Repository audit remediation for 10 November 2026 #4368

Activity

1. thymikee

   added

   needs-triageNew or unreviewed issueNew or unreviewed issue

   on Nov 10, 2026
2. apex-sentinel-staging commented on Nov 10, 2026

   

   apex-sentinel-stagingBot

   on Nov 10, 2026 – with apex-sentinel-staging

   Last edited by apex-sentinel-staging

   More actions

   Apex Sentinel · Issue review

   I cannot review this issue, as input_limits.issue_desc_max_size is exceeded (49,522/30,000 characters). Shorten the description (a long log or stack trace can go in a gist or an attached file), and I will review it once it is under the limit.
3. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Prevention design ledger 1 of 3

   Prevention design exploration for #4368. Each row is an audit-derived candidate to evaluate at the existing owner, not an approved abstraction or a new confirmed defect. Merged fixes need no follow-up if they already enforce the invariant. Aliases share their canonical direction. The issue body defines design/proof requirements and the prevention family codes.

   apple-runner-native-2.md

   • ARUN2-1 [A] — Make runner disposal consume verified lease process identity and observed exit state before every signal; a retained PID alone grants no authority.
   • ARUN2-2 [N] — Align querySelector-backed get/is/wait normalization through cross-language cases; preserve the intentional Maestro mutation waiver unless its owning decision is explicitly changed.
   • ARUN2-3 [C] — Separate verified cache artifact identity, optional repair and last-used metadata; unchanged reuse cannot rebuild its authorization manifest twice.
   • ARUN2-4 [X] — Remove incident logging or retain a bounded intentional diagnostic with redaction coverage; investigation markers are not a standing observability API.
   • ARUN2-5 [L] — Express runner stop as explicit bounded grace transitions with fresh signal authority; back-to-back signals cannot pretend to provide escalation waits.
   • ARUN2-6 [H] — Reuse this runner owner's immutable identity and batch asynchronous foreign-process observations during eviction; preserve lock/freshness requirements at each deletion decision.
   • ARUN2-7 [A] — Pass temporary token-bearing plist input through a protected stream or short-lived owned file; do not retain redundant secret copies for the session lifetime.
   • ARUN2-8 [D] — Use keyed cache identity to select candidates directly; remove scoring dimensions that cannot affect that namespace's result.
   • ARUN2-9 [P] — Separate human diagnostic metadata from cache authorization fields; retain packageVersion only if a named reader or support contract needs it.
   • ARUN2-10 [R] — Return unreadable versus too-large from manifest hashing distinctly; cache refusal preserves the actual reason without text classification.
   • ARUN2-11 [X] — Attach the ownership constraint to its enforcing declaration and remove the orphaned block; no runtime change.

   apple-runner-native-3.md

   • ARUN3-1 [N] — Query bounded text-input types once and stop after ambiguity is established; no-focus return cannot scan every app element through live attributes.
   • ARUN3-2 [L] — Use Swift errors across Swift cleanup scopes and contain foreign exceptions at the narrow Objective-C boundary; state restoration always runs.
   • ARUN3-3 [B] — Pass an absolute deadline into bridge traversal and check between AX requests; abandoned reads stop issuing new requests while in-flight noncancelable work remains honestly owned.
   • ARUN3-4 [N] — Use captured text-input geometry inside one issue-contained probe; unavailable geometry stays unavailable rather than triggering an uncontained live frame read.
   • ARUN3-5 [N] — Acquire keyboard candidates once per container and choose in memory; settling compares bounded image evidence without repeated full PNG work.
   • ARUN3-6 [N] — Carry one focus/keyboard observation per poll and re-observe only on a changed target; do not retry a potentially dispatched focus tap without an explicit safe contract.
   • ARUN3-7 [N] — Read display/window facts through the existing safe candidate observation order; stale handles cannot bypass existence/issue containment.
   • ARUN3-8 [I] — Book a bounded lit-window set with the request's panel identity and reuse it within that request only; repeated queries cannot expand the captured surface.
   • ARUN3-9 [P] — Resolve drag coordinate frames once and carry app/reference/keyboard provenance through planning and injection.
   • ARUN3-10 [B] — Perform modal/title reads inside the same deadline and exception containment as alert acquisition; cheap-looking metadata cannot escape the read budget.
   • ARUN3-11 [R] — Return typed native refusals with actual dispatch status; unsupported swipe rejects before side effects and failed fill preserves a sent focus tap.
   • ARUN3-12 [V] — Let one tree-acquisition boundary own depth/node truncation; conversion cannot apply a second inconsistent limit that drops siblings silently.
   • ARUN3-13 [D] — Keep test/support-only modal structures in their actual build target after production-call verification; do not ship a speculative runtime abstraction.
   • ARUN3-14 [X] — Split unused counters, parameters and stale command labels into local corrections; no shared framework is justified by mixed leftovers.

   apple-runner-native.md

   • ARUN-1 [A] — Resolve alert actions from explicit default/cancel semantics or unambiguous whole labels; uncertainty refuses rather than guessing by button order.
   • ARUN-2 [P] — Resolve window identity/title at the window root and carry it down unchanged; descendant labels cannot become window metadata.
   • ARUN-3 [R] — Have one snapshot-result constructor aggregate every acquisition limit into quality/truncation facts; entrypoints cannot silently drop depth limits.
   • ARUN-4 [L] — Give non-inline screenshot artifacts a bounded handoff lifetime with unique ownership; retire only files whose reader has finished, not arbitrary matching paths.
   • ARUN-5 [C] — Prepare source/toolchain fingerprint once per justified identity/invalidation interval; command dispatch consumes prepared runner identity without rewalking source synchronously.
   • ARUN-6 [N] — Acquire AX attributes in bounded batches into snapshot values and track visited elements by identity; tree presentation performs no repeated remote reads.
   • ARUN-7 [N] — Build selector/sweep observations from bounded snapshot acquisitions rather than live attribute-by-attribute queries; preserve successful-match semantics with conformance cases.
   • ARUN-8 [I] — Compute descendant-derived labels bottom-up once per native snapshot; repeated label projection cannot retraverse the same subtrees.
   • ARUN-9 [R] — Use the runner watchdog's typed failure predicate at the host; Swift message wording is not timeout control data.
   • ARUN-10 [R] — Create pre-dispatch argument refusals through one typed native response helper; invalid input and executed failures remain distinguishable.
   • ARUN-11 [V] — Consume native argv values positionally in one parser with strict numeric readers; text equal to a flag never re-enters option scanning.
   • ARUN-12 [P] — For each one-sided wire field choose a real producer/consumer or retire it with version evidence; a named field cannot imply unimplemented recovery guarantees.
   • ARUN-13 [V] — Represent viewport size as dimensions or a rect, distinct from endpoint coordinates; a typed codec prevents width from being interpreted as x2.
   • ARUN-14 [S] — Keep native error vocabulary in the actual wire enum and document its real declarations; stale protocol pointers cannot define another owner.
   • ARUN-15 [S] — Classify off-queue transport commands in one executable dispatch trait table; dead main-thread branches cannot contradict transport routing.
   • ARUN-16 [E] — Retain cross-language capability pins when they prove real invariants; otherwise remove test-only production declarations with the exact stronger proof identified.
   • ARUN-17 [P] — Attach tool-process evidence only when a tool process failed; runner refusals cannot fabricate xcodebuild causality.
   • ARUN-18 [C] — Make checkout and packaged runner identity use the same production source manifest; unit/test files cannot cause unexplained cache invalidation.
   • ARUN-19 [P] — Stamp response provenance at the live send boundary, including journal replay; document stored unstamped versus transmitted stamped representations.
   • ARUN-20 [C] — Use APPLE-1's helper preparation owner; this duplicate needs no additional cache or lifetime rule.
   • ARUN-21 [K] — Tie legacy XCTestDevices recovery to supported persisted producers and an explicit removal version; do not keep a historical public surface indefinitely.

   capture-selectors-kernel-2.md

   • CAP2-1 [R] — Preserve typed/canceled capture failures through scroll-edge orchestration; wrapping applies only to unknown errors and identifies the actual failed scope.
   • CAP2-2 [L] — Model PID monitoring as waiting, active or recovering with observed probe failure; one rejected probe cannot terminate a healthy owned stream silently.
   • CAP2-3 [I] — Resolve overlay labels through one indexed, cycle-safe traversal per immutable tree; distinguish graph validation from repeated defensive walks.
   • CAP2-4 [L] — Own provider reads with a stop signal and one in-flight read; slow reads cannot overlap or be disposed while still using the reader.
   • CAP2-5 [B] — Put decode/resize/diff-region CPU work behind the existing bounded image worker contract; transfer results rather than executing hidden main-loop work.
   • CAP2-6 [V] — Construct merged scans under one validated output cap from the first entry onward; seed entries cannot bypass the bound.
   • CAP2-7 [L] — Let stream exit drive PID recovery where possible; make healthy-stream probing cadence a bounded policy rather than unconditional frequent process spawns.
   • CAP2-8 [P] — Preserve native terminal audio status as the observed fact; host finish time is separate metadata and cannot overwrite its stop reason.
   • CAP2-9 [I] — Create one command-local scroll analysis with lazy expensive fingerprints; reuse indexes by immutable snapshot identity, not mutable global session state.
   • CAP2-10 [K] — Remove unproduced screenshot-diff fields through the correct public-type/version decision; output contracts describe actual emitted evidence.
   • CAP2-11 [A] — Route every durable-record compare-and-write through its fence owner, including failed adoption; initial creation has a separate explicit authority path.
   • CAP2-12 [S] — Use the canonical Apple family/leaf device accessors; eliminate old leaf-string interpretations only after persisted-state readers are checked.
   • CAP2-13 [S] — Export existing shared enum vocabularies and derive flag/schema subsets; preserve owner facts rather than introducing a universal capability table.
   • CAP2-14 [V] — Decode PNG signature/dimensions once through a bounded image ingress; invalid format and pixel-budget refusal are distinct typed outcomes.
   • CAP2-15 [I] — Use validated image header metadata to identify a no-op crop before decoding; preserve full validation for actual transforms.
   • CAP2-16 [V] — Choose container readers from validated byte signatures and share one atom scan; file extensions remain hints, not content authority.
   • CAP2-17 [A] — Resolve bundled executable helpers from package-owned roots only; caller cwd cannot select code to execute.
   • CAP2-18 [I] — Give region accumulation one meaning and test transitive merge behavior; choose a bounded spatial algorithm from measured image sizes rather than removing safety caps blindly.

