Merge pull request #87 from living-ip/codex/working-leo-current-truth-20260712

Harden GCP Cory replay against false DB counts

.agents/skills/teleo-gcp-parity-ops/SKILL.md

@@ -1,127 +1,123 @@
 ---
 name: teleo-gcp-parity-ops
-description: Use for Teleo GCP control-plane inventory, Cloud SQL read-only parity, authenticated Chrome routing, VM/runtime comparison, and exact GCP access gates without collapsing VPS proof into GCP proof.
+description: Use for passwordless Teleo GCP VM access, private Cloud SQL canonical parity, GCP Leo runtime readback, Cory no-send replay, rollback, and cleanup without collapsing VPS proof into GCP proof.
 ---
 
 # Teleo GCP Parity Ops
 
 ## Working Target
 
-Prove the real GCP resource, database, runtime, and Cory-answer paths separately.
+Restore a copy of the VPS canonical Leo database to GCP, prove exact schema,
-Control-plane inventory alone is not database or Leo parity.
+row, role, extension, performance, and private-connectivity parity, then run the
+real GCP Leo read/reasoning path without Telegram sends or DB mutation.
 
-## Current Verified Inventory
+## Passwordless Operator Path
 
-- Project: `teleo-501523` (`Teleo`).
+Use the retained SSH alias:
-- Authenticated Console account: redacted `b***@livingip.xyz` via `authuser=5`.
-- VM: `teleo-prod-1`, running in `europe-west6-a`.
-- VM shape: Debian 12, `e2-standard-4`, 4 vCPU, 16 GB; OS Login metadata is
-  present. Treat the displayed API scope as metadata, not IAM authorization.
-- Cloud SQL: exactly one instance, `teleo-pgvector-standby`.
-- Database engine: PostgreSQL `16.14`, Enterprise.
-- Region/zone: `europe-west6` / `europe-west6-c`, single-zone.
-- Network: private-only `teleo-staging-net`; public IP disabled.
-- Connection name: `teleo-501523:europe-west6:teleo-pgvector-standby`.
-- Cloud SQL Studio loads, but the observed session exposes no enabled existing
-  IAM DB principal and selects built-in password authentication.
-- Cloud Logging has guest/platform logs but zero seven-day entries matching
-  `leoclean`, `hermes`, `gateway`, `postgres`, or `teleo-kb`; Ops Agent is not
-  installed.
-- Read-only serial output is current through `2026-07-10T15:57:54Z`. It proves
-  recurring successful `leoclean-cloudsql-memory-sync.service` cycles. The last
-  exact `leoclean-gcp-prod-parallel.service` lifecycle event in the retained
-  buffer is a Hermes start on July 9 with no later exact stop/failure. This is
-  not a current PID, process, or deployed-SHA readback.
 
-Read these before refreshing:
+```bash
+ssh teleo-gcp-staging
+```
 
-- `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.json`
+The alias uses `/Users/user/.ssh/google_compute_engine` for
-- `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.json`
+`billy_livingip_xyz@34.65.143.148`, disables password and keyboard-interactive
-- `docs/reports/leo-working-state-20260709/gcp-parallel-delegation-current.json`
+authentication, and does not store a Google password. Local `gcloud` browser
-- `docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.json`
+reauthentication is not required for routine VM operator access.
 
-## Browser Rule
+Verified target:
 
-Use authenticated Chrome/Computer Use for Console-only facts when CLI auth is
+- project `teleo-501523`;
-stale. Never use AppleScript, `osascript`, JXA, `open`, System Events, or a
+- VM `teleo-prod-1` in `europe-west6-a`;
-focus-stealing fallback. Do not inspect cookies, tokens, saved passwords, or
+- Cloud SQL `teleo-pgvector-standby`, PostgreSQL 16.14;
-secret values.
+- private endpoint `10.61.0.3:5432`, public IP disabled, TLS required;
+- service `leoclean-gcp-prod-parallel.service`.
+
+Never print the Cloud SQL password. On the VM, use the attached service account
+and Secret Manager through reviewed wrappers or a short-lived environment
+variable, then unset it.
+
+## Two Different Databases
+
+- Canonical collective knowledge is Cloud SQL database `teleo_canonical`, with
+  `public.*` and `kb_stage.*` tables.
+- Hermes conversation continuity is `state.db` plus session JSONL files. The
+  `leoclean-cloudsql-memory-sync.service` snapshot path copies this runtime
+  memory; it does not populate or prove canonical claims, sources, evidence,
+  edges, or proposals.
+
+Do not describe a passing Hermes memory sync as canonical KB parity.
+
+## Current Verified State - 2026-07-12
+
+- GCP `teleo_canonical` matches the captured VPS canonical database across
+  `39/39` tables and `52,164/52,164` rows.
+- Exact high-signal counts are claims `1837`, sources `4145`, claim evidence
+  `4670`, claim edges `4916`, and proposals `26`.
+- Rowsets, schemas, columns, constraints, indexes, functions, types, triggers,
+  views, policies, required roles, extensions, and performance checks have zero
+  mismatches. `pgcrypto` and `kb_apply` are present.
+- The GCP gateway remained active/running at PID `148735`, `NRestarts=0`, with
+  start time `2026-07-09 07:00:04 UTC` throughout restore, swap, and read tests.
+- The reviewed GCP `teleo-kb` wrapper, Cloud SQL tool, and bridge skill were
+  synchronized without a service restart. All six `DC-01` through `DC-06`
+  database-read routes pass.
+- Generated candidate databases and temporary client/operation directories were
+  removed. `teleo_canonical_pre_20260712t1905z` is retained disabled, with zero
+  connections, as the verified pre-swap rollback point.
+- The model-response replay must pass both the strict benchmark and exact count
+  consistency. A nominal score is not accepted if a reply prints table counts
+  that differ from the status receipt.
+
+Primary retained proof:
+
+- `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
+- `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json`
+- root task output `outputs/gcp-staging-canonical-parity-20260712T1905Z/`
+- root task output `outputs/gcp-cory-model-replay-20260712T1940Z/`
 
 ## Required Parity Rows
 
-Track each independently:
+Track these independently:
 
-1. control-plane project/VM/Cloud SQL inventory;
+1. control-plane project, VM, Cloud SQL, private-IP, and TLS identity;
-2. database name, principal, transaction-read-only proof, schema, counts, and
+2. canonical database schema, counts, row hashes, constraints, indexes,
-   selected row identities;
+   functions, extensions, roles, and performance;
-3. VM process/service/repo/profile/model/bot configuration;
+3. GCP service PID/restarts plus live profile and tool hashes;
-4. no-post `DC-01` through `DC-06` replies and score;
+4. `DC-01` through `DC-06` DB-read readiness;
-5. cleanup and no-mutation readback.
+5. real no-send model replies, strict score, and exact count consistency;
+6. no-mutation fingerprints, child/profile cleanup, clone deletion, and rollback
+   disposition.
 
-## Canonical Restore Rule
+## Canonical Restore And Replay
-
-The canonical Leo database is VPS Docker Postgres `teleo-pg/teleo`. The
-SQLite `pipeline.db` to `teleo_kb.teleo_restore` drill is a separate legacy
-pipeline-memory proof and never satisfies canonical Leo parity.
 
 Use:
 
-- `ops/capture_vps_canonical_postgres_snapshot.py` for one exported read-only
+- `ops/capture_vps_canonical_postgres_snapshot.py` for a single source dump and
-  snapshot shared by `pg_dump` and the source manifest;
+  manifest;
-- `ops/postgres_parity_manifest.sql` for complete row/catalog/role/performance
+- `ops/postgres_parity_manifest.sql` for row/catalog/role/performance readback;
-  readback;
+- `ops/verify_postgres_parity_manifest.py --scope gcp_staging` for exact parity;
-- `ops/verify_postgres_parity_manifest.py --scope gcp_staging` for exact parity
+- `scripts/run_gcp_generated_db_direct_claim_suite.py` for the adapter-free,
-  plus a staging-compute private-connectivity receipt.
+  read-only, no-send six-response replay against a generated `teleo_clone_*`.
 
