feat(observation): add scoped metadata projection and bounded local waits

[abruption]

Current authorized sequential merge checkpoint — 2026-10-18 KST

Exact head 9e123cf9e3bfb07a0526215c9e797a0fb538be46 applies only #109's 18 own commits after actual #108 squash d645a692f8e402dd224691410fa89be502e45383. Tree 2b14c78b7e10d7312736444ae0c06cdf624da707 is byte-identical to locally validated projected d83635d.

Local macOS arm64 Node24.16.0: full387 total/382 pass/0 fail/5 Windows-only skips; build/types, reproducible package/install/uninstall, shorthand, repository/diff checks pass. New native hello fixtures report their actual configured build; they do not bypass #108's exact actual-process build gate.

Preserved #107 fixes: private prepared Claude/inactive Codex continuity, encrypted epoch/intent-bound journal plus fail-closed private key, exact operationId wait finalization and committed confirmation idempotency. Preserved #108 fixes: delayed-spawn cleanup, positive pre-probe deadlines, actual queue-process build and executable identity, final post-fence/post-owner SQLite FD device/inode checks.

Scoped observation extension: one observed instant resolves all same-clock pending delivery operations against each immutable cutoff; foreign-clock operations remain pending/unclassified for their independent observer, and terminal waits are immutable. Never invent foreign-clock deadlines, ACK, retry or new native submissions. Original-operation SIGINT remains stopped/exit130 even with concurrent waits.

Included native observation remains exact macOS arm64 Codex0.160.1/0.162.1 and warm original storage/generation. Linux/Windows observation, Windows private ledger and automatic receipt collection remain #130–#132. Plain queued/posted, turn completion and queue disappearance are not ACK. No new native/model/remote-host/live ACK tests were performed for this refresh; prior dated evidence below is historical. Companion Draft37 is review-only, not a published skill or adopted pin.

Ready now triggers current-head automatic Code/Security Review. Fresh CI/CodeQL/Windows22+24 and reviews must pass before normal exact-head squash. No manual mention, admin/protection bypass, release dispatch, tags or publication. Earlier source/checkpoint records below are history.

---

Current refresh checkpoint — 2026-10-14 KST

• Exact head: 55daf83bd8ebe1cd6e67bb98259130213d1cac71; latest published main base: a2057940ba19056fcaaa5551a7820f7414bd3bfa.

• Rebased sequentially in dependency order docs(handoff): record the jointly frozen v1 design #106 → feat(handoff): add private correlation ledger and evidence CLI #107 → feat(app-server): add bounded guarded queue-only client #108 → feat(observation): add scoped metadata projection and bounded local waits #109. Each PR keeps base main for current-head full CI and CodeQL; later branches contain preceding source dependencies and must be reviewed/merged in that order. This is branch preparation, not an integration merge into main.

• Local macOS arm64 full npm test: 352 total, 347 passed, zero failed, five Windows-only skips. Build/types, repository/diff checks, npm audit (zero vulnerabilities), reproducible package/isolated install/uninstall and bash/zsh shorthand checks passed.

• Conformance used the existing exact exported published Python 1.1.0 source 8ca77cf31254c8287a2593fe484bb30a7dba2727; hash-pinned oracle and cross-runtime pure-validator tests executed. Frozen contract bytes/hashes and historical evidence are retained.

• Existing literal message-file dash, close-before-delayed-spawn cleanup and operation-ID-bound concurrent SIGINT regressions passed. Main's published 0.3.5 version, finite skill matrix/pin, ordinary strict SSH/evidence preservation and Windows native exit propagation are retained.

• Existing qualified macOS/native/manual-receipt scope is retained. This refresh performed no new real native/user-session delivery, ACK, Linux/Windows automatic observation, model/provider or operational test. Current-head Actions completed successfully; automatic reviews remain a separate gate; earlier green checks below are historical, not this refreshed-head evidence.

• Draft remains, human review gate retained; no merge, tag, release, publication or protection changes.

• Final exact-head CI: 12/12 SUCCESS, CLI 38488829300 and CodeQL 38488826157, including both Windows-native Node 22/24. No rerun/bypass. Branch-scoped CodeQL open-alert API returned zero alerts. No new automatic Code/Security Review completion is claimed. GitHub reports MERGEABLE; the PR remains Draft.

---

Earlier PR history (superseded heads/checkpoints)

Current checkpoint — scoped 0.4.0 acceptance, 2026-10-11 KST

Exact head: d830ccaa1a459bfec0f3c67e2b0e682d99bc7734. Fast-forward test/docs follow-up; no runtime source, version, frozen design/fixture/pin or published main change. Draft, base main, Refs #72; #69/#70/#71/#72 stay together in 0.4.0. Main remains published 0.3.3 source c0ed30273b9e9c0049df86ae3c38486a94289527. No merge, tag, release/publication or operations change.

