spec: portable-core-contracts

[yihanzhu]

Tracks #155

G1 amendment: #184

What changed

• Replaces the failed one-file/one-PR implementation design with one core.contracts.v1 package delivered through seven independently gated child initiatives.
• Gives schema, raw-byte ingress, profile graph, stage request, result facts, result truth, and final assembly one clear owner each.
• Fixes the command-to-rule matrix, completed outcome precedence, resolved-profile self/external split, sanitized ingress failures, and fixed jq module loading boundary.
• Adds fail-closed cross-child spec/G3 pins, a continuous private-activation guard, and exact 31-review-finding / 279-legacy-assertion migration ledgers.
• Records the parent-plan/child-intake order, Add the v1 portable core contract validator (inactive) #183 close-as-superseded boundary, and final assembly ownership of closing Define portable core contracts #155.

Risk and boundary

risk: high — this is broad architecture and defines security controls, workflow dependencies, fixed code loading, and operator-owned CI behavior.

The five document kinds, three capability IDs, five permission IDs, every v1 field/enum, canonical bytes, error classes, claims-not-authority boundary, and no-live-activation outcome remain unchanged.

This PR changes only work/portable-core-contracts/spec.md. It does not approve the parent plan, create or approve child intakes, modify code, resume/close/merge PR #183, or activate any validator. The #180 bridge is no longer authority after the merged G1 amendment.

Exact identities

• Intent blob: f77fc1fdd8f7af228e7f211740901b265fc545ae
• Spec blob: 580210b1a265cf7ccee619d603650afbcc026d83
• Head: 1b93923374fa39e28f76457769769eba8529f8b2
• Base: d1e403fadb5d4c13cc8d2bdb1d9c1ddde65d71a8

Proof

• YAML frontmatter parsed successfully; intent-blob matches merged main; risk: high is explicit.
• Exact diff: one file, +483 / -93; git diff --check clean.
• Independent local reviews on the exact draft: semantics PASS; process/security PASS; plain-language/executability PASS.
• Fixed loader design was checked against the official jq 1.6 -L and import metadata rules.
• PR Add the v1 portable core contract validator (inactive) #183 remains frozen at ab4a7082f02e67b5748c5c54b9214f37d222f53f, round-3 + needs-human.

Human merge only. G2 merge accepts this spec and risk classification; it does not authorize code.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 1b93923
Reviewed-base: d1e403f
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/185-65839/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The amended contract weakens unavailable-tool result truth and leaves two gaps in the cross-child freshness gate. These can permit conclusive results or downstream implementation against stale contracts.

Full review comments:

• [P1] Treat every unavailable tools fact as a gap — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.zhXFEhbOx4/work/portable-core-contracts/spec.md:742-743
  When requested_tools is empty, this definition excludes metadata.tools:{state:"unavailable"} from fact_gap, so a completed result with passing evidence can claim changed or passed even though actual tool use is unknown. This reverses the frozen PR Add the v1 portable core contract validator (inactive) #183 round-3 behavior, whose regression fixture has no requested tools, and weakens R12; any unavailable tools fact should force a gap.

• [P1] Bind each upstream G3 tuple to its accepted spec — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.zhXFEhbOx4/work/portable-core-contracts/spec.md:149-155
  The tuple and its checks never prove that the G3 merge implemented the upstream spec blob pinned by the downstream child. If an upstream G2 spec is amended while its old export remains unchanged, the old implementation merge is still an ancestor and its export still matches current main, so downstream planning and code can pass before replacement implementation lands. Include the upstream spec blob in the tuple and verify that the G3 merge/review was bound to it.

• [P1] Validate the full upstream spec closure — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.zhXFEhbOx4/work/portable-core-contracts/spec.md:196-200
  Checking only direct spec blobs does not fail closed over this dependency graph. For example, after the schema spec changes, the current profile-graph spec can remain unchanged but stale; stage-request will still see its direct profile-graph blob match current main, while the old schema G3/export tuple also remains valid. Record the full upstream spec closure or recursively verify every direct spec's own pins before allowing downstream work.

