Beta Readiness Checklist

Bert has run Sanctum unattended for months. Since 2026-05-20 the haus reboots itself, heals its own routing, and renews its own certs with nobody in the loop. That is not the same thing as handing it to a friend. A single technical friend with a Mac, one free week, and no operator sitting behind them is a different contract entirely — and this page is the honest ledger of the gap between the two.

What’s already solid (operator unattended)

The unattended layer is the part that already earned its keep. Everything in this table survives a power cut, a bad key, or a runaway log without a human noticing.

Layer	Status	Notes
Power-cycle recovery	live	autorestart=1, womp=1, autoLogin=bert, kcpassword present; 14 system-domain LaunchDaemons + all cathedrals KeepAlive=true
Cathedrals (Yoda 35B :1337 + Coder-14B :1338)	live	mTLS-only, plain-bridges on :1339 + :1234 for proxyd; smoke-tested HTTP 200 in 15ms
proxyd routing + autoheal	live	OpenRouter rotate-key + dual-mgmt-key failover, SOPS drift heal at 09:30 daily, model audit weekly
R2D2 v0.4 supervisor	live	11-layer safety stack, cycle bookends, chitti heartbeat, Force Flow escalation, audit log rotates at 50 MB. In classifier-only soak.
TLS certs	live	9 mTLS certs expire 2027 (yoda) / 2031 (rest) — years of headroom
TCC permission stability	live	7 brew formulas pinned (node, [email protected], uv, restic, lima) so versioned-path re-prompts stop
SSH unattended path	live	~/.ssh/sanctum_automation_ed25519 + restrict constraint + Host manoir-automation alias
Log bounded growth	live	sanctum-log-rotate.sh daily 04:30, .1.gz cascade with 3-deep retention
Audit trails	live	r2d2-audit.jsonl, chitti samskara, force-flow notifications.db, secret-rotator drift logs
Cross-session vault	live	Memory Vault on Mini, to: all broadcast, vault.sh ack flow
Daily VM↔GitHub sync	live	03:00 ET cron, ff skip on dirty tree with Force Flow alert
Doctrine	live	sanctum-docs publishes narratives + architecture pages, Cloudflare Pages deploy auto on push to main

What blocks the first friendly beta tester

Update — 2026-07-03 (beta-blocker sweep): a deep audit enumerated 28 beta blockers into a machine-checkable ledger (~/.sanctum/state/beta-blockers.yaml), read by the readiness ruler. As of this sweep: 19 fixed and merged, 4 staged behind one sudo launchctl kickstart -k system/com.sanctum.proxyd, 0 open, 5 deferred with written reasons (two cathedral inference-hot-path edges held for the parity harness; two Force Flow findings that are working-as-designed tradeoffs; net-heal owned by another session). The full arc — including the findings that were verified not to be bugs before anyone touched them — is in Closing the Gaps. The ruler, not this prose, is the source of truth: it exits non-zero while any blocker is open or staged.

The blockers that matter most

Ordered by impact, highest first — the four that stand closest to a stranger’s terminal.

1. sanctum-cli productization

Update — 2026-06-19 (v0.10.0): beta-readiness pass shipped. The whole brew install path is now exercised by a real macOS CI job on the tap — it downloads the release tarball, verifies the sha256, builds the venv, and smoke-tests the binary on a clean runner. That E2E caught a genuine install bug (the jiter wheel wouldn’t relocate; now built from source) that the earlier pip-only check missed — the full story is in The Wheel That Wouldn’t Move. Also in v0.10.0: sanctum init first-run bootstrap, haus-aware banners (commands that need the full haus exit cleanly instead of crashing on a fresh machine), the net toolkit (check / optimize / speedtest), and a relicense to FSL-1.1-MIT. The formula now hard-depends on restic.

Status as of 2026-05-21: v0.8.0 tagged, sanctum-cli repo flipped to public (Council vote 4/4 APPROVE — brain/mlx/code/spacial), Ogilthorp3/homebrew-sanctum tap repo created and live. The formula Formula/sanctum-cli.rb published; manual install steps verified end-to-end (38-dep pip resolution succeeds, sanctum --help renders cleanly).

