#206/#28: combine bounded tool-name recovery with faithful live transcripts and look-back

[acoliver]

Current disposition, October 3, 2026

READY for Andrew's merge decision at 64fabfc2e83dd54876878772302dd3cc9fc7c83e, tree 95c687c4bed20316b5195a6a9f7bae41319902d1, against main fc872110ec5a9b67ae8dce5dd9dbd727ad5f6ef8. No merge has been performed.

The original #28 full manual review is complete: all70 original paths are accounted for, with38 feature-bound inspections and32 explicit inherited-scope exclusions. Its manifest confinement finding was repaired centrally at aace587a; the single findings-only follow-up resolved F1 on final 64fabfc2. The original compiled escape now rejects with exit4 and no successful transcript. Independent54-case/108-invocation current/retained artifact boundary and measured nonmutation checks passed. Recovery's earlier F1/F2 ownership fix remains preserved; no third recovery review or extra transcript review cycle was used.

Exact final native acceptance passed: MSRV/stable1128 owning tests each, xtask65 each, direct vendor12SSE+2WebSocket cases, denied-warning formatting/clippy/rustdoc and source-policy/provenance/license/mutation checks, all16 aggregate release phases and genuine extracted-source acceptance, compiled transcript caller fidelity/look-back nonmutation and authenticated bounded read. Archive SHA256: 9d23d17605fdfb20b7a6b9da77d39011b472e9ed88c28da72f98688be89dd265.

Required CI 37083295279 passed8 checks, with0 failures/pending and1 tag-only publication skip. The generated release merge has exactly the candidate tree. Failedaace CI37081589928 remains failed. Native #325 diagnosis reproduced expected early client closure racing the old fixture producer; the repaired producer queues the complete remaining witness in one checked write. All12 test bodies/assertions and runtime parser, manifest and summary blobs are unchanged from its parent. Short writes and socket errors still fail; none are ignored.

Independent evidence-only readiness reconciliation completed in publication/readiness-transcript.md/json. This qualifies readiness at the stated base, not blanket approval of future integrations. Recommended serial queue: #308, #319, #302, #323, #324. After any authorized merge, reconcile the next affected delta, actual base/tree and CI while preserving previously delivered scopes. These separately accepted candidates are not a tested cumulative stack.

Earlier strict elapsed failures, provider interruptions, invalid-tool-JSON/context-guard failures, external evidence access limits and prior failed commands remain preserved. No universal timing repair, intercepted authenticated TLS-wire proof, byte-identical archive reproducibility or unseen historical approval is claimed. Original #245/#305 were closed as mapped duplicate deliveries without merging or deleting their branches.

Evidence root: branch-2/evalwork/results/pr-remediation-20261002/, including review-transcript-final.md, followup-transcript.md, fix325-report.md, source mappings, raw gate/CI receipts and final readiness reports.

Preserved prior descriptions

Everything below is a time-specific historical record. The current disposition above supersedes earlier pending-head and blocked-status wording, without changing original source, failed commands or evidence.

Current disposition, October 3, 2026

NOT READY / REQUEST CHANGES at 40dc91cd. Exact CI8pass and native1125 tests per toolchain/full package/fidelity acceptance passed, but independent review reproduced manifest-selected intermediate-symlink traversal beyond the read-only session directory. Native isolated confinement repair is active; original full review manual coverage is being completed on immutable40dc. Original provider errors/HTTP503 remain retained and explicitly resumed, not automatically replayed or approval. Final source and single findings follow-up must complete before readiness.

No merge has been performed. Head/base changes require affected source and check reconciliation. Evidence under branch-2/evalwork/results/pr-remediation-20261002/.

Preserved earlier delivery description

The description below is retained as a time-specific record. Any pending/completed wording there is superseded by the current disposition above, without changing failed-command evidence.