[yihanzhu]

Manager fix claim — G2 round-0

• claim_id: ystack-claim-20260829T203343Z-portable-core-contracts-fix-23db9aa1
• mode: fix
• gh operator: yihanzhu
• manager session: one manager session is driving this target

Exact tuple

• target: yihanzhu/ystack
• slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels; ready, claimed, and needs-human are absent)
• PR: spec: portable-core-contracts #185 (OPEN)
• stage: G2 spec amendment
• allowed path: work/portable-core-contracts/spec.md
• branch: ystack/spec/portable-core-contracts
• local HEAD = PR remote head: 1b93923374fa39e28f76457769769eba8529f8b2
• current base: d1e403fadb5d4c13cc8d2bdb1d9c1ddde65d71a8
• round: round-0
• worktree: clean
• current spec blob: 580210b1a265cf7ccee619d603650afbcc026d83
• intent blob: f77fc1fdd8f7af228e7f211740901b265fc545ae
• review: comment 5464726341, bound once to the exact current head and base; three P1 findings; not-pass
• CI on this head: ci=success; Cloudflare Pages=success
• PR state at claim: labels are exactly claimed and round-0; needs-human and merge-ready are absent

Authorized scope

This claim authorizes one fix pass and only these three changes:

1. Make metadata.tools.state == "unavailable" always create fact_gap, even when requested_tools is empty.
2. Add the accepted upstream spec blob to each upstream G3 tuple, and verify that the G3 merge and review were bound to that blob.
3. Make upstream-spec-blobs cover the full upstream spec closure, not only direct dependencies.

Do not change intent, any other file, the accepted product outcome, or the delivery topology. This claim gives no merge authority. One fix pass is authorized by this claim and no other.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	5c7172f
Status:	✅  Deploy successful!
Preview URL:	https://2f044ada.fabrica-6yx.pages.dev
Branch Preview URL:	https://ystack-spec-portable-core-co.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Round-0 review fixes

Commit: 70185493641eb46436c0a977516446d4686db47b

Scoped to the three P1 findings in Codex review comment 5464726341:

1. Unavailable tools fact — any tools:{state:"unavailable"} now creates fact_gap, even when the selected binding requested no tools. Failed check evidence still has precedence; the change only blocks false passed/changed/no-change outcomes.
2. G3 binds its accepted spec — every upstream G3 tuple is now {spec_blob,merge_commit,exports:[{path,mode,type,oid}]}. The upstream implementation PR, review, and G3 record must bind that same spec blob, so an old implementation cannot satisfy an amended spec merely because exports stayed unchanged.
3. Full upstream spec closure — both spec and G3 maps now cover the complete transitive closure from the dependency table. G2 compares every upstream spec on current main; plan/code/CI/final review additionally compare the spec-bound G3 ancestor and export entries.

Proof:

• git diff --check: clean
• YAML frontmatter: valid; intent blob unchanged and matching
• Revised spec blob: 3b07cbeaf0556f7b9ae1c8d5962bbc29a6092808
• Scoped delta: one file, +26 / -24
• Independent semantics review: PASS
• Independent process/security review: PASS
• PR Add the v1 portable core contract validator (inactive) #183 was not changed

Round moved round-0 → round-1. Leaving claimed for manager verification and removal. No merge or approval.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 7018549
Reviewed-base: d1e403f
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/185-68116/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The dependency scheme does not prove that composed child implementations were accepted against the same upstream generation. It also exposes upstream changes through the existing public wrapper before reassembly completes.

Full review comments:

• [P1] Bind each G3 tuple to its accepted dependency closure — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.ImVKxRBP6e/work/portable-core-contracts/spec.md:150-157
  After an early dependency changes, these checks allow incompatible generations to be mixed. For example, a new schema G3 can coexist with an unchanged stage-request G3 built against the old schema; a result-facts plan can pin both current tuples, and every listed blob, ancestor, and export check passes. Include and verify each upstream G3 record's own accepted upstream-g3 closure, or require dependent G3s to refresh before they can be consumed.

