docs(auth): record Task 4 certification evidence

.artifacts/task-15/automated-gates.json

@@ -1,13 +1,21 @@
 {
-  "schema": "thothii-task15-gates-v2",
+  "schema": "thothii-task4-certification-v1",
   "generated_on": "2026-08-18",
+  "started_at_utc": "2026-08-18T09:26:00Z",
+  "ended_at_utc": "2026-08-18T09:48:36Z",
+  "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
+  "source_immutability": {
+    "status": "PASS",
+    "tracked_changes_after_freeze": false,
+    "allowed_untracked": [".playwright-cli/", ".thothctl/"]
+  },
   "source_commits": {
-    "authentication_round1": "2b618c5a0f6f07045700cfe7146ca517fb5f78ab",
+    "task4_candidate": "b31b27e5845ffd3adf311429367319beaba263c7",
-    "fix_round2": "fe190e7046acc173f510dddcb32f46ed142858c1",
+    "task1": "d43738eeae6d14bb5e470093058b069a983f5372",
-    "maintenance_profile_follow_up": "4d230b87afdcd24f02264f8f937c8628b92db05a",
+    "task2": "5f9a3ae066a060b43a11a959b60a1efadd1c2425",
-    "fix_round3_and_final_docker": "e20bf33e2a00102192e5be66b178037aeca3a7b1",
+    "task3": "0d8e707533fada938c99eb06f8457150e7ef2b40",
-    "fix_round4_streamed_archive_privacy": "54698e73400a54ce7c3e6c10099e14eb471ce8b9",
+    "task3_follow_up": "b31b27e5845ffd3adf311429367319beaba263c7",
-    "fix_round5_retained_handle_private_creation": "74b062f1a737103524cbe706346cfd65f87cdfd1"
+    "historical_task15_final": "74b062f1a737103524cbe706346cfd65f87cdfd1"
   },
   "versions": {
     "node_contract": "v24.16.0",
@@ -16,6 +24,59 @@
     "pi": "0.80.3"
   },
   "retained_report": ".superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md",
+  "task4_report": ".superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md",
+  "workflow": {
+    "run_id": "32122302381",
+    "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381",
+    "event": "workflow_dispatch",
+    "head_sha": "b31b27e5845ffd3adf311429367319beaba263c7",
+    "status": "completed",
+    "conclusion": "failure",
+    "windows_job": {
+      "name": "Windows clone and Compose contract",
+      "job_id": "95665197885",
+      "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885",
+      "conclusion": "failure",
+      "native_step": "Run native Windows retained-capability tests",
+      "native_step_conclusion": "failure",
+      "command": "go test ./internal/safeio ./internal/backup -count=1",
+      "requested_packages": ["internal/safeio", "internal/backup"],
+      "executed_packages": ["internal/safeio", "internal/backup"],
+      "not_executed_packages": ["internal/authstorage"],
+      "focused_tests_observed": [
+        "TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion",
+        "TestRemoveCanonicalPrivateClaimPreservesOrphan",
+        "TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup"
+      ],
+      "failure_categories": [
+        "safeio retained-capability tests failed with unsafe file",
+        "backup retained-staging tests failed with unsafe file",
+        "backup TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup timed out after 10m0s",
+        "some backup fixture tests could not read their external-secret declarations"
+      ]
+    },
+    "lf_compose_docs_typescript_job": {
+      "name": "LF, Compose, docs, and TypeScript",
+      "job_id": "95665197839",
+      "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197839",
+      "conclusion": "failure",
+      "failed_step": "Verify Compose and installation contracts",
+      "category": "baseline_ci_contract",
+      "detail": "unified Compose contract passed; test-no-deployment-coupling-scope.sh stopped on TMPDIR: unbound variable",
+      "downstream_steps": "skipped"
+    },
+    "linux_docker_job": {
+      "name": "Linux Docker deployment and rollback",
+      "job_id": "95665197846",
+      "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197846",
+      "conclusion": "failure",
+      "failed_step": "Run unified deployment smoke",
+      "category": "infrastructure_prerequisite",
+      "detail": "Task 13 smoke failed before deployment because rg is required",
+      "cleanup": "PASS",
+      "image_manifest": "not_generated"
+    }
+  },
   "docker_image_evidence": {
     "authentication_smoke": {
       "status": "PASS",
@@ -23,100 +84,130 @@
       "reason": "no_docker_images_exercised"
     },
     "unified_docker_smoke": {
+      "status": "FAIL",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