Consolidated replacement for #245 and #305

Exact head 40dc91cd62ee2bdf8993b0b3c43e9ede6112707c combines closely related tool-round recovery and transcript/session delivery on main fc872110. Original #245 c69462ad is a retained ancestor. Original #305 4767d6b1 and its branch/history/diffs are preserved with all70 original paths explicitly mapped to the unique current-main port; replacement ancestry is not invented. Shared #308/#194 and required #319 profile residuals were integrated with exact per-path scope mapping. Cache #323 and xtask #302 feature deltas are excluded.

Original branches remain intact. Native Sol alone implemented and serialized the overlapping agent/session seams in new worktrees; no coordinator source repair, force rewrite, compatibility reader, provider fallback or gate weakening.

Recovery and findings

Unknown/disabled safe tool names retain charged ordered failures and enabled-only corrective rosters; unsafe/secret/malformed names reject before effects. Main live/durable/executed-prefix and separate request/turn budgets remain. Independent current-main verification found duplicate answered batches in forced summary and acceptance of a nonempty tool-call preamble as final output. Isolated fix 55b96ce6 explicitly transfers ownership of the current reply. Its single findings-only verification resolved F1/F2 with14 independent compiled wire cases; unchanged strict elapsed-deadline assertions failed in that reviewer run and remain qualifications.

This candidate carries only those six fix files, with one transcript ingress hook reconciliation, not a second recovery redesign. All nine registered summary fixtures are byte-identical to the isolated fix. Captured compiled wire verifies one ID/result each, charged/refused order, final instruction and no refused-write effect.

Transcripts and evidence

Opt-in emission uses admitted result_live bytes only, never durable fallback. Read-only current-format JSON/human look-back stays network-free and nonmutating. On preserved earlier combined source 6146fa71, controlled release proof was small450 emitted=450 wire=450 durable and bulk2975 emitted=2975 wire versus211 durable digest; authenticated Sol/localoauth read proof was571 emitted=571 durable and12 unchanged files. Authenticated TLS request was not intercepted. Those are earlier-source results, not final40dc acceptance.

Final owning summary/transcript/emitter/profile/lifetime/provenance/quality/compat gates and the carried caller proof passed on40dc. Its exact full MSRV/stable, aggregate/archive/extracted and final release/authenticated fidelity/nonmutation acceptance are running. Remaining full original #28 independent review has just launched against an immutable40dc copy; no implementer self-approval. Fresh exact-head CI requested by this draft.

Pending acceptance

Keep draft/not merge-ready until final40dc review and source-bound acceptance/CI are reconciled. Historical #245 review delivery error, strict timing failures, external sibling/owner prerequisites, bsdtar reproducibility and cached-advisory limits remain recorded. Neither old green CI nor a passing smoke erases those attempts. No historical experiment repeated, assertions relaxed or merge performed.

Evidence: branch-2/evalwork/results/pr-remediation-20261002/{transcript305-findings-ready.json,transcript305-findings-evidence,followup-recovery.md}. Original #245/#305 will be closed only as mapped duplicate deliveries, preserving refs and explicit unfinished qualifications.

[acoliver]

Current40dcCI passed8required checks, and native fullMSRV/stable1125each/package/extracted/release/authenticated fidelity passed separately. Those do not override a confirmed original #28 review finding: manifest-selected snapshot/segment names are not confined to a local basename. A valid digest snapshot selected as redirect/snapshot-0-0.json traversed an intermediate directory symlink outside the selected session; compiled look-back returned exit0/one turn. Severity Medium, read-only scope violation, not proof of arbitrary secret disclosure or write access.

Keep draft/REQUEST CHANGES. Native Sol is repairing F1 in a NEW isolated tree from40dc, validating current and retained artifact-name boundaries and original no-mutation/format/recovery behavior without compatibility readers. Original40dc/proof/source/refs remain intact. The same initial reviewer is completing its remaining manual coverage on40dc; interrupted provider errors after513/3events and partial coverage remain preserved, not approval or automatic replay. Single findings-only follow-up will occur only after initial scope and exact fix source are complete.

