[kitamura-tetsuo]

Refs #2608 (child of #2592). DRAFT — live acceptance is still incomplete. Do not mark ready or merge solely because deterministic tests or CI pass.

Problem and changes

The previous disposable client stopped after reevaluation and beta source deployment. It could not execute and independently verify beta acceptance, source promotion, and a separate release-worker installation. The previous live v6 attempt also exposed an invalid idle worker configuration: all ordinary backends were disabled, so the installed child exited before producing an advancing heartbeat.

Current head: f535897. This update adds:

• Worker code mounts are limited to src, and a test-source checkout containing the fixture state is rejected before any fixture write. The previous whole-checkout mount accidentally exposed management-only write PAT files through .agent-tmp to the same worker UID, even read-only. Actual container stat/access reproduced that path without reading credential contents; the narrowed configuration now keeps those files outside both workers' mounts.

• A source-storage preflight before fixture creation. Linked worktrees, Gitfile/symlink metadata, and borrowed object stores are rejected because the worker receives only one read-only /source mount. Real Git regressions cover the previously accepted broken cases and a repaired independent checkout.

• The explicitly selected positive sequence: reevaluate, beta-source, beta-acceptance, promote-source, and release-source. Each step consumes actual producer receipts; published acceptance and promotion are independently checked against Git objects, exact Actions attempts, and current selection. Promotion success never claims release deployment.

• Durable --resume-original using the saved original operation and arguments without repeating admission. Original journal inspection precedes worker diagnostics. BUSY/CONFLICT responses cannot rebind a send to another occupying operation.

• Cross-action original-send reservations now share a stable private Linux file lock. Concurrent clients cannot both pass the prior-ticket scan for the same target; distinct targets remain independently admissible.

• Readiness checks requiring a running/serving child, an open invocation gate, and advancing producer heartbeats within the same installed source/runtime/process/Supervisor lifetime. Worker lifecycle projections now expose their durable effect_state, and deployment success requires confirmed.

• The negative companion for observe refusal, beta-only release refusal, policy downgrade, genuine held drain, unresolved original effects, consumed recovery budget, and unsupported data rollback. Refusal success additionally requires independent read-only journal absence; unknown/held/exhausted outcomes remain operationally BLOCKED.

• A durable recovery-budget admission gate. A real failed deployment can release the producer's target lane after one confirmed prior-runtime recovery; a fresh checkpoint, stage revision, or idempotency key cannot bypass the retained exhausted action/target/source/failure signature.

• A viable idle task-only backend with empty Issue/PR author allowlists, disabled automatic merges and labels, and no LLM credentials. This allows genuine startup and heartbeat production without ordinary repository work.

The existing global repository-ownership rule remains intact:

Role	Workload repository	Installed source
Beta	kitamura-tetsuo/auto-coder-test-beta	kitamura-tetsuo/auto-coder-test
Release	kitamura-tetsuo/auto-coder-test	kitamura-tetsuo/auto-coder-test

The generator creates separate ownership records, private worker readers, and manager publication/dispatch credential placeholders. Default policy remains observe, UID allowlists remain empty, and bootstrap remains held until externally authorized.

Runbooks: positive sequence, negative scenarios and physical fault prerequisites.

Verification on this update

• 40/40 fixture tests passed on head f5358975 using the canonical scripts/test.sh --ci-tests-only tests/test_dot_disposable_fixture.py wrapper. All seven new mount regressions failed before the fix. They cover ancestor-directory exposure of management credentials/peer state, real-source and no-source layouts, missing src, and genuine clean Git checkouts containing the future fixture. Black, isort, flake8 and diff checks passed.
• Actual beta and release containers now report the management write-PAT paths and the old /code/.agent-tmp alias absent and unreadable, while their assigned reader, src and exact TEST source remain present. No credential contents were read by these probes.
• A new isolated probe using the narrowed mounts installed exact source 196f89c5…, independently validated READY, observed the same installed child's heartbeats 6 → 9, and verified a genuine held terminal followed by the same original STOP's OS exit. Its complete audit remains 2 launches / 3 POSTs. It completed in 84.43 seconds; its container and network were removed. This is PREAUTH_ONLY_VERIFIED, not authenticated MCP acceptance.
• Exact-head CI is in progress: Test Source for Runtime, OpenCode Live Tests, PR Tests, NEW Docker Private Engine Acceptance, Muse Live Tests, Browser Tests, Prompt Regression (Advisory), Supervisor Integration Tests. At 08:49 JST, Muse, Browser and Prompt Regression succeeded; the other five workflows were pending/running, with no failed new-head jobs observed. Do not reuse older-head CI as current-head evidence.
• Preceding head 40338a87 passed 33 fixture tests and seven workflows. Its remaining Supervisor workflow was cancelled when superseded by the new push; the aggregate subsequently reported the cancelled container jobs. The earlier actual-image source-storage reproduction, repaired independent Git checkout, and frozen installation of source 299dfdf8… remain historical evidence.
• On head 8fd6f504…, 108/108 positive/negative client tests passed on uf, and all eight workflows succeeded, including all 30 Supervisor jobs. On 7330957…, the broader 272-test selection passed. These are explicitly prior-head results.

Historical V7 test-source GitHub evidence

The V7 test source was 299dfdf8b5264c057b85cce80b93c5a1a094bf61:

• Test Source for Runtime 43233362549: success, attempt 1.
• Publish Tested Source 43235648807: success. Independently read annotated ref refs/tags/auto-coder-tested-299dfdf8b5264c057b85cce80b93c5a1a094bf61, object e45d4ecaaea40d6ee639461241357bb0f23b190a, directly targeting that commit and recording the exact successful source run.
• Advance Beta Source 43236321761: success. At that historical selection, the source pointed to that commit; selection object 34575460907dde2787525606e9163a795aa180b6 binds original operation r43236321761, the tested-source object, and the expected previous SHA.
• Actual promotion workflow ID 415275979 and accepted profile revision 0caa32fa4fc1e619df7e7252714133546f89676b99be386272598ce144c43d96 are configured for fixture pr2835-full-20261112v7. The source provenance and initial configuration were independently verified before the V7 attempt recorded below.

These GitHub results establish source provenance and selection, not beta/release installed acceptance.

Live blockers and retained original

The original v6 beta operation b66a1bf6-668f-4bd4-9940-cefeac7b0c58 remains NEEDS_ATTENTION / lifecycle_deadline_exceeded. It staged the selected source but did not establish a serving installed child with advancing heartbeat. Its original ticket, key and journal are preserved; it is not being replayed or relabeled as PASS. The old OAuth grant was revoked during cleanup.

The owner approved the fixed V7_SCOPE. The private beta workload repository and inert reevaluation canary issue #1 now exist. The previously approved test-source reader and test-repository-only publication/dispatch credential have been placed in the new fixture. The owner saved the approved 7-day fine-grained beta reader. On 2026-11-13 06:57 JST, authenticated Metadata, Contents, Issues and Pull requests GETs each returned HTTP 200 for the exact private auto-coder-test-beta repository. The credential remains in its private file and its value was never printed. These read checks establish the required capabilities; no write probe was attempted.

Actual V7 result and cleanup

Fresh owner Google OAuth succeeded on 2026-11-13 at 07:10 JST. The authenticated observe-refusal scenario passed: the producer returned DENIED / profile_denies_mutation, and an independent read-only SQLite query confirmed absence of the original request key from the operation journal.

The one beta deployment original, e2ab519e-821f-42e2-affe-c3531ee57338, then became FAILED / confirmed / worker_version_preparation_failed. Its Supervisor preparation also retained a terminal FAILED result. The source checkout depended on an absolute Git alternates path available on uf but absent inside the single /source mount. The container reproduction and source-storage fix above establish that cause.

The original ticket, key, journal and failed preparation are retained. The unknown-effect probe and --resume-original correctly returned BLOCKED for this terminal failure; neither is counted as a verified unresolved-effect negative or a successful recovery. No installed child, beta acceptance, promotion or release activation succeeded in V7.

uf rebooted during investigation, removing the transient cleanup timer. The attempt to restore the same deadline through sudo systemd-run was blocked by the remote command policy. The safer existing unprivileged cleanup ran early, at 07:25 JST, without extending the original 07:52 JST window. Independent readbacks confirmed: original grant durably revoked, empty UID allowlist, absent ADC and owner-token files, original authorized domains restored, policy observe, exact temporary SA TokenCreator binding absent, all V7 services stopped, and the original failed operation preserved.

Independent V8 preparation

A new fixture, pr2835-full-20261113v8, uses the same approved two TEST repositories, Firebase project and service account, with fresh identities, nonce and bridge keys. No V7 journal, ticket, runtime or OAuth grant is imported. Both checkouts have independent Git storage. Worker code mounts now exclude the fixture state and management credentials.

The TEST repository policy changes only its accepted beta instance to dot-pr2835-full-20261113v8-beta, producing source 196f89c59fc34f1033039afdb837847560b44c36:

• Test Source 43321934554, attempt 1: all 15 jobs succeeded, including the aggregate.
• Publish Tested Source 43329276074, attempt 1: success. The immutable tested-source tag object is 22fd8c6c778dc02f1af08e7056c5b94d643281c9, directly targeting source196 and recording the exact successful source run. The production reader and recorded-attempt verifier independently validated it.
• Advance Beta Source 43330523049, attempt 1: success after one original dispatch. Main and the beta source pointer both equal source196. Current selection and immutable history auto-coder-beta-selection-r43330523049 share annotated object 190efc64d5bd0e159ad213a8c51fce02f19f86cd, with the original operation, previous source299, tested proof and CI attempt independently verified.

