@@ -42,7 +42,7 @@ Never mark a gate `Passed` without its approved SHA, deployment disposition, evi
 | Phase 1a: Metamind implementation | Passed | Metamind `fb6a7b706106306d95861ebe4a7abf0f5c65c6b8` (merged to `dev`) | Not applicable: implementation gate; production still on the baseline | [PR #17](https://github.com/ProofOfTechOrg/metamind/pull/17) merged, [CI passing](https://github.com/ProofOfTechOrg/metamind/actions/runs/30325493776) (app, worker, preflight). Worker lane covers typecheck, 716 tests, Biome, proof-runner self-test in both modes, `pnpm build` + `validate-build.sh`. Both migration copies apply to SQLite with identical schemas; the additive file is idempotent | `2026-07-28T03:21:33Z` | Engineering |
 | Phase 1b: Metamind attended deployment and proof | Passed | Metamind `434c1a7f5c368d4910c78c59997623762185fda8` (merged to `master`) | Version `3f1ba280-6cbe-480c-89fd-47b4daf2f731` at `2026-07-28T06:18:01Z`, message `release 434c1a7f5c368d4910c78c59997623762185fda8`. Superseded at `2026-07-28T16:29:30Z` by version `56fb278f-15f3-40f1-ab3b-a0276d123bfa` (`b70c40e39b74a98f79199634a5390d32610b180e`), which repointed `UNDERSTUDY_URL` at the routed domain | D1 lease migration applied BEFORE the first promotion: `changes: 1, changed_db: true, num_tables: 34`; `browser_session_leases` present with both indexes and queryable post-deploy. `/health.commit` confirmed by consecutive matching reads at each deploy. [PR #18](https://github.com/ProofOfTechOrg/metamind/pull/18), [PR #19](https://github.com/ProofOfTechOrg/metamind/pull/19), [PR #20](https://github.com/ProofOfTechOrg/metamind/pull/20). Smoke: `/` 302 to `/app/`, `/app/` 200, `/v1` 401 unauthenticated. **Attended production proof PASSED** on run `metamind_efefdb2e-2aed-441a-af6b-527e640c816f` — all eight gates in the table below, including a datum read from behind a portal login and a lease `released` on a confirmed 204. Three attempts were needed; the first two failed on consumer defects, all fixed. **Phase 1's durable-cleanup guarantee is met on the attended path**: the `16:30Z` sweep cleared four real orphans (three `minting`, one `cleanup_pending` carrying the 404) to `released` with null errors. All six leases are `mode=attended`, so the unattended replay remains unproven until Phase 4 — see the scope limit under the resolution | `2026-07-28T16:30:22Z` | Release operator |
 | Phase 2: Understudy `v2`, flags-off rollback baseline | Passed | `5cc969024b32380f1a3e14ff6f72e8d0c808b086` (deployed; approved at `dd7c100343cfc15e02802d93831600e0535670ed`) | Deployment `1c32a8e9-bf87-49eb-89a5-253ea4e47d1a`, version **`7eff2d11-2ba5-420b-b1f2-113faf0d6f73`** at `2026-07-28T04:29:57Z`, message `release dd7c100343cfc15e02802d93831600e0535670ed`. Previous baseline was version `41434382-ecdd-4f95-a27c-811c4337b6bd` | Verified at the approved SHA on a detached checkout: `pnpm install --frozen-lockfile`, `build`, `typecheck`, `test` (408 tests: 194 backend, 139 extension, 43 protocol, 32 connector), `wrangler deploy --dry-run`. All six secret names confirmed present — `DEVICE_TOKENS` and `WS_TICKET_SECRET` were MISSING and were provisioned first (see below). Active version exports `SessionAgent`, `DeviceAgent`, `TenantDeviceCoordinator`; binds `SESSION`, `DEVICE`, `TENANT_CONTROL`, `ANALYTICS`, `RATE_LIMITER`, `VAULT`, all six secrets, `QUOTA_POLICY`, and both rollout variables at `"[]"`. `/health` returns `{"ok":true}`; an unmapped token gets `401`; a well-formed unattended request gets `503 unattended sessions are disabled`, proving the flags-off baseline. Caller token rotated on both sides (Metamind confirmed as the only caller). The attended `curl` smoke test returns `200` with a `sessionId` after Understudy `e0351f6` (version `8ec9be79-76bb-4140-9530-402b4a46a40e`) fixed the empty-body discrimination — it had answered `400` for every over-the-wire caller. Baseline then advanced to `5cc969024b32380f1a3e14ff6f72e8d0c808b086` (version `fd67173d-e402-420d-9437-77dbc1e6be4a` at `2026-07-28T09:43:59Z`), which serves Understudy at `understudy.proofof.tech` while keeping `workers.dev` explicitly enabled; both hostnames return `200` on `/health`. The Metamind attended proof PASSED against this version | `2026-07-28T11:03:08Z` | Release operator |
-| Phase 3a: canary device acceptance | Not started | Pending | Pending | Pending | Pending | Canary operator |
+| Phase 3a: canary device acceptance | In progress | `3493b243c0aa61fb06ec19ad5dcb4eb197a2d670` | Allowlist deployment: version **`e0673967-0ca5-4cca-81ee-50d4088cec33`** at `2026-07-29T03:12Z`, message `release 3493b243c0aa61fb06ec19ad5dcb4eb197a2d670 - enable unattended for metamind`. Uploaded bindings confirm `UNATTENDED_ENABLED_TENANTS` and `SAFE_WRITE_REQUIRED_TENANTS` both `["metamind"]`. Previous flags-off baseline was version `fd67173d-e402-420d-9437-77dbc1e6be4a` | Device `aaf119f2-a85f-46b4-8b53-8e92196d6275` enrolled and `GET /v1/devices` reports `status: "online"`, `capacity: 2`, `used: 0`, `Chrome/150.0.0.0`, extension `0.1.1`, heartbeat 41s against the 75s offline threshold. Protocol 2 is ENFORCED, not merely reported: `src/device.ts` closes the control socket on a `protocolVersion` mismatch, and `listDevices` reports `incompatible` without the `safe-write-v2` capability, so `online` is unreachable below protocol 2. Device stayed `online` across the allowlist deploy (heartbeat 6s after). Both hostnames return `200`. **Remaining: the 13-scenario Chromium acceptance suite**, which needs an operator at the browser | Pending | Canary operator |
 | Phase 3b: 24-hour read-only soak | Not started | Pending | Pending | Pending | Pending | Canary operator |
 | Phase 4: governed Metamind unattended proof | Not started | Pending | Pending | Pending | Pending | Canary operator |
 | Phase 5a: one-record production gate | Not started | Pending | Pending | Pending | Pending | Canary operator |