{
  "status": "Proposed private adapter component; no command or HTTP mounting",
  "parents": [
    "Home startup6289db0 with Fable approval",
    "Opened DB4770bc6",
    "Operator/provisioner898fe219"
  ],
  "configuration": {
    "source": "HOME_OPERATOR_COMMAND from the worker's immutable protected app environment; never argv or signed-request fields",
    "wire": "UTF-8 JSON at most8192 bytes; duplicate, unknown and missing fields refuse",
    "fields": [
      "version=1",
      "account",
      "app",
      "host",
      "role",
      "origin",
      "installation",
      "registry",
      "device",
      "public_key",
      "key_id",
      "actions"
    ],
    "validation": "Shared route validators, existing NewVerifier role/origin/identity/key/action checks, and exact derived key ID match. No default, trust-on-first-input or key rotation by request.",
    "origin_and_host": "Transport host names the deployment endpoint; signed origin is the canonical Home identity origin and can differ during preview/custom-host routing. Both are independently pinned from protected configuration and matched against their corresponding transport or signed fields; neither is derived from the other."
  },
  "ordering": [
    "Parse protected configuration and build the existing signature verifier before database access.",
    "Consume reviewed private startup transport; preserve /dev/null reservations on fd0/3/4 until the database baseline.",
    "Match launch account/app/host against protected configuration; verify exact signed Home request using pinned role/origin/actions/installation/registry/device/key.",
    "Only then construct the opened-DB connector for context path/device/inode, bounded by the earlier caller/launch deadline.",
    "Keep platform request/attempt IDs distinct from the signed Home operation ID; retain exact private signed bytes for the existing transactional engine.",
    "Final cleanup checks pinned database identity, closes the database and clears retained private byte buffers; any uncertain cleanup/deadline yields unavailable, never a successful result."
  ],
  "replay": "Expired authentic requests remain eligible for the existing engine's exact committed-result recovery. The adapter does not grant freshness or execute a mutation. The engine separately enforces freshness before a new operation.",
  "tests": "Real inherited-descriptor subprocesses plus Linux inotify IN_OPEN prove wrong signer, signed scope, configuration and transport scope refuse before any database open. Actual pinned modernc connection accepts the valid path; wrong inode is opened only for identity refusal. Closed config tests cover every missing field, duplicates, unknown fields, trailing data and key mismatch. Real subprocess cleanup refuses a swapped database and expired caller deadline, refuses a second close, and parent checks original rows unchanged. Descriptor tests pair controlled and default Go runtime settings. Oversized valid JSON is refused.",
  "remaining": [
    "Fable approval of configuration alignment and component",
    "Final fixed command dispatch, role-specific key/sealer/owner resolver and schema checks",
    "Native worker authentication, owner approval, lease/fence/checkpoint and resume workflow",
    "Whole integration/canary validation before any live invocation"
  ]
}