   capture-selectors-kernel-3.md

   • CAP3-1 [N] — Classify React Native overlays from structural/banner evidence plus text, preserving weak-signal uncertainty; passive app error text cannot authorize dismissal.
   • CAP3-2 [L] — Keep recovery acquisition, fenced cleanup and disposal as separately owned phases; prove each owner's cancellation/settlement contract before bounding startup waiting.
   • CAP3-3 [R] — Produce a typed alert-wait timeout at the alert owner and preserve it across platforms; ordinary absence and timed-out observation remain distinguishable.
   • CAP3-4 [I] — Carry payload validation evidence with the exact immutable node list; reuse only when presentation leaves the list unchanged.
   • CAP3-5 [B] — Use the existing image worker for expensive contact-sheet transforms with byte/pixel bounds; avoid redundant encode/decode and identical-size transforms.
   • CAP3-6 [X] — Represent binary delimiters with explicit source escapes so text tooling can inspect the module; no runtime redesign is needed.
   • CAP3-7 [T] — Validate the entire committed artifact set before replaying recording completion; missing chunks or telemetry are explicit unavailable artifacts.
   • CAP3-8 [I] — Build presentation indexes and viewport context once per tree; rules consume that context instead of independently normalizing and traversing ancestors.
   • CAP3-9 [D] — Remove unread statistics and callback plumbing when reference checks confirm no evidence consumer; keep useful measurements local to their actual readers.
   • CAP3-10 [O] — Share identical geometry/traversal rules in existing leaves, preserve named variants and cross-language proof, and remove only demonstrably impossible branches.
   • CAP3-11 [V] — Decode perf variants from one plan grammar across structured/positional inputs; refuse unsupported kinds and trailing tokens before execution.
   • CAP3-12 [L] — Return the conflict/fence evidence already obtained by start admission; do not reconstruct ownership from repeated synchronous directory scans.
   • CAP3-13 [P] — Associate each contact-sheet change ratio with the displayed predecessor; thinning recomputes provenance and mismatched image geometry is handled explicitly.
   • CAP3-14 [I] — Reuse one ancestor predicate or descend from the target through an index; filter semantic candidates before expensive ancestry work.
   • CAP3-15 [V] — Use strict coordinate token parsing with exact arity; empty strings and discarded extra coordinates are invalid input.
   • CAP3-16 [S] — Own capture kind names and log-backend vocabulary once; align freshness explanations with the code-owned policy without merging unrelated decisions.
   • CAP3-17 [E] — Pin both acceptance without a tap point and rejection with a real point; the retained contract must fail when that branch is broken.

   capture-selectors-kernel.md

   • CAP-1 [I] — Pass one snapshot-owned children index through Android presentation; descendant operations cannot rescan the entire node array per target.
   • CAP-2 [B] — Give snapshot diff an explicit worst-case memory/work contract; evaluate a linear-space algorithm with differential output proof rather than treating typed arrays as complexity removal.
   • CAP-3 [I] — Separate recursion-path cycle detection from shared-subtree memoization; aliases retain data while actual cycles terminate without exponential cloning.
   • CAP-4 [O] — Use one positive-finite-rectangle rule where import budgets permit; otherwise preserve explicit shared-fixture parity until a statement-neutral consolidation is feasible.
   • CAP-5 [I] — Build immutable overlay classification and ancestry evidence once per snapshot; reuse it without caching across changing surfaces.
   • CAP-6 [I] — Compute settle chrome classification once per captured tree and pass the result through diff/tail construction.
   • CAP-7 [I] — Carry previous/current captures explicitly through stability polling; remove a cache whose identity key can never repeat.
   • CAP-8 [R] — Recognize cancellation by the shared typed contract; arbitrary user/tool messages cannot become cancellation authority.
   • CAP-9 [P] — Normalize error refs at the wire boundary and type bare versus displayed refs distinctly; coordinate all producers/consumers under a separate child related to Interaction guarantee gaps (ADR 0011 umbrella) #1081.
   • CAP-10 [E] — Have device fakes consume production selector grammar while independently asserting expected matches; no simplified fake parser defines a second language.
   • CAP-11 [S] — Derive role hints from the existing semantic role vocabulary plus explicitly named presentation additions.
   • CAP-12 [F] — Describe the actual whole-value matching normalization in versioned help; documentation changes cannot silently redefine selector equality.
   • CAP-13 [O] — Give semantic touch classification one owner only where role semantics match; keep intentional editable-field distinctions named and covered.
   • CAP-14 [V] — Parse find into a closed action/timeout plan and reject leftovers; invalid timeouts cannot silently become defaults.
   • CAP-15 [V] — Use the shared boolean-literal decoder for set-valued flags with an explicit empty-value rule.
   • CAP-16 [D] — Remove impossible hidden-group formatting modes after checking production inputs; keep only representable presentation choices.
   • CAP-17 [K] — Review subpath exports as package contracts before removal; distinguish private workspace entries from published SDK compatibility.
   • CAP-18 [E] — Prove each allegedly redundant occlusion guard from an enforced invariant and retained mutation detection; no generic guard deletion from comments alone.
   • CAP-19 [I] — Use monotone ancestor marking with an already-visible stopping condition; validate tree assumptions and cycles at the snapshot boundary.
   • CAP-20 [I] — Compile selector terms once per resolution with normalized query values; node matching consumes the compiled query without re-parsing.
   • CAP-21 [O] — Reuse geometry primitives only with identical empty/infinite semantics; name intentional variants and preserve cross-language fixture parity.
   • CAP-22 [X] — Align the package description with its current owner; no code architecture change is justified by metadata alone.
   • CAP-23 [S] — Derive presentation-key inputs from the declared key list, use precise visibility-summary naming and one strict ref grammar; split mixed subitems by owner.

   command-packages-2.md

   • CMD2-1 [V] — Model clipboard input as read or write-with-required-text, where empty text is valid; one decoder drives structured input and CLI projection.
   • CMD2-2 [R] — Have boot probes produce typed retry dispositions; only stable facts influence polling, while raw tool text is bounded diagnostic evidence.
   • CMD2-3 [D] — Remove unused bound selector/focus operations from the runtime contract and test the routed public operations; do not retain a second hidden execution API.
   • CMD2-4 [A] — Make native-ref preflight consume the authorized immutable frame via its existing resolver, not a general session observation; keep resolution provenance with the resolved target.
   • CMD2-5 [P] — Bind each diff baseline to its presentation key; incompatible snapshots yield a new baseline or a typed mismatch rather than a misleading change report.
   • CMD2-6 [V] — Pair every schema field with an actual runtime decoder; reject unsupported structured values before projection, including scalar constants and discriminated unions.
   • CMD2-7 [T] — Separate archive inspection requirements from extraction mechanics; preserve traversal/size checks and transactional staging while sharing the validated entry list.
   • CMD2-8 [F] — Construct structured snapshot output once and render text only at the selected output boundary; a JSON caller cannot trigger hidden text rendering passes.
   • CMD2-9 [R] — Use the selector owner's typed missing-target failure with property context; ref/get/find presentation cannot invent a second diagnostic taxonomy.
   • CMD2-10 [E] — Share schema assertion mechanics while keeping family-specific contract expectations and exceptions explicit; reducing files is not removing independent proof.
   • CMD2-11 [V] — Format a ref annotation only from a validated present ref; absent identity has an explicit presentation variant.
   • CMD2-12 [H] — Build capture context from one request-scoped host/session constructor; snapshot cannot omit cancellation, provenance or scope fields passed to sibling captures.
   • CMD2-13 [L] — Give provider rentals explicit waiter/holder ownership through delivery; loss of the last in-budget waiter triggers teardown, with all driver failure factories observed.
   • CMD2-14 [V] — Expose the concrete archive budget capability from its owner; decide missing-scope behavior at construction instead of asserting the type at use.
   • CMD2-15 [K] — Keep deprecated public URL-trust APIs behind an explicit removal release and migration note; internal non-use alone does not authorize breaking removal.

   command-packages.md

   • CMD-1 [D] — Expose only command-runtime operations reached by the production binding; delete unreachable families and their owned state after checking public and dynamic entrypoints.
   • CMD-2 [R] — Have execution timeout producers issue a typed reason with timing evidence; timeout classification cannot be inferred from a numeric diagnostic field.
   • CMD-3 [H] — Make async lock acquisition consume bounded asynchronous owner observations; preserve the separately supported synchronous acquisition contract until migrated deliberately.
   • CMD-4 [A] — Bind reclaim guards to a verifiable acquisition identity; compare the observed guard under the mutation guard and retain unknown ownership rather than expiring by age.
   • CMD-5 [B] — Make source-download and install phase budgets explicit parts of the install ledger; change total versus idle semantics only with the end-to-end requirement.
   • CMD-6 [L] — Use one host-kit identity-checked stop sequence with explicit initial signal, grace and terminal observations; backend-specific recording semantics stay with backends.
   • CMD-7 [H] — Read bounded process facts through the host-process owner and retain executor isolation; combine probes only when platform parsing preserves command boundaries.
   • CMD-8 [R] — Return a spawned-process handle only after a spawn event; failure is a typed outcome, never a sentinel PID that every caller must rediscover.
   • CMD-9 [L] — Own process-group lifetime separately from the direct child; child exit cannot cancel cleanup while owned descendants remain, and each later signal requires identity proof.
   • CMD-10 [C] — Define the device-selection key from every semantic target input, including simulator app target; exclude unrelated ambient environment data.
   • CMD-11 [B] — Represent operation budget and client result margin as separate validated durations; conversions cannot produce negative daemon time or erase the response margin.
   • CMD-12 [V] — Use one strict wait/find numeric decoder and explicit grammar variants; absence, blank text, zero and trailing garbage are distinct inputs.
   • CMD-13 [F] — Format text from the same structured outcome as JSON; keep required state and empty-list presentation in the owning formatter.
   • CMD-14 [F] — Make text decorators preserve every non-text output field by construction; appended notes cannot drop JSON data or stderr.
   • CMD-15 [O] — Reuse existing durable-file and host helpers only where their preconditions match; keep symlink/ownership checks at publication rather than adding a weaker wrapper.
   • CMD-16 [H] — Make home versus host-global claim storage explicit in the host contract; every caller uses the same captured environment and documented authority.
   • CMD-17 [K] — Investigate real cross-session artifact interference, then choose an injective session storage key or validated names with a deliberate migration; add ownership to reads meanwhile where required.
   • CMD-18 [R] — Return retry outcome with actual attempts and a typed stop reason; exhausted, non-retriable, canceled and deadline-spent cannot share fabricated counts.
   • CMD-19 [C] — Distinguish a successful architecture observation from probe failure before memoization; transient failure cannot become a permanent host fact.
   • CMD-20 [K] — Remove an option with no behavioral choice through the supported public-surface retirement path; a future mode is not an active contract.
   • CMD-21 [E] — Retain independent descriptor relationships/completeness checks; consolidate literal mirror scaffolding only after identifying the failure each assertion detects.