-The 2026-07-11 local preflight restored all `39` canonical tables and `52,164`
+The replay must use the Hermes virtualenv, not system Python:
-rows with zero row-hash, catalog-hash, role, or performance mismatches. That is
-local restore proof only. GCP import, private connectivity, and Cory replay are
-still unproven.
 
-## Cloud SQL Read-Only Query
+```bash
-
+/home/teleo/.hermes/hermes-agent/venv/bin/python \
-Only after Studio is already authenticated with an existing principal:
+  scripts/run_gcp_generated_db_direct_claim_suite.py ...
-
-```sql
-begin transaction read only;
-select current_database(), current_user,
-       current_setting('transaction_read_only');
-select count(*) from public.claims;
-select count(*) from public.sources;
-select count(*) from public.claim_evidence;
-select count(*) from public.claim_edges;
-select count(*) from kb_stage.kb_proposals;
-rollback;
 ```
 
-Do not submit a raw password, create a user, change IAM, enable a flag, open
+The replay is not complete until the generated clone, temporary profile,
-browser SSH that creates a key, or mutate infrastructure under this read-only
+children, upload/run directories, and any temporary client are absent.
-skill.
 
-## Exact Current Gate
+## Safety And Claim Ceiling
 
-Database parity is unproven because the privileged gcloud/Console account now
+- Do not send Telegram messages from the GCP parity lane.
-requires password reauthentication, while both planned WIF identities
+- Do not apply, approve, or stage KB changes during read/reasoning replay.
-`sa-teleo-readiness` and `sa-teleo-restore-drill` are absent. The only proven
+- Do not restart the live GCP gateway for tool-file synchronization unless a
-WIF identity is intentionally Artifact Registry-only. The clear CTA is:
+  separate restart window is explicitly requested.
+- Do not call control-plane inventory, memory sync, route readiness, or a
+  nominal scorer pass full Cory parity.
 
-```text
+The strongest accepted claim requires exact DB parity plus real no-send model
-Run gcloud auth login billy@livingip.xyz --force, enter the Google password
+replies with truthful counts and cleanup. It still does not prove Telegram
-yourself, and tell Codex: GCP CLI reauthenticated.
+delivery, GCP canonical mutation, ongoing replication, or production cutover.
-```
-
-Otherwise route the reviewed IAM split to a separately authorized admin window.
-Once authenticated, create only a generated clone database, import the retained
-canonical dump, run full parity/private-connectivity/Cory replay, and clean up.
-
-For the narrower read-only Studio route, an operator may instead authenticate
-an already-existing database principal and report `GCP Studio authenticated`;
-that permits SQL readback but does not authorize the clone/import replay.
-
-## Claim Ceiling
-
-Current proof covers the GCP project, VM, Cloud SQL instance, health, version,
-private routing surface, and bounded serial unit activity. It does not prove
-current gateway PID/restarts, deployed SHA, profile, model/auth, Telegram bot
-identity, selected canonical DB, DB contents, VPS-vs-GCP schema/row parity,
-safe no-post Cory answers, or cutover.

.agents/skills/teleo-kb-db-change-workflow/SKILL.md

@@ -1,26 +1,58 @@
 ---
 name: teleo-kb-db-change-workflow
-description: Use for Teleo canonical Postgres changes, proposal normalization, separate review and apply authority, isolated approve_claim canaries, row-level proof, rollback, and production-apply gating.
+description: Use for Teleo document-to-claim composition, proposal normalization, separate review/apply authority, isolated apply canaries, row-level proof, rollback, and production-apply gating.
 ---
 
 # Teleo KB DB Change Workflow
 
 ## Working Target
 
-Move one reviewed knowledge change from `kb_stage.kb_proposals` to exact
+Turn a source document, post, or operator correction into source-bound evidence,
-canonical rows without confusing approval with application or silently changing
+atomic claims, graph links, and a reviewable proposal; then move an approved
-production.
+change into exact canonical rows only through a guarded apply transaction.
+
+Composition and application are separate capabilities. A synthetic apply test
+does not prove source ingestion, and a staged source extraction does not prove
+canonical application.
 
 ## State Model
 
 - `pending_review`: staged, not approved, canonical rows unchanged.
 - `approved`: reviewed intent exists, but `applied_at` may still be null.
-- `applied`: the guarded transaction finished and canonical postflight matches.
+- `applied`: guarded transaction and canonical postflight completed.
-- `packet_ready_not_executed`: rehearsed artifacts exist; production is unchanged.
+- `packet_ready_not_executed`: rehearsed artifacts exist; production is
+  unchanged.
 
 Never infer `applied` from chat text, a packet, a clone, or `status=approved`.
 
-## Canonical Contract
+## Composition Contract
+
+A useful composed change must retain:
+
+1. immutable source locator, captured bytes or excerpt, and SHA-256 binding;
+2. atomic claim body plus type, confidence, tags, and provenance metadata;
+3. exact evidence excerpt linked to both claim and source;
+4. graph edges, conflict/update/supersession candidates, and uncertainty;
+5. duplicate and existing-row search before staging;
+6. a proposal payload that accounts for every intended canonical row.
+
+Do not flatten strategy, governance, concept maps, identity, and reasoning tools
+into generic claim rows merely because the input document discusses them.
+
+Run the deterministic source-to-proposal canary:
+
+```bash
+.venv/bin/python scripts/run_leo_local_ingestion_proposal_canary.py \
+  --fixture fixtures/working-leo/document-ingestion-v1.json \
+  --output outputs/leo-local-ingestion-proposal-canary-current.json
+```
+
+Require the source, claim, evidence, and proposal UUIDs to link exactly; claim
+and evidence text must be exact substrings of the source; status must remain
+`pending_review`; the container must use network `none` and leave no volume or
+container behind.
+
+## Canonical Apply Contract
 
 The strict `approve_claim` v2 payload may create:
 
@@ -32,35 +64,30 @@ The strict `approve_claim` v2 payload may create:
 
 The lifecycle is split across:
 
-- `scripts/kb_proposal_normalize.py`: fail-closed rich intent to strict payload.
+- `scripts/kb_proposal_normalize.py`: fail-closed rich intent to strict payload;
-- `scripts/approve_proposal.py`: `kb_review` login approves the exact type/payload.
+- `scripts/approve_proposal.py`: `kb_review` approves the exact type/payload;
-- `scripts/apply_proposal.py`: operator-only `kb_apply` login writes and verifies.
+- `scripts/apply_proposal.py`: operator-only `kb_apply` writes and verifies;
 - `scripts/kb_apply_prereqs.sql`: roles, immutable approval row, gate functions,
-  ownership, indexes, and exact ACL matrix.
+  ownership, indexes, and ACLs;
-- `scripts/run_approve_claim_isolated_container_canary.sh`: disposable runtime
+- `scripts/run_approve_claim_isolated_container_canary.sh`: disposable
-  proof plus read-only live count/service endpoints.
+  lifecycle plus optional live-readonly source/service checks.
 
 ## Authority Invariants
 
-1. `kb_review` and `kb_apply` are separate `NOINHERIT` login roles with no role
+1. `kb_review` and `kb_apply` are separate `NOINHERIT` login roles.
-   memberships.
+2. `kb_gate_owner` is `NOLOGIN` and owns immutable approval/gate functions.
-2. `kb_gate_owner` is `NOLOGIN` and owns the immutable approval table and three
+3. Review binds DB role, reviewer, type, full payload, timestamp, and note.
-   `SECURITY DEFINER` gate functions.
+4. Apply locks and compares that snapshot before canonical writes.
-3. The legacy three-argument approval overload must be absent.
+5. Payload-controlled fields and exact table deltas are verified.
-4. Review binds DB role, reviewer principal, type, full payload, timestamp, and
+6. Existing evidence/edge semantic mismatches roll back the transaction.
-   note in one immutable row.
+7. Replay, stale payload, source-hash drift, and direct privilege probes fail.
-5. Apply locks and compares that snapshot before writes, verifies every
+8. `kb_apply` remains a trusted operator-only canonical writer, not autonomous
-   payload-controlled field and exact table deltas, then finishes the ledger.
+   chat write authority.
-6. Existing semantic evidence/edge rows must match approved weights and owners;
-   a mismatch rolls back.
-7. `kb_apply` remains a trusted operator-only canonical writer. This design does
-   not claim resistance to a compromised apply credential.
 
 ## Operator Path
 
-1. Read the proposal and canonical target rows.
+1. Read the proposal, source bytes/hash, and canonical target rows.
-2. Normalize rich intent; reject malformed, duplicate, lossy, or unsupported
+2. Normalize rich intent; reject lossy, duplicate, or unsupported mappings.
-   candidates instead of guessing.
 3. Run focused tests:
 
