# V5 working tree inventory

**Captured:** 2026-10-01, after V5 discovery-preparation documents were added  
**Branch/HEAD:** `master` / `b8c71d2`  
**Purpose:** preserve existing work and establish the product baseline before changing code.

## Snapshot

At capture time, `git status --porcelain=v1 -uall` reported **87 changed paths**, including the V5 product-planning documents:

| Git state | Paths | Notes |
|---|---:|---|
| Staged changes | 51 | Includes historical project records and staged source/tests. |
| Tracked working-tree changes | 36 | Several paths also have staged versions; index and checkout differ. |
| Untracked paths | 25 | Includes reports, CI, V5 proposal/materials, new implementation, tests, and backups. |
| Paths with both staged and unstaged changes | 25 | Index and checkout contain different snapshots for these paths. |

These categories overlap. Some files have both staged and unstaged changes. The numbers are a snapshot, not a claim that the branch is clean. The later execution fix modified an already-untracked provider file, so the status count did not change.

## Content groups and disposition

| Group | Current contents | V5 treatment |
|---|---|---|
| `.kilo/` | Staged architecture, roadmap, status, and dated historical reports. | Preserve as project history. Do not treat old snapshots as current implementation evidence. |
| Root project documentation | README, Phase 3/5 reports, source audit, project structure, status, execution integration/security reports, and `BASELINE_REVIEW.md`. | Preserve. Reconcile `PROJECT_STATUS.md` against current code and fresh verification before any release claim. |
| `.github/workflows/ci.yml` | New CI quality workflow. | Preserve; review whether it covers the actual supported host matrix and both Bubblewrap-present and absent cases. |
| `src/cyberbrain26/` tracked modifications | Agent, CLI, Control Plane, provider, model, security, and Ptah/orchestration changes. | Preserve. Review index versus working-tree versions before release staging. Keep changes needed for the single MVP scenario; defer unrelated roadmap expansion. |
| `src/cyberbrain26/` new files | SQLite storage/memory, authorized execution, Bubblewrap, and privacy gateway components. | Preserve. Verify integration and behavior; do not implement duplicate persistence or privacy services. |
| `tests/` staged, modified, and new files | Control/model/agent/security/task, execution, end-to-end, and SQLite persistence coverage. | Preserve. Use the quality workflow to establish the current working-tree result. |
| Backups | `security_plane_backup_20260923_210356/` and `src/cyberbrain26/orchestration/ptah_bridge.py.phase6-backup`. | Preserve as forensic/history material. Do not package them as application code. |
| V5 proposal/materials | `ROADMAP_V5.md` and `docs/product/*_V5.md`. | Treat as a product direction proposal until the customer-discovery gate confirms the segment and use case. |

## Handling rules

- No existing files were reset, deleted, staged, or committed during this inventory.
- Do not run `git reset`, `git clean`, or broad staging commands to create a clean baseline.
- Before a release commit, compare staged and working-tree snapshots for every `MM`/`AM` path and stage only the reviewed product scope.
- Historical reports and backups should remain available until their contents are classified and any needed evidence is preserved.

## Immediate findings

1. The working tree already contains substantial implementation beyond the last canonical status report, including a CI workflow, persistent SQLite components, security review, and persistence tests.
2. The SQLite storage guide documents task, approval, audit, memory, and provenance persistence, including its recovery and retention limitations.
3. `PROJECT_STATUS.md` still describes several of these areas as incomplete or unverified. Refresh it only after fresh checks of the present working tree.
4. The baseline is reviewable but not yet release-ready: the index and working tree contain separate snapshots, there is no reviewed release commit, and the first sellable workflow has not been selected with customers.
5. The current `.gitignore` working-tree edit adds SQLite database, WAL, and SHM patterns. Preserve it; it protects local persistence files from accidental commits.
6. `git diff --check` is clean for the working-tree diff. `git diff --cached --check` reports 732 whitespace findings across 51 staged paths, mainly historical/staged text additions. These were not normalized; review line endings and intended index content before release staging.

## First V5 verification update

During this checkpoint, `BubblewrapExecutionProvider.execute()` was adjusted to validate the requested language before checking whether the Bubblewrap executable is present. Both full-suite environments now pass: 291 tests with Bubblewrap available; 283 passed and 8 Bubblewrap-dependent tests skipped with Bubblewrap hidden from `PATH`. Ruff passes and mypy reports no issues in 53 source files. See `V5_FIRST_SPRINT_REPORT.md` and `MVP_GAP_ANALYSIS_V5.md` for the product gate and remaining work.