Item	Status
sanctum onboard --recipe family --yes super-command	shipped
16-pattern secret scanner refusal	shipped
GitHub Tier 0 (free private repo per host)	shipped
iCloud Photos auto-exclude	shipped
Brew formula (brew install ogilthorp3/sanctum/sanctum-cli)	shipped — Formula/sanctum-cli.rb in tap repo, points at v0.8.0 tarball
Sigstore signing on binaries	pending — keyless OIDC signing via cosign in a GitHub Action, not yet wired
Public release on Ogilthorp3/sanctum-cli	shipped — repo public, v0.8.0 tag, tarball at archive/refs/tags/v0.8.0.tar.gz
Onboarding splash + personalized completion	shipped (commit 5b17c05)
Smoke-tested “fresh Mac to working R2 backup in 5 min” recipe	verified Apr

What this enables: a beta tester now runs brew install ogilthorp3/sanctum/sanctum-cli && sanctum onboard --recipe family --yes and gets a working stack. Tested end-to-end pip-side; brew install requires modern Apple Command Line Tools (the user gets prompted to install if they don’t have them — one-time macOS setup).

2. Cathedral long-context eval harness

Status as of 2026-05-21: Tasks 1-10 shipped on feat/long-context-eval-harness. Stdlib-only Python; the package lives at services/sanctum-mlx/tools/long-context-bench/ with niah.py (NIAH probe), ruler_subset.py (5 mini-RULER tasks), runner.py (HTTP runner + scoring + trend + gate), test_bench.py (mocked-cathedral test suite, 38 tests passing), the entrypoint shim, and the weekly LaunchAgent plus post-deploy gate wrapper.

Task 11 (full operating runbook) still to write. A live trend run against the cathedral was kicked off this afternoon to confirm end-to-end function; first row landing in trend.jsonl will mark the harness fully validated.

3. R2D2 has never fired in production

Status as of 2026-05-21: classifier-only mode flipped OFF in v0.5 (commit fb8f546). The two-cycle promotion path the v0.1 doctrine promised but earlier code skipped is now wired (commit 4a88ca4) — ~/.sanctum/state/r2d2-promotions.json is the new state file that maps stable_id → dry-run completion timestamp + exit code. Promotion window is 24h.

Behavior by recipe:

Recipe	dry_run_required	Behavior
reload-service-after-merge	false	real fire immediately (benign on KeepAlive services)
reindex-stale-fts	false	real fire immediately (moves DB aside, fully reversible)
retire-orphan-launchagent	true	dry-run → promotion → real fire on next detection within 24h
repair-keychain-secret-drift	true	dry-run → promotion → real fire on next detection within 24h

The first real fire under the new posture will appear in ~/.sanctum/logs/r2d2-audit.jsonl with "decision": "fired" or "fired_after_promotion". Force Flow gets a critical notify on any exec_error. Kill-switch is one touch ~/.sanctum/state/r2d2-disabled away if anything looks wrong.

4. MBP-side automation key

Today’s SSH automation-key fix is Mini-only. The MBP needs the same ~/.ssh/sanctum_automation_ed25519 (private key) plus the Host manoir-automation block in its ~/.ssh/config. Three sanctum scripts on the MBP-side workspace would otherwise still hit 1Password unlock prompts.

Runbook: runtime/docs/doctrine/runbooks/mbp-automation-key-setup.md. ~3 minutes of operator-side work.

The rest of the punch list

Further down the impact order — three of these four turned out to be already shipped when someone actually went to check.

5. SanctumBridge.app code-signed bundle wrapper

Status as of 2026-05-22: closed via the maximum-effort TCC sweep. SanctumBridge.app launcher rebuilt (NODE_BIN → /usr/local/bin/node) and re-signed with Bertrand’s Developer ID Application: Bertrand Nepveu (GJ994MN2YF). Bundle ID ai.openclaw.denchclaw is stable; child node process inherits from the Node.js Foundation .pkg install (Team ID HX7739G8FX).

Two TCC identity anchors are now in place (council-approved 2026-05-22 — vault topic federate-vs-two-anchors-decision):

• Anchor A — Node.js Foundation .pkg (HX7739G8FX) → /usr/local/bin/node → 9 vanilla node services. 13 TCC categories pre-granted via ~/.sanctum/scripts/sanctum-grant-tcc.sh.
• Anchor B — SanctumBridge.app (GJ994MN2YF, bundle ai.openclaw.denchclaw) → C launcher spawns /usr/local/bin/node → iMessage / WhatsApp / Calendar / Contacts SQLite bridge.

The council deliberately did NOT federate everything under one umbrella bundle — TCC’s responsible-process attribution doesn’t flow from launchd to its children, so a single-anchor architecture would have carried federation costs (rebuild cycles, more complex plists) for zero TCC benefit on the launchd-spawned majority.

