From 6cbcf7565434fa18b1da12f3238b4871bf3a039c Mon Sep 17 00:00:00 2001
From: artale <arosstale1@gmail.com>
Date: Thu, 2 Jul 2026 13:08:58 +0200
Subject: [PATCH] docs: quarantine stale phase-claims and gate stale-memory
 refresh

---
 docs/agentic-layer-tac.md                     |  1 +
 .../stale-memory-quarantine-20260702.json     | 21 ++++++++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/docs/agentic-layer-tac.md b/docs/agentic-layer-tac.md
index 475e3dc..afafd0f 100644
--- a/docs/agentic-layer-tac.md
+++ b/docs/agentic-layer-tac.md
@@ -36,6 +36,7 @@ PASS real-engineering verify
 ✓ verifier rule present
 ✓ factory status ok
 ✓ deploy route 8099/deploy present
+✓ stale-memory quarantine receipt refreshed: `fable5 stale-memory-quarantine --output .fable/memory/stale-memory-quarantine-live.json` and checked for `blockedTrustPaths` containing `8098/deploy-webhook` and `canonicalTrustPaths` containing `8099/deploy via git-proxy`
 ✓ verify-cycle receipt written
 ✓ agentic attestation attached
 ```
diff --git a/docs/receipts/stale-memory-quarantine-20260702.json b/docs/receipts/stale-memory-quarantine-20260702.json
index 567e7d5..1ee9e58 100644
--- a/docs/receipts/stale-memory-quarantine-20260702.json
+++ b/docs/receipts/stale-memory-quarantine-20260702.json
@@ -3,12 +3,30 @@
   "createdAt": "2026-07-02T00:00:00.000Z",
   "source": "factory/deploy memory reconciliation against current policy",
   "claims": [
+    {
+      "claim": "25 Docker containers all UP and container/agent/skill inventory from memory is canonical",
+      "staleBecause": "this snapshot is stale memory and later live/committed receipts show differing authoritative state checks",
+      "replacementTruth": "container/deployment authority follows live receipt > committed receipt > memory; reconcile against current live checks before any decision",
+      "severity": "advisory"
+    },
     {
       "claim": "8098/deploy-webhook is the trusted deploy path",
       "staleBecause": "current policy marks 8098/deploy-webhook as legacy/internal/stale, not canonical deploy authority",
       "replacementTruth": "8099/deploy via git-proxy is the canonical signed/gated deploy route",
       "severity": "dangerous"
     },
+    {
+      "claim": "agents/loops can perform raw POST deploy or signed-action-less autonomous deployment",
+      "staleBecause": "safety policy requires explicit approval and fresh ZTE/factory gate receipts; autonomous POST deploy remains unsafe/unproved",
+      "replacementTruth": "guarded 8099/deploy via git-proxy with explicit approval and fresh route-health proof",
+      "severity": "dangerous"
+    },
+    {
+      "claim": "Phase 4 recursive self-improvement and full non-canary auto-patch repair is proven",
+      "staleBecause": "memory-only phase claims are not current authority and non-canary recovery receipts are still missing",
+      "replacementTruth": "auto_patch_proven remains false until a fresh local degraded-skill recovery receipt is produced",
+      "severity": "dangerous"
+    },
     {
       "claim": "memory-only factory/deploy state can authorize deploy",
       "staleBecause": "current policy orders authority as live receipt > committed receipt > memory",
@@ -19,7 +37,8 @@
   "blockedTrustPaths": [
     "8098/deploy-webhook",
     "memory-only deploy authority",
-    "autonomous deploy without fresh gate receipt"
+    "autonomous deploy without fresh gate receipt",
+    "raw signed/action-less POST deploy claims"
   ],
   "canonicalTrustPaths": [
     "live receipt > committed receipt > memory",