Timestamp verification owners
Read the native clock writers and explicit wire boundaries for artifacts, clock readers, QA and diagnostic evidence.
Artifact, projection and verification clocks
New baseline artifact metadata formats its capture clock as fixed-six UTC and binds the corresponding creation instant natively; existing artifact bytes stay unchanged. Registry/board render headers and timing-log wall clocks use the shared formatter. Artifact filename dates remain labels. Branch preview cleanup successors emit fixed-six UTC log prefixes using the standalone Python output boundary; historical Pack files remain frozen. Current observation birth fixtures declare native clocks; historical conversion fixtures retain TEXT. PostgreSQL project/planning, parity, path, constrained-audit and structured-write mini-DDL follows this native contract; episode clocks parse before SQL and capability fixtures bind aware clocks. Browser, Doctor control-plane, done-transition, resync and merge-audit fixtures retain native clocks; retired SQLite probe subjects retain their declared schema.
YAML update clocks, command event envelopes, adoption evidence and fleet-rehearsal receipts use fixed-six UTC. Database read diagnostics format native datetimes while calendar dates retain date ISO. Board item classification keeps nullable native update facts and sorts done items by those instants without an empty-string SQL fallback.
Board session ages consume native starts and ends with explicit null absence; malformed clocks refuse rather than inventing UTC. Daily velocity fallback queries compare native transition instants with native cutoffs, while calendar rollups retain day strings. Strategy revision windows retain all native history before projecting UTC days and applying the day bound.
Board pricing binds native offered instants; session durations parse owned start/end facts with explicit null absence. New typed board datetime values use fixed-six UTC, and archived typed query parameters normalize only in the replay lookup without modifying the supplied payload or its durable bytes. Calendar date tags remain calendar values.
QA requirement creation, waivers, plan snapshots, materialization, rematerialization, standalone executions, and new review audit/bundle rows generate aware native facts. Shared insert constructors own backend adaptation; direct SQL writers use the existing instant_parameter only at binding. Original capture start/proof values and immutable review bundle documents remain unchanged.
Relative-age and freshness helpers, including strategy day bands and both QA yesterday bands, retain exact microseconds through age buckets before duration display; QA HTML clocks and tooltips canonicalize qualified source instants to fixed-six UTC and only null permits absence; age and day bands share one captured reference; opaque fallback text supplies no freshness, and browser millisecond reference clocks keep their protocol unit. Optional activity observations normalize qualified clocks or display unknown as null without changing raw observations or server liveness. Mission preparation proof chronology uses shared strict native parsing; the hosted-origin probe formats only its owned HTTP event_time leaf as fixed-six UTC. Project scalar and pipe readers format native clocks only at their text boundary; typed get, list, resolve and upsert rows parse the named project clocks before the function-response owner. QA baseline readers reuse the canonical QA text formatter, preserving metadata and opaque cells. Item read projections derive their clock fields from the finite stored-instant roster. Structured item listings retain native/null clock facts through the function-response owner; scalar and pipe text readers reuse one SQL formatter for fixed-six UTC, with empty text cells for absence. Project, actor-label, body and numeric-id rendering keep their contracts. Strategy corpus activity compares native revision instants against an inclusive UTC-midnight cutoff and reuses the board SQL day projector for calendar sparkline keys, independent of the database session timezone. Live session-control acceptance reports format receipt and attempt-summary clock leaves as fixed-six UTC or null. Supplied ambiguous receipt clocks refuse; malformed attempt clocks retain the settlement refusal and null body-free diagnostic projection. Original command attempt evidence and opaque traffic remain unchanged. Hook and tool latency aggregation retains native UTC hourly keys through registered handler rows; the existing response owner formats hour_utc, while SQL cutoffs, duration coverage and tool identities retain their semantics. Carried-work checkout and repository-provider getters parse committer clocks into native nullable instants; absent or invalid external evidence cannot attribute a landing, and raw Git/provider caches retain their clocks, messages and authors. Structured client responses serialize native clock leaves on both local and HTTPS paths regardless of secret redaction; the generic human JSON receipt uses that same owner and retains opaque body strings. Workflow canon generations parse publication clocks to native instants at archived JSON ingress; native fixture bindings and the existing response owner retain definition digests and archived bytes. Shared merge-queue status text formats its native owned clocks to fixed-six UTC while retaining empty text for absent occupancy and closed-out items. Finishing-time SQL maps and internal roster facts retain native instants; the existing function-response owner formats their wire clocks. Source cutoff and snapshot export generate native freeze clocks; the fence SQL owner binds native values, and the existing freeze-intent owner formats the signed document with equal receipt identities across equivalent inputs. Relay adapter contexts normalize leased launch deadlines to native nullable instants without altering instruction or job