User-approved scope and remaining gates

On 2026-10-11 the user approved completing 0.4.0 with exact Codex 0.160.1/0.162.1 on macOS arm64 client-ID observation, bounded original-intent/SSH/wait handling and explicit operator-confirmed receipts on supported POSIX ledgers. The four issue checklists and milestone description now record this scope, retaining original plans as history. It does not imply all-platform observation, model-authenticated ACK or full Python runtime parity.

Deferred extensions: #130 Linux observation, #131 Windows observation/private storage, #132 voluntary receipt producer/authenticated collector bootstrap, all Future — Agent integrations. These are not mandatory gates of the accepted limited release. Unsupported required goals still refuse before effect, native retry remains false, and possible submission never triggers fallback/resend. Queue acceptance, injection, turn completion, arbitrary reply text and queue deletion never manufacture ACK.

Still pending: companion TS skill candidate guidance/profile rollout in session-peer-skill #31, exact-head review/current-main integration and human merge/release acceptance. The named skill session was inactive at dry-run: no message queued, wake/resume or inactive opt-in. No existing skill metadata/pin was changed and no successor runtime compatibility is advertised. All four issues and Drafts remain open; review/merge dependency order is #106 → #107 → #108 → #109 with checks after main changes.

Added evidence

• test/handoff-cross-runtime.test.ts + static Python adapter actually invoke pinned published Python 1.1.0 pure validators/projections and TS validators. 5 tests / 45 cases: 19 accepted examples spanning all seven states, 12 schema/privacy/forged-ACK/retry negatives, four unsupported-observation state projections, four Claude optional-absence/native-profile cases and six Codex native-profile cases. Standalone SHA-256 d36d83f3d6f59eb20c958aac530ca6d5d988a99f6ceabf2704c7c51db1fe524f, canonical handoff module 138115b9cc8ee73c77ad1099625f2b6cc2e0a6bd343e864a6b5219328735a808, exact release 8ca77cf31254c8287a2593fe484bb30a7dba2727. Input is bounded JSON data, no main/ledger/native CLI/collector/network. Distinct UUID reason names and native optional absence are preserved. Initial omitted-reference ENOENT and incorrect expected UUID reason were corrected; this is pure-function comparison, not live/native interoperability.
• Core/CLI 55/55: wrong correlation ID/epoch/generation, duplicate keys, malformed/extra/oversize private frames, byte-identical ledger preservation, no ACK promotion; matching/duplicate operator confirmation with no native queue or synthetic injection.
• SSH suite 14/14, with three new qualified-macOS fake-SSH destination/native fixtures: exact-ID injection, never-injected deadline and queue-response loss. Retain original preparation CID/epoch/home/thread/generation, exactly one queue RPC, no legacy fallback, status adds no submissions, duplicate intent refused. Static fixture source with JSON/argv inputs; real isolated lock holder, no real SSH/agent/model. Request budget15s; separate harness cleanup upper limit20s does not extend the production request deadline. First10s fixture budget exhausted setup before its positive goal; fixture-only budget adjustment is recorded, production bounds unchanged.
• Four README/guide locales, API/PARITY and VALIDATION distinguish public0.3.3 examples from unreleased candidate support. Correct stale preparation wording and distinguish SQL's internal body-bearing-cell evaluation from the narrower no-body/error-to-JavaScript/output guarantee. Runtime observer/privacy behavior is unchanged.

Current-head validation

macOS arm64 / Node24.16.0 / Python3.15.0, exact published Python1.1.0 reference via SESSION_PEER_PYTHON_ROOT, PYTHONDONTWRITEBYTECODE=1:

• npm test (build + test:types + integrated tests): 347 total / 342 pass / 0 fail / 5 Windows-only skips.
• npm run test:package: bash/zsh contract + lifecycle, reproducible pack and isolated install/uninstall pass. Repository structure/links/anchors, git diff --check, release helper pack/artifact pass; npm audit zero vulnerabilities.
• Exact committed development artifact SHA-256 4f8366409e3f2f8a064ab52d1150fa7da06f239808b96835afbba664c8746818, integrity sha512-o5U/P1ts5gUKgRcGFLO0cjhgT2Eovs+thEdOkzi+g7iVvo46LpSf2CPPkP8F4O4wY2WPpmd/0Gy2RPY+hJjzMQ==. All71 packaged files byte-match the committed workspace. A final PARITY wording correction changed only documentation after the package-smoke pass; repeat release pack/artifact and byte comparison passed. Earlier artifacts retained privately and superseded. This is an unpublished development package, not public npm0.3.3 bytes.
• Exact-head CLI run38125288290 and CodeQL run38125286322: 12/12 SUCCESS at this exact head, attempt1 (macOS/Ubuntu Node22/24, Windows native22/24, policy, release gate, CodeQL and GitGuardian). Zero open CodeQL branch alerts. Fixture/CI results do not extend native platform qualification. No manual Codex review mention or current-head independent review claim.

