[kitamura-tetsuo]

Refs #2824. The prerequisite completion scopes in #2839 and #2840 remain separate and open; #2825 owns child launch, application readiness and admission.

Why

A lost continuous-exclusion interval cannot be repaired by retrying an old management root or treating current containment as historical proof. This change implements the host-owned, deployment-fixed, single-use recovery epoch required by #2824/REQ-101–108.

Changes

• Derive and independently verify genuine original genesis and complete retained lineage, including failed successor branches, original journals and affirmative never-created evidence. Missing expected history remains unavailable.
• Join the complete approved controller, Docker, source, root and owner-file scope to current kernel observations. Observe every task, current namespace and listener with actual retained resources; independently revalidate the original evidence and current containment in the issuer invocation.
• Acquire original fences independently SH and retain the fixed deployment/controller EX locks and namespace objects. Authenticate the actual receiving process with kernel peer identity, pidfds, process/boot lifetime and a fresh challenge, then verify its complete custody.
• Persist immutable, file-and-directory-fsynced reservation, intent, consumption and receipt records/heads. Revalidate exact target/source/READY, lineage, containment and custody before consumption and again immediately before the single grant send. Partial persistence, changed evidence, interrupted delivery and host death never permit reset or reissue.
• Add the non-launching recovery bootstrap endpoint, bounded refusal diagnostics, maintained documentation, component regressions and the complete initial-namespace systemd/Docker VM matrix. The receiver retains custody; the separate Launch a replacement from a recovery epoch #2825 consumer owns child launch, readiness and protected admission.
• Preserve the actual native post-receipt READY mutation and stopped-receiver socket oracle. A separate copied-source control removes only the second final verifier; it must be detected by observing the canonical forbidden queued grant, with exact source/fixture maps and unchanged native oracle.

Current verification

Current published head: 65c2ac85572bf6aae49b3a87eebbd07a8add4bba.

The complete nine-workflow verification is running at this head. Native acceptance: run 43336888362, attempt 1. Earlier-head results are diagnostic history and do not supply this head's acceptance. The existing native review thread remains unresolved until all final-head gates and artifacts are verified.

The last four-file correction is limited to fresh-VM preparation, its regression tests and documentation. The guest now stops all six selected stock housekeeping timers before any selected service, then verifies all twelve exact units and protected masks before creating originals or approving routes. Production containment and the native refusal oracle are unchanged.

Local focused verification:

CI=true UV_NO_SYNC=1 PYTHONPATH=.:src bash scripts/test.sh --ci-tests-only tests/test_management_recovery_vm.py -q

Result: 116 passed in 2.35s, exit 0. The new actual-block ordering regression failed against the previous helper at the intended all-timers-first assertion, then passed with the fix. Black, isort, flake8, shell syntax and diff checks passed; the four-file patch received independent review.

Diagnosed prior-head CI failure

At d9d8e9d004acc12964bb648da015e74020254f39, all eight nonnative workflows succeeded, including the actual Supervisor shard that previously failed during held-worker reconstruction. The native matrix's after-receipt-head scenario failed before reaching its selected publication boundary: job 131543555073.

The VM recorded target startup at 23:58:08.1399639 UTC after route approval, followed by dpkg-db-backup.service running from 00:00:00.2218320 to 00:00:00.3340939 UTC. The issuer refused at 00:01:07.623 in the strict per-unit route comparison. The bounded diagnostic did not export the exact mismatching unit name; the measured post-approval backup execution nevertheless changes its full execution readback and independently invalidates its approved digest. The finite six-pair preparation correction addresses that observed scheduling dependency without weakening production comparison.

The completed prior native run passed 30 of 31 ordinary scenarios plus the separate omission control. It passed the real grant/escaped-nonleader/exited-task path, post-receipt refusal, lost-reply, retargeting, separate verifier-omission control and the formerly failing before-receipt-head boundary. Exact replacement-head results are required for completion.

Scope

The supported profile is the documented finite ordinary local-system-Docker deployment with genuine original evidence and separately approved containment/target authority. The implementation preserves unknown original outcomes and existing worker/OAuth state. A successful host grant is not a child launch, current application readiness, incident recovery or acceptance of a legacy deployment with missing original records. Independent prerequisite native obligations in #2839/#2840 remain open; no production enrollment, recovery, controller or worker operation is performed by this PR.

[kitamura-tetsuo]

Independent exact-head correction published as faab92049b630f519312ecdee92c2f1417635de6 (base 5746f228). Failure reproduced first: after reserve(binding A) durably recorded reserved.json and its head, calling record_intent(binding B) with changed authorization, evidence digest, or issuer lifetime refused the incorrect binding but left the same in-memory issuer usable. A subsequent record_intent(binding A) succeeded, so the caller could catch a conflicting post-reservation authority attempt and resume the same epoch. Three new native state tests failed before the fix, then all three passed with the fix. The state machine now marks a reserved invocation failed when binding verification refuses, preventing a caught conflict from continuing durable issuance; already published records are preserved. The design fragment records this fail-closed rule.

Exact-head local verification on isolated uf worktree: 106 passed in tests/test_management_recovery_epoch_state.py (0 skipped); Black 26.10.1, isort, flake8 and git diff --check passed; canonical whole-package mypy passed for 359 source files. Pushed remote branch SHA equals the commit. New exact-head CI must finish independently. DRAFT remains mandatory: this change proves only bounded persistence state behavior. REQ-101–108 integrated original-producer provenance, all retained controllers/current Docker origin closure, independently acquired SH custody, verified consumer handoff, authenticated one-use grant, AS-B01–AS-B05 live producer tests and the supported engine/origin decision remain unresolved. No management MCP query, live recovery/rollout, production or beta effect, or authorization claim was made.

[kitamura-tetsuo]

dot adversarial review

Target head: faab920
Issue contract: #2824, updated 2026-11-12T15:15:53Z; current explicit Requirements only.

Reviewed AGENTS.md, the complete changed-file and changed-test manifest, all added implementation/tests and affected documentation against all Issue Requirements. One inline P1 records the explicitly required native production-entrypoint test deliverable missing from this partial component. No additional demonstrated unsafe production execution is claimed. Components are not full-contract acceptance, readiness or merge approval.

