Record alpha.6 physical acceptance

PROJECT_SPEC.md

@@ -212,6 +212,8 @@ Raw mode must:
 
 - Use the same SSH channel and PTY.
 - Continue receiving the exact same byte stream.
+- Keep commands entered directly in raw mode and their output in the terminal;
+  they do not create structured transcript cards or persisted transcript turns.
 - Support resize events.
 - Expose Ctrl, Alt, Esc, Tab, arrows, and common terminal keys.
 - Return to transcript mode without terminating the process.
@@ -1087,9 +1089,12 @@ resumable signing and in-place installation path, but a release-only R8
 relocation broke sshlib 0.4.2's bundled Ed25519 provider before authentication.
 Alpha.5 is rejected. The alpha.6 source applies the narrow provider keep rule,
 passes an isolated minified SSH probe, and adds a mapping/DEX release regression
-gate. It still needs independent CI, permanent signing, and physical update
-acceptance. Alpha distribution is direct invited sharing while Phase 5 is open.
-Because the repository is public, any published
+gate. Independent CI passed, and the resulting permanent-key alpha.6 installed
+over alpha.5 with retained state intact. Password and retained imported-key
+authentication, Diagnostics, structured commands, and same-session raw-terminal
+behavior passed on the Galaxy S25 Ultra. Alpha.6 is the accepted tester build.
+Alpha distribution is direct invited sharing while Phase 5 is open. Because the
+repository is public, any published
 GitHub prerelease would be public. Sufficient invited technical-alpha use is the
 remaining Phase 5 boundary.
 

README.md

@@ -7,17 +7,17 @@ like responses, while a real terminal remains underneath for interactive work.
 ## Alpha status
 
 **[Phase 5: Alpha polish](docs/STATUS.md) is in progress.** Its feature slices
-and owner-device acceptance through alpha.4 are complete. Alpha.5 installed in
-place but is rejected because a new release-shrinker failure prevents SSH
-connection. The alpha.6 source correction now passes the minified SSH proof and
-release regression gate; it still needs independent CI, permanent signing, and
-physical update acceptance. The remaining product boundary is enough invited
-technical-alpha use to evaluate whether ten real users can complete small
-remote tasks for two weeks and provide useful feedback.
-
-The current accepted signed build is `0.1.0-alpha.4`; `0.1.0-alpha.5` is an
-immutable rejected artifact, and `0.1.0-alpha.6` is the current corrected source
-candidate. Signed builds are shared directly with invited testers.
+and owner-device acceptance through alpha.6 are complete. Alpha.5 installed in
+place but is rejected because a release-shrinker failure prevents SSH
+connection. Alpha.6 corrects that failure and has passed independent CI,
+permanent signing, in-place update, and physical acceptance. The remaining
+product boundary is invited technical-alpha use sufficient to evaluate whether
+ten real users can complete small remote tasks for two weeks and provide useful
+feedback.
+
+The current accepted signed build is `0.1.0-alpha.6`; `0.1.0-alpha.5` is an
+immutable rejected artifact. Signed builds are shared directly with invited
+testers.
 There is no public signed APK or GitHub prerelease while Phase 5 is open.
 Testers should obtain the APK and its checksum from the owner through the agreed
 private channel, then follow the
@@ -299,8 +299,11 @@ relocation. Alpha.5 is rejected; an isolated minified probe reproduces the
 failure and proves the narrow keep-rule correction intended for alpha.6.
 The alpha.6 source applies that narrow rule and makes the release gate verify
 the exact provider class names in both the R8 mapping and assembled DEX. Its
-isolated minified password SSH proof passes. Independent CI, permanent signing,
-and physical acceptance remain before invited technical-alpha use resumes.
+isolated minified password SSH proof passes. Independent CI then produced the
+exact candidate signed with the permanent key. Alpha.6 installed over alpha.5
+with state intact and passed password and retained imported-key authentication,
+Diagnostics, structured commands, and same-session raw-terminal acceptance on
+the Galaxy S25 Ultra. Invited technical-alpha use can resume.
 
 Use these records according to their purpose:
 

docs/BACKLOG.md

@@ -230,3 +230,23 @@ optional on-device counters or an exportable local summary only after defining
 the exact questions, fields, retention, redaction, consent, and deletion model.
 Do not add a telemetry SDK, background upload, stable user identifier, command
 content, host data, or terminal output merely to claim that metrics exist.
+
+## Automated release-path and device acceptance
+
+**Status:** Deferred test-infrastructure design; alpha.6 physical acceptance is
+complete.
+
+The core debug Android suite and static release-shrinker checks run in public CI,
+but alpha.5 showed the remaining gap: assembling a minified APK is not the same
+as connecting through its production runtime. Alpha.6 used an isolated in-app
+minified probe plus a manual signed update on the physical device to close that
+specific regression.
+
+A later automation slice should define how to cover a packaged minified app
+through fixture connection, password and imported-key authentication,
+structured commands, raw-terminal input, same-session switching, and retained
+state across versioned installs. Use a dedicated test application identity and
+disposable test signing material. The permanent release key and its passwords
+must remain outside public CI. Device or OEM automation can strengthen the
+matrix, but it does not make every physical keyboard, lifecycle, accessibility,
+or update behavior universal.