Pre-auth preparation was independently rechecked at 08:49 JST:

• The new narrowed-mount probe4 established real installed startup, the advancing heartbeat, the held genuine terminal, unchanged PID lifetime, and completion of its original STOP without extra POST/launch. Its original evidence is retained under .agent-tmp/pr2835-v8-worker-preflight-4/runtime/. Earlier probes and originals are preserved separately.
• The previous unarmed cron registration was removed before changing the code pin. The new exact-code user-cron entry was installed/read back at 08:45 JST, and actual unarmed executions were observed. Earlier helper files, Compose and registration records are preserved; no authentication deadline has been extended or replaced.
• The same approved owner account, original Firebase authorized domains, absence of the temporary owner TokenCreator binding, empty allowlist/operation journal, observe policy, free loopback ports and exact reviewed cleanup-helper hashes were verified.
• The first observe-refusal checkpoint was created from the retained real source proof through the complete production dataclass schema, using private exclusive creation. It has sent no intent. Later checkpoints must carry forward genuine original results.
• Explicit post-positive fault intents and the one-scenario current-grant runner are prepared. V8 OAuth is not yet consented, and no authenticated rollout operation has been admitted.

The current pre-auth readiness record is management/v8-preauth-ready-before-arm.json, SHA-256 0073d7402833483144799fb5c120087832e6823f17a6dcaafbe2e2fd073eabeb. The verified selection record is management/v8-beta-selection-proof.json, SHA-256 13f1d209646284c5a002232eeed415db4ac136c5a86025f56765bb55c307c206. The earlier pre-auth summary 53228f3e… remains an unmodified historical snapshot.

The full beta installation → acceptance publication → promotion → independent release activation, interruption/resumption and installed-worker recovery scenarios remain NOT_RUN/BLOCKED until their genuine original evidence is collected. Fresh owner Google/Allow consent for V8 is the next required human step; the previously approved resource scope does not need to be approved again.

V8 owner-consent handoff

On 2026-11-13 08:54 JST, the exact V8 management endpoint returned HTTP 200 with the approved scopes auto-coder.read, auto-coder.operate and auto-coder.deploy. The original loopback PKCE client is waiting for the owner's fresh Google/Allow consent. Its original PID lifetime and callback listener were verified; no owner grant or authenticated rollout admission exists yet.

The original 48-minute window was armed at 08:51:20 JST. The exact temporary SA TokenCreator binding includes the original expiry condition, and its issued credential lifetime is bounded by that same window. Persistent user-cron cleanup starts at 09:37:20 JST; the hard deadline is 09:39:20 JST. The window has not been extended. Running beta/release container mounts were checked again after authentication setup and exclude the management credential/state directories.

The owner receives the one-time local consent URL privately. Resource scope remains the previously approved V7 scope; only genuine consent for this new isolated grant is required. Full authenticated acceptance and exact-head CI are still pending.

Existing enabled hourly dot automation was independently rechecked. Its recorded completed run 03ff9a56-d778-8329-9adb-8c5664b5eaa1 produced ordinary development output, and its referenced commit 7df6c857 exists on GitHub. This establishes recurring execution capability; it does not establish that this authenticated rollout ran unattended. The cleanup cron and final rollout go/no-go evidence remain separate.

The P1 live-acceptance finding remains unaddressed at the live-evidence boundary. Preserve DRAFT until REQ-007/008/011, exact-head CI and review are satisfied. This update provides no production rollout or merge authorization.

[kitamura-tetsuo]

#2608 latest incremental checkpoint (exact published head 55f19a8e0f64479c8a1351cea56e3230f4c332aa):

After initial read-only runbook/observer and example schema (776564dd), two follow-up corrections were published:

• 783c2cbd: CLI returns nonzero exit 3 for NOT_RUN, 2 for BLOCKED, 1 for FAIL, and 0 only for truly evidenced PASS. Stdout retains Loguru JSON records and final JSON verdict as the last line; nonsecret logs also rotate on disk. A scheduler cannot mistake missing acceptance as a green run.
• 55f19a8e: when a durable pending effect is SENT_UNKNOWN or NEEDS_ATTENTION, an MCP read plan requires the same original operation ID already recorded in the checkpoint; a caller-supplied unrelated/new ID refuses before any transport. New negative controls first failed 6/6 before correction, then passed with the exact original idempotency/operation path.

Latest isolated uf test selection: 51 passed (test_dot_source_rollout_contract.py, directly affected test_management_mcp.py); Black, isort, flake8, whole-package mypy (334 modules) and diff checks all pass. Example checkpoint roundtrip validated. No server MCP query, production/beta mutation, OAuth authority grant, Docker effect or synthetic acceptance was performed.

DRAFT / normative blockers unchanged: #2608/REQ-007/008/011 still require a genuinely disposable operator-selected authenticated mutation+acceptance harness, genuine Git/Actions/worker source and advancing heartbeat evidence, policy-downgrade/unknown-effect/real recovery acceptance, and verified dot recurring facility. The actual management MCP is currently unavailable under #2822 recovery; that is not a blocker for this isolated code, but it prevents truthful live MCP acceptance. positive_deployment_proven=false and effect_dispatched=false throughout this subset. Required exact-head GitHub Actions are running and must pass independently. Do not mark PR ready/merge merely because CI becomes green.

[kitamura-tetsuo]

Exact-head incremental correction: 8489f635 (follow-up to 55f19a8e).

Defect fixed: while a checkpoint carried an unresolved SENT_UNKNOWN / NEEDS_ATTENTION effect, the read-only plan previously accepted the correct original operation ID with a different target (or without any original target binding), and performed status/deployment reads before original-operation reconciliation. An unrecognized nonempty pending-state value could also fall through to the normal stage. Now a pending original operation must have exactly one original ID→configured target association (beta, release or release-promotion), unknown states fail closed, and identity+original-operation readback precede status/deployment diagnostics. No new key, grant, mutation or deployment path was added.

Evidence: On isolated uf worktree, new regressions and directly affected suites: 63 passed, 0 failed (tests/test_dot_source_rollout_contract.py, tests/test_management_mcp.py); Black, isort, flake8, whole-package mypy (334 source files), git diff --check passed. Tests use the preexisting isolated Python test environment; no live MCP endpoint was called. Exact pushed SHA and remote branch SHA match; fresh GitHub Actions on this HEAD must independently complete.

Still DRAFT / not accepted: #2608 REQ-007/008/011 still lack an opt-in disposable real authenticated mutation+Git/Actions/source-worker acceptance, bounded recovery and current scheduler evidence. No positive deployment claim, management recovery authority, beta/release changes or management MCP query. Green CI would not make the PR mergeable under the Issue's normative requirements.

[kitamura-tetsuo]

dot adversarial review

Head: 8489f63
Contract: #2608, saved updated_at 2026-10-25T01:03:54Z; Requirements REQ-001–REQ-011, qualified here under owning Issue #2608.

Reviewed all four changed files and the complete changed-test manifest against the explicit Requirements, with the current repository AGENTS.md. Two independently actionable findings are attached inline: missing work/stage identity in the checkpoint (REQ-003), and the explicitly required real acceptance-harness deliverable still absent (REQ-007/008).

The runbook and CLI correctly distinguish diagnostics/NOT_RUN from proven deployment, preserve read-only defaults, and do not claim that green offline tests establish runtime rollout. This is a deliberately partial draft, not completion of #2608. The missing real acceptance deliverable is not being misclassified as a demonstrated unsafe runtime effect. No live management operation or mutation was performed for this review; no independent live acceptance or CI success is claimed. Documentary coverage does not establish end-to-end verification of REQ-002/004/006/011.

No previous native review/thread existed at the fresh-read check. Review event is COMMENT, not merge approval.

[kitamura-tetsuo]

[P1] Supply the explicitly required real acceptance harness before treating #2608 as complete

Requirement #2608/REQ-007: "Provide a maintained opt-in real MCP rollout/acceptance client or equivalent reproducible harness with read-only default and mutation mode limited to operator-selected disposable test worker/container/source-repository fixtures plus current grants/policy; no fixture mode may target deployed beta/release service or gain runtime Docker authority, and it emits PASS/FAIL/BLOCKED/NOT_RUN with original evidence."
Requirement #2608/REQ-008: "Exercise real end-to-end observe refusal, beta-only grant/current policy, real reevaluation acceptance-not-completion, tested Git source→in-container beta installed revision update with durable unknown recovery, beta heartbeat acceptance, full-mode promotion and separately verified release worker source activation, policy downgrade, repeated-failure circuit-breaker and impossible data rollback against actual management/worker/ref producers; do not satisfy end-to-end PASS with mocked OAuth, staged READY, container-is-running, image digest or fabricated publication."

Classification: missing explicitly required acceptance deliverable, not a demonstrated unsafe production mutation and not a criticism of correctly reporting NOT_RUN/BLOCKED.

The complete four-file manifest contains only the runbook, checkpoint example, read-only CLI and offline tests. The CLI can only call its read-tool allowlist and cannot select disposable fixtures or execute the required fixture-bound mutation/acceptance sequence; the added tests never exercise real management/worker/ref producers. These lines accurately acknowledge that absence, but documenting it does not implement REQ-007/008. Even with valid operator-selected disposable fixtures and current grants, this version cannot execute the required beta update/unknown-recovery/acceptance or promotion followed by independent release activation. Its offline tests can remain green with all those paths absent.

Keep this PR draft/incomplete as already stated. Add the opt-in, disposable-target-only harness and focused real-producer scenarios for the enumerated REQ-008 boundaries, with independent installed-source/heartbeat, operation journal, Git-ref and Actions evidence. Preserve the read-only default and prohibit deployed beta/release targets and runtime Docker authority. Demonstrate negative cases for observe refusal, policy downgrade, unresolved sends and exhausted recovery; promotion success while the release worker still runs its prior source must not yield complete PASS. Distinguish an implemented scenario that cannot run because external fixtures/credentials are unavailable (BLOCKED/NOT_RUN) from the currently absent scenario implementation. Never replace this with synthetic success or require live production mutation to complete the review.