• [P1] Make module upgrades atomic with public assembly — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.ImVKxRBP6e/work/portable-core-contracts/spec.md:267-269
  Once assembly has exposed the wrapper, merging a change to an earlier child's fixed module path immediately changes what that public wrapper loads, before the downstream pins and assembly proof are refreshed. This creates a public mixed-version window despite the partial-package rule. Stage upgrades under an inactive versioned path or activation pointer so the refreshed assembly can switch the whole package atomically.

[yihanzhu]

Manager fix claim — G2 round-1

• claim_id: ystack-claim-20260829T204427Z-portable-core-contracts-fix-cdffb11e
• mode: fix
• gh operator: yihanzhu
• manager session: one manager session is driving this target

Exact tuple

• target: yihanzhu/ystack
• slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels; ready, claimed, and needs-human are absent)
• PR: spec: portable-core-contracts #185 (OPEN)
• stage: G2 spec amendment
• allowed path: work/portable-core-contracts/spec.md
• branch: ystack/spec/portable-core-contracts
• local HEAD = PR remote head: 70185493641eb46436c0a977516446d4686db47b
• current base: d1e403fadb5d4c13cc8d2bdb1d9c1ddde65d71a8
• round: round-1
• worktree: clean
• current spec blob: 3b07cbeaf0556f7b9ae1c8d5962bbc29a6092808
• intent blob: f77fc1fdd8f7af228e7f211740901b265fc545ae
• review: comment 5464779864, the newest current-operator Codex review, bound once to the exact current head and base; two P1 findings; not-pass
• CI on this head: ci=success; Cloudflare Pages=success
• PR state at claim: labels are exactly claimed and round-1; needs-human and merge-ready are absent

Authorized scope

This claim authorizes one fix pass and only these two changes:

1. Bind each upstream G3 tuple to the complete dependency closure accepted for that G3, and verify that closure so implementations from incompatible generations cannot be mixed.
2. Make module upgrades atomic with public assembly, using inactive versioned module paths and one public activation boundary so the wrapper never exposes a partly refreshed package.

Do not change intent, any other file, the child dependency order, the public package identity, or the accepted product outcome. This claim gives no merge authority. One fix pass is authorized by this claim and no other.

[yihanzhu]

Round-1 review fixes

Commit: 8c3c6e21c161d183ce9f762da4a4c11c320510b6

Scoped to the two P1 findings in Codex review comment 5464779864:

1. Dependency generation closure — G3 now records g3_record={self,built_against}. Each self ref binds accepted spec, generation, merge commit, immutable generation exports, and any assembly activation export. built_against is the exact full prerequisite generation the child was built with; downstream selection requires every overlapping ref to match, so new-schema/old-dependent mixtures fail stale.
2. Atomic public upgrades — every delivery uses an inactive core/v1/generations/<generation-id>/ subtree. Published generation exports are immutable. The stable scripts/core-contract.sh wrapper is a separate assembly-only activation export and contains one literal selected generation. During upgrades the old complete generation remains public; only the final assembly merge adds the new root and switches the wrapper.

The activation guard now distinguishes first publication, an upgrade under construction, and post-switch state. The parent plan records one unused g-[0-9a-f]{64} ID and pins the current wrapper/selected generation for upgrades.

Proof:

• git diff --check: clean
• Revised spec blob: 7d3704b8ebcdfb4476ce78a4116f7b4353aa5f49
• Scoped delta: one file, +109 / -70
• Independent semantics review: PASS
• Independent process/security review: PASS
• PR Add the v1 portable core contract validator (inactive) #183 was not changed

Round moved round-1 → round-2. Leaving claimed for manager verification and removal. No merge or approval.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 8c3c6e2
Reviewed-base: d1e403f
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/185-70143/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The specification leaves the assembly activation gate internally unsatisfiable and does not fully authenticate merged upstream dependencies or permanently unique generation IDs. These gaps undermine the delivery and atomic-generation guarantees introduced by the patch.

