teleo-infrastructure/docs/reports/leo-working-state-20260709/current-truth-index.md

Current Truth Index - Leo / Teleo - 2026-07-09

Use this file before making status claims. Prefer fresh VPS/GCP readbacks when cheap; this directory is the retained July 9 evidence snapshot committed to the Teleo infrastructure repo.

Definition And Outcomes

• Working Leo definition: docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md
• Cory expected outcomes: docs/reports/leo-working-state-20260709/cory-expected-working-leo-outcomes-20260709.md
• Current state: docs/reports/leo-working-state-20260709/working-leo-current-state-20260709.md
• Execution plan: docs/reports/leo-working-state-20260709/working-leo-execution-plan-current.md
• Open-ended benchmark spec: docs/reports/leo-working-state-20260709/working-leo-open-ended-benchmark-spec.json (5 live-safe open prompts, 9 broader Cory-style outcome scenarios, and 6 no-context direct-claim follow-up prompts for disposable clone/sandbox first)
• Open-ended live Telegram canary: docs/reports/leo-working-state-20260709/telegram-live-open-ended-cory-style-20260709.md
• Open-ended live Telegram canary JSON: docs/reports/leo-working-state-20260709/telegram-live-open-ended-cory-style-20260709.json
• Retained Telegram benchmark score for the open-ended canary: docs/reports/leo-working-state-20260709/telegram-live-open-ended-benchmark-score-current.md
• Retained Telegram benchmark score JSON: docs/reports/leo-working-state-20260709/telegram-live-open-ended-benchmark-score-current.json
• Full live-safe open-ended Telegram suite report: docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-current.md
• Full live-safe open-ended Telegram suite score: docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-score-current.md
• Full live-safe open-ended Telegram suite score JSON: docs/reports/leo-working-state-20260709/telegram-live-open-ended-suite-score-current.json
• Full Cory-style outcome/direct-claim sandbox results: docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-results-current.md
• Full Cory-style outcome/direct-claim sandbox score: docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.md
• Full Cory-style outcome sandbox score JSON: docs/reports/leo-working-state-20260709/working-leo-cory-outcome-sandbox-score-current.json
• Live VPS handler direct-claim suite report: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-current.json
• Live VPS handler direct-claim suite score: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md
• Live VPS handler direct-claim suite review: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-review-current.md
• Telegram-visible direct-claim authorization packet, ready-to-request but not sent: docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-authorization-packet-current.md
• Telegram-visible direct-claim pre-send preflight, local packet checks pass but current shell cannot SSH to VPS: docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-preflight-current.md
• Telegram-visible direct-claim full-access remote readback command: docs/reports/leo-working-state-20260709/telegram-visible-direct-claim-remote-readback-command-current.sh
• Argus public KB state probe, read-only HTTP diagnostics: docs/reports/leo-working-state-20260709/argus-kb-state-current.md
• Live VPS handler direct-claim follow-up challenge report: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-followup-current.json
• Fable onboarding prompt: docs/reports/leo-working-state-20260709/fable-leo-teleo-onboarding.md
• Operator surface map: docs/reports/leo-working-state-20260709/operator-surface-map.md
• VPS/Hermes/DB mapping: docs/reports/leo-working-state-20260709/vps-hermes-db-mapping-20260709.md
• DB provenance/load-path report: docs/reports/leo-working-state-20260709/leo-db-provenance-report-20260709T214741Z.md

Telegram And Live Leo Proof

• Live Telegram canary: docs/reports/leo-working-state-20260709/telegram-live-canary-current.md
• Live Telegram canary JSON: docs/reports/leo-working-state-20260709/telegram-live-canary-current.json
• Live Telegram DB-write canary: docs/reports/leo-working-state-20260709/telegram-live-db-write-canary-20260709.md
• Live Telegram DB-write canary JSON: docs/reports/leo-working-state-20260709/telegram-live-db-write-canary-20260709.json
• Handler canary: docs/reports/leo-working-state-20260709/telegram-gateway-handler-canary-current.md
• Handler canary JSON: docs/reports/leo-working-state-20260709/telegram-gateway-handler-canary-current.json
• Handler direct-claim suite: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-review-current.md

