docs: record NativeStack2604 Dagu loopback operator access

[seathatflowsinourveins]

Scope

Record NativeStack2604 Dagu as an unauthenticated loopback operator path, distinct from Grafana Viewer access. Update the current dashboard/passwordless/backend wording, preserve historical receipts, and retain sanitized native observations plus the co-op's separate eight-DAG ownership classification.

• Publication base: 0d5e650. Earlier publication base 1fa8650 remains historical. Source observations and cited repository decisions were initially inspected at c1300c1.
• Lane: lane:foundation, exactly one lane label. DRAFT pending the co-op GPT first-pass and command-center ACK.
• Owned paths: three observability Markdown pages; docs/decisions/2026-10-06-dagu-loopback-auth-none.md; evidence/receipts/dagu-loopback-auth-none-20261006.json; evidence/artifacts/dagu-loopback-auth-none-20261006/{native-observations,owner-classification}.json; manifests/evidence.json in the LAST registry-only commit.
• No trading file, pin, host configuration, live DAG or historical receipt is changed. Prior frozen PR branches remain untouched.

SOTA sources

• Dagu v2.18.2, dagucloud/dagu@5ca5c59: internal/service/frontend/api/v1/api.go:725,733-742 and health.go:16-22 establish the auth-none bypass/public health scope; api/v1/api.yaml:789,12963,13037-13044 supplies the native API contracts. No server-side names-only projection is declared; the response's parameter fields are discarded outside the model.
• Pinned example source:10,29,67,113,155 supplies the five bundled sample-name/header associations. This does not claim unchanged installed bodies or inactivity.
• c1300c15:blueprints/us-equities/hosting/README.md:95-106 already adopts none on loopback and rejects a global Viewer interpretation. docs/decisions/2026-10-05-dagu-mise-pin-move.md:7,15 separates new-WSL 2.18.2 from the held workstation/trading 2.16.6; no pin move is made here.
• The same source pin's observability/grand-dashboard/README.md:131, passwordless.md:86-90 and observability/backends/README.md:214-218 are the corrected current statements. docs/native-dashboards.md:63-68 already gives the role distinction. Historical observability/grand-dashboard/receipt.json:159 and the corrected failed Viewer claim in the old scheduling review keep their original execution scope and bytes.
• curl native interface, checked 2026-10-06: --disable first prevents default curl configuration; --noproxy and stderr/http_code write-out give the recorded request. jq 1.8 manual, checked 2026-10-06: maintained field filtering. Installed clients report curl 8.18.0 and jq 1.8.1; no wrapper or dependency is adopted.
• Dagu installer v2.18.1:281-285,1036-1056,1647,1751,1763-1770 supplies native quote writer/readers matched by the archived source copies. systemd v258 source:3107-3109,3145-3182 supplies stable EnvironmentFile semantics. These are syntax references, not a systemd selection or host apply.
• Command-center report task-ns2604-coop-20261006T102431Z-prs, source SHA aedbffe132af2017b918d3b3c6fc3011d746478fdaa60833e7142861b7ff3f33, reports the existing auth change. Co-op A25 at 2026-10-06T11:01:22Z supplies the separate installed-description/comment/schedule classification, retained with its source digest and a sanitized backup destination. scripts/currency_due.py:800-801 at c1300c1 ties the two backup action names to foundation practice; the time job's dashboard tie is reported as PR feat: combine native Lanes collector and dashboard monitoring #775.
• docs/acceptance-evidence-policy.md:26-35 separates these classes; docs/lanes.md:96-128 supplies main-copy re-registration and registry LAST.

Evidence-class table

Claim	Evidence class	Observation / limitation
Existing auth:none change/restart	source_review, reported host execution	Command-center report; no private env/config/backup/key inspected or host change performed
Native direct listener scope	native_proven	ss rc 0, only 127.0.0.1:21080; three direct non-loopback IPv4 probes refused 111; no tunnel/proxy/off-host proof
Healthy server/client versions	native_proven, metadata only	Health HTTP 200/healthy/2.18.2 and PATH CLI 2.18.2; not binary/install acceptance
Credential-free DAG inventory	native_proven	Config-free curl/jq rc 0/0, HTTP 200, returned=totalRecords=8; exact tag presence retained
Eight DAG owner classifications	source_review, reported metadata inspection	Co-op read descriptions/comments/schedules only: five samples, two foundation backups, one foundation time check; zero paper execution/support DAGs by this mapping
Housekeeping outcome	source_review	No executable naive loader found in scoped sources; installer helpers evaluate quotes, dispatcher match is task text
Publication integrity	local_integration	validate.py passed after synchronized rebase; no upstream suite, provider or paper acceptance
Independent publication review	pending	Co-op GPT first-pass then command-center ACK; PR stays draft

The API response includes parameters/defaultParams. Only names, native tag presence/value and counts are streamed through jq into model context and persisted. No raw response, workflow body, credential value or host-interface address is retained. Matching sample headers does not prove installed body identity or inert runtime state. Whole-host backup/time practice serves trading without becoming a paper-lane workflow. The co-op reports current paper runs as NativeStack systemd timers outside this Dagu.

