jobtrackingapp/docs/automation/SINGLE_USER_ACCEPTANCE.md

AUTONOMOUS-ROADMAP-02 acceptance — 29 October 2026

Single-user mode implemented and installed. Actual roadmap execution remains disabled. Phase 10: NO-GO without its separate formal entry approval.

Source: codex/autonomous-roadmap-single-user, based on c1663df, in the existing isolated orchestrator worktree. The ongoing Pre-Phase-10 worktree was not edited, checked out, tested or operated. No main merge or production operation was performed.

Decisions

Area	Result	Evidence / boundary
Current Windows login setup	PASS	Setup detected the actual current SID for both owner/controller and installed outside the worker. No account, VM or subscription was created. Stable $HOME/.jobjakt-backlog/single-user-local location avoids desktop package path redirection.
Same ChatGPT account support	IMPLEMENTED; HUMAN SIGN-IN PENDING	Dedicated auth-only CODEX_HOME, forced ChatGPT/file credentials and operator-terminal login. Existing tokens/config were not read/copied. The new profile is currently unsigned-in; actual identity, entitlement and inference are not claimed.
Native filesystem boundaries	PASS for real canaries	Actual MXC process could read/write its workspace; all seven protected canary categories denied reads and write-handle opens. Files existed and were host-readable/writable before probing. No private documents/production secrets were used.
Native command networking	PASS for real loopback canary	Host-positive listening TCP socket; worker connection denied under the same explicit network-disabled profile used for future sessions/checks. No production or third-party endpoint was contacted. This is finite evidence, not exhaustive network testing.
Same-user signing protection	CANARY PASS; REAL KEY NOT CONFIGURED	Temporary nonexportable current-user key was usable by the host, inaccessible through worker certificate and direct CNG attempts, then cleaned up. The actual pinned owner key must pass its own host-positive/worker-negative tests before unattended mode.
Apps/plugins/MCP	PASS for compiled configuration	Installed CLI reported apps, plugins and remote-plugin features false under the exact overrides; effective MCP server list was empty. Web search is explicitly disabled. No unrelated normal configuration is inherited by design; no model-backed tool session was run.
Approval workflow	PASS in tests; live owner action pending	Signed verifier retained; typed challenge plus concrete disposition/decision; no active-worker signing; exact recovery request can be signed after reconciliation. Noninteractive approval and arbitrary writable approval JSON remain rejected.
Regression	PASS	69 distinct Python tests: all original 48 plus 21 single-user tests, zero failures/errors/skips in the final source-stable run. Six separate original .NET signature cases also pass; focused reruns are not added to those totals.
Git/pause/recovery/concurrency	PASS in disposable flows	Single-user tests cover ordered publication, missing approval, pause/resume, publication-only retry, common-directory locking, interrupted-state guard and main protection. Original safety tests remain unchanged.
Overnight/scheduling	IMPLEMENTED; LIVE SCHEDULE NOT QUALIFIED	Native Job controls retained, optional limited-user task script refuses unqualified state. No task was installed. No physical reboot/locked-desktop/logged-out run was performed.
Unattended real roadmap	BLOCKED / DISABLED	Default operator-controlled policy, zero real sessions, no actual owner key, no ChatGPT sign-in, unconfigured application qualification adapter, and no Phase 10 authorization. No security control was bypassed to enable it.

Evidence

automation/reports/single-user/ contains:

• results.json and tests.txt: final complete regression, distinct totals, before/after source-stability assertion and hashes.
• signature-results.json and signature-tests.txt: six disjoint actual .NET signature-verifier cases.
• native-qualification.json: actual MXC canary results, policy/source binding, issue time, cleanup status and explicit real-owner-key NOT_CONFIGURED scope.
• setup-results.json: same Windows identity, empty dedicated authentication, zero sessions, disabled queue and Task Scheduler refusal before registration.
• capabilities.json: actual CLI feature-state verification and zero effective MCP servers.
• format-check.json: packaging removed one trailing space in the new test file after the full run; its Python AST is identical to the tested bytes. The original full-run hash remains recorded, with the packaged hash separately identified. No extra test count is added for formatting.
• packaging.json: a fresh committed clone at 1e6c80f installed the mode successfully; repeated setup through the installed wrapper preserved state, the auth profile stayed empty, all prompt sources validated, and zero real sessions were launched.

The first new MXC probe could not start because the old subprocess environment omitted SystemDrive. Only that non-secret OS variable was added to the existing allowlist; no unrestricted environment or sandbox fallback was enabled. Explicit MXC startup and the subsequent real canary probes passed. The previous legacy CryptUnprotectData result remains historical evidence; the user's normal saved sandbox selection was not changed.

The independent read-only review found two issues: the convenient approve command could not sign its own recovery request, and successful probe fields could override a BLOCKED qualification status. Both were reproduced with regression tests and fixed. Recovery still needs operator confirmation and a stopped/verifiably absent recorded process; signing alone never clears recovery-required. Qualification now requires PASS with no failure as well as complete probes, current binding, freshness and the real owner-key denial.

Setup from both source and the installed wrapper was exercised. Existing state/auth/policy is preserved. A packaging/setup correction makes the installed wrapper reuse its stored repository path rather than incorrectly require ControlRoot to be a Git checkout. This change was verified and included in the final regression source hashes.

Restrictions retained

The original numbered prompt snapshots, order, dependencies, stage-specific owner gates, retry/session/time budgets, report/artifact verification and protected approval mechanism remain. Development completion is not production release. Failed publication keeps the exact tested commit; no force push, main merge, deployment, destructive migration, production credentials or live model activation is added.

Single-user confinement is not an independent administrator boundary. An unrestricted process already acting as the same Windows user can access owner files/credentials outside the worker sandbox. Tested canaries do not prove all Windows APIs, credential providers, future files or sandbox defects are harmless. An actual owner key, current sign-in and the qualified execution context are still required. A failed or incomplete boundary keeps the operator-controlled pause; it never launches an unconfined interactive worker.

The source still carries the intentional unconfigured provider/browser/Python/PDF/security/preservation adapter gate from AUTO-01. This task does not invent or waive application qualification. Actual roadmap activation must wait for finished Pre-Phase-10 acceptance, a published accepted baseline, explicit candidate/scope entry and the existing signed grants.

Next owner actions

See SINGLE_USER.md for exact commands. In your own terminal, load Use-JobjaktBacklog.ps1, run Jobjakt auth with your existing ChatGPT account, then Jobjakt key and Jobjakt qualify to test the actual key. Do not activate the queue yet. Jobjakt status, dry-run, logs, pause, resume, retry, recover and approve remain available through the short command; workers remain disabled until their independent runtime and phase gates are met.