KB DB Apply Proof

• Strict apply plan: docs/reports/leo-working-state-20260709/kb-apply-canary-plan-current.md
• Strict apply execute: docs/reports/leo-working-state-20260709/kb-apply-canary-execute-current.md
• Claim/source preview: docs/reports/leo-working-state-20260709/claim-source-contract-preview-current.md
• Mapped rich proposal plan: docs/reports/leo-working-state-20260709/rich-proposal-creation-plan-mapped-current.md
• Mapped production apply packet, not executed in production: docs/reports/leo-working-state-20260709/production-apply-packet-current.md
• Mapped production apply packet JSON: docs/reports/leo-working-state-20260709/production-apply-packet.json
• Mapped production apply authorized commit SQL, not executed in production: docs/reports/leo-working-state-20260709/production-apply-authorized-commit.sql
• Mapped production apply delete rollback SQL: docs/reports/leo-working-state-20260709/production-delete-rollback.sql
• Cross-surface strategy anchor companion packet, not executed in production: docs/reports/leo-working-state-20260709/cross-surface-resolution-current.md
• Cross-surface packet JSON: docs/reports/leo-working-state-20260709/cross-surface-packet.json
• Cross-surface authorized commit SQL, not executed in production: docs/reports/leo-working-state-20260709/cross-surface-apply-authorized-commit.sql
• Cross-surface delete rollback SQL: docs/reports/leo-working-state-20260709/cross-surface-delete-rollback.sql
• Cross-surface clone commit/delete rollback log: docs/reports/leo-working-state-20260709/cross-surface-clone-rehearsal-current.log
• Rio strategy-context companion packet, not executed in production: docs/reports/leo-working-state-20260709/rio-strategy-context-current.md
• Rio strategy-context packet JSON: docs/reports/leo-working-state-20260709/rio-strategy-packet.json
• Rio strategy-context authorized commit SQL, not executed in production: docs/reports/leo-working-state-20260709/rio-strategy-apply-authorized-commit.sql
• Rio strategy-context delete rollback SQL: docs/reports/leo-working-state-20260709/rio-strategy-delete-rollback.sql
• Rio strategy-context clone commit/delete rollback log: docs/reports/leo-working-state-20260709/rio-strategy-clone-rehearsal-current.log
• Governance/concept-map schema companion packet, not executed in production: docs/reports/leo-working-state-20260709/governance-concept-current.md
• Governance/concept-map packet JSON: docs/reports/leo-working-state-20260709/governance-concept-packet.json
• Governance/concept-map authorized commit SQL, not executed in production: docs/reports/leo-working-state-20260709/governance-concept-apply-authorized-commit.sql
• Governance/concept-map delete rollback SQL: docs/reports/leo-working-state-20260709/governance-concept-delete-rollback.sql
• Governance/concept-map clone commit/delete rollback log: docs/reports/leo-working-state-20260709/governance-concept-clone-rehearsal-current.log
• Helmer 7 Powers proposal plan: docs/reports/leo-working-state-20260709/helmer-7powers-creation-plan.json
• Helmer 7 Powers apply packet, not executed in production: docs/reports/leo-working-state-20260709/helmer-7powers-production-apply-packet-current.md
• Helmer 7 Powers apply packet JSON: docs/reports/leo-working-state-20260709/helmer-7powers-production-apply-packet.json
• Helmer 7 Powers authorized commit SQL, not executed in production: docs/reports/leo-working-state-20260709/helmer-7powers-production-apply-authorized-commit.sql
• Helmer 7 Powers delete rollback SQL: docs/reports/leo-working-state-20260709/helmer-7powers-production-delete-rollback.sql
• Working Leo integrated packet manifest, not executed in production: docs/reports/leo-working-state-20260709/working-leo-integrated-packet.md
• Working Leo integrated packet JSON: docs/reports/leo-working-state-20260709/working-leo-integrated-packet.json
• Working Leo integrated clone rehearsal report: docs/reports/leo-working-state-20260709/working-leo-integrated-packet-current.md
• Working Leo integrated clone rehearsal log: docs/reports/leo-working-state-20260709/working-leo-integrated-clone-rehearsal-current.log
• Working Leo authorized-apply readiness verifier: docs/reports/leo-working-state-20260709/working-leo-apply-readiness-current.md
• Working Leo authorized-apply readiness verifier JSON: docs/reports/leo-working-state-20260709/working-leo-apply-readiness-current.json
• Working Leo authorized apply operator runbook, not executed: docs/reports/leo-working-state-20260709/working-leo-authorized-apply-runbook-current.md
• Working Leo authorized apply operator runbook JSON: docs/reports/leo-working-state-20260709/working-leo-authorized-apply-runbook-current.json
• Working Leo authorized apply session plan, not executed: docs/reports/leo-working-state-20260709/working-leo-authorized-apply-session-plan-current.md
• Working Leo authorized apply session plan JSON: docs/reports/leo-working-state-20260709/working-leo-authorized-apply-session-plan-current.json
• Working Leo production apply authorization packet, not executed: docs/reports/leo-working-state-20260709/working-leo-production-apply-authorization-packet-current.md
• Working Leo production apply authorization packet JSON: docs/reports/leo-working-state-20260709/working-leo-production-apply-authorization-packet-current.json
• Working Leo production apply authorization verification, currently refused/missing text: docs/reports/leo-working-state-20260709/working-leo-production-apply-authorization-verification-current.md
• Working Leo production apply authorization verification JSON: docs/reports/leo-working-state-20260709/working-leo-production-apply-authorization-verification-current.json
• Working Leo live production preflight baseline, read-only: docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.md
• Working Leo live production preflight baseline JSON: docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.json
• Working Leo production apply receipt template, not executed: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-template-current.md
• Working Leo production apply receipt template JSON: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-template-current.json
• Working Leo production apply receipt assembly, currently not ready: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-assembly-current.md
• Working Leo production apply receipt assembly JSON: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-assembly-current.json
• Working Leo production apply receipt validation, currently missing receipt: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-validation-current.md
• Working Leo production apply receipt validation JSON: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-validation-current.json
• Working Leo cleanup readback: docs/reports/leo-working-state-20260709/working-leo-cleanup-readback-current.md
• Working Leo cleanup readback JSON: docs/reports/leo-working-state-20260709/working-leo-cleanup-readback-current.json
• Helmer live rollback log: docs/reports/leo-working-state-20260709/helmer-7powers-live-preflight-rollback-current.log
• Helmer clone commit/delete rollback log: docs/reports/leo-working-state-20260709/helmer-7powers-clone-commit-delete-rollback-current.log
• Helmer ledger clone commit/delete rollback log: docs/reports/leo-working-state-20260709/helmer-7powers-ledger-clone-commit-delete-rollback-current.log