[kitamura-tetsuo]

Target head: 4215e03. Current contract: #2608, updated 2026-10-25T01:03:54Z, especially #2608/REQ-004, REQ-007 and REQ-008 quoted/covered in this finding. The real acceptance deliverable remains absent in the complete four-file manifest; this thread must remain unresolved.

The new pretransport refusal is appropriate, but adds an important concrete prerequisite to the existing implementation plan: at this head, ManagementRuntime.operation_get in src/auto_coder/management/mcp_runtime_tools.py can submit unsettled source-release/worker operations and enqueue management-update work. A read-facing scope/name is not proof of a non-actuating reader. scripts/management_mcp_rollout_smoke.py now calls checked_live_plan before importing the SDK or opening transport and rejects this tool; consequently original-operation reconciliation is unavailable, not completed.

For the required disposable harness, first select or provide a verified non-dispatching original-operation evidence path within the explicit contract/dependency scope. If that requires an independently owned producer change or product decision, keep it a prerequisite rather than weakening the read-only default or silently enabling this effectful call. Trace the actual producer to journal/projection and verify that inspection cannot submit/enqueue an effect. Then connect the real public CLI checkpoint-resume path to that evidence using the exact pending_operation_id and unique original target binding. Preserve immutable intent/idempotency, pending state and the one-attempt budget; an unavailable reader must stay BLOCKED, never settle the unknown effect from status alone.

Extend the existing focused pretransport tests with the real disposable-service boundary and independent before/after journal/dispatcher/worker evidence. Exercise SENT_UNKNOWN and NEEDS_ATTENTION, optional original reads, same-target wrong operation substitution, policy downgrade and restart/resumption. Prove no effect for observe/read-only inspection and separately exercise authorized fixture-only mutations plus real installed-source/heartbeat/Git/Actions acceptance already required here. Keep the existing negative refusal tests and distinguish implemented-but-unrunnable scenarios from absent implementation. No deployed beta/release mutation is needed or authorized by this guidance.

[kitamura-tetsuo]

Partial response to the P1 acceptance request (intentionally not resolving this thread):

• dbaef359 adds maintained opt-in disposable Compose provisioning and a fixture-bound MCP acceptance client. a4394d49 binds the current OAuth project to a fixture--namespaced test identity, refuses untracked source files, expands offline regressions and documents the operator procedure.
• Offline harness/client tests: 27 passed, flake8 clean. A private two-worker + management fixture on uf was started with no Docker socket or production mounts; real signed Supervisor/child bridge status and a public test Git source checkout were independently observed. Current fixture test Git SHA: 733be5fb910f2d889c9a3de5606bd970dfd8435a. No fixture OAuth bearer is configured, so the actual client correctly reports BLOCKED before sending any MCP request. Deliberately held workers do not produce installed-source heartbeats; this is not a positive deployment.
• A real kitamura-tetsuo/auto-coder-test source workflow is running (run 43125584754). It must finish successfully and publish its exact annotated tested-source ref; merely seeing an Actions job or a SHA is insufficient.
• Still missing: real current test-only OAuth grants/policy, accepted beta source installation/heartbeat, durable unknown-operation and recovery outcomes, beta acceptance, full-mode release promotion and independent release activation, policy downgrade and scheduler evidence.

REQ-007/008/011 therefore remain BLOCKED/NOT_RUN, not PASS. This P1 thread and the PR remain unresolved/DRAFT until genuine producer evidence is complete. Production manager/worker, authorization, state and Docker remain untouched.

[kitamura-tetsuo]

Target head: 8fd6f50. Current contract: #2608 updated 2026-10-25T01:03:54Z, particularly #2608/REQ-007/008/011. This remains a missing required live acceptance deliverable, not a newly demonstrated runtime defect. The earlier four-file/absent-client description is superseded: scripts/dot_mcp_acceptance.py now has the positive five-stage sequence and scripts/dot_mcp_negative_acceptance.py has refusal, held-drain, original-unknown and exhausted-budget consumers.

Complete the remaining work through those actual CLI entrypoints against separately authorized disposable fixtures. Preserve scripts/dot_disposable_fixture.py's distinct beta/release workload ownership, empty processing allowlists and no-Docker client boundary. In run_authenticated/complete_original retain exact source CI/ref/run/attempt, original admission ticket/key/operation, installed runtime/process/Supervisor identity and current grants; never replace the unresolved v6 operation or manufacture its success to start another run. Prerequisite credential/consent work stays with the existing operator/implementation owner, not this review.

Collect independent original journal and real worker evidence for beta installation/startup and advancing heartbeat, then published acceptance, exact original Actions attempt/catalog/selection, and separate release installed-source/heartbeat. Promotion alone must leave release deployment unproven. Exercise the documented real held-drain, lost-response/original-resume, one prior-runtime recovery and retained exhausted-signature paths, observing actual launch/journal history so a new key or reconstructed client cannot silently send another attempt. Observe refusal and downgrade need genuine denied admission plus independent absent original journal intent; unsupported data rollback must remain BLOCKED. Preserve failing/unknown evidence rather than clearing tickets to reuse a fixture.

Retain tests/test_dot_mcp_acceptance.py and tests/test_dot_mcp_negative_acceptance.py as offline regressions, including substituted receipts, post-send exceptions and original-ticket concurrency. They do not replace the real producer scenarios. Record exact harness SHA, source SHA, fixture identities and immutable evidence for every REQ-008 scenario, with NOT_RUN/BLOCKED for missing prerequisites, and keep recurrence/renewal/final go-no-go evidence separate under REQ-006/011. Until those observations exist, keep this thread unresolved and the contract incomplete. This requests no production mutation, new authority or bypass of approval gates.

[kitamura-tetsuo]

Incremental #2608/REQ-003 checkpoint identity correction (still DRAFT)

Published exact HEAD 780b0ede1574c34b7cf653105271bcd19c7d0221 on the existing PR branch, without touching management MCP or a deployed target.

• The original operator checkpoint now accepts and validates task_id, repository, issue_number, pr_number, and stage_revision instead of rejecting this REQ-003 information as extra schema fields. The on-disk example and runbook are updated. Invalid/noncanonical identities fail checkpoint loading; beta/full without original work identity or stage revision is BLOCKED, never implicitly promoted from HEAD or the stage name.
• Added a real CLI subprocess round-trip preserving original work/stage/source identities across offline restart, negative schema tests, and fail-closed stage regression. Original unknown-operation reconciliation and immutable idempotency behavior remain intact.
• On the authorized uf host, isolated code checkout + local Python test environment: 64 passed in tests/test_dot_source_rollout_contract.py; Black, isort, flake8, mypy of the observer script, and git diff --check passed. No live MCP, worker, Git-ref acceptance, installed-source acceptance, or Docker validation was run; NOT_RUN is not PASS.
• New exact-head GitHub Actions are queued (PR Tests run, Supervisor Integration run); required gates are not yet established.

Do not mark ready or merge. This only addresses checkpoint retention/validation: the current authoritative operator stage revision still cannot be independently compared by the read-only observer, and #2608/REQ-007/008's opt-in disposable real acceptance harness and end-to-end proof remain missing. Keep both existing inline threads unresolved until those portions are implemented and demonstrated. No recovery authority or production/beta deployment was granted.

[kitamura-tetsuo]

Incremental fail-closed fix at 5a008a7c91f2923d5e500f719844607e6939ab97 (still DRAFT; not acceptance of #2608):

• Reproduced four previously accepted unbound read plans for auto_coder_operation_get when no uncertain effect was recorded: absent original ID, different original ID, cross-target reuse, and ambiguously duplicated original IDs.
• Now every optional operation readback, not only SENT_UNKNOWN / NEEDS_ATTENTION, must uniquely match the original checkpoint operation ID and target. Unrelated reads are refused before any network call; original unknown-effect read ordering and no-effect default remain unchanged.
• Added positive and negative regression cases and documented the bound readback contract.
• Verification on isolated uf worktree: four new negative cases failed before the code fix; after the fix, tests/test_dot_source_rollout_contract.py + tests/test_management_mcp.py: 79 passed; Black, isort, flake8, git diff --check: pass; full-package mypy: 334 files pass.
• This is a read-only planning fix; no management MCP request, mutation, beta/release deployment, real fixture acceptance, or positive origin claim was performed. REQ-003's authoritative stage-revision revalidation before mutation and REQ-007/008/011 live disposable fixture harness/acceptance remain incomplete. Preserve both inline review threads and DRAFT status pending their full demonstrable fixes. Exact-head required CI is pending.

[kitamura-tetsuo]

dot adversarial review

Target head: 5a008a7
Issue contract: #2608, updated 2026-10-25T01:03:54Z; #2608/REQ-001–REQ-011.

Reviewed the complete four-file manifest and complete changed-test file against the current explicit Requirements and AGENTS.md. No new independently actionable root cause was identified beyond the existing acceptance-deliverable thread. This remains partial implementation, not full-contract acceptance or merge approval.

The specific missing checkpoint-schema fields identified in #2835 (comment) are now present in DotCheckpoint and the example: task_id, repository, issue_number, pr_number and stage_revision. The actual public main -> load_checkpoint path accepts and validates them, preserves the loaded immutable record, and does not derive them from current HEAD. test_checkpoint_preserves_original_work_and_stage_revision_across_cli_resume supplies a saved checkpoint, invokes the real CLI subprocess, and rereads the same original task/stage/source identifiers; the all-identifiers roundtrip and invalid-identity cases independently protect this representation. required_next_observation refuses beta/full records missing the original identity/revision. This establishes the narrow schema/retention repair, not proof of current operator authorization or the absent mutation flow. The native thread remains unresolved; no successful resolution is claimed.