+      "run_id": "32122302381",
+      "workflow_job_id": "95665197846",
+      "manifest": ".artifacts/task-15/unified-docker-images.json",
+      "reason": "workflow attempt stopped before deployment because rg is required",
+      "cleanup": "PASS",
+      "images": 0,
+      "historical": {
         "status": "PASS",
         "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1",
         "run_id": "20260818070637-66409-30058",
-      "manifest": ".artifacts/task-15/unified-docker-images.json",
         "manifest_sha256": "9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6",
         "images": 5,
         "cleanup": "PASS"
       }
+    }
   },
   "gates": {
-    "task13_lifecycle_carry_ins": {
+    "posix_registry_ownership": {
       "status": "PASS",
-      "evidence": "focused_backup_red_green_full_go_race_build"
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
+      "evidence": "backend Node 24 full suite including local-registry ownership coverage"
     },
-    "platform_private_restore_staging": {
+    "stagearchive_unix_retained_capability": {
       "status": "PASS",
-      "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
-      "evidence": "safeio_unix_ancestor_swap_red_green_and_windows_rootdirectory_static_cross_compile"
+      "evidence": "focused safeio/backup tests, Go race suite, and Unix ancestor-swap coverage"
     },
-    "provider_fixture": {
+    "windows_claim_retained_capability": {
-      "status": "PASS",
+      "status": "FAIL",
-      "tests": 6,
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
-      "node": "v24.16.0"
+      "evidence": "native Windows workflow step failed"
     },
-    "backend_node24_round1": {
+    "workflow_lf_compose_docs_typescript": {
-      "status": "PASS",
+      "status": "FAIL",
-      "tests": 1081,
+      "classification": "baseline_ci_contract",
-      "files": 75
+      "reason": "TMPDIR was unset after the unified Compose contract passed"
     },
-    "frontend_node24_round1": {
+    "workflow_linux_docker": {
-      "status": "PASS",
+      "status": "FAIL",
-      "tests": 444,
+      "classification": "infrastructure_prerequisite",
-      "files": 61
+      "reason": "runner did not provide rg; cleanup proof passed and no image manifest was generated"
     },
-    "authentication_and_f1_smoke": {
+    "go_security_build": {
       "status": "PASS",
-      "playwright": 8,
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
-      "files": 2,
+      "focused_packages": 3,
-      "node": "v24.16.0",
+      "race_packages": 18,
-      "sentinel_leak_scan": "PASS",
+      "focused_test": "PASS",
-      "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1"
+      "race": "PASS",
-    },
+      "vet": "PASS",
-    "go_race_build": {
+      "host_build": "PASS"
-      "status": "PASS",
-      "packages": 18,
-      "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1"
     },
     "windows_cross_compile": {
       "status": "PASS",
-      "packages": 18,
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
-      "execution": "cross_compile_only_not_native_execution",
+      "focused_test_packages": 2,
-      "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1"
+      "cli_build": "PASS",
+      "execution": "cross_compile_only_not_native_execution"
     },
-    "shell_and_compose_contracts": {
+    "backend_node24": {
       "status": "PASS",
-      "checks": [
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
-        "shell_syntax",
+      "node": "v24.16.0",
-        "unified_smoke_self_test",
+      "files": 76,
-        "default_compose",
+      "tests": 1092,
-        "unified_compose",
+      "typecheck": "PASS",
-        "compose_secret_policy"
+      "build": "PASS",
-      ],
+      "note": "an initial full run had one workspace-registry timeout; focused rerun and complete rerun passed"
-      "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1"
+    },
+    "frontend_node24": {
+      "status": "PASS",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
+      "node": "v24.16.0",
+      "files": 61,
+      "tests": 444,
+      "typecheck": "PASS",
+      "build": "PASS"
+    },
+    "authentication_and_f1_smoke": {
+      "status": "PASS",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
+      "node": "v24.16.0",
+      "filtered_e2e": "1 passed",
+      "sentinel_leak_scan": "PASS"
+    },
+    "harness_pytest": {
