U02 is a published Power User lesson in Preview 0.32. The action cards are the primary route. Academy provides local Prepare, Check, and Reset helpers.
Keep a native terminal and one supported CodeArbiter harness at the same clone. Native shell commands never begin with !. Harness shell commands begin with exactly one !. Host CodeArbiter commands never begin with !.
1
YouBrowser
Read the audit-guard observation boundary
This lesson observes one harmless blocked write against an existing append-only audit log. It does not ask you to execute an override, change an audit record, or claim that anyone approved a bypass.
Why this matters: A failed pre-write attempt and an actual override are different events.
Expected result
You know that `.codearbiter/overrides.log` stays unchanged and that the exercise commits only one local observation note.
Evidence
Check binds repository bytes and one local event-shaped note. It cannot prove the refusal chronology; manual imitation remains possible.
If that does not happen
If any requested action would change an audit record, stop this lesson. Do not substitute an override command.
Prepare creates a numbered U02 branch with a committed scenario overlay and binds the starting bytes of .codearbiter/overrides.log. The learner makes one content-neutral restore request. H-05 protects the audit log from that rewrite-shaped shell operation before Git runs.
The only committed learner artifact is .codearbiter/reports/academy/U02-observation.md. It records the prepared baseline digest and the displayed H-05 line, then says plainly that a written note cannot prove the event chronology. The audit log remains unchanged.
This lesson does not practice $ca-override, write audit packets, or preserve metrics output. Those are separate real CodeArbiter surfaces. Do not represent an Academy note as their output.
At the clean Academy clone root, run Academy Prepare in a native terminal. Native-terminal commands go directly into that terminal and never begin with `!`.
Why this matters: Prepare creates the numbered attempt and binds Check to the audit log's pre-observation bytes.
In the prepared attempt, inspect the current audit log through the selected harness shell. Harness shell commands begin with exactly one `!`; they are shell commands, not CodeArbiter commands.
Why this matters: Recognize the protected target before observing the guard that prevents its rewrite.
You see a local baseline digest without changing the audit log.
Evidence
The displayed digest is orientation only. Check derives its own digest from the prepared commit.
If that does not happen
If the log is missing or the worktree is not clean, stop and Reset the attempt. Do not create or edit the log by hand.
4
You
Observe the H-05 guarded restore refusal
Run exactly one `git restore --source=HEAD` request in the harness shell, so it begins with one `!`. Prepare has proven the target equals HEAD, so the request is content-neutral if enforcement is unavailable. Do not retry it or use an override command.
Why this matters: The real H-05 shell guard blocks Git restore because it can rewrite an audit log.
The active host prints one `BLOCKED [H-05]: ...` line before Git runs, and the audit log remains byte-for-byte unchanged.
Evidence
Capture the displayed H-05 line exactly. Its SHA-256 binds the note to that text, but the note cannot independently prove when the refusal happened.
If that does not happen
If the guard does not run, verify the log still equals HEAD, preserve the result, and stop for host-install investigation. Never edit the log to repair or hide the attempt.
Ask the agent to draft `.codearbiter/reports/academy/U02-observation.md` from the displayed H-05 line and the bound baseline. It must contain the exact target, baseline SHA-256, event SHA-256, event_line, and the chronology limitation. Do not stage, commit, or push.
Why this matters: A constrained note preserves an observation without touching protected audit history.
Any OS · Claude Code
Create only .codearbiter/reports/academy/U02-observation.md. Write exactly these eight lines, each followed by LF:
# U02 audit-guard observation
event: H-05 guarded restore refusal
target: .codearbiter/overrides.log
baseline_sha256: <SHA-256 of the unchanged current .codearbiter/overrides.log UTF-8 bytes; Prepare bound it to HEAD>
event_sha256: <SHA-256 of the exact displayed BLOCKED [H-05] refusal line as UTF-8 bytes>
event_line: <that exact displayed line>
limitation: This record cannot prove the refusal chronology; manual imitation remains possible.
Do not stage, commit, push, or edit .codearbiter/overrides.log.