Actual-host evidence retained, not upgraded by these fixtures

Earlier macOS native observation/independent wait and explicit operator confirmation, KR/US ordinary Linux SSH queue/manual confirmation and physical quintet Windows process-harness results remain in VALIDATION and history below. They were run against their recorded component/checkpoint versions, not a new whole-head live test. Linux/Windows observer/authenticated automatic receipt qualification remains unsupported. Owned remote test prefixes/processes were cleaned and absence checked; native test history was retained. Prior failed macOS Node22 owner-probe and physical Windows runs remain disclosed rather than counted as pass.

Prior checkpoints and evidence (historical; current scope and head above)

Current checkpoint — 2026-10-11 KST

Exact head: e9e4936466bae1ff64557f9d98fed3e0c04db55f. This follow-up changes test fixtures and VALIDATION only; runtime checkpoint 2add20d52217e665058337c30a4f8ac592f7e0c8 remains unchanged. Draft, refs #72; #69/#70/#71/#72 remain together in 0.4.0. Published main remains c0ed30273b9e9c0049df86ae3c38486a94289527. No merge, version bump, tag or publication.

Additional verification requested by the user

• KR, Linux arm64 / Node 24.16.0 / Codex 0.162.1: discovery and dry-run selected the existing user-authorized live Codex session. Exactly one best-effort SSH send returned queued/submitted=true, queueId retained, consumptionConfirmed=false, retry=false. Required delivered wait refused before effect (evidence_unsupported); best-effort observation/automatic ACK remained unsupported. A voluntary reply was requested but has not been received; no transcript polling or resend.
• US, Linux arm64 / Node 24.18.0 / Codex 0.159.2: the existing saved inactive session refused; no inactive opt-in, queue, resume or wake was used on it. A fresh separately owned read-only Codex TUI was created in an already trusted working directory. Exactly one SSH test send returned queued/submitted=true. Its original TUI displayed the requested response marker; a separate explicit operator confirmation bound to the original correlation/epoch/generation then recorded acknowledged / operator_confirmed. Status and acknowledged wait passed without new submissions. Visible response alone was not treated as automatic receipt ACK or native client-ID injection evidence.
• KR/US exercised runtime files from exact checkpoint e83fcffa2dbee33de0694e30b6420d83a128fc5e, not the subsequent test/docs-only commit. Both explicitly uploaded private development copies had verified archive bytes; they were not installations of a newly published npm package. Required evidence channels remained unsupported. Owned remote prefixes were removed and absence verified. US test TUI closed; inspectWriter reported inactive / writerLock absent. Existing native records and test history were retained.

Physical Windows alternative

• On quintet Windows 10 x64 / Node 24.16.0, C# directly launching the existing PowerShell 5 encoded-command path reproduced AccessDenied. Node launching the same PowerShell command succeeded. The underlying cause remains unverified.
• Replace only the fake SSH child-launch harness with C# → static Node helper → the same PowerShell 5 command. Require the exact production command prefix and a base64 token; do not relax production parsing, policies, ACLs or platform guards. The helper's 55s child timeout sits inside the harness's 60s parent timeout; status254 is a harness failure, not submission evidence.
• Build/types pass. Full npm run test:windows: 295 total / 165 pass / 0 fail / 130 skip. After applying the final exact-prefix guard, the related contract rerun passed 9/9; exact-prefix / changed-flag / trailing-space controls passed 3/3. Unsupported-platform guards passed 3/3. Guarded fixture files were hash-identical to this repository's files. Full-suite result precedes the final guard and is distinguished from its focused rerun.
• All owned remote diagnostic processes and the marked prefix were removed; absence verified. No actual Windows native agent queue/observer/ACK qualification is claimed. The original 266/155/2/109 failing run remains historical evidence below and in VALIDATION.

