Historical record: the application-wide stop restrictions below were superseded on September 15. This page is evidence, not current execution instructions.
The operator explicitly continued the next stage after image verification and independent review. The prior general automation stop and required final personal correctness acceptance remain in force. Current Codex owns this checkpoint; no background repair is implied.
PR 4366 (https://gitea.app.lan/AutoCoder/AutoCoder-Engine/pulls/4366) merged through the normal provider API at 19:19 UTC as e15fd937d3d495a6cf053b2c1958889a4c33bd82. Authoritative Git tree entries match reviewed recovery candidate 883f6b3561f3c31e87d488ec4caa524c5c43cf32 exactly. The sole change from c44 is the Dockerfile wasm-bindgen symlink. Repository Actions stayed disabled. This is the preserved worker implementation, not a replacement patch.
Published gitea.app.lan/autocoder/autocoder-engine:sha-883f6b3561f3 with manifest sha256:77a2bd51c946fba04f28c58ab2885a6ee91cfae465700c70399d5a11233f392c, matching the previously verified image. No latest tag or production workload image changed.
Verified context kubernetes-admin@kubernetes, established cluster at 192.168.1.9:6443. Created task-only namespace autocoder-1447-verification and pod reviewed-engine on drg-k8s.auth.home.lan. Deployed the exact digest, disposable PostgreSQL and a loopback-only fixture Gitea provider. No real repository/model credentials, no service-account token, no external Service or Ingress. Namespace NetworkPolicy denied ingress and egress; fixture traffic stayed within the pod. Registry pull secret was used only by the kubelet. All containers were non-root, dropped capabilities and disabled privilege escalation. Pod deadline 7200 seconds; bounded RAM-backed database and workspace. Limits: engine 1 CPU/4 GiB, PostgreSQL 0.5 CPU/512 MiB, fixture provider 0.1 CPU/128 MiB.
The production backend starts lifecycle/initialization/reconciliation loops unconditionally. Its existing flags cannot establish a general server-only pause. Starting it against production would resume unrelated automation, contrary to the stop. Therefore this deployment was explicitly isolated; it is not a production rollout or production acceptance claim.
Production codecartography issue 1447 still has the operator's 11 September 06:41 decision important=true, urgent=false with unchanged provenance. Its original recovery task remains completed/completed, original session/workspace/accounting preserved. Production backend and frontend remain desired replicas zero, PostgreSQL one ready, Actions disabled. No issue was edited or closed. Draft supervised-runner PR 4365 remains separate and unmerged.
The build prerequisite is integrated, published and demonstrated running. Production source-to-card-to-queue selection/admission, full recovered-cycle delivery and final operator acceptance are not complete. The concrete next stage is an independently reviewed server-only/supervised control path that can expose the repaired production API without starting unrelated controllers, followed by scoped admission verification. A green build, fixture tests or direct administrator delivery must not be called full autonomous recovery.
Bounded temporary evidence remains at /home/ax_julian/temp/autocoder-1447-image-verification: integration-verification.json, registry-push.log, isolated-deployment.json, deployed-pod.json, deployed-startup.log, acceptance-api-result.json, priority-before-restart.log, priority-after-restart.log, board-after-restart.json and database-acceptance.log. Owner current Codex; maximum 8 GiB retained total; review by 12 September. Original retained OCI archive/hash and worker work are preserved. Test namespace and port-forward are removed at the end of this checkpoint; this deletes only disposable fixture data. Temporary local loaded Docker image is removed after registry/deployment evidence is captured; the registry artifact remains. Restricted publication credentials were erased immediately after push.