+      "status": "FAIL",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
+      "passed": 951,
+      "failed": 1,
+      "skipped": 4,
+      "subtests": 232,
+      "failure": "test_column_decisions::test_f4_emits_column_types: workflow.yaml not found from harness test cwd"
+    },
+    "authentication_docs": {
+      "status": "PASS",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7"
+    },
+    "shell_syntax": {
+      "status": "PASS",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7"
+    },
+    "authentication_smoke_runtime": {
+      "status": "PASS",
+      "node": "v24.16.0",
+      "sentinel_leak_scan": "PASS"
+    },
+    "compose_default": {
+      "status": "FAIL",
+      "reason": "required THT_WORKSPACE_GIT_REMOTE was not available"
+    },
+    "compose_unified": {
+      "status": "FAIL",
+      "reason": "compose.unified.yaml is absent from the frozen source"
     },
     "unified_docker_smoke": {
-      "status": "PASS",
+      "status": "FAIL",
-      "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1",
+      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
-      "run_id": "20260818070637-66409-30058",
+      "workflow_run_id": "32122302381",
-      "images": 5,
+      "reason": "remote workflow attempted the smoke but stopped before deployment because rg is required",
-      "cleanup": "PASS"
+      "cleanup": "PASS",
-    },
+      "image_manifest": "not_generated"
-    "harness_pytest_round1": {
-      "status": "PASS",
-      "passed": 921,
-      "l2_deselected": 4
-    },
-    "authentication_docs_round1": {
-      "status": "PASS"
-    },
-    "windows_native": {
-      "status": "PENDING",
-      "reason": "required_host_prerequisites_unavailable"
-    },
-    "l2": {
-      "status": "PENDING",
-      "reason": "configured_secret_layout_unavailable"
-    },
-    "manual_psd": {
-      "status": "PENDING",
-      "reason": "real_identity_or_access_unavailable"
-    },
-    "provider_readiness": {
-      "status": "PENDING",
-      "reason": "unrelated_host_port_occupied"
     },
     "ruff": {
       "status": "FAIL",
@@ -125,25 +216,49 @@
     },
     "mkdocs_strict": {
       "status": "FAIL",
-      "warnings": 69,
+      "classification": "not_reached_after_stop",
-      "classification": "known_baseline"
+      "historical_status": "FAIL",
+      "historical_warnings": 69
     },
     "canonical_install_docs": {
       "status": "FAIL",
-      "classification": "existing_manual_wording_mismatch"
+      "classification": "not_reached_after_stop",
+      "historical_status": "FAIL"
     },
     "workspace_install_docs": {
       "status": "FAIL",
-      "classification": "existing_manual_wording_mismatch"
+      "classification": "not_reached_after_stop",
+      "historical_status": "FAIL"
     },
     "pi_user_auth_compose": {
       "status": "FAIL",
-      "classification": "existing_model_policy_mismatch"
+      "classification": "not_reached_after_stop",
+      "historical_status": "FAIL"
     },
     "deployment_coupling": {
       "status": "FAIL",
-      "classification": "protected_ignored_local_material"
+      "classification": "not_reached_after_stop",
+      "historical_status": "FAIL"
+    },
+    "l2": {
+      "status": "PENDING",
+      "reason": "configured secret layout unavailable; gate not run after stop"
+    },
+    "manual_psd": {
+      "status": "PENDING",
+      "reason": "approved real identity/access unavailable; gate not run after stop"
+    },
+    "provider_readiness": {
+      "status": "PENDING",
+      "reason": "provider prerequisite unavailable; gate not run after stop"
     }
   },
-  "release_complete": false
+  "review": {
+    "three_important_findings_closed": false,
+    "verdict": "CHANGES_REQUIRED",
+    "reason": "native Windows retained-capability tests failed; the frozen workflow omits internal/authstorage from its native command"
+  },
+  "release_complete": false,
+  "authentication_implementation_complete": false,
+  "release_readiness": "FAIL"
 }

.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md

@@ -1,5 +1,35 @@
 # Task 15 retained release-gate report — fix round 5 (sanitized)
 
+## Task 4 recertification addendum — frozen source `b31b27e5845ffd3adf311429367319beaba263c7`
+
+This addendum supersedes the earlier source-bound matrix for current certification while preserving
+the fix-round-5 material below as historical provenance.