Current-head local and package checks

• macOS arm64 / Node 24.16.0, exact published Python 1.1.0 reference 8ca77cf31254c8287a2593fe484bb30a7dba2727 through SESSION_PEER_PYTHON_ROOT: npm test including build/types 337 total / 332 pass / 0 fail / 5 Windows-only skips. This ordinary reference is not full cross-runtime handoff qualification.
• Repository/link/anchor/diff checks, npm run test:package (bash/zsh contracts, lifecycle, reproducible pack, isolated install/uninstall), release helper pack/artifact all pass. npm audit: zero vulnerabilities. All 71 package files match the final workspace bytes.
• Current-head pack/artifact and package tests pass, reproducible SHA-256: 147791832dedc166f78fcf1f8f5a2d4d78eb181b9c85782ef0511f6321062201. All 71 package files match the workspace bytes. Previous artifacts are superseded and retained privately; this is an unpublished development package, not public npm 0.3.3 bytes.
• Previous CLI run38110140277 failed the macOS Node22 persistence regression; its release gate failed. Other platform jobs and CodeQL38110137845 passed. The real lock holder had no expiry, but fake owner tools added four Node startups to a bounded probe. Static shell/native-tool fixtures now preserve the exact owner data without that startup burden; production 800ms/250ms guards and assertions stay unchanged. Timing cause is not conclusively proven. Focused delivery suite 16/16 and full macOS 337/332/0/5 pass after this correction.
• Exact current-head CI 12/12 SUCCESS, attempt1: CLI run38110540450, CodeQL run38110538942. macOS/Ubuntu Node22/24, Windows native22/24, repository policy, release gate, CodeQL and GitGuardian all passed; zero open CodeQL branch alerts. Prior failure remains recorded and was not bypassed. No manual Codex review mention was posted and no current-head review is claimed.

Remaining gates

Linux and Windows native metadata observation, automated receipt producer/collector bootstrap and original-sender SSH collector remain unsupported/unqualified. Ordinary queue acceptance and manual operator confirmation do not close those gates. Required unsupported goals refuse before effect; native retry remains false. No deduplication or exactly-once claim. Four issues/milestone remain open for remaining scope and human review. Review/merge dependency order remains #106 → #107 → #108 → #109, with exact-head integration checks after changes to main.

Prior checkpoints and original physical-host failure (historical)

Current checkpoint — 2026-10-11 KST

Exact head: e83fcffa2dbee33de0694e30b6420d83a128fc5e. The final commit is a test-only follow-up to integrated runtime checkpoint 2add20d52217e665058337c30a4f8ac592f7e0c8. Normal fast-forward update of this existing Draft, base main. Refs #72; all #69/#70/#71/#72 stay together in 0.4.0. Published main remains c0ed30273b9e9c0049df86ae3c38486a94289527; no release/version bump, merge, tag or publication.

Integrated changes

• Qualify exact Codex 0.162.1 / Darwin arm64 metadata mapping against upstream 092d3acd6bec3e3a14bdc7e7a2810ab628ab759d, beside existing 0.160.1. Persist private original version/source/platform provenance. Never infer a missing historical qualification from the current executable.
• Standalone delivery wait resumes the original submitted home/thread/generation/client ID using read-only bounded workers. Zero native queue calls; independent operation IDs/cutoffs and immutable terminal waits. Ledger contention retries remain inside the existing budget; failed writes preserve last verified pending evidence.
• POSIX destination-owned SSH preparation/final-send handler, explicit destination ledger initialization, per-destination total budget, strict request/native/handoff binding, distinct fanout IDs. Partial/no-EOF input is bounded before frame parsing; normal Node bootstrap consumes the same budget. Static import that never reaches the handler is outside the in-process watchdog; origin retains its hard transport deadline.
• A successful preparation followed by SSH255/timeout refuses the actual send. Complete native evidence survives failed wait/persistence/transport; malformed handoff or failed-wait envelope cannot invent ACK or discard native submission facts. Wrong stopped exit drops handoff evidence and preserves independently valid submitted/queueId facts.
• A sub-millisecond probe cutoff is settled against the exact monotonic deadline before timeout is committed. No deadline extension, synthetic terminal record or resubmission.
• Four-language source-only guidance, API/PARITY, sanitized native-evidence fixture and detailed VALIDATION record. Frozen contract document/fixture bytes are unchanged.

Actual isolated native verification

User explicitly authorized dedicated test sessions and identification messages. No existing working session received a test message.

• macOS arm64 / Node 24.16.0 / Codex 0.162.1: one queue attempt per fresh test thread; production reader matched exact client ID/original thread/generation and linked turn. Actual observe-send and independent delivered wait passed. On a second fresh thread, an explicitly verified voluntary reply was manually confirmed before any new wait: acknowledged with operator_confirmed, then status/acknowledged wait passed. This is not an automated receipt collector or model-authenticated ACK. The first manual-confirm harness order instead correctly refused receipt_order_unprovable; no intent replay. Tested component hashes, not final whole-commit live tests, are recorded in the fixture.
• Separate Claude Code 2.1.296 / Opus 5.5 session: prepared correlated send and best-effort request-ack each posted once; required acknowledged wait refused before effect. Plain responses did not establish machine ACK. Native assigned a non-null name; null-name coverage remains synthetic.
• All owned test terminals closed and project/ledger temporaries cleaned. Native Codex test records retained; no pre-existing native record deleted. Authentication used normally without reading/copying credentials.