The later read-plan changes bind any requested operation ID, including optional diagnostic reads, uniquely to its original configured target. SENT_UNKNOWN/NEEDS_ATTENTION readback precedes deployment diagnostics; unknown state, cross-target, unbound and ambiguous IDs refuse. Their parameterized tests cover the relevant producer-to-read-plan boundary without presenting offline plans as live acceptance. The live route stays an explicit read-only allowlist and returns NOT_RUN rather than deployment PASS. No new key or recovery operation is dispatched.

Requirement coverage remains limited: REQ-001/002/005/006/009/010 are addressed as runbook/stage/provisioning/escalation descriptions, not independently exercised rollout; REQ-003 gains the narrow checkpoint repair above; REQ-004 has bounded offline refusal and original-read planning, not a verified real recovery lifecycle. REQ-007/008's explicitly required disposable fixture-bound mutation/acceptance implementation remains absent, with REQ-011 live scheduler/Git/worker evidence unverified. Existing detailed implementation guidance at #2835 (comment) remains applicable and sufficient; no duplicate thread or repeated equivalent guidance is added. Preserve its unresolved state and the draft/incomplete status. Missing scenario implementation is distinct from an implemented scenario that merely cannot run, and neither is a demonstrated unsafe production mutation.

Static source/test-path review only; no test execution, live MCP access, CI rerun or runtime/deployment claim. Immediately before publication, re-fetched open/unmerged state, unchanged head, current Issue body, existing reviews and both native threads with all replies; no existing dot review covers this head.

[kitamura-tetsuo]

Follow-up on draft #2608 implementation (commit 18ed1789a47c20bc6fffbeee242c2a3e2ab34d7a):

• Persist pending_operation_id separately from the other saved management operation identities. An unresolved SENT_UNKNOWN/NEEDS_ATTENTION operation is rejected when its original operation ID is missing, unbound, ambiguous, or different from the requested operation—even if another saved operation belongs to the same target. This prevents resumption from accidentally reconciling a completed operation in place of the unresolved original.
• Tighten the schema-1 example, read-plan checks and runbook; add negative cross-operation and checkpoint round-trip/resume regressions.
• Isolated uf worktree: 84 passed across tests/test_dot_source_rollout_contract.py and tests/test_management_mcp.py; changed-file black/isort/flake8 and package-wide mypy (334 files) pass; git diff --check passes. Tests used an existing isolated Python 3.12 environment; no management MCP was contacted.

The two pre-existing review threads remain unresolved: retaining checkpoint values does not itself satisfy the independent current operator-authority comparison requested by P2, and REQ-007/008/011 still require a disposable real-service mutation/acceptance harness with actual producer evidence. New exact-head CI has not been declared successful. Keep DRAFT; do not merge or claim recovery/deployment authority.

[kitamura-tetsuo]

Incremental #2608 REQ-003/REQ-004 fail-closed repair at exact HEAD 7c15ad1173e76afbb2b5decd02f206167f011de9: a full-stage checkpoint previously returned NOT_RUN even when the original tested source/CI lineage was absent, and beta omitted the original CI attempt, source OID or configured target. Four regressions reproduced these omissions before the fix (4 failed), and the observer now returns BLOCKED for these missing original upstream bindings before any stage assessment. The change only strengthens offline diagnostic eligibility; it does not issue authority or attempt any MCP mutation. On isolated uf worktree, 88 affected pytest cases passed (tests/test_dot_source_rollout_contract.py and tests/test_management_mcp.py), plus Black, isort, flake8, package mypy (334 source files), and git diff --check. The test runner used the existing dependency-complete Python 3.12 environment from a separate project worktree, with this worktree source selected by PYTHONPATH. New exact-head GitHub Actions are not yet independently green. PR remains DRAFT: original real fixture MCP mutation/worker/Git/Actions acceptance under REQ-007/008/011 and review threads remain incomplete; no deployed service, management MCP, or recovery grant was touched.

[kitamura-tetsuo]

dot adversarial review

Target head: 7c15ad1
Issue contract: #2608, updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011. AGENTS.md blob 93c3586c9d71c110e55b0031f2714fb8be619960.

Reviewed the complete four-file and changed-test manifests, current CLI entrypoint, checkpoint parser, read planner, live observer and offline oracles against all eleven Requirements, reconciling the preceding 5a008a7 review. No new independently actionable root cause was identified. This remains incomplete implementation, not full-contract acceptance or merge approval.

The REQ-003/004 increment now records pending_operation_id separately from completed beta/promotion/release operation IDs. load_checkpoint refuses missing or unbound pending IDs and pending IDs without unresolved state. read_plan requires the caller's ID to equal that exact pending ID before independently checking its unique target binding. Thus another saved operation on the same release target cannot substitute for the original unknown promotion. The disk-resumption, same-target substitution and missing/unbound cases exercise these distinct boundaries. Original-operation readback still precedes deployment diagnostics; the record is not repaired, a new key is not allocated, and no recovery effect is dispatched.

The offline beta/full assessment now requires source SHA/ref/OID, original CI run/attempt and beta target before returning diagnostic-only NOT_RUN. Full-stage assessment cannot skip the earlier beta/source lineage. Missing-field and full-stage regressions protect that refusal. These are retained checkpoint prerequisites, not authentication of the recorded evidence. The separate live observer still only collects read-response digests and reports diagnostic NOT_RUN; neither branch proves installed-worker progress, current stage authority, promotion or deployment.

REQ-001/002/005/006/009/010 remain runbook/stage/bootstrap/escalation coverage rather than independently exercised rollout. REQ-003's work/stage schema repair remains present, but the existing native thread is still unresolved; no resolution action is claimed. REQ-004 has conservative offline refusal and exact read planning, not a real bounded-recovery lifecycle. REQ-007/008's expressly required opt-in disposable fixture-bound mutation harness and real-producer scenarios remain absent; REQ-011 scheduler/Git/worker acceptance remains unverified. The detailed existing guidance in #2835 (comment) still applies without substantive change, so no duplicate thread or repeated equivalent reply is added. Preserve draft/incomplete status and the unresolved acceptance finding.

Static source/contract review only: no test execution, live MCP request, CI rerun or runtime/deployment claim. Immediately before publication, re-read open/unmerged state and exact head, current unchanged Requirements, existing reviews and both native threads with their replies. No prior dot review of this head was present.

[kitamura-tetsuo]

Implemented and pushed an additional fail-closed operator-stage resume guard at exact head 28da5653.

Before a live read-only diagnostic using a saved beta/full checkpoint, the caller now has to supply the current operator-selected --operator-stage and --operator-stage-revision. Both are compared with the checkpoint's original selection before accessing the token or contacting the MCP endpoint. Missing, downgraded, changed, or malformed selections produce BLOCKED; the original checkpoint remains unchanged. Observe-only still defaults to read-only. Documentation and a CLI regression using a deliberately unreachable fixture endpoint were added; no live management MCP was queried.

Validation on the isolated uf worktree:

• 94 passed, 0 failed via CI=true bash scripts/test.sh --ci-tests-only tests/test_dot_source_rollout_contract.py tests/test_management_mcp.py. The six new regression cases first failed before implementation and passed afterward.
• Black and isort checks, flake8, mypy --config-file pyproject.toml -p auto_coder (334 source files) and git diff --check passed.
• Exact-head required GitHub Actions have started; no all-green claim.

This is a current operator re-selection guard, not independent service/grant attestation, an acceptance harness, or permission to mutate anything. REQ-007/008/011 positive real-fixture acceptance, installed-source / worker / Git/Actions lineage and reviews remain outstanding. Keep this PR DRAFT; unresolved normative review threads are intentionally not marked resolved merely for this partial fix.

[kitamura-tetsuo]

Incremental fail-closed scope correction at c7e054efd98f0b432ebfcc8160471ad4fc35a187: read-only target diagnostics are now tied to the saved operator checkpoint (beta stage → configured beta target; full → configured beta/release targets; observe → saved targets if present). This prevents an unrelated worker's readback from being attributed to the selected stage. An unresolved original operation is still reconciled against its exact saved operation/target identity, even across a stage transition; no mutation is introduced.

Regression: four negative cases failed before the fix; 5 focused cases passed afterward. On the isolated uf worktree, affected tests/test_dot_source_rollout_contract.py + tests/test_management_mcp.py now report 99 passed, 0 failed. Black, isort, flake8, full-package mypy (334 files), and git diff --check passed. These are local tests using the existing test environment, not independent current authenticated MCP acceptance. Exact-head GitHub Actions after push must still be checked.

Still DRAFT / no merge: #2608/REQ-007/008/011 real disposable-service mutation, worker/Git/Actions acceptance, and unresolved native review threads remain. No management MCP inquiry, live beta/release mutation, recovery grant, or production deployment occurred.

[kitamura-tetsuo]

dot adversarial review

Target head: c7e054e
Issue contract: #2608, updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011.

Inspected the complete four-file and changed-test manifest, current AGENTS.md, checkpoint example, full observer/CLI and regression source. Reconciled the two-commit increment from the preceding 7c15ad1 review. No new independently actionable implementation violation or qualifying material test-oracle gap was identified in that increment. This remains incomplete implementation, not full-contract acceptance or merge approval.

REQ-001/003: main now checks a newly supplied operator stage and revision before constructing the live read plan or opening transport. Beta/full requires retained work identity and an exact matching fresh revision. A changed/missing selection refuses without rewriting the checkpoint; the subprocess regression reaches that CLI boundary and requires BLOCKED, no observations and unchanged persisted identity. This is an operator selection check, not server attestation or a current grant. Offline diagnostics remain non-authorizing.

The planner now confines non-pending diagnostics to saved stage targets: beta cannot substitute the release target, full can select either configured target, and observe permits a fresh target only when no target was saved. The pending-original-operation branch deliberately retains exact original ID/target reconciliation even for a previously selected other-stage target. It still reads the original operation before deployment diagnostics and never dispatches a new effect. The new focused cases cover unselected/cross-stage target refusal and the original pending release read during beta. No positive deployment or recovery completion is inferred from these reads.

