The Trilogy Times

Implements all nine source-shaped Dictionary routes and five Enablement workflows against existing Surtr Redshift snapshots. Selects whole successful publications by school, local date and incident capture bounds; preserves source fields and excludes media/demo alerts. Missing security feedback is null with explicit not-captured coverage, so independent security-review counts remain unavailable. Adds the isolated reader secret and scoped warehouse network access.

Validation: 19 tests pass (configured-template setup test skipped), independent snapshot review passes, CI including Docker and redacted secret scan is green. All nine routes and five workflows pass through the deployed HTTPS service and match local real-warehouse results. Served inventory: 1 school, 2 floors, 11 locations, 16 cameras. Reports: 23 space, 35 presence, 12 attention, 27 risk rows. Incidents: 50 served after four demo exclusions; September has 17 rows, three verifier tier-1 grades, and 17 source-null guide reviews. Security counts are unavailable; camera heartbeat nulls leave outage duration unknown. Missing dates return explicit not-captured coverage.

Final service: https://marauders-map-dss.klair.ai/api/skill . Final release and CI succeeded for main 5613b2ed59bbe55bc296046fb61f909739106b98. Internal validation keys are revoked; no recipient keys issued. No Surtr/source/schedule changes or pipeline invocations.

Linear: AERIE-2855

## Testing contract

### What this PR delivers

Two additions to the Portfolio site reads, so a caller can tell which sites changed without re-reading the whole portfolio.

1. lastChangedAt on each row of GET /v2/portfolio/sites and on GET /v2/portfolio/sites/{siteRef}: the time of the latest audit entry recorded against the site. That covers the site record and its audited child records (notes, documents, work, backup links). Null when no audited change is on record.

2. changedSince query filter on GET /v2/portfolio/sites: return only sites whose lastChangedAt is at or after the given instant.

Why: a full read of the 88 active sites is about 2,700 calls today because nothing says what moved, and no served value says when a site last changed. With these, a repeat sweep lists the sites changed since its last run and re-reads only those.

### Who uses it and where

API-key callers with operations.portfolio.read (the existing capability for both reads). No UI change. No new operation.

### Conditions needed

- Sites with and without rows in auditLog.

- For the filter: at least one site with an audit row newer than the chosen instant and one without.

### Expected behavior and examples

- A site with no audit rows returns lastChangedAt: null.

- A site with audit rows returns the newest row's time, whichever record it was written against. Example: one audit row against the site and a later one against a note on it → the later time.

- ?changedSince=2026-10-01T00:00:00Z returns only sites changed at or after that instant; a site with null is never returned. The comparison is inclusive.

- The filter is applied after the page is read, like the existing status filter, so a page can be short or empty while hasMore is true. The contract tells callers to follow the cursor to the end. Example: limit=1 with the match on the second site → first page empty with hasMore: true, second page has the match.

- The filter is bound into the cursor. Using a cursor with a different changedSince (or without it) returns 400 invalid_cursor. Cursors issued before this change carry no filter and keep working unfiltered.

- A value that is not an ISO date-time with an offset (a bare date, free text, a time with no zone) returns 400.

- lastChangedAt is one indexed read per site (auditLog.by_site, newest first), so a page of 100 is at most 100 extra reads.

### Limits and unanswered questions

- This is "last audited change", not a full modification time. Writers that skip the audit log do not move it: the scheduled REBL geography copy, the school-calendar copy, the HubSpot program-code copy, and raw imports. Both the field and the filter say so in the published contract, and the filter tells callers to run an unfiltered sweep periodically. Closing this properly needs a stamped sites.updatedAt with a backfill, or audit entries on those writers. Not attempted here.

- The value is per site, not per card. A per-card updatedAt was asked for and is not delivered: the audit row does not say which card changed.

- lastChangedAt is a new required field on two response schemas. Additive for JSON consumers, but a strict client validating against a pinned schema will need the new contract.

- Not run locally: the full repository test suite. CI runs it.

