{
"schema": "hiverelay-vnext-program-state-v1",
"releaseTrain": {
"candidatePattern": "v0.25.0-rc.N",
"artifactBaseline": {
"tag": "v0.24.3",
"commit": "d0190577c5eccd10b7e4ae84baf2dc7b0f2b1c80"
},
"integrationBase": {
"branch": "feat/vnext-integration",
"commit": "999b0afd7584bb727cef6e6a88a054f11513927a"
}
},
"profiles": [
{
"id": "public-t1-gateway",
"status": "active-ship-track",
"claim": "Public exact-byte HTTPS distribution; no blind privacy claim",
"requiredGates": [
"PG-0",
"PG-1",
"PG-3",
"PG-5",
"PG-6"
],
"liveTip": "feat/vnext-gateway-merge canary-preflight pass (transitional admission)",
"remaining": [
"operator: staging host + DNS + TLS + one app key",
"live probe preflight on staging",
"24h observation",
"frozen T1 admission before --mode fleet",
"D-5 collateral: never claim blind privacy"
],
"priority": 1
},
{
"id": "direct-blind-g2s",
"status": "parked-per-D-1",
"claim": "Direct blind storage with disclosed stable access metadata (G2-S)",
"requiredGates": [
"PG-0",
"PG-1",
"PG-2",
"PG-3",
"PG-4",
"PG-5",
"PG-6"
],
"liveTip": "feat/vnext-gateway-merge@2ab0cb625910 with gateway storage redesign present",
"remaining": [
"D-1/D-6/D-7 before specHash",
"CR/V gate closure on one ABI",
"daemon production readiness gates",
"browser artifact evidence-bound releaseReady",
"seven-day soak / disposable cohort"
],
"priority": 99
},
{
"id": "g3-randomized-cells",
"status": "spec-only",
"claim": "At-rest unlinkability only after repair, placement, renewal-correlation, and classifier evidence",
"requiredGates": [
"PG-0",
"PG-1",
"PG-2",
"PG-3",
"PG-4",
"PG-5",
"PG-6"
]
},
{
"id": "split-web-ohttp-v1",
"status": "spec-only",
"claim": "Source-separated browser ingress and storage only with independent operators",
"requiredGates": [
"PG-0",
"PG-1",
"PG-2",
"PG-3",
"PG-4",
"PG-5",
"PG-6"
]
},
{
"id": "browser-hc11-cs7",
"status": "discovery-only",
"claim": "Browser Hypercore 11/Corestore 7 storage after IndexedDB conformance and real-browser evidence",
"requiredGates": [
"PG-0",
"PG-3",
"PG-4",
"PG-5",
"PG-6"
]
}
],
"decisions": [
{
"id": "D-1",
"owner": "product-owner",
"deadline": null,
"status": "decided",
"question": "Ship an honestly labelled direct G2-S invitation canary before advanced blind profiles?",
"recommendation": "approve-direct-g2s-canary",
"recommendationRationale": "A bounded invitation canary yields real workload evidence without borrowing OHTTP, CORE, FORWARD, or G3 claims.",
"affectedProfiles": [
"direct-blind-g2s"
],
"blocks": [
"T09",
"direct-blind-g2s"
],
"supersededAssumptions": [
"The first blind canary must wait for every transport and storage family."
],
"selected": "wait-for-full-advanced-blind-before-canary",
"rationale": "Owner rejected early honestly-labelled G2-S canary. Peerit blind migration and direct-blind-g2s public canary wait until advanced blind profiles are ready. NOTE: tension with D-3 (G3 deferred) and D-4 (self-ops only) \u2014 define which advanced profile unblocks first canary (e.g. OHTTP with independent operator only).",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": false,
"recommendationWas": "approve-direct-g2s-canary"
},
{
"id": "D-2",
"owner": "product-owner",
"deadline": null,
"status": "decided",
"question": "Which independently controlled operator supplies OHTTP ingress?",
"recommendation": "require-independent-ingress-operator",
"recommendationRationale": "OHTTP mechanics under one operator do not establish source separation or a non-collusion boundary.",
"affectedProfiles": [
"split-web-ohttp-v1"
],
"blocks": [
"split-web-ohttp-v1",
"G2-W",
"G4-T"
],
"supersededAssumptions": [
"Running ingress and storage as separate processes under one operator is independent operation."