Local integrated validation

• Exact published Python 1.1.0 8ca77cf31254c8287a2593fe484bb30a7dba2727 archive through SESSION_PEER_PYTHON_ROOT, PYTHONDONTWRITEBYTECODE=1. Ordinary list/discovery oracle repin is separate from the unchanged frozen design identity; not complete cross-runtime handoff qualification.
• At integrated checkpoint 2add20d, npm test includes build/types: 337 total / 332 pass / 0 fail / 5 Windows-only skips. Focused SSH/delivery predecessor 27/27 pass.
• First integrated full run: 337/331/1/5, exposed the fractional cutoff bug and was corrected; it is not counted as a pass.
• npm run test:package: bash/zsh contracts and fixture-version update/uninstall, identical tarballs, isolated clean install/uninstall PASS. First packaging check failed because VALIDATION was edited between two packs; source edits then stopped and the frozen repeat passed.
• Repository structure/links/anchors and diff checks PASS; npm audit zero vulnerabilities. Fresh exact-head release helper pack and artifact PASS. This is an unpublished development package, not public npm 0.3.3 bytes.
• Follow-up CodeQL alert feat: support native Windows discovery and delivery #10 (js/bad-code-sanitization) identified dynamic code construction in the watchdog test. Fixed by static fixture modules/worker with structured loader data and process arguments; runtime/package bytes unchanged. Follow-up SSH tests 11/11, test:types/repository/diff checks PASS; fresh exact-head pack/artifact PASS with the same package SHA-256. The original alert is not dismissed or bypassed.
• Exact final head CI: 12/12 SUCCESS, CLI run 38108723971 and CodeQL run 38108722661, attempt 1. CodeQL reports no new alerts, zero open branch alerts; alert feat: support native Windows discovery and delivery #10 was corrected in code, not dismissed. The preceding 2add20d CLI run was superseded/cancelled by the test-only push, not counted as an all-green run. No current-head Codex review is claimed and no manual review mention was posted.

Independent review

Claude Code 2.1.296, tools disabled/no session persistence: first 240s call timed out (exit143/no output), one narrower 104,671-byte retry succeeded (268.508s, actual first-party claude-opus-5-5, exit0/is_error=false). Input SHA-256 69169aacf2c7f02d6606aebbdb23961e2694a0845e86875f2848469ea97a1718 unchanged before/after. Read-only source review only, no tests. Its findings were corrected afterwards with regressions; it is not a review of the entire final commit. Subsequent internal source audit caught and fixed the malformed failed-wait error normalization. Details and limits are in VALIDATION.

Windows gate and remaining scope

Actual quintet Windows 10 x64 / Node24.16 test run: 266 total / 155 pass / 2 fail / 109 skip. One underlying C# fake-SSH .cmd child-launch AccessDenied plus its enclosing failure. Twelve minimal process controls passed and the same executable reproduced failing .cmd --version between successful encoded PowerShell exit0 controls. Cause remains unverified; this physical-host gate is not passed, regardless of CI. No policies/permissions/services/guards were changed, no actual agent/native queue invoked. Owned remote diagnostic directory removed and absence verified.

Automated receipt producer/collector bootstrap, original-sender SSH collector, Windows private ledger/native observation, Linux native observation and broader version/platform qualification remain unsupported/unverified. Required unsupported goals refuse before submission. Destination SSH fixtures are not actual remote native-agent qualification. Queue acceptance, injection, turn completion and visible response do not independently prove receipt ACK; native retry remains false. The milestone and its issues stay OPEN for remaining gates/human review. Suggested merge review sequence remains #106 → #107 → #108 → #109, with exact-head integration checks after any main changes.

Development artifact SHA-256: 894c9eddce56e0478f8501481c85d5da781a57965bc317b58e40d6612f679b35.

Superseded historical checkpoint (not current qualification)

Current checkpoint — 2026-10-11 KST

Exact head: 485c6e1bfe41f0c5f5e2e775e6976d295ce69da7. Refreshed against published 0.3.3 main c0ed30273b9e9c0049df86ae3c38486a94289527 using fast-forward branch updates and integration merges; the earlier Cloud CodeQL fixes are retained. This stays Draft, refs #72, within the unchanged four-issue 0.4.0 milestone.

Changes in this checkpoint

Add regressions for positive native acceptance followed by ledger failure: preserve queued/submitted/queueId, reconcile unknown without resubmission, and keep total queue calls at one. Explicitly test synthetic 0.162.1 rejection for required observation (zero queues), versus exactly one legacy queue in best-effort mode before any app-server effect. Includes the revised ledger and app-server guards from the preceding PRs.