## Business Value

Edu Ops' agents and the DSS registry sweep the portfolio on a schedule, and the sweep is bounded by the shared rate limit: about an hour and a half for a full pass. Reading only what changed turns most passes into a handful of calls, which is what makes a frequent data-quality loop affordable.

## Manual Effort Estimate

About 6 hours by hand (trace audit coverage, design the cursor binding, implement, test). Proposed figure; Keval to confirm or adjust.

## Testing

- New HTTP test covers null and non-null values on list and detail, the inclusive filter, a future instant, sparse paging, cursor binding and three malformed inputs.

- portfolioDomain.test.ts passes (30 tests); the existing exact-body list test is updated for the new field.

- Pre-commit type check and lint pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

The School Ops dashboard now loads even when one site from Aerie fails the operating-site schema. Invalid sites are skipped and logged with their ID, slug, and the failing field paths. The load still fails with 502 only when no site validates.

Fixes [AERIE-2823](https://linear.app/builder-team/issue/AERIE-2823).

## Why it's needed

fetchRhodesDashboardSites ran rhodesOperatingResponseSchema.safeParse on the whole sites array. One non-conforming site rejected the batch with "Aerie returned an unexpected site shape" (502), so nobody could load the dashboard: 10 events across 5 actors. The Zod issues were logged without saying which site they belonged to, so the bad record couldn't be identified. This is the same all-or-nothing behaviour behind AERIE-1053; that fix (#571) only relaxed the DRI-ref sub-schema.

## Changes

- chat/lib/rhodes-dashboard-server.ts:

- validate the envelope (sites must be an array), then parse each site with rhodesOperatingSiteSchema;

- skip invalid sites and console.error a summary: rejected and accepted counts, plus _id, slug, and each issue's path, code, and message for up to 20 sites;

- return the existing 502 only when the array is non-empty and nothing validates.

- rhodes-dashboard-server.node.test.ts: a payload with one valid site and one with a non-numeric tuition returns the valid site and logs site_2 / tuition. This test fails without the change. The existing all-invalid test still expects 502.

## Breaking changes

None. Valid payloads are unchanged, and rhodesOperatingResponseSchema is still exported for its other users.

## Test plan

- [x] chat: npx vitest run lib/__tests__/rhodes-dashboard-server.node.test.ts lib/__tests__/operating-sites.node.test.ts lib/__tests__/rhodes-operating-contract.node.test.ts app/api/operating-sites app/api/sync/accountability (134 pass)

- [x] Pre-commit biome + typecheck-chat

- [ ] CI

- [ ] After deploy: no new load_operating_sites 502s; check the logs for "Skipped Aerie sites that failed validation" to find the bad record

## Summary

- publish typed HubSpot program code/name aliases through the accepted Alpha staging boundary

- exclude archived and publication-unready program records at that shared boundary

- move canonical program identity, SIS campus resolution, and the projection compatibility bridge off stg_educrm_all_program

- remove the obsolete staging model and all_program dbt source declaration

## Warehouse comparison

Read-only Redshift comparison on 2026-10-14:

- legacy all_program: 95 distinct program IDs

- typed Alpha programs: 123 IDs total; 118 active and publication-ready

- every one of the 95 legacy IDs exists in typed programs with identical program code and display name

- 23 active/ready typed-only IDs expand source coverage; 5 additional typed-only IDs are archived test rows and are excluded

- built pr1876_int_program_identity versus current int_program_identity: 118 rows before, 118 rows after, 0 differing rows across every published column

## Validation

- dbt parse --no-partial-parse

- exact unit test: stg_education_hubspot_program_keeps_only_active_ready_alpha_rows (pass)

- dbt build --select +int_program_identity --indirect-selection cautious --vars {pr_number: 1876} (42/42 pass)

- related SIS/projection build (23 pass, 1 existing WARN for four unresolved SIS campuses)

- full PR model/seed build with tests excluded (148/148 pass)

