[decebal]

Summary

Allstack carries an accepted plan and source snapshot across coding hosts, then verifies and publishes the exact resulting commit. Embedded AllSource owns validated run history, Chronis owns task claims and completion, and embedded Prime supplies source-linked context.

• Add the Rust CLI for plan → build → verify → ship, immutable host epochs, isolated worktrees, bounded process supervision, and recovery of uncertain actions.
• Invoke real Codex and Claude Code with native permission modes and hooks. Restrict Claude planning tools to read/search capabilities.
• Bind receipts to source, workflow/method/policy digests, selected environment, and running executable digest. Recheck Chronis ownership before first publication.
• Reuse this PR, publish with an explicit branch lease, read back destination state, reconcile task/memory updates, and remove only owned worktrees matching accepted snapshots.
• Add component-aware history, evidence, and recall diagnostics, original workflow data, host guidance, and reproducible delivery fixtures.

Test plan

• Real Codex → Claude Code → Codex: run 9acd9993-3a70-4a87-b4fe-f62b96eb2cbb, shipped; Chronis task t-3d5fb1 read back done; Prime outcome read back through its engine.
• Real Claude Code → Codex → Claude Code: run 750de2d1-ec0b-4327-be96-4f0e1ba5c5f5, shipped; task t-649659 read back done; Prime outcome read back.
• Final exact-commit policy: 20 runtime tests passed, zero skipped; four fixture tests passed; whitespace gate exit 0.
• Actual caller interruption recorded owner-pipe loss, durable unresolved intent, and explicit recovery without automatic model replay.
• Real concurrent coordinator refused; stale outgoing epoch refused; outgoing native edit isolated; changed environment and changed runtime executable refused stale shipping receipts.
• Remote ref and PR head independently read back as 4c2ba68e59bfe7168bb62918522d1cc9a0a87bcf; one commit above main; working tree clean; all owned host worktrees removed.
• Final Linux/macOS CI: 20 runtime tests and four fixture tests passed on each OS; formatting, Clippy, and source/dependency audit passed: run 40117053469.

Final delivered commit: 4c2ba68e59bfe7168bb62918522d1cc9a0a87bcf.
Final local runtime SHA-256: c174a817e7ab70d95d81c7d5e1550a47f973287c4ca53666b104577a7b8abcd9.
Final environment fingerprint: 84efc0566562d3108017dd627c97d262f6419b2885f3e51bef386f37c00eba9c.

Final gate receipt digests:

• Runtime: 776e3b1ff856c36d2c3f42b5137c8c0c468e7a51a471dd1096fff1fff63a007e.
• Fixtures: 0cea30d146ef15dd40e19f5f07b4924f6eb67072ba173ad49dab348482ffb27e.
• Whitespace: 2a854ec0f0a859c659ad9cf401ac20945b49da36e45fde389ca881fa3be063fb.

Design and evidence

• Cross-host design
• Indexed verification report
• CLI and recovery guide

Preview limits

Sequential hosts on one Unix machine; local storage; lexical Prime recall; github.com publication. Ship means verified push and open PR. Native tools outside Allstack remain outside epoch fencing. Merge, deployment, cross-machine transfer, and simultaneous loss of all guardians were not verified. Runtime stores and unredacted transcripts remain private and ignored. Main was unprotected at inspection, so CI is advisory at the forge; managed shipping enforces the frozen policy. Rebase merging is the only enabled merge mode.