GCP

• Current GCP parity probe: docs/reports/leo-working-state-20260709/gcp-db-parity-current-probe-current.md
• Current GCP parity probe JSON: docs/reports/leo-working-state-20260709/gcp-db-parity-current-probe-current.json
• Prior auth-capable GCP blocker: docs/reports/leo-working-state-20260709/gcp-db-parity-current-blocker-20260709.json

Images

• Skill-pack map: docs/reports/leo-working-state-20260709/leo-db-state-13-skill-pack.svg
• Helmer packet proof: docs/reports/leo-working-state-20260709/leo-db-state-14-helmer-packet.svg
• Open-ended Cory-style canary map: docs/reports/leo-working-state-20260709/leo-db-state-15-open-ended-canary.svg
• Helmer ledger packet proof: docs/reports/leo-working-state-20260709/leo-db-state-16-helmer-ledger.svg
• Cory-style outcome benchmark map: docs/reports/leo-working-state-20260709/leo-db-state-17-cory-outcome-benchmark.svg
• Leoclean DB versus workspace map: docs/reports/leo-working-state-20260709/leo-db-state-18-db-vs-workspace.svg
• Claim/body/metadata schema map: docs/reports/leo-working-state-20260709/leo-db-state-19-claims-body-metadata.svg
• Cross-surface strategy anchor proof: docs/reports/leo-working-state-20260709/leo-db-state-20-cross-surface-anchor.svg
• Forgejo/load/agent update loop map: docs/reports/leo-working-state-20260709/leo-db-state-21-forgejo-load-agent-loop.svg
• Identity render / decision matrix / document artifact map: docs/reports/leo-working-state-20260709/leo-db-state-22-identity-render-matrix-artifacts.svg
• Rio strategy context packet proof: docs/reports/leo-working-state-20260709/leo-db-state-23-rio-strategy-context.svg
• Governance/concept-map schema packet proof: docs/reports/leo-working-state-20260709/leo-db-state-24-governance-concept-schema.svg
• Integrated apply rehearsal proof: docs/reports/leo-working-state-20260709/leo-db-state-25-integrated-apply-rehearsal.svg
• Direct-claim handler state: docs/reports/leo-working-state-20260709/leo-db-state-26-direct-claim-handler.svg
• Direct-claim handler pass state: docs/reports/leo-working-state-20260709/leo-db-state-27-direct-claim-handler-pass.svg
• DB loading diagram SVG: docs/reports/leo-working-state-20260709/leo-db-loading-diagram-20260709T214741Z.svg
• DB loading diagram Mermaid source: docs/reports/leo-working-state-20260709/leo-db-loading-diagram-20260709T214741Z.mmd

