[07/36] Record OC-000 and OC-060 supervisor audit

[cjohnsto-nz]

---

This is part 15 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41 <-- current
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: approve. Docs plus packaging hygiene, and the .vscodeignore exclusions (.agents, .github, .opencode, .socket, .windsurf, gap-analysis docs) are sound, dev-coordination dirs should not ship in the VSIX. The audit's build/test/install numbers are self-reported and unverifiable from the diff, but nothing contradicts the stack. One structural note that applies to all the audit PRs: every commit hash cited in the ledger is already unresolvable after GitButler restacks, so the evidence pointers are dead on arrival. Consider citing branch + file paths instead of hashes.

[cjohnsto-nz]

Not changing this audit PR.

The ledger is a contemporaneous coordination log, not a permanent source permalink. Its entries already retain the owning full branch names and test/file paths alongside the then-current GitButler hashes. Rewriting historical entries after every restack would create documentation churn throughout the stack while still becoming stale on the next restack.

The structural point is valid, so the review workflow is now concrete for the remaining PRs: every later-fix claim will cite the stable PR URL/number, full owning branch, and relevant source or task path, with the current remote commit hash included only as supporting evidence after live verification. A mutable hash will no longer be the sole pointer.

The packaging change itself remains correct and requires no rework. PR #41 and immediate child PR #42 are currently MERGEABLE/CLEAN, and PR #41’s build and security checks are successful.