---
name: inspect-original-source-custody
description: "Fail-closed original #2962/r7 Windows custody inspection and commissioning handoff for the existing Stephanos recovery path; never forge a terminal receipt or release a lease."
---

# Inspect original source custody (#2961 / #2962)

Use this skill when canonical repair reports `REPAIR_ORIGINAL_EXECUTION_RECEIPT_MISSING` for `critical-2962-elastic-goal-r7-lease`. This skill is a **source-controlled diagnostic candidate**, not a remotely executable privileged operation, authority grant, or installed service.

## Trusted sequence

1. Verify exact current protected `main`, canonical Battle Bridge source head, and original source lease/mission provenance using existing read-only Sovereign Commander visibility. Preserve the original eight dirty checkout entries.
2. On an independently authorized Battle Bridge session, use the fixed source-only `scripts/windows/inspect-original-source-custody-readonly.ps1`. This script accepts no target path, PID or lease parameter, reads a bounded class of Windows telemetry, emits a redacted local JSON summary and never terminates a process, changes an ACL, starts a task, signs proof or writes source.
3. Parse the local JSON with `inspectOriginalSourceCustodyCensusV1` in `shared/agents/originalSourceCustodyInspectionV1.mjs`. Even a clean read reports **ORIGINAL_SOURCE_CUSTODY_HOLD**. Never infer privileged custody from process count zero, task count, local ACL readability or a structurally valid result.
4. Qualify and **commission outside the checkout** a real independent protected Windows OS witness with a privileged service SID distinct from original source writers and the separate operator attestation principal. Signer private keys must remain inaccessible to source builders, mailboxes and GitHub. Verify current original-writer process/job exclusion, WMI/COM and scheduled task re-entry denial, and enforce/test source ACL denial on the exact original principals. Require independently audited timestamps, key pinning and immutable logs.
5. Use the existing `authenticateLegacyOrphanQuarantine` verifier and independently signed operator approval bound to one exact original r7 lease digest. Existing canonical mission lock, queue inventory, cancellation audit and CAS release must all pass. If there is no genuinely verified prospective witness or the environment is uncommissioned, **stop with HOLD**, not a fabricated r7 receipt.
6. After a real canonical exact release, resume legal goal selection and confirm physical SELECT / CLAIM / PICKUP / EDIT / TEST / COMMIT / protected merge / deployment / two unattended refill receipts. Never mark the original goal completed based on cancellation.

## Separate parallel rescue

The independent **Rescue Island** (#3103 / #3109) can progress previously unclaimed, non-overlapping ordinary goal source work without acquiring, cloning, deleting or bypassing the original programme lease. Follow the separately qualified `merge-and-commission-rescue-island` skill. It cannot borrow Seed Canopy queue ownership or a new unrestricted execution shell.

## Hard boundaries

No assumed elevated permissions, no blanket PowerShell installation or `Set-Acl` against the running checkout, no force-release, process kill, false attestation, manual GitHub status pretending to be a machine proof, unattended run from this read-only diagnostic, or protected merge without immutable independent qualified review. Gaming mode preserves Battle Bridge CPU/GPU performance.

**Production blocker:** independent privileged OS witness provisioning plus separate operator signing and live commissioning are still required. This skill and census intentionally do not implement those privileged actions.