Operational self-hosting alpha record

This record has two evidence layers:

1. deterministic offline black-box acceptance over disposable repositories;
2. a staged public landing verified through ordinary Git transport.

The protocol and threat boundaries are defined in protocol-v0, identity-v0, governance-v0, and replication-v0. Full IDs are used for every public trust-bearing value. Short IDs shown by some inspection commands are display conveniences only.

Offline black-box evidence

Observed on 2026-08-30 with the release-candidate source in this repository:

go test ./... -run TestOperationalSelfHostingAlpha -count=3 -v

The complete three-count command passed in 45.89 seconds. Its three full two-actor operational scenarios completed in 9.13, 9.01, and 8.98 seconds, each below the 120-second bound.

Topology and governance assertions

Every run generated a fresh author clone, reviewer clone, identity-free depth-1 verifier clone, and local bare Git remote. The test generated distinct Ed25519 actors independently; it failed if actor or public-key material was reused or if the reviewer received a legacy identity file.

The synthetic baseline policy trusted only the author actor, allowed author approval, and had no required pipeline. The policy amendment added the second actor as trusted reviewer and runner, disabled author approval, and required one passing test result. The test asserted:

• both full base/head policy digests were reported;
• the second actor's signed review of the amendment was valid but contributed zero trusted approvals under the old base policy;
• the amendment decision signed only the old-policy author's qualifying review, its exact base-policy digest, and no new-actor evidence;
• a later candidate based on the amended policy remained blocked after its author's review and run request;
• it became ready only after the second actor supplied the exact review and passing run result;
• decision and merge facts bound the exact candidate, pipeline definition, proposed head, policy digest, evidence IDs, and resulting Git commit.

The automated runner used the explicitly authorized host backend only for a controlled synthetic printf pipeline. The live public proof records the default Bubblewrap result separately.

Selection, budgets, and isolation

The main scenario saved these positive per-remote budgets:

max-events: 10000
max-objects: 100000
max-object-bytes: 16777216
max-attachment-bytes: 1048576
max-total-bytes: 268435456

Focused boundary tests measured every dimension at one below, exactly equal, and one above the configured limit: measured-above-limit rejected; equality and measured-below-limit promoted.

The hostile remote scenario selected one valid actor, one two-event actor over an event limit of one, one ref whose root was not an event commit, and one well-formed ref name pointing at another actor's chain. It also published an unselected valid actor. The result was:

Crash tests interrupted before object copy, after object copy, before accepted ref commit, after accepted ref commit, and before completion recording. Missing, corrupt, unsafe-mode, symlinked, oversized, or internally inconsistent private anchors/receipts kept trust operations fail-closed. A retry reconciled the exact durable transaction rather than treating copied objects as accepted.

Shallow recovery and identity projection

The depth-limited fixture detected an exact missing actor predecessor, reported the full event/actor IDs and nh sync origin --recover-shallow, promoted only the selected supplier through quarantine, replayed the original operation, and remained a shallow repository. An available but unselected supplier was not added implicitly; recovery refused until the saved exact selection named it.

The main identity-free verifier reconstructed the amendment, role-distinct candidate, reviews, run request/result, decisions, merges, and planned successor authorization/acceptance without any private identity records or local actor ref. A separate two-actor successor-cycle fixture converged on ambiguous for both actors while policy continued to list only its explicit maintainer.

Stable pre-identity event IDs

The deterministic compatibility fixture proves the new optional identity fields do not change existing payload bytes or IDs:

The same focused test also preserves the exact standalone legacy fixture ID sha256:cc324cc49ad14cb8f75e4ff6f112396d966af50546937770d5adb7b8e979f091.

Isolation claims for automated proof

The automated proof used zero public network mutations, zero hosting-provider API calls, zero Docker operations, and zero copied private identity. It reset home, credential-helper, askpass, token, and Hubnot test environment surfaces for subprocesses. Run-specific random actor/event IDs are intentionally not recorded; the assertions above and stable fixture IDs are reproducible.

Public staged proof

Observed on 2026-08-30 against the public ordinary-Git endpoint https://github.com/LynnColeArt/hubnot.git. The same two-stage sequence first passed against a fresh disposable bare remote. The public run then used the reviewed explicit source and destination refs below. No wildcard, deletion, force push, hosting-provider API, or hosting-provider UI supplied evidence.

The initial advertised public state was:

The proof created a distinct reviewer/runner actor and accepted its device relationship without changing project authority:

These are public signing histories and continuity claims. The private keys, active-identity selection, replication selections, and transaction records remained local and were not published. nh sync publishes every local public actor ref required by the signed history, including predecessor histories; continuity is not authority.

Stage 1: identity continuity and old-policy amendment

The candidate changed the policy from sha256:f58220c462cc5faaa1448e7c0e6e548f4ce10705b1352ce6ed0a7a5377eb874c to sha256:e4f68ce6e0d26212683b983a5a99c08a34b34dba8b5cb390fbde0a4d484f0d05. The proposed policy/code commit was a3ef855ca062c191a6c7e5c14709de67bdfb4f1c.