Full review comments:

• [P1] Define a satisfiable proof order for the wrapper switch — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.M5ApXdzMbR/work/portable-core-contracts/spec.md:190-191
  The assembly proof requires testing the public wrapper and binding CI/review to the exact head, but this rule permits the wrapper switch only after complete proof. On the first assembly no wrapper exists beforehand, and during an upgrade the existing wrapper still selects the old generation; committing the switch afterward also makes prior exact-head proof stale. Define a pre-switch package proof, the switch commit, and a mandatory post-switch exact-head proof before merge.

• [P1] Require the recorded G3 merge to be on main — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.M5ApXdzMbR/work/portable-core-contracts/spec.md:160-163
  The new g3_ref contains merge_commit, but the validation rules only say that the self ref must “match current main” and never require that commit to be an ancestor of main. A record from an unmerged branch can therefore have current spec/export blobs and satisfy the stated comparisons even though the prerequisite never reached G3, defeating the required dependency order. Specify the exact ancestry or accepted-merge check.

• [P2] Check generation IDs against history before reuse — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.M5ApXdzMbR/work/portable-core-contracts/spec.md:324-325
  Checking only that the subtree does not currently exist cannot enforce R24's promise that a generation ID is never reused. After the later removal process explicitly contemplated by this spec deletes an old generation, this test would accept the same ID and let it identify different immutable contents. The plan needs an append-only registry or a repository-history check for prior use.

[yihanzhu]

Manager fix claim — terminal round-3

• claim_id: ystack-claim-20260829T210500Z-portable-core-contracts-fix-290a701c
• mode: fix
• gh operator: yihanzhu
• manager session: one manager session is driving this target

Exact tuple

• target: yihanzhu/ystack
• slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels; ready, claimed, and needs-human are absent)
• PR: spec: portable-core-contracts #185 (OPEN)
• stage: G2 spec amendment
• allowed path: work/portable-core-contracts/spec.md
• branch: ystack/spec/portable-core-contracts
• local HEAD = PR remote head: 8c3c6e21c161d183ce9f762da4a4c11c320510b6
• current base: d1e403fadb5d4c13cc8d2bdb1d9c1ddde65d71a8
• round: round-2 → terminal round-3
• worktree: clean
• current spec blob: 7d3704b8ebcdfb4476ce78a4116f7b4353aa5f49
• intent blob: f77fc1fdd8f7af228e7f211740901b265fc545ae
• review: comment 5464869813, the newest current-operator Codex review, bound once to the exact current head and base; two P1 findings and one P2 finding; not-pass
• CI on this head: ci=success; Cloudflare Pages=success
• PR state at claim: labels are exactly claimed and round-2; needs-human and merge-ready are absent

Authorized scope

This claim authorizes one terminal fix pass and only these three changes:

1. Define a satisfiable activation order: pre-switch package proof, the wrapper switch commit, then mandatory post-switch proof bound to the exact switched head before merge.
2. Require every recorded G3 merge commit to be on current main before another child can consume it.
3. Make generation IDs permanently non-reusable with an append-only registry or an equivalent repository-history check that survives generation removal.

Do not change intent, any other file, the child dependency order, the public package identity, or the accepted product outcome. There is no automatic round-4. This claim gives no merge authority. One terminal fix pass is authorized by this claim and no other.