   contracts-clients-2.md

   • CONTR2-1 [H] — Split claim-record decoding from live-owner classification; cache only this process's stable identity and obtain foreign facts asynchronously at the authority check.
   • CONTR2-2 [P] — Return the scanned log's absolute continuation cursor independently of decoded events; malformed lines and rotation cannot make clients infer offsets.
   • CONTR2-3 [E] — Route loopback availability through the test-kit skip policy and CI-required mode; unavailable infrastructure is an explicit skip or failure, never a silent pass.
   • CONTR2-4 [A] — Create daemon state and logs through the existing launcher owner with explicit private creation modes; reopening cannot substitute for creation-time policy.
   • CONTR2-5 [S] — Let journal presentation import command-domain vocabularies and derive supported result variants; no second gesture-kind list omits newly added kinds.
   • CONTR2-6 [I] — Build a node index once for one immutable snapshot analysis and pass it to ancestor queries; callers cannot hide a full rebuild inside each lookup.
   • CONTR2-7 [R] — Represent claim decode failure separately from ownership classification; make refusal presentation exhaustive over reachable classified states.
   • CONTR2-8 [R] — Use producer-owned reason values and one transport-preference decoder; preserve released reason spellings while removing contradictory local interpretations.
   • CONTR2-9 [L] — Put Metro-hint retirement in the client session-close operation shared by both public close entrypoints; app/session intent remains explicit.
   • CONTR2-10 [A] — Require reconciliation to receive a root-confined session directory from the common resolver; an unreadable or unsafe claim remains retained.
   • CONTR2-11 [T] — Separate event append from rotation maintenance and cursor metadata; define degraded append semantics so a rotation failure cannot suppress all later events.
   • CONTR2-12 [D] — Have launcher entries derive from the current build outputs; keep recognition of older running processes separate from launching this installed package.
   • CONTR2-13 [O] — Use the existing viewport-root predicate and ancestor traversal with explicit empty/offset semantics; identical terminology must identify identical geometry rules.
   • CONTR2-14 [E] — Give type-only contracts a compiler-owned test category; moving them must preserve inclusion and negative-check detection, not merely reduce runtime test counts.
   • CONTR2-15 [R] — Treat diagnostics as a secondary observation of retirement; diagnostic failure cannot replace the recorded retirement outcome or escape as an unhandled rejection.
   • CONTR2-16 [X] — Document the current retention predicates beside their implementation and link the owning ADR; remove historical narratives without changing recovery behavior.

   contracts-clients-3.md

   • CONTR3-1 [S] — Make relaunch policy a required lifecycle binding input with typed unsupported behavior; constructing a platform binding cannot silently omit the decision.
   • CONTR3-2 [V] — Decode bounded summary statistics and closed vocabularies once at ingress; merge weighted aggregates without expanding attacker-controlled counts into arrays.
   • CONTR3-3 [R] — Give an advertised-but-missing interactor operation one invariant-error constructor; unsupported admission and broken runtime construction remain distinct variants.
   • CONTR3-4 [D] — Delete a producerless compatibility message and its stale exemption together after caller verification; dead exports cannot be kept alive solely by an allowlist.
   • CONTR3-5 [K] — Retire the no-op update option across schema, grammar, types and projection under an explicit release decision; do not retain a misleading executable contract.
   • CONTR3-6 [P] — Let ad-script own bidirectional screenshot flag encoding, consuming the existing command-surface definitions through an allowed seam; wire contracts do not own script grammar.
   • CONTR3-7 [O] — Unify only shapes with the same meaning and derive closed subsets; preserve deliberate client/runtime distinctions instead of creating a universal shape generator.
   • CONTR3-8 [H] — Keep platform decisions with the platform and shared contracts data-only; remove owner-specific mechanics from contract hubs without changing ADR0028's capability authority.
   • CONTR3-9 [S] — Derive each settings operation's client union from its valid command forms; device-level and app-level options cannot be combined accidentally.
   • CONTR3-10 [X] — Collocate each rule's explanation with its actual owner and remove obsolete comments; rename only where domain meaning improves.
   • CONTR3-11 [O] — Use relative imports within the contracts package and explicit exports only at package boundaries; internal imports cannot accidentally traverse a public facade.
   • CONTR3-12 [P] — Distinguish producer identity from backend identity in statistics types and aggregation; retain or version the published wire key deliberately.
   • CONTR3-13 [X] — Split the mixed leftovers into meaningful local corrections; narrow impossible branches and derive existing unions before proposing another shared layer.

   contracts-clients.md

   • CONTR-1 [A] — Make credentialed HTTP transport own redirect admission on every hop; caller-selected origin and TLS policy travel with credentials, never with Location.
   • CONTR-2 [B] — Pass RPC deadline/cancellation through the proxy as operation context; keep health and transfer policies separate from command envelopes.
   • CONTR-3 [R] — Construct RPC errors through one normalized JSON-RPC encoder; a REST error string cannot inhabit the RPC response variant.
   • CONTR-4 [A] — Issue client-owned artifact destinations keyed by remote identity, tenant, session and capture generation; resolve stop/report from that authority and publish files without following destination symlinks.
   • CONTR-5 [A] — Make diagnostics accept only a session path resolved beneath its root by the existing session-path owner; remote strings cannot bypass segment validation.
   • CONTR-6 [O] — Give backend capture and interactor capture distinct result names and one explicit conversion; reuse truly identical option types.
   • CONTR-7 [L] — Model download as response admission, bounded streaming, then publication; every response end, abort and error settles and closes the same owned stream.
   • CONTR-8 [S] — Own keyboard action vocabulary below execution and journaling; derive named input/output subsets without making journal presentation an execution dependency.
   • CONTR-9 [O] — Name client targets and runtime targets by their role; require an explicit boundary conversion rather than competing identically named shapes.
   • CONTR-10 [R] — Own lease failure variants at the protocol boundary, including external producers; use exhaustive consumer matching without inventing producerless local branches.
   • CONTR-11 [D] — Remove a test-only exported diagnostic constructor only after proving no public/dynamic contract needs it; exercise diagnostics through their real production owner.
   • CONTR-12 [B] — Give each transfer explicit total and inactivity budgets, resumable byte offsets and terminal cancellation; transport owns mutually exclusive length/framing headers.
   • CONTR-13 [A] — Derive advertised upload origin from trusted proxy configuration or validated forwarded provenance; arbitrary header text cannot become URL scheme authority.
   • CONTR-14 [K] — Version connection-state decoding explicitly; reject superseded credential fields according to the supported migration contract rather than quietly retaining them.
   • CONTR-15 [O] — Use the existing remote config and URL constructors directly; share only the artifact-root rule whose meaning is actually identical.
   • CONTR-16 [X] — Keep constraints next to enforcing code and historical explanations in issue history; remove stale comments without adding a comment-lint framework.
   • CONTR-17 [E] — Keep negative type proofs in a compiler-owned target with discoverable inclusion; classify fixture smoke separately from production-behavior tests.
   • CONTR-18 [H] — Separate cheap liveness polling from bounded asynchronous identity observations; process reuse/zombie evidence remains required before destructive actions.
   • CONTR-19 [R] — Decode socket replies into the actual response union before resolving; preserve the primary request failure when subsequent cleanup also fails.

   daemon-core.md

   • DCORE-1 [R] — Make script publication return written, skipped or failed explicitly; close aggregates resource retirement and publication outcomes without converting filesystem failure into success.
   • DCORE-2 [L] — Adopt every asynchronous binding through the request scope; a binding delivered after disposal is immediately cleaned by the same owner.
   • DCORE-3 [P] — Return aggregate sequence timing with first start, last end and per-repetition spans; recording consumes that evidence instead of extrapolating from the final gesture.
   • DCORE-4 [V] — Represent recorded text as present-or-absent independently of its value; empty fill remains a valid action through optimization and serialization.
   • DCORE-5 [O] — Require the bound capture operation at construction and remove legacy interactor capture; all callers share one admitted capture authority.
   • DCORE-6 [L] — Express authoring publication transitions as an exhaustive state transition; impossible none-to-authoring calls fail at the owning boundary.
   • DCORE-7 [D] — Remove internal flags with no producer through their full projection chain; no compatibility branch remains solely for its own test.
   • DCORE-8 [O] — Use the canonical session lease type directly; remove producerless compatibility input rather than reconciling parallel lease shapes.
   • DCORE-9 [K] — Choose whether deferred stability carries an absolute deadline or no timing state; a timestamp must affect the owner's budget or be deleted.
   • DCORE-10 [O] — Share runtime admission predicates and the unavailable-operation traversal; daemon and session admission cannot maintain competing interpretations of the same facts.
   • DCORE-11 [D] — Remove unreachable script-writing branches after checking serialized consumers; emitted metadata must have a real supported meaning.
   • DCORE-12 [X] — Build the complete device-contention hint before trimming; fix the local expression without adding a formatting abstraction.
   • DCORE-13 [P] — Model duration sources by provenance and precedence; native span, reported duration and defaults remain distinct from wall-clock event offset.
   • DCORE-14 [V] — Specify whether anonymous surfaces have a semantic key; make the return type reflect that rule rather than an impossible undefined branch.
   • DCORE-15 [C] — Tie readiness evidence to device boot/generation and lifecycle invalidation; a successful old boot cannot authorize operations after shutdown.
   • DCORE-16 [X] — Retain only current invariants that code cannot express; remove historical narration with no runtime redesign.
   • DCORE-17 [K] — Associate legacy recovery readers with supported persisted formats and a removal decision; startup cannot accumulate unbounded migration phases.

   daemon-execution.md

   • DEXEC-1 [V] — Parse ref syntax through the existing selector/ref grammar at its actual target boundary; arbitrary user text never becomes a ref by prefix heuristic.
   • DEXEC-2 [T] — Resolve and validate an interaction plan before expiring the ref frame; only the admitted side-effect seam consumes mutation authority.
   • DEXEC-3 [S] — Map event templates by the canonical platform vocabulary and validate configuration at use; hints name only supported configuration keys.
   • DEXEC-4 [V] — Decode wait into sleep or device-observation before runtime admission; duration-only waits have no device capability requirement.
   • DEXEC-5 [O] — Let one Android dialog owner perform the cheap probe and targeted recovery; recording cannot introduce a second unconditional accessibility capture.
   • DEXEC-6 [P] — Separate artifact identity from optional materialized archive size; defer archive construction only through an explicitly compatible inventory response shape.
   • DEXEC-7 [S] — Decode alert actions from the owning closed vocabulary before binding; unknown actions cannot fall through as get.
   • DEXEC-8 [R] — Restrict foreground-surface enrichment to typed observation failures; validation and cancellation retain their original normalized error variants.
   • DEXEC-9 [T] — Stage screenshots and complete crop/validation before atomic publication; a failed derived capture cannot expose an uncropped image at the requested destination.
   • DEXEC-10 [R] — Keep action-dispatched and effect-observed as independent facts; failed verification preserves the dispatched tap and never asserts dismissal.
   • DEXEC-11 [T] — Have each command resolve a validated execution plan before lease admission, binding or recovery; rejected input creates no device effects.
   • DEXEC-12 [L] — Give timeout-evidence directories a request/session artifact owner with explicit retention; partial generation rolls back and published evidence follows normal download lifetime.
   • DEXEC-13 [B] — Pass the request signal and remaining deadline into every dialog probe and wait; cancellation stops the recovery loop before another mutation.
   • DEXEC-14 [A] — Issue host leases through the same non-reuse invariant as other leases; publish tenant bookkeeping only after issuance succeeds.
   • DEXEC-15 [R] — Stamp the escaped-app outcome at its producer with a typed reason and dispatch facts; consumers do not classify by incidental detail shape.
   • DEXEC-16 [O] — Call existing ref normalization and runtime owners directly; delete pass-through adapters that add no domain decision.
   • DEXEC-17 [X] — Replace migration narration with a standing ownership constraint only where code cannot show it; no separate architecture project.
   • DEXEC-18 [R] — Return or record bounded secondary failures through diagnostics without changing primary behavior; best effort remains explicit at the owning operation.
   • DEXEC-19 [I] — Carry scroll-edge analysis on the immutable baseline for one command; downstream planning reuses its container and visibility facts.
   • DEXEC-20 [L] — Centralize snapshot replace/clear transitions with scope and comparison-baseline semantics; partial writers cannot leave stale associated metadata.