],
"selected": "require-independent-ingress-operator",
"rationale": "OHTTP / split-web claims require a separate ingress operator with independent control, keys, hosts, deploy access, logs, and failure domain. Same-operator OHTTP may prove mechanics only; effective claim remains G2-S until independence is real.",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": true,
"recommendationWas": "require-independent-ingress-operator"
},
{
"id": "D-3",
"owner": "product-owner",
"deadline": null,
"status": "decided",
"question": "Who owns and funds G3 repair, cadence, offline-writer behavior, and repair-hint authenticity?",
"recommendation": "defer-g3-until-repair-contract",
"recommendationRationale": "Randomized cells are not a durable G3 product until repair responsibility, placement, renewal cadence, and incentives are operationally owned.",
"affectedProfiles": [
"g3-randomized-cells"
],
"blocks": [
"g3-randomized-cells",
"V-8"
],
"supersededAssumptions": [
"Randomized cell names alone make renewal and placement unlinkable."
],
"selected": "defer-g3-until-repair-contract",
"rationale": "No G3 product commitment or marketing until repair ownership, payment, cadence, offline-writer behavior, and repair-hint authenticity are defined and evidenced.",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": true,
"recommendationWas": "defer-g3-until-repair-contract"
},
{
"id": "D-4",
"owner": "product-owner-legal",
"deadline": null,
"status": "decided",
"question": "What operator liability, takedown, retention, and acknowledgement posture is approved?",
"recommendation": "require-jurisdiction-aware-operator-policy",
"recommendationRationale": "Third-party operators need an explicit abuse, locator-report, retention, acknowledgement, and jurisdiction contract before recruitment.",
"affectedProfiles": [
"direct-blind-g2s",
"g3-randomized-cells",
"split-web-ohttp-v1"
],
"blocks": [
"third-party-operator-recruitment",
"PG-7"
],
"supersededAssumptions": [
"Opaque payload storage removes operator policy and legal responsibilities."
],
"selected": "self-operated-relays-only-for-now",
"rationale": "No third-party storage operator recruitment until a full jurisdiction-aware operator policy pack exists. For now only self-operated relays. Blocks independent-operator and multi-operator collusion claims.",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": false,
"recommendationWas": "require-jurisdiction-aware-operator-policy",
"note": "Aligned with caution; chooses self-ops rather than recruiting under draft policy."
},
{
"id": "D-5",
"owner": "product-owner",
"deadline": null,
"status": "decided",
"question": "Keep the HTTPS gateway as the separately named public-t1-gateway product?",
"recommendation": "keep-separate-t1-product",
"recommendationRationale": "Public exact-byte HTTPS distribution is valuable, but its operator-visible access path must not inherit blind-storage privacy claims.",
"affectedProfiles": [
"public-t1-gateway"
],
"blocks": [
"T05-public-positioning",
"T18-gateway-collateral"
],
"supersededAssumptions": [
"Every HiveRelay delivery surface belongs to one progressively stronger privacy product."
],
"selected": "keep-separate-t1-product",
"rationale": "Public HTTPS gateway is the separately named public-t1-gateway / public-gateway-v1 product for exact-byte public app distribution. It must not inherit blind privacy claims.",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": true,
"recommendationWas": "keep-separate-t1-product"
},
{
"id": "D-6",
"owner": "product-owner",
"deadline": null,
"status": "decided",
"question": "Retain K_partition only with measured benefit and a tested recovery contract, or remove it?",
"recommendation": "remove-unless-measured-benefit",
"recommendationRationale": "An unrecoverable partition secret adds operational failure risk unless measured cross-relay privacy benefit exceeds the backup and rotation burden.",
"affectedProfiles": [
"direct-blind-g2s",
"g3-randomized-cells",
"split-web-ohttp-v1"
],
"blocks": [
"PG-2",
"specHash",
"store-format-freeze"
],
"supersededAssumptions": [
"A private keyed bucket map is automatically worth making store recovery depend on another secret."