docs/HISTORY.md

@@ -79,8 +79,11 @@ Alpha.5 then proved the resumable signing and in-place installation path but is
 rejected because R8 relocation broke sshlib 0.4.2's bundled Ed25519 provider
 before authentication. An isolated minified probe reproduced the failure and
 proved the narrow keep-rule correction. The alpha.6 source now applies that rule
-and adds a release mapping/DEX gate for the provider class names; permanent-key
-and physical acceptance remain.
+and adds a release mapping/DEX gate for the provider class names. Independent
+CI passed, and the permanent-key alpha.6 installed over alpha.5 with retained
+state intact. Password and retained imported-key authentication, Diagnostics,
+structured commands, and same-session raw-terminal behavior passed on the
+Galaxy S25 Ultra, making alpha.6 the accepted tester build.
 Additional device and OEM coverage is opportunistic alpha evidence rather than a separate Pixel
 gate. See
 [STATUS.md](STATUS.md) rather than this chronology for the active boundary.

docs/STATUS.md

@@ -86,22 +86,26 @@ authentication, PTY creation, and shell startup. Alpha.5 is rejected and alpha.4
 remains the latest accepted signed artifact. See the
 [alpha.5 signing and release-shrinker investigation](investigations/2026-08-10-alpha5-signing-update-progress.md).
 
-The current corrected source is `0.1.0-alpha.6` (`10006`). It preserves the
+The accepted tester build is `0.1.0-alpha.6` (`10006`). It preserves the
 three cbssh Ed25519 JCA classes whose binary names are part of the provider
 contract, and the renamed release verifier now requires those exact names in
 both the R8 mapping and assembled DEX alongside the existing termlib JNI field
 checks. The gate rejects the pre-fix alpha.5 output and accepts alpha.6. An
 isolated minified API 35 probe with the exact production rule completed password
 authentication, PTY creation, and shell startup. The full local JVM, lint,
 debug, release, connected Android, password fixture, and encrypted-key fixture
-paths pass. See the
+paths pass. The merged `main` gate produced the exact candidate signed with the
+permanent key. Its package, version, certificate, v2/v3 signatures, checksum,
+and 16 KiB alignment independently verify. On the Galaxy S25 Ultra, alpha.6
+installed over alpha.5 with retained state intact and passed password and
+retained imported-key authentication, Diagnostics, structured commands, and
+same-session raw-terminal acceptance. Commands typed directly in the raw
+terminal correctly remained terminal-only rather than creating transcript
+cards. See the
 [alpha.6 Ed25519 shrinker correction](investigations/2026-08-10-alpha6-ed25519-shrinker-correction.md).
 
 ## Remaining Phase 5 boundaries
 
-- Merge alpha.6 and pass independent CI, then sign its exact `main` candidate
-  and repeat physical update, retained-state, authentication, Diagnostics, and
-  same-session structured/raw acceptance.
 - Technical-alpha use sufficient to evaluate the Phase 5 exit criterion.
 
 ## Alpha distribution: direct invited sharing, decided 2026-08-09
@@ -126,12 +130,12 @@ position.
 Two things worth recording so this isn't relitigated from memory:
 
 - **The signing question is separate and already settled.** The permanent update
-  lineage was established at alpha.1 and verified again at alpha.5 against
+  lineage was established at alpha.1 and verified again at alpha.6 against
   certificate SHA-256 `102893bc…`, with the release key never entering CI. That
   holds under either distribution choice, so it argues for neither.
 - **The transparency half of the public option is already done.** Checksums, the
   certificate fingerprint, signature schemes and 16 KiB alignment are published
-  in `investigations/2026-08-10-alpha5-signing-update-progress.md`, in a public
+  in `investigations/2026-08-10-alpha6-ed25519-shrinker-correction.md`, in a public
   repository. Only the signed tester APK stays private.
 
 The asymmetry closes it: private can become public later, published can't become

docs/alpha-testing.md

@@ -47,6 +47,9 @@ Exercise only systems and accounts you are authorized to use:
 10. Generate a sanitized diagnostic preview and confirm its default form contains
     no host fields, commands, output, or credentials.
 
+Commands entered directly in the raw terminal and their output remain in the
+terminal. They do not create structured cards or persisted transcript turns.
+
 For imported-key authentication, use a disposable or dedicated test key rather
 than a high-value production identity during the first alpha pass.
 

docs/development/release-signing.md

@@ -75,10 +75,19 @@ release-only cbssh Ed25519 provider failure after R8 relocation, so alpha.5 is
 rejected and must not be distributed or overwritten. Preserve it as immutable
 evidence and advance the corrected build to alpha.6.
 