Any OS · Codex
Create only .codearbiter/reports/academy/U02-observation.md. Write exactly these eight lines, each followed by LF:
# U02 audit-guard observation
event: H-05 guarded restore refusal
target: .codearbiter/overrides.log
baseline_sha256: <SHA-256 of the unchanged current .codearbiter/overrides.log UTF-8 bytes; Prepare bound it to HEAD>
event_sha256: <SHA-256 of the exact displayed BLOCKED [H-05] refusal line as UTF-8 bytes>
event_line: <that exact displayed line>
limitation: This record cannot prove the refusal chronology; manual imitation remains possible.
Do not stage, commit, push, or edit .codearbiter/overrides.log.
Any OS · Pi
Create only .codearbiter/reports/academy/U02-observation.md. Write exactly these eight lines, each followed by LF:
# U02 audit-guard observation
event: H-05 guarded restore refusal
target: .codearbiter/overrides.log
baseline_sha256: <SHA-256 of the unchanged current .codearbiter/overrides.log UTF-8 bytes; Prepare bound it to HEAD>
event_sha256: <SHA-256 of the exact displayed BLOCKED [H-05] refusal line as UTF-8 bytes>
event_line: <that exact displayed line>
limitation: This record cannot prove the refusal chronology; manual imitation remains possible.
Do not stage, commit, push, or edit .codearbiter/overrides.log.
Expected result
One unstaged observation note describes the local refusal and explicitly says that manual imitation remains possible.
Evidence
Check requires exact note bytes and the unchanged protected log. It does not authenticate the agent or harness transcript.
If that does not happen
If the agent cannot derive a field from the prepared baseline or displayed refusal, stop rather than guessing.
6
YouBrowser
Review the one-path observation boundary
Review the draft before staging. The only learner commit path is `.codearbiter/reports/academy/U02-observation.md`; `.codearbiter/overrides.log` must remain unchanged. Audit and metrics are optional read-only observations, never input to Check's chronology proof.
Why this matters: A one-path commit boundary prevents an observation exercise from mutating the audit trail it discusses.
Expected result
You can accept the one-path note or identify the exact local field to correct.
Evidence
Review is a learner action. No repository artifact can prove it occurred.
If that does not happen
If another path changed, unstage it and correct only the note. Do not reset, amend, or rewrite audit history.
7
You
Stage only the observation note
After your review, stage exactly the observation note in a native terminal. Native-terminal commands never begin with `!`.
Why this matters: The staged diff makes the permissible one-path boundary visible before the governed commit.
The prepared attempt has exactly one child commit. It changes only .codearbiter/reports/academy/U02-observation.md; .codearbiter/overrides.log is byte-for-byte identical to the prepared baseline. The note has eight lines, including the displayed H-05 line and the chronology limitation.
This is not proof that the selected host ran the command at a particular time. It is a bounded local record whose path, bytes, prepared baseline, and commit scope Check can validate.
Check validates the prepared baseline, protected-log preservation, note bytes, one child commit, and clean worktree. It does not authenticate a transcript, a person, or a hosted result.
9
You
Run the local U02 checkpoint
Run Check in a native terminal. Native-terminal commands never begin with `!`.
Why this matters: Check validates the prepared baseline, protected-log preservation, exact note shape, one commit, and clean worktree.
If Check reports a mismatch, correct only the observation note. Do not edit .codearbiter/overrides.log, add a second event line, invent an override, or rewrite the attempt.
Hint 1. The probe is exactly git restore --source=HEAD -- .codearbiter/overrides.log through the harness shell. It is safe because Prepare bound the target to HEAD before the probe.
Hint 2. The note uses the displayed BLOCKED [H-05]: ... text verbatim. Hash that exact UTF-8 text for event_sha256.
Hint 3. Reset is only for an attempt that cannot be corrected inside the observation-note boundary. It preserves rather than erases the failed attempt.
10
You
Reset this attempt safely
If the attempt cannot be corrected within its note boundary, use Academy Reset in a native terminal. Native-terminal commands never begin with `!`.
Why this matters: Reset preserves the failed attempt rather than hiding it through history rewriting.
The guide and action manifest are one contract. The renderer turns each action reference into the same website card, with the correct operating-system, harness, and copy control. Check is the deterministic authority for the local artifact boundary. It does not claim a command invocation, approval, or event chronology that repository state cannot establish.
