# B5 Real Pilot & Cutover v002

Status: **B5 PASS · LIVE PILOT CUTOVER COMPLETE**

Supersedes the operational status in `B5_REAL_PILOT_CUTOVER_v001.md`.
The v001 file remains historical evidence of the temporary SSH blocker before
the already-configured Git-for-Windows root channel was used.

## Final baseline

- Agent Agency release: `b8184368ea541d19dae0cab16edfd5485a666a14`
- Public origin: `https://agency.anpavel.ru/`
- Mode: `pilot-authenticated`
- Project: `abamama / Mama Aba`
- Imported source SHA: `55ed88f83023e11dc15af06a4445f5c1d19c8eb1`
- Mama Aba pilot branch: `pilot/b5-agent-agency`
- Final pilot commit: `14060def4eda68d500ff1322804841433858ff8f`
- Mama Aba `main` merge: **NOT DONE**
- Mama Aba production deploy: **NOT DONE**

## Real pilot

Five successive useful preview Missions passed through the B5 pilot.
| Mission | Accepted preview commit |
| --- | --- |
| M1 · project-state reconciliation | `81f91ef06b039d2a258f0c44f48beefb17f014c3` |
| M2 · project-index reconciliation | `dfcfdcb9c0a4d7b8b4b10c28924bb04722dd9a46` |
| M3 · project-control validator | `5eb5b898be4971bf2c54e70d9d551a61e115869d` |
| M4 · Guide 2 source-precedence clarification | `8e5c89eba0417eaba31e5d65bb73864a67df122a` |
| M5 · production-readiness handoff | `14060def4eda68d500ff1322804841433858ff8f` |

Routine Owner technical transport prompts after execute: **0**.

Accepted Mission history is materialized in Hub from immutable B5 metrics
without replaying execution:
- 6 project tasks;
- 5 completed Missions;
- 4 Runs (M1 native Run identity unavailable and remains honestly absent);
- 5 accepted Results;
- 0 pending boundary operations.

## Verification / recovery

- Latest code gate on `b818436…`: Hub **104/104**, Bridge **25/25**.
- lint / typecheck / build: PASS.
- production dependency audit: **0 vulnerabilities**.
- restore rehearsal: PASS; restore enters `recovery_readonly`, effects denied until reconciliation.
- rollback rehearsal: PASS; no blind queue/effect replay.
## Live cutover

Pre-cutover SQLite Online Backup:
- path: `/var/lib/agent-agency/backups/pre-b5-20260918T160530Z.sqlite`
- SHA-256: `c251ed0a8ac43147a27957ba4eb2a0e1c556ca72d4224747aecd984c06dd2693`

Cutover input:
- release package SHA-256: `c7b1d7ff46bfb3b3986df1217d09907bd57a6728a63bc178ce3baff3c8233d28`
- imported/materialized DB input SHA-256: `2012094e15adf6c1a463ad1953f562d35f2f53cd26d321ab165f93996efdd97e`

Live checks:
- root: HTTP 200;
- health: HTTP 200;
- anonymous Project API: HTTP 401;
- anonymous write: HTTP 401;
- authenticated human Project API: HTTP 200;
- authenticated write path reached domain validation: HTTP 400;
- human cookie rejected by B3 machine API: HTTP 401;
- logout: HTTP 200; same cookie after logout: HTTP 401;
- `files.anpavel.ru/Agency/STATUS.html`: HTTP 200.

The nginx blanket `PREVIEW_READONLY` fence was removed only after local
application-auth preflight passed. Application-level Owner/machine auth now
enforces the boundary.

## PLAN Bridge

- machine principal/session stored in existing canonical auth relations;
- raw bearer only in protected PLAN credential file;
- worker: `plan-bridge-b5`, project `abamama`;
- live recovery completed with no uncertain journal rows;
- long-poll is active against `https://agency.anpavel.ru`;
- runtime is pinned locally to Agent Agency release `b8184368ea54`;
- user Startup launcher provides pilot persistence.
Dedicated Windows service account / system Scheduled Task could not be
created from the non-elevated PLAN session; B5 therefore retains the explicit
pilot limitation allowed by the assignment: Bridge runs as the verified
non-elevated PLAN user. This is a hardening item before wider rollout, not a
failure of the pilot execution path.

## Remaining non-blocking rollout items

- Google Drive provider remains truthfully `unconfigured`.
- Encrypted off-host Hub backup destination has not yet been provisioned.
  The pre-cutover backup + digest is retained on the VPS; off-host encrypted
  backup remains required before a wider production reliability claim.
- Legacy Agent Agency history/mechanisms are not deleted. Destructive
  retirement remains B7 and requires explicit authorization.

## B5 exit

B5 real pilot and one-project cutover criteria are satisfied:
real project import, five useful Missions, zero routine Owner transport
handoffs after execute, trusted verification/recovery gates, restore and
rollback rehearsals, application-level authentication, live project cutover,
and preserved rollback evidence.

Next architecture stage: **B6 — additional bindings and second project**.