truegoodcraft · Aug 27, 2026 · Aug 27, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -37,7 +37,8 @@ Authority sources in descending order:
 - When code depends on a D1 schema change, a migration requires explicit approval and remote verification before any Worker deployment.
 - Do not print or commit secret values.
 - The optional `REPORT_READ_TOKEN` is a secret-binding capability, not repository data. Do not generate, provision, inspect, remove, or rotate its production value without explicit secret-operation approval. It must be independently generated and cryptographically random, contain 32 to 128 URL-safe ASCII characters (`A-Z`, `a-z`, `0-9`, `_`, and `-`), and differ from `ADMIN_TOKEN`; an identical non-empty configuration intentionally fails every protected read and write closed.
-- `npm run --silent diagnostic:ceo` is the sole canonical operator helper for a Lighthouse production CEO read. Its fixed, non-echoing behavior does not grant endpoint approval; every invocation still requires explicit production-read scope.
+- `npm run --silent diagnostic:ceo` is the sole canonical operator helper for a Lighthouse production CEO read. It strictly validates CEO response contract `1.1` or `1.2` with metric-definition version `1.1`. Its fixed, non-echoing behavior does not grant endpoint approval; every invocation still requires explicit production-read scope.
+- Active-production receipt: the separately approved 2026-08-27 release/audit established Lighthouse `1.30.0`, Worker version `ab29c0fb-ca9e-4074-a379-18d0943ec02c` at 100% traffic, deployment `526f9fbc-6432-466c-9b39-2ae90b299cae`, from merged `main` commit `4e80d65de01606c15100a99e7852ce19c5e6cd98`; the approved CEO read at `2026-08-27T15:08:12.012Z` verified the report-read path. `SOT.md` and `OPERATIONS.md` are the detailed authority. This receipt does not authorize another endpoint request, deployment, or secret operation.
 - Cross-repository contracts with Agent Smith, BUS Core, buscore-site, or the leads database must be documented when touched.
 
 ## Canonical Analytics Access and Diagnostics
@@ -59,7 +60,8 @@ Operational constraints:
 - `ADMIN_TOKEN` remains broad: it protects report reads and is the only credential accepted by the mutating `POST /campaign`, `POST /notes`, and `POST /report/snapshot` routes. Optional `REPORT_READ_TOKEN`, when separately provisioned, is accepted only through `X-Report-Token` for `GET /report`; the admin credential remains a backward-compatible report fallback and the read credential never authorizes a write.
 - The report-read split does not make report requests zero-mutation. Bare/fleet/site reports refresh stored traffic, and every report view—including CEO—can increment `metrics_daily.errors` when assembly fails. The helper is therefore Class 2 and approval-gated.
 - Treat the helper's three static failure lines literally: `access blocked` is credential/access evidence, `report unavailable` is application evidence with a possible error-counter increment, and generic `diagnostic failed` is an unclassified transport/safety/contract failure. None authorizes a retry or alternate probe.
-- The local 1.30.0 bundle contains no secret value, provisioning, deployment, or production verification. Do not claim production read-token availability until separately approved external activation and readback prove it.
+- The local 1.31.0 target advances the CEO response contract to `1.2` while metric definitions remain `1.1`; active production remains Lighthouse 1.30.0/CEO `1.1` until an explicitly approved promotion. Direct CEO `1.2` sources use an activity watermark, which is not health, freshness, completeness, or failure evidence. A composite-source watermark is the conservative earliest required-component watermark; a day-bucket watermark is a reporting bound, not an event timestamp. Only `service_probes` uses scheduled-probe fresh/stale semantics.
+- Do not promote Lighthouse 1.31.0 until Agent Smith's owning governed bundle accepts both strict CEO `1.1` and `1.2`, and retain its `1.1` support for Worker rollback. Agent Smith `0.26.0` established deployed dual-version compatibility on 2026-08-27: merged `main` commit `5519764d959cf1d6a505280814c59e82854f9bda` passed CI run `33105121602` and deployment run `33105121605`, including Discord command registration, and the owner confirmed `/report` works against active Lighthouse CEO `1.1`. A final Lighthouse audit then tightened the `1.2` schema to reject non-null inquiry totals when that source is unavailable. The deployed consumer accepts every valid producer output but its pinned validator predates that additional rejection; deploy and verify the matching Agent Smith validator patch before Lighthouse promotion. Until then, report `BLOCKED BEFORE LIGHTHOUSE 1.31 PROMOTION`.
 - Agent Smith still carries `LIGHTHOUSE_ADMIN_TOKEN` for report reads and monthly snapshot writes. Do not remove or rotate that credential until an owner-approved snapshot-specific authorization split or write removal is implemented and verified in the owning repositories.
