[schickling-assistant]

Problem

Bounded test-client control needs one interoperable signing contract, without message-send authority or a second protocol.

Goal and ordered source plan

1. This PR Define canonical client command result contract #6274: D-1/D-2 wire vocabulary, D-4 grant record types, D-6 generated purpose-specific canonical form and language-neutral fixed-test-key signed golden vectors. A-1 byte-stable Rust/Swift/TypeScript generation; A-2 canonical signature/replay/cross-use tests.
2. Enroll fixture clients through local operator consent #6288: D-3 Unix-socket enrollment/revocation binding existing client-generated pairing/key and operator-attested native consent packet. A-2 enrollment/revocation, non-test-client, consent/key/scope/fixture refusals.
3. Bind client control grants to running mission ownership #6289: D-4 running mission and exact claimed-step-owner binding, durable bounded budgets and lifecycle records. A-2 every grant refusal, run/claim end and replacement, revoke/re-enroll, persisted budget/forgery tests.
4. Verify narrow-purpose client results and durable command receipts #6296: D-1/D-2 command admission for enrolled iOS/web/TUI, D-6 narrow-purpose result verification WITHOUT control.messages, D-7 durable terminal and bounded rejected-attempt receipts. A-2 wrong-key/window/replay/cross-kind/grant/run/command, real message.send cross-use refusal and existing command regressions. Uses existing commands subscription for lifecycle.
   A-3 belongs to each client implementation consuming THIS exact canonical source. A-4/A-5 journeys, A-6 live refusals and A-7 live store/signer/isolation evidence stay in separate consent-gated mission steps; no live fixture prerequisite is imposed on daemon source. Local-only fixture policy source feat(instance): enforce local-only fixture network boundary #6279 is an explicit prerequisite to enrollment. Stack #6290 carries the ordered daemon source layers.

Decisions

Existing device.command/device.result and phone.inspect/phone.navigate names remain. Purpose client.device-result.v1; purpose-first claim-fields-v1 lines bind RFC8785 JCS visible-state digest. All clients read one JSON vector file with canonical bytes/digest/fixed-key P256 signature and negative grant/run/command/purpose/message cross-use cases. Generated sources come only from cargo run -p fractal-client-codegen.

Verification

Current shared generated head 972b65b7c4cf8e3612ffdd4d756e11d0b7b011f2 comes from exact source 5613f10737357b245ee2fda7187ae90d346c7758. Authorized regeneration exited 0: elapsed 19.61 seconds, peak RSS 1,164,360 KiB, clean start, source HEAD fixed; only the expected generated TypeScript helper changed. Earlier strict-decoder regeneration also exited 0; no generated source was hand-edited.
The contract now strictly rejects lifecycle sequence zero and values above 2^53-1 in Rust, Swift and TypeScript; shared negative vectors are decoded before stale-event checks. TypeScript exports ClientResultCanonicalizationError with invalid-unicode code, supports injected Hermes hashing, and gives default WebCrypto an owned ArrayBuffer without narrowing injected hasher inputs. Scenario folding ignores lifecycle-only metadata, including its ordering, and skips it in mixed visible updates.
Six client-control release fragments pass the repository validator at integrated daemon head c1e61d6f700cdb9de1547ba6c1e2500ba4598316. Exact-head codegen --check, required client/scenario TypeScript typechecks, vectors and Rust/API/store suites remain pending sequential admitted execution. Queue-only withdrawn/expired tickets are NOT RUN, not passing checks. Swift native toolchain is unavailable on the proof host. No live setup/pairing/enrollment/grant/daemon action or CI dispatch/rerun.

Complexity

One generated contract shared by all clients, no new authority or transport.

Concerns

Generated output is now consumer-available; independent tests and byte-stability verification remain pending. Fixed scalar/nonce are public test material only.

Friction & bottlenecks

Shared build-lane admission delayed generation until the authorized short-slot declaration; no bypass or hand-generation is used. QR generated changes remain on their own branch; the second branch to land must regenerate after merging main.

Follow-ups

The ordered drafts complete daemon source scope; human setup/apply/enrollment/live acceptance stays pending.

References

#6288, #6289, #6296, #6279; client-control-v1 daemon contract.

Posted on behalf of @schickling

field	value
agent_identity	unknown
session	unknown
agent_persona	unknown
agent_supervisor	unavailable
agent_tool	unknown
agent_tool_version	unknown
agent_runtime	unknown
agent_model	unknown
worktree	unknown

[schickling-assistant]

Source-only draft head b6c0d55: NOT consumer-ready. Canonical implementation inputs and fixed-test-key signed vector template are published, but generated Rust/Swift/TypeScript outputs still await admitted cargo codegen. No generator, build or test completed yet. Existing live instances/pairings remain untouched.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-product-lead
session	01a1b525
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	openai-codex/gpt-6.1-sol
worktree	fractal/2026-11-10-client-control-daemon

[schickling-assistant]

Parked: generated contract is published at36592f7090; independent exact-head tests/byte-stability verification and review remain pending under the coordinated no-extra-queues hold. Reissue: verification admission is authorized. Generated API and golden JSON may be consumed now; no further canonical source work is active.

Posted on behalf of @schickling

field	value
agent_identity	unknown
session	unknown
agent_persona	unknown
agent_supervisor	unavailable
agent_tool	unknown
agent_tool_version	unknown
agent_runtime	unknown
agent_model	unknown
worktree	unknown

[schickling-assistant]

Corrected shared generated head: 7cafdf138efbea937cbefa83323d5d2fc8dda15c, generated from fixed source d8872e300e77e45987941b09325d037b3a672275 (HEAD unchanged before/after). One admitted regeneration: exit 0, payload elapsed 6.55 s, peak RSS 1,202,584 KiB. Includes typed lifecycle Resource arms/shared decoder vectors and injectable TypeScript SHA-256 defaults for non-WebCrypto runtimes. Six client-control release fragments pass the repository validator. Corrected-head codegen consistency, Rust, TypeScript and daemon proofs are queued sequentially; no passing test result is claimed yet. Swift native toolchain is unavailable on the proof host. Future typed canonical-error refinement is not part of this generated revision.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-product-lead
session	01a1b525
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	openai-codex/gpt-6.1-sol
worktree	fractal/2026-11-10-client-control-results

[schickling-assistant]

Owner-requested correction is published as signed source f92a26354aec5948899d482d06f6ea644e78a04f: the shared sequence-zero trace now expects refuse-invalid-frame (sequence-one stale trace retained); Rust and Swift decoder templates enforce 1 through 2^53-1; Rust, Swift and TypeScript tests assert strict resource/frame refusal. TypeScript canonicalization exports ClientResultCanonicalizationError with code invalid-unicode, tested by class/code rather than message text. Generated output for this correction is still pending the authorized single replacement generation; this source head is NOT consumer-ready. The earlier consistency-check ticket and initial correction-generation ticket ended queue-only with no payload and are NOT RUN. No test pass is claimed.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fractal-product-lead
session	01a1b525
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	openai-codex/gpt-6.1-sol
worktree	fractal/2026-11-10-client-control-results