 ```bash
@@ -71,39 +98,46 @@ The lifecycle is split across:
   tests/test_kb_apply_prereqs.py
 ```
 
-4. Run both disposable canaries from the repo root:
+4. Run the generic and real-packet disposable canaries.
+5. Require exact before/after projections, deltas, source hashes, approval row,
+   applied timestamp, service state, rollback, and cleanup.
+6. Treat source checkout deployment, permission migration, worker enablement,
+   and production proposal application as separate windows.
 
-```bash
+## Current Proof - 2026-07-12
-scripts/run_approve_claim_isolated_container_canary.sh \
-  --output docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.json
 
-scripts/run_approve_claim_isolated_container_canary.sh \
+- Deterministic source composition passes all `13` checks and links one source,
-  --normalization-json docs/reports/leo-working-state-20260709/helmer-approve-claim-normalization-current.json \
+  one extracted claim, one evidence row, and one `pending_review` proposal. It
-  --output docs/reports/leo-working-state-20260709/helmer-approve-claim-clone-canary-current.json
+  proves the retained fixture path, not arbitrary-source model extraction.
-```
+  Arbitrary production document/tweet ingestion is not proven.
+- The isolated approved-change lifecycle creates exact deltas of `2` claims,
+  `2` sources, `2` evidence rows, `1` edge, and `1` reasoning tool, stamps the
+  proposal applied, rolls back, and leaves no container or volume.
+- The earlier generic and Helmer v3 source-bound receipts remain `37/37`; the
+  newer lifecycle receipt adds stricter service/source isolation and cleanup.
+- A VPS live-readonly T3 clone run passed with unchanged canonical counts and
+  unchanged gateway PID. Production was not applied.
+- The broader live-VPS full-data source-composition checkpoint passes `34/34`:
+  new hash-bound document/post, conflicting atomic claims, exact source/evidence
+  links, strict proposal, separated approval/apply, restarted discovery, graph
+  reasoning, and cleanup. This is isolated clone proof, not Telegram delivery
+  or production mutation.
+- PR #86 merged the harness/operator fixes. VPS auto-deploy synchronized source
+  without restarting Leo; the gateway remained PID `2403328`, `NRestarts=0`.
+- Current VPS canonical counts remain claims `1837`, sources `4145`, evidence
+  `4670`, edges `4916`, proposals `26`.
 
-5. Require `status=pass`, every check true, expected deltas equal measured
+Read:
-   deltas, source hashes matching current files, zero live count deltas, stable
-   service endpoints, and independent clone/container/workdir cleanup.
-6. Treat production deployment, permission migration, worker enablement, and a
-   production proposal apply as separate authorization windows.
 
-## Current Proof And Claim Ceiling
+- `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.json`
+- `docs/reports/leo-working-state-20260709/leo-source-composition-clone-checkpoint-current.json`
+- `outputs/leo-local-ingestion-proposal-canary-current.json`
 
-The retained generic and Helmer v3 receipts each pass `37/37`. Generic proves
+## Claim Ceiling
-`2/2/2/1/1`; Helmer proves `5/13/17/7/1`. Live read-only endpoint counts stayed
-`1837/4145/4670/4916/17/26`, and the gateway stayed on PID `2999690` with zero
-restarts during those runs.
 
-This proves current-source behavior in disposable PostgreSQL and unchanged live
+Leo has strong isolated proof for source-bound composition, guarded canonical
-count/service endpoints. PR #72 source later auto-synchronized to the VPS
+application, restarted discovery, and graph reasoning. Production still has
-checkout without a gateway restart or profile-source delta; the production
+three approved-but-unapplied legacy packets and fourteen pending-review
-permission migration was not applied, the apply worker remained disabled and
+proposals. No broad autonomous production apply authority exists, and no
-inactive, and Helmer remained unapplied. Checkout synchronization alone is not
+production rich packet should be applied without exact retained authorization,
-proof of any of those later state changes. It does not prove byte-for-byte live
+operator identity, postflight, regression, rollback, and cleanup evidence.
-content.
-
-Read `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md`
-and both JSON receipts before making a current claim.
-Read `docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.md`
-before describing the VPS deployment state.

.agents/skills/teleo-leo-onboarding/SKILL.md

@@ -24,9 +24,23 @@ Orient the worker before action. Build a current, proof-linked understanding of
 - Leo is the operator-facing agent expected to answer in Telegram, remember operator context, reason from canonical KB state, stage concrete KB changes, and support approved changes becoming canonical DB rows with proof.
 - The immediate July 9 issue is not generic bot liveness. It is Cory/m3taversal's expectation that approved KB changes move beyond proposal state when appropriate.
 - The VPS is the currently proven Telegram-visible Leo surface.
-- GCP is a separate lane. Project, VM, private Cloud SQL inventory, and bounded
+- GCP is a separate lane. Passwordless VM access, the live gateway, private
-  serial unit activity are current. Current gateway PID/SHA/model/auth,
+  Cloud SQL canonical rows, and exact VPS-to-GCP database parity are now proven.
-  canonical DB rows, Cory answers, and cutover are not proven.
+  Telegram delivery, GCP canonical mutation, ongoing replication, and cutover
+  remain separate proof rows.
+
+## Architecture Boundaries
+
+- VPS canonical KB: Docker Postgres `teleo-pg`, database `teleo`.
+- GCP canonical KB: private Cloud SQL database `teleo_canonical`.
+- Canonical rows: `public.claims`, `public.sources`,
+  `public.claim_evidence`, `public.claim_edges`, and related identity/strategy
+  tables; staging/review is `kb_stage.*`.
+- Hermes `state.db` and session JSONL files are conversation continuity, not
+  canonical collective knowledge. GCP memory-sync success does not prove the
+  canonical KB was restored or updated.
+- `SOUL.md` is a rendered/runtime artifact. Direct file edits are not canonical
+  identity changes without DB row and render/sync proof.
 
 ## Read First
 
@@ -38,8 +52,8 @@ From the repo root, read:
 4. `docs/reports/leo-working-state-20260709/cory-expected-working-leo-outcomes-20260709.md`
 5. `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md`
 6. `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.md`
-7. `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.md`
+7. `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
-8. `docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.md`
+8. `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json`
 
 ## Required Status Split
 
@@ -61,9 +75,11 @@ Do not collapse GCP demo readiness into Telegram completion. Do not collapse pro
 - Do not production-apply DB packets unless explicitly authorized.
 - Do not expose secret contents.
 - Do not treat an old summary as current if a fresh readback is cheap.
-- Do not call GCP blocked on CLI login when authenticated Chrome can answer the
+- Use `ssh teleo-gcp-staging` for passwordless GCP VM access. Do not call GCP