REQ-101–104/106 lack the joined original-lineage, containment, shared-fence and authenticated grant issuer. REQ-105 has bounded fixed-inventory, flock, immutable fsync state and refusal probes but not the complete actual-evidence join. REQ-107 preserves the no-old-root-reuse boundary in the added component; end-to-end exclusion remains unverified. REQ-108's integrated native deliverable is missing.

No tests, CI reruns, runtime operations or implementation changes performed. Prepublication read checks the open/unmerged state, head, current Issue contract and all reviews/threads for conflicts and duplicate findings.

[kitamura-tetsuo]

[P1] Add the explicitly required native production-entrypoint regression deliverable

Classification: missing explicitly required test deliverable (implementation finding), not a demonstrated unsafe production execution and not a generic request for more tests.

Contract #2824/REQ-108 (2026-11-12T15:15:53Z):

Real isolated production-entrypoint OS/Docker tests cover two contenders, busy/replaced locks, unknown controller, escaped/exited task, stale/mutated/missing ancestry, listener conflict, interruption around intent/containment/receipt/grant and host death; fixtures cannot replace live authority. Retain all these integrated production-entrypoint scenarios in this Issue after prerequisite extraction, adding forged, cross-deployment, stale and mutated prerequisite-output cases against the actual producer verifiers; prerequisite component tests do not discharge these integrated obligations, and contention tests must establish the material overlap through observable barriers or receipts rather than merely concurrent process starts.

Head: faab920.

Evidence: The complete changed-file manifest adds only the persistence module, its component tests and the design. The tests call _hold_recovery_epoch with a manufactured inventory and evidence digest; they do not invoke an authenticated recovery issuer, original-lineage and containment verifiers, or a consumer/grant path. hold_recovery_epoch() has a fixed-root unit interception test, not the required production host test.

Concrete missing-regression scenario: Given an authorized isolated deployment with genuine ancestry, a failed branch and two observed overlapping issuer contenders; when recovery admission reaches consumption/grant, the integrated test must prove exact current prerequisite verification and at-most-one grant, then preserve uncertainty across host death. The current tests can still pass with that entire issuer path absent, because they exercise only reserve/intent/consume on constructed component bindings.

Expected: the maintained native regression artifact required above. Actual: component-only coverage, with the integration and its independent oracle absent. Material consequence: a green component suite cannot establish this Issue's merge gate or detect a missing/incorrect production integration. This remains actionable even though the Draft accurately acknowledges incompleteness; no stronger requirement is inferred from that prose.

Fix/verification: Complete the selected production issuer and its independently verified prerequisites, then add maintained isolated OS/Docker tests through that real entrypoint. Establish overlap at a recorded reservation barrier; mutate ancestry, target/READY, controller/task/listener and fences before actual grant, and interrupt around consumption/dispatch. Independently inspect original records, peer custody, grant count and no replay. Keep component tests; do not relabel them as AS-B01–AS-B05.

Static source/manifest review only; no native test run or CI-success claim.

[kitamura-tetsuo]

Re-evaluated at head 355143f, against #2824 Requirements updated 2026-11-12T15:15:53Z.

The former statement that the issuer and integrated driver are absent is no longer true: recovery_epoch.run_issuer()/issue_epoch_once(), the real consumer custody exchange, original producers and scripts/test_management_recovery_epoch_host.py now exist. I am not carrying that old-head absence forward. This thread remains unresolved for the narrower remaining native regression deliverable under #2824/REQ-108, read together with the present-verification invariant in #2824/REQ-106.

Exact #2824/REQ-108:

Real isolated production-entrypoint OS/Docker tests cover two contenders, busy/replaced locks, unknown controller, escaped/exited task, stale/mutated/missing ancestry, listener conflict, interruption around intent/containment/receipt/grant and host death; fixtures cannot replace live authority. Retain all these integrated production-entrypoint scenarios in this Issue after prerequisite extraction, adding forged, cross-deployment, stale and mutated prerequisite-output cases against the actual producer verifiers; prerequisite component tests do not discharge these integrated obligations, and contention tests must establish the material overlap through observable barriers or receipts rather than merely concurrent process starts.

Evidence at this head: run_native_negatives() and _original_negatives() inject their conditions before starting the issuer, require an entirely unreserved epoch, and restore the fixture before the positive grant run. verify_native_containment_reports() exercises a separate containment CLI while the issuer is paused before observation; _check_lineage() separately calls the lineage verifier. The later scenarios kill at publication boundaries or retarget the inventory. None of these injects stale target/READY, lineage or containment evidence into the already-observed issuer between its first successful observation and grant.

Concrete missing-regression counterexample: Given genuine initial observations and acknowledged consumer custody, when a target READY file or current containment fact changes while the same issuer persists its intent/consumption, #2824/REQ-106 requires that issuer to revalidate and refuse stale evidence before grant. The runtime currently calls final_verification() both before and after state.consume(), which is the correct intended defense; this is NOT a demonstrated production-code violation. However, an incorrect implementation omitting those calls can retain the initial checks and pass the existing prepublication negative scenarios, the unchanged positive scenario, and separate verifier tests. The native suite therefore does not protect the material observation-to-grant boundary. A green harness/unit result cannot discharge the explicitly integrated stale/mutated-evidence obligation.

Implementation guidance: extend the existing isolated native driver, not a new synthetic authority seam. Use its actual syscall/publication barrier (for example after intent-head and after receipt-head) to establish that the first observation and custody exchange completed. While that exact issuer is stopped, inject one bounded target/READY or current containment change in the disposable fixture, then release the same issuer. Require independently observed refusal before grant, no consumer grant acknowledgment/child/admission, preservation of original unknown records and unrelated worker state, and no reissue after the now-retained partial/consumed epoch. Keep each uncertain fixture root intact; do not use the prepublication restoration helper after any publication. Add the independently maintained scenario to the executable matrix/result oracle. Cover the selected lineage/profile/target/fence boundaries required by the contract and demonstrate that bypassing the corresponding final verifier makes the focused test fail. Preserve the existing genuine positive, contention and durable-interruption cases.