   daemon-server-core.md

   • DSRV-1 [L] — Establish a daemon diagnostics scope for the daemon lifetime and a nested request scope per request; teardown/startup events always have an owner.
   • DSRV-2 [L] — Own each timeout race as a disposable timer-and-operation pair; normal completion cancels the losing timer and its misleading timeout report.
   • DSRV-3 [A] — Enforce a shared byte-counted request admission limit before authentication buffering grows; all transports and clients agree on the envelope cap.
   • DSRV-4 [V] — Decode environment integers through a strict bounded grammar with explicit unset/invalid distinction; blank text is not zero.
   • DSRV-5 [B] — Declare upload total and inactivity policies at route construction; Node defaults cannot silently override an admitted large-transfer contract.
   • DSRV-6 [T] — Hash the bytes received before committing every upload path; integrity validation belongs to publication, not only one transport variant.
   • DSRV-7 [L] — Let a pipeline own source and response stream disposal; client disconnect settles the same lifetime as successful diagnostics delivery.
   • DSRV-8 [V] — Use one byte-bounded body reader and route-specific error encoder; Unicode sizing and oversize responses cannot diverge between HTTP and socket.
   • DSRV-9 [A] — Authenticate a request before renewing daemon activity or in-flight ownership; rejected traffic cannot keep the daemon alive.
   • DSRV-10 [P] — Specify when the streaming response becomes committed and how later errors are framed; implementation and protocol documentation must agree.
   • DSRV-11 [A] — Reuse one credential reader and declared admission ordering across HTTP routes; auxiliary endpoints cannot invent a different trust gate.
   • DSRV-12 [V] — Parse URL pathname once and decode each route segment exactly once; route dispatch cannot mix raw query text with decoded identity.
   • DSRV-13 [V] — Require archive root identity supplied by its caller; extraction cannot infer authority from optional unrelated platform fields.
   • DSRV-14 [K] — Treat RPC method aliases as a published protocol decision; remove only with external-consumer/version evidence, not repository producer absence.
   • DSRV-15 [L] — Make upload-ticket reuse an explicit lease renewal transition; every returned ticket has a coherent expiry and active timer.
   • DSRV-16 [A] — Keep remote input restriction at the request-scope admission owner that also covers nested steps; ingress stamps provenance without repeating policy.
   • DSRV-17 [X] — Keep current wire/lifetime constraints near their owner and remove obsolete history; no behavioral refactor is implied.
4. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Prevention design ledger 2 of 3

   Prevention design exploration for #4368. Each row is an audit-derived candidate to evaluate at the existing owner, not an approved abstraction or a new confirmed defect. Merged fixes need no follow-up if they already enforce the invariant. Aliases share their canonical direction. The issue body defines design/proof requirements and the prevention family codes.

   daemon-sessions.md

   • DSESS-1 [V] — Resolve push input once into inline-json or file-content with provenance; path probing and NAME_MAX cannot decide the meaning of long JSON.
   • DSESS-2 [L] — Route suite-session close through the same lease-owning session teardown contract as ordinary close; provider release is a required dependency.
   • DSESS-3 [R] — Use DCORE-1's publication outcome; this duplicate requires no second writer or success policy.
   • DSESS-4 [H] — Resolve relative paths from captured request cwd through one existing helper; daemon process cwd never supplies client path authority.
   • DSESS-5 [V] — Validate retention into the supported timer range at every ingress or implement long expiry scheduling explicitly; reported expiry and actual scheduling share one value.
   • DSESS-6 [B] — Discover independent platforms with bounded concurrency and per-owner budgets; preserve deterministic aggregation and partial failures.
   • DSESS-7 [O] — Make session execution dependencies required at construction; tests provide complete hosts instead of production no-op defaults and per-call optional checks.
   • DSESS-8 [R] — Use the shared normalized response constructor for every failure path; redaction, hints and typed details cannot be bypassed by handler literals.
   • DSESS-9 [A] — Capture tenant attribution in the owned perf resource at start and retain it through stop/recovery; finishing request metadata cannot erase ownership.
   • DSESS-10 [O] — Pass the constructed session dependency value directly to handlers; remove rebuilding and test-only lease defaults through DSESS-7.
   • DSESS-11 [L] — Separate existing-session open, fresh-session open and perf report by their distinct transitions; avoid splitting functions solely to satisfy a complexity number.
   • DSESS-12 [D] — Remove unused fields and false lazy-loading seams after reference checks; retain explicit synchronous versus lazy import behavior.
   • DSESS-13 [S] — Type route handler maps against registry-owned route command unions; a new routed command cannot be omitted silently.
   • DSESS-14 [S] — Normalize Android isolation allowlists through their existing owner once; all key builders use the same ordering semantics.
   • DSESS-15 [F] — Send structured progress without daemon terminal styling; the client owns color according to its captured terminal preference.
   • DSESS-16 [S] — Derive doctor scope fields from the existing declared provider key groups; diagnostics cannot omit a newly added scope input.
   • DSESS-17 [V] — Decode the logs plan before admission and bind exactly its required operations once; non-device actions do not acquire unused bindings.
   • DSESS-18 [H] — Resolve caller scope once per captured request context; use bounded memoization only if cross-request invalidation is justified.
   • DSESS-19 [V] — Interpret platform selectors through family/leaf matching against the stored session device; do not compare selector aliases as literal platforms.
   • DSESS-20 [V] — Decode network limits with the shared strict positive-integer reader; trailing junk cannot silently change a requested bound.
   • DSESS-21 [X] — Keep current lifetime/numeric constraints in code names and short comments; delete stale historical statements without new machinery.

   maestro-replay-rn-2.md

   • REPLAY2-1 [R] — Classify infrastructure failures from typed producer evidence only; ordinary failure messages cannot suppress retries.
   • REPLAY2-2 [A] — Build published divergence evidence and its ref scope together; a suggestion can carry an actionable ref only when that same frame issues it.
   • REPLAY2-3 [P] — Export the parsed wait plan, not reparsed positional heuristics; stable/ref/text variants are lowered or explicitly refused with their semantics intact.
   • REPLAY2-4 [L] — Serialize companion ensure/stop through one keyed process-lock owner and roll back partial starts; profiles cannot orphan each other's companion.
   • REPLAY2-5 [L] — Model CDP connection state explicitly and reject sends after closure immediately; pending calls are settled by the connection owner.
   • REPLAY2-6 [P] — Validate exported gesture points with the target format's decoder; unsupported coordinates cannot be emitted as apparently runnable flows.
   • REPLAY2-7 [F] — Use one percent-coordinate formatter whose output round-trips to the coordinate grammar across progress, trace and failure labels.
   • REPLAY2-8 [D] — Remove unused observation construction and forwarding; keep action evidence only at consumers that actually validate or report it.
   • REPLAY2-9 [E] — Generate conformance statements from maintained semantic cases or update them with owner changes; labels cannot certify an algorithm the runtime does not use.
   • REPLAY2-10 [E] — Pin the intentional public export set exactly when that is the contract; a denylist of vanished names cannot detect new unwanted exports.
   • REPLAY2-11 [E] — Assert the typed strict-absence export refusal specifically; an unrelated throw must fail the test.
   • REPLAY2-12 [D] — Narrow the failure projection to produced/consumed evidence and name it accordingly; test-only fields cannot become a competing runtime shape.
   • REPLAY2-13 [R] — Represent manual repair as the actual available outcome unless real evidence supports another route; remove a classifier with a constant result.
   • REPLAY2-14 [V] — Reuse the wait plan and coordinate decoder rather than independent numeric guesses in replay-port.
   • REPLAY2-15 [D] — Keep only companion state needed for ownership and recovery; remove unused command data without weakening identity validation.
   • REPLAY2-16 [P] — Carry literal-versus-placeholder provenance through native-to-Maestro export; inverse escaping is format-specific and depends on REPLAY-1's corrected writer.
   • REPLAY2-17 [F] — Name the React DevTools operation in its own errors; a local message correction needs no profiler abstraction.
   • REPLAY2-18 [D] — Collapse a pass-through diagnostics wrapper into its owner; preserve the actual failure capture boundary.
   • REPLAY2-19 [O] — Use the existing command-domain app-target predicate where semantics match; do not maintain duplicate static-target definitions.
   • REPLAY2-20 [P] — Let one location formatter consume typed source metadata; nested wrappers cannot invent punctuation or append duplicate locations.
   • REPLAY2-21 [R] — Make scroll target observation explicitly reference-backed or geometry-backed; refuse unsupported evidence instead of looping on an impossible success condition or adding an unapproved fallback.

   maestro-replay-rn.md

   • REPLAY-1 [P] — Represent literal text separately from inserted live placeholders and serialize through one escaping owner; record/resolve round trips preserve both meanings.
   • REPLAY-2 [B] — Isolate synchronous user scripts in a request-owned child with bounded I/O, deadline and cancellation; daemon responsiveness is independent of script execution.
   • REPLAY-3 [B] — Define response byte limits once for local and remote script HTTP and size interprocess framing accordingly; transport buffer defaults cannot silently lower the contract.
   • REPLAY-4 [V] — Validate erase counts before allocation through the format's numeric constraints; the runtime receives a bounded count, not an unchecked giant string request.
   • REPLAY-5 [D] — Remove producerless action-source plumbing after preserving digest compatibility deliberately; optional evidence exists only when a producer supplies it.
   • REPLAY-6 [P] — Let the pinned Maestro compatibility adapter own launch-argument lowering, including Boolean cases; conformance fixtures define intentional divergence.
   • REPLAY-7 [V] — Keep variable grammar with its resolved script format and reuse it at every ingress; generic CLI parsing cannot impose native-script rules on Maestro.
   • REPLAY-8 [K] — Preserve intentional Maestro loop semantics and bound enclosing attempts through REPLAY-19; do not invent an iteration cap as an incidental cleanup.
   • REPLAY-9 [R] — Carry normalized suite errors with details and hints to every reporter; aggregation cannot reduce typed failure evidence to text.
   • REPLAY-10 [K] — Remove or redefine the always-zero healed field through an explicit public result-contract decision; do not imply unsupported repair behavior.
   • REPLAY-11 [V] — Tokenize context metadata with the script grammar and validate known keys; quoted names cannot become metadata and invalid values cannot disappear.
   • REPLAY-12 [V] — Use one script-coordinate decoder shared by parser, classifier and writer; every classified coordinate must reparse with the same meaning.
   • REPLAY-13 [P] — Attach source-location metadata as typed provenance when creating located errors; formatting does not detect provenance from message text.
   • REPLAY-14 [O] — Own format-neutral resume validation once and keep engine-specific guards local; identical preconditions cannot drift across engines.
   • REPLAY-15 [A] — Require script trust explicitly and expose only implemented HTTP methods; missing policy never authorizes execution by default.
   • REPLAY-16 [V] — Make accepted snapshot syntax and emitted syntax a bidirectional contract; unknown or retired tokens are rejected according to the release policy.
   • REPLAY-17 [O] — Use test-kit's owned temporary-directory fixtures and remove local clones; preserve cleanup and environment isolation semantics.
   • REPLAY-18 [A] — Validate uniqueness after resolving device identities, before shard launch; aliases cannot allocate concurrent shards onto the same device.
   • REPLAY-19 [B] — Give each test attempt an explicit finite-or-intentionally-unbounded budget policy, override semantics and owned cleanup; select the default through a tracked decision.
   • REPLAY-20 [S] — Declare retry limits once and validate metadata against them; silent clamping cannot obscure the requested execution policy.
   • REPLAY-21 [R] — Return match, mismatch or observation-failed from animation comparison; failed capture takes a bounded retry cadence instead of a CPU loop.
   • REPLAY-22 [K] — Distinguish accepted compatibility metadata from executable filters; tags have a documented meaning without unconsumed runtime state.
   • REPLAY-23 [X] — Keep script/runtime invariants and remove change-history narration; delete a redundant guard only with separate retention evidence.
   • REPLAY-24 [F] — Carry the input field's actual path in validation context; shared validators cannot hard-code a different field name.
   • REPLAY-25 [K] — Minimize package entrypoints after checking layering/public contracts; internal helpers use relative imports without breaking released exports casually.
   • REPLAY-26 [P] — Define native suite order deterministically and preserve Maestro ordering as an explicit compatibility rule; filesystem enumeration is not an implicit scheduler.

