks remain truthful. | Metadata-only, preview-only, proposal-only, or unavailable work cannot complete the row. | | `blocked` | Validation, stale revision, dependency, approval, or policy stop prevented dispatch. | A dependency, approval, cycle, planning-only boundary, or validation issue prevents progress. | User sees product-facing repair copy. | | `failed` | Runtime execution failed after dispatch. | A dispatched executable task failed and dependents cannot complete. | Retry is allowed only where the task family supports it. | | `unavailable` | Capability was unavailable before or during dispatch. | Required capability was unavailable and dependent work did not falsely complete. | Optional runtime absence is truthful product evidence, not a release failure. | *** ## Command Evidence Ledger Commands must be run under Node `v26.2.0` with npm `11.16.0`. | Command | Purpose | Result | | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `npm --workspace packages/protocol run typecheck` | Protocol contract type safety. | PASS - `@factionos/protocol` `tsc --noEmit` completed. | | `npm --workspace apps/server run typecheck` | Server manager and route type safety. | PASS - `@factionos/server` `tsc --noEmit` completed. | | `npm --workspace apps/web run typecheck` | Web component and store type safety. | PASS - `@factionos/web` `tsc -b --noEmit` completed. | | `npm test` | Full Vitest regression suite across protocol, server, web, and support packages. | PASS - 273 test files passed, 1 skipped; 3118 tests passed, 1 skipped. | | `npm run test:e2e -- --project=app-desktop tests/e2e/orchestration-command-center.e2e.ts` | Browser release evidence for Command Center execution, recovery, unavailable states, and privacy. | PASS - app-desktop Command Center Playwright suite passed, 8 tests. | | `git diff --check` | Whitespace and patch hygiene. | PASS - no whitespace errors reported. | *** ## Broad Privacy Audit The following categories must not appear in broad REST rows, WebSocket events, exports, diagnostics, docs examples, or normal UI rows: * Raw terminal command text. * Terminal stdout, stderr, scrollback, transcript text, or PTY internals. * Raw Git output, diffs, patch bodies, commit bodies, or broad path lists. * File contents, raw patches, backup contents, or broad absolute paths. * Tokens, secrets, cookies, authorization headers, webhook signatures, and raw headers. * Provider payloads, model payloads, prompts, raw transcripts, or MCP payloads. * Raw webhook request bodies or untrusted remote executable claims. * Docker command lines, raw runtime output, mount paths, and host internals. Allowed broad fields are ids, stable status labels, relative or scoped labels, counts, short summaries, execution ids, queue ids, campaign ids, safe recovery copy, scoped detail links, and no-claim docs paths. *** ## Documentation Owners | Surface | Owner File | Release Responsibility | | ----------------------- | -------------------------------------- | -------------------------------------------------------------------------------------- | | Stable API behavior | `docs/api/README_api.md` | REST/WebSocket routes, payload limits, execution claims, and blocked fields. | | Server runtime behavior | `apps/server/README_server.md` | Manager ownership, local execution boundaries, diagnostics, and unavailable states. | | Web product behavior | `apps/web/README_web.md` | Product-facing labels, verbs, row privacy, links, and no-overclaim copy. | | Shared contracts | `packages/protocol/README_protocol.md` | DTOs, event parsers, blocked fields, enum handling, and package ownership. | | Privacy posture | `docs/privacy-and-security.md` | Data inventory, local-only boundaries, external transfer limits, and no-claim risks. | | Release checklist | `docs/release.md` | Focused commands, unsupported-path register, release wording, and remaining no-claims. | *** ## Session 11 Update Log | Task | Update | | ---- | ---------------------------------------------------------------------------------------------------------------- | | T002 | Initial release evidence matrix created from Phase 20 PRD and Sessions 01-10 validation artifacts. | | T024 | Recorded protocol, server, web, full Vitest, and app-desktop Command Center Playwright release command outcomes. | | T025 | Recorded final whitespace, ASCII, LF, and release/docs wording hygiene results before handoff. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase20-session11-release-evidence-and-event-privacy/release-evidence.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.