],
"selected": "remove-k-partition-unless-measured-benefit",
"rationale": "Do not freeze K_partition into store layout. Prefer simpler recovery. Revisit only if measured cross-relay privacy benefit justifies a tested backup/rotation/recovery contract.",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": true,
"recommendationWas": "remove-unless-measured-benefit"
},
{
"id": "D-7",
"owner": "product-owner",
"deadline": null,
"status": "decided",
"question": "Acknowledge that rollback after the first blind-only write is dual-read only, never legacy-only?",
"recommendation": "approve-dual-read-rollback-floor",
"recommendationRationale": "A legacy-only rollback after blind-only writes would hide or strand accepted state and is therefore not a valid recovery path.",
"affectedProfiles": [
"direct-blind-g2s",
"g3-randomized-cells",
"split-web-ohttp-v1"
],
"blocks": [
"PG-2",
"T09-migration-runbook",
"specHash"
],
"supersededAssumptions": [
"The legacy-only binary remains a safe rollback target after blind-only writes begin."
],
"selected": "dual-read-rollback-only-after-blind-only-write",
"rationale": "After the first successful blind-only write, rollback is only to a dual-read build that understands blind + legacy. Legacy-only binaries are not a valid recovery path.",
"evidence": [
"owner-session-2026-07-13-decision-interview",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"decidedAt": "2026-07-13T11:26:51Z",
"followedRecommendation": true,
"recommendationWas": "approve-dual-read-rollback-floor"
}
],
"gates": [
{
"id": "PG-0",
"status": "in-progress",
"evidence": [
"git/744c6d4d77052d4a1baeb676e99ce27d8f6355df/docs/vnext/workspace-inventory.json",
"git/9a7d6a75f68095aa5833d10f8eb1622411712e44/docs/vnext/blind-peerit-preservation.json",
"git/95098d93db74e5ce1bddaa7a82187244f035c8b9/docs/vnext/blind-peerit-preservation.json",
"git/349db39b0df03582a141bf54f99a3c00af2a375b/docs/vnext/blind-peerit-preservation.json",
"git/5a7af14a1e16ee79bc91a5c663b2406498029106/docs/vnext/hiverelay-main-salvage.json",
"git/ce167bd222c23d246e6a51d9c33fb1ca895b3a19/docs/vnext/peerit-vendor-authority-drift.json",
"git/ad8fbe9b63dfcbd81217582ed8d8c41ebfdd88a8/docs/vnext/peerit-vendor-repair.json",
"git-local/salvage/main-dirty-snapshot-2026-07-13@c360ff7b",
"docs/vnext/salvage-bundles/2026-07-13-main-dirty",
"docs/vnext/HIVERELAY-PHASE0-INTEGRATION-PLAN-2026-07-13.md",
"git/2ab0cb625910db856f01f25db0b18d78ebf17c94/docs/vnext/vnext-gateway-merge-2026-07-13.json"
],
"notes": "Main dirty snapshotted 2026-07-13; P1 patches must not integrate as-is. Prefer vnext credits auth-gate and gateway/salvage storage redesign."
},
{
"id": "PG-1",
"status": "decided-with-open-followups",
"evidence": [
"git/c61be6df8d32693f9b72f479638ea9cdd5ea331b/docs/vnext/program-state.json",
"docs/vnext/owner-decisions-2026-07-13.json"
],
"notes": "D-1..D-7 recorded. D-1 hard-blocks early G2-S canary; open follow-up: which advanced profile unblocks first blind canary given D-3 defers G3 and D-4 is self-ops."
