teleo-infrastructure/docs/reports/leo-working-state-20260709/working-leo-execution-plan-current.md

Working Leo Execution Plan - 2026-07-09

Claim ceiling: VPS Telegram memory/KB audit, full live-safe open-ended Telegram suite, full mixed-evidence Cory-style outcome/direct-claim sandbox benchmark, live VPS GatewayRunner no-context direct-claim suite, Telegram-visible DC authorization packet, Telegram-to-kb_stage proposal staging, and strict existing-ID apply are working. The live VPS handler suite for exact DC-01 through DC-06 prompts strict-scores 6/6 after the authorized-session-plan deploy and scorer refresh, with no Telegram post, no live profile write, no production DB apply, unchanged DB counts, temp profile cleanup, and unchanged gateway service state during the harness. The Telegram-visible DC suite is exact-scoped and ready to request authorization, but not sent; the new pre-send preflight harness verifies the packet but cannot complete the current shell's SSH deploy/service/DB readback gate without a supplied full-access VPS JSON payload. It now retains a copy-pasteable full-access command script for that payload, and the capture receipt assembler is retained but remains awaiting_capture until real visible replies plus DB/service/visual proof are supplied and scored. Public Argus HTTP diagnostics currently show 3 approved proposals, all approved_needs_apply_payload, with worker_applyable_count=0, which supports the expected no-overclaim answer but does not prove Docker row counts or systemd state. The full prepared DB packet set is integrated-clone-proven in dependency order: mapped rich base, cross-surface anchor, Rio strategy context, governance/concept schema, and Helmer 7 Powers. A read-only live production preflight baseline now passes 5/5, an authorized apply operator runbook is generated, an authorized apply session plan maps every apply-window output path with authorization gates, a production apply authorization packet is ready-to-request, the authorization verifier refuses the current apply window because no exact authorization text/operator identity is present, and the receipt assembler refuses final receipt emission because post-apply session artifacts/counts are absent. None of those packets are production-applied or authorized. GCP parity remains pending.

WL-EXEC-01 - VPS Telegram-visible memory + KB audit

• Status: done
• Result: Live Leo group canary passed; marker/correction remembered; proposal/edge DB state audited from Telegram. The retained live-safe open-ended Telegram suite now scores as a full selected benchmark pass for OE-01 through OE-05 (5/5 scored prompts, no overclaim). Post-suite readback showed no suite marker rows in kb_stage or canonical public.* tables and no canonical rows created after the OE-02 start timestamp.
• Not done condition: Would reopen if live Telegram canary fails, service restarts, benchmark score regresses, or read-only benchmark prompts stage/apply KB rows without explicit authorization.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/telegram-live-canary-20260709/telegram-live-canary-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-live-open-ended-benchmark-score-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-score-current.md

WL-EXEC-01B - Cory-style outcome and direct-claim benchmark

• Status: sandbox_fixture_done_live_handler_done_telegram_visible_auth_ready
• Result: Full mixed-evidence Cory-style benchmark scores 20/20: OE-01 through OE-05 are retained live Telegram read-only replies; CS-01 through CS-09 are sandbox expected-answer fixtures covering broader regular-use cases; DC-01 through DC-06 are no-context direct-claim expected-answer fixtures requiring the correct Cory-style follow-up action. A live VPS GatewayRunner handler run of the exact DC-01 through DC-06 prompts now returns 6/6 replies and strict-scores 6/6 with no Telegram post, no live profile write, no production DB apply, unchanged DB counts, and unchanged service state during the harness. The Telegram-visible DC run now has an exact authorization packet for the raw DC-01 through DC-06 group messages, proof paths, scorer command, DB/service readbacks, and screenshot/accessibility capture; it has not been sent. The capture receipt assembler now exists and is awaiting_capture, refusing pass until the exact authorized visible replies, DB/service readbacks, screenshot/accessibility proof, and 6/6 score are present. The pre-send preflight harness now exists and local packet checks pass, but the retained current artifact is status=fail because this shell cannot SSH to 77.42.65.182:22; run telegram-visible-direct-claim-remote-readback-command-current.sh from a full-access shell, then rerun the preflight with --remote-json-base64 to unlock the Telegram-visible send gate. The Argus HTTP diagnostics probe passes and shows the currently approved proposals are visible but still not worker-applyable.
• Not done condition: Reopen if DC-02 stops recognizing approved Helmer staging row a64df080-8502-42e2-98f4-9bbdecb8da73 as approved/unapplied, DC-03 infers decision-matrix approval while matrix_voters, proposal_votes, and proposal_decisions tables are absent, any direct-claim answer omits the Next Cory-style follow-up: line, the handler mutates DB/service state during a read-only suite, or the Telegram-visible DC authorization packet drifts from the raw benchmark catalog.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-results-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-review-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-authorization-packet-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-capture-receipt-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-preflight-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-remote-readback-command-current.sh
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/argus-kb-state-current.md