REQ-002/004/005/006/009/010 remain the documented ordered evidence, refusal, bootstrap and bounded-recovery boundaries, not an independently exercised rollout. The existing REQ-003 schema/identity finding has bounded repairs present, but its native thread is left unresolved; no resolution action is claimed. The existing explicit REQ-007/008 acceptance-deliverable finding remains: there is still no opt-in disposable fixture-bound mutation harness or real management/worker/ref acceptance flow. REQ-011's scheduler/Git/worker acceptance remains unverified. The detailed correction conditions already in #2835 (comment) remain applicable, so no duplicate finding or substantially equivalent guidance reply is added.

Static source/contract review only: no tests, live MCP requests, CI reruns or runtime operations were executed. No exact-head CI success is claimed. Immediately before posting, fresh reads confirmed open/unmerged exact head, unchanged current Issue contract, no existing dot review for this head, and both native threads with unchanged full reply histories. Preserve draft/incomplete status and unresolved acceptance work.

[kitamura-tetsuo]

Bounded #2608 checkpoint/provenance correction (commit ba5da575c3cb7f67ee8961f3653c9665f0e4b43a).

• The schema-1 read-only consumer now refuses non-canonical/zero CI run and attempt identifiers and non-40-character/non-lowercase tested-source, beta-acceptance and promotion-catalog Git OIDs before any transport. Prior malformed fields were accepted as apparently retained original evidence.
• A full-stage checkpoint with beta acceptance and promotion records but no distinct release target now returns BLOCKED rather than NOT_RUN, because its release installed-worker state cannot be identified. This does not assert promotion/release readiness.
• Added seven invalid-identifier regressions plus the missing-release-target negative oracle; first demonstrated 2 failing regressions before the correction; 97/97 focused tests now pass on the isolated issue-2608 worktree. Black, isort, flake8, package-wide mypy (334 files), and git diff --check pass.
• Dashboard/trace emission is unchanged: all changes are in pre-transport local checkpoint validation and existing report wording. Documentation updated.
• Previous head c7e054ef had a failed Supervisor Integration Tests workflow, caused by native Supervisor isolated-containers (shard 11) test test_expired_live_failed_installed_drain_settles_without_prior_launch: the real network inspect_supervisor() returned UNKNOWN rather than the fixture's expected OK at tests/test_release_worker_acceptance_container.py:291. This is an independent release-worker fixture/timeout issue, not a demonstrated Document and verify a resumable staged dot operating loop #2608 implementation failure. Attempts to rerun that workflow and fetch jobs via GitHub Actions returned HTTP 502; the underlying failed job log was retrieved from the job-specific API. The new commit triggers fresh exact-head required workflows; no pass is assumed.

Do not mark ready or merge: REQ-007/008/011 require the disposable, real authenticated MCP/worker/Git/Actions producer harness and positive acceptance. The existing unresolved P1 review must remain unresolved. No management MCP query, worker operation, production/beta deployment, credential change or authority grant was performed.

[kitamura-tetsuo]

Additional fail-closed read-only transport fix, commit 4215e0375b46c1f35eb0ac15e12636f95276905f.

Review of the real management service producer exposed a material pre-existing boundary: ManagementRuntime.operation_get in src/auto_coder/management/mcp_runtime_tools.py can call dispatcher.submit(operation_id) for unsettled worker/source-release operations, and dispatcher.enqueue(operation_id) for the management self-update branch. Thus auto_coder_operation_get must not be treated as a side-effect-free read merely because it has a read-facing name/scope. The previous #2608 client allowed that tool in its live read-only plan, including SENT_UNKNOWN recovery. This could inadvertently advance an existing operation without the separate fixture-bound mutation authorization required by #2608.

The client now checks the exact plan before importing the MCP SDK or opening any transport, refusing every live operation_get invocation with a specific BLOCKED verdict. Local-only status/deployment diagnostic plans remain available; original-operation reconciliation is not declared successful or absent. A safe non-dispatching original-operation read API and its producer/consumer tests remain necessary before REQ-004/007/008 live acceptance. Documentation explicitly records this gap instead of calling the service's current operation-get path read-only.

The new negative tests exercise SENT_UNKNOWN, NEEDS_ATTENTION, optional original reads and the actual async pre-transport entrypoint. There was a demonstrated red test for the missing preflight guard; 102/102 focused offline tests now pass, together with Black, isort, flake8, whole-package mypy (334 modules) and git diff --check. The checkout is a clean isolated issue-2608 worktree and the branch was pushed without force. This is an observability-neutral pretransport gate; no native dashboard/trace event schema was changed.

Do not mark ready or merge: a correctly BLOCKED original-operation read is not real reconciled evidence, and #2608's opt-in disposable positive acceptance harness, current policy/grants, Git/Actions and worker heartbeat producer scenarios are still unimplemented. The unresolved P1 review remains open. No management MCP invocation, production/beta effect, Docker deployment, or authority grant was performed. Check exact-head full required CI independently.

[kitamura-tetsuo]

dot adversarial review

Target head: 4215e03.
Issue contract: #2608, updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011.

Reviewed the complete four-file manifest, full changed-test file, current AGENTS.md, CLI entrypoint/checkpoint schema/live transport, and the actual ManagementRuntime.operation_get producer at this head. No new independently actionable root cause was identified beyond the existing missing real-acceptance deliverable. This is not full-contract acceptance or merge approval.

REQ-003: checkpoint loading now rejects malformed original CI run/attempt and tested/accepted/promotion Git object identifiers before transport. The invalid-identifier tests exercise the disk loader, while the example and existing subprocess resume test preserve original work/stage/source identities. REQ-002/003 full-stage offline assessment now refuses a missing release target even when a promotion record exists. These checks do not authenticate the saved evidence or prove installation.

REQ-001/004/007: the actual operation_get producer can submit pending source-release/worker operations or enqueue management-update work. The previous live read plan therefore was not inherently non-actuating. In this head, observe_live calls checked_live_plan before SDK import/transport and refuses every operation_get plan. The pending/optional-read tests and async pretransport regression protect that boundary. This is a conservative refusal, not successful original-operation reconciliation; unknown effects stay unproven and no alternative key or new effect is sent. The remaining status/deployment diagnostic plan still emits NOT_RUN and cannot certify installed-worker progress.

Coverage remains partial: REQ-001/002/005/006/009/010 have runbook/bootstrap/stage/escalation descriptions, not independently exercised rollout. REQ-003 has checkpoint and refusal coverage, not full server-backed resumption. REQ-004 lacks the real bounded-recovery lifecycle. REQ-007/008's explicitly required disposable fixture-bound mutation/real-producer acceptance harness remains absent; REQ-011 scheduler/Git/worker acceptance is unverified. The existing P1 thread remains unresolved and now contains head-specific guidance for the newly identified non-dispatching-reader prerequisite: #2835 (comment). The earlier checkpoint thread was already resolved when fetched; no resolve/unresolve operation was performed.

Static source/contract review only. No test execution, live MCP call, CI rerun, runtime operation or exact-head CI success is claimed. Fresh reads immediately before publication confirmed open/unmerged exact head, unchanged Requirements, complete current thread replies and no prior dot review for this head. Preserve draft/incomplete status.

[kitamura-tetsuo]

Incremental fail-closed correction for #2608 at 3da7b7ad410bc17d7b162d8b18f197bd43305d7c (still DRAFT / NOT merge-ready).

• load_checkpoint, offline stage assessment, and read planning now reject equal beta/release targets; one worker can no longer masquerade as separately activated release-worker identity.
• Before opening any MCP transport for a non-pending beta/full stage, the live observer checks original task/Issue/PR and stage revision plus complete tested source SHA/ref/OID, original CI run/attempt, configured beta worker, and exhausted recovery budget. Incomplete checkpoints return BLOCKED instead of reaching the service. Pending unknown effects retain the existing conservative operation-get transport refusal; this change does not authorize a substitute operation or silently reconcile it.
• Added four regression tests. All four reproduced failure before the fix; after the fix the focused test file is 106 passed on isolated uf Linux. Black, isort, flake8, package-wide mypy (334 files), and git diff --check passed. The branch was clean after the exact-head push.
• Observability-neutral: this changes only the opt-in client-side checkpoint/read preflight, tests, and runbook. No server-side admission, trace emitter, structured production event, dashboard consumer, or dashboard event schema is modified; no production dashboard-trace contract update is needed.

Not acceptance proof: no management MCP connection was attempted, no worker/source mutation or deployment was performed, and there is still no maintained real disposable end-to-end authenticated acceptance harness or non-effectful original operation reader. #2608 REQ-007/008/011, the current P1 review thread, and exact-head required Actions checks remain open. Do not resolve the review or mark this PR ready/merge merely because local tests pass.

[kitamura-tetsuo]

dot adversarial review

Target head: 3da7b7a
Issue contract: #2608, updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011.

Inspected the complete four-file manifest, full changed-test source, checkpoint example, current AGENTS.md, public CLI/load/planning/transport path and ManagementRuntime.operation_get. No new independently actionable root cause was identified beyond the existing missing acceptance deliverable. This is partial implementation, not contract acceptance or merge approval.

REQ-002/003: load_checkpoint, required_next_observation and read_plan now reject a checkpoint naming the same beta and release target. The disk-loader, planner and full-stage offline tests separately protect these boundaries. This preserves distinct target identity, not proof that a selected target actually runs the required release revision. REQ-003/004: main now applies required_next_observation before constructing/opening a non-pending beta/full live plan. Missing original tested-source/work/CI bindings and exhausted recovery therefore refuse before transport; the new subprocess CLI test exercises matching operator selection but incomplete source lineage and expects BLOCKED with no observations. Pending original operations remain bound to the exact saved ID and target, and checked_live_plan still refuses operation_get before SDK/transport because the real service method can submit or enqueue effects. Neither refusal nor a read-response digest proves reconciliation or deployment.