Current Claim Ceiling

• VPS Leo Telegram memory, KB audit, and staged-write canaries are live-proven.
• VPS Leo live-safe open-ended Telegram suite is live-proven and retained-benchmark-scored for OE-01 through OE-05: full selected coverage, 5/5 scored prompts passing, no overclaim, and no marker/staging/canonical KB rows created by the suite.
• The broader sandbox-first Cory-style benchmark has a full-catalog mixed-evidence score: real retained live Telegram evidence for OE-01 through OE-05, sandbox fixture replies for CS-01 through CS-09, and no-context direct-claim expected-answer/follow-up fixtures for DC-01 through DC-06, 20/20 passing. This is not a live Telegram run for the CS/DC prompts.
• The live VPS GatewayRunner direct-claim handler suite for exact DC-01 through DC-06 passed again after deploy SHA 7ab563e1aebe08913e72781e4e16a2b2883c5230: 6/6 runtime replies, strict score 6/6, no Telegram post, no live profile write, no production DB apply, unchanged DB counts (public.claims=1837, public.sources=4145, public.claim_edges=4916, public.claim_evidence=4670, kb_stage.kb_proposals=26 before and after), temp profile removed, and leoclean-gateway.service stayed active/running during the harness with MainPID=1908033, NRestarts=0, ExecMainStartTimestamp=Fri 2026-07-10 01:04:22 UTC.
• The Telegram-visible direct-claim benchmark is now executable as an exact authorization packet, not yet run: target Leo group -5146042086, raw no-context messages DC-01 through DC-06, expected proof paths, before/after DB/service readbacks, scorer output, and final screenshot/accessibility proof are retained in telegram-visible-direct-claim-authorization-packet-current.md; telegram_visible_messages_sent=false.
• The Telegram-visible direct-claim pre-send preflight harness now verifies the authorization packet and can consume a supplied VPS readback JSON payload. Current local packet checks pass, but this current shell cannot open SSH to 77.42.65.182:22 (Operation not permitted), so the retained preflight artifact is status=fail until a full-access VPS readback is supplied. The exact copy-pasteable full-access command is retained in telegram-visible-direct-claim-remote-readback-command-current.sh with SHA256 741b9ee14548122cc5e15009f3bbbbfddd4389a1452099265f80f367cbe467ec; no Telegram messages were sent and no DB apply ran.
• The public Argus KB diagnostics HTTP probe passes from live curl payloads captured at 2026-07-10T02:47:53Z: 3 approved proposals are visible (14fa5ecc, ac036c9d, a64df080), all are approved_needs_apply_payload, worker_applyable_count=0, and the endpoint is read-only. This supports Leo's expected answer that the approved KB work is not yet directly applyable/canonical, but it is not Docker/Postgres row-count or gateway-service proof.
• The highest-risk direct-claim cases are now green at handler level: DC-02 recognizes approved Helmer staging row a64df080-8502-42e2-98f4-9bbdecb8da73 as approved/unapplied, DC-03 says the decision-matrix path is not shipped while matrix tables are absent, DC-04 avoids a single-cause document pointer diagnosis, DC-05 separates staging demo from authorized canonical apply, and DC-06 separates SOUL.md runtime edits from canonical DB identity.
• A strict canonical add_edge apply canary is live-proven.
• Helmer 7 Powers is full-coverage packet and ledger clone-proven, not production-applied.
• Mapped rich approved proposal packet is clone/rehearsal-proven for the supported subset, not production-applied.
• The strategy-anchor companion write for mapped rich proposal 14fa5ecc is clone-proven and reversible, not production-applied.
• The Rio strategy-context companion write for mapped rich proposal 14fa5ecc is clone-proven and reversible: after the mapped base packet exists, it creates 2 Rio strategy nodes and 5 strategy anchors in a disposable clone; production stayed unchanged.
• The governance/concept-map schema companion write is clone-proven and reversible: after the mapped base packet exists, it creates minimal concept-map and claim-to-governance link tables, then inserts 1 concept map, 1 concept link, and 2 governance links in a disposable clone; production stayed unchanged.
• The full integrated packet set is now clone-proven in production dependency order: mapped base, cross-surface anchor, Rio strategy context, governance/concept schema, and Helmer 7 Powers applied together in teleo_integrated_rehearsal_20260710, then rolled back in reverse order; production stayed unchanged and the disposable clone/temp files were removed.
