vault-sync: 2026-10-11 06:00 (jimmy)

2026-10-11 06:00:05 -07:00
parent 09e7d3d40f
commit 4423a57d61
6 changed files with 206 additions and 8 deletions
@@ -551,3 +551,24 @@ Any eval started now would void **every** candidate as `measurement_artifact`
 • Backups exist at …/jimmy/cache/scratch/cfg-backup-20261010-225205/.
 Entries added (all 4 profiles):
 python harness/paper_trader_instrumented.py *
+python3 harness/paper_trader_instrumented.py *
+python *paper_trader_instrumented.py *
+sqlite3 results/*.db *
+w32tm /query /status
+w32tm /query /source
+Mechanism notes (correct):
+• The gate that blocks headless -q is approvals.single_query_mode: deny, not a “manual mode.”
+• command_allowlist is a pre-gate: allowlisted commands now run unattended; everything else still stops for a tap.
+• single_query_mode was left untouched, so the “everything else on a tap” behavior holds.
+• Still gated: w32tm /config / resync, any git push/remote write, installs, anything outside the scoped patterns.
+Limitations correctly left un-faked:
+1. Path-scoped shell ops under killcorpus (rm/mv/cp etc.) can’t be expressed — allowlist matches whole command strings/globs only. Native file tools (read_file/write_file/patch) already run unattended and are not gated by this system.
+2. Strict “SQLite that only touches results/*.db” isn’t enforceable beyond the sqlite3 results/*.db * approximation; python -c / execute_co
+
+**assistant:** Recommendation: **hold the deliberate eval — it's not viable right now.** The clock has now crossed the gate:
+
+- Skew **−284 ms** (google/cloudflare/pool all agree); gate is **250 ms**.
+- `w32time`: still **`Leap Indicator: 3 (not synchronized)`**, last sync ~2 h ago, poll 1024 s.
+- State otherwise safe: `reg_state.json` absent, eval DB 0/0.
+
+Any eval started now would void **every** candidate as `measurement_artifact` — the clock would have to be fixed anyway. So the eval waits on the clock, and the clock fix needs you at the PC (UAC).