[kitamura-tetsuo]

Why

The A-only acceptance for #24 needs observations from the real ChatGPT connection and its native Events subscription. The current private activation requires a reviewed callback target before the host has supplied that target, and ordinary telemetry cannot establish a complete dispatch history. This change supplies the bounded preparation and observation paths needed to run that trial.

Changes

• Add read-only get_connection, returning only the authenticated caller's own IDs, the intersection of token/grant scopes, and explicit effective/token/grant deadlines. Every observation rechecks GuestDO authority.
• Add a-only-discovery under the existing staging-only private profile. Exact A identity, table scope, build, finite window and the observation opt-in are required. Outbound must remain disabled and callback targets empty. A genuine subscribe request records only its sanitized origin after fresh authority/membership checks, then returns callback_operator_review_required. It creates no subscription or candidate and sends no challenge. A dedicated durable quota allows one observation per minute across policy tables.
• Add separately reviewed private observations for final authorization, native fetch invocation, response headers and completion, including late results rejected by SQL settlement. Keep routine telemetry and default behavior unchanged.
• Add an explicit policy-scoped view to the existing secret-protected staging evidence endpoint. It projects retained subscription, message identity, closure and outbox retry state without transcript text, credentials, destinations or lease tokens.
• Add a bounded staging-only collector and conservative verifier. Raw Wrangler frames/stderr are never retained; reconnects, gaps, invalid frames, missing attempts or mismatched recipient/state produce incomplete evidence. Bind discovery/observation decisions through protected release authorization, immediate prewrite checks and postverification.

Validation

• TypeScript typecheck and repository/script lint passed.
• Focused real-GuestDO/TableDO and MCP tests cover own identity, no-egress discovery, revoked/foreign/expired authority, durable quota, retained retry state, cancellation during native fetch and 2xx headers followed by body failure.
• 73 focused release-script tests and 27 collector/verifier tests passed. Independent review findings about recipient binding, accepted-state consistency and final-snapshot coverage were fixed with regressions.
• Final-head GitHub Validation #43327135201 passed all 28 steps on 6e33201e3ca433a761606fba0e953dfbd52d585f; the native review reported no actionable issue and there were no unresolved threads at merge.
• The later exact-main Validation exposed a timing-dependent expired-connection test fixture. Follow-up PR #66 corrects that fixture; it does not change the runtime code.

Scope and operational limits

Application schema remains 11; no namespace, schema or credential migration is introduced. Existing stopped delivery policies remain compatible. Discovery and private observation each need their own actual operator review and protected staging deployment. This PR does not activate them.

A conditionally-complete sender report is not proof of host execution. PR #63 remains draft with its real-host acceptance thread unresolved until the actual B post → idle A event → new A run → authenticated read → reply and the remaining bounded scenarios are observed. Issue #24 remains an open actual-host acceptance gate.

[kitamura-tetsuo]

The first full CI run passed the application, integration, restore, SDK/Workerd probes and dry-runs, then found one browser assertion still expecting the previous exact tool catalog. The new get_connection tool was correctly advertised. Added that entry to the strict browser expectation (retaining exact equality); the other 9 browser cases had passed. Full CI is running again on the corrected head. No deployment or private activation has been performed.

[kitamura-tetsuo]

dot adversarial review

Target head: 6e33201e3ca433a761606fba0e953dfbd52d585f.
Contract: Issue #24, current Requirements version updated_at=2026-11-12T14:41:16Z; owning IDs #24/REQ-001 through #24/REQ-007. Reviewed at 2026-11-12 23:20 UTC.

No demonstrated actionable implementation violation or qualifying material test-oracle gap was identified in the supporting changes of this head. This is a COMMENT, not merge approval or acceptance of the real-host pilot.

Scope: inspected the complete 31-file changed-file/test manifest, implementation patches, regression assertions, collector/verifier, release gates and operational documentation against every current Requirement. Root AGENTS.md was unavailable at this head (404); no repository-specific rule was invented.

Production-boundary checks:

• #24/REQ-001, #24/REQ-005: own-connection discovery rechecks GuestDO grant authority and intersects token delegation without accepting foreign identity selectors. Private callback discovery remains scoped to the configured A connection, table membership, staging build and active finite window; durable admission is followed by a fresh authority check. The actual MCP subscription route returns operator-review-required, with no committed subscription, callback challenge or outbound request.
• #24/REQ-003, #24/REQ-004: inspected the TableDO authorization/dispatch/settlement path and its separate native transport invocation, response headers and completion observations. A late 2xx after closure is not represented as a successful SQL settlement. Retry identity and charged counts remain retained state, not reconstructed successes. The snapshot and verifier join actual retained message/event/subscription identities and require the final SQL snapshot after the capture interval; missing stages, recipient mismatch, inconsistent accepted state and additional unobserved attempts cannot pass their conditional check.
• #24/REQ-005–#24/REQ-007: inspected explicit field projection, operator-secret/scoped evidence access, bounded collector parsing/output, opt-in observation policy and protected release binding. Raw callback paths, credentials, transcript text, request metadata and stderr are not accepted as retained observation fields. Discovery cannot silently become delivery, and its active-window checks still apply with outbound disabled.

Evidence limits: the new observation tests seed retained SQLite state and mock HTTP; they are deterministic regressions, not proof that a supported real host creates every precondition or starts a new run. No live pilot, deployment or local test execution was performed by this reviewer. The collector's conditionally-complete result explicitly leaves hostExecution: "not-established"; it cannot satisfy #24/REQ-002 or complete #24/REQ-001–#24/REQ-007. Actual independent-owner authorization, verified A subscription, B → idle A → new A run → authenticated read/reply, and live cancellation/restart/isolation evidence remain UNVERIFIED under the existing #63 acceptance work. This supporting PR explicitly does not close #24, so that already-tracked absence is not duplicated as a new inline finding here.

Fresh pre-publication reads found this PR open at the stated head, the same Issue contract, and no existing native reviews or inline threads requiring deduplication, guidance or resolution.