Validation actually performed

• macOS arm64, Node 24.16.0; existing exact Python 1.0.2 conformance source 47c23713d0a2a3c11ebde6186afd8c43489b8b65, extracted from the local reference repository. No runtime/reference repin.
• npm test (including build and test:types): 308 tests, 303 pass, 0 fail, 5 Windows-only skips.
• npm run test:package: bash/zsh contract + in-place fixture-version lifecycle, reproducible package, isolated install/uninstall pass. Repository checker, release helper pack/artifact, npm audit (0 vulnerabilities) and diff check pass. These are unpublished validation tarballs, not the public 0.3.3 bytes.
• Synthetic private homes, DBs, writer/SSH/native tools only for the new regressions. No user session delivery, transcript read, live injection/ACK, installed Codex 0.162.1 queue call, or Windows/Linux native qualification was performed.
• The final integrated full run passed on its first invocation with the explicit pinned oracle; it includes the corrected SSH banner and stdin fixtures from feat(handoff): add private correlation ledger and evidence CLI #107.
• Exact-head CI: 12/12 SUCCESS, including macOS/Ubuntu Node 22/24, Windows native 22/24, repository policy, release gate, CodeQL and GitGuardian. CLI run, CodeQL run; no reruns. These are fixture/CI results, not broader native integration qualification. No new current-head Codex review is posted as of this check; historical reviews are not counted, and no manual review mention was posted.

Physical Windows follow-up — 2026-10-11 KST

Actual Windows 10 x64 / Node 24.16 SSH fixture run: build/types passed; test:windows 266 total / 155 pass / 2 fail / 109 skip. One underlying C# fake-SSH PowerShell-child spawn failure plus its parent is counted as two failures; this run is not all green. Additional disposable unsupported-path guards passed 3/3 after a helper expectation correction. Real native agent submission/ACK was not exercised; Windows support gates remain. Details are recorded in the follow-up comment. The owned remote test directory was deleted and absence verified.

Remaining gates

Standalone restart-resumed observation, receipt/bootstrap, original-sender SSH ledger coordination, Windows private ACL storage, real live injection/ACK and new native/platform qualification remain open.

Required unsupported goals refuse before native effect. No fallback/retry after a possible native submission; queued/posted is not receipt ACK or completion. The milestone remains incomplete. No merge, release/version bump, npm publication, tag, protection change, operations change or issue closure is requested by this checkpoint.

Earlier implementation/validation record (historical checkpoint)

Scope

Refs #72 and #69. Draft local observation integration, part of the unchanged 0.4.0 milestone. Stacked on #108, which is stacked on #107 and #106. No issue is closed; no release/publication/live TUI experiment is claimed.

• Add read-only warm SQLite metadata projection for exact native client ID/thread/home/original writer fingerprint. No rollout/history API, queue/list, full item/turn notification, resume/start, warm-up/backfill or native model turn is used to observe.
• SQL materializes recent row keys and bounded scalar IDs/status only, verifies memory-only temporary storage, excludes cells over 256 KiB before JSON parsing and limits the recent-user window to 256. Raw body/error columns never cross into JS/IPC. Queue disappearance, unmatched completion and arbitrary body text cannot establish injection/ACK.
• Move all observer filesystem/schema/inode checks to deadline-bounded owned workers. Use a separate inherited-group owner probe matching the original writer fingerprint; kill only owned groups/descendants. Native direct queue client separately proves actual selected state/queue DB storage before effect (feat(app-server): add bounded guarded queue-only client #108).
• Connect opt-in send/wait to one native queue RPC using correlation ID as native client ID when qualified. Unsupported best-effort selects legacy queue before any app-server attempt. After a possible native write, no fallback/retry occurs.
• Preserve native queued/submitted/consumption facts independently from observation and wait. Deadline failure keeps submitted:true; SIGINT uses matching stopped status/reason for exit130, never rewrites an existing terminal wait or retracts a queue item.
• Track each wait by operation ID/original cutoff. A later concurrently started wait cannot replace the originating send's outcome; status still returns the latest-started operation. Unknown clocks never invent timing/late/ACK facts.
• Explicit runtime file allowlist, four-language source-only guidance, portable schema fixtures in Windows CI, platform-scoped integration tests. Published version/parity pins and exact frozen design(handoff): adopt the Python #181 delivery state model and JSON contract #69 mirror bytes are unchanged.