+
+- Certification status: `FAIL` / `CHANGES_REQUIRED`; no tracked source changed after the freeze.
+- Native Windows workflow run `32122302381` was dispatched on the exact frozen SHA and concluded
+  `failure`. Job `Windows clone and Compose contract` (`95665197885`) executed the native
+  `safeio`/`backup` test command, which failed; `internal/authstorage` was not part of that frozen
+  workflow command.
+- Local current results: Go focused/race/vet/build and Windows cross-compile PASS; Node 24 backend
+  `76 files / 1092 tests`, frontend `61 files / 444 tests`, typechecks/builds and authentication
+  smoke PASS; harness `951 passed / 1 failed / 4 skipped`, Ruff `192` errors, and Compose contracts
+  FAIL; authentication docs and shell syntax PASS.
+- The same run's `LF, Compose, docs, and TypeScript` job (`95665197839`) failed on an unset `TMPDIR`
+  in the deployment-coupling scope script after its unified Compose contract passed; this is a
+  baseline/CI contract issue. Its Linux Docker job (`95665197846`) stopped before deployment because
+  `rg` was unavailable; cleanup proof passed and no image manifest was generated, so this is an
+  infrastructure prerequisite issue rather than a source-bound Docker result.
+- The remote unified Docker smoke attempt therefore failed before deployment; the existing image
+  manifest below remains historical and is not evidence for the new source.
+- Current machine-readable evidence and the requested Task 4 report are recorded in
+  `.artifacts/task-15/automated-gates.json` and
+  `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`.
+- Current automated-gates SHA-256: `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`.
+- Historical unified Docker manifest SHA-256: `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`.
+
+The complete sanitized Task 4 matrix and the separate remediation/release verdicts are in the
+requested Task 4 report.
+
 - Final tested source commit: `74b062f1a737103524cbe706346cfd65f87cdfd1`.
 - Historical retained source commits: fix-round-2 `fe190e7046acc173f510dddcb32f46ed142858c1`,
   maintenance follow-up `4d230b87afdcd24f02264f8f937c8628b92db05a`, prior final Docker
@@ -7,7 +37,7 @@
   archive privacy `54698e73400a54ce7c3e6c10099e14eb471ce8b9`.
 - Versions: Node contract `v24.16.0`; host default Node `v25.6.1`; Go `go1.26.5`;
   Pi `0.80.3`.
-- Automated gate artifact: `.artifacts/task-15/automated-gates.json`;
+- Historical automated gate artifact: `.artifacts/task-15/automated-gates.json`;
   SHA-256 `7d9ec93af15510605f1aa7179b26a7ee46d78122f647854300f7a9922057a63f`.
 - Docker image manifest: `.artifacts/task-15/unified-docker-images.json`;
   SHA-256 `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`.

.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md

@@ -0,0 +1,97 @@
+# Task 4 authentication remediation recertification (sanitized)
+
+## Result
+
+- Frozen source under test: `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`.
+- Freeze check: PASS. No tracked source changed during certification. The only untracked paths
+  retained are `.playwright-cli/` and `.thothctl/`.
+- Certification window: `2026-08-18T09:26Z` to `2026-08-18T09:48:36Z` (UTC; the start marker is
+  minute-precision because no earlier second-level operator timestamp was captured).
+- Overall result: `FAIL` / `CHANGES_REQUIRED`. The three Important findings are not closed and
+  authentication is not implementation-complete or release-complete.