WL-EXEC-02 - VPS runtime stability

• Status: done
• Result: leoclean-gateway.service stayed active/running with MainPID=3252143 and NRestarts=0 after live Telegram and rollback DB rehearsal.
• Not done condition: Would reopen if MainPID/restart count changes during canaries without explanation.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/telegram-live-canary-20260709/telegram-live-canary-current.json
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/working-leo-current-state-20260709.md

WL-EXEC-03 - Strict existing-ID apply path

• Status: done
• Result: Strict add_edge proposal 00957f6c became canonical edge c167933e with row-level proof.
• Not done condition: Would reopen if approve/apply helper cannot reject already-applied or fails row readback.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/kb-apply-canary-20260709/kb-apply-canary-execute-current.md

WL-EXEC-04 - Rich approved packet normalization

• Status: done_for_inventory
• Result: Live approved packets 14fa5ecc and ac036c9d are converted from vague approvals into row/fragments/gap inventory.
• Not done condition: Not sufficient for production apply by itself.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/claim-source-contract-preview-20260709/claim-source-contract-preview-current.md

WL-EXEC-05 - Rich approved packet creation-plan rehearsal

• Status: done_for_mapped_supported_subset_clone_commit
• Result: Mapped supported rich-packet claim/source/evidence/edge rows committed in disposable DB clone: 7 claims, 15 sources, 17 evidence rows, 11 edges; production stayed zero and clone was dropped.
• Not done condition: Not production-applied; remaining non-claim targets still need reviewed storage/apply decisions.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/rich-proposal-creation-plan-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/rich-proposal-creation-plan-mapped-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/staging-db-commit-rehearsal-current.log

WL-EXEC-05B - Production apply packet for mapped subset

• Status: done_packet_ready_not_executed
• Result: Generated packet with preflight, rollback rehearsal, authorized commit SQL, postflight, and exact delete rollback. Live preflight and rollback passed; disposable clone commit produced 7 claims, 15 sources, 17 evidence rows, 11 edges; delete rollback returned clone counts to 0/0/0/0; production stayed zero.
• Not done condition: Production canonical rows remain unapplied until explicit production apply authorization.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/production-apply-packet-mapped-20260709/production-apply-packet-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/production-apply-packet-mapped-20260709/clone-commit-delete-rollback-current.log

WL-EXEC-05C - Helmer 7 Powers approved proposal packet

• Status: done_packet_ready_not_executed
• Result: Generated full-coverage packet for proposal a64df080-8502-42e2-98f4-9bbdecb8da73 with 1 reasoning tool, 5 claims, 13 sources, 7 edges, and 17 evidence rows. Live production preflight and rollback rehearsal passed; disposable clone commit/readback produced 1/5/13/7/17 and marked the proposal applied; delete rollback returned clone generated rows to 0/0/0/0/0 and restored the proposal to approved; production stayed zero.
• Not done condition: Production canonical rows remain unapplied until explicit production apply authorization.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/helmer-7powers-20260709/production-apply-packet/production-apply-packet-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/helmer-7powers-20260709/production-apply-packet/ledger-clone-commit-delete-rollback-current.log