-  control-plane question. Conversely, do not submit a raw DB password or create
+  blocked on local `gcloud` reauthentication while this route works. Do not
-  IAM/users under a read-only lane.
+  print the Cloud SQL password or create IAM/users inside a read-only lane.
+- A benchmark score is not sufficient when an answer contradicts the DB receipt.
+  Compare every printed count to `teleo-kb status` or the canonical manifest.
 
 ## Output Format
 

.agents/skills/working-leo-cory-outcomes/SKILL.md

@@ -99,6 +99,48 @@ that would change the proof:
 
 End no-context answers with exactly one `Next Cory-style follow-up:` line.
 
+## Current Verdict - 2026-07-12
+
+Use `not fully yet` for the whole Cory-standard question until every row below
+is green at its required tier:
+
+- VPS runtime and restart survival: proven.
+- VPS no-send `DC-01` through `DC-06`: strict `6/6`, proven.
+- Telegram-visible open-ended read-only behavior and conversation memory:
+  proven by the earlier `OE-01` through `OE-05` suite.
+- Telegram-visible no-context direct-claim suite: partial. `DC-01` was visibly
+  sent and its server-side reply strict-passed, but the reply itself is not yet
+  captured in Telegram and `DC-02` through `DC-06` are not yet sent.
+- Canonical apply primitive and approved bundle lifecycle: proven in isolation;
+  broad production packet application is not authorized or executed.
+- Source composition: deterministic fixture proof plus a full-data, no-send,
+  current-VPS clone checkpoint are proven. Arbitrary production document/tweet
+  ingestion is not proven.
+- GCP canonical DB parity and six DB-read routes: proven. Real model replay must
+  also pass exact count consistency; a nominal scorer pass with invented counts
+  is a failure.
+
+Do not answer `yes` merely because all repo tests pass. The final user-facing
+proof is a visible Telegram conversation plus truthful canonical row readback.
+
+## Hard Cory Question Bank
+
+Use these without IDs, schema hints, or guardrail-heavy setup. The answer must
+infer the relevant rows and end with one proof-changing follow-up:
+
+1. `I approved Helmer weeks ago. Why isn't it real yet?`
+2. `What can I show a partner in five minutes?`
+3. `This PDF should update Leo. What happens now?`
+4. `What changed in your identity since last week?`
+5. `Make this claim canonical: <claim text>.`
+6. `Are pending proposals stuck because sources are wrong?`
+7. `What does our strategy depend on, and which evidence could overturn it?`
+8. `What's the next KB change I should approve?`
+
+Score the answer on directness, fresh canonical lookup, claim/evidence/source
+reasoning, state semantics, uncertainty, row-level proof, and the usefulness of
+the next action. Penalize asking Cory for IDs that Leo can discover itself.
+
 ## Required Answer Discipline
 
 When Leo or a worker answers about KB state, it must say:

docs/reports/leo-working-state-20260709/current-truth-index.md

@@ -2,6 +2,44 @@
 
 Use this file before making status claims. Prefer fresh VPS/GCP readbacks when cheap; this directory is the retained July 9 evidence snapshot committed to the Teleo infrastructure repo.
 
+## Live Addendum - 2026-07-12
+
+The whole-system Cory-standard verdict is **not fully yet**. Do not let older
+sections below override this newer status.
+
+- VPS runtime: active and restart-survival proven. Latest gateway readback is
+  PID `2403328`, `NRestarts=0`, start `2026-07-12 09:14:10 UTC`.
+- VPS canonical KB: claims `1837`, sources `4145`, evidence `4670`, edges
+  `4916`, proposals `26`; proposal states are applied `2`, approved `3`,
+  pending review `14`, canceled `7`.
+- VPS direct Cory answers: no-send `DC-01` through `DC-06` strict-score `6/6`.
+- Telegram direct Cory answers: partial. `DC-01` was visibly sent and its live
+  gateway reply strict-passed server-side, but the reply itself is not yet
+  captured in Telegram. `DC-02` through `DC-06` are not yet sent.
+- DB composition/application: deterministic source-to-proposal, full-data clone
+  composition/reasoning, and guarded approved-bundle application are
+  isolated-proven. Arbitrary production ingestion and broad production apply
+  are not proven or authorized.
+- GCP canonical DB: exact VPS parity is proven across `39` tables and `52,164`
+  rows over private TLS, with zero row/catalog/role/extension/performance
+  mismatches. Gateway PID `148735`, `NRestarts=0` stayed unchanged.
+- GCP Cory replay: six DB-read routes pass. One real no-send model replay
+  nominally scored `6/6`, but it was rejected because two replies printed false
+  zero canonical counts. The harness now enables the required `status` read and
+  rejects any printed count that differs from the canonical status receipt. A
+  hardened rerun is required before this row is green.
+- GCP rollback/cleanup: generated parity candidates and temporary tooling were
+  removed; disabled rollback database `teleo_canonical_pre_20260712t1905z` has
+  zero connections. The current hardened-replay clone must be deleted after the
+  rerun.
+
+Newest artifacts:
+
+- `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
+- `docs/reports/leo-working-state-20260709/teleo_clone_cory_20260712t1940z-canonical-parity-receipt.json`
+- `docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-dc01-partial-current.json`
+- `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json` (created only after the hardened rerun)
+
 ## Definition And Outcomes
 
 - Working Leo definition: `docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md`

docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json

@@ -0,0 +1,177 @@
+{
+  "artifact": "gcp_staging_canonical_parity_final_receipt",
+  "cleanup": {
+    "all_teleo_clone_databases_remaining": 0,
+    "current_candidate_remaining": false,
+    "remote_operation_dir_remaining": false,
+    "remote_runtime_backup_files_remaining": false,
+    "rollback_retained_disabled": true,
+    "temporary_pg16_client_remaining": false
+  },
+  "current_canary": "A rerunnable full manifest verifier proves GCP teleo_canonical parity with the fresh VPS exported snapshot after runtime readiness checks and cleanup.",
+  "delivery_state": "live_gcp_staging_runtime_mutation_with_local_retained_receipts; no repo tracked files changed",
+  "full_manifest_result": {
+    "application_role_mismatches": 0,
+    "performance_problems": 0,
+    "problems": [],
+    "required_extension_mismatches": 0,
+    "scope": "gcp_staging",
+    "source_table_count": 39,
+    "source_total_rows": 52164,
+    "status": "pass",
+    "structural_hash_mismatches": 0,
+    "table_content_mismatches": 0,
+    "target_database": "teleo_canonical",
+    "target_server_address": "10.61.0.3",
+    "target_ssl": true,
+    "target_ssl_version": "TLSv1.3",
+    "target_table_count": 39,
+    "target_total_rows": 52164
+  },
+  "gateway": {
+    "ActiveEnterTimestamp": "Thu 2026-07-09 07:00:04 UTC",
+    "ActiveState": "active",
+    "MainPID": "148735",
+    "NRestarts": "0",
+    "SubState": "running"
+  },
+  "generated_at_utc": "2026-07-12T19:37:37.201190+00:00",
+  "post_repair_counts": {
+    "claim_edges": 4916,
+    "claim_evidence": 4670,
+    "claims": 1837,
+    "kb_proposals": 26,
+    "sources": 4145
+  },
+  "pre_repair": {
+    "counts": {
+      "claim_edges": 4915,