Local commands run

All native checks were light and at nice 19. validate.py was explicitly permitted during the paper window. No full unittest suite, build, install, DAG start, broker connection or order was run; no executable/test module changed.

ss -H -ltn '( sport = :21080 )'
# rc 0; sole 127.0.0.1:21080 listener
ip -j -4 address show scope global; direct socket.connect_ex to port 21080
# discovery rc 0; 3 non-loopback addresses, all ECONNREFUSED 111; addresses omitted
dagu version
# rc 0; 2.18.2
GET http://127.0.0.1:21080/api/v1/health with a fresh no-proxy/no-auth/no-cookie client
# HTTP 200; healthy; version 2.18.2
curl --disable --silent --show-error --fail --max-time 10 --noproxy '*' --write-out '%{stderr}%{http_code}
' 'http://127.0.0.1:21080/api/v1/dags?page=1&perPage=100&sort=name&order=asc'
# streamed directly into the maintained jq selector retained in native-observations.json
# curl rc 0 / jq rc 0; HTTP 200; 8 returned of 8; native tag presence true, empty arrays
python3 scripts/component_matrix.py --write
# rc 0; 32 rows, 0 flip-rule violations; outputs unchanged
python3 scripts/new_host_grand_list.py --write
# rc 0; 32 layers, 66 winners; outputs unchanged
python3 scripts/validate.py
# initial rc 0; synchronization retry rc 1 retained; corrected pinned-base final rc 0
# final: 69 components, 4 profiles, 213 receipts, 10322 hashed files
git diff --check
# rc 0

The first metadata GET lacked --disable, so it is retained only as inventory evidence. The next tag filter normalized null/missing to empty; the final capture retains tag presence/value without normalization and confirms all eight fields present. These are retained method corrections, not dropped failures or paper retries.

A shared origin/main update caused a publication check to use the newer registry with the older worktree. The failed check is retained in the receipt and private log. The source was rebased onto immutable 1fa8650, registry derived from that same commit and owned files re-registered. Final validation passes. A bounded completeness critic found no blocking source issue; its source review is not independent host acceptance.

Decision record

2026-10-06 Dagu loopback operator record, proposed with review_by 2027-01-01. Alternatives, role/bind boundaries, eight-name mapping, historical supersession, native methods and recheck conditions are explicit.

Host apply / read-back / rollback

None for this records PR. The command center's already reported auth change is not repeated. No peer/private script is changed: the alleged export/cat match was instruction text, and the archived installer helpers are quote-aware. The current main inventory has no Dagu declaration to amend. Any additional host proposal waits for the command center's ACK; no service/OS/WSL/user-manager restart is requested.

Historical receipts and the protected-instance probe contract are preserved; live Collector probe re-qualification, if needed for this mode, belongs to its owner.

Host evidence

No evidence/hosts files change. Source records and snapshots do not promote a platform, adoption, readiness, role-completeness or broker status.

Checklist

• One foundation lane label, draft PR from the template, non-empty SOTA sources.
• Supported upstream interfaces only; no new runner, validator, dependency, install or rebuild.
• No credential value, private env/key file, raw DAG body, machine-specific backup path or raw response committed.
• Peer worktrees, historical receipts, native DAGs and previous frozen branches preserved.
• No workflow/action pin, paid host, billing, host configuration or merge change.
• Native observations, reported owner metadata and local publication checks have separate classes.
• Registry is the LAST commit, reconstructed from the pinned publication base.
• Co-op GPT first-pass and command-center ACK pending.

Post-restart mechanical refresh

Rebased onto immutable main 0d5e650; restored its registry and re-registered only owned evidence. Every owned source file is byte-identical to the preceding reviewed head. The final commit touches only manifests/evidence.json. Fresh validate.py at nice 19 passed: 69 components, 4 profiles, 215 receipts, 10340 hashed files. No role/readiness or host acceptance promotion. GitHub review pagination was complete and had no unresolved connector threads; no comment mutation needed. New frozen head: dff1c03. Keep DRAFT for the requested co-op/command-center read. No queued-PR ownership claim or host apply.

[seathatflowsinourveins]

Closed with a record by the PR triage of 2026-10-07 (the command center's ruling). Not merged; the branch codex/ns2604-dagu-records-20261006 stays on origin at dff1c03.

Folded into #820 at 77d35e4. Of this PR's 8 changed files, 7 are byte-identical there and 1 is merged (shared files, and registry entries re-registered for the merged files); none is lost. The exact-head read of #820 at that head gives the same fold-completeness table.

Reopen trigger: none while #820 carries the content. Reopen with gh pr reopen 787.