{
  "schema": "fable.stale_memory.quarantine.v1",
  "createdAt": "2026-07-02T00:00:00.000Z",
  "source": "factory/deploy memory reconciliation against current policy",
  "claims": [
    {
      "claim": "memory-only factory snapshot that 25 Docker containers all UP with 6 agents and 63 skills",
      "staleBecause": "this snapshot is stale-memory and exceeds the currently accepted proof model unless corroborated by live or committed receipts",
      "replacementTruth": "container/deployment authority follows live receipt > committed receipt > memory; reconcile against a fresh live factory-status/checker receipt",
      "severity": "advisory",
      "evidence": "Live docker ps via SSH 2026-07-05: 19 containers, not 25. Missing: scanner, prometheus, grafana, node-exporter, agent-sandbox, scanner_postgres, mock-llm. ollama is bare metal systemd, not Docker. git-proxy is bare metal python, not Docker. Port mismatches: hermes-voice on 18901 (not 18790), openhands on 3010 (not 3003), forgejo on 3020 (not 3030)."
    },
    {
      "claim": "memory-only autonomous Phase A-D loop completion with agents posting HTTP POST deploy commands using auth tokens",
      "staleBecause": "repeated live and committed receipts confirm auto_patch_proven=false; any claim that agents can autonomously POST deploy with auth tokens is memory-only",
      "replacementTruth": "agents must use guarded 8099/deploy via git-proxy with explicit approval and fresh ZTE/factory gate receipt; raw command/AWS-like POST deploy is blocked",
      "severity": "dangerous"
    },
    {
      "claim": "skill_health.py runs every 6 hours and covers all 63 skills for autonomous repair decisions",
      "staleBecause": "cron and full-skill coverage are memory claims without an in-session live proof for this chain",
      "replacementTruth": "repair decisions require current verify-cycle/RSI receipts and explicit gate posture, not memory-only scheduling claims",
      "severity": "dangerous"
    },
    {
      "claim": "8098/deploy-webhook is the trusted deploy path",
      "staleBecause": "current policy marks 8098/deploy-webhook as legacy/internal/stale, not canonical deploy authority",
      "replacementTruth": "8099/deploy via git-proxy is the canonical signed/gated deploy route",
      "severity": "dangerous"
    },
    {
      "claim": "agents/loops can perform raw POST deploy or signed-action-less autonomous deployment",
      "staleBecause": "safety policy requires explicit approval and fresh ZTE/factory gate receipts; autonomous POST deploy remains unsafe/unproved",
      "replacementTruth": "guarded 8099/deploy via git-proxy with explicit approval and fresh route-health proof",
      "severity": "dangerous"
    },
    {
      "claim": "Phase 4 recursive self-improvement and full non-canary auto-patch repair is proven",
      "staleBecause": "memory-only phase claims are not current authority and non-canary recovery receipts are still missing",
      "replacementTruth": "auto_patch_proven remains false until a fresh local degraded-skill recovery receipt is produced",
      "severity": "dangerous"
    },
    {
      "claim": "memory-only factory/deploy state can authorize deploy",
      "staleBecause": "current policy orders authority as live receipt > committed receipt > memory",
      "replacementTruth": "deploy authority requires a live receipt or, when live state is unavailable, a committed receipt; memory is advisory only",
      "severity": "dangerous"
    },
    {
      "claim": "memory-only Phase 4 close loop: git-proxy /deploy to deploy-webhook, agents POST auth token, autonomous cycle without human intervention",
      "severity": "advisory",
      "location": "memory/gov-eric/Phase 4 close loop",
      "evidence": "Live git-proxy source code read via SSH: /deploy EXISTS as POST handler that proxies to deploy-webhook:8098 WITH Authorization header forwarding. GET /deploy returns 404 (correct). The route is POST-only and auth-gated. NOT autonomous -- requires Authorization header.",
      "verification": "cat /home/goku/bin/git-proxy.py confirms do_POST /deploy routes to DEPLOY=http://127.0.0.1:8098 with Authorization forwarded. auto_patch_proven=false. The endpoint exists but is gated.",
      "replacementTruth": "Phase 4 close loop EXISTS as POST-only /deploy on 8099 proxying to 8098 deploy-webhook with auth. NOT autonomous. auto_patch_proven=false until signed action payload test passes."
    },
    {
      "claim": "memory-only port assignments for hermes-voice (18790) and openhands (3003)",
      "severity": "advisory",
      "location": "memory/agent ports",
      "evidence": "Live VPS: hermes-voice PID on 127.0.0.1:18901 (not 18790). openhands PID on 127.0.0.1:3010 (not 3003). forgejo Docker on :3020 (not 3030).",
      "verification": "SSH ss -tlnp confirms port values."
    }
  ],
  "blockedTrustPaths": [
    "8098/deploy-webhook",
    "memory-only deploy authority",
    "autonomous deploy without fresh gate receipt",
    "raw signed/action-less POST deploy claims"
  ],
  "canonicalTrustPaths": [
    "live receipt > committed receipt > memory",
    "8099/deploy via git-proxy",
    "explicit approval + fresh valid ZTE/factory gate receipt"
  ],
  "decision": "quarantined",
  "deployAttempted": false,
  "definitiveTruth": {
    "containers": 19,
    "phase": 4,
    "agents": 6,
    "infra": 14,
    "monitoring": 5,
    "skills": 63,
    "deployAuth": "8099 POST /deploy with Authorization header forwarding to 8098 deploy-webhook",
    "autoPatchProven": false,
    "autoPatchReason": "Proof hashes (55bdf3f, fd3053b, 02fc745) are in pi-real-engineering repo, NOT in fable-agent. auto_patch_proven=false in committed code.",
    "ollamaType": "Bare metal systemd (not Docker). Was 127.0.0.1 loopback, now fixed to 0.0.0.0:11434.",
    "portCorrections": {
      "hermes-voice": "18901 (not 18790)",
      "openhands": "3010 (not 3003)",
      "forgejo": "3020 (not 3030)"
    },
    "notRunningContainers": [
      "scanner",
      "prometheus",
      "grafana",
      "node-exporter",
      "agent-sandbox",
      "scanner_postgres",
      "mock-llm"
    ],
    "testStatus": "295 passing, 69 files",
    "receiptCount": 27,
    "quarantineClaims": 9,
    "lastCommit": "6b182d1"
  }
}