18 — Release 0.1 Review

From the Burrow™ specification set.

18 — Release 0.1 Review

Mandatory human approval gate for VLT-38. Automated tests and agent notes do not authorize anyone to approve this gate or to start Release 0.2 hashing.

Burrow™ stays at Safety Level 0 until the project owner records explicit approval on VLT-38.

Result codes

Every expected location must use exactly one of:

Code Meaning
VALIDATED Owner-approved read-only pass on an approved root succeeded
NOT_PRESENT The location class is absent on this Mac
NOT_CONFIGURED The provider exists in principle but is not signed in or set up
INACCESSIBLE The location was found but could not be read
FAILED The controlled pass was attempted and did not succeed

Missing or unconfigured iCloud Drive or OneDrive is an environment gap. Record NOT_PRESENT or NOT_CONFIGURED. Never record VALIDATED for a missing cloud account.

Expected locations

Show each candidate root to the owner before any scan. Do not scan $HOME. Do not start a live inventory until the owner names the approved roots.

Location Result Approved root shown Notes
Internal storage owner
iCloud Drive owner Missing → NOT_PRESENT / NOT_CONFIGURED
OneDrive owner Missing → NOT_PRESENT / NOT_CONFIGURED
Portable SSD owner

Release01ValidationRecorder in BurrowEngine rejects VALIDATED when an iCloud or OneDrive observation is missing or unconfigured. A record without Release01OwnerApproval is not complete. Release01ValidationRecorder.approveByAgent() throws.

Mutation-safety checklist

Run the fixture harness immediately before any live pass. Live work is manual, controlled, and read-only.

  • MutationSafetyHarness / NoMutationPathTests passed on fixtures
  • ScanCoordinator.startScan is read-only: it inventories approved roots and does not move, delete, archive, or back up files
  • No delete / move / rename / archive / backup / cloud-sync API was invoked
  • Safety Level 0 held (SafetyGate.productionFilesystemMutationEnabled is false)
  • Hosted HTTPS was not used as a live inventory source
  • No $HOME walk and no unapproved-root scan

Agent evidence (not approval)

Collected 2026-09-26 for owner review. This section does not close VLT-38.

  • The public website is documentation only (ADR-004). Retired /files and /activity console routes redirect home. Hosted HTTPS cannot call 127.0.0.1.
  • Engine persist for activity stays in-memory ActivityService.query(scanId:). There is no catalog activity table in 0.1.
  • Production filesystem mutation remains disabled.
  • Follow-up taxonomy or exclusion changes must be new Jira issues. Do not silently rewrite specs after a live pass.

Owner approval

The project owner, not an agent, records explicit approval on VLT-38. Until that comment exists, Release 0.2 hashing and duplicate analysis stay blocked.

See 10 — Implementation Plan and 12 — Test Strategy.