- full dbt test (740 pass, 11 warnings, 3 failures all on newly built Alpha Orlando 2026 forecast state: assert_forecast_session_1_reconciles, assert_forecast_unavailable_without_rate, and assert_forecast_v4_publication_contract; the same three assertions pass against the current materialized production models)

- static scan confirms no dbt SQL/YAML reference remains to stg_educrm_all_program or source(educrm, all_program)

Closes #1876

## Summary

- exclude HubSpot programs hidden from dashboards at the shared typed staging boundary

- exclude _test_ program records to match the reporting program dimension

- cover both reportability filters in the staging unit test

## Production evidence

- Alpha Orlando (26463204892) and Alpha Folsom (29735717529) both have show_in_dashboard = false

- applying the reporting filters reduces the typed active/ready set from 118 to 95 programs, matching sales_educrm_wh_mart_all_program

## Validation

- dbt parse --no-partial-parse

- focused dbt unit test: PASS

- live Redshift predicate check: Orlando and Folsom excluded

Creates the standalone snapshot service from DSS-Template with isolated key, feedback, ECS and deployment resources. Retains manual protected OIDC releases and adapts the supplied public documents to September snapshot semantics. Data routes follow in the next change. Validation: template tests, typecheck and build pass.

Linear: AERIE-2854, AERIE-2855 (the upstream changes this publishes)

## What changed

Publishes two read improvements that went to production in Aerie on 2026-10-14.

- New operation: GET /api/v1/insights/quality-bars/catalog, the scoring catalog quality-bar scores are computed against. The surface is now 45 operations (43 GET, 2 POST).

- Refreshed contract from the system of record. Site list rows and site detail now carry lastChangedAt, and the site list accepts changedSince.

- Enablement: two new sections, "Re-read only what changed" and "Check how a quality-bar score was computed", and two rows in the business-question table. Both state the limit: lastChangedAt sees audited changes only, so scheduled copies and bulk imports do not count.

- Dictionary: the operation count only (42 → 43 GET). No other change to the published definitions.

- Name rewrite: the refreshed contract carried a fixed actor label, "External, no Aerie account". It is now renamed in responses and the contract, matched as a whole value only, so a person's text containing the same words is untouched.

## Business Value

The registry and JC's agents sweep the portfolio under a shared 10-per-minute budget, about an hour and a half per pass. Re-reading only what changed makes a frequent pass affordable. The catalog closes an open registry finding: quality-bar scores can now be checked rather than taken on trust.

## Manual Effort Estimate

About 2 hours by hand. Proposed figure; Keval to confirm or adjust.

## Testing

- pnpm check passes locally except two infrastructure tests that time out at the default 5 s on this machine (CDK synth); they pass with a longer timeout.

- Contract test confirms no upstream platform name in the published contract, including the new label.

- Every route cited in the enablement is published and uses only declared parameters.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

This PR is the blocking repair in [AERIE-2653 — Complete all remaining production observe cohorts and close the rollout](https://linear.app/builder-team/issue/AERIE-2653/complete-all-remaining-production-observe-cohorts-and-close-the).

It makes the Commit Proposal boundary receipt-owned: the Agent returns only its five decision/evidence fields, while Aerie restores contractVersion, targetRef, and the complete input fence from the persisted receipt before applying the existing authoritative validation. It also explicitly sets the Commit Proposal Agent's optional model Quality Bar to null while retaining Sindri Output Format validation. This work is tracked by [AERIE-2837 — Make Commit Proposal receipt-owned and remove its model Quality Bar](https://linear.app/builder-team/issue/AERIE-2837/make-commit-proposal-receipt-owned-and-remove-its-model-quality-bar).

Production effect: controlled rollout or migration. Merging changes the accepted Commit Proposal wire contract, but it does not publish Sindri assets, start reconciliation, enable writes, clear the ANDON, or resume the rollout. Deployment and asset publication are separate, coordinated actions.