REQ-001/002/005/006/009/010 retain documentary stage, ordered evidence, bootstrap and escalation coverage, not independently exercised rollout. REQ-003 has schema/resumption checks, not full authoritative server-backed resumption. REQ-004's real bounded-recovery lifecycle remains unimplemented. The explicitly required REQ-007/008 disposable mutation/real-producer acceptance harness remains absent, distinct from an implemented scenario merely unable to run. REQ-011 scheduler, Git/Actions and worker acceptance remains unverified. Existing detailed guidance at #2835 (comment) remains sufficient for the same root cause, including the non-dispatching original-reader prerequisite; no duplicate thread or equivalent reply is added. That P1 thread remains unresolved. The earlier checkpoint thread was already resolved; no resolve/unresolve action was attempted.

Static source and contract review only: no tests, live MCP calls, CI reruns or runtime operations executed, and no exact-head CI success claimed. Immediately before publication, fresh reads confirmed open/unmerged exact head, unchanged current Requirements, all existing reviews and both native threads with their full replies. No prior dot review covered this head.

[kitamura-tetsuo]

PR #2835 — SOURCE_READ_TOKEN readback, real E2E checkpoint, and safe cleanup (2026-11-12 JST)

Verified read-only source evidence: The newly provisioned SOURCE_READ_TOKEN (secret never printed) enabled the authenticated management MCP's auto_coder_beta_source_readback to return OK / configured_beta_source_verified. Exact immutable source kitamura-tetsuo/auto-coder-test@70ae3b7ca5d041ecb92be7ee66abf31fcf481ae0, source tag OID 86b02b8fe36eed8e3ec3d295f68f167f4ec329f2, CI run 43166584562, selection OID af7d2ad14db4ea69b9da2bb58a0c55d3f699daf0, and operation r43197123408.

One authorized, isolated beta-source dispatch: The exact fixture source and checkpoint were validated before sending; original idempotency key pr2835-beta-source-70ae3b7-20261112. The single genuine management operation 3ad0fe7e-db64-4171-b7b5-4d99bf6c98a9 staged the verified source and requested the real supervisor handoff. It reached a fresh worker launch, but the 80-second E2E deadline elapsed with an ambiguous result, and authenticated readback found the same operation in RECONCILING; no duplicate send or replay was attempted.

Observed fixture blocker: The staged worker failed to create its repository ownership lock: OSError: [Errno 30] Read-only file system: '/fixture/routing/ownership.json.lock'. This was caused by a :ro bind in the disposable Compose fixture, not established as a production defect. The untracked disposable fixture was corrected to :rw and its Compose config validated, without resending the original operation or erasing original evidence.

Security cleanup (independently verified, 2026-11-12 19:49 JST): After restoring the fixture OAuth proxy, both test OAuth refresh/access grants were revoked (HTTP 200), Firebase authorizedDomains and UID allowlist restored to pre-test baselines, ephemeral SA impersonation ADC and owner grant tokens removed, policy returned to observe, and the three disposable test containers stopped. User-owned TEST_TOKEN / SOURCE_READ_TOKEN files were not deleted. No production manager/worker was changed.

CI work: 78c1b89c repaired Black formatting (32 focused acceptance tests pass). 7c8ad5c4 fixes the isolated offline process-issues fixture's live GitHub preflight for two fixed dummy values only, without exposing or overriding any real token; locally checked by intercepted CLI args, Black, compile, and diff check. CI on 7c8ad5c4 is running at the time of this comment.

Merge status: BLOCKED. Draft PR and P1 review thread remain open. Still need a new independent correctly provisioned authorized E2E, fresh explicit browser OAuth consent (old fixture grants were revoked), and a positive readback/ready/rollback verification before resolving the review or merging. The original ambiguous operation ID remains preserved; it must not be replayed.

[kitamura-tetsuo]

Cleanup addendum (2026-11-12 JST): A read-only post-test IAM check found the temporary roles/iam.serviceAccountTokenCreator binding on the individual test service account pr2835-auth-readonly@fixture-pr2835-20261112.iam.gserviceaccount.com still granted to user:kitamura.tetsuo@gmail.com. I removed only that exact service-account policy binding (not a project-wide IAM role) and independently read back the service-account IAM policy: the member/role pair is absent. No new service-account key was created. A future new E2E will need a fresh bounded impersonation grant and browser consent; no old ambiguous send was retried.

[kitamura-tetsuo]

CI repair on the existing #2835 branch, commit fc962bf9.

The exact previous HEAD 7c8ad5c4 failed PR Tests / Tests with Coverage (1/4) solely at test_scoped_fixture_pat_never_enters_child_process_argv: a static text assertion rejected the literal, non-secret --github-token nonfunctional-ci-placeholder pair recently introduced to bypass live GitHub startup verification in offline-only fixtures. It did not demonstrate any PAT leakage.

Replaced that source-string assertion with a parameterized actual CLI child-exec argv capture. The tests now require that a synthetic github_pat_ secret never appears in the actual child argv; the fixed inert placeholder is permitted only in its explicit offline mode, and when a real scoped PAT is selected, no --github-token flag is passed. The real private-file/test-repository-only token validation tests remain intact. This corrects a false-positive test without relaxing actual secret-handling acceptance.

Local validation (isolated detached worktree on exact original HEAD): tests/test_dot_disposable_fixture.py 16/16 passed; Black (including 26.x), isort, flake8 and git diff --check passed. No production management MCP was called, no live worker was modified, and no deployment was performed.

GitHub started eight exact-new-head workflows for fc962bf9 (starting with PR Tests run 43207015241); they were queued/pending when checked. This is not full CI success and not REQ-007/008/011 acceptance. The existing P1 real-acceptance thread remains unresolved; PR remains DRAFT and must not merge.

[kitamura-tetsuo]

dot adversarial review

Target head: fc962bf.
Issue contract: #2608 updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011. AGENTS.md blob 93c3586c9d71c110e55b0031f2714fb8be619960.

Reconciled the complete 23-file PR and changed-test manifests against reviewed d46099e. The three-commit increment changes three test/fixture files; the other twenty files, including the acceptance client, management implementation and runbook, are unchanged. No new demonstrated independently actionable implementation violation or qualifying distinct material test-oracle gap was identified in this increment. This is not full-contract acceptance or merge approval.

Traced the fixture's actual process-issues child command and the production Click GITHUB_TOKEN/--github-token input through get_github_token_or_fail. The added argv pair contains only a fixed inert placeholder and is conditional on either of two exact nonsecret environment values. Explicit mounted scoped-token activation happens first, so a selected real PAT does not take that branch and remains in the child environment, not argv. The test now captures the actual main-to-execv argument vector for synthetic PAT and both placeholder cases instead of rejecting a harmless source-code string. Private-file/test-repository checks remain independently tested. This is a narrow argv safety regression, not proof of credential scope or live GitHub connectivity. No token or live fixture was used here. The acceptance exception-group test changes only formatting, preserving all four assertions.

All-Requirement assessment remains limited: REQ-001/002/005/006/009/010 retain documentary authority, ordered evidence, bootstrap and escalation coverage; REQ-003 retains original checkpoint bindings. REQ-004's complete real bounded-recovery lifecycle remains unverified. REQ-007/008/011 remain partial. Read the new author-reported exact-source dispatch and RECONCILING/ownership-lock/cleanup checkpoint: neither that report, an untracked local fixture correction, nor a later CI run proves complete acceptance or settles the original unknown operation. The client still does not implement and independently demonstrate the complete beta acceptance, promotion, separate release activation, recovery/policy-negative and scheduler sequence. Existing P1 #2835 (comment) remains unresolved with sufficient implementation/scenario/oracle guidance. No duplicate reply/thread or resolve is added.

Static source/contract review only. No tests, CI reruns, authenticated operations, credential changes or runtime operations performed; no exact-head CI or E2E success claimed. Coordination records assign this head to this review. Fresh prepublication reads confirmed open/unmerged draft, unchanged head and Requirements, all reviews and full native-thread replies/resolution states, with no prior dot review for this head.

[kitamura-tetsuo]

PR #2835 CI and real-fixture follow-up (2026-11-12 JST): The old CI run 43205152240 failed one coverage test because test_scoped_fixture_pat_never_enters_child_process_argv looked for any literal --github-token in the fixture source. Concurrent PR commit fc962bf9 correctly strengthens this to an actual intercepted os.execv argv test: the test-repository PAT never enters argv, while only fixed inert placeholders may use the documented CLI skip. I preserved that stricter behavioral guard (no monkeypatched startup auth). My new commit b5e17f97 fixes the separately observed real E2E fixture failure: the private worker routing directory now mounts rw so it can create ownership.json.lock; the management container still receives no routing mount, and the test asserts both facts. Local Black and diff checks pass; an isolated no-network test image ran 46 focused tests successfully (two Git-dependent tests excluded because that image lacks git; normal CI has git). Fresh exact-head CI is restarting. The original ambiguous management operation has not been retried, and the PR remains Draft with P1 review unresolved until a genuine new authorized E2E passes.

[kitamura-tetsuo]

PR #2835 real-fixture acceptance safety follow-up (2026-11-12 JST), commit df59597:

• The original 2-second heartbeat comparison could incorrectly BLOCK a genuine idle worker: the real producer maintenance cadence is 60 seconds. The read-only fixture client now polls every 5 seconds for up to 150 seconds, with exact Supervisor/process/runtime/deployment/source identity checked for both beta and release on every iteration. A worker restart, binding change, or unavailable producer is not accepted as progress.
• Added offline regressions for slow independent workers, a bounded non-advancing worker, an immediate restart, and a worker disappearing after early progress. 36 tests in tests/test_dot_mcp_acceptance.py passed in an isolated no-network Docker container; Black check passed.
• The new exact-head GitHub CI is still pending. This is offline evidence, not a fabricated real E2E PASS.
• No new OAuth grant, service-account IAM binding, or effect send was made. Original operation 3ad0fe7e-db64-4171-b7b5-4d99bf6c98a9 remains non-replayable while its actual outcome is not confirmed. The P1 real producer acceptance thread stays unresolved; the PR remains Draft pending separately authorized fresh fixture E2E.