[yihanzhu]

Terminal round-3 review fixes

Commit: 3a23d68ed3ffe8ede06896585d8bf430088e0457

Scoped to the three findings in Codex review comment 5464869813:

1. Satisfiable assembly proof order — assembly now has a pre-switch exact head that includes the complete new generation but leaves the stable wrapper absent/old; private drivers, CI, and independent review bind that head. A single-parent switch commit then changes only scripts/core-contract.sh. Mandatory public-wrapper CI/review run again on the exact post-switch head; only that evidence can create merge-ready.
2. G3 must be on main — every G3 self ref now requires its merge_commit to be the operator-accepted merge commit and an ancestor of current main, with generation and activation exports matching current-main Git entries.
3. Generation IDs never reuse — core/v1/generation-registry.json is canonical, restore-critical, and append-only. The schema child appends {generation_id,parent_spec_blob,parent_plan_merge_commit}; CI requires unique IDs and every prior-main entry to remain an unchanged ordered prefix. Deleting an old subtree cannot make its ID reusable.

The generation-aware guard still keeps the old complete generation selected until the final assembly merge. Published generation exports remain immutable; the stable wrapper remains the only assembly activation export.

Proof:

• git diff --check: clean
• Revised spec blob: 273aba86c45bb3c4c4efc30128cf6e76122608e7
• Scoped delta: one file, +64 / -34
• Independent semantics review: PASS
• Independent process/security review: PASS
• PR Add the v1 portable core contract validator (inactive) #183 was not changed

Round moved round-2 → round-3. This is terminal; there is no automatic round-4. Leaving claimed for manager verification and removal. No merge or approval.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 3a23d68
Reviewed-base: d1e403f
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/185-71849/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The first-publication assembly sequence cannot satisfy both its wrapper-only switch rule and the repository's required-files gate. This blocks the planned public assembly until the specification permits an atomic restore-manifest update.

Review comment:

• [P1] Let the switch commit update the restore manifest — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.fngWLLpEFD/work/portable-core-contracts/spec.md:941-943
  On the first publication, scripts/core-contract.sh is absent at the pre-switch head, so listing it in ci/required-files.txt would fail the mandatory structure check. Restricting the switch commit to the wrapper alone then leaves the new restore-critical wrapper unlisted, violating R16; allow the manifest entry to land atomically with the wrapper or define another CI-safe mechanism.

[yihanzhu]

round-cap

Terminal G2 handoff

• target: yihanzhu/ystack
• slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels)
• PR: spec: portable-core-contracts #185 (OPEN)
• branch: ystack/spec/portable-core-contracts
• head: 3a23d68ed3ffe8ede06896585d8bf430088e0457
• base: d1e403fadb5d4c13cc8d2bdb1d9c1ddde65d71a8
• round: terminal round-3
• worktree: clean
• spec blob: 273aba86c45bb3c4c4efc30128cf6e76122608e7
• review: comment 5464936039, newest current-operator Codex review with unique matching head/base markers; not-pass
• carrier: needs-human + round-3; no claimed or merge-ready
• CI on this head: ci=success; Cloudflare Pages=success

Remaining finding

• [P1] Atomic restore-manifest switch — the first-publication switch commit must update both scripts/core-contract.sh and its ci/required-files.txt entry atomically, so the structure check and restore-critical rule can both pass.

The terminal review exhausted the round cap. There is no automatic round-4. This PR remains frozen without merge-ready; a human ruling is required before any further revision. This handoff authorizes no edit or merge.

[yihanzhu]

Operator direction — one post-cap final revision

Source: direct operator instruction in the current Codex session on 2026-08-29. The operator asked the manager to keep moving, place approval points on GitHub, and use the operator merge as the decision.

Authorize one final revision on the existing PR #185. Keep the review counter at round-3. The only allowed change is the assembly switch rule needed to satisfy the restore manifest gate:

• On first publication, the switch commit changes exactly two paths: it adds scripts/core-contract.sh and adds the exact scripts/core-contract.sh entry to ci/required-files.txt.
• On a later upgrade, the switch commit changes only scripts/core-contract.sh; the manifest entry must already exist and remain byte-identical.
• The exact post-switch head must pass the structure check, public-wrapper CI, and independent review before merge-ready.