bytes; qualified ingress and direct constructors refuse ambiguous clocks. Frontier and scheduler API adapters format native creation clocks before constructing their nullable string response models; registered merge-queue hold responses likewise retain null absence. Source credential retirement bundles and lifecycle clocks remain native through SQL validation, with fixed-six file and retirement-receipt owners; retries retain the existing file clock and qualified archived bytes. Browser daemon state readers retain native nullable start clocks from the owned fixed-six file; raw documents and file bytes remain unchanged, and supplied unqualified clocks refuse. Queue and standalone merge outcomes require aware datetime constructor clocks or null, normalize offsets through shared as_utc and reject wire strings; injected arming clocks validate before any marker dispatch. Registered marker responses parse at client ingress; the pending JSON envelope formats only its owned clock leaf. Latest-code references normalize qualified Git and explicit override clocks to native nullable instants; browser freshness diagnostics format the owned commit clock, preserving SHA and accepted-revision authority. Git supplies seconds precision without invented microseconds. Migration content adoption generates native records and binds their clocks through the evidence SQL owner; only explicit SQLite storage formats them, with manifest/digest identities retained. GitHub REST/GraphQL merge clocks enter native nullable landing state and stay native through readiness, holds and observer SQL; readiness/hold JSON and hold narratives format only the owned merge clock. GitHub required-check selection parses CheckRun starts and StatusContext creation clocks before comparing exact instants; known clocks outrank null, equivalent instants retain last-arrival ties, and invalid clocks make the projection unreadable. Deployment-run creation/start/completion, member addition, item merge and mutation approval models retain native nullable facts and normalize qualified constructor ingress; service-client mutation results use the existing function-response JSON formatter. Machine-reading and session-usage results require Native clocks and reject internal wire/naive input; source capacity clocks validate before probes, while stored JSON ingress/output retains its explicit owners. Launch pool resets and machine-capacity observations stay native through placement and lane decisions; shared level placement, launch eligibility and capacity helpers require Native reference clocks and validate before SQL; exhausted-pool refusal text reuses the owned UTC/null reset projection; existing to_dict owners emit fixed-six UTC or null before preview and stored placement JSON, leaving labels and summaries unchanged. Frontier items decode Native/qualified stored creation clocks at raw-SQL ingress. Scheduled steps require Native creation clocks or null; exceptional SQL reads decode their clock before that handoff. Naive values refuse and missing synthetic clocks stay null and rank after known clocks. Historical progress headings render qualified instants canonically and retain unsupported clock-like prose as visible text without rewriting body bytes. Meter reset runway and session stale eligibility compare exact microseconds against the browser clock before duration/display conversion; unqualified meter readings supply no freshness. Environment inventory chooses each latest run at exact microsecond precision while retaining equal-instant arrival ties and preferring known clocks over null. QA plan and method-plan ordering uses exact microseconds before stable name ties, with null clocks after known clocks and strict refusal of unqualified values. Board replay probes coverage of native aggregate and scalar reads before rendering them. An archived payload without the current figure omits that figure rather than executing a query it never recorded. The version-2 baseline fingerprints and archived payload bytes remain frozen; live collection still records the current native SQL plan.
QA CLI/batch/browser run writes generate native start/completion facts for the existing finite run writer. Requirement retraction, supersession and target rebinding, method seeding/registration, project defaults, review bundle creation and host-wait completion bind native SQL clocks; supersession and rebind receipts retain native facts internally. Host-wait queue JSON remains an explicitly formatted six-digit wire owner.
Rehearsal freshness compares native aware instants at the exact microsecond boundary. Missing or invalid rehearsal evidence remains expired; invalid explicit current clocks refuse, and only None generates a current fact. PostgreSQL fingerprint catalog queries move unchanged to their own reader, preserving schema/digest computation. Epic heartbeat validation consumes native database values with shared strict ingress, without accepting PostgreSQL display text or inventing UTC for naive values.
Doctor session/reclaim, checkpoint, coordination, QA and lane checks compare native cutoff/window instants with microsecond precision. Sweep and heartbeat age readers use shared strict ingress; malformed clocks produce a refusal finding rather than guessed UTC or a green result. Reclaim and coordination message clocks explicitly format as UTC wire instants; filesystem modification ages remain numeric file metadata.
Machine verification, operation and mission preparation receipts generate native SQL facts. Capability and receipt readers retain aware clocks, with nullable verification absence preserved. New verification history entries format only their declared clock; earlier receipt entries, submission identities and check evidence remain opaque and unchanged. Replay parses only the declared clock and operation response JSON explicitly formats it as fixed-six UTC or null. SQLite storage is an explicit canonical wire boundary.
