[poll] cd04-q1/budget (round 1) #55

Walking the pipeline (docs/PIPELINE.md) for the reference poll, as the verification step of #54. Checked boxes were exercised live; unchecked boxes are owner-gated or known gaps, annotated with what's needed.

Identity

• pile: cd04-q1
• poll: budget
• scope: colorado
• round: 1
• type: multichoice (Cut / Keep)
• pile repo: (the operator's data-pile fork)
• canonical Issue: [poll:budget] Cut or keep the library budget? tell.anecdote.channel#35

Checklist — the pipeline

• 0. Compose the question (fewest-verbs). pre-pipeline
• 1. Copy the data-pile template ⚑ — owner-gated: needs SETUP_TOKEN to run setup (age keypair + PILE_AGE_IDENTITY). Not run here.
• 2. Configure the question — the reference constitution already exists: tell …/_data/constitutions/cd04-q1/budget.json; pile.yml sources: carries the tell source. ┄ §J one-gesture authoring still unbuilt.
• 3. Register the pile with the Tell ⚑ — owner-gated: handshake PR + human merge + IRL signer-fingerprint pin. ┄ §B/§A validation. The reference pile is already listed in _data/piles.yml.
• 4. Register the question + mint the QR — ✅ verified live: bin/qr (throwaway secret) minted a landing URL; token binds {pile, poll, round} — confirmed it differs by round and by pile. Canonical Issue opened (docs: vision + consolidated open-questions for the constellation #35, matches bin/open-poll). ⚑ a real authorizable token needs the owner's TELL_QR_SECRET; ┄ §L signed-QR trust roots/tiling unbuilt.
• 5. Answer-intake page — ✅ verified live: tell …/test/landing.test.mjs passes — index.md builds the prefilled Issue/comment link with a parseable tell block. ┄ §F QR expiry / pre-public pickup.
• 6. Answer submitted — not posted (would require a real authorizable token; deliberately not faked).
• 7. Tell seals into encrypted chunks — ✅ spine verified via data-pile/test/run.sh: a chain is built (deliver), encrypted under the ratchet. Signature path skipped in the walk env (no ssh-keygen). ┄ §K producer cron off by default.
• 8. Pile pulls + verifies — ✅ verified live: data-pile/test/run.sh — verify passes a good chain, detects a tampered block, and cross-checks ratchet commitments. ┄ §K per-poll registry / delivery marker.
• 9. Tell retains/rotates — not exercised (cadence/prune-pile-history is operator-set). ┄ §F exposure window.
• 10. Owner decodes; no clobber — ✅ verified live: owner decrypt recovered all blocks; forward-only proof (bin/prove K_1) verifies blocks 1.. against the signed manifest while block 0 stays sealed. Multi-source no-clobber holds by architecture (independent feed/<source> branches; per-source verify) — see data-pile …/docs/lifecycle.md "Multiple Tells, one pile."
• 11. Report / aggregate beyond the arc — ┄ §C Atlas pool aggregation/reporting-law.

Proof of lifecycle (where this poll is right now)

• Current state: Answerable — a canonical Issue (docs: vision + consolidated open-questions for the constellation #35) exists and the QR mechanic is proven; not yet Live (no authorized answer has been sealed, because that needs the owner's TELL_QR_SECRET).
• Proven by: the canonical Issue tell#35 + the verified QR-mint/landing tests above.

Owner-gated acts still pending

• Step 1 — run setup with SETUP_TOKEN; hold PILE_AGE_IDENTITY.
• Step 3 — TELL_PR_TOKEN, merge the handshake PR, pin the signer fingerprint (IRL).
• Step 4 — set TELL_QR_SECRET (and the delivery signer for a signed QR) to mint an authorizable token.
• Step 7 — decide + enable the deliver cadence (§K).
• Step 10 — provide PILE_AGE_IDENTITY to decode real data.

These are the steps "ejected to the user's side" — the pipeline is provably correct up to them; they are the consent/secret boundary, by design.