[kitamura-tetsuo]

Independent bounded fix on exact prior head df59597b9bb8824ff90b8a54a1a744e351eb2d96, published as 40b431f7 (non-forced fast-forward).

The opt-in fixture acceptance client previously collapsed the live auto_coder_targets array into a dictionary and silently ignored malformed entries. For example, a valid beta/release pair plus a duplicate beta target or malformed third entry could pass the exact-target comparison. This is incorrect for the required current, exact two-target disposable policy.

The client now rejects any non-list, incomplete/malformed target, duplicate, omitted or extra entry, unexpected physical target/repository/channel, or non-OK result before a fixture mutation; two distinct valid bindings remain order-independent. The production MCP tool, OAuth grants, scope and defaults are unchanged. Updated the feature runbook with the refusal behavior.

Evidence on the isolated exact-head worktree: 68/68 focused tests passed via bash scripts/test.sh --ci-tests-only tests/test_dot_mcp_acceptance.py tests/test_dot_disposable_fixture.py tests/test_management_runtime_mcp.py; Black, isort, flake8, git diff --check, and whole-package mypy (334 files) passed. Tests include actual producer response shape and malformed/duplicate entries; no live MCP request, production/beta operation, or fixture mutation was performed.

This only corrects the current-target acceptance boundary. The still-open P1 REQ-007/008/011 real end-to-end fixture acceptance and scheduler evidence remain unmet. Keep this PR DRAFT, leave the P1 thread unresolved, and require all exact-new-head CI gates plus actual producer evidence before considering merge.

[kitamura-tetsuo]

dot adversarial review

Target head: 40b431f.
Issue contract: #2608 updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011. AGENTS.md blob 93c3586c9d71c110e55b0031f2714fb8be619960.

Reconciled the complete 23-file PR and changed-test manifests against reviewed fc962bf. This four-commit increment changes six files: runbook, disposable provisioner, acceptance client and three test files. The other seventeen files are unchanged. No new demonstrated independently actionable implementation violation or qualifying distinct material test-oracle gap was identified in this increment. This is not full-contract acceptance or merge approval.

For REQ-002/007/008/011, traced both authenticated observe and beta-source completion into await_advancing_worker_heartbeats. It retries only HeartbeatNotAdvanced within the observation window; missing/untrusted observations, changed original Supervisor/process/runtime/deployment/source binding and other errors still fail closed. Every selected worker is freshly checked on each iteration, including one that advanced earlier, and success requires all current samples to advance relative to their original stable identities. The added slow-worker, bounded-stale, restart and earlier-worker-restart cases exercise these independent negative predicates. The 150-second polling window concerns reads, not authority to retry a mutation or settle an unknown original effect.

Traced ManagementRuntime.targets through current policy resolution to the actual target_id/repository/channel projection and the client's verify_current_targets gate before any mutation. The new gate rejects wrong status/type/cardinality, missing fields, duplicate and unexpected bindings instead of silently filtering or collapsing them. Tests retain order independence for two correct bindings and reject malformed/extra/duplicate/incorrect targets. These checks do not create an authorization grant.

The fixture provisioner changes only the fixture-private routing mount for beta/release to writable, allowing its ownership lock to be created; management gains no such writable mount. Regression assertions verify those generated mount boundaries. The integration-workflow source assertion now points to the executable argv guard reviewed on the preceding head rather than banning the inert placeholder string. Neither a writable fixture directory nor these offline tests proves a real worker rollout completed.

All-Requirement assessment remains limited: REQ-001/002/005/006/009/010 retain documentary staged authority, ordered evidence, bootstrap and escalation coverage; REQ-003 retains checkpoint bindings. REQ-004's complete real bounded-recovery lifecycle remains unverified. REQ-007/008/011 remain partial: this increment does not implement and independently demonstrate the complete beta acceptance, promotion, separate release activation, recovery/policy-negative and scheduler sequence. Original unknown dispatch is not resolved by later code or reported local tests. Existing P1 #2835 (comment) stays unresolved with sufficient detailed implementation/scenario/oracle guidance; no duplicate reply/thread or resolve is added.

Static source/contract review only. No tests, CI reruns, live MCP, credentials, fixture or runtime operations performed; no exact-head CI/E2E success claimed. Coordination records assign this head to this reviewer. Fresh prepublication reads confirmed open/unmerged draft, unchanged head and Requirements, all reviews and full thread replies/resolution states, with no prior dot review for this head.

[kitamura-tetsuo]

CI follow-up for HEAD 812ca91 (2026-11-12 JST): The previous operator-upgrade production-origin Docker job could not reach an installed beta worker heartbeat because the disposable fake-GitHub worker token triggered the global GitHub /user startup probe. The local isolated HTTPS fixture deliberately answers 404 for that route. Commit 812ca91 includes only this known synthetic worker token in the fixture CLI bypass allowlist; real PATs never go into argv and normal startup reconciliation still runs against the private GitHub HTTPS fixture. Added argv regression coverage. Offline verification: 17 fixture tests passed, Flake8 clean, Black clean. A fresh set of eight CI workflows is running at 812ca91 (Supervisor Integration run 43222163166). P1 authenticated real-worker acceptance is still blocked on separate fresh IAM/OAuth approval; no prior operation was replayed.

[kitamura-tetsuo]

Updated this Draft PR after #2829 / #2827 merged to main, without claiming #2608 acceptance or resolving the remaining P1 thread.

Non-forced merge commit: d4a0c2ff24d5 merges e742338b3f311e6d30a22a8f5341b8072513d813 into the unchanged prior PR head 812ca91bd4d75149103158ab85740f5afea2d67f. GitHub confirms this exact head, base main and mergeability after publication; no force push and no other worktree/branch was overwritten.

The only content conflict was tests/test_release_worker_acceptance_container.py. Kept the PR branch's stronger _await_initial_stopped_supervisor initial signed-bridge check (bounded 45 s, result_code=OK, alive is False, worker is None); removed main's redundant looser _wait_initial_release_inspection helper rather than duplicating validation. No UNKNOWN/ambiguous worker state is counted as STOPPED, and source/worker/effect safety tests were not weakened. The remainder of merged main's production containment changes are preserved in the ancestry.

In an isolated detached worktree, actual merge-tree checks passed: git diff --cached --check, Python syntax compilation of the conflicted file, uv run --offline --locked pytest -q tests/test_supervisor_integration_workflow.py tests/test_ci_pr_supersession_workflows.py (26 passed), and Black/isort/flake8 on the resolved file (all green). The first test attempt could not find uv in the remote shell PATH (exit 127), so the rerun explicitly used the existing trusted installed uv binary; no test was skipped or relaxed. New exact-head GitHub Actions are queued and must all pass before considering merge.

The REQ-007/008/011 real disposable MCP mutation, installed-source/heartbeat, promotion and scheduler evidence remains incomplete, as does the native acceptance P1 thread. Draft stays in place. No management MCP call, production/beta deploy, recovery grant or authentication change was made.

[kitamura-tetsuo]

Resolved a new exact-head CI regression introduced by the main merge, without weakening fixture readiness.

Browser Tests run 43227209630 failed during pytest collection on d4a0c2ff: tests/test_release_worker_fixture_readiness.py still imported the now-removed _wait_initial_release_inspection helper. The merger had preserved a stricter, signed and worker-empty _await_initial_stopped_supervisor helper but missed this cross-test import. This was a real merge integration defect, not an environmental transient; rerunning unchanged CI would not fix it.

Published f288b9c3484bb0f519b45c34a91dcd5e4dd5adfd on the same branch via non-forced fast-forward, verified previous remote head d4a0c2ff. The regression now imports the stronger signed-stopped verifier, while allowing a bounded test-specific timeout; its refusal assertion matches the stricter failure. Never accepts UNKNOWN, invalid signature, a live worker, or an ambiguous state as stopped.

Isolated-worktree local verification: actual socket/bridge/auth tests 3 passed, supervisor and CI configuration regressions 26 passed, Black/isort/flake8 and git diff checks all green. New HEAD is still Draft; fresh exact-head CI is required and #2608 REQ-007/008/011 real disposable producer/worker/promotion/scheduler acceptance and the P1 review thread remain pending. No management MCP / deployed beta/release / recovery effect.

[kitamura-tetsuo]

dot adversarial review

Target head: f288b9c.
Issue contract: #2608 updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011. AGENTS.md blob 93c3586c9d71c110e55b0031f2714fb8be619960.

The assigned d4a0c2f head changed during intake; no stale-head review was posted. Reconciled the current complete 24-file PR/changed-test manifest against prior reviewed 40b431f and current base e742338. The intervening merge imports already-main containment/original-history changes, which are not new #2608 obligations. Separately compared the overlapping fixture/test files against both prior head and current base to distinguish imported main code from this PR's changes and conflict resolution. No new demonstrated independently actionable implementation violation or qualifying distinct material test-oracle gap was identified in the PR-specific increment. This is not full-contract acceptance or merge approval.

The offline fixture adds one exact synthetic token value to the inert-placeholder argv branch, with another actual exec-argv test case. Explicit private scoped-token activation still runs first; real PATs remain in the environment, never this argv branch. Neither the placeholder nor its isolated HTTPS fixture represents actual GitHub authentication or end-to-end rollout acceptance.