This is static review of the actual entrypoint and maintained native scenario paths, not a claim that VM acceptance ran or passed. No runtime operation, CI rerun, implementation change or thread resolution was performed.

[kitamura-tetsuo]

Re-evaluated at head 8849652 against #2824 Requirements updated 2026-11-12T15:15:53Z.

The ten new after-intent mutations, actual peer-syscall cases and complete 29-scenario matrix materially address the previous head. In particular, mutate_after_intent() changes genuine objects while the original issuer is stopped; _late_mutation() resumes that issuer, requires refusal, preserves the injected uncertainty and rejects replay. I am not treating the old absence of those tests as current evidence.

A narrower material test-oracle gap remains at the second final verification, after durable consumption/receipt and before grant. This is not a demonstrated unsafe runtime implementation: issue_epoch_once() currently revalidates there. #2824/REQ-106 expressly requires revalidating lineage, profile/containment, target/source/READY and fences in the same issuance invocation before grant; #2824/REQ-108 explicitly requires integrated stale/mutated evidence and interruption coverage around containment/receipt/grant. The exact REQ-108 text is retained in the opening comment.

Evidence: _selected_boundary() sends every LATE_MUTATION_SCENARIOS entry to intent-head.json. The after-receipt-head boundary scenario kills the issuer rather than changing its observed evidence and letting it continue. lost-reply stops the receiver and verifies issuer death after a successful send, not a changed authority input before dispatch. Thus all new late mutation refusals occur before the first final_verification() succeeds. No current scenario distinguishes the second revalidation from its omission.

Concrete oracle counterexample: Given real initial observations, acknowledged custody and successful pre-consumption final verification, when the exact READY receipt or controller fact changes while the issuer is stopped after receipt-head publication, #2824/REQ-106 requires refusal before grant. An incorrect implementation retaining the first final_verification() but removing only the post-consumption one could still pass all ten intent-boundary mutations, unchanged positive grants, kill-only publication cases and the lost-reply case. It would lack regression detection for a material stale-evidence dispatch boundary.

Correction: reuse the actual publication barrier at after-receipt-head; inject a bounded genuine READY/configuration or containment mutation into that same invocation, release it, and independently require no grant send/consumer acknowledgment/child/admission. Keep the already-consumed receipt/history intact, preserve the deliberate mutation and unrelated workers, and prove replay refuses without repair. Add this distinct scenario to ACCEPTANCE_SCENARIOS/required_cases and result assertions. Do not reset an epoch to obtain a second attempt. A focused mutation check removing only the second final verifier must fail the new scenario; component mocks or killing the issuer cannot supply this oracle.

Separately, the current maintained task/listener negative couples an out-of-cgroup network task with a listening socket; it is not evidence of an independently exercised escaped nonleader/exited-task condition. The PR body correctly acknowledges that remaining REQ-108 scenario, so no duplicate thread is opened for the already-tracked integrated deliverable.

Static review only: no native test execution or CI-success claim. Existing thread remains unresolved, not because the old missing issuer persists, but because the currently required integration oracle is still incomplete.

[kitamura-tetsuo]

CI precondition diagnosis (no bypass or status promotion): On exact PR HEAD 5accde9fdca9db25bbcc998c6aa6010a7815a482, Management Recovery Epoch Acceptance run 43254220388 failed in all four isolated-VM scenarios (grant, lost-reply, kill-after-intent, kill-after-consume) at the step Require actual hardware virtualization. The step executes test -c /dev/kvm, test -r /dev/kvm, test -w /dev/kvm and exits 1 before VM acceptance; artifact upload subsequently reports no output files. This is not evidence that a recovery epoch was accepted or that the implementation failed inside the VM. The available log does not identify which KVM predicate failed.

The authorized uf host has a readable/writable /dev/kvm device, but that host observation is not a PR acceptance run and grants no management/recovery authority. A properly isolated native acceptance run on an eligible KVM runner remains required. Do not skip the KVM precondition, replace native tests with component fixtures, waive the failed gate, or merge while REQ-108 and upstream #2839/#2840 remain unmet.

[kitamura-tetsuo]

dot adversarial review

Target head: 355143f
Owning contract: #2824, updated 2026-11-12T15:15:53Z, explicit REQ-101 through REQ-108. No obligations are derived from the tracking parent or implementation prose.

The complete 58-file changed manifest and changed-test manifest were retrieved and mapped to the contract. This pass inspected the issuer's original-lineage/containment/READY join and consumption/grant sequence, protected authorization/state/resources, peer-custody implementation, and the complete native recovery driver plus negative/report-verifier scenario paths and their test inventory. AGENTS.md was read. This is a focused static review, not a claim of exhaustive verification of every added prerequisite implementation or of a native test run.

The earlier head's lack of any issuer/integrated driver is superseded by substantial new implementation. The same native-test obligation remains open in its existing inline thread, now narrowed to the unprotected observation-to-grant mutation boundary: current-head evidence and detailed correction guidance. No duplicate finding/thread was created. Classification: missing explicitly integrated regression protection under #2824/REQ-108, not a demonstrated unsafe runtime execution. The runtime currently performs final verification before and after consumption; the maintained native scenarios do not prove that boundary rejects facts changed after initial observation.

Contract coverage:

• #2824/REQ-101: issuer invokes derive_lineage/verify_lineage and joins complete retained scope; exhaustive original-producer correctness is INCONCLUSIVE in this pass.
• #2824/REQ-102 and #2824/REQ-103: actual observation and current verifier are invoked, with controller/kernel negatives; full closed-profile correctness remains INCONCLUSIVE, and late mutation protection lacks the integrated oracle described in the thread.
• #2824/REQ-104: source acquires O_NOFOLLOW independent SH locks, validates object/protection and kernel custody; full host execution not established here.
• #2824/REQ-105: fixed protected inventory, irreversible four-phase append/heads, retained canonical evidence and conflicting-binding poison are present; native acceptance across all publication boundaries is not established here.
• #2824/REQ-106: the code retains authenticated challenge/custody and consumes before send, then rechecks; do not substitute separate verifier tests for its current grant-boundary regression obligation.
• #2824/REQ-107: the inspected join rejects overlapping old roots and the state machine has no repair/reissue path; no live incident applicability or complete preservation proof is claimed.
• #2824/REQ-108: actionable remaining obligation is tracked in the existing thread. The four-entry CI matrix is not evidence that all supported native scenarios ran.