-The current corrected source is `0.1.0-alpha.6` (`10006`). Its release rules
-preserve cbssh's name-loaded Ed25519 provider classes, and the release gate
-checks their exact binary names in both the R8 mapping and assembled DEX. Its
-permanent-key artifact and physical update evidence do not exist yet.
+Permanent-key alpha.6 uses the same certificate. Its verified APK SHA-256 is:
+
+```text
+67b20d8b6c149c06e23fb063dff9b3e84ad988f0ff16fcaea25964fa62ede674
+```
+
+The artifact identifies as `io.github.r055le.threadline`, version
+`0.1.0-alpha.6` (`10006`), verifies with APK signature schemes v2 and v3, and
+is 16 KiB page aligned. Its exact successful merged-`main` candidate was signed
+through `scripts/sign-latest-alpha.sh`. Android accepted it as an in-place
+update over alpha.5, retained local state, and passed the physical password,
+retained imported-key, Diagnostics, structured-command, and same-session
+raw-terminal acceptance path. Alpha.6 is the current accepted tester build.
 
 ## Signing-key boundary
 

docs/investigations/2026-08-10-alpha6-ed25519-shrinker-correction.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-08-10
 **Phase:** 5, alpha polish
-**Status:** Source correction accepted; permanent artifact pending
+**Status:** Accepted
 
 ## Boundary
 
@@ -58,13 +58,39 @@ suite reached SSH but timed out on its later Ctrl-C completion case. An
 immediate isolated rerun passed both credential-gated tests. No product change
 was made for that one load-sensitive timeout.
 
-## Remaining acceptance
-
-Alpha.6 still needs to merge and pass the independent GitHub gate. The resulting
-exact `main` candidate must then be signed with the permanent key and installed
-over alpha.5. On the physical device, repeat retained-state, password and
-imported-key authentication, Diagnostics, structured command, and same-session
-raw-terminal checks before sharing it with invited testers.
-
-Alpha.4 remains the latest accepted tester build. No password, passphrase,
-private key, private endpoint, or fixture identity is recorded here.
+## Permanent artifact
+
+Pull request 7 merged the correction as `b96cda3bfd2c60b006adf17281174dddfbe48af5`.
+The independent Android push run for that exact `main` commit passed its build,
+release-shrinker, and instrumented gates and uploaded the unsigned alpha.6
+candidate. The local signing wrapper selected that run and signed it with the
+permanent key.
+
+The finished artifact independently verifies as:
+
+- package: `io.github.r055le.threadline`
+- version: `0.1.0-alpha.6` (`10006`)
+- APK SHA-256: `67b20d8b6c149c06e23fb063dff9b3e84ad988f0ff16fcaea25964fa62ede674`
+- signing certificate SHA-256: `102893bcc2fa4b70fb451661579c717c6c2b917296a99baefa6d9e9d1d13e7fc`
+- signature schemes: APK v2 and v3 verified
+- alignment: 16 KiB page-aware zip alignment verified
+
+## Physical acceptance
+
+The owner installed alpha.6 over rejected alpha.5 on the Galaxy S25 Ultra.
+Android accepted it as an in-place update, and the retained application state
+remained usable. The acceptance path passed fixture connection, password and
+retained imported-key authentication, Diagnostics, structured commands, and
+same-session raw-terminal switching. This closes the alpha.5 release regression
+and makes alpha.6 the accepted tester build.
+
+Typing `echo` directly in raw mode displayed its output in the terminal without
+adding a transcript card. This matches the current product contract: raw input
+writes directly to the shared PTY, while structured transcript turns are created
+only by composer submissions and collect output between their lifecycle
+markers. Raw-terminal activity is therefore not persisted as structured
+transcript history.
+
+Broader release-path and device acceptance automation remains a deferred test-
+infrastructure decision in the backlog. No password, passphrase, private key,
+private endpoint, or fixture identity is recorded here.

docs/investigations/README.md

@@ -33,4 +33,4 @@ technical claim.
 | 2026-08-08 | 5 | [Alpha.3 imported-key and diagnostic acceptance](2026-08-08-alpha3-imported-key-diagnostics-acceptance.md) | permanent-release imported-key auth after force-stop/reopen and exact default diagnostic privacy proof |
 | 2026-08-09 | 5 | [Alpha.4 installed-update preservation](2026-08-09-alpha4-update-preservation.md) | public-CI candidate provenance, permanent-key update, retained local state, and imported-key auth without re-import |
 | 2026-08-10 | 5 | [Alpha.5 signing and release-shrinker rejection](2026-08-10-alpha5-signing-update-progress.md) | resumable signing proof, physical connection failure, minified reproduction, and cbssh Ed25519 provider root cause |
-| 2026-08-10 | 5 | [Alpha.6 Ed25519 shrinker correction](2026-08-10-alpha6-ed25519-shrinker-correction.md) | narrow provider keep rule, mapping/DEX regression gate, and minified SSH proof |
+| 2026-08-10 | 5 | [Alpha.6 Ed25519 shrinker correction](2026-08-10-alpha6-ed25519-shrinker-correction.md) | narrow provider keep rule, mapping/DEX regression gate, permanent artifact, and physical acceptance |