+
+## Local gate matrix
+
+| Gate | Result | Sanitized evidence |
+|---|---|---|
+| Go focused security tests | PASS | `safeio`, `backup`, and `authstorage`; 3 packages |
+| Go race/vet/host build | PASS | 18 race-tested packages; vet and host CLI build exit 0 |
+| Windows amd64 cross-compile | PASS | focused safeio/backup test binaries and CLI build; compile-only |
+| POSIX registry ownership | PASS | Node 24 backend suite includes local-registry ownership coverage |
+| Unix StageArchive retained capability | PASS | focused safeio/backup and race coverage passed on host |
+| Backend Node 24 | PASS | 76 files / 1092 tests; typecheck and build passed |
+| Frontend Node 24 | PASS | 61 files / 444 tests; typecheck and build passed |
+| Authentication/F1 browser smoke | PASS | Node `v24.16.0`; filtered E2E 1 passed; sentinel scan passed |
+| Harness pytest | FAIL | 951 passed, 1 failed, 4 skipped, 232 subtests; `test_f4_emits_column_types` could not find `workflow.yaml` from its test cwd |
+| Ruff | FAIL | 192 errors; known baseline |
+| Authentication docs smoke | PASS | required-term and forbidden-word checks passed |
+| Shell syntax | PASS | `bash -n scripts/*.sh` |
+| Default Compose contract | FAIL | required `THT_WORKSPACE_GIT_REMOTE` was unavailable |
+| Unified Compose contract | FAIL | `compose.unified.yaml` is absent from the frozen source |
+| Unified Docker smoke | FAIL | workflow attempted it on the frozen SHA but stopped before deployment because `rg` was unavailable; cleanup proof passed and no new image manifest was generated |
+| L2 / PSD manual / provider readiness | PENDING | required external secrets, identities/access, or provider prerequisites unavailable/not reached |
+
+The first full backend Vitest attempt had one workspace-registry timeout. The focused test and a
+fresh complete rerun passed, so the current backend result above is the fresh complete rerun.
+
+## Native Windows authority
+
+The authorized dispatch was bound to the frozen SHA:
+
+- Run: `32122302381`
+- URL: https://github.com/mptyl/ThothII/actions/runs/32122302381
+- Head SHA: `b31b27e5845ffd3adf311429367319beaba263c7`
+- Workflow conclusion: `failure`
+- Job: `Windows clone and Compose contract`, job `95665197885`
+- Job URL: https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885
+- Native step: `Run native Windows retained-capability tests` — `failure`
+- Executed command: `go test ./internal/safeio ./internal/backup -count=1`
+- Observed focused failures include `TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion`
+  and `TestRemoveCanonicalPrivateClaimPreservesOrphan`.
+- The backup package timed out in
+  `TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup` after `10m0s`.
+- Additional backup failures included retained-staging `unsafe file` results, Windows temporary-file
+  cleanup reporting that a file was still in use, and fixture cases that could not read external
+  secret declarations. The first two categories are remediation/security-boundary failures; the
+  fixture declaration failures are recorded as an accompanying CI-fixture issue.
+- `internal/authstorage` was not requested by the frozen workflow step and therefore has no native
+  Windows execution evidence. Cross-compilation does not substitute for this gate.
+
+This native failure is the blocking gate. No source fix was attempted, and no later Docker smoke
+was run locally after the failure.
+
+## Other workflow failures
+
+- `LF, Compose, docs, and TypeScript` (job `95665197839`) failed in
+  `Verify Compose and installation contracts` after the unified Compose contract itself passed.
+  `test-no-deployment-coupling-scope.sh` aborted on `TMPDIR: unbound variable`; this is classified
+  as a baseline/CI contract prerequisite, and later docs/TypeScript steps were skipped.
+- `Linux Docker deployment and rollback` (job `95665197846`) failed before deployment because the
+  runner did not provide `rg` (`Task 13 smoke failed: rg is required`). The sanitized cleanup proof
+  passed and no Docker image manifest was generated. This is classified as an infrastructure
+  prerequisite failure, not as evidence of a remediation regression.
+
+## Evidence and provenance
+
+- Current machine-readable matrix: `.artifacts/task-15/automated-gates.json`; SHA-256
+  `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`.
+- Current requested report: this file (SHA-256 recorded after the evidence commit if needed for
+  external indexing).
+- Historical Docker image manifest: `.artifacts/task-15/unified-docker-images.json`, unchanged
+  because no new immutable-source Docker smoke ran. Its retained historical SHA-256 is
+  `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`, bound to historical source
+  `74b062f1a737103524cbe706346cfd65f87cdfd1`, not to this Task 4 candidate.
+- The historical Task 15 report remains provenance for earlier source SHAs; its current addendum
+  records this recertification separately.
+
+No credentials, tokens, internal endpoints, provider identities, registry names, raw environments,
+or browser traces are retained here.
