Execute the terminal caller convergence transaction

[coenttb]

Outcome

Converge every active public Swift Institute package repository to the one byte-identical terminal caller in one bounded forward wave.

Owner

Repository Policy owns enumeration, exact caller bytes, preconditions, journal entries, rollback material, per-repository results, and the terminal recensus. The trusted GitHub host owns only App credential acquisition and invoking the verified Swift transaction.

Required transaction

• Enumerate the complete active public package population from the canonical fleet policy and live repository state; refuse zero or incomplete enumeration.
• Require an existing .github/workflows/ci.yml and capture its exact blob SHA and bytes before mutation.
• Refuse concurrent default-branch movement and use expected-head guards.
• Open a narrowly scoped swift-institute-bot ruleset bypass only for the one repository being updated; close it unconditionally and verify closure before advancing.
• Commit exactly the canonical terminal caller by forward commit, preserving ci / matrix / ci-ok.
• Record the old and new heads, old and new blob digests, mutation result, bypass closure, and rollback coordinate for every repository.
• On any uncertain state, stop the wave with the journal intact; never leave an unverified bypass open.
• Recensus all active public callers byte-for-byte and refuse closure unless the population count is complete and every digest equals the owner output.

Prohibitions

No force push, history rewrite, cache workaround, compatibility form, caller-selected behavior, shell-owned fleet semantics, or private-repository hosted CI.

[coenttb]

Successor handoff — exact state on 14 August 2026

This comment is the authoritative live execution checkpoint for the current convergence transaction. The issue body remains the authority for the outcome and safety contract. The principal transferred execution to a successor agent; the successor should challenge or accept this checkpoint in a new comment before mutation.

Checked protected-main coordinates

• Institute CI main a10fd8b6fb31901a6faf6aa5ec176c12d3f99d98
• GitHub host main ea892f6e8b1350757c22244cbff62bc2d21d5320

The host head includes the narrow corrections in PR #587, PR #588, PR #589, and PR #590.

Last fleet transaction

Terminal caller wave run 31793561070 completed with failure at the exact host head above.

Checked facts:

• The exact census succeeded: 17 organizations, 504 active public repositories, 469 caller subjects.
• Repository digest: 8dda8118609766cd965b8195e3b929db3acd81144c371af411b90197c651a703
• State digest: 9213db669e161e5f9b10567ad60e0405f5a65090492fe2038491d7b4da343c00
• Subject digest: 53c46541e9884802052cc2a8b4d72122f2aa85a4a0614276cbb48a6f49a21545
• Both independent capacity gates passed.
• Organization preflights failed before the complete-preflight gate.
• Apply and closure matrices were skipped.
• No fleet repository was mutated and no ruleset bypass was opened.

A representative failure is Preflight · swift-ecma.

Current blocker and adjudication boundary

Checked: the official GitHub App token action successfully issued the bounded organization tokens after requesting contents: write and administration: write. Repository Policy then refused preflight because the repository response exposed collaborator-style permissions.push and permissions.admin booleans as false.

Inference requiring successor review: those collaborator-style booleans are not an authoritative permission signal for this App actor. The likely smallest owner-correct repair is an exact permission-issuance attestation passed by the protected host only after the official token action succeeds, with negative controls proving missing or false attestations are refused before mutation.

A local uncommitted draft explores that repair. It is not reviewed, tested, published, or part of this GitHub SSOT and must not be treated as evidence.

Next transaction

1. Independently adjudicate the App permission evidence surface.
2. Implement and prove the correction at Repository Policy, including negative controls.
3. Land the exact reviewed Institute CI head and publish a new immutable Repository Policy bundle.
4. Make the thin host pass only the proved attestation.
5. Dispatch one new terminal wave.
6. Require complete preflight before apply, then exact receipt, closure, population-set, caller-byte, and ruleset-bypass recensus.
7. Run the terminal L1/L2/L3 provenance probes and close this issue only from exact green evidence.

The auxiliary publisher failed-readback control run 31793012331 completed in the expected failing posture: the injected readback checksum mismatch fired before pointer advancement, and the pointer guard reported no change.

Related authority

• Institute CI #33 — terminal caller and fleet policy owner
• GitHub host #574 — terminal package CI host activation
• GitHub host #461 — Project-admitted terminal host reduction
• Institute Work Project

This issue is the sole technical work object for the caller convergence transaction. Do not duplicate its live state elsewhere. Preserve the acceleration ruling: do not improve superseded machinery solely for compatibility; prove terminal invariants at their canonical Swift owners and continue.