Inspected the release fixture merge resolution and new-head follow-up: the real signed WorkerNetworkClient inspection retains the stricter predicate (OK, dictionary data, alive=false, worker=None), replacing main's looser helper instead of retaining two different definitions. The configurable timeout defaults to the prior 45 seconds. All imported same-PID1/recovery and durable-terminal test code is preserved relative to current main. The real-socket readiness test now imports/calls this surviving helper with bounded test timeouts; it exercises actual unavailable transport followed by signed bridge startup, plus unavailable and wrong-key refusal, and checks no worker journal was created. This fixes the stale helper reference after the merge without weakening the stopped-state predicate. These are fixture transport checks, not installed source/heartbeat acceptance.

Current all-Requirement assessment remains limited: REQ-001/002/005/006/009/010 retain documentary staged authority, ordered evidence, bootstrap and escalation coverage; REQ-003 retains original checkpoint bindings. REQ-004's complete real bounded-recovery lifecycle remains unverified. REQ-007/008/011 remain partial: importing main and repairing fixtures does not implement and independently demonstrate the complete beta acceptance, promotion, separate release activation, recovery/policy-negative and scheduler sequence. The original ambiguous dispatch remains unproven, not resolved by a merge or CI report. Existing P1 #2835 (comment) stays unresolved with sufficient implementation/scenario/oracle guidance; no duplicate reply/thread or resolve is added.

Static source/contract review only. No tests, CI reruns, live MCP, credentials, fixture or runtime operations performed, and no exact-head CI/E2E success claimed. Coordination assigns this PR review to this reviewer; parent was informed of the head update. Fresh prepublication reads confirmed open/unmerged draft, current head/base and unchanged Requirements, all reviews and full native-thread replies/resolution states, with no previous dot review for this head.

[kitamura-tetsuo]

Independent #2608 REQ-004 original-send concurrency repair on PR #2835 (2026-11-12 JST).

Published exact commit: 8fd6f5046b434fed2afc651691bccbec44059cbf, normal non-forced fast-forward from verified previous head 7330957b2aeec028226fd2bd59daf4d55f4cd719.

Reproduced defect before fixing: Two independent fixture clients could concurrently call persist_original_ticket for different action filenames but the same beta target, each with a distinct original idempotency key. Both scanned an empty ticket directory before either used its own O_EXCL file create, and both returned RESERVED. The new controlled-overlap pytest failed on the previous exact head with ['RESERVED', 'RESERVED']; merely checking one scenario-specific ticket path did not serialize cross-action admission. The producer's own admission controls are not a substitute for this client's promised durable same-target original-send fence.

Repair: A stable fixture-private Linux flock(LOCK_EX) covers the whole cross-scenario prior-ticket scan and fsynced original intent creation. The separate ticket's O_EXCL|O_NOFOLLOW remains. A replaced, unsafe or unavailable lock fails closed; distinct physical targets still admit their own intents. The lock is not a grant, management authority or evidence that an effect completed. Updated the feature runbook and added deterministic race, unsafe-lock and independent-target regressions.

Verification on uf, isolated detached worktree at the published head:

• Controlled regression failed on the pre-fix source, then passed after the repair.
• 153 passed across tests/test_dot_mcp_acceptance.py, tests/test_dot_mcp_negative_acceptance.py, tests/test_dot_disposable_fixture.py, tests/test_management_runtime_mcp.py.
• Black, isort, flake8 (changed Python files), git diff --check, and whole-package mypy (358 source files) succeeded.
• GitHub accepted the exact new head and started eight new workflows (runs 43242771068, 43242771100, 43242771278, 43242771326, 43242771051, 43242771058, 43242771054, 43242771296). Full exact-head CI remains unfinished.

Acceptance boundary unchanged: PR remains DRAFT. REQ-007/008/011 genuine disposable authenticated MCP rollout, beta-installed/heartbeat acceptance, promotion, separately accepted release activation, physical negative/recovery cases and unattended scheduler/go-no-go remain unproven. The existing P1 live-acceptance thread remains open. This patch made no management MCP calls, production/beta changes, grant/recovery authority modifications or live fixture sends. Do not merge solely on offline tests or green CI.

[kitamura-tetsuo]

dot adversarial review

Target head: 8fd6f50.
Issue contract: #2608 updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011. AGENTS.md blob 93c3586c9d71c110e55b0031f2714fb8be619960.

Reconciled the complete 29-file implementation/test manifest against the contract and inspected the 12-file increment since previously reviewed f288b9c. Reviewed positive/negative CLI paths, independent journal/Git/Actions readback, original-ticket reservation and recovery-budget consumers, physical fixture configuration, changed producer projection and associated regression oracles. No new demonstrated production-code violation or independent qualifying test-oracle gap was identified in this increment; this is not whole-contract acceptance.

REQ-001/002/007/009: the source now implements fixture-bound positive and negative scenario clients, including separate beta acceptance, promotion and release installation. The original finding's initial four-file/missing-client description is historical, not a statement about this head. REQ-003/004/005/010: pending original IDs and tickets remain retained, same-target reservations are locked and persisted, exhausted failure signatures are checked before admission, and unsupported data rollback remains BLOCKED. The sent_unknown promotion continuation is restricted to its original operation; SourceReleaseDispatch.process rereads the journal under its lane lock and dispatches only NOT_SENT, while the unknown path observes the retained run. This does not make generic operation_get a read-only tool.

REQ-006/008/011: the existing P1 thread remains unresolved at the genuine live-evidence boundary. Offline controlled HTTP/policy/journal tests and typed lifecycle projections are not real installed-worker recovery or full beta→acceptance→promotion→release acceptance. No live authenticated rollout or tests were executed by this review. The current PR description also mentions a different head (7330957…), so its test/CI claims were not accepted as exact-head evidence for 8fd6f5. Keep the original live prerequisite/credential blockers and their operation records; neither this COMMENT nor green offline checks is a merge or rollout approval.

No duplicate inline finding was created for the existing P1 root cause. No thread resolution, implementation change, CI rerun or operational action was performed.

[kitamura-tetsuo]

dot adversarial review

Target head: 40338a8.
Contract: #2608 updated 2026-10-25T01:03:54Z, explicit #2608/REQ-001–REQ-011. Read current AGENTS.md and reconciled the complete 29-file implementation/test manifest with the prior reviewed head 8fd6f50. This increment changes exactly the fixture generator, its tests and its operating documentation.

Inspected _source_fixture_revision and its actual call from provision before fixture directory creation. The source has only one read-only /source mount: a host-visible linked-worktree Gitfile or nonempty alternates object store does not establish in-container source availability. The new preflight rejects these inputs before creating a fixture, without repairing or modifying source/history. Existing exact test-repository, clean local main and locked-project checks remain. The new regressions construct real linked worktree/shared clones, hide their donor to independently demonstrate failed Git object reads, then restore it and require preflight refusal; the materialized independent checkout is accepted while its donor remains unavailable. This addresses the affected REQ-005/007/009 bootstrap boundary without claiming those Git tests are authenticated rollout evidence.

No new demonstrated implementation violation or qualifying independent oracle gap was identified in this increment. Static review only; I did not run the tests or an authenticated fixture. The existing P1 live-acceptance thread remains unresolved: the PR reports genuine preparation/observe progress but also retained failed originals and no completed full beta installation→acceptance publication→promotion→independent release activation/recovery sequence. Those claims are not independently verified by this source diff and do not discharge #2608/REQ-008/011. The existing detailed implementation guidance still applies; no duplicate thread/reply was posted. This COMMENT is neither whole-contract acceptance nor merge/rollout approval.

[kitamura-tetsuo]

dot adversarial review

Target head: f535897
Contract: #2608, updated 2026-10-25T01:03:54Z; explicit #2608/REQ-001–REQ-011.

Read current AGENTS.md and the current complete Issue contract; reconciled all 29 implementation/test manifest files with previously reviewed 40338a8. Exactly the fixture generator, its tests and operating documentation changed. This is an incremental correctness review using that prior review as the unchanged-file baseline, not a claim to have freshly re-proven the entire rollout.

Inspected provision's full configuration generation and actual Supervisor fixture entrypoint. Worker code now mounts only src at /code/src or /source/src, alongside explicit fixture scripts and the independently selected test checkout. The former ancestor checkout mount no longer exposes sibling .agent-tmp management credential/peer-state files to the same worker UID. The source-src prerequisite and test-source-containing-fixture guard occur before fixture creation. Explicit per-role runtime, routing, workspace, bridge and reader mounts remain separate; management publication/dispatch paths are not worker mounts.

The seven added parameterized regressions inspect resolved host ancestry rather than only matching secret filenames or assuming read-only means unreadable. They cover both source layouts, expected src/fixture mounts, missing src, and genuine clean independent Git checkouts containing the future fixture directly or through an ancestor. The latter inputs pass the original Git-identity preflight but must refuse before writes. This addresses the affected fixture-isolation/bootstrap boundary under REQ-005/007/009 without introducing runtime Docker authority or claiming live acceptance.

No new demonstrated implementation violation or qualifying independent test-oracle gap was identified in this increment. Static source review only; no tests, credential inspection, container operations or authenticated fixture execution were performed.

The existing P1 thread PRRT_kwDOPZA8nM62JUDp remains unresolved. Source/mount regressions and claimed preauth startup/heartbeat progress do not discharge REQ-008/011's complete authenticated beta installation, acceptance publication, promotion, separate release activation and failure/recovery evidence. The PR still reports these full-path scenarios pending/BLOCKED; this review has not independently verified a complete live evidence chain. The detailed guidance in reply 4552828476 remains applicable and sufficient, so no duplicate thread or reply is added. No previously resolved thread is changed. This COMMENT is not whole-contract acceptance, merge approval or rollout authorization.

Immediately before publication, open/unmerged state, exact head, current full Issue body, all reviews and all thread replies/resolution states were re-read and matched the reviewed baseline.