+
+## Separate verdicts
+
+- Three Important findings: `CHANGES_REQUIRED`. Native Windows retained-capability authority
+  failed, and the frozen workflow omits the required `authstorage` package from its native command.
+- Overall release readiness: `FAIL` with additional `PENDING` gates. The native Windows remediation
+  gate failed; the remote Docker attempt failed on a missing runner prerequisite; existing
+  Ruff/harness/Compose failures and external/manual prerequisites remain unresolved; and no
+  successful new unified Docker image evidence exists.

PROJECT_STATE.md

@@ -7,70 +7,41 @@
 > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base
 > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici
 > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato.
-> Last updated: 2026-08-18 (Task 15 and final whole-branch reviews recorded; both are CHANGES
+> Last updated: 2026-08-18 (Task 4 recertification recorded; native Windows authority failed and
-> REQUIRED and the authentication feature is not implementation- or release-complete).
+> the authentication feature is not implementation- or release-complete).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
-### Task 15 authentication — automated smoke PASS, final review CHANGES REQUIRED (2026-08-18)
+### Task 4 authentication recertification — FAIL, native Windows CHANGES REQUIRED (2026-08-18)
 
-- Task 13 carry-ins are closed with focused TDD: restore acquires the lifecycle lock before
+- Frozen source under test is `b31b27e5845ffd3adf311429367319beaba263c7` on `feat/thoth-auth`.
-  target-dependent preflight; stages the immutable candidate and recovery archives under that lock;
+  No tracked source changed during certification; only `.playwright-cli/` and `.thothctl/` remain
-  accounts their combined capacity before mutation; and uses an opaque installation-bound
+  untracked.
-  transaction capability. Fix-round-5 makes private archive creation retain its validated parent
+- Local PASS: Go focused security tests for `safeio`, `backup`, and `authstorage`; Go race across
-  through the full create/metadata/failure-cleanup sequence: Unix uses `openat` plus descriptor
+  18 packages; `go vet`; host build; Windows amd64 cross-compile; Node `v24.16.0` backend
-  `fchmod`/`fstat` and `unlinkat`; Windows uses NT `RootDirectory`-relative traversal and final
+  `76/1092` and frontend `61/444` with typecheck/build; authentication/F1 smoke and sentinel
-  create with the owner-only DACL applied in that same operation. Capacity, lifecycle, rollback,
+  scan; authentication docs smoke; shell syntax.
-  and streaming tests pass, but the final review found that StageArchive drops the retained
+- Local FAIL: harness `951 passed / 1 failed / 4 skipped` (the F4 column-decision test cannot find
-  capability before pathname-based staging cleanup; an ancestor swap can therefore strand the
+  `workflow.yaml` from its test cwd); Ruff `192` errors; default Compose missing its required
-  secret-bearing archive or redirect cleanup. Deterministic StageArchive swap-and-cleanup tests are
+  workspace-remote variable; unified Compose references absent `compose.unified.yaml`.
-  still required on Unix and native Windows.
+- Authorized workflow run `32122302381` (URL in the Task 4 report) has the exact frozen SHA and
-- Final tested source is `74b062f1a737103524cbe706346cfd65f87cdfd1`; fix-round-4
+  conclusion `failure`. Its `Windows clone and Compose contract` job `95665197885` really ran the
-  `54698e73400a54ce7c3e6c10099e14eb471ce8b9`, prior final Docker source
+  native `safeio`/`backup` command and failed, including a 10-minute backup lifecycle-lock
-  `e20bf33e2a00102192e5be66b178037aeca3a7b1`, fix-round-2
+  timeout. The frozen workflow does not request `internal/authstorage`, so that native evidence is
-  `fe190e7046acc173f510dddcb32f46ed142858c1`, and follow-up
+  absent rather than inferred from cross-compilation.
-  `4d230b87afdcd24f02264f8f937c8628b92db05a` remain historical provenance. The final unified
+- The same run's LF/Compose/docs/TS job failed on an unset `TMPDIR` after its unified Compose
-  Docker smoke is PASS for run `20260818070637-66409-30058`, exactly bound to `74b062f...`,
+  contract passed (baseline/CI contract). Its Linux Docker job failed before deployment because
-  including maintenance auth isolation, restore, registry lifecycle, rollback, five-image
+  `rg` was unavailable; cleanup proof passed and no new image manifest was generated (runner
-  revalidation, and task-scoped cleanup.