• The authorized-apply readiness verifier now passes: packet files exist and hash, apply/rollback order matches the manifest, expected counts match, clone apply/rollback markers are ordered, clone cleanup is proven, service stayed stable, and production_apply_executed=false.
• The authorized apply operator runbook is generated and ready-not-executed: it gives preflight/apply/postflight/rollback command templates in manifest order, requires TELEO_DATABASE_URL, and now also includes a post-apply regression command bundle plus required production-apply receipt fields and an offline receipt validator. It still does not authorize or execute production SQL.
• The authorized apply session plan is generated and ready-not-executed: it maps concrete output log paths for pre-apply validation, preflight, apply, postflight, post-apply regression, service readback, cleanup readback, receipt validation, and rollback. Apply and rollback steps require explicit authorization; non-apply steps are marked non-mutating.
• The production apply authorization packet is generated and ready-to-request, not authorized/executed: all evidence gates pass, it names the exact integrated packet order and the operator authorization template, requires a fresh deployed-SHA readback at apply time, and keeps production_apply_executed=false plus production_apply_authorization_present=false.
• The production apply authorization verifier currently refuses the apply window in the committed artifact: deployed_sha_shape=false, fresh_deployed_sha_required=true, authorization_text_present=false, operator_identity_present=false, authorization_text_matches_expected=false, safe_to_enter_apply_window=false, and production_apply_executed=false. At apply time, it must be rerun with a fresh deployed-SHA readback.
• The live production preflight baseline now passes through the read-only collector: 5/5 preflight files executed on the VPS with begin transaction read only, mutates_production_db=false, applies_production_packet=false, and production_apply_executed=false. Current production still has generated base rows 0/0/0/0, Helmer rows 0/0/0/0/0, no generated governance/concept tables, and dependent Rio/cross-surface/governance base rows absent before any apply, as expected.
• The production apply receipt template is generated but intentionally invalid as a final receipt: production_apply_executed=false, valid_production_receipt=false, and it names the fields that must only be filled after authorized apply execution (explicit_authorization_record, operator_identity, apply_output_paths, postflight_output_paths, actual_after_apply_counts, telegram_or_handler_regression_paths, service_readback, cleanup_readback).
• The production apply receipt assembler currently refuses final receipt emission: receipt_ready=false, authorization_verified=false, all_session_artifacts_exist=false, actual_counts_match_expected=false, no apply/postflight/regression/service/cleanup logs exist, and production_apply_executed=false.
• The production-apply receipt validator currently reports missing_receipt, which is correct because no production apply has been authorized or executed.
• DB-first identity rendering is now documented from the July 9 PDFs plus VPS readback: canonical identity rows feed rendered SOUL.md, direct SOUL edits are not canonical DB updates, and no active renderer/timer/hook is proven in the current VPS readback.
• The decision-matrix approval schema is still a target design on the current VPS: kb_stage.matrix_voters, kb_stage.proposal_votes, and kb_stage.proposal_decisions were not present in live schema readback.
• Pending/approved document proposals are real kb_stage.kb_proposals rows with source_refs, but inspected source_refs did not directly match public.sources; they still need review/apply mapping into canonical sources/evidence/edges.
• Governance-gate and concept-map targets are now schema-packet-proven, but not production-applied; the live VPS production schema still has no generated governance/concept tables.
• The live VPS runtime behavior should not be changed while the DB apply path is stabilized.
• Latest cleanup readback found no leftover rehearsal/clone/staging database names on the VPS Postgres container and did not mutate production DB or post to Telegram.
• A live Telegram regression canary should be rerun after any production apply; no production apply has been authorized or executed.
• GCP parity remains blocked by account auth/access facts until a fresh readback proves otherwise.