Validation boundaries

• Local macOS arm64 / Node 24.16.0 with the existing pinned Python 47c2371 reference.
• Focused integration 5/5: exact-ID injection+linked completed turn without ACK; post-attempt response loss/no fallback; unsupported version/missing warm store with zero queue; timeout retaining queued facts; SIGINT130 retaining possible/known effect.
• Core 39/39: durable crash/fence/private storage/receipt/retention/quota plus per-operation concurrent wait cutoffs and terminal preservation.
• Metadata 15/15: no body/error IPC, DB/WAL bytes and sidecar creation unchanged, exact native clientId separate from item_id, wrong/unmatched IDs, bounded window/cells, schema/views/permissions/inode/owner races, unknown status, actual memory-only temp policy, blocking filesystem stall confined to a killable child.
• Owner probe 4/4: exact original fingerprint parity, sanitized failures, bounded inherited lsof/ps descendants and unrelated writer survival.
• Native app-server 31/31 includes actual storage-binding checks with scripted descriptors. Actual native evidence is queue mechanics in an isolated home plus a separate zero-queue initialization-only storage-pin check; synthetic integration is not live injection/ACK proof.
• Full build/types/tests, package smoke/isolated install-uninstall, repository checker, release pack/artifact and audit results are recorded in follow-up validation comments. No Windows/local Linux success is inferred from this Mac.

Remaining 0.4.0 release gates

Combined CLI route is narrowly qualified for direct native Codex0.160.1/macOS arm64 with a warm supported store. Linux/Windows native integration, original-sender SSH ledger coordination, Windows private ACL storage, automated receipt producer/collector bootstrap, restart-resumed observation, full initial setup/filesystem cancellation and real live/platform qualification remain open. Required ACK remains unsupported. Bootstrap may initialize policy-selected native state/cache files before a storage-binding refusal; only zero QUEUE is promised on that refusal, not zero bootstrap filesystem activity. No managed requirement is bypassed.

Review/merge order after remaining work: #106 -> #107 -> #108 -> this PR, with main retarget/rebase and exact-head CI/CodeQL verification. No merge, staging, npm/tag/fleet or protection changes performed.

[abruption]

0.4.0 source work is available as a Draft stack:

• docs(handoff): record the jointly frozen v1 design #106: exact jointly frozen design mirror (existing; normative bytes unchanged).
• feat(handoff): add private correlation ledger and evidence CLI #107: private POSIX correlation ledger, durable sender fence and opt-in evidence CLI.
• feat(app-server): add bounded guarded queue-only client #108: bounded guarded native app-server queue-only client.
• feat(observation): add scoped metadata projection and bounded local waits #109: warm metadata projection, exact-ID local observation and per-operation bounded waits.

All four issues #69/#70/#71/#72 remain in the single 0.4.0 milestone and OPEN. These PRs are partial source implementations, not publication/product acceptance. Automated receipt bootstrap, Windows private storage, original-sender SSH coordination, restart observation, full setup cancellation and real live/platform qualification remain release gates. Native local/SSH retry permission remains false.

Latest local integrated check at ce4741f: build/types; npm test 259 total / 254 pass / 0 fail / 5 Windows-only skips; package smoke/install-uninstall/reproducible pack; repository checker; release pack/artifact; npm audit 0; diff checks pass. Local package SHA-256 a06956e07b7c7723a51fe59160450cbcec5b7819f3afe671d34451596d7a6f10 is validation only, not a published or exact future main artifact. Independent findings on URI routing, generation/storage binding, filesystem bounds and wait concurrency were corrected with regressions.

Review order is #106 -> #107 -> #108 -> #109. Main retarget/rebase and exact-head CodeQL/CI are required before a future merge; stacked PR checks are not CodeQL completion. No merge, npm/stage/tag/fleet/protection changes performed.

[abruption]

Latest exact-head validation:

• feat(handoff): add private correlation ledger and evidence CLI #107: 9ae30eb, base docs(handoff): record the jointly frozen v1 design #106 branch; all eight CLI jobs and GitGuardian success.
• feat(app-server): add bounded guarded queue-only client #108: c228c7f, base feat(handoff): add private correlation ledger and evidence CLI #107 branch; all eight CLI jobs and GitGuardian success.
• feat(observation): add scoped metadata projection and bounded local waits #109: 3579e85, base feat(app-server): add bounded guarded queue-only client #108 branch; all eight CLI jobs and GitGuardian success.

#109 initial CI37559247540 failed only the owner-abort test: its 35ms total budget could correctly expire during the newly added snapshot child startup before the owner callback began. The test now separates snapshot startup from the verifier-cancellation phase. Runtime 1s child/owner bounds were not changed. Focused metadata15/15 passed, and new exact-head CI37559641813 passed on macOS/Linux Node22/24 and Windows Node22/24 with release gate. The update is test-only; runtime/package bytes match the already verified ce4741f local artifact a06956e07b7c7723a51fe59160450cbcec5b7819f3afe671d34451596d7a6f10.

Local integrated checkpoint: full259/254pass/0fail/5Windows-only skip; build/types/package/install-uninstall/repository/release artifact/audit0 passed. Exact frozen document/fixture SHA-256 remain 46a953010c49214bd8f969412f26713384fbe09a0ba78ebf0fef75da40d0d889 / 963b94e78f510c2535e405813558275d512a5bfe6bbd99ffdf0994b4d2e6e441.