},
{
"id": "PG-2",
"status": "in-progress",
"evidence": [
"git/088ebb7b105fa09578d6c5dd656400d06fa755d2/docs/vnext/blind-handoff-cr-audit.json",
"git/046e845eec67db6061314b3aa9fa48785549f02a/docs/vnext/protocol-remediation.json",
"git/9456f12400e25e02ab0233e3dc069bdda41a8f96/docs/vnext/blind-protocol-v1-field-remediation.json",
"git/67ed85c088f4a6438382a2776619a9aeaa8d04c3/docs/vnext/blind-forward-route-scope-design.md",
"git/5844e25a42f5bfc228580d431c89beffa3a006c7/docs/vnext/blind-v3-staged-put-gate.json",
"git/2692a9a9ef507fe3dce16d21493153dad0f053e7/docs/vnext/blind-cr5-route-scope-candidate.json"
]
},
{
"id": "PG-3",
"status": "in-progress",
"evidence": [
"git/2ab0cb625910db856f01f25db0b18d78ebf17c94/docs/vnext/vnext-gateway-merge-2026-07-13.json#verification",
"docs/vnext/PUBLIC-T1-GATEWAY-GO-NOW-2026-07-13.md#verified-today-local"
]
},
{
"id": "PG-4",
"status": "pending",
"evidence": []
},
{
"id": "PG-5",
"status": "pending",
"evidence": []
},
{
"id": "PG-6",
"status": "pending",
"evidence": []
},
{
"id": "PG-7",
"status": "pending",
"evidence": []
},
{
"id": "PG-8",
"status": "pending",
"evidence": []
},
{
"id": "PG-9",
"status": "pending",
"evidence": []
},
{
"id": "PG-10",
"status": "pending",
"evidence": []
}
],
"tracks": [
{
"id": "T00",
"status": "in-progress",
"handoffs": [
"git/744c6d4d77052d4a1baeb676e99ce27d8f6355df/ecosystem-custody-inventory",
"git/c61be6df8d32693f9b72f479638ea9cdd5ea331b/owner-decision-controls"
]
},
{
"id": "T01",
"status": "in-progress",
"handoffs": [
"git/9a7d6a75f68095aa5833d10f8eb1622411712e44/blind-peerit-preservation",
"git/95098d93db74e5ce1bddaa7a82187244f035c8b9/blind-reproducibility-repair",
"git/349db39b0df03582a141bf54f99a3c00af2a375b/peerit-independent-verification",
"git/5a7af14a1e16ee79bc91a5c663b2406498029106/hiverelay-main-salvage",
"git/ce167bd222c23d246e6a51d9c33fb1ca895b3a19/peerit-vendor-authority-drift",
"git/ad8fbe9b63dfcbd81217582ed8d8c41ebfdd88a8/peerit-vendor-repair",
"git-local/salvage/main-dirty-snapshot-2026-07-13@c360ff7b",
"git/2ab0cb625910db856f01f25db0b18d78ebf17c94/vnext-gateway-merge"
]
},
{
"id": "T01B",
"status": "in-progress",
"handoffs": [
"git/5e90232ddead9e5bab71be75eae2e722f813bba0/credits-auth-remediation",
"git/640b83ec0a5c7836351264e67bf7ab7dce22a056/inherited-baseline-alignment"
]
},
{
"id": "T02",
"status": "in-progress",
"handoffs": [
"git/088ebb7b105fa09578d6c5dd656400d06fa755d2/blind-handoff-cr-audit",
"git/046e845eec67db6061314b3aa9fa48785549f02a/protocol-freeze-guard",
"git/9456f12400e25e02ab0233e3dc069bdda41a8f96/V-1-field-remediation",
"git/67ed85c088f4a6438382a2776619a9aeaa8d04c3/forward-route-scope-design",
"git/5844e25a42f5bfc228580d431c89beffa3a006c7/V-3-staged-put-gate",
"git/2692a9a9ef507fe3dce16d21493153dad0f053e7/CR-5-route-scope-candidate"
]
},
{
"id": "T03",
"status": "in-progress",