This review is not a no-findings result, full-contract acceptance, merge approval, or proof that the draft is complete. Unverified areas remain INCONCLUSIVE and must not be recorded as requirement acceptance. No code, CI, worker, enrollment or deployment operations were performed. Open/unmerged state, exact head, unchanged Requirements and current full thread/review state were checked immediately before publication.

[kitamura-tetsuo]

dot adversarial review

Target head: 8849652
Issue contract: #2824, updated 2026-11-12T15:15:53Z; explicit REQ-101–REQ-108 only.

This completes the continued static requirement assessment begun at 355143f, including the formerly uncompleted original-genesis/full-lineage and closed-profile/containment implementation inspection. The complete prior 58-file manifest and this head's ten-file incremental manifest (60 changed files total) were reconciled. Production implementation paths, relevant component-test evidence, the native driver, negative injections, actual peer/syscall helper, late-mutation helper and VM/CI wiring were inspected. This is not a claim that every test body was dynamically exercised or that native acceptance passed.

The substantive fixes are recognized: all ten intent-boundary mutations now use actual original issuer observations, four native peer fault paths are present, and CI derives its 29-case matrix from ACCEPTANCE_SCENARIOS with an aggregate failure gate. The old “issuer absent” and “no late mutation scenarios” statements do not describe this head.

Remaining actionable assessment is retained in the existing native thread, not duplicated: current-head evidence and implementation guidance. Classification is a material test-oracle gap for post-consumption/pre-grant revalidation, not a demonstrated unsafe production execution. Intent-boundary mutations do not discriminate omission of only the second final verifier; receipt-boundary kill and lost-reply tests do not inject a changed authority before dispatch. The separately acknowledged escaped nonleader/exited-task integrated scenario also remains unestablished. The thread is not resolved.

Requirement assessment:

• #2824/REQ-101: genuine original root/genesis capture, expected-store checks, retained failed/unknown outcomes and reverse history frontier feed derive_lineage/verify_lineage; no new demonstrated violation found in the inspected production path. Legacy missing evidence is not converted.
• #2824/REQ-102–103: fixed enrollment joins complete selected originals/target/watchers with source/config/mount closure, original namespace resources and current controller/Docker/kernel observations; cached success is not the grant authority. No demonstrated new runtime violation found; task and grant-boundary regression coverage remains qualified above.
• #2824/REQ-104: original canonical protected O_NOFOLLOW objects, independent SH acquisition and kernel lifetime/acquirer checks are present, including refusal of inherited-as-independent custody.
• #2824/REQ-105: deployment-fixed protected inventory, exact evidence binding, irreversible fsync record/head chain and conflicting/partial-state refusal remain; expanded matrix is an artifact, not proof its cases have passed.
• #2824/REQ-106: authenticated challenge/peer and complete resource custody precede consumption, with actual current revalidation on both sides of consumption; second-boundary regression oracle remains the actionable gap.
• #2824/REQ-107: original roots/outcomes and uncertain epoch are preserved by refusal paths; no retry/repair or implicit worker/OAuth/controller operation was found in issuer code. Disposable test injections are separate from production authority.
• #2824/REQ-108: substantial integrated native artifacts are present, but the retained thread records the remaining specific oracle/integrated-deliverable limitations.

No implementation, native test execution, CI rerun, runtime operation, merge approval or full-contract acceptance is asserted or performed. Open/unmerged state, exact head, unchanged contract and every current review/thread were freshly checked before posting. This head is reviewed, not accepted; native execution evidence remains unverified.

[kitamura-tetsuo]

dot adversarial review

Target head: 080bd7c
Owning Issue contract: #2824, updated 2026-11-12T15:15:53Z, explicit REQ-101 through REQ-108 only.

Reviewed the complete 67-file current manifest and all 30 files changed since reviewed head 8849652, including implementation changes, changed-test artifacts, native driver/fault paths, VM preparation and aggregate CI wiring. AGENTS.md and current Requirements were reacquired. The prior full static production-path assessment is retained only for unchanged source; new code and its independent oracles were inspected rather than inferred from the PR description.

No additional demonstrated production violation or new material test-oracle gap was identified in this static pass. The earlier missing post-consumption oracle is now specifically addressed in source:

• post-receipt-ready-mutation selects the fsynced receipt-head boundary, changes the exact authorized READY file in place and resumes the same issuer.
• observe_post_receipt_dispatch pins the original issuer and stopped receiver, authenticates the actual socket, checks its initially empty queue and independently peeks real bytes while retaining socket flags. A refusal must have actual issuer exit 2 with no queued grant.
• _post_receipt_mutation preserves all consumed publications, the deliberate fault and unrelated workers, requires no child/admission, and checks replay refusal without repair.
• The separate mutation-control artifact removes only the second final_verification after state.consume, checks the AST/source delta and the complete executing package/fixture identity, and runs the same oracle. Only the specifically observed canonical queued grant can produce mutation-detected; generic errors, timeout, killed processes and logs cannot.
• The escaped nonleader artifact now observes actual distinct leader/TID namespaces outside the original cgroup without a confounding listener, invokes the real issuer for refusal, and additionally rechecks the same retained lifetime after an independently measured unreaped exit.
• Factory override, original missing-lock, late target-loss and failed-branch terminal-evidence cases are connected to required result inventories. CI selects all 31 production scenarios and a separate omission control, requiring both in its aggregate gate.

The earlier statements that these artifacts do not exist are therefore superseded. The existing thread remains unresolved: a resolution attempt did not apply, and readback confirms its state. Static artifact correction is not being represented as successful native execution. Exact-head Management Recovery Epoch Acceptance run https://github.com/kitamura-tetsuo/auto-coder/actions/runs/43272971916 was queued when checked. Actual scenario and omission-control execution evidence remains INCONCLUSIVE, not a passed REQ-108 acceptance gate. No duplicate finding or renewed instruction to implement already-present artifacts is posted.

