docs(evals): record finite pending authoring and privacy handoffs

doc/plans/2026-10-26-chat-catalog-eval-progress.md

@@ -102,3 +102,23 @@ Plugin installation fingerprints two generated child artifacts. CLI and plugin S
 Selected private credential inputs retain name-only identity for fingerprint replay after raw file cleanup; secret values never become fingerprint data or tracked metadata. Actual value validity and provider/disposable scope are still unverified. The separate narrow AgentMail/GitHub authenticated read-only discovery approval remains pending; no such request ran during this checkpoint. Native model calls in an authored eval are distinct from that discovery gate. Synthetic imported budget cost-events are fixture context, not incurred usage; campaign billing must use actual native run receipts and keep subscription dollars unpriced where appropriate.
 
 No live launch, selected-case probe, reservation, final retry, production edit or core PR occurred. Goal-tree remains exhausted; alignment and purpose final retries remain for coherent freeze B only. Freeze A still processes all remaining initial attempts first, and only then accumulates one correction set and one reviewed final retry set on B. Coordinator pauses for the runtime authoring wave while retaining sole execution/ledger ownership.
+
+## Pending authoring handoffs
+
+These committed area handoffs await the coordinator's next immutable reconciliation. They do not replace the archived `ad0907afb9` checkpoint of 134 executions or establish live acceptance. The fixed denominator remains 244; the production source baseline remains `8373d7867963674ff960d2345d0d28086f799bc7`. Live history is unchanged: three scenarios, four measurements, zero eligible passes.
+
+| Pending owner handoff | Authored | Without declared gaps | Partial | Still absent |
+| --- | ---: | ---: | ---: | ---: |
+| Domains, including two legacy cases | 41 | 41 | 0 | 4 |
+| Identity | 44 | 41 | 3 | 0 |
+| Runtime | 36 | 36 | 0 | 24 |
+| Integrator | 22 | 19 | 3 | 5 |
+| External | 25 | 22 | 3 | 27 |
+| Coordinator privileged | 16 | 16 | 0 | 0 |
+| Total pending reconciliation | 184 | 175 | 9 | 60 |
+
+Integrator's latest finite area handoff is `37b72e28e3` (genuine SDK-managed routine), following `2d53c3952f` / `6cc0012da0` (actual Morgan primary execution and review handoff) and `fe05c54c11` / `edbf426db3` (partial skill enablement). Its five absent IDs are `cases.update-case-facts`, `cases.case-history`, `cases.close-case`, `routines.webhook-trigger`, and `skills.review-update`. Card explanation still lacks the actual responding-principal inaccessible-source phase; card refresh still lacks an actual persisted failed-generation phase retaining prior output. Skill enablement has concrete intended assignment/future-version callbacks but requires an observed public configuration grant and an applicable effective-denial branch; rejection of the nonexistent `skills.use` action alone is not proof that every denial context is unsupported. Partial authoring and unsupported prerequisite receipts never count as passing outcomes or complete inventory processing.
+
+Shared privacy changes `b72f0f7cbb`, `4e73b7bb70`, `69b2e2b1a2`, and `d1fa9efdaf` protect diagnostic streaming, generated secret registration, reporter archives, authenticated API cookies, and sensitive PATCH calls. Worker registrations synchronously update an owned atomic mode0600 registry outside retained evidence; the launcher redacts before console/log emission and deletes that registry unconditionally. Diagnostic sink cleanup runs after independent observations: actual product response/work-product bytes remain available to leak oracles, while leaking opaque HTML/blob reports are omitted with explicit failure metadata and the original failed diagnosis retained. Actual offline Playwright canaries used synthetic values only, with no provider calls or canonical attempts. Closed source/hash/count receipts are retained under ignored `tests/runner-e2e/results/chat-catalog-campaign/privacy/`: `external-original-closed.json`, `shared-diagnostic-boundary.json`, `identity-private-browser-closed.json`, and `authenticated-api-transport-closed.json`. Raw canary reports are not published. Identity's finite child and exact state-file installation proof scanned 17 sinks without findings; the authenticated API canary scanned nine sinks without findings. Shared fingerprints change with these inputs; older passes cannot silently carry forward.
+
+`7154ba9e85` adds only the approved numeric GitHub alias/discovery bindings for the two workspace repository scenarios and removes the erroneous requirement for an already-qualified managed Anthropic profile. Source credential-name availability still does not establish validity or target authorization. Narrow authenticated AgentMail/GitHub resource discovery remains pending explicit approval after automatic review rejected it; no credentialed discovery calls or metadata persistence occurred. No production fix, core PR, live launch, reservation, or final retry was added by these authoring handoffs. The coordinator retains sole ledger/execution ownership and resumes sole progress-document ownership after this bounded update.