# Stage 139: RING-0 Airlock & WORM 3-2-1-1-0 (aq139_enforce_ring0_airlock_and_worm_restore / DB-UNIT-07)

Scrubs secrets and holdouts at the Plane-0 promotion airlock and verifies 3-2-1-1-0 immutable WORM backups via clean-room SWHID restore and causal WAL replay.

- Atomic micro-queue: `aq139_enforce_ring0_airlock_and_worm_restore` (visibility: `public_commons`)
- Backing database unit: `DB-UNIT-07` (`Deterministic Wasm/gVisor Sandbox & Red-Team Oracle Core`)
- Database cell: `queues-db.teleon.dev` (`teleon_core.acceptance_oracle_suites`, `teleon_core.sandbox_slsa_attestations`, `teleon_core.adversarial_redteam_vectors`)
- Claim row hydration: `single_self_contained_flat_task_row` (100% context inline, normalized writeback)
- Track 2 Sister queue (`SISTER-07`): `sq07-improve-sandbox-queue.teleon.dev` (Strengthen mutation kill rates, reduce sandbox cold-start fuel, and harvest new adversarial fuzzing routines.)
- Lanes: One-Way Promotion Airlock, 3-2-1-1-0 Object Lock, Causal Outbox WAL Replay

## Execution engines & AI Agent freedom contract

- **Deterministic (0 model calls)**: `wasmtime_wit_deterministic_runner_v1` (Secret/holdout airlock scrubber, 3-2-1-1-0 policy checker & fenced WAL replayer (0 calls))
- **Hybrid (<=1 model call)**: `boundary_counterexample_synthesizer_v1`
- **AI Agent & Bot Fleet (1..6 calls)**: `adversarial_exploit_hunter_v1` (Disaster-recovery drill auditor & clean-room verification author)
  - Contract: **Instructions + Resources + Freedom to search for new resources and new ways not bound by instructions**

## Database invariants

- Content approval grants zero execution authority; sandboxes enforce fuel, memory, and zero-network isolation.

## External & internal bot fleet actions

- Block any internal record containing API keys, PEM blocks, or holdout answers from leaving RING-0
- Enforce 3 copies, 2 media types, 1 offsite region, 1 immutable WORM lock, and 0 clean-room restore errors
- Replay Outbox WAL entries strictly in monotonic (fencing_token, row_version) order

## Sister self-tuning areas

- Add deterministic property-testing generators for surviving code mutants
- Tune Wasm fuel ceilings and warm-snapshot pooling priorities
- Expand prompt-injection and path-traversal red-team vector corpora