Record approved scope Case blocker

.sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-SCOPE-CASE-EVIDENCE.md

@@ -0,0 +1,97 @@
+---
+name: cto-first-real-governed-workflow-scope-case-evidence
+tier: local
+status: blocked
+owner: jp
+source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-ISSUES.md
+created: 2026-06-01
+last_reviewed: 2026-06-01
+lifecycle_classification: planning
+core_promotion_status: not-promoted
+description: Child-local evidence for the approved CTO-WORK-049 src slugify Harness case and real Case no-diff blocker.
+---
+
+# CTO First Real Governed Workflow Scope Case Evidence
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Scope
+
+Work item: `CTO-WORK-049`
+
+Approved target:
+
+```text
+/home/svrnty/workspaces/cortex-os/cto-stage5-target-sandbox
+```
+
+Approved task:
+
+```text
+src/strings.py slugify alignment task
+```
+
+## Harness Fix
+
+Hermes commit:
+
+```text
+59d4d2e Add Stage 5 src slugify case
+```
+
+What changed:
+
+- added Harness case `r1-src-string-slugify`
+- registered it in `harness/harness.yaml`
+- made the Case task contract derive `filesChanged` from case `allowed_writes`
+- kept runtime default activation false
+
+Why it mattered:
+
+The previous Harness case `r1-string-slugify` targeted root `strings.py`. The approved task targets `src/strings.py` and `test_strings.py`. Reusing the root case was not evidence for the approved task.
+
+## Evidence
+
+Focused fake proof:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T104749Z-r1-src-string-slugify-160593/report.json
+```
+
+Post-merge aggregate proof:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T104911Z-run-all-fake-167794/report.json
+```
+
+Real Case approved-scope run:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T104818Z-r1-src-string-slugify-163262/report.json
+```
+
+Observed real Case facts:
+
+- executable `ca` path was found
+- local provider config was supplied from Hermes runtime config without writing endpoint value to SOT
+- Case process started: true
+- required events passed: true
+- target repository start clean: true
+- target repository ending clean: true
+- changed files: none
+- tests passed because existing root-path tests still pass
+- Stage 5 proof failed because no approved target diff was produced
+
+## Decision
+
+Do not mark `CTO-WORK-049` validated.
+
+Do not patch the target by hand.
+
+Do not treat Case process start as success.
+
+Next useful step is backend behavior diagnosis: why `ca run --task` exits under Harness supervision without producing the required target diff or useful stdout/stderr.
+
+## Non-Authority Notice
+
+This record is child-local planning evidence. It does not promote CTO artifacts into Core, does not activate Case as default backend, and does not authorize any broader target mutation.

WORKBOARD.yaml

@@ -255,3 +255,8 @@ items:
     status: blocked
     source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-EXECUTION-ATTEMPT.md
     owner: jp
+  - id: CTO-WORK-052
+    title: First Real Governed Workflow Scope Case Evidence
+    status: blocked
+    source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-SCOPE-CASE-EVIDENCE.md
+    owner: jp