The run used pipeline definition sha256:73874909dd6e6365f6417e56b2bc50292fbebe5446b35a6ab37c550ee875d494. The merge advanced main from the initial commit to 08291d6f363fa68ca66b84d922d46cc8302fc9a0. The merge fact binds that result to the proposed head and the old base-policy digest; the newly accepted actor's review did not qualify under that base policy.

Stage 1 published and then separately verified:

Stage 2: role-distinct release candidate

The release candidate used the stage-1 merge as its base and the metadata-free product/test/documentation commit 07b64dfdb11dc376644e068f201ca998bb54defe as its proposed head. Its exact base policy was the amended digest above.

The distinct actor's result used the same exact pipeline definition, the default sandbox backend, commit 07b64dfdb11dc376644e068f201ca998bb54defe, outcome passed, and duration 52,517 ms. After its review and result arrived, status changed from 0/1 review and 0/1 pipeline to ready. The final merge commit was 7e41574792be828ba507e5df7adda71662475483.

Stage 2 advanced the actor histories and added the release ref first. Those advertised OIDs were checked before main was advanced separately:

Fresh public depth-limited reconstruction

An identity-free depth-1 HTTPS clone selected the two actors and all three candidate histories needed by the maintainer chain. The pre-existing candidate is required because it is referenced by the maintainer history; omitting it correctly reports a missing dependency.

git clone --depth 1 https://github.com/LynnColeArt/hubnot.git verify
cd verify
nh replication select origin \
  --actor 36944394addccd027292abc8183f332af8b4590925291ee8f1e8d8f09446b7dd \
  --actor 10425b859ef6c86afe46e9586a1c26a9fe007f7a0aa38a46a3c316fcfc69a1db \
  --proposal sha256:4fd8813d5849241173eb48bbebd6858535545fa514a80b88d3fdae0e59377290 \
  --proposal sha256:52aee3a8a6fd110321b3506e9408397158d02d3dfe63747cb445effa157e0a95 \
  --proposal sha256:122a6dc9ba587f787897395e89c38bd48aef1f68dc5d7dc35121562a1073371d \
  --max-events 10000 \
  --max-objects 100000 \
  --max-object-bytes 16777216 \
  --max-attachment-bytes 1048576 \
  --max-total-bytes 268435456
nh sync origin
nh proposal status sha256:122a6dc9ba587f787897395e89c38bd48aef1f68dc5d7dc35121562a1073371d
nh identity list
nh log
git rev-parse --is-shallow-repository
git for-each-ref --format='%(refname) %(objectname)' refs/nh/remotes/origin

The selected sync promoted 24 verified events and five selected histories. The release reconstructed as merged with one qualifying distinct review, one trusted sandbox pass, and one acceptance decision. Both public actors and the accepted device relationship reconstructed. git rev-parse --is-shallow-repository remained true. The clone contained neither a private identity keyring nor a legacy identity record, and it contained no local refs/nh/actors/*; accepted public facts were under refs/nh/remotes/origin/*.

Every selected dependency was present, so public recovery was unnecessary. The separate offline fixture above exercises the exact nh sync origin --recover-shallow path and confirms that recovery preserves the shallow boundary.

Verification method

The public verification uses only ordinary Git and the release-candidate nh binary:

git ls-remote --symref origin HEAD
git ls-remote origin 'refs/heads/main' 'refs/nh/actors/*' 'refs/nh/proposals/*'

git clone --depth 1 https://github.com/LynnColeArt/hubnot.git verify
cd verify
nh replication select origin \
  --actor 36944394addccd027292abc8183f332af8b4590925291ee8f1e8d8f09446b7dd \
  --actor 10425b859ef6c86afe46e9586a1c26a9fe007f7a0aa38a46a3c316fcfc69a1db \
  --proposal sha256:4fd8813d5849241173eb48bbebd6858535545fa514a80b88d3fdae0e59377290 \
  --proposal sha256:52aee3a8a6fd110321b3506e9408397158d02d3dfe63747cb445effa157e0a95 \
  --proposal sha256:122a6dc9ba587f787897395e89c38bd48aef1f68dc5d7dc35121562a1073371d \
  --max-events 10000 \
  --max-objects 100000 \
  --max-object-bytes 16777216 \
  --max-attachment-bytes 1048576 \
  --max-total-bytes 268435456
nh sync origin
nh proposal status sha256:122a6dc9ba587f787897395e89c38bd48aef1f68dc5d7dc35121562a1073371d
nh proposal show sha256:122a6dc9ba587f787897395e89c38bd48aef1f68dc5d7dc35121562a1073371d
nh identity list
nh log
git rev-parse --is-shallow-repository
git rev-parse origin/main
git for-each-ref --format='%(refname) %(objectname)' refs/nh/remotes

If an inspection command records a shallow dependency gap, run nh sync origin --recover-shallow; it uses only an already saved exact supplier and does not globally unshallow. A successful initial selected sync may already contain every dependency, in which case recovery is unnecessary and explicitly calling it exits zero after an idempotent accepted-projection verification without writing to standard output or standard error.

Limits of the proof

Two distinct signing keys prove distinct actor histories, not distinct humans. The public host is evidence of ordinary Git ref/object transport, not of its UI or collaboration API. Promotion budgets do not prevent standard Git from downloading a selected pack before measurement. Planned rotation requires the old key. Public immutable facts cannot carry a global erasure guarantee.