WL-EXEC-05D - Cross-surface strategy anchor companion packet

• Status: done_packet_ready_not_executed
• Result: Generated a companion packet for mapped proposal 14fa5ecc that updates strategy anchor 47f128a0-36c5-4b60-97d4-48c32fa48bc7 from old compressed claim d0000000-0000-0000-0000-000000000005 to Claim D e6ce4e36-15d2-53bc-8b74-dda0efc095c1 after the mapped base packet creates Claim D. Disposable clone commit/readback passed; delete rollback restored the old anchor; base rollback returned generated rows to zero; production stayed unchanged; temp files and clone were removed.
• Not done condition: Production canonical anchor remains unapplied until explicit production apply authorization and base mapped packet application.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/cross-surface-resolution-20260709/cross-surface-packet.json
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/cross-surface-resolution-20260709/cross-surface-clone-rehearsal-current.log

WL-EXEC-05E - Rio strategy-context companion packet

• Status: done_packet_ready_not_executed
• Result: Generated a companion packet for mapped proposal 14fa5ecc that creates two Rio strategy nodes (Rio capital deployment layer, Rio internet-finance capital product) and five row-level anchors after the mapped base packet creates claims A/C/D. Disposable clone commit/readback passed: base rows were 7, Rio strategy nodes were 2, Rio anchors were 5; Rio rollback plus base rollback returned clone counts to 0/0/0; production stayed unchanged; temp files and clone were removed.
• Not done condition: Production canonical strategy rows remain unapplied until explicit production apply authorization and base mapped packet application.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/rio-strategy-context-20260710/rio-strategy-packet.json
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/rio-strategy-context-20260710/rio-strategy-clone-rehearsal-current.log

WL-EXEC-06 - Reviewed decisions for unsupported rich-packet fragments

• Status: done_packet_ready_not_executed
• Result: Edge-type mappings, one canonical capital-allocation target, the active policy-to-Claim-D strategy anchor, Rio strategy context, and governance/concept-map storage are clone-proven. The governance/concept-map packet creates minimal tables and row-level links in a disposable clone, then rollback removes the rows and drops the generated tables.
• Next action: If production apply is authorized, apply packets in dependency order in a maintenance window: mapped base packet, cross-surface anchor packet, Rio strategy packet, governance/concept schema packet, then postflight readback.
• Not done condition: Production canonical rows/schema remain unapplied until explicit production apply authorization.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/rich-proposal-creation-plan-mapped-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/governance-concept-20260710/governance-concept-clone-rehearsal-current.log

WL-EXEC-06B - Integrated production-order packet rehearsal

• Status: done_integrated_clone_ready_not_executed
• Result: Applied the full prepared packet set in one disposable clone in dependency order: mapped base, cross-surface anchor, Rio strategy context, governance/concept schema, and Helmer 7 Powers. Expected integrated footprint was 12 claims, 28 sources, 18 claim edges, 34 claim evidence rows, 1 reasoning tool, 2 Rio strategy nodes, 5 Rio strategy anchors, 1 concept map, 1 concept link, 2 governance links, one Helmer ledger row marked applied, and one cross-surface anchor update. Reverse rollback restored all generated rows/schema to zero/absent, restored the cross-surface anchor to the old claim, restored the Helmer ledger to approved, dropped the disposable DB, removed temp files, and left production unchanged. The apply-readiness verifier now passes over the retained manifest/files/logs with ready_for_authorized_production_apply_packet=true, production_apply_executed=false, and production_apply_authorization_present=false. The authorized apply runbook now emits preflight/apply/postflight/rollback command templates in manifest order, a read-only pre-apply production baseline collector, a post-apply regression command bundle, a required production-apply receipt schema, and an offline receipt validator with status=ready_not_executed. The authorized apply session plan maps concrete output paths for pre-apply validation, preflight, apply, postflight, post-apply regression, service readback, cleanup readback, receipt validation, and rollback; apply and rollback steps require explicit authorization, non-apply steps are non-mutating, and production_apply_executed=false. The production apply authorization packet now passes all evidence gates and retains the operator authorization template plus fresh deployed-SHA requirement while keeping production_apply_executed=false and production_apply_authorization_present=false. The committed authorization verifier keeps <DEPLOYED_SHA_READBACK> as a placeholder and refuses the apply window with safe_to_enter_apply_window=false because fresh deployed SHA, authorization text, and operator identity are absent. The receipt assembler now proves no final receipt can be emitted yet: receipt_ready=false, authorization_verified=false, all_session_artifacts_exist=false, actual_counts_match_expected=false, and production_apply_executed=false. The live production preflight baseline ran through begin transaction read only and passed 5/5 with no production apply executed.
• Next action: If production apply is explicitly authorized, use the generated runbook order, run every postflight SQL file, run the post-apply regression bundle, retain the production receipt, and then rerun any user-visible Telegram canary needed for the demo/meeting tier.
• Not done condition: Production canonical rows/schema remain unapplied until explicit production apply authorization.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/integrated-20260710/working-leo-integrated-packet.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/integrated-20260710/working-leo-integrated-clone-rehearsal-current.log
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-apply-readiness-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-authorized-apply-runbook-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-authorized-apply-session-plan-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-production-apply-authorization-packet-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-production-apply-authorization-verification-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-assembly-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-validation-current.md