Report/proof: branch-2/evalwork/results/pr-remediation-20261002/review-transcript-final.md and review-transcript-final-evidence/manifest-path.json. No enforcement weakening, force rewrite or merge.

[acoliver]

Native isolated F1 repair is now published by nonforced fast-forward40dc→aace587a9379ae2a5248da5670dfe6d6cd448818. Two files only: central read_manifest validates all current/retained snapshot/segment names as strict local basenames before selection/recovery, plus registered confinement tests. No new format reader, runtime/provider change or other245/305 redesign.

Original compiled40dc escape reproduced with valid snapshot digest; fixed compiled exploit rejects before output, and owning tests cover44 malformed name/slot cases in read-only/writer paths, valid current/retained recovery and final-component symlink refusal. Early owning/MSRV fmt/clippy/quality/compat pass. Full new-head package/release/native fidelity acceptance is running; old40dcCI cannot certify this change.

Same initial original #28 review still finishing manual coverage on immutable40dc after retained provider503 interruptions. Single findings-only follow-up will bind originalF1/scope to aace only after that full initial assignment completes. Keep draft/not merge-ready; fresh exactaaceCI requested. No merge, source reset, weakened assertion or automatic provider-body replay.

[acoliver]

Latest draft head is 64fabfc2e83dd54876878772302dd3cc9fc7c83e, nonforced fromaace, including the native #325 fixture repair. FailedaaceCI37081589928 remains failed: requiredmacOSMSRV vendor lifecycle test11pass/1BrokenPipe; release/source correctly skipped.

Native causal probe reproduced early real client FIN after a contradictory frame, a post-FIN7-byte write eliciting peer RST, then original writer unwrap BrokenPipe (exit101). Fixture fix queues the intended whole body before the client can abort mid-producer sequence; fixed deterministic probe exits0. InitialFIN-only probe without write failure retained as incomplete reproduction. All12 test function bodies/semantic assertions and runtimeResponses parser, manifest confinement, recovery-summary and look-back blobs remain byte-identical to parentaace. Full vendor patch/pins regenerated and provenance/license early checks passed, no ignored socket error or runtime guard.

Fresh exact64fabCI requested; required final direct-vendor blackhole/no-NO_PROXY MSRV+stable/freshempty-home and whole new-source/package/native fidelity gates are running. Original full #28 manual coverage and single manifest-F1 follow-up still unfinished; keep draft/not-ready. Source proof: branch-2/evalwork/results/pr-remediation-20261002/fix325-ready.json.

[acoliver]

Final 64fabfc2 CI37083295279 now passed8required checks,0fail/0pending,1tag-onlyskip, including previously failedmacOSMSRV/directvendor and actual release/source. FailedaaceCI stays failed. Native final64fab fullMSRV/stable1128each/xtask65each, original direct-vendor commands/all12SSE+2WS, all16aggregate phases/extracted/native fidelity/authenticated bounded read passed. ArchiveSHA2569d23d17605fdfb20b7a6b9da77d39011b472e9ed88c28da72f98688be89dd265.

Original full #28 review manual assignment is now complete:70pathdispositions with38feature-bound inspections/32explicit inherited exclusions, persisted source/caller ledger. Its verdict remainsREQUESTCHANGES on40dcF1, not approval of64fab. The SINGLEmanifest-F1 findings-only follow-up has just launched on newimmutable64fabcopy; keep draft until actual independent verdict and final readiness reconciliation.

Original513/3/94/1/497event providererrors, HTTP503s and918961-byte contextguard322 remain preserved; fresh-context continuations completed only unfinished tasks, not new review cycles or accepted-body replay. Source reports/maps/fixtures under branch-2/evalwork/results/pr-remediation-20261002/. No merge, test assertion reduction, branch deletion or blanketBrokenPipe ignore.