---

## Why

The Boston observe run failed because an Agent-carried copy of otherwise-valid receipt metadata omitted one type: "string". The Carrollton proposal passed Aerie's deterministic validator but was subsequently vetoed by a malformed optional model Quality Bar verdict. This repair removes both non-authoritative failure modes without weakening receipt fencing, citation validation, stale-work checks, canonical hashing, replay idempotency, or observe-mode no-write behaviour.

---

## Business Value

- Prevents model copying errors from corrupting Site identity, allowed-field schemas, or source fences already held by Aerie.

- Prevents an optional model judge from overriding Aerie's deterministic proposal validator.

- Keeps stored proposals fully auditable because their canonical representation still contains the complete receipt-bound context.

- Preserves observe-mode safety and existing commit-mode approval and kill-switch controls.

---

## How does it work

1. @bran/contracts defines an exact Agent-owned proposal containing only sourceAssessments, operations, dispositions, citations, and decision.

2. bindReconciliationAgentProposalV1 rejects legacy envelope fields and unexpected keys, then combines the Agent decision with Aerie's authoritative receipt envelope.

3. Draft validation and final settlement both use the same receipt-bound validation seam before existing citation, policy, freshness, lease, and canonical-hash checks run.

4. Aerie continues storing the complete canonical proposal and hash; existing stored full proposals remain readable and require no migration.

5. The Commit Proposal Agent and Workflow assets request the five-field shape, retain required Output Format validation, and explicitly set successCriteria: null.

6. Asset publication, production registration changes, deployment, and rollout resumption remain deliberately inactive.

---

## Scope

### Included in this phase

- Exact five-field Commit Proposal Agent input contract.

- Authoritative receipt-envelope binding shared by draft and final validation.

- Strict rejection of legacy, mixed, nested-stringified, and unknown Agent proposal shapes.

- Preservation of complete canonical proposal storage and terminal replay behaviour.

- Explicit removal of only the Commit Proposal model Quality Bar.

- Updated Commit Proposal Agent, Skill, and Workflow assets.

- Regression and local write-disabled Boston/Carrollton coverage.

- Exact final diff paths:

chat/convex/reconciliation/finalOutputSettlement.test.ts
chat/convex/reconciliation/finalOutputSettlement.ts
chat/convex/reconciliation/readiness.ts
chat/convex/reconciliation/validator.test.ts
chat/convex/reconciliation/validator.ts
chat/convex/reconciliation/validatorHttp.test.ts
chat/convex/reconciliation/validatorHttp.ts
chat/sindri-assets/document-field-reconciliation/agents/commit-proposal.json
chat/sindri-assets/document-field-reconciliation/assets.test.ts
chat/sindri-assets/document-field-reconciliation/skills/aerie-reconciliation-commit-proposal/SKILL.md
chat/sindri-assets/document-field-reconciliation/workflow.json
packages/contracts/src/reconciliation.test.ts
packages/contracts/src/reconciliation.ts

### Deliberately excluded for later phases

- Publishing or mutating any Sindri Agent or Workflow version.

- Updating the production Workflow registration or retrying a historical run.

- Deployment, production starts, write enablement, ANDON clearance, or rollout continuation.

- Changes to the Evidence Analyst or Site Reconciler contracts.

- Sindri runner changes, schemas, migrations, backfills, new endpoints, or new MCP tools.

- Reviving AERIE-2668 through AERIE-2671 or the retired source-relevance classifier design.

- Reimplementing the two citation-organisation suggestions that existed only in the model judge.

---

## Test plan

### Automated validation

- Contracts reconciliation tests — 15/15 passed (cd packages/contracts && pnpm exec vitest run src/reconciliation.test.ts --reporter=verbose).

- Commit Proposal asset tests — 7/7 passed (cd chat && node --test sindri-assets/document-field-reconciliation/assets.test.ts).

- Focused validator, validator HTTP, and settlement tests — 35/35 passed (cd chat && pnpm exec vitest run convex/reconciliation/validator.test.ts convex/reconciliation/validatorHttp.test.ts convex/reconciliation/finalOutputSettlement.test.ts).

- Full Chat reconciliation edge project — 131/131 passed during final independent review.