All PRs remain Draft and #69/#70/#71/#72 stay OPEN in the single 0.4.0 milestone. This is partial source implementation with the release gates stated in the PRs, not completion/shipping. Stacked CI does not replace main-retarget CodeQL/CI; no merge/npm/stage/tag/fleet/protection changes.

[abruption]

Review findings corrected and propagated through the implementation candidates. All three Draft PRs now target main; each exact current head has successful macOS/Linux Node22/24, Windows Node22/24, release gate, CodeQL (Actions and JavaScript/TypeScript) and GitGuardian checks.

• feat(handoff): add private correlation ledger and evidence CLI #107 / 52f233d: message-file contents are literal. Open stdin with different data cannot replace file '-' or block submission. --message - still reads stdin; framed SSH body '-' is literal. Old code reproduced a wait; new CLI fixtures7/7 pass.
• feat(app-server): add bounded guarded queue-only client #108 / 53a656b: close/timeout/error/exit stop the registration lifecycle, detach spawn callback and prevent late re-registration/reaping. Immediate-close test delivers a delayed spawn event plus captured queued callback, verifies listener baseline and no second fake-PID reap. Old-code negative control failed; current app-server32/32 pass. No foreign process is signalled by the test.
• feat(observation): add scoped metadata projection and bounded local waits #109 / f6c283c: SIGINT first retrieves the originating operation, and fence/submission/catch keep that projection. Regression adds another wait before effect, withholds queue response and interrupts: original stopped/exit130, submitted:null, newer terminal unchanged, exactly one queue attempt/no resubmit. Old-code negative control failed; delivery6/6 pass.

Combined focused build/types and45/45 fixtures pass locally. main-target exact-head CI/CodeQL success supersedes the earlier stacked-base gate note. Implementation release gates and Draft status remain; no merge/publication performed. Dependency review order stays #106 -> #107 -> #108 -> #109 despite their main comparison targets.

[abruption]

Physical Windows SSH test — 2026-10-11 KST

Tested the exact unpublished #109 snapshot 485c6e1bfe41f0c5f5e2e775e6976d295ce69da7 on a user-authorized Windows 10 Pro x64 host (build 19045), PowerShell 5.1.19041.6456, Node 24.16.0. Existing dedicated-key SSH with BatchMode/StrictHostKeyChecking succeeded; no authentication, host-key, privilege, execution-policy or service changes. Only a new marked temporary test directory was used. Source archive SHA-256 28fd777ae561b3619fce7ad170875855728ab13203715973b00faf20dbcb9e27 matched after upload.

Actual commands/results

• Isolated npm ci --ignore-scripts --no-audit --no-fund: pass. Empty npm configs/cache and private synthetic HOME/profile/native homes; no global install.
• npm run test:windows: build and test:types passed; tests 266 total / 155 pass / 2 fail / 109 skip. This real-host run is not all green and was not rerun to replace the failure.
• The two failures are one failing SSH child subtest plus its parent: Windows SSH executes encoded PowerShell/.cmd with stdin JSON and preserves refused/unknown. Its first result was ssh_preflight_failed / refused / submitted:false, rather than the expected synthetic queued result. A version-only diagnostic reproduced the C# fake-SSH executable failing at .NET Process.StartWithCreateProcess when starting its PowerShell child (Win32Exception: access denied). Direct Node version and Node-launched encoded PowerShell/.cmd version probes succeeded. An absolute PowerShell path in the disposable diagnostic also failed. The Windows restriction/root cause is not established; no security-policy workaround or production fix is claimed.
• Additional disposable Windows guard helper: 3/3 pass after correcting the helper's expected capability shape (initial 2/3 failure was a helper assertion error, not a runtime fix). Ledger init refuses before storage creation, CLI init reports handoff_platform_unsupported, and observation/native queue guards reject before mock owner/spawn/effect calls, all counters zero.

Scope and remaining work

These are fixture tests on actual Windows, not real Codex/Claude submission, delivery, receipt ACK, or native-platform qualification. The installed Codex was not invoked or version-qualified. POSIX-scoped ledger/owner/observer integration tests remain skipped on Windows; a successful SSH login does not implement Windows ACL/durability/locking or qualify app-server cleanup. Windows handoff/metadata guards remain unsupported, and the native queue allowlist remains narrowly macOS-arm64/Codex 0.160.1. Original-sender SSH handoff/bootstrap also remains unsupported.

Private evidence was downloaded, source hash verified, and the marked remote directory was removed with an independent absence check. Existing user files, native sessions, profiles, keys, SSH settings and global installations were unchanged. No merge/release/publication performed; all four issues remain in 0.4.0.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T15:36:52.020154Z	9e123cf	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-17T15:38:54.414231Z	9e123cf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.