+      "claim_evidence": 4670,
+      "claims": 1837,
+      "kb_proposals": 28,
+      "sources": 4145
+    },
+    "manifest_problems": [
+      "table_content_mismatches=2",
+      "functions_hash_mismatch",
+      "required_extension_mismatches=1",
+      "application_role_mismatches=1"
+    ],
+    "missing_extension": "pgcrypto",
+    "missing_role": "kb_apply",
+    "table_mismatches": [
+      "kb_stage.kb_proposals",
+      "public.claim_edges"
+    ]
+  },
+  "proof_paths": {
+    "cleanup": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/cleanup/cleanup-receipt.json",
+    "final_parity": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/final-post-cleanup-parity.json",
+    "final_post_cleanup_manifest": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/final-post-cleanup-manifest.jsonl",
+    "final_receipt": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/final-receipt.json",
+    "gcp_pre_snapshot_dump": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/gcp-pre/teleo-canonical-pre.dump",
+    "pre_row_diff": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/row-diff/pre-row-diff-sanitized.json",
+    "rollback_verification": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/rollback/rollback-database-verification.json",
+    "runtime_repair": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/runtime-post/runtime-repair-receipt.json",
+    "six_cory_readiness": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/readiness/benchmark-readiness-final.json",
+    "source_manifest": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/source/source-manifest.jsonl",
+    "source_snapshot_receipt": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/source/receipt.json"
+  },
+  "remaining_benchmark_action": "Create a fresh disposable teleo_clone_* from teleo_canonical, run the six no-send paid-model direct-claim benchmark, retain replies/score, then drop that clone. Do not post Telegram.",
+  "required_tier": "live GCP staging copy; no production cutover",
+  "rollback": {
+    "database": {
+      "allow_connections": false,
+      "name": "teleo_canonical_pre_20260712t1905z",
+      "retained": true,
+      "verified_against_pre_repair_manifest": true
+    },
+    "manifest_verification_status": "pass",
+    "pre_repair_dump_sha256": "ed058215da66fca5846a0e6cae06579788e8d319ed25acdf38e5aff4c6ca56f2"
+  },
+  "runtime_repair": {
+    "after": {
+      "skill": "523bf6975523c7ea94c043b9e60be3375b122860b951f78ad13dad10fe822de8",
+      "tool": "f4396298405b1cbc92590e148b6272c66bb0e8461178edc3ffcfd02bfed69ab4",
+      "wrapper": "b988079ff2f23b962c40d4c6c9f20c0b85a7bdb0ee675ae146cf36f18ea6529a"
+    },
+    "before": {
+      "skill": "7505a1804e000354f3a87d2f72fd066cea31516d0a828a2d8c283d6a400145c4",
+      "tool": "ebba10abea9e1ffe820cfcaede96cb6515b01ceebd4cd67e05776ee8a9927d09",
+      "wrapper": "aafd51ad82c0e7afb7a9be3ee2861aa176ddeae13cb51ca78ac4fa71e3c985df"
+    },
+    "service_restarted": false
+  },
+  "safety": {
+    "gcloud_reauthentication_used": false,
+    "gcp_production_cutover_performed": false,
+    "model_calls_executed": false,
+    "telegram_send_attempted": false,
+    "vps_production_database_mutated": false
+  },
+  "six_cory_db_read_readiness": {
+    "all_six_ready": true,
+    "database_write_command_executed": false,
+    "model_calls_executed": false,
+    "results": [
+      {
+        "commands": [
+          "decision-matrix-status",
+          "list-proposals"
+        ],
+        "id": "DC-01",
+        "ok": true
+      },
+      {
+        "commands": [
+          "search-proposals",
+          "show-proposal"
+        ],
+        "id": "DC-02",
+        "ok": true
+      },
+      {
+        "commands": [
+          "decision-matrix-status",
+          "show-proposal"
+        ],
+        "id": "DC-03",
+        "ok": true
+      },
+      {
+        "commands": [
+          "search-proposals",
+          "show-proposal"
+        ],
+        "id": "DC-04",
+        "ok": true
+      },
+      {
+        "commands": [
+          "status"
+        ],
+        "id": "DC-05",
+        "ok": true
+      },
+      {
+        "commands": [
+          "context",
+          "search-proposals"
+        ],
+        "id": "DC-06",
+        "ok": true
+      }
+    ],
+    "status": "pass",
+    "telegram_send_attempted": false
+  },
+  "source_snapshot": {
+    "dump_bytes": 13462116,
+    "dump_sha256": "8a217e32bf6c83cb2b629e5ca5f91fc57f759e5010d9c40babe0d13c9a450822",
+    "production_db_mutated": false,
+    "service_unchanged": true,
+    "status": "pass"
+  },
+  "status": "pass",
+  "strongest_claim": "T3 live GCP staging: teleo_canonical is an exact current copy of the captured VPS canonical KB across all 39 tables, 52,164 rows, row hashes, schemas, constraints, indexes, sequences, views, functions, triggers, types, policies, pgcrypto, kb_apply role attributes, and bounded query checks; all six Cory DB-read routes are ready. No model-response benchmark or production cutover was run."
+}

docs/reports/leo-working-state-20260709/skill-pack-manifest.json

@@ -26,7 +26,7 @@
     },
     {
       "name": "teleo-gcp-parity-ops",
-      "role": "GCP control-plane, private Cloud SQL inventory, Studio DB-auth gate, and parity workflow",
+      "role": "Passwordless GCP VM access, private Cloud SQL parity, Cory replay, rollback, and cleanup",
       "path": ".agents/skills/teleo-gcp-parity-ops/SKILL.md"
     },
     {

docs/reports/leo-working-state-20260709/skill-pack-readme.md

@@ -9,8 +9,8 @@ This is the repo-native skill set under `.agents/skills/`. It is evidence-linked
 1. `teleo-leo-onboarding`: company/product/architecture orientation before touching Leo or Teleo.
 2. `working-leo-cory-outcomes`: Cory/m3taversal's expected Leo behavior and the current benchmark.
 3. `teleo-vps-runtime-ops`: VPS service, paths, Postgres, Docker, report sync, and stability checks.
-4. `teleo-gcp-parity-ops`: GCP/Cloud SQL parity lane, auth facts, and blocker format.
+4. `teleo-gcp-parity-ops`: passwordless GCP access, Cloud SQL parity, no-send replay, rollback, and cleanup.
-5. `teleo-kb-db-change-workflow`: approved proposal to canonical DB row workflow with clone rehearsal and rollback.
+5. `teleo-kb-db-change-workflow`: source composition plus approved proposal to canonical-row workflow with clone rehearsal and rollback.
 6. `leo-telegram-canary-ops`: live Telegram/Chrome/Computer Use canaries for Leo bot behavior.
 7. `teleo-infra-provenance`: repo, deploy, mirror, and runtime provenance map.
 8. `teleo-proof-handoff`: evidence bundle and Fable/Codex worker handoff protocol.
@@ -19,9 +19,9 @@ This is the repo-native skill set under `.agents/skills/`. It is evidence-linked
 
 - VPS Leo Telegram memory, KB audit, and staged write canaries are live-proven.
 - A strict canonical `add_edge` apply canary is live-proven.
-- Generic and real Helmer guarded-apply canaries pass `37/37` with exact payload projections/table deltas, current-source hashes, and cleanup proof. PR #72 source auto-synchronized to the VPS checkout without a gateway restart or profile-source delta; the permission migration was not applied, the apply worker stayed disabled/inactive, and Helmer was not production-applied.
