{
  "status": "Proposed startup component; no command mounting or database integration",
  "parent_contracts": [
    "home-operator-open.md at approved 4770bc6",
    "platform maintenance-launch.md at approved 8eb788c9",
    "home-provisioner.md at approved 898fe219"
  ],
  "alignment": "The prior opened-DB contract listed fd0/1/2/3. The reviewed platform launch adds fd4 as a startup-only readonly artifact pin. Home verifies fd4 against /proc/self/exe and closes both executable descriptors with checked errors before any opened-DB baseline. fd4 never becomes an exception in the database descriptor inventory. Consumed fd0/fd3/fd4 are closed by atomic replacement with readonly /dev/null, preserving their reservation and preventing os.Stdin from aliasing a future SQLite file. The private /dev/null source is closed after replacement. Executable descriptors do not enter the regular-file baseline.",
  "implementation": "internal/operatorlaunch.ReadOperator checks mutable-v1 metadata using the shared exact-pinned launchctx module. No HTTP or command entrypoint invokes it yet.",
  "ordering": [
    "Read only the private FIFO at fd3 under a five-second startup bound and caller cancellation; cap at 8192 plus one byte, require EOF, close with checked error, reject malformed or checker-mode context.",
    "Require byte-exact database selector equality. Apply the earlier of startup timeout, caller deadline and context execution deadline.",
    "Require fd4 readonly regular identity equal to opened /proc/self/exe, stream the actual executable SHA256 and compare artifact_digest, and check all executable descriptor closures.",
    "Read only private FIFO stdin with 65536 plus one byte bound and EOF; match exact input_sha256 and check stdin closure. A failed startup returns only a fixed error and no private result bytes.",
    "The future command adapter must next validate the signed Home request using pinned role/origin/action/configuration, then construct the existing opened-DB connector. Startup metadata alone grants no mutation or worker authority. No database is opened by this component."
  ],
  "boundary": "Native Linux, fixed nonserving trusted-worker process. The worker owns actual owner approval, lifecycle fence, continuous lease, verified release/environment and strict containment. Neither synthetic inherited descriptors nor metadata establish those facts.",
  "verification": [
    "Actual subprocesses with both default Go runtime and controlled fixture runtime settings",
    "Valid v2 checker context rejected by mutable-v1 reader",
    "Regular-file context/stdin and same-inode O_PATH executable descriptor rejected",
    "Wrong context, oversized input/context, wrong selector/hash/image/flags and expired deadline refuse",
    "Stalled context and stdin terminate under the two-second caller deadline (the component also sets an independent five-second upper bound)",
    "fd0/fd3/fd4 refer to readonly /dev/null on return; a subsequently opened regular file uses a descriptor above 4 and remains usable after os.Stdin.Close; database sentinel remains unchanged"
  ],
  "remaining_before_mount": [
    "Fable review of this alignment and source",
    "Fixed pinned configuration schema and signed-request binding in final command adapter",
    "Modernc package-init and opened-DB baseline call-graph review",
    "Native full worker plus consumer integration",
    "Real owner-approved preview provisioning and restore drill"
  ],
  "review_history": [
    {
      "revision": "6143a83",
      "model": "claude-fable-5-1",
      "verdict": "REQUEST_CHANGES",
      "receipt": "/home/paulca/.cache/oficina-provisioning-20260911/home-startup-review/review.json",
      "required": [
        "Atomically replace consumed descriptors with readonly /dev/null",
        "Prove regular-file context/stdin refusal"
      ]
    }
  ],
  "parent_contract_note": "Platform maintenance-launch.md retains a stale pending annotation. Actual approvals are recorded in platform discussion117; this Home alignment and source require their own fresh verdict before mounting."
}