   platform-android-2.md

   • ANDR2-1 [R] — Interpret recorder identity as ours, gone, reassigned or unknown; reassigned proves the recorded process ended and never authorizes a signal.
   • ANDR2-2 [R] — Decode default-IME probes into known value or unreadable evidence; unknown cannot become inactive and retire restoration authority.
   • ANDR2-3 [O] — Choose one readiness owner and pass its returned device value forward; admission cannot certify one device while deployment uses a stale one.
   • ANDR2-4 [R] — Keep export-committed and native-chunks-retired as independent facts; failed deletion cannot retroactively invalidate an already served artifact.
   • ANDR2-5 [T] — Model recorder launch as stage-marker, launch and confirm; candidate-directory failure before dispatch rolls back before any explicitly supported next candidate.
   • ANDR2-6 [C] — Key clipboard capability by device boot generation and bound probes with the request scope; unreachable devices yield unknown, not cached permanent refusal.
   • ANDR2-7 [P] — Schedule chunk rotation from each native launch instant, not completion of previous teardown; disclose early recorder exit as an observation.
   • ANDR2-8 [D] — Remove the unused push pipeline and preserve unique cases at the deployment owner; one production route owns broadcast behavior.
   • ANDR2-9 [D] — Remove the unused install pipeline, preserving app-resolution tests at their actual owner; derived app naming has one definition.
   • ANDR2-10 [D] — Limit the mechanics facade to real external consumers and let local tests import owners; dead-code analysis then sees actual roots.
   • ANDR2-11 [V] — Dispatch manifest readers by validated artifact format; AAB protobuf cannot enter an APK XML parser under a misleading candidate name.
   • ANDR2-12 [I] — Share one bounded feature observation per inventory read and poll only the selected emulator's readiness; unrelated devices are outside the polling plan.
   • ANDR2-13 [O] — Use one cancelable deadline-based boot waiter with typed observations; compatibility adapters do not own another retry policy.
   • ANDR2-14 [L] — Define each setting operation's mutate, verify and cancel contract at its handler; use the existing common toggle mechanics where semantics coincide.
   • ANDR2-15 [H] — Resolve adb from the captured host SDK roots once; doctor and inventory probe the executable that actual commands will use.
   • ANDR2-16 [E] — Make recording fixtures implement the current transport contract directly; obsolete fixture adapters cannot keep retired production shapes alive.
   • ANDR2-17 [E] — Test pure parsers with buffers and timing state with an injected clock; retain a small number of real archive/process seam tests.
   • ANDR2-18 [R] — Set truncation when a presentable node is actually refused or traversal evidence is incomplete; reaching a count alone does not prove dropped output.
   • ANDR2-19 [I] — Carry the PID already observed in network recovery context into the bounded request; avoid duplicate unsynchronized process lookups.

   platform-android.md

   • ANDR-1 [P] — Treat adb text encoding as a codec with literal round-trip properties; chunking cannot let percent-s escape syntax reinterpret user text.
   • ANDR-2 [R] — Return IME commit acknowledgement with actual committed length/outcome; broadcast delivery alone cannot certify text entry.
   • ANDR-3 [A] — Bind the persistent helper protocol to an authenticated host session before dispatch and bound silent-peer reads; review credential bootstrap/exposure separately from the token check.
   • ANDR-4 [O] — Use one foreground-app observation owner with version-aware dump ordering; state and lifecycle consumers share the same parsed evidence.
   • ANDR-5 [R] — Separate helper unavailable, command refused without dispatch and transport unknown-effect outcomes; apply only the existing authorized fallback policy after typed admission.
   • ANDR-6 [L] — Track helper health separately from application command refusal; a healthy non-dispatched refusal cannot automatically retire the process-lived helper.
   • ANDR-7 [I] — Parse helper XML once into a capture-owned tree and derive recovery, presentation and verification views from that immutable parse.
   • ANDR-8 [C] — Own helper artifact resolution once with a complete package/version/root identity; reuse successful immutable preparation without hiding replacement/failure invalidation.
   • ANDR-9 [O] — Keep one helper installation mechanism with explicit version/recovery inputs; snapshot and IME callers cannot maintain different package-trust policies.
   • ANDR-10 [P] — Publish viewport geometry from the active display with rotation/override provenance; tests use the production geometry reader.
   • ANDR-11 [L] — Serialize helper acquisition/start/stop by device identity and register forward cleanup immediately; every partially acquired resource belongs to rollback.
   • ANDR-12 [L] — Give reverse-port mappings a real device/runtime lifetime and owner; per-call construction cannot pretend to provide persistent deduplication.
   • ANDR-13 [R] — Produce a typed boot result at its source and use that in polling; changing an error message cannot change emulator control flow.
   • ANDR-14 [K] — Remove unused native commands with an explicit helper protocol/version change and host/native agreement, not just a host-side search.
   • ANDR-15 [S] — Resolve capture limits and timeout defaults once into a request value; host/native diagnostics report the same applied values.
   • ANDR-16 [O] — Call package-local helper mechanics directly; keep the host port limited to services supplied by a different owner.
   • ANDR-17 [T] — Treat screenshot demo settings as a scoped mutation: record prior state, apply, capture and restore exactly, including originally absent settings.
   • ANDR-18 [D] — Delete the unreachable package-installed branch after its input invariant is confirmed; do not add another fallback.
   • ANDR-19 [R] — Have one key dispatch outcome carry delivery/effect facts for every key route; unsupported TV key duration is explicit rather than discarded.

   platform-apple-2.md

   • APPLE2-1 [L] — Let the bridge connection own permanent terminal/error listeners from connect through disposal; request listeners cannot leave an idle socket unobserved.
   • APPLE2-2 [R] — Model optional network-history recovery as recovered, unavailable or canceled; only its permitted failures degrade while primary results survive.
   • APPLE2-3 [O] — Use the same app-identity predicate builder for live and historical logs; report whether recovery actually ran as evidence.
   • APPLE2-4 [P] — Carry freshly verified process identity through one bridge exchange with a post-exchange check; avoid duplicate probes without caching destructive authority.
   • APPLE2-5 [E] — Make exec fakes honor allowFailure and model returned failures separately from thrown transport errors; remove unreachable classification only after its true seam is established.
   • APPLE2-6 [S] — State the supported confirmation device family explicitly in admission; add iPad behavior only after source/device evidence resolves the intended contract.
   • APPLE2-7 [P] — Resolve perf identity from the running process and verified bundle relationship; Spotlight order cannot choose a different installed copy.
   • APPLE2-8 [S] — Give recording backends a typed kind and define invalidation only for reachable states; daemon logic does not branch on display labels.
   • APPLE2-9 [R] — Have runner cleanup return the existing confirmed/pending observation contract; an exception cannot bypass recording retention decisions.
   • APPLE2-10 [L] — Dispose timers and abort listeners with their bridge/perf wait scope; whichever branch settles first closes the losing wait.
   • APPLE2-11 [E] — Validate actual emitted request keys and decoder fields against cross-language fixtures; unused mirror constants cannot certify production wire parity.
   • APPLE2-12 [V] — Validate envelope once and tree depth/node limits during traversal; validated immutable data is not repeatedly rechecked with inconsistent bounds.
   • APPLE2-13 [P] — Return the actual perf capture method from the capture owner; formatters cannot invent a tool name independently.
   • APPLE2-14 [H] — Route background captures through the scoped Apple tool provider or refuse unsupported transport; a remote PID can never reach host-local xctrace.
   • APPLE2-15 [H] — Construct injected-runner capabilities only from operations the scoped provider can execute; tvOS clipboard writes cannot escape to local simctl.
   • APPLE2-16 [B] — Execute independent trace exports with bounded concurrency under one request deadline; distinct outputs do not require serial full budgets.
   • APPLE2-17 [X] — Remove stale/orphaned docs and keep current recovery constraints beside the enforcing declaration; no new code layer.
   • APPLE2-18 [B] — Resolve bridge duration/byte bounds once with explicit units and one expiry owner; duplicate timers do not independently govern the same phase.
   • APPLE2-19 [O] — Share command construction for identical double-tap/focus behavior and remove constant injected parameters; retain real transport seams.
   • APPLE2-20 [E] — Assert timing transitions through injected clocks and call ordering; reserve wall-clock/device latency measurements for performance evidence.
   • APPLE2-21 [B] — Batch independent symbol-tool lookups and bound parallel image-group work; use directory metadata already returned instead of redundant stats.

