[Cuarroc]

Dieser PR baut den Schalter, der den Dauerbetrieb (Continuous Mode) einschalten könnte, aber so, dass er im Zweifel zubleibt. Er lehnt jeden Einschaltversuch ab, solange das Prüfzeugnis für die Abnahme-Zeilen 1–26 nicht maschinenlesbar vorliegt – und das tut es heute nicht, der Schalter bleibt also gesperrt. Es startet noch keine Arbeitsschleife; das ist ein späteres Paket.

Report

Supersedes branch claude/w4-03-activation-switch (head aa9b3f4, left untouched): its feature commit carried the wrong subject and a No-Test trailer, and no PR was opened. This is the same content (git diff origin/main...aa9b3f4 applied cleanly) as one correct commit. Base: origin/main 4c1d9db.

What changed

• New src-tauri/src/workers/activation.rs: the only production route to a SchedulerPermit. enable() refuses unless: the verdict token matches; no emergency stop is active; the evidence source reports rows 1-26 accepted for exactly the requested policy revision (stale revision refused); the switch was not already enabled for that revision. The production source NoMachineReadableEvidence is always Locked.
• main.rs (seam): Tauri commands get_continuous_activation (read-only status) and enable_continuous_activation; the permit is parked in HeldSchedulerPermit, nothing consumes it. Control API snapshot gets a read-only continuousActivation entry.
• scheduler.rs: permit constructor narrowed so only the activation module can build one (test only_the_activation_module_builds_a_production_permit).

Evidence

• cargo test --bin projecta activation -- --list (exit 0): 6 new tests + 1 existing.
• bash scripts/ci/red-first.sh --plan (exit 0): count=6, specs=6.
• bash scripts/ci/gates.sh lane prepush at final HEAD 0448cf2 (exit 0), also run as the pre-push hook (exit 0). Remote SHA = local SHA (git ls-remote).
• Diff size: 306 lines (6 over the size-M limit of 300).

Architecture drift

scripts/ci/architecture-drift.allow gets one API_STORE_BLOCK_ON line for the new ApiBackend status call in main.rs: the decided pattern (ApiBackend stays in main.rs until after M4). No other drift finding.

Open points (from the first job)

• No dispatch loop yet: an enabled switch only parks the permit.
• The Control API write route (enable over HTTP) is cut at the api.rs seam; only the read-only status is exposed there.
• The enable state is not re-armed after an app restart.
• The production evidence source is always locked, so the switch cannot be enabled in production.

NICHT ABGEDECKT

• Windows half (#[cfg(windows)] tests, Windows clippy arms): runs in the merge queue.
• GUI: no frontend/visual change, none inspected; app not launched.
• Real evidence source: only test doubles exercise the unlocked path.

Review

Review: Stufe A durchgeführt (Ollama, autor-fremd).

Review disposition

Reviewer: kimi-k3 (kimi-k3:cloud) und glm-5.2 (glm-5.2:cloud) über .pa/review_transport.py, beide Exit 0. Kandidat-SHA: 0448cf2; Fix-Commit 58b9a89 (Delta nur Test + Kommentar). Beide: „freigeben mit Auflagen“.

• Emergency-stop TOCTOU (kimi F1 niedrig, glm F1 mittel) — activation.rs enable(): Stop-Check und set_setting nicht atomar. Gegengeprüft: Dispatch-Schreibzugriffe sind durch die Emergency-Stop-Trigger im Store geschützt (store/emergency_stop.rs:23-47), ein später gesetzter Stop blockiert jede Nutzung des Permits; heute wird der Permit nur geparkt. Als Defekt widerlegt; Kommentar an der Stelle ergänzt (58b9a89).
• Token-Fold ungetestet (kimi F2 niedrig) — bestätigt: alle Negativfälle scheiterten schon am Längenvergleich (activation.rs tokens_match). Angenommen: gleichlange Falschtokens t0k/toK im Test ergänzt (58b9a89, No-Test-Trailer: bestehender Test verstärkt, red-first OK).
• Längen-Timing-Orakel (glm F2 niedrig) — abgelehnt: die Länge des lokalen Verdict-Tokens ist kein Geheimnis, der Längenvergleich ist für den Fold nötig (zip kürzt).
• Architektur-Drift (beide) — keiner: Result<_, String>, Store-Zugriff, .manage(), vorhandene API_STORE_BLOCK_ON-Erlaubnis.
• Evidenz: cargo test --bin projecta activation (Exit 0, 7 passed); bash scripts/ci/red-first.sh (Exit 0); Push mit prepush-Hook (Exit 0), Remote-SHA = lokal 58b9a89; CI auf 58b9a89: gates (linux) pass, gates (windows) pass (Stub auf PR).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Cuarroc]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-05 10:55 UTC · Rule: default · triggered by @Cuarroc with the @mergifyio queue command
• ✅ Checks passed · on draft merge queue: checking #481 on main (a2d4048) #485
• ✅ Merged — 2026-10-05 11:09 UTC · at 2ec6960f675f46adc5f962587915cf18a6cff1f0 · merge

This pull request spent 13 minutes 50 seconds in the queue, including 13 minutes 34 seconds running CI.

Required conditions to merge

• check-success = gates (linux)
• check-success = gates (windows)
• check-success = red-first
• label != do-not-merge
  • feat(workers): fail-closed continuous activation switch (W4-03) #481