Doctor blocked-item, task heartbeat, undeployed-item and backlog ages compare native aware instants through timedeltas, retaining their existing thresholds at microsecond boundaries. The Unix epoch is valid evidence. Missing clocks remain unknown and malformed stored clocks produce refusal findings rather than quiet passes. The private epoch parser and its reexports are retired; new report headers and branch-protection drift events use fixed-six UTC wire clocks.
Doctor close-out checks query native merge and queue-landing clock nullness directly, without empty-text substitutes or comparisons. A completed item lacking a merge fact still warns; a real native landing fact still identifies active work needing close-out.
Session inventory compares native heartbeat and tool-activity cutoffs at exact microsecond boundaries. Machine capture recording shares a native fact across run and artifact inserts; merge-gate CI requirement/run writes retain native clocks. Actor-role and feedback handlers generate native facts for their strict SQL writers. Artifact evidence, captured clock-looking text and verdict identities remain opaque.
Session human output parses native or qualified clocks strictly and preserves deliberate minute/age presentation. End-blocker message clocks format as fixed-six UTC, and stale countdowns retain positive microsecond order before rounding to minutes. Malformed Doctor receipt clocks report unverified health. New wizard log clocks and native field values format at the append owner; previous lines and opaque text remain unchanged. Runner provider-token expiry and current clocks use strict shared ingress with exact inclusive expiry and secret-free refusal messages; authority signing bytes are unchanged.
Claude job-record reads parse only their declared updatedAt clock as a native aware instant. Missing clocks stay unknown; malformed clocks refuse the bounded read without changing foreign bytes. Idle eligibility compares native timedeltas at microsecond precision before reporting integer durations. OS process-start and foreign session-start NumericDate protocols retain their process identity role; live-session and newest-spare protections remain in place.
CI-wait handlers and observers retain native creation, read, notification and poll-cutoff facts, adapting only at their SQL owners. The inclusive poll floor keeps microseconds; malformed notification clocks refuse authority. Invalid replacement clocks refuse before deleting a superseded wait. Continue commands and verdict notices remain opaque and each session/run still notifies once.
Session-holdings, lifecycle API, paged-item roster and minimal Doctor database fixtures generate native aware clocks without truncating microseconds. The holdings SQL owner strictly parses supplied release/end clocks and preserves null absence; its explicit SQLite boundary formats fixed-six UTC. Minimal session and Doctor schemas declare native instant columns while preserving the slim Doctor fixtures' existing nullable constraints. Consumer assertions format only public projections, retaining native SQL ordering and cutoff inputs.
Path-integrity and path-context fixture owners bind native project, target, snapshot, move, context, event and fixture-registration clocks. Continuity fixture implementations share the existing clock binder and public catalog; their intentionally malformed substrate states and opaque context values retain the same invariant behavior. Minimal supporting schemas use native clock types. Scoped deployment fixtures bind native run/member/environment clocks and keep frozen requirement snapshots unchanged; verdict/artifact fixture clocks are parsed once and adapt only at their SQL bindings.
Performance range ingress strictly parses qualified instants before model coercion. Observations, latest selection and half-open bucket boundaries stay native, with exact timedelta rounding. Aggregate/detail responses format native clocks once. The chart's external uPlot coordinate adapter uses numeric seconds for display while inspection preserves the original canonical endpoints; calendar controls use the shared Date-to-instant wire adapter. The captured Performance review page filters endpoints with exact kernel microseconds.
Full Doctor fixtures declare their finite stored-instant columns natively, including both audit schema owners, without tightening nullable slim states. Shared current/day/minute clocks stay aware and preserve microseconds; actual health-check callers use those native values directly.
Event fixture suites share one native day-offset generator and preserve microseconds through actual event insertion/retention callers. Severity fixture SQL adapts only its declared clock. The event insert owner strictly validates supplied and generated instants before severity/storage lookup; canonical event envelope clocks remain an owned JSON boundary.
Stale/reclaim fixture clocks and carry/review seed clocks stay native through SQL and preserve microseconds. Minimal session, actor, organization and event schemas declare native instants while retaining nullable states. Runnable item seeds reuse the existing backlog fixture owner with qualified deterministic inputs; the stale fixture's absent project sequence stays absent.
Run-check and carried-check ordering and cross-project event page merging use the shared microsecond instant kernel. Equal-offset instants retain stable arrival/bucket ties; temporal order preserves the producer clock exactly. Machine evidence adapts filesystem nanoseconds once into native UTC instants, sorts natively, and formats six fractional digits only in its JSON listing.