 - Many GET/HEAD surfaces change evidence. Bare/fleet/site reports refresh stored traffic; report failures can increment errors; artifact HEAD records raw/HEAD truth; update, redirect, artifact, telemetry, and admin-write routes are not passive probes.
 - Git publication is not zero-mutation. The 1.29.3 `main` merge proved that the former Workers Builds production command could promote active traffic independently of the checked-in gate. Durable readback on 2026-08-26 confirmed that both non-production and production publication now use `npx wrangler versions upload`. Pushes still create version or preview state, while active production promotion is reserved for the explicitly approved manual GitHub workflow. Any future external-setting drift reinstates `BLOCKED BEFORE MERGE`.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## [1.31.0] - 2026-08-27
+
+- Advanced only the strict CEO report contract from `1.1` to `1.2`; `metric_definition_version` remains `1.1`, so metric definitions, window boundaries, counts, and historical meaning do not reset.
+- Added `freshness_basis` to every CEO source state. Direct aggregate sources use `activity`, remain `freshness: "unknown"`, use `activity_only` when an activity watermark exists, and expose `data_through` only as that watermark. A single-component watermark is its latest trusted observation; a composite watermark is the conservative earliest required-component watermark; a day-bucket watermark is a bounded reporting timestamp rather than an event timestamp. Sparse silence is no longer mislabeled `fresh`, `stale`, or failed; a successful source with no history remains `unknown`/`source_history_missing`.
+- Reserved `freshness_basis: "scheduled_probe"` and `fresh`/`stale` for `service_probes`. A successful query with no probe history is available/unknown with `probe_history_missing` and empty details; a partial active-target set is available/unknown with `probe_history_incomplete`, observed details, and the latest observed watermark; query failure alone is unavailable. A complete six-target set retains its oldest-required-target 36-hour fresh/stale rule. Exact latest-timestamp ties now resolve deterministically with failure before success and a stable row-ID tie-break, preventing a tied pass/fail pair from producing order-dependent status.
+- Clarified that voluntary-inquiry windows count unique lead records by `created_at`; a later update is not counted as a new inquiry record and does not move that record into a later created-at window. Added the aggregate-only `details.voluntary_inquiry_records` diagnostic with `total_records`, `last_created_at`, and `last_updated_at`, plus the exact limitation `existing_lead_updates_increment_inquiry_windows: false`; it returns no lead PII, record identifiers, email, form content, or raw attribution. The strict schema now rejects non-null inquiry window totals whenever the inquiry source is unavailable.
+- Preserved the strict `1.1` schema for rollback and made the canonical CEO diagnostic helper strictly validate either `1.1` or `1.2` while requiring metric-definition version `1.1`. Agent Smith `0.26.0` established deployed dual-version compatibility on 2026-08-27: merged `main` commit `5519764d959cf1d6a505280814c59e82854f9bda` passed CI run `33105121602` and deployment run `33105121605`, including Discord command registration, and the owner confirmed `/report` works against active Lighthouse CEO `1.1`. The final Lighthouse audit subsequently added the unavailable-source inquiry-count rejection. Deployed Smith accepts every valid `1.2` producer output and retains `1.1` rollback support, but exact validator parity requires a matching governed Agent Smith patch before Lighthouse production promotion.
+- Preserved all routes, headers, authorization behavior, CORS, Worker configuration and bindings, D1 schema and storage semantics, retention, schedules, service-probe/canary requests, ingestion, external integrations, and secret requirements. No migration, secret operation, direct SQL, configuration change, or producer change is required.
+- Corrected the production baseline from the separately approved 2026-08-27 receipts: release workflow run `33086080869` succeeded for merged `main` commit `4e80d65de01606c15100a99e7852ce19c5e6cd98`; Lighthouse `1.30.0` Worker version `ab29c0fb-ca9e-4074-a379-18d0943ec02c` is active at 100% under deployment `526f9fbc-6432-466c-9b39-2ae90b299cae`; and the approved CEO read occurred at `2026-08-27T15:08:12.012Z`. No build timestamp is inferred.
+- This local 1.31.0 bundle made no production endpoint request, Cloudflare read, upload, deployment, traffic change, D1 mutation, secret operation, or external-system change. The production facts above are retained receipts from the separately approved prior audit and release steps; production remains on CEO contract `1.1` until a separately approved 1.31.0 promotion.
+
 ## [1.30.0] - 2026-08-26
 
 - Added the optional `REPORT_READ_TOKEN` Worker secret and exact `X-Report-Token` authentication path for every `GET /report` view. The read secret must be independently generated, cryptographically random, contain 32 to 128 URL-safe ASCII characters, and differ from `ADMIN_TOKEN`; existing exact `X-Admin-Token`/`ADMIN_TOKEN` report access remains backward-compatible when the configuration is distinct.