+- Deterministic source composition, full-data clone composition/reasoning, and guarded approved-bundle application are isolated-proven with exact source/evidence/claim links, row deltas, rollback, and cleanup. Production rich packets remain unapplied.
 - The live VPS runtime behavior should not be changed while the DB apply path is stabilized.
-- GCP project, VM, private Cloud SQL inventory, and bounded serial unit activity are live-proven. Current gateway PID/SHA/model/auth and DB row/schema parity are not; Studio requires an already-existing authenticated DB principal.
+- GCP passwordless SSH, gateway liveness, private Cloud SQL identity, and exact VPS-to-GCP canonical parity are live-proven. The database matches across `39` tables and `52,164` rows. Telegram delivery, GCP canonical mutation, ongoing replication, and cutover remain separate proof rows.
 
 ## Key References
 
@@ -29,7 +29,8 @@ This is the repo-native skill set under `.agents/skills/`. It is evidence-linked
 - Operator surface map: `docs/reports/leo-working-state-20260709/operator-surface-map.md`
 - Fable onboarding prompt: `docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md`
 - PR #72 VPS auto-deploy/runtime readback: `docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.md`
-- GCP Leo runtime observability: `docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.md`
+- GCP canonical parity: `docs/reports/leo-working-state-20260709/gcp-canonical-parity-live-20260712.json`
+- GCP Cory replay: `docs/reports/leo-working-state-20260709/gcp-cory-model-replay-current.json`
 - Skill manifest: `skill-pack-manifest.json`
 
 ## Discovery

docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-dc01-partial-current.json

@@ -0,0 +1,74 @@
+{
+  "artifact": "telegram_direct_claim_partial_server_receipt",
+  "prompt_id": "DC-01",
+  "prompt": "Did we actually update the knowledge base, or is it still just proposals?",
+  "target": {
+    "platform": "telegram",
+    "chat_label": "Leo",
+    "chat_id": "-5146042086"
+  },
+  "server_session": {
+    "jsonl_path": "/home/teleo/.hermes/profiles/leoclean/sessions/20260712_183900_2c340f62.jsonl",
+    "jsonl_sha256": "764dcf5d893674e363066f3ae2bcd0059783fa80e4801c019949877ac655aa4e",
+    "session_timestamp_utc": "2026-07-12T18:39:27.083866",
+    "finish_reason": "stop",
+    "reply_chars": 1153,
+    "reply_sha256": "04376f2469ae8f765aa17535c585bc86585212ab547305f717c1d35807a330ed",
+    "tool_sequence": [
+      "skill_view:teleo-kb-bridge",
+      "teleo-kb status",
+      "teleo-kb list-proposals --status all --limit 50"
+    ]
+  },
+  "reply": "Mostly still proposals.\n\nDB readback: claims: `1837`; sources: `4145`; claim_edges: `4916`; claim_evidence: `4670`; kb_proposals: `26`.\n\nBreakdown across all 26 proposals:\n\n- `applied`: 2\n- `approved`: 3 (reviewed, not yet applied)\n- `pending_review`: 14\n- `canceled`: 7\n\nThe 2 applied ones:\n- `f004bbb2` - Leo guiding-policy revision evidence (applied 2026-07-05)\n- `00957f6c` - strict `add_edge` canary (applied 2026-07-09)\n\nThe 3 approved but NOT applied:\n- `14fa5ecc` - claim-split proposal for internet-finance/capital-allocation; `applied_at: none`\n- `ac036c9d` - strategy-kernel document / claim hygiene; `applied_at: none`\n- `a64df080` - Helmer 7 Powers framework packet; `applied_at: none`\n\nApproved is not the same as applied. All three have empty `applied_at` - they are packet-ready but not canonical. The 14 pending proposals haven't been reviewed at all.\n\nNext Cory-style follow-up: the proof-changing action is running the apply step on the 3 approved proposals - that requires explicit operator/admin authorization and a reviewed apply path, not a normal chat command. Want me to draft or refresh the admin review packet for any of them?",
+  "post_prompt_readback": {
+    "db": {
+      "backend": "teleo|postgres",
+      "high_signal_rows": {
+        "claim_edges": 4916,
+        "claim_evidence": 4670,
+        "claims": 1837,
+        "kb_proposals": 26,
+        "sources": 4145
+      },
+      "proposal_status_counts": {
+        "applied": 2,
+        "approved": 3,
+        "canceled": 7,
+        "pending_review": 14
+      }
+    },
+    "service": {
+      "ActiveState": "active",
+      "SubState": "running",
+      "MainPID": "2403328",
+      "NRestarts": "0",
+      "ExecMainStartTimestamp": "Sun 2026-07-12 09:14:10 UTC"
+    },
+    "gateway_errors_since_prompt": []
+  },
+  "telegram_user_prompt_visible": true,
+  "telegram_user_prompt_visible_display_time": "20:39",
+  "telegram_visible_reply_captured": false,
+  "telegram_message_id": "",
+  "reply_message_id": "",
+  "evidence_tier": "telegram_ingress_plus_live_gateway_session",
+  "strict_score": {
+    "coverage": "partial",
+    "expected_prompt_count": 1,
+    "passes": 1,
+    "failures": [],
+    "pass": true,
+    "signals": {
+      "canonical_db": true,
+      "cory_followup": true,
+      "no_overclaim": true,
+      "row_level_proof": true,
+      "state_semantics": true,
+      "structured_db_readback": true
+    }
+  },
+  "mutates_kb": false,
+  "production_apply_executed": false,
+  "claim_ceiling": "The Telegram user prompt was visibly sent and the live gateway generated this reply after fresh KB readback. The reply itself has not yet been captured in the authenticated Telegram UI, so this is not yet Telegram-visible reply proof."
+}

docs/reports/leo-working-state-20260709/teleo_clone_cory_20260712t1940z-canonical-parity-receipt.json

@@ -0,0 +1,131 @@
+{
+  "artifact": "canonical_postgres_parity_verification",
+  "details": {
+    "application_role_mismatches": {},
+    "performance": [
+      {
+        "query": "claim_edges_by_claim_id",
+        "source_ms": 0.037,
+        "source_ratio": 0.3606,
+        "target_ms": 1.803
+      },
+      {
+        "query": "claim_evidence_by_claim_id",
+        "source_ms": 0.067,
+        "source_ratio": 0.2794,
+        "target_ms": 1.397
+      },
+      {
+        "query": "count_claims",
+        "source_ms": 0.226,
+        "source_ratio": 0.397,
+        "target_ms": 1.985
+      },
+      {
+        "query": "pending_proposals_latest",
+        "source_ms": 0.012,
+        "source_ratio": 0.002,
+        "target_ms": 0.01
+      }
+    ],
+    "performance_problems": [],
+    "required_extension_mismatches": {},
+    "source_connection": {
+      "database_collation": "en_US.utf8",
+      "database_ctype": "en_US.utf8",
+      "server_address": null,
+      "server_port": null,
+      "ssl": false,
+      "ssl_version": null
+    },
+    "source_database": "teleo",
+    "source_table_count": 39,
+    "source_total_rows": 52164,
+    "structural_hashes": {
+      "columns": {
+        "source": "50b502967aa85b88bd204c7b9035de60bf21a6a6973817e8b8121d0cd9faab81",
+        "target": "50b502967aa85b88bd204c7b9035de60bf21a6a6973817e8b8121d0cd9faab81"
+      },
+      "constraints": {
+        "source": "8b26d26fda56f09325e0603aae48051da08dfc6c35322fa88880acdabb8ad859",
+        "target": "8b26d26fda56f09325e0603aae48051da08dfc6c35322fa88880acdabb8ad859"
+      },
+      "functions": {
+        "source": "4bddee626b3ab62af236493001d2a09f2d56c084beb7e6c69cd082ce4aba155b",
+        "target": "4bddee626b3ab62af236493001d2a09f2d56c084beb7e6c69cd082ce4aba155b"
+      },