[acoliver]

READY for Andrew's merge decision at exact64fabfc2 against mainfc872110; promoted from draft, no merge. SinglemanifestF1 follow-up terminalRESOLVED: original compiledescape exit4/no transcript,54-case108-invocation boundary/nonmutation proof and owningMSRV/stable gates passed, original70-path coverage/12SSEassertions preserved. Independent evidence-only reconciliation verified raw native/package/archive receipts, CI37083295279 8pass0fail1tagskip and generated-release-merge tree equal to candidate. Full current disposition and preserved prior descriptions are now in the body.

Recommended serial queue308→319→302→323→324. Readiness does not transfer automatically after another merge; reconcile affected delta/base/tree/CI and preserve cache/xtask/transcript owners. #320 remains draft awaiting actual original220matrix/terminal evidence closure, not replacement trials. Historical provider/tool/context/timing/CI failures remain failed. Reports publication/readiness-transcript.{md,json} and publication/portfolio-final-readiness.{md,json} under retained remediation evidence root. No branch deletion, force rewrite, test weakening or automatic merge.

[acoliver]

Current landing candidate af544991 preserves the accepted transcript/summary/manifest scope and integrates cache plus landed shared/profile/xtask/evaluation source. Native composition tests found #327: unconditional cache stderr telemetry broke six unchanged transcript assertions. The product repair adds explicit --cache-observations PATH output ownership; accounting stays active, default stderr stays quiet, and selected transcript JSONL stays separate. It rejects destination collisions/write failures without fallback or replay.

All six original failures now pass. Exact-head MSRV/stable root suites passed 1,148 complete-parent tests each; helper subprocess subset counts are recorded separately. Original 54-case/108-invocation manifest proof and all12 SSE tests pass. Quality/coupling pass without exceptions or debt entries. The rebuilt native Sol/localoauth read workload produced 571 bytes equal to durable lookback, with two completed calls recorded separately in cache JSONL.

Fresh CI is requested on this head. Independent review of the new #327 code and composition seams is active in a detached copy, not approval yet. Final exact-source archive/extracted acceptance and actual landed-cache main/tree binding remain pending. Earlier failures and source candidates are preserved. No merge yet.

[acoliver]

Fresh CI 37166395705 at af544991 passed eight checks, including release/source. Independent review of the new #327 output ownership change nevertheless reproduced one medium correctness defect: an absent cache-output path inside this invocation's session-owned namespace can be replaced/unlinked by the session store after successful creation, silently losing observations after a provider request.

Original snapshot/temp/lock collision inputs and raw loopback proof are retained in review327-evidence. Native Sol is fixing R327-1 before merge, with pre-provider ownership validation and compiled nonmutation/zero-request regressions. Green CI is not being substituted for that finding. The original accepted cache/transcript assertions, quality limits and previous feature reviews remain intact. One findings-only follow-up will verify the new repair and its original #327 scope; no extra broad feature review or historical experiment is being restarted.

[acoliver]

Merged by ordinary exact-head guard at f4adda82266dcdbf9ec1f726281379dff17fdebd. Its tree 1e2a7ce9 exactly equals independently reviewed f3fe54b1 and CI generated merge 136fb747, whose parents are actual cache main 4046b0c2 and that candidate.

The single findings-only follow-up resolved R327-1: all 30 independent namespace-collision cases reject before provider requests with unchanged measured filesystem snapshots. Original assertions remain intact. Both toolchains passed 1,153 unfiltered complete-parent tests, with filtered helper repeats counted separately. Native final release authenticated read produced 571 live bytes equal to durable lookback and separate cache records.

Fresh run 37169041730 passed eight checks. Raw checked-out-source logs verify all 16 release phases, extracted offline tests/build and GNU-tar reproducibility. Artifact ID 11291198127 is tied to generating commit 136fb747, not relabelled as a local package. Local f3fe archive/extracted gates remain unrun. Original failures, review finding, branches and evidence are retained.