   platform-apple.md

   • APPLE-1 [C] — Own helper preparation as keyed single-flight work with atomic artifact publication; immutable source/toolchain identity is cached separately from fresh app state.
   • APPLE-2 [I] — Read plist data in process where the owner permits and cap inventory concurrency; discovery has an explicit deadline instead of one spawn per unbounded app.
   • APPLE-3 [C] — Timestamp boot evidence when observed, never when read; cache hits cannot renew their own validity.
   • APPLE-4 [T] — Create a prepared replacement artifact before the irreversible uninstall seam; install/reinstall share prepared deployment and preserve returned identity fields.
   • APPLE-5 [O] — Keep one host-injected simulator boot owner with explicit request deadline and retry policy; sibling callers consume its result rather than boot again.
   • APPLE-6 [B] — Require operation-specific bounded spawn options or an explicit intentional-unbounded variant at the Apple tool boundary; audit callers without imposing one arbitrary universal timeout.
   • APPLE-7 [I] — Read and validate an Info.plist once, then project required keys; repeated shell extraction cannot define three divergent parsers.
   • APPLE-8 [O] — Have one simulator-app identity reader return container, plist and executable evidence; consumers cannot bypass null/invalid-container handling.
   • APPLE-9 [B] — Resolve physical-app identity within the request scope and pass cancellation through close; reuse identity only with declared invalidation or a targeted query.
   • APPLE-10 [R] — Convert stable tool codes/status into typed screenshot failure reasons at the adapter; retry decisions cannot consume combined argv/message text.
   • APPLE-11 [B] — Give physical inventory probes explicit budgets and skip redundant discovery for an already resolved exact device; cancellation reaches each spawn.
   • APPLE-12 [C] — Share native helper/toolchain preparation by complete build identity with explicit invalidation; per-command capture state remains fresh.
   • APPLE-13 [I] — Resolve URL-scheme ownership from one bounded app/plist inventory; avoid sequential per-app tool spawns.
   • APPLE-14 [R] — Represent the real launch-attempt policy once with accurate attempt reporting; dead counters cannot imply retries that are unreachable.
   • APPLE-15 [B] — Recompute remaining boot time before each substep and consume authoritative bootstatus evidence; no phase receives the entire budget twice.
   • APPLE-16 [V] — Classify physical devices from stable identity/OS fields and exclude the host explicitly; user-assigned display names are not platform discriminants.
   • APPLE-17 [C] — Use the simulator address owner to define cache identity, including scoped set/host; a UDID alone cannot alias distinct simulator namespaces.
   • APPLE-18 [O] — Remove duplicate reads/helpers within the existing Apple owners only after preconditions match; preserve readiness at one intentional boundary.

   providers-platforms-2.md

   • PROV2-1 [S] — Declare hardware-button support per actual driver and lower through its supported protocol; Android and iOS cannot share a guessed mobile command.
   • PROV2-2 [L] — Track recorder start/stop observations in the recording owner before a non-idempotent HarmonyOS toggle; unknown state cannot authorize another toggle.
   • PROV2-3 [V] — Separate device-only open from app activation and type platform-specific activation arguments; an empty object cannot masquerade as a valid activateApp request.
   • PROV2-4 [B] — Observe scroll viewport through a request-bounded provider call; define unavailable evidence explicitly before considering any fallback or cache.
   • PROV2-5 [H] — Record browser-fleet identity from one bounded asynchronous host observation, reusing actual command tokens; foreign identity remains fresh at signalling.
   • PROV2-6 [S] — Construct HarmonyOS perf bindings from truthful operation-specific facts; never advertise an operation whose only implementation is unavailable.
   • PROV2-7 [R] — Keep unavailable reasons with their actual capability cells and platform; a refusal cannot borrow a different operation's explanation.
   • PROV2-8 [V] — Tokenize quoted snapshot labels and trailing metadata separately; value patterns cannot inspect user-visible quoted names as protocol syntax.
   • PROV2-9 [A] — Identify managed processes by canonical executable/script entry and launch provenance before recording them; arbitrary argv substrings cannot authorize reaping a process tree.
   • PROV2-10 [S] — Keep iOS keyboard-enter admission and capability notes aligned with verified routes; unsupported dormant branches are not evidence of support.
   • PROV2-11 [O] — Have deployment request post-install open through the lifecycle owner; target resolution and launch arguments have one meaning.
   • PROV2-12 [T] — Wait for stable native recording evidence, stage once, validate and commit; media copying and cleanup report typed independent outcomes.
   • PROV2-13 [D] — Remove unused provider fields/parameters and aliases after external-contract checks; no speculative state survives only through forwarding.
   • PROV2-14 [X] — Name the Limrun runtime owner for the operations it actually binds and update its baseline entry; do not move ownership merely for cosmetic consistency.
   • PROV2-15 [X] — Keep current fact meaning beside its declaration and delete migration history; preserve owner-authored capability answers under ADR0028.
   • PROV2-16 [E] — Assert real host calls, argv and typed failures at the production seam; a test title or any-throw assertion does not prove the named refusal.

   providers-platforms.md

   • PROV-1 [R] — Decode transport status and dispatch evidence independently of optional JSON error bodies; malformed server text cannot erase retry/auth semantics.
   • PROV-2 [L] — Use the existing provision-kit rental owner for shared waiter/holder/release rules where semantics match; migrate providers separately with their stop confirmations explicit.
   • PROV-3 [A] — Keep sensitive text in stdin/request bodies and scrub process-error evidence at the command adapter; executable argv contains only non-secret control data.
   • PROV-4 [L] — Keep immutable plugin installations while selected or used by a running daemon; investigate owner-aware garbage collection with a tracked liveness/retention contract.
   • PROV-5 [V] — Lower logical press/release through a versioned ydotool command adapter; platform options cannot be invented by generic input code.
   • PROV-6 [L] — Distinguish start-app from wait-for-command execution at the Linux host port; detached apps return a verified launch handle and typed spawn failures.
   • PROV-7 [B] — Stream hosted app uploads under explicit total/idle and caller budgets; bounded transport failures preserve authentication/status reasons without loading the whole app.
   • PROV-8 [P] — Derive artifact service region from the provider session identity that created it; ambient region is only an explicitly permitted creation default.
   • PROV-9 [V] — Decode CDP frames/events at the socket boundary before handler dispatch; invalid unsolicited data produces bounded diagnostics instead of escaping an event callback.
   • PROV-10 [L] — Treat session deletion as an idempotent confirmed release operation; transient failure retains ownership for retry and already-gone is a typed success.
   • PROV-11 [R] — Carry AT-SPI traversal completeness with every tree result; a depth/node limit cannot silently advertise a full snapshot.
   • PROV-12 [T] — Bracket held mouse buttons with owned finally-release behavior; intermediate motion failure cannot leave global input state pressed.
   • PROV-13 [L] — Evaluate the final AWS readiness observation before deciding failure and cleanup; reaching the deadline does not erase a just-confirmed running session.
   • PROV-14 [A] — Accept the provider's validated WebDriver endpoint field with explicit scheme policy; unrelated metadata cannot become a guessed credential destination.
   • PROV-15 [I] — Capture managed-backend status once for the command and pass it through the invocation; nested helpers cannot reread inconsistent synchronous status files.
   • PROV-16 [P] — Expose the executable actually admitted by the managed-backend owner; remove a misleading binaryPath only through the public diagnostic contract decision.
   • PROV-17 [B] — Give Linux screenshot operations bounded execution and explicit supported options; admitted crop/format flags cannot be silently ignored.
   • PROV-18 [S] — Advertise only supported long-press duration behavior and refuse unsupported overrides before dispatch; duration is not an ignored input.
   • PROV-19 [K] — Choose a keyboard-dismiss contract with evidence of keyboard visibility or disclose Back semantics explicitly; do not hide a navigation mutation behind a stronger promise.
   • PROV-20 [K] — Retire v1 plugin adapters under the existing 0.22 migration issue; move genuinely shared store mechanics out of legacy ownership without another compatibility layer.
   • PROV-21 [O] — Reuse WebDriver protocol parsing/upload mechanics while keeping provider credentials and endpoint policy distinct; consolidate decisions rather than branding boilerplate.
   • PROV-22 [L] — Own TV polling, sleeps and app logs with the connection/request signal; use event-driven closure where supported and bound residual probes.
   • PROV-23 [C] — Bound released-session bookkeeping by a documented retention policy; active rentals and required recovery identities cannot be evicted as disposable cache entries.
   • PROV-24 [L] — Declare whether wl-copy is a daemonized owner or a foreground child; captured stdio and timeout policy must match that lifecycle.
   • PROV-25 [I] — Batch equivalent xdotool pointer-and-click operations into one adapter call while preserving the existing pointer no-op guard and effect evidence.
   • PROV-26 [V] — Decode webOS tool output at the adapter boundary and return a normalized bounded failure; raw JSON parser exceptions do not cross the public API.
   • PROV-27 [R] — Have the AT-SPI helper emit typed structured failures/stable exit codes; host policy does not classify human stderr or expose raw helper JSON.

   src-cli-mcp-sdk-2.md

   • SRC2-1 [H] — Filter recorder candidates on-device in one bounded scan, then verify only those identities; process-count growth cannot multiply per-PID adb calls.
   • SRC2-2 [H] — Read managed-process identity asynchronously through the host owner and reuse command evidence; no synchronous ps sits on request execution paths.
   • SRC2-3 [L] — Let the app-log sink own byte accounting, rotation and descriptor replacement for its whole lifetime; readers scan bounded blocks rather than whole files.
   • SRC2-4 [V] — Compile redaction patterns into validated configuration before opening capture resources; preserve regex delimiters and report invalid indices without secret patterns.
   • SRC2-5 [R] — Keep lease-release confirmation separate from local disconnect intent; failed release preserves recoverable identity and returns a typed partial outcome.
   • SRC2-6 [A] — Derive connection identity from stable client/session inputs and retire generated profiles only when unreferenced; time-based IDs cannot defeat idempotence.
   • SRC2-7 [B] — Make finalization cancellation support explicit end to end; pass the signal into actual waits/transforms or remove a contract that falsely promises it.
   • SRC2-8 [H] — Keep each public SDK entry bound to its direct owner and explicit lazy boundary; helper imports cannot eagerly load unrelated platform composition.
   • SRC2-9 [C] — Associate immutable runner product manifests with preparation identity and stream hashing; relaunch recomputes only inputs that actually changed.
   • SRC2-10 [R] — Run every reporter with aggregated failures and derive JSON/exit success from the same suite outcome; one reporter cannot suppress siblings.
   • SRC2-11 [H] — Require captured host env in capability policy construction; compiler-visible mandatory dependencies replace ambient process.env defaults.
   • SRC2-12 [L] — Use identity-backed termination handles with bounded cancellation for each host process owner; missing launch markers cannot become permission to kill.
   • SRC2-13 [L] — Model product preparation as mutually exclusive pending, ready, canceled and failed states; an abort/upload race cannot re-enter an unprogressing cache loop.
   • SRC2-14 [D] — Remove unconsumed wiring and call existing owners directly; evaluate mixed table/cache/status subitems separately rather than one broad cleanup abstraction.