Other changed boundaries:

• #2824/REQ-101/107: fixture-only finalization occurs before recovery preparation/baselines, limits itself to six identified stopped A/B/C stores, rejects nonempty transaction state and verifies unchanged database bytes and identities; never-created D is untouched. Production unknown-history/quarantine refusal is not weakened.
• #2824/REQ-102/103: ordinary single-config proxy capture remains strict; recovery selects the existing separate stock-proxy path and explicitly bounds mount effects. No new closure exception was found.
• #2824/REQ-104/105: unchanged fixed-inventory/independent-lock and durable-state paths remain subject to the previous assessment; new native overrides and custody checks strengthen their test artifacts.
• #2824/REQ-106: the issuer still has both current revalidations; the test source now distinguishes omission of the second one.
• The uv authorization change preserves the full bounded version banner for exact installer equality, not numeric-prefix acceptance. SQLite readers explicitly close connections on success/refusal; corresponding tests distinguish actual handles from garbage-collection timing.

This is a completed static assessment, not merge approval, contract acceptance, native CI success or incident recovery. No implementation, runtime, enrollment, restart or CI-rerun operation was performed. Open/unmerged status, exact head, unchanged contract and all current thread/review states were rechecked immediately before publication.

[kitamura-tetsuo]

Independent exact-head verification of fd141fff36ec05776e9995efacd4e9c7a82fd445 on the authorized uf host (2026-11-13 JST):

• The earlier native CI grant VM job 131385382546 genuinely booted Linux/systemd/Docker and reached scripts/test_management_recovery_epoch_host.py::_finalize_original_stores, then rejected the additional management-readiness.sqlite3 produced by authenticated runtime readback as an unknown historical store. This was a fixture classification bug, not an observed successful recovery or a reason to waive full native acceptance.
• Independently reproduced the old-head failure locally before correction. Concurrent work on this PR already published 25d8e197 covering the same fix, so no duplicate commit or branch push was made.
• Fetched and tested the published latest head fd141fff: PYTHONPATH=src:. python -m pytest -q tests/test_management_recovery_epoch_host.py tests/test_management_recovery_epoch_mutation_control.py tests/test_management_recovery_fixture_finalization.py tests/test_invocation_process_supervisor.py::test_cancelling_one_owner_does_not_stop_peer_or_delete_results using Python 3.12 -> 200 passed, 2 benign subprocess buffering warnings in 8.08s. The test selection includes the fixed original-readiness fixture and the earlier high-load cancellation regression.

Still blocked: complete final-head native KVM/TCG VM matrix, verifier-omission control, AS-B01–AS-B05, prerequisite #2839/#2840 and unresolved P1 native-review thread. Targeted green tests do not satisfy those gates. Keep Draft; no recovery authority or live deployment was exercised by this independent verification.

[kitamura-tetsuo]

New exact-head native VM failure diagnosis for Draft PR #2838 at fd141fff36ec05776e9995efacd4e9c7a82fd445 (2026-11-13 JST), separate from the prior readback-store fixture correction:

• Management Recovery Epoch Acceptance run 43278614525 reached actual ordinary A/B/C original generations, a failed D branch, original-finalization, independent issuer contention and installed target-source proof in real isolated Linux/systemd/Docker VMs. The previous unknown store or directory failure was not the terminating failure on this head.
• The lost-reply, retarget-after-reservation, before-reserved, and verifier-omission control jobs failed before their ptrace-selected durable publication boundary. The fixture's final assertion is actual issuer exited before the selected publication boundary; this is secondary.
• Actual issuer diagnostic retained in the lost-reply artifact 13970919682 is: Recovery epoch unavailable; preserved evidence is not repaired: recovery epoch state unavailable: current recovery containment unavailable: approved external namespace pin cannot be independently retained (the issuer's nonzero exit is expected from fail-closed). This originates from _external_namespace_pin in src/auto_coder/management/containment_kernel_subobservation.py; its generic wrapper catches OSError, ValueError, IndexError, or UnicodeError, so the available artifact does not identify the underlying syscall/errno or prove which operation failed. Do not assume a permissions cause or relax the pin check.
• The earlier exact-head 200 bounded tests passed only demonstrate local component/fixture behavior. These four real native failures are not positive AS-B acceptance evidence. Inspect the chained exception/errno in a next isolated VM, retain independent namespace-object and holder-lifetime verification, and repair only the demonstrated in-scope boundary; rerun the complete actual VM matrix and omission control.

No production or beta deployment, recovery authority, or management MCP action was taken. Draft and P1 review must remain until the full native gates pass.

[kitamura-tetsuo]

dot adversarial review

Target head: 4dbab24
Owning contract: #2824, updated 2026-11-12T15:15:53Z; explicit REQ-101 through REQ-108 only.

Reconciled the complete 71-file changed implementation/test manifest and inspected all nine incremental file patches since reviewed 080bd7c, including the corresponding production readers and fixture boundaries. Unchanged source retains the earlier full static assessment, not an assertion that CI ran. Current AGENTS.md, Requirements and every existing review/thread were reread.

No additional demonstrated production violation or material oracle gap was identified in this delta. In particular:

• #2824/REQ-101/107: fixture finalization now enumerates the actual twelve original A/B/C authority stores, not the previous incomplete six-store set. The separately produced A/B readiness databases are required and byte/identity-preserved, not checkpointed or treated as ancestry authority; unresolved C readiness remains forbidden. Every store and sidecar is validated before any checkpoint. Missing/unknown stores and nonempty transaction state still refuse, D remains untouched, and production quarantine behavior is unchanged. Tests now use the actual store constructors and distinguish readiness observations from original authority. This is a fixture correction, not proof that existing incident history can be repaired.
• #2824/REQ-102–106: the only issuer delta adds bounded causal code-location diagnostics after refusal. It changes neither containment predicates, same-invocation revalidation, fence custody, consumption nor grant dispatch. Diagnostic tests cover explicit cause chains, cycles, bounded depth and omission of inner exception contents/locals.
• #2824/REQ-108: the post-receipt READY mutation, same-socket oracle, independently observed escaped/exited task and isolated second-verifier omission-control artifacts remain present. Old-head claims that these artifacts are absent must not be carried forward.
• The incidental worktree patch suppresses command-local Git index stat refresh during patch capture; its regression uses real metadata-only changes and checks exact caller-index bytes before/during/after preparation. The concurrent-owner test restores real sleep without dropping cancellation, peer/result preservation assertions or deadlines. Neither change supplies recovery acceptance evidence.