- Local isolated E2E — 61/61 intended checks passed across saved-case replay, explicit-null runner behaviour, observe settlement, exact replay, focused tests, and assets.

- Contracts typecheck — passed (pnpm --dir packages/contracts typecheck).

- Chat and Convex typecheck — passed (pnpm --dir chat typecheck).

- Rhodes worker typecheck — passed (pnpm --dir chat/rhodes-worker typecheck).

- Architecture boundaries, Convex paths, read bounds, and test architecture — passed.

- git diff --check — passed.

- Independent review — PASS for exact commit 8f0db85ba2dee36d7516abf4d12cb2a7adaafc39.

A mistakenly broad local contracts invocation also ran unrelated tests. The target reconciliation file passed, while an unrelated large-bundle stress test timed out at its existing 5-second limit. It was not changed or rerun; the corrected target-only command passed 15/15. Hosted CI remains the final full-suite gate.

### Time for Implementation

Approximately 4–6 engineering days without AI assistance, including failure analysis, contract design, implementation, regression coverage, independent review, saved-case replay, and rollout-safety validation.

### Manual QC

A local, isolated, write-disabled E2E replay used the supplied private Boston and Carrollton saved inspections without production credentials, networks, or model calls.

- Boston: the saved receipt retained both string schemas while the Site Reconciler handoff omitted one. The old full-proposal path rejected the corruption; candidate receipt binding restored type: "string" from Aerie's receipt. The exact historical Commit Proposal validator request was not retained, so this is explicitly not represented as an exact replay of that missing payload.

- Carrollton: both captured proposals were reduced to the five Agent-owned fields, rebound to the authoritative envelope, and reproduced canonical hash d5fee920068a6a4ce80884f98a392cf1096ec35d2d4e3a5e9eeff1eb2cf2117b.

- Explicit successCriteria: null: Output Format still accepted valid output and rejected malformed output; generic judge calls were zero.

- Observe settlement and exact replay: five terminal invocations completed with no_write; Site changes, field-history rows, provenance rows, scheduled functions, outbound calls, and duplicate proposal/citation rows were all zero.

The redacted E2E report SHA-256 is 7e1486dcf55bda8cdd107be65d2c71bec06215d8c9eadef2a4271a7057cdd2dc. Private production-derived fixtures were not committed.

---

## Limits and unanswered questions

- The exact historical Boston Commit Proposal validator request was not retained. Saved evidence directly proves the valid-receipt/corrupt-handoff mismatch; the candidate repair used a minimal five-field decision over that saved envelope.

- The new five-field Agent contract and Aerie deployment require a coordinated cutover because candidate Aerie intentionally rejects the old eight-field Agent output.

- Sindri asset publication, production registration updates, and rollout resumption require separate authorization after merge and deployment.

- This exact validated head is based on 2f18213cea317c2f2010ee927ae7aa819e7e1dec; main has advanced. Before merge, the branch must be updated and the exact-head merge gates rerun. Do not treat the current local E2E as evidence for a different rebased or merged SHA.

## Summary

When driveSearchFiles hits Drive's 200-folder recursive-search limit, the Flue gateway now returns the tool's guidance ("Pass a more specific folderId") to the agent as an invalid request. It no longer reports a transient Rhodes MCP failure, and the case is no longer captured as an unexpected Platform Error.

Fixes [AERIE-2812](https://linear.app/builder-team/issue/AERIE-2812).

## Why it's needed

extractRhodesMcpToolPayload wrapped every isError: true tool result in a plain Error whose message starts with "Rhodes MCP tool returned an error". codeForGatewayError matches the substring MCP before any other rule, so a deterministic tool-level limit became rhodes_mcp_upstream_error, then transient_failure, then a 502. The 502 was captured as an unexpected Platform Error, and the agent was told the capability was temporarily unavailable. The two production occurrences were for a site whose Drive tree had 227 folders.

## Changes

- chat/convex/agentRuns/http.ts:

- extractRhodesMcpToolPayload now throws a RhodesMcpToolError, which keeps the tool's text. The message format is unchanged.

