feat(demo): beat 06 through the PluginManager, Rev 3 bundle one stream across a restart, streams read path checks the head

[Levaj2000]

Summary

Picks up Teryl's bd39d2c/64c8eba on cpex feat/audit-seam (host-settable audit stream identity: plugin_settings.audit_stream_namespace in YAML, code-only plugin_settings.audit_epoch, both bridged into ExecutorConfig; non-Clone EffectEmitterSlot) and closes the three commitments from the 2026-09-02 thread.

• Beat 06 now goes through the PluginManager. examples/panic_drive.rs parses an operator config declaring the panicking plugin and kind: audit/ocsf with no hooks:, registers both factories, sets the epoch in code, and runs load_config → initialize → invoke_named → shutdown. First thing in the tree to exercise load_config end to end. The real panic lands on gw-1:decision in the demo's second epoch at stream_seq 0, and the driver asserts the stream id and epoch the executor stamped, so an upstream change fails on the driver, not on stage.
• Rev 3 runner: one stream across a restart. demo/run-demo.sh restores EPOCH_2, drives beats 01–05 on the same gw-1:decision id, asserts one stream across two epochs each dense from 0, and writes SHA256SUMS.txt + PROVENANCE.txt beside the loose files (no archive). Runner output: PASS: 6 records — 0 errors, 0 warnings.
• CI seam pin → 64c8eba. Re-verified the way the workflow runs it: warning-free --locked build, 33 tests green, emit_sample byte-identical to SAMPLE-OUTPUT.md. The README wiring, SAMPLE-OUTPUT.md, and SEAM-PORT-RESULTS.md record it.
• Edge streams read path checks the head (edge ingest: check first stream_seq of a new epoch (lost record 0 is invisible) #507). GET /api/v1/edges/{id}/streams scored dense from records == last_seq - first_seq + 1, so an epoch opening at 1 with a dense interior read as dense while its row carried the stream_seq head gap anomaly. Dense now also requires first_seq == 0; the Case File continuity panel counts expected records from 0 and names a lost head (2 of 3 · head lost · 1 anomaly).

The ledger-adapter half of the same rule (GapDetector head-of-epoch + epoch regression, are-immutable-ledger#13) is prepared as a patch for Jeff to post from his terminal; it is not in this PR.

Verification

• cargo +1.96.1 check --locked --all-targets with -D warnings: clean. cargo +1.96.1 test --locked: 33 passed; 0 failed.
• cargo run --example emit_sample: byte-identical to SAMPLE-OUTPUT.md on 64c8eba.
• ./demo/run-demo.sh against cpex 64c8eba: exit 0, one stream gw-1:decision across epochs 1755648000000000000 → 1755649000000000000, validator PASS: 6 records — 0 errors, 0 warnings.
• Full backend pytest (api + gateway + common + mandate, CI's SQLite env): 1181 passed, 21 skipped, 6 warnings in 50.53s.
• cd dashboard && npm test: 89 passed (89).
• ruff, ruff format, prettier, eslint, pillar and no-confidential hooks: clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FnVdSstGAoYJEoEVqzUXbq

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ai-identity-landing	Ready	Preview	Sep 4, 2026 3:36pm UTC
dashboard	Building	Preview	Sep 4, 2026 3:36pm UTC