6. Family Pass v1.0 (fortnight plan)

Status as of 2026-05-22: Phase 1 (Foundation) substantially shipped; Phases 2-5 partially in flight or remaining.

Task	Status
T1.1 Firewalla bridge MSP-API contract fix	shipped (c9a5a28, sanctum-screen-time)
T1.2 Firewalla baseline-rule fallback	shipped (8b169c4 T1.2-a + 177e3e9 T1.2-c)
T1.3 Multi-tenancy refactor of sanctum-screen-time	shipped (ef7637a, 2026-05-12)
Phase 2 sanctum CLI dispatcher + commands	partially shipped via sanctum-cli v0.7.1 (4b09b98) — sanctum onboard, doctor, status, chat, family/operator/code recipes live; self-test, update, uninstall, devices, schedule, keys backup still per the plan
Phase 3 install.sh (hash-pinned 2-step + Lima/socket_vmnet + sops + acid-test)	remaining
Phase 4 Per-haushold setup runbook in sanctum-docs	partially via Quick Start + installation.mdx
Phase 5 Acid Test on a clean MBP user	remaining

The fortnight plan’s task checkboxes (1/104 done in the doc) are STALE — the codebase shows ~25/104 done. The original doc was a spec, never a tracking surface. What’s left is the install.sh productization sweep + acid-test pass. ~1 week of focused execution.

7. Screen-time Layer 2 (reconciler + reaper)

Status as of 2026-05-22: shipped (commit ae25412, 2026-04-26 — discovered during pre-flight 2026-05-22). The inline _reconcile_screens(session) + _reap_stale_rules(session) functions live in screen_time.py HEAD with REAPER_HOUR=4 nightly + 7 Layer 2 tests in test_screen_time.py. Plus adaptive Firewalla-bridge IP discovery + drift alarm. The beta-readiness item was carrying stale info from the April 25 incident; the work itself shipped the next day.

Note: there’s an in-flight 759-line refactor of screen_time.py in someone’s working tree as of 2026-05-22 that restructures the file (HEAD=2414 lines → working=2287). The committed Layer 2 functionality is on origin/main; the refactor is uncommitted WIP and not blocking beta-readiness.

8. Beta-grade install walkthrough (documented + recorded)

Status as of 2026-05-21: written walkthrough shipped — getting-started/quick-start.mdx lands at position 2 in the sidebar (right after “What is Sanctum?”). Friendly framing, 4-step install path through sanctum onboard --recipe family, first-week expectations card grid, troubleshooting pointer. Paired with the sanctum-cli onboarding splash + personalized completion celebration (commit 5b17c05) so the on-screen moment matches the doc.

The recorded walkthrough (screencast) is still TODO — best done by an operator running through a fresh-Mac VM and capturing the actual experience.

What “first beta” actually looks like

Realistic profile: a single technical friend with a Mac, willing to follow a written setup guide, who runs Sanctum for one week and reports issues. Not a production deployment, not a multi-user family unit, not a turnkey product.

Status as of 2026-05-22 — first-beta is effectively unblocked. Items 1, 2, 3, 4, 5, 7, 8 are shipped. Item 6 (Family Pass Phase 1) is shipped; Phases 2-5 (install.sh + acid test) are remaining but not required for a single-friend beta — that friend installs via brew install ogilthorp3/sanctum/sanctum-cli and runs sanctum onboard --recipe family against their own haushold. Multi-haushold scoping is only needed when you start onboarding a second tester.

Remaining work before broader release (beyond first friend):

• Family Pass Phase 3 (install.sh with Lima/socket_vmnet + sops + acid-test) — ~1 week
• Eval harness branch merge + weekly LaunchAgent install on Mini — 30 min
• Recorded install walkthrough (screencast) — 1 evening
• The 759-line in-flight screen_time.py refactor needs to land cleanly OR be reverted — operator decision

Timing estimate from 2026-05-22:

• First friend beta: ready now. No hard blockers.
• Broader friends-and-family beta: ~1 week of focused install.sh + acid-test work.

Note

The gap between “I run it” and “they run it” lives in writing, scripting, and trust gates — not in the infrastructure. Power-cycle, autoheal, log rotation, the safety stack — those are all done. What remains is the productization wrap and the validation harness. Both are crisp pieces of work with no architectural unknowns.

This checklist is the same kind of standing watch: it gets updated as items land, and one ordinary morning the last empty box gets a checkmark and a friend, not the operator, types the command.