+      "indexes": {
+        "source": "5c4f7567e9ad0f25da0ab15f650a1005397ae9c727af1ab41e2675c46a5ebce5",
+        "target": "5c4f7567e9ad0f25da0ab15f650a1005397ae9c727af1ab41e2675c46a5ebce5"
+      },
+      "policies": {
+        "source": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
+        "target": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
+      },
+      "schemas": {
+        "source": "2fdf551b403db2d79813c8fd2869dadfeba261fac2aaa718b355cd7414640979",
+        "target": "2fdf551b403db2d79813c8fd2869dadfeba261fac2aaa718b355cd7414640979"
+      },
+      "sequences": {
+        "source": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
+        "target": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
+      },
+      "triggers": {
+        "source": "4d5f3394480c8410035dac5457e144c7db80fa0820ff49beb93aa819a7282c64",
+        "target": "4d5f3394480c8410035dac5457e144c7db80fa0820ff49beb93aa819a7282c64"
+      },
+      "types": {
+        "source": "365e82ac205319d25d14c8b16026978f0e6023ae0c58767f700d7f2ea659b70b",
+        "target": "365e82ac205319d25d14c8b16026978f0e6023ae0c58767f700d7f2ea659b70b"
+      },
+      "views": {
+        "source": "5c33fa260f25dccffc214f795c66e3dbae89d91d0dbf8a98122ace1dcda46799",
+        "target": "5c33fa260f25dccffc214f795c66e3dbae89d91d0dbf8a98122ace1dcda46799"
+      }
+    },
+    "table_mismatches": [],
+    "target_connection": {
+      "database_collation": "en_US.UTF8",
+      "database_ctype": "en_US.UTF8",
+      "server_address": "10.61.0.3",
+      "server_port": 5432,
+      "ssl": true,
+      "ssl_version": "TLSv1.3"
+    },
+    "target_database": "teleo_clone_cory_20260712t1940z",
+    "target_extra_application_roles": [],
+    "target_table_count": 39,
+    "target_total_rows": 52164
+  },
+  "error": null,
+  "generated_at_utc": "2026-07-12T19:42:53.851388+00:00",
+  "not_proven_by_this_artifact": [
+    "GCP staging Leo composition replay",
+    "ongoing replication after the manifest timestamps",
+    "production cutover"
+  ],
+  "private_connectivity": {
+    "path": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-cory-model-replay-20260712T1940Z/connectivity.json",
+    "proof": {
+      "captured_at_utc": "2026-07-12T19:42:31Z",
+      "evidence": {
+        "direct_private_tls_manifest": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-cory-model-replay-20260712T1940Z/clone-manifest.jsonl",
+        "parent_canonical_parity": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/final-post-cleanup-parity.json",
+        "passwordless_operator_status": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-passwordless-operator-status-20260712.json"
+      },
+      "private_connectivity": true,
+      "public_ip_disabled": true,
+      "server_address": "10.61.0.3",
+      "source_compute": "teleo-prod-1 (non-production parallel staging VM)",
+      "ssl": true,
+      "status": "pass",
+      "target_database": "teleo_clone_cory_20260712t1940z"
+    },
+    "required": true
+  },
+  "problems": [],
+  "scope": "gcp_staging",
+  "source_manifest": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-staging-canonical-parity-20260712T1905Z/source/source-manifest.jsonl",
+  "status": "pass",
+  "target_manifest": "/Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-cory-model-replay-20260712T1940Z/clone-manifest.jsonl"
+}

scripts/run_gcp_generated_db_direct_claim_suite.py

@@ -9,6 +9,7 @@ import hashlib
 import ipaddress
 import json
 import os
+import re
 import shlex
 import shutil
 import subprocess
@@ -33,6 +34,14 @@ DEFAULT_SECRET = "gcp-teleo-pgvector-standby-postgres-password"
 DEFAULT_MANIFEST_SQL = HERE.parent / "ops" / "postgres_parity_manifest.sql"
 REVIEWED_CLOUDSQL_TOOL_SHA256 = "f4396298405b1cbc92590e148b6272c66bb0e8461178edc3ffcfd02bfed69ab4"
 REVIEWED_MANIFEST_SQL_SHA256 = "8b8cdc25d54fdd8de05eb38c6e4423d2836953eb6012d4545f5c9c71b5f0150a"
+COUNT_READBACK_RE = re.compile(
+    r"DB readback:\s*claims:\s*`?(?P<claims>\d+)`?;\s*"
+    r"sources:\s*`?(?P<sources>\d+)`?;\s*"
+    r"claim_edges:\s*`?(?P<claim_edges>\d+)`?;\s*"
+    r"claim_evidence:\s*`?(?P<claim_evidence>\d+)`?;\s*"
+    r"kb_proposals:\s*`?(?P<kb_proposals>\d+)`?\.?",
+    re.IGNORECASE,
+)
 
 
 def run(command: list[str], *, env: dict[str, str] | None = None, input_text: str | None = None) -> str:
@@ -446,15 +455,16 @@ This temporary no-send profile is bound only to private-TLS database
 must start directly with the bare command `teleo-kb` and contain exactly one
 read command. Never use an absolute path, Python, shell variables, `which`,
 `env`, pipes, redirects, heredocs, cache files, or a second shell command. Use
-only search, context, show, evidence, edges, list-proposals,
+only status, search, context, show, evidence, edges, list-proposals,
 search-proposals, show-proposal, and decision-matrix-status. Keep list/search
 limits at 30 or below. For aggregate proposal status counts, call
 `teleo-kb decision-matrix-status`; do not parse cached output. Do not stage,
 approve, apply, write, send, or use live-profile paths. Distinguish pending,
 approved, applied, and canonical rows from database readback; never infer
-decision-matrix approval when its tables are absent. `status` and the restored
+decision-matrix approval when its tables are absent. The restored audit fallback
-audit fallback are unavailable in this clone-only profile. Every helper session
+is unavailable in this clone-only profile. Use `teleo-kb status` whenever an
-is server-enforced with `default_transaction_read_only=on`.
+answer prints total canonical table counts. Every helper session is
+server-enforced with `default_transaction_read_only=on`.
 
 For every direct-claim answer, use this sequence: direct yes/no/partly answer;
 exact proposal/canonical-row readback; what is not proven; then a final line
@@ -508,6 +518,36 @@ def direct_prompts() -> list[dict[str, Any]]:
     ]
 
 
+def audit_structured_count_readbacks(
+    results: list[dict[str, Any]],
+    canonical_status_receipt: dict[str, Any],
+) -> dict[str, Any]:
+    counts = canonical_status_receipt.get("high_signal_rows") or {}
+    expected = {
+        key: int(counts[key])
+        for key in ("claims", "sources", "claim_edges", "claim_evidence", "kb_proposals")
+        if key in counts
+    }
+    observations: list[dict[str, Any]] = []
+    for result in results:
+        for match in COUNT_READBACK_RE.finditer(str(result.get("reply") or "")):
+            actual = {key: int(value) for key, value in match.groupdict().items()}
+            observations.append(
+                {
+                    "prompt_id": result.get("prompt_id"),
+                    "actual": actual,
+                    "matches_canonical_status": actual == expected,
+                }
+            )
+    return {
+        "expected": expected,
+        "observations": observations,
+        "observed_count_readback_count": len(observations),
+        "all_observed_count_readbacks_match": bool(expected)
+        and all(item["matches_canonical_status"] for item in observations),
+    }
+
+
 async def run_suite(args: argparse.Namespace) -> dict[str, Any]:
     report: dict[str, Any] = {
         "schema": SCHEMA,
@@ -600,6 +640,10 @@ async def run_suite(args: argparse.Namespace) -> dict[str, Any]:
             catalog=benchmark.CORY_DIRECT_CLAIM_FOLLOWUP_SCENARIOS,
             expected_prompt_ids=expected_ids,
         )
+        report["structured_count_readback_audit"] = audit_structured_count_readbacks(
+            report["results"],
+            before_status,
+        )
         report["tool_proof"] = bound.read_tool_proof(
             Path(bridge["tool_log_path"]),
             SOURCE_COMPUTE,
@@ -660,6 +704,9 @@ async def run_suite(args: argparse.Namespace) -> dict[str, Any]:
             "parity_receipt_validated": bool(report.get("parity_receipt")),
             "six_replies_returned": len(report["results"]) == 6 and all(row.get("ok") for row in report["results"]),
             "strict_score_passed": report.get("score", {}).get("pass") is True,
+            "observed_count_readbacks_match_database": (
+                report.get("structured_count_readback_audit", {}).get("all_observed_count_readbacks_match") is True
+            ),
             "tool_calls_bound_read_only_and_successful": tool_proof.get("all_bound_to_supplied_target") is True
             and tool_proof.get("all_completed_successfully") is True
             and tool_proof.get("default_read_only_required") is True,

scripts/run_leo_clone_bound_handler_checkpoint.py

@@ -50,6 +50,7 @@ DEFAULT_USER_NAME = "codex clone checkpoint"
 EXPECTED_STATES = ("pending_review", "approved", "applied")
 READ_ONLY_BRIDGE_COMMANDS = frozenset(
     {
+        "status",
         "context",
         "search",
         "show",
@@ -1097,6 +1098,7 @@ def validate_read_only_bridge_argv(argv: list[str]) -> None:
     search_proposals.add_argument("--limit", type=int, default=10)
     show_proposal = command("show-proposal")
     show_proposal.add_argument("proposal_id", type=_uuid_argument)
+    command("status")
     command("decision-matrix-status")
 
     parsed = parser.parse_args(argv)

tests/test_gcp_generated_db_direct_claim_suite.py

@@ -10,6 +10,7 @@ import pytest
 from scripts.run_gcp_generated_db_direct_claim_suite import (
     REVIEWED_CLOUDSQL_TOOL_SHA256,
     REVIEWED_MANIFEST_SQL_SHA256,
+    audit_structured_count_readbacks,
     build_cloudsql_wrapper,
     database_fingerprint,
     direct_prompts,
@@ -29,11 +30,45 @@ def test_direct_prompt_catalog_is_the_exact_six_case_suite() -> None:
     prompts = direct_prompts()
 
     assert [prompt["id"] for prompt in prompts] == [f"DC-{index:02d}" for index in range(1, 7)]
-    assert "status" not in READ_ONLY_BRIDGE_COMMANDS
+    assert "status" in READ_ONLY_BRIDGE_COMMANDS
+    validate_read_only_bridge_argv(["status"])
     validate_read_only_bridge_argv(["list-proposals", "--help"])
     validate_read_only_bridge_argv(["list-proposals", "--status", "rejected"])
 
 
+def test_structured_count_readback_audit_rejects_plausible_but_false_counts() -> None:
+    status = {
+        "high_signal_rows": {
+            "claims": 1837,
+            "sources": 4145,
+            "claim_edges": 4916,
+            "claim_evidence": 4670,
+            "kb_proposals": 26,
+        }
+    }
+    wrong = [
+        {
+            "prompt_id": "DC-03",
+            "reply": (
+                "DB readback: claims: `0`; sources: `0`; claim_edges: `0`; "
+                "claim_evidence: `0`; kb_proposals: `26`."
+            ),
+        }
+    ]
+    correct = [
+        {
+            "prompt_id": "DC-03",
+            "reply": (
+                "DB readback: claims: `1837`; sources: `4145`; claim_edges: `4916`; "
+                "claim_evidence: `4670`; kb_proposals: `26`."
+            ),
+        }
+    ]
+
+    assert audit_structured_count_readbacks(wrong, status)["all_observed_count_readbacks_match"] is False
+    assert audit_structured_count_readbacks(correct, status)["all_observed_count_readbacks_match"] is True
+
+
 def test_wrapper_binds_private_read_only_database_and_records_calls(tmp_path: Path) -> None:
     wrapper = build_cloudsql_wrapper(
         cloudsql_tool=tmp_path / "cloudsql_memory_tool.py",

tests/test_repo_skill_pack.py

@@ -51,44 +51,40 @@ def test_db_change_skill_tracks_guarded_v2_runtime_proof() -> None:
         "source hashes",
         "trusted operator-only canonical writer",
         "run_approve_claim_isolated_container_canary.sh",
+        "all `13` checks",
+        "`34/34`",
+        "PR #86",
     ):
         assert required in text
 
-    assert "does not prove byte-for-byte live content" in squashed
+    assert "Production was not applied" in squashed
-    assert "production permission migration" in squashed
+    assert "Arbitrary production document/tweet ingestion is not proven" in squashed
-    assert "pr72-vps-auto-deploy-runtime-nonchange-current.md" in text
+    assert "three approved-but-unapplied legacy packets" in squashed
 
 
-def test_gcp_skill_uses_current_cloud_sql_truth_and_exact_gate() -> None:
+def test_gcp_skill_uses_current_passwordless_parity_truth() -> None:
     text = _skill("teleo-gcp-parity-ops")
     squashed = " ".join(text.split())
-    observability = json.loads(
-        (REPORT_DIR / "gcp-leo-runtime-observability-current.json").read_text(
-            encoding="utf-8"
-        )
-    )
 
     for required in (
+        "ssh teleo-gcp-staging",
         "teleo-pgvector-standby",
-        "PostgreSQL `16.14`",
+        "PostgreSQL 16.14",
-        "teleo-staging-net",
         "public IP disabled",
-        "Cloud SQL Studio",
+        "39/39",
-        "GCP Studio authenticated",
+        "52,164/52,164",
-        "begin transaction read only",
+        "PID `148735`",
-        "DB contents",
+        "NRestarts=0",
-        "gcp-leo-runtime-observability-current.json",
+        "state.db",
         "leoclean-cloudsql-memory-sync.service",
-        "zero seven-day entries",
+        "gcp-canonical-parity-live-20260712.json",
+        "gcp-cory-model-replay-current.json",
     ):
         assert required in text
 
-    assert "no enabled existing" in squashed
+    assert "does not store a Google password" in squashed
-    assert "IAM DB principal" in squashed
+    assert "Do not describe a passing Hermes memory sync as canonical KB parity" in text
-    assert "Do not submit a raw password" in text
+    assert "Do not call control-plane inventory" in text
-    assert "AppleScript" in text
-    assert observability["delivery_context"]["gcp_deployment_status"] == "unproven"
-    assert observability["delivery_context"]["gcp_deployed_sha_proven"] is False
 
 
 def test_vps_onboarding_and_cory_skills_point_to_current_proof() -> None:
@@ -104,8 +100,9 @@ def test_vps_onboarding_and_cory_skills_point_to_current_proof() -> None:
     assert "/opt/teleo-eval/.last-deploy-sha" in provenance
     assert "does not prove a gateway restart" in " ".join(provenance.split())
     assert "gcp-cloud-sql-t3-live-readonly-current.md" in onboarding
-    assert "gcp-leo-runtime-observability-current.md" in onboarding
+    assert "gcp-canonical-parity-live-20260712.json" in onboarding
-    assert "GCP Studio authenticated" not in onboarding
+    assert "gcp-cory-model-replay-current.json" in onboarding
+    assert "ssh teleo-gcp-staging" in onboarding
     assert "37/37" in cory
     assert "Approved is not the same as applied" in cory
     assert "Next Cory-style follow-up:" in cory