Record first governed workflow pass

.sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-PASS-EVIDENCE.md

@@ -0,0 +1,93 @@
+---
+name: cto-first-real-governed-workflow-pass-evidence
+tier: local
+status: validated
+owner: jp
+source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-ISSUES.md
+created: 2026-06-01
+last_reviewed: 2026-06-01
+lifecycle_classification: planning
+core_promotion_status: not-promoted
+description: Child-local evidence that CTO-WORK-049 passed through the governed CTO Harness Case seam.
+---
+
+# CTO First Real Governed Workflow Pass Evidence
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Result
+
+Status: validated.
+
+Work item: `CTO-WORK-049`
+
+Approved target:
+
+```text
+/home/svrnty/workspaces/cortex-os/cto-stage5-target-sandbox
+```
+
+Approved task:
+
+```text
+src/strings.py slugify alignment task
+```
+
+Target commit:
+
+```text
+7706f99 fix(strings): align src.slugify with root behavior, add whitespace tests
+```
+
+Harness pass report:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T105222Z-r1-src-string-slugify-180161/report.json
+```
+
+Stage 5 proof:
+
+```text
+/home/svrnty/.hermes/profiles/cto-planb/harness-runs/20260601T105222Z-r1-src-string-slugify-180161/stage5-owned-repo-proof.json
+```
+
+Hermes fix commit:
+
+```text
+9806400 Fix Case Stage 5 baseline supervisor
+```
+
+## Evidence Facts
+
+- target repository admission status: `admitted`
+- target repository start clean: true
+- target repository ending clean: true
+- Case process started: true
+- changed files: `src/strings.py`, `test_strings.py`
+- allowed paths passed: true
+- forbidden paths passed: true
+- forbidden actions attempted: false
+- public publication attempted: false
+- push, merge, deploy, close, PR open attempted: false
+- validation command: `python3 -m pytest -q`
+- validation passed: true
+- operator outcome: `accepted`
+- runtime default activation: false
+
+## Root Cause Fixed
+
+The Stage 5 lifecycle supervisor previously treated any repository with more than one commit as ready to stop Case after a clean commit state. The owned Stage 5 target already had history, so the supervisor killed Case before the approved task diff existed.
+
+Hermes now passes the captured baseline HEAD into the Case engine and stops only after `HEAD != baseline_head` with a clean worktree.
+
+The Stage 5 validator now uses a target repository with existing history so this failure class is covered.
+
+## Decision
+
+`CTO-WORK-049` is validated as the first real governed workflow execution.
+
+Case remains a gated adapter behind CTO Harness.
+
+Runtime default activation remains false.
+
+This evidence does not promote CTO artifacts into Core and does not authorize broader target mutation.

WORKBOARD.yaml

@@ -242,9 +242,9 @@ items:
     owner: ""
   - id: CTO-WORK-049
     title: First Real Governed Workflow Execution
-    status: candidate
+    status: validated
     source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-ISSUES.md
-    owner: jp
+    owner: ""
   - id: CTO-WORK-050
     title: First Real Governed Workflow Approval Packet
     status: validated
@@ -257,6 +257,11 @@ items:
     owner: jp
   - id: CTO-WORK-052
     title: First Real Governed Workflow Scope Case Evidence
-    status: blocked
+    status: validated
     source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-SCOPE-CASE-EVIDENCE.md
-    owner: jp
+    owner: ""
+  - id: CTO-WORK-053
+    title: First Real Governed Workflow Pass Evidence
+    status: validated
+    source: .sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-PASS-EVIDENCE.md
+    owner: ""

tools/validate_cto_child.py

@@ -1587,8 +1587,11 @@ def main() -> int:
             "CTO-WORK-046": "validated",
             "CTO-WORK-047": "validated",
             "CTO-WORK-048": "validated",
-            "CTO-WORK-049": "candidate",
+            "CTO-WORK-049": "validated",
             "CTO-WORK-050": "validated",
+            "CTO-WORK-051": "blocked",
+            "CTO-WORK-052": "validated",
+            "CTO-WORK-053": "validated",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")