WL-EXEC-07 - Leo-in-the-loop staging from Telegram

• Status: done_for_guarded_kb_stage_canary
• Result: Live Leo group T3/T4 proved Leo can stage a guarded review proposal in kb_stage.kb_proposals, remember the staged proposal, and read back the DB state without mutating canonical public.* tables.
• Next action: Use this as the regression harness for future strict proposal staging. Rich approved packets still need reviewed mappings before using this path for real production apply candidates.
• Not done condition: Reopen if Leo cannot stage strict proposals from Telegram or if a staging test mutates canonical public.* rows without explicit apply authorization.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/telegram-live-canary-20260709/telegram-live-db-write-canary-20260709.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/fable-working-leo-convergence-20260709/live-proof-supersession-20260709.md

WL-EXEC-08 - Clone/staging before rich production apply

• Status: done_for_full_prepared_packet_set
• Result: Disposable staging DB commit proof, individual packet clone proofs, full integrated clone commit/delete-rollback proof, and the ready-not-executed authorized apply runbook are completed; production remained zero.
• Next action: Production apply requires explicit authorization and should use the generated runbook order plus immediate postflight, the non-posting handler regression bundle, receipt capture, and any user-visible Telegram regression canary needed for the demo/meeting tier.
• Not done condition: Do not claim production canonical rows/schema are live until the production packet set is explicitly applied and postflight confirms it.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/rich-proposal-creation-plan-mapped-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/rich-proposal-creation-plan-20260709/staging-db-mapped-commit-rehearsal-current.log

WL-EXEC-09 - GCP parity

• Status: blocked_on_network_dns_before_auth_refresh
• Result: Fresh current probe uses a temporary writable gcloud config copy and keeps token stdout redacted. Local config still selects billy@livingip.xyz for teleo-501523, but every token/project readback fails at DNS resolution for oauth2.googleapis.com; this runner cannot reach the prior auth/project-access gate.
• Not done condition: No GCP parity claim until scripts/probe_gcp_db_parity.py reports ready_for_gcp_readonly_parity=true and then read-only VM/Cloud SQL/runtime parity is captured.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/gcp-db-parity-current-probe-current.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/gcp-db-parity-current-blocker-20260709.json

WL-EXEC-10 - Cleanup and retained evidence

• Status: done_current_pass
• Result: Temporary VPS SQL files removed; macOS sidecar files removed from remote report dir; reports copied under leoclean profile. Fresh read-only cleanup check found no leftover VPS Postgres database names matching rehearsal|clone|staging; gateway stayed active/running with MainPID=1908033, NRestarts=0.
• Not done condition: Reopen if any temp clone/VPS/bot is later created.
• Evidence:
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/outputs/working-leo-current-state-20260709.md
  • /Users/user/Documents/Codex/2026-07-09/019f34eb-d297-72d0-b7e2-b222d5515ab9-load/work/teleo-infra-main/docs/reports/leo-working-state-20260709/working-leo-cleanup-readback-current.md