The existing native-regression thread remains unresolved. The prior resolution refusal has not been retried or bypassed. Exact-head native run https://github.com/kitamura-tetsuo/auto-coder/actions/runs/43281513858 was queued when checked; PR Tests and other checks were not all complete. New source, component-test claims and earlier-head CI results do not establish final-head native acceptance.

Remaining evidence is concrete: successful production-entrypoint results at this exact head for the maintained scenario inventory, including post-consumption READY refusal with retained history/no replay, independently measured escaped/exited tasks, plus the separately classified omission-control result showing detection of the canonical queued grant. A setup/current-containment refusal, generic error or timeout cannot substitute for those outcomes. The PR's new causal diagnostics are not themselves a fix for an unidentified failing predicate. No further code defect is asserted without evidence establishing its cause.

Static assessment is complete; actual native behavior/contract acceptance remains INCONCLUSIVE. This COMMENT is not merge approval, acceptance, recovery completion or a thread-resolution claim. No code, CI-rerun or runtime operation was performed. Open/unmerged state, exact head, unchanged contract and current review/thread state were checked immediately before publication.

[kitamura-tetsuo]

Exact-head native acceptance failure evidence at db3e3d7aa77c2058194170e7da15da744bc8916e (2026-11-13 JST); not a passing mutation control or an authorization signal.

• Management Recovery Epoch Acceptance / mutation-control job 131430162774 exited 1. Its uploaded VM evidence artifact 13976352912 has status=failed.
• The original A→B/C/D fixture progressed, but the actual issuer refused before the selected post-consumption publication boundary, reporting current recovery containment unavailable: approved external namespace pin cannot be independently retained. Consequently the fault tracer raised AssertionError: actual issuer exited before the selected publication boundary. This does not establish that the intentionally omitted verifier was detected at its intended boundary.
• Bounded stack origin: recovery_epoch_state._hold_recovery_epoch → recovery_containment.observe → _external_namespace_pin. The artifact does not preserve a verified failing syscall/errno; do not infer EPERM or weaken the namespace predicate. The failure-only systemd catalog snapshot had 350 approved and 350 observed units, no added/removed unit names; observed original SQLite sidecars were absent. Artifact does not establish complete original/worker preservation (preserved_originals=false, preserved_workers=false), so no positive native acceptance claim follows.
• Next in-scope repair: instrument the exact namespace FD/pidfd acquisition and retention refusal with bounded syscall/errno evidence, correct the isolated producer/holder fixture or implementation as demonstrated, then rerun the unmodified native mutation-control and all AS-B01–B05 jobs at the final exact head. Keep Draft, open P1 and unchanged authority/refusal rules.

No management MCP, production/beta deployment or recovery grant was used in this diagnosis.

[kitamura-tetsuo]

dot adversarial review

Target head: db3e3d7
Owning contract: #2824, current saved version updated 2026-11-12T19:22:02Z; explicit #2824/REQ-101 through #2824/REQ-108. Requirements were reread, not inferred from labels or PR prose.

Reconciled the complete 73-file implementation/test manifest and inspected every patch in the nine-file delta from reviewed 4dbab24, together with the actual cron scope producer, route-manifest consumer and repeated-observation boundary. Unchanged source retains the prior full static assessment. AGENTS.md was reacquired.

No additional demonstrated implementation violation or material test-oracle gap was identified in this static assessment:

• #2824/REQ-102/103: recovery-only _cron_approval_binding excludes unrelated cgroup directory identities from the comparison with historical route approval, not from current evidence. Required inhibited roots, their ancestors/descendants, missing/empty facts, mount/boot identity, source/mask/controller bindings remain compared. _cgroup_snapshot still enumerates the actual tree and process/thread memberships; the actual route reader's repeated observation still compares complete cron values, including unrelated directories. Ordinary v1/v2 profiles retain their exact historical comparison. The regression probes distinguish unrelated add/remove/recreate from inhibited-scope changes and verify refusal when even an unrelated scope changes during the fresh observation. No exemption for live inhibited tasks or unknown systemd routes was found.
• #2824/REQ-108: the VM now establishes its specific Docker-managed-containerd/private-mount service profile before any original fixture history or approval exists. It verifies actual daemon command/lifetime, managed child, namespaces, empty engine and systemd cgroup driver. Production systemd-catalog equality is not relaxed. This demonstrates the intended fixture setup in source, not successful native acceptance or support for every Docker service profile.
• The actual archived-cutover fixture now re-reads terminal status after authenticated whoami and requires every non-status field to match that same launch. Its component tests reject altered observation/child identities, nonterminal status, incorrect principal and missing unauthenticated refusal. These mocks test the fixture oracle only; they are not native readiness evidence.
• Post-failure catalog diagnostics retain bounded differences and preserve the original error; they neither overwrite approval nor convert refusal to success.
• #2824/REQ-101/104–107 issuance, lineage, fixed inventory, original fence custody, irreversible consumption and same-invocation final verification are unchanged by this delta. Their earlier static assessment is not promoted to execution proof.

The existing native-regression thread remains unresolved. The previously missing post-receipt mutation/omission-control and escaped/exited-task artifacts are present; their old absence is not a current finding. The prior resolve refusal was not retried or bypassed because no new exact-head successful native evidence was established.

At inspection, exact-head PR Tests, Browser Tests, OpenCode Live Tests and NEW acceptance were successful, but Management Recovery Epoch Acceptance https://github.com/kitamura-tetsuo/auto-coder/actions/runs/43288943214 was queued. Those other successes do not prove #2824/REQ-108. The needed evidence remains actual exact-head production scenario outcomes, especially same-issuer post-consumption READY refusal with preserved consumed state/no replay, independently measured escaped/exited tasks, and the separately classified omission-control detection of the canonical queued grant. Setup errors, generic refusal or timeouts cannot substitute for these outcomes.

Static review is complete; native execution/contract acceptance remains INCONCLUSIVE. This is not merge approval, a runtime recovery result or a thread-resolution claim. No implementation, CI rerun or runtime action was performed. Open/unmerged state, exact head, current contract and all reviews/thread replies were freshly checked before posting.

