Campus AI OS 5.2.11

Fixes the last instructions that told non-clock primary seats to write to the shared ledger (Codex 5.2.10 blocker). 251 fixtures pass; packaged artifact audited. SHA-256 (.plugin/.zip): ef4ee25c9d458cb099a187b0c6f8803fe3c14e40807716a553026e23baf9862f. See CHANGELOG.md.

Campus AI OS v5.2.9

[5.2.9] - 2026-09-14

First release prepared for public GitHub distribution (trainingsites/campus-ai-os). Scope is the co-primary seat model only; SEC-04/05/06 ride a dedicated security train at 5.3.0 or later by owner decision (2026-09-13).

Fixed

• tests/test_phase0_coprimary.py doctor fixtures issued their host binding against the frozen fixture clock while the doctor reads wall-clock time, so the suite began failing on its own three days after 5.2.8. The two doctor fixtures now issue the binding relative to real time; resolver fixtures keep the frozen clock.

Changed

• Co-primary seats. A campus may now designate more than one client primary in seat.json, so an owner can work from any installed client and finish the job there — closing tasks, writing memory and wiki — instead of filing a proposal for another seat to merge. Single-primary campuses are unaffected: a seat.json with one primary and no clock_owner resolves exactly as before.
• clock_owner names the single scheduling seat. One campus, one clock is preserved by configuration rather than by role: clock_owner is the one client that runs recurring jobs, holds the host binding, and writes the shared ledger dean/.activity.jsonl. Every other primary appends to its own shard. The resolver returns owns_clock so a client can tell the difference. A co-primary seat.json without a valid clock_owner is refused and the caller stays satellite.
• Doctor is co-primary aware. Check 11a treats a stamp from any configured primary seat as expected instead of unresolved attribution, while an unrecognised seat is still reported. Check 11d validates the host binding against the clock owner; previously a co-primary config made it advise deleting a valid binding.

Security

• Unchanged boundary, re-proven by fixture: an unknown machine fingerprint, an unassigned client, a sandbox with no binding, an expired binding, and a binding issued for a client that is not the clock owner all still resolve satellite. Co-primary widens who may write on one recognised installation; it does not widen what counts as recognised.

Added

• tests/test_phase0_coprimary.py — 17 fixtures covering co-primary resolution, clock ownership, ledger routing, the unchanged satellite boundary, config integrity, legacy single-primary behaviour, and the two doctor checks. Suite is 226 tests.

Verify: the SHA-256 of both artifacts is in campus-ai-os-v5.2.9.PACKAGE.json (they are byte-identical).