"handoffs": [
"git/ce167bd222c23d246e6a51d9c33fb1ca895b3a19/peerit-vendor-authority-drift",
"git/ad8fbe9b63dfcbd81217582ed8d8c41ebfdd88a8/peerit-vendor-repair",
"packages/blind-protocol wire releaseReady; package still draft.1",
"packages/blind-client browser artifact fail-closed until evidence",
"git/2ab0cb625910db856f01f25db0b18d78ebf17c94/vnext-gateway-merge"
]
},
{
"id": "T04",
"status": "in-progress",
"handoffs": [
"packages/blind-daemon draft on feat/vnext-integration",
"packages/blind-edge draft on feat/vnext-integration",
"git/2ab0cb625910db856f01f25db0b18d78ebf17c94/vnext-gateway-merge"
]
},
{
"id": "T05",
"status": "in-progress",
"handoffs": [
"local/hr-https-gateway@0ff54842 public-https-hive-gateway",
"docs/vnext/HIVERELAY-PHASE0-INTEGRATION-PLAN-2026-07-13.md",
"git/2ab0cb625910db856f01f25db0b18d78ebf17c94/vnext-gateway-merge"
]
},
{
"id": "T06",
"status": "pending",
"handoffs": []
},
{
"id": "T07",
"status": "pending",
"handoffs": []
},
{
"id": "T08",
"status": "pending",
"handoffs": []
},
{
"id": "T09",
"status": "pending",
"handoffs": []
},
{
"id": "T10",
"status": "pending",
"handoffs": []
},
{
"id": "T11",
"status": "pending",
"handoffs": []
},
{
"id": "T12",
"status": "pending",
"handoffs": []
},
{
"id": "T13",
"status": "pending",
"handoffs": []
},
{
"id": "T14",
"status": "pending",
"handoffs": []
},
{
"id": "T14M",
"status": "pending",
"handoffs": []
},
{
"id": "T15",
"status": "pending",
"handoffs": []
},
{
"id": "T15H",
"status": "pending",
"handoffs": []
},
{
"id": "T16",
"status": "pending",
"handoffs": []
},
{
"id": "T17",
"status": "pending",
"handoffs": []
},
{
"id": "T18",
"status": "pending",
"handoffs": []
},
{
"id": "T19",
"status": "pending",
"handoffs": []
},
{
"id": "T20",
"status": "pending",
"handoffs": []
},
{
"id": "T21",
"status": "pending",
"handoffs": []
}
],
"lastHiveRelayConductorPass": {
"at": "2026-07-13T11:09:38Z",
"scope": "hiverelay-only-merge",
"peerit": "owned-by-parallel-agent-do-not-touch",
"actions": [
"created feat/vnext-gateway-merge worktree",
"merged gateway 0ff54842 into vnext at 2ab0cb625910db856f01f25db0b18d78ebf17c94",
"resolved package.json conflict union",
"ran blind + gateway + storage focused suites (all pass)"
],
"next": [
"optional: promote merge into feat/vnext-integration after review",
"owner decisions D-5 D-6 D-7",
"staging gateway canary only after frozen T1 admission"
]
},
"lastOwnerDecisionPass": {
"at": "2026-07-13T11:26:51Z",
"allSevenRecorded": true,
"openFollowups": [
"D-1-scope: define the minimum advanced profile that unblocks first blind canary"
]
},
"activeShipTrack": {
"id": "public-t1-gateway",
"setAt": "2026-07-13T11:29:16Z",
"reason": "owner directed: get public HTTPS gateway going for now",
"posture": "staging-canary-only",
"fleetBlockedUntil": "non-transitional T1 admission profile"
}
}