- codeForGatewayError classifies RhodesMcpToolError by that text:

- a non-retryable result that matches Drive's "exceeding the N-folder search limit" guard becomes gateway_invalid_request, a 400 that isn't captured and that returns the tool message to the agent;

- everything else, including Rhodes' structured retryable: true errors, stays rhodes_mcp_upstream_error as before.

- chat/convex/agentRuns.test.ts has two gateway tests:

- the folder-limit result returns 400 with the guidance and records no errorEvents; this test fails without the fix;

- a retryable Rhodes tool error still returns 502 transient_failure and is captured.

## Breaking changes

None. Transport failures, timeouts, JSON-RPC errors, and other tool errors are classified exactly as before.

## Test plan

- [x] chat: npx vitest run convex/agentRuns.test.ts (115 pass)

- [x] Pre-commit biome + typecheck-chat

- [ ] CI

- [ ] After deploy: no new /agent/flue-gateway Platform Errors for driveSearchFiles folder-limit responses

## Summary

When a Drive upload succeeds but the stored file doesn't match the approved filename, MIME type or byte length, the Rhodes upload approval now fails with a clear "ask Rhodes to propose the upload again" message. Previously it stayed stuck, and every "Approve again" failed the same way.

Fixes [AERIE-2832](https://linear.app/builder-team/issue/AERIE-2832).

## Why it's needed

verifyAndCompleteAerieDriveUpload threw on a metadata mismatch without changing the pending mutation. The row stayed uploading with uploadedFileCandidateId set, so getUploadSessionDisposition returned verify_candidate on every retry, which re-checked the same immutable Drive file against the same approved args. Meanwhile the card told the user to "Click Approve again… the file will not be uploaded again", so they kept retrying a check that could never pass. This was captured twice for one Moderator-Approvals user, on two permit uploads.

## Changes

- rhodes-worker/src/upload-recovery.ts: new uploadedDriveFileApprovalMismatch helper holding the existing name, MIME type and byte-length comparisons, with the same messages.

- rhodes-worker/src/index.ts: on a mismatch, verifyAndCompleteAerieDriveUpload now calls markPendingMutationFailed and returns the failed result. The error names the Drive file ID so the stray file can be found. This covers the upload-complete route, and the verify_candidate and intent-recovery paths of upload-session, so rows already stuck in uploading reach the failed state on their next approval.

- components/rhodes-mutation-card.tsx: a failed result from upload-session or upload-complete raises RhodesUploadProposalMismatchError. That puts the card in its existing needs-new-proposal state, skips Platform Error capture, and no longer adds "Click Approve again". The staged attachment is kept for the new proposal.

## Breaking changes

None. Once a mismatch happens, the pending mutation is failed instead of uploading, so the user re-proposes rather than retrying.

## Test plan

- [x] rhodes-worker: new helper test, full worker suite (323 tests) and tsc --noEmit pass.

- [x] rhodes-mutation-card.node.test.ts: new test covering a failed upload-complete result and a retry where upload-session returns failed. It fails without the fix, because the error is the "Drive upload succeeded… Click Approve again" message.

- [x] tool-call.test.tsx upload and registration tests pass (24).

- [x] Pre-commit biome and typecheck pass.

Closes #1873

## Summary

- replace is_new_contact with the established is_brought_by_event contract

- retain the event-capped effective registration timestamp through the event mart

- add focused divergence tests and participant-level legacy reconciliation

## Validation

- dbt parse --no-partial-parse

- exact participant unit test

- targeted affected-model dbt tests (23/23 pass)

- real PR-prefixed mart build and warehouse reconciliation

## Reconciliation note

The direct mart reproduces the reviewed classification rules. Remaining legacy deltas are concentrated in known source-resolution differences: the legacy mart registration timestamp often comes from its historical form/registration enrichment, while the direct HubSpot mart intentionally retains #1871 participation resolution. No new stages or aggregates are introduced.