[kitamura-tetsuo]

dot adversarial review

Target head: f56a851
Contract: #2824, saved version updated 2026-11-12T19:22:02Z; explicit #2824/REQ-101 through #2824/REQ-108 only.

Reconciled the complete 75-file changed implementation/test manifest, inspected all eight incremental file patches since db3e3d7 and the affected actual watcher producer, source/config reader and current-containment consumer. Unchanged paths retain the prior full static assessment. Current AGENTS.md, Issue Requirements, all reviews and all native-thread replies were reacquired.

No additional demonstrated production violation or material test-oracle gap was identified in this delta. The previous masked-unit/effective-command mismatch is addressed by a concrete recovery-only source path, not by omitting technical inhibition:

• #2824/REQ-102/103: RecoveryWatcher now requires a bound original unit_source. observe_recovery_watcher_unit reads the actual manager UnitPath, requires one protected mask above exactly one retained fragment, rejects aliases, competing fragments and unit/dash-prefix/type-wide drop-ins, and repeats both selection and byte/identity reads.
• _literal_command permits only the finite simple/Restart=no profile and the observer's exact literal interpreter, isolated/no-bytecode module invocation and exact bound configuration. A different venv pointing at the same Python binary is not treated as the same selection.
• _watchers still verifies the actual installed proxy_watch_cli module, protected configuration, original manager/proxy/image/config binding and the exact existing proxy-watch.lock. Current route inhibition, zero MainPID and no pending daemon reload remain required. The retained unit is added to the selected original-file scope, and returned observation facts retain its load-path/mask evidence.
• The real WatcherFixture starts that exact module/service, waits for its actual attached observation, then stops and masks it while retaining the original /run fragment; enrollment selects that object. Component tests exercise real protected files and deliberate source/inode/mask/alias changes, but mock UnitPath and do not establish native systemd acceptance.
• #2824/REQ-101/104–107 lineage, original fences, durable issuance, current revalidation and no-repair boundaries are unchanged. This reader does not unmask, modify a controller, enroll an operational host or authorize a grant independently.

The existing #2824/REQ-108 native-regression thread remains unresolved. Post-receipt READY mutation, the second-verifier omission control and independent escaped/exited-task artifacts remain present; their earlier absence is not a current finding. Actual exact-head native results are still required to establish those paths execute and the oracle discriminates the prohibited behavior. No resolution was retried after the prior rejection.

At inspection, PR Tests, Browser Tests and NEW acceptance succeeded at this head; OpenCode remained in progress and Management Recovery Epoch Acceptance https://github.com/kitamura-tetsuo/auto-coder/actions/runs/43292613031 was queued. These states do not establish native recovery acceptance, and a new head alone does not prove the earlier failure resolved.

Static assessment is complete; native behavior/contract acceptance remains INCONCLUSIVE. No new duplicate thread was created and no already-present implementation was demanded again. This COMMENT is not merge approval, recovery completion or thread resolution. No implementation, CI-rerun or runtime operation was performed. Open/unmerged state, exact head, unchanged contract and all current reviews/thread replies were checked immediately before publication.

[kitamura-tetsuo]

dot adversarial review

Target head: fb1fc14
Owning contract: #2824, saved version updated 2026-11-12T19:22:02Z; explicit #2824/REQ-101 through #2824/REQ-108 only.

Reconciled the complete 77-file implementation/test manifest and inspected all 15 incremental file patches since f56a851, including production diagnostics, actual fixture readiness/maintenance paths and their changed regression oracles. Unchanged source retains the prior full static assessment. Current AGENTS.md, Requirements and all existing reviews/native-thread replies were read.

No additional demonstrated production violation or material test-oracle gap was identified:

• #2824/REQ-102/103/107: the maintenance change is confined to fresh VM preparation before original producers and recovery approval. It stops the exact tmpfiles timer first, then its service, verifies stopped facts, masks only that pair and independently repeats actual systemd inhibition observations. Existing masks, failed stops, nonzero PID, pending reload and changed final evidence fail preparation. It does not relax the production whole-route comparison or repair an already-approved operational host.
• #2824/REQ-108: fresh cutover now separates bounded prelaunch source work from the bounded HTTP-readiness phase. The actual in-container launch read joins original fresh status to observe_supervisor, matching owner/child identity, running phase and the existing configured observation window. The retained expected launch must match before and after authenticated whoami; terminal success remains mandatory. Controlled regression cases cover changed launches, expired/oversized windows, nonterminal outcomes and budgets that do not renew on retries. These tests inspect the fixture oracle, not native execution success.
• The containment CLI shares bounded causal metadata with the issuer, drains queued logging before its final JSON result, and preserves refusal status and non-authorizing fields. NativeContainmentFailure carries validated metadata into a separate failed-result field so later log truncation cannot erase code locations. The tests exercise actual asynchronous subprocess output ordering and failure-artifact preservation without converting the mocked observer into authority.
• Scenario ordering moves post-receipt mutation earlier without dropping any of the 31 cases. The independent omission control remains outside production scenarios, and the aggregate still requires both production matrix and control.
• #2824/REQ-101/104–106 lineage, original lock custody, fixed inventory, irreversible consumption and fresh grant-boundary verification are unchanged. The diagnostics refactor does not add an alternate successful issuance route.

The existing native-regression thread remains unresolved. The required source artifacts are present; old statements that the issuer, post-receipt oracle or independent task scenarios are absent are not current findings. Exact-head native evidence is still unestablished: Management Recovery Epoch Acceptance https://github.com/kitamura-tetsuo/auto-coder/actions/runs/43305843374 was queued when checked. PR Tests, Browser Tests, OpenCode, NEW and Test Source for Runtime succeeded, but cannot substitute for those native scenario outcomes or the separate omission-control discrimination. No resolve retry was made after the prior rejection.

Static assessment is complete, while actual native behavior and full contract acceptance remain INCONCLUSIVE. Required follow-through remains exact-head execution evidence for the maintained scenario inventory, including post-consumption mutation refusal/no replay and escaped/exited-task outcomes, plus the distinct canonical-grant detection by the omission control. Generic refusal, setup failure, timeout or unrelated green checks do not satisfy that evidence.