   src-cli-mcp-sdk.md

   • SRC-1 [V] — Give the MCP line decoder explicit empty, malformed, complete and trailing-buffer states; one bad frame cannot stall later frames.
   • SRC-2 [L] — Separate MCP control messages from serialized mutating tool work and own cancellation by request ID; ping/cancel never queue behind the operation they control.
   • SRC-3 [S] — Resolve lock/platform binding policy once from the captured serving host for CLI, MCP and SDK; untrusted tool input cannot turn serving policy on or off.
   • SRC-4 [S] — Use the canonical platform selector decoder for environment defaults; a local historical list cannot reject newly supported platforms.
   • SRC-5 [L] — Return exit status to the CLI's output-flush owner; command handlers cannot terminate the process before buffered results finish.
   • SRC-6 [C] — Treat token reuse as a credential-scoped cache with expiry/invalidation and explicit retry policy; measure refresh cost before persisting new credential state.
   • SRC-7 [V] — Route MCP startup through exact grammar admission; fast-path dispatch cannot ignore extra flags or positionals.
   • SRC-8 [H] — Pass captured host cwd/env through plugin commands just as other CLI paths do; ambient process defaults cannot override request context.
   • SRC-9 [D] — Use TOOL-6's actual build-entry decision; this duplicate needs no independent SDK chunk policy.
   • SRC-10 [R] — Classify cloud failures from HTTP status and normalized payload; service overload cannot be misreported as missing credentials.
   • SRC-11 [R] — Normalize replay-export input read errors at the file owner with the requested path; raw filesystem exceptions cannot become unhelpful internal failures.
   • SRC-12 [R] — Recognize startup failures from their typed producer reasons; message fallback cannot silently widen lifecycle recovery behavior.
   • SRC-13 [S] — Declare retired commands once with recovery messages and surface policy; dispatcher stubs cannot form a second command catalog.
   • SRC-14 [V] — Use strict integer decoding and exact option admission in the CLI parser; silent exemptions and unused warning state cannot hide unsupported input.
   • SRC-15 [R] — Represent auth session validity separately from file presence; status derives authenticated from valid, unexpired credentials.
   • SRC-16 [S] — Construct the SDK client's platform pin with an explicit enforcement policy; a returned client cannot advertise a pin that invocation ignores.
   • SRC-17 [R] — Choose one documented relationship between command health, JSON success and process exit; web doctor cannot return contradictory outcomes.
   • SRC-18 [F] — Keep debug diagnostics on stderr through the CLI stream owner; machine-readable stdout is reserved for the command result.
   • SRC-19 [K] — Tie legacy startup recovery to supported producers and removal criteria under existing migration issues; current daemons do not carry permanent speculative compatibility work.
   • SRC-20 [K] — Limit runtime-hint paths to supported producers and document any one-release cleanup migration explicitly; no speculative preference file is always rewritten.
   • SRC-21 [E] — Maintain public API reference coverage from the actual exported surface while keeping descriptions authored; every supported symbol has an intentional documentation disposition.
   • SRC-22 [O] — Collocate single-owner tests with their production subject and keep real composition tests at root; preserve detectable failures and runner inclusion.
   • SRC-23 [H] — Inject runtime providers through the real request-scoped host in tests; remove mutable global fallbacks that production never uses.
   • SRC-24 [D] — Separate dead aliases from shared host predicates and cache decisions; delete forwarding with no authority rather than adding another composition layer.

   tests-docs-website-2.md

   • TEST2-1 [E] — Discover production source roots from the repository structure and plant violations in each root; guard reach must grow with package ownership.
   • TEST2-2 [E] — Assert the exact intended export contract against actual package exports; stale mirrors and tombstone denylists cannot certify completeness.
   • TEST2-3 [E] — Validate coverage claims in both directions with real owner paths; no string-shape exception bypasses evidence existence.
   • TEST2-4 [E] — Make platform fakes reject every unscripted command at the production seam; success requires a deliberate modeled response.
   • TEST2-5 [E] — Bind contract declarations to collected/executed test identities and report skips separately; a manifest claim alone cannot certify execution.
   • TEST2-6 [E] — Track which waivers are actually reached and fail on stale exceptions; an unused waiver cannot hide a later unrelated gap.
   • TEST2-7 [O] — Share protocol fixture builders in test support but keep scenario-specific expectations independent; helper reuse cannot make expected output tautological.
   • TEST2-8 [E] — Make Android world fakes accept only the current production argv contract; obsolete permissive aliases cannot mask a routing change.
   • TEST2-9 [L] — Own partial test-world construction with rollback from the first acquired global/resource; close restores state even if intermediate disposal fails.
   • TEST2-10 [D] — Delete unused CSS only after actual page-state inspection; static selector search alone cannot prove dynamic styling is unreachable.
   • TEST2-11 [D] — Remove unreferenced private icons after dynamic-name lookup checks; no icon abstraction is needed for dead assets.
   • TEST2-12 [E] — Test public script behavior and meaningful composition order; retire source-text/tombstone assertions only after naming the retained detectable failure.
   • TEST2-13 [E] — Associate every fixture/replay example with an actual lane or an explicit illustration-only purpose; maintain published excerpts from a known source.
   • TEST2-14 [X] — Link the wire ledger to its current execution script; fix the citation without generating another ledger owner.
   • TEST2-15 [D] — Delete the unused private fixture constant once dynamic/reference checks are complete; no structural design change is needed.
5. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Prevention design ledger 3 of 3

   Prevention design exploration for #4368. Each row is an audit-derived candidate to evaluate at the existing owner, not an approved abstraction or a new confirmed defect. Merged fixes need no follow-up if they already enforce the invariant. Aliases share their canonical direction. The issue body defines design/proof requirements and the prevention family codes.

   tests-docs-website.md

   • DOCS-1 [E] — Give every retained recording journey a declared automated/manual owner and exercised failure contract; repair useful scenarios before considering proof-backed deletion.
   • DOCS-2 [E] — Bind a size waiver to the baseline condition it relaxes and detect spent waivers; old exceptions cannot preauthorize future regressions.
   • DOCS-3 [P] — Separate an ADR's accepted rule from rollout status and proposed remainder; source-owned implementation references make partial adoption explicit.
   • DOCS-4 [K] — Record accepted recording rules separately from incomplete rollout and resolve ADR0020 independently; no bulk status change claims unimplemented behavior.
   • DOCS-5 [E] — Compile maintained runnable documentation snippets through supported SDK entrypoints; mark intentional fragments distinctly instead of excluding arbitrary pages.
   • DOCS-6 [O] — Use test-kit's single fake-browser fixture with explicit production protocol behavior; local tests cannot maintain diverging executable fakes.
   • DOCS-7 [E] — Check current ADR citations against real registry anchors and files; keep rationale authored without treating historical source paths as executable guarantees.
   • DOCS-8 [P] — Store measured dependency snapshots as dated evidence and link live guarantees to executable gates; an old report cannot impersonate the current graph.
   • DOCS-9 [G] — Use TOOL-5's one-owner execution plan for provider integration; this duplicate needs no second CI change.
   • DOCS-10 [G] — Expand local/CI aggregate gates into a deduplicated execution plan with visible ownership; nested script composition cannot run the same scenario silently twice.
   • DOCS-11 [E] — Give website source a real compiler/gate owner and supported toolchain boundary; retaining an unused check script is not validation.
   • DOCS-12 [P] — Index historical evidence by its issue/decision and retention purpose, checking external links before deletion; backlinks alone do not establish whether evidence is useful.
   • DOCS-13 [S] — Derive example path mappings/public-symbol coverage from supported build entries where feasible; keep example intent and prose independent.
   • DOCS-14 [X] — Update the skill routing description to supported target families; avoid hard-coded prose equality tests and new agent documentation frameworks.
   • DOCS-15 [E] — Share coverage assertion mechanics and keep each platform's authored support contract independent; completeness checks must survive simultaneous fixture/code edits.
   • DOCS-16 [X] — Point the budget comment at the enforcing reporter; no runtime change or new reminder is required.

   tooling-ci-config-2.md

   • TOOL2-1 [A] — Pass a validated cleanup target from the shared derived-directory policy into deletion; environment text never directly authorizes recursive removal.
   • TOOL2-2 [P] — Choose and record disjoint deterministic seed ranges with explicit replay overrides; scheduled fuzz discovery and reproducibility share the same seed provenance.
   • TOOL2-3 [E] — Give parked replay journeys named execution owners and retained behavior proofs; manual-only status requires a tracked repair/retirement decision, not silent deletion.
   • TOOL2-4 [R] — Represent changed-file selection as success-with-paths or a typed failure; failed git discovery cannot become the legitimate empty-set success variant.
   • TOOL2-5 [G] — Own Android SDK versions, licence handling and tool paths in one setup action/build output; callers consume validated outputs without swallowing licence failures.
   • TOOL2-6 [E] — Retain independent architectural invariants and remove only rules subsumed by proven stronger checks; demonstrate the retained gate rejects the prohibited module.
   • TOOL2-7 [S] — Type every layering policy completely and validate its ownership roots according to intended prospective rules; nonexistent paths alone are not always useless policy.
   • TOOL2-8 [A] — Require coverage artifacts stamped for the exact source/config before certification; changed-line and complexity gates consume the same instrumentation authority.
   • TOOL2-9 [V] — Build the CI matrix from admitted work variants without impossible build=false branches; fork publication policy remains explicit at the mutation seam.
   • TOOL2-10 [C] — Resolve runner build pins and cache-key inputs from one setup owner; reuse cannot depend on comments telling five workflows to match.
   • TOOL2-11 [R] — Classify unreadable historical comparisons as unavailable with provenance while current local evidence remains strict; one corrupt old artifact does not invalidate every baseline.
   • TOOL2-12 [L] — Make crash-envelope publication depend only on bounded best-effort metadata reads; the failure reporter cannot fail before recording the primary crash.
   • TOOL2-13 [S] — Build depgraph and affected-check selection from the same validated input constructor; missing required manifests are errors, not a silent alternate model.
   • TOOL2-14 [K] — Decide whether the snapshot harness is a supported standing benchmark or completed experiment; preserve evidence and remove runtime scaffolding only after that decision.
   • TOOL2-15 [A] — Pass release tags through environment data and a supported tag decoder; shell interpolation and manifest rendering cannot reinterpret the tag as code.
   • TOOL2-16 [P] — Read upstream version and commit from the pinned-upstream declaration, distinct from this repository's commit identity.
   • TOOL2-17 [G] — Represent differential-only mode as validated arguments to one workflow step; repeated shell bodies cannot drift independently.
   • TOOL2-18 [L] — Make shared runner build production an explicit predecessor/artifact dependency where justified; parallel cache users cannot assume a cache that no completed job has populated.
   • TOOL2-19 [S] — Have helper build output publish the actual package/SDK metadata consumed by packaging; shell case tables cannot redeclare the product identity.
   • TOOL2-20 [V] — Treat shell paths as argument data with null-safe enumeration and validate prerequisites before effects; keep root resolution explicit in each supported entrypoint.
   • TOOL2-21 [L] — Separate scheduled and manual run ownership in concurrency keys or serialize them explicitly; an unrelated invocation cannot silently cancel another required lane.
   • TOOL2-22 [X] — Derive rule inventories from the real registry and keep genuinely shared source inspection in its existing owner; avoid file moves without an ownership benefit.