Do not change the seven-child topology, contract semantics, risk, dependency rules, or any other scope. Do not create round-4. If the final exact-head review does not pass, restore needs-human and stop. The operator merge of this PR is the G2 acceptance. PR #183 remains frozen. This direction does not authorize any agent to merge.

[yihanzhu]

Manager claim — post-cap final

• claim_id: ystack-claim-20260829T212317Z-portable-core-contracts-post-cap-final-02599593
• mode: post-cap-final
• gh operator: yihanzhu
• manager session: one manager session is driving this target
• authority: durable operator direction comment 5464956032

Exact tuple

• target: yihanzhu/ystack
• slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels; ready, claimed, and needs-human are absent)
• PR: spec: portable-core-contracts #185 (OPEN)
• stage: G2 spec amendment
• allowed path: work/portable-core-contracts/spec.md
• branch: ystack/spec/portable-core-contracts
• local HEAD = PR remote head: 3a23d68ed3ffe8ede06896585d8bf430088e0457
• current base: d1e403fadb5d4c13cc8d2bdb1d9c1ddde65d71a8
• round: remains round-3
• worktree: clean
• current spec blob: 273aba86c45bb3c4c4efc30128cf6e76122608e7
• terminal review: comment 5464936039, bound to this exact head/base, with one P1
• round-cap handoff: comment 5464942226
• post-cap direction: comment 5464956032, newest current-operator direction
• carrier while this claim is recorded: claimed + needs-human + round-3; merge-ready is absent

Sole authorized scope

1. Amend only the assembly switch rule: on first publication the switch commit changes exactly scripts/core-contract.sh and its exact entry in ci/required-files.txt; on later upgrades it changes only the wrapper while the manifest entry remains byte-identical; the exact post-switch head must pass the structure check, public-wrapper CI, and independent review before merge-ready.

Do not change any other file or rule, the seven-child topology, contract semantics, risk, or dependency rules. Do not create round-4. This claim authorizes one post-cap final revision only and gives no agent merge authority. needs-human remains present until this exact claim record is verified.

[yihanzhu]

Post-cap final revision complete

Claim: ystack-claim-20260829T212317Z-portable-core-contracts-post-cap-final-02599593

• Head: 5c7172f
• Parent: 3a23d68
• Base: d1e403f
• Spec blob: 17b2f20c870c371a53be79d08d784c322d8d2a75
• Changed path: work/portable-core-contracts/spec.md only
• Round remains round-3; no round-4 was created.

This revision changes only the terminal P1 from review 5464936039. First publication now requires one switch commit that adds exactly the public wrapper and its exact restore-manifest entry. Upgrades remain wrapper-only and keep that manifest entry byte-identical. The exact post-switch head must pass the structure check, public-wrapper CI, and independent review.

Local proof on this exact commit: git diff checks are clean; YAML frontmatter parses as risk high; intent-blob matches current main at f77fc1fdd8f7af228e7f211740901b265fc545ae. Two independent read-only draft reviews returned PASS on blob 17b2f20c870c371a53be79d08d784c322d8d2a75.

No topology, contract semantics, dependency, authority, or other scope changed. claimed stays in place until the manager verifies this handoff. No merge-ready and no merge authority.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 5c7172f
Reviewed-base: d1e403f
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/185-73925/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The amended spec remains hash-linked to the accepted intent, records the required high-risk classification, and consistently defines the child boundaries, dependency pins, generation switching, and validation behavior. No discrete blocking defect was identified in the changed lines.

[yihanzhu]

Operator action — please review and merge

PR #185 is now merge-ready at exact head 5c7172f. GitHub CI and Cloudflare passed. The final independent Codex review comment 5465008961 has no actionable findings, and a separate adjudicator authenticated its exact head/base markers and clean result.

Merging this PR is the operator acceptance of G2 for portable-core-contracts. No agent will merge it. If you want a change, do not merge and leave a PR comment instead.

After your merge, the manager will sync the accepted spec and continue with the separate high-risk parent plan-only PR. It will not start implementation or create child ready state. PR #183 remains frozen.