+  prerequisite). The historical five-image manifest remains bound to source
-- PASS on pinned Node `v24.16.0`: provider security fixture 6/6 and current authentication/F1
+  `74b062f1a737103524cbe706346cfd65f87cdfd1` and was not rewritten for this candidate. L2, real
-  Playwright smoke 8/8 with the runtime sentinel used as the exact fixture credential and absent
+  PSD/manual acceptance, and provider readiness remain `PENDING` where prerequisites are unavailable.
-  from retained output. Round-1 full suites remain PASS: backend 75 files / 1081 tests, frontend
+- Durable current evidence is tracked in `.artifacts/task-15/automated-gates.json` and
-  61 files / 444 tests, harness 921 passed / 4 L2 deselected. The host default Node is `v25.6.1`;
+  `.superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md`; the historical
-  it is not the release contract and no tracked `v24.19.0` pin exists.
+  Task 15 report contains a separate Task 4 addendum. Current automated-gates SHA-256 is
-- PASS: focused RED then GREEN Unix ancestor-swap creation test; full backup/safeio tests;
+  `e0cb84185354b740ce97c8d21d365160b321c88722d08cc31b668ec4cab0353c`; the unchanged historical
-  final-source Go race/vet/native-host build across 18 packages; Windows amd64 static test/build
+  Docker manifest SHA-256 is `9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`.
-  cross-compile across 18 packages; Node 24 authentication smoke; shell syntax and unified safety
+- **Implementation/release state: NOT COMPLETE.** The three Important findings remain
-  self-tests; default/unified Compose and secret-policy contracts; final unified Docker smoke and
+  `CHANGES_REQUIRED`; overall release readiness is `FAIL` with additional `PENDING` gates. No
-  cleanup. Windows results are compile-only; the native retained-handle
+  source fix was attempted in Task 4.
-  `ValidatePrivateRegular` test was not executable on this host and remains PENDING.
-- Durable sanitized evidence is tracked at `.artifacts/task-15/automated-gates.json`
-  (`7d9ec93af15510605f1aa7179b26a7ee46d78122f647854300f7a9922057a63f`),
-  `.artifacts/task-15/unified-docker-images.json`
-  (`9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`), and
-  `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md`
-  (`9e4737e84bb9fb866eb0ee9ba2660f0fcfdef0c081dde11f19f6078c59b1bf56`). Authentication smoke
-  exercised no Docker images; the final unified run retained all five exercised image identities.
-- FAIL baseline evidence remains unchanged: Ruff reports 192 errors; MkDocs strict reports 69
-  warnings; canonical/workspace install checks have existing wording mismatches; Pi user-auth
-  Compose has the existing model-policy mismatch; deployment coupling sees preserved ignored private
-  material.
-- PENDING: native Windows execution because required host prerequisites are unavailable; real
-  PSD/manual acceptance because no real identity/access is available; L2 because its configured
-  secret layout is unavailable; isolated provider readiness because an unrelated host port is
-  occupied. These are not PASS claims.
-- Final Task 15 review after fix round 5 is **CHANGES REQUIRED**. In addition to the StageArchive
-  cleanup race above, Windows claim removal closes validated retained parent handles before using
-  pathname-based `DeleteFile`, leaving an ancestor-swap race. The five-round breaker is exhausted;
-  no sixth implementation round was started.
-- Final whole-branch review found one additional Important defect: on POSIX, the local-user registry
-  checks type, link count, and mode but not effective-UID ownership for `users.yaml` and its parent.
-  A foreign-owned `0600` registry can therefore remain writable by that owner and alter local
-  credentials or roles, including administrator access. Add fail-closed ownership checks on every
-  POSIX registry path and foreign-owner rejection coverage.
-- **Implementation/release state: NOT COMPLETE.** Resolve both Important code-review findings and
-  the registry-ownership finding, rerun the affected tests/reviews, then make every required
-  FAIL/PENDING gate PASS in an eligible environment before marking authentication complete or
-  release-accepted. The branch is not ready to merge.
 
 ### P3 effective configuration and `.tht-dwh` — implementation complete, automated PASS, manual PASS (2026-08-13)