   tooling-ci-config.md

   • TOOL-1 [E] — Include all owned TypeScript tooling in an intentional compiler project, with generated/corpus exclusions explicit; executable gate code cannot hide outside typechecking.
   • TOOL-2 [S] — Build package-impact entry paths from the real build-entry declaration and validate their existence; exports-to-source string heuristics are not ownership data.
   • TOOL-3 [D] — Keep exactly one release-note production workflow and remove artifacts no consumer reads; update contribution contracts that still require the retired mechanism.
   • TOOL-4 [G] — Project documented local and GitHub check ownership from the existing catalog into an explicit execution plan; do not run every catalog entry on every host.
   • TOOL-5 [G] — Assign provider integration one required CI execution owner and model nested coverage execution explicitly; deduplication cannot erase the required scenario.
   • TOOL-6 [D] — Define bundle groups from real current source owners or remove them; retired paths cannot remain invisible nonmatching build policy.
   • TOOL-7 [G] — Share changed-path semantics including both sides of renames across impact selectors; moving a device file cannot erase its old owner obligation.
   • TOOL-8 [E] — Give retained bench-host tests explicit project inclusion and execution ownership; a tracked test file alone is not running coverage.
   • TOOL-9 [E] — Resolve the compatibility test script to a real collected test target and fail on an empty selection.
   • TOOL-10 [E] — Require every static-analysis exemption to name a current reached symbol; remove stale permissions rather than expanding baselines.
   • TOOL-11 [O] — Prefer typed implementation source over a hand-maintained declaration twin where feasible; otherwise verify declarations against the actual module interface.
   • TOOL-12 [G] — Resolve lane selection from dependency-free metadata before expensive host setup; skipped work does not install/build an entire device toolchain.
   • TOOL-13 [G] — Group cheap documentation checks under one compatible setup owner when failure reporting remains clear; a second job needs an independent execution reason.
   • TOOL-14 [G] — Declare setup prerequisites from actual script dependencies; builtin-only release bookkeeping cannot trigger an unrelated package install.
   • TOOL-15 [G] — Give deployment an explicit deadline, concurrency policy and least required permissions; its workflow lifetime and mutation authority are visible.
   • TOOL-16 [D] — Remove unused development dependencies after type/build consumer verification; keep production dependency classification separate from source-reference counting.
   • TOOL-17 [E] — Make declared mutation-report outputs correspond to reporters actually executed and stamp their config; artifact upload cannot imply a nonexistent report.
   • TOOL-18 [K] — Decide whether the external Smithery listing is supported; retain it with validation ownership or retire its package entries intentionally.
   • TOOL-19 [G] — Use one underlying coverage command with intentional named entry aliases only when their user/CI contracts differ.
   • TOOL-20 [K] — Classify scripts as supported manual tools, automated gates or dead entries before removal; absence of repository callers cannot identify human usage.
   • TOOL-21 [E] — Give the provider-plugin validation scenario an owned gate with build prerequisites or retire it with retained equivalent proof; dormant scripts do not protect plugins.
   • TOOL-22 [G] — Assign platform coverage-manifest validation once in the execution graph, distinct from live device evidence; device jobs need not rerun the same static proof.
   • TOOL-23 [E] — Keep complexity/size limits tied to current modules and measurable policies; deleting a stale entry cannot weaken an independently needed cap.
   • TOOL-24 [X] — Remove stale exclusions and correct current workflow references; keep exclusion behavior explicit rather than preserving historical duplicates.
   • TOOL-25 [X] — Name workflow steps for the action they actually perform; a label correction does not require runtime restructuring.
   • TOOL-26 [K] — Review action/runtime/runner compatibility and real upstream releases under a tracked upgrade policy; version-major arithmetic alone is not an upgrade contract.
   • TOOL-27 [X] — Retain current constraints and linked rationale; track temporary test-split removal conditions without keeping long incident narratives in code.

   PLAN.md

   • BASE-1 [E] — Inject read/write failure at the real filesystem seam instead of relying on uid-dependent chmod; the same production failure remains testable for root and non-root.
   • BASE-2 [D] — Re-evaluate dead code from real build/public/dynamic roots and verify packaged runtime dependencies; remove only confirmed dead surface after active changes land.
   • BASE-3 [K] — Use TOOL-26's explicit action/runtime upgrade decision; this baseline alias creates no separate version policy.
6. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Decision: prevention design and review reconciliation:

   Add a prevention assessment for every audit entry while keeping each direction a candidate until its owning boundary, supported semantics and proof are established. Merged fixes do not automatically need another refactor. A local correction, justified deletion or retention of the current design can be the correct outcome.

   Claude Opus 5.5 completed an independent planning/source review of the published issue against the audit, current main and relevant PRs. Its seven correction groups are incorporated as follows:

   1. Transfer ownership: DSRV-5, CMD-5 and CONTR-12 have an explicit large-transfer budget contract. Keep aggregate deadlines/result margins and bounded ingress. Decide total versus progress/idle budgets deliberately; neither the old 120 s substep value nor an unbounded body timeout is automatically approved.
   2. Dropped structural work: explicitly own typed retry/fallback reasons (APPLE-10, CMD2-2, ANDR-13, CMD-2) and one bounded Apple boot path (APPLE-5/6/15). A source-confirmed rule violation can be confirmed by source inspection; changed behavior still needs production-seam and device proof.
   3. Selector compatibility: ARUN2-2 covers querySelector-backed get/is/wait. Preserve Interaction guarantee gaps (ADR 0011 umbrella) #1081's newest Current state and intentional Maestro mutation waiver. ARUN2-2 and CAP-9 need separate children related to Interaction guarantee gaps (ADR 0011 umbrella) #1081, not an implicit expansion of its remaining guarantee cells.
   4. Behavior-impacting lows: name CONTR-13, PROV2-9, DEXEC-9, REPLAY2-16, DSRV-9, ANDR-17, CONTR2-11, PROV-13 and CMD-9 as active follow-ups. Coordinate fix(remote): harden transport (redirects, artifact paths, upload hash, socket cap, proxy RPC errors) #4358/fix(host-kit): one async process-identity reader and one identity-checked stop escalation #4359/fix(replay): escape recorded interpolation, run scripts off the event loop, harden Maestro and test flows #4363/fix(capture): audit remediation for redaction, capture lifecycle, contract validation and snapshot performance #4366 where stated. Each remains owned by open Repository audit remediation for 10 November 2026 #4368 until a scoped child exists; these are separate owner changes, not one mixed-package PR.
   5. Closure: every behavior-impacting low claim needs a current confirm/reproduce or reject-with-evidence verdict. Any remaining deferral at umbrella closure must name a separate open GitHub issue with required behavior, reason and next action. A package name, merged PR or this closing umbrella is insufficient.
   6. Plugin installations: reject immediate deletion of selected/running-daemon files, while keeping safe reclamation and bounded retention active under PROV-4. This does not reject the unbounded-disk-growth concern. Compare safe quiescent cleanup and existing lifecycle records before adding reference state.
   7. Decision completeness: explicitly cover ARUN-16, CAP-18, CONTR-17, CONTR2-14, DOCS-12, TOOL-26/BASE-3, BASE-2 and REPLAY-19. Preserve independent compiler/golden/completeness proof and verify actual upstream compatibility.

   Each accepted child records its trigger/root cause, invariant and existing owner, simplest feasible design, mechanisms removed, sibling regression proof, and compatibility/ADR constraints. Do not approve generic frameworks, new lifecycle stores, global caches, broad generators or fallback behavior from the category alone. Respect ADR0014, ADR0024, ADR0027, ADR0028 and ADR0030.

   The three prevention-ledger comments give an explicit direction for all 548 report entries plus BASE-1/2/3, including five aliases. They are exploration inputs, not 551 new confirmed defects or mandated abstractions. The public intake retains every ID and promotes the reviewed residuals to active follow-up.
7. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Current state: the prevention-design pass and initial Claude Opus review reconciliation are published.

   • Merged audit implementations: fix(cli,mcp): reliable MCP stdio, cancellation, shared session lock, strict mcp args #4355, chore(gates): make test guards and CI selectors fail on the violations they exist for #4356, fix(daemon): report failed close/disconnect, cancel shutdown timers, scope daemon diagnostics #4357, fix(daemon): harden command input handling for type, alert, push, clipboard, paths and artifacts #4360, refactor: align ADRs with the code and delete unreachable command-runtime families #4361 and chore(gates): typecheck every scripts/ TypeScript file #4364. fix(interaction): disclose label-fallback when the native-ref preflight recovers by label #4352 is merged for its narrower label-fallback disclosure scope; CMD2-4's frame-authority concern remains separate.
   • Open implementations at this refresh: fix(remote): harden transport (redirects, artifact paths, upload hash, socket cap, proxy RPC errors) #4358, fix(host-kit): one async process-identity reader and one identity-checked stop escalation #4359, fix(providers): secure web text entry, harden WebDriver transport and buttons, honor --relaunch #4362, fix(replay): escape recorded interpolation, run scripts off the event loop, harden Maestro and test flows #4363 and fix(capture): audit remediation for redaction, capture lifecycle, contract validation and snapshot performance #4366. Their existence does not close named residuals. Head snapshots inspected for the relevant residuals include fix(remote): harden transport (redirects, artifact paths, upload hash, socket cap, proxy RPC errors) #4358 a20e8fc8, fix(host-kit): one async process-identity reader and one identity-checked stop escalation #4359 83ee1d6c, fix(replay): escape recorded interpolation, run scripts off the event loop, harden Maestro and test flows #4363 ca4bb1fc and fix(capture): audit remediation for redaction, capture lifecycle, contract validation and snapshot performance #4366 4f1fdca0.
   • All 551 source entries now have a prevention direction in the linked three-part design ledger, with aliases preserved. These are source/audit-derived candidates; no implementation or device/test success is claimed by the ledger.
   • The issue now explicitly owns large-transfer budgets, typed behavior reasons, bounded Apple boot/spawns, query-only selector parity, ref wire shape, safe plugin retention/reclamation and the reviewed low-severity behavior/security items.
   • Next step: work report by report. Confirm each behavior-impacting finding, select the simplest owner-level prevention mechanism, and create/link a scoped child before implementation. Keep existing correct designs where they already enforce the invariant. The umbrella stays open until every row has an individual supported disposition; unresolved deferrals at closure require separate open issues.

   Source review baseline remains 0db888ac62a0d56f860e4b1d528732bca1aa7a68; main at the final status refresh is f4b01839e37d0f38d0c68fbbedf76267cd98e009. The current intake includes the #4356 merge. No repository source, device or session was changed.
8. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Decision: context accuracy and integration-first feedback:

   Adopt an explicit boundary-based testing preference: provider-backed integration for command behavior; owned E2E/smoke for native and OS behavior; focused unit/property/type tests for deterministic or exhaustive contracts. Extend existing scenarios and remove weaker duplicated behavioral tests only after retained detection is demonstrated. This follows ADR0001 and does not authorize blanket unit-test or independent-guard deletion.

   Treat misleading context as a recurring design defect. Correct the Interactor, waiver and coverage-manifest glossary claims; the scripts-typechecking claim; the single-row routing instruction; and the ambiguous local “full” gate description. Keep glossary descriptions separate from normative owner rules. Preserve context budgets and avoid tests that merely pin prose.

   The initial local deletion is the mocked alert wait timeout-forwarding test. With it removed in an isolated checkout, the retained suite passed 10 tests; a production mutation dropping the wait budget caused exactly the provider integration scenario to fail (1 failed, 9 passed); restoration returned 10 passing tests. The integration transcript crosses the actual request path and requires the caller's exact timeout. Boundary/negative/lifetime tests remain.

   Keep #4050's full-unit production fallback unchanged. The existing read-dependency inventory was incomplete; the user's preference for fast integration/E2E feedback is not proof that Vitest's import graph covers source-reading guards. Future narrowing needs the exhaustive inventory and omission/failure evidence required by that decision.

   The new issue section records deletion