No duplicate finding or demand to implement already-present artifacts was added. This COMMENT is not merge approval, native acceptance, runtime recovery or thread resolution. No implementation, CI rerun or operational action was performed. Open/unmerged state, exact head, unchanged current contract and complete review/thread state were freshly checked before publication.

[kitamura-tetsuo]

dot adversarial review

Target head: d9d8e9d
Owning contract: #2824, saved version updated 2026-11-12T19:22:02Z; explicit #2824/REQ-101 through #2824/REQ-108 only.

Reconciled the complete 81-file implementation/test manifest and read every patch in the five-file delta since fb1fc14, the affected full procfs/cgroup observation path and worker lifecycle identity/retained-receipt gates. Unchanged source retains the preceding full static assessment. Current AGENTS.md, Requirements and all native threads/reviews were read.

No additional demonstrated production violation or qualifying material oracle gap was identified:

• #2824/REQ-102/103: the cron observer retries only a distinct, independently confirmed PID/TID-inventory disappearance/change. It discards the whole incomplete pair and requires two new complete matching observations within three attempts. Source/controller/boot/mask bindings from incomplete attempts remain refusal anchors. Still-listed missing evidence, empty live task lists, malformed data, permission errors and positively observed inhibited tasks/schedulers do not enter that retry path. Current cgroup inventory, mount and final directory-identity checks remain intact; this is not permission to skip a task or reuse a partial successful result.
• Regression probes exercise the actual paired reader with filesystem inventories, disappearance during either half, independent nonleader disappearance, finite churn, missing/invalid evidence, later-added inhibited tasks and protected-source changes. Source/systemd observations are controlled in these component probes; they are not native acceptance evidence.
• The worker lifecycle delta returns the retained operation unchanged when its second Supervisor check differs. The next _process_locked iteration applies the existing exact durable-receipt gate; it does not dispatch a new effect, change the original deadline or unconditionally adopt the replacement. The regression drives the real dispatcher/SQLite journal with typed controlled Supervisor observations and checks complete/pending/conflicting/missing/expired receipts, original correlation fields, no duplicate effect and retained lane. No new worker obligation is inferred from #2824 context.
• #2824/REQ-101/104–107 original lineage, independent fences, fixed inventory, consumption, same-invocation verification and no-history-repair paths remain unchanged.

New exact-head native evidence is material, but partial. Run 43321049334 attempt 1 checks out this exact SHA and verifies the installed fixture source. In omission-control job 131543550925, the real receipt-head mutation was followed at 22:50:08 UTC by observation of the complete consumed grant queued for the stopped actual receiver, and the unchanged forbidden-grant oracle detected the copied-source mutant. This is not merely a green status or generic failed mutant. In normal post-receipt mutation job 131543551653, the actual publication stop/mutation was followed by all eleven required native cases passing at 22:51:44 UTC. These logs materially address the narrower second-verifier concern.

The complete #2824/REQ-108 deliverable remains INCONCLUSIVE: the exact-head grant/task path and numerous interruption/late-mutation scenarios were still running or queued, including before-receipt-head. The prior head's failure to reach that boundary is neither asserted to persist nor declared repaired by this new commit. Existing thread remains unresolved; no rejected resolve operation was retried or bypassed. Already-present artifacts are not requested again, and no duplicate finding was opened.

Static assessment complete; not full native acceptance, merge approval, runtime recovery or a thread-resolution claim. No code, CI-rerun or operational action was performed. Open/unmerged state, exact head, current contract and complete reviews/thread replies were freshly checked before publication.

[kitamura-tetsuo]

dot adversarial review

Target head: 65c2ac8
Contract: #2824, saved version updated 2026-11-12T19:22:02Z; explicit #2824/REQ-101 through #2824/REQ-108 only.

Reconciled the complete 81-file implementation/test manifest and inspected all four changed files since d9d8e9d, including the actual guest setup placement, extracted maintenance code and parameterized regression oracles. AGENTS.md, current Requirements and all existing reviews/thread replies were reacquired. Unchanged implementation retains the previous full static assessment.

No additional demonstrated production violation or material test-oracle gap was identified in this delta. The change extends the disposable VM's finite pre-original maintenance profile from one to six named timer/service pairs. It stops all selected timers before any selected service, refuses preexisting masks or unavailable/failed initial units, verifies actual stopped state, installs only those exact masks, then reobserves the complete inhibited facts and mask identities. This happens before original producers, approval and the omission-control copy. It does not refresh existing approval after a failure or weaken the production catalog/digest comparison. The separate stock-route fixture still owns motd-news.

The tests execute the guest's actual extracted preparation block and real systemd parser against controlled systemctl readback and real mask files. They assert all-timers-before-services, every selected unit, per-pair failed stops/missing state/wrong mask/changed mask and preserved preexisting masks. These are component evidence for fixture setup, not proof of a native recovery run.

#2824/REQ-101–107 production lineage, containment predicates, independent fences, irreversible epoch state and same-invocation current verification are unchanged. For #2824/REQ-108 the scenario matrix and its actual refusal/no-replay oracles are also unchanged; no required scenario or assertion was removed.

The earlier after-receipt-head job log records dpkg-db-backup starting at 2026-11-13 00:00:00.221832 UTC and finishing at 00:00:00.334093 UTC, followed by the issuer exiting before the selected publication boundary. That is concrete chronological evidence motivating stable fresh-fixture preparation, not by itself proof of the exact mismatching unit or proof that the new head fixes every failure.

Exact-head native run 43336888362 attempt 1 is not complete: the omission control was in progress and production scenarios queued when checked. Earlier-head partial successes, including the independently observed queued-grant omission-control detection, are not promoted to this head's acceptance. The existing native-regression thread remains unresolved, and the previous rejected resolve operation was not retried. Already-present test artifacts are not asserted absent or requested again.

Static assessment complete; full native behavior/contract acceptance remains INCONCLUSIVE. No new duplicate thread, code change, CI rerun or operational action. This COMMENT is not merge approval or recovery completion. Open/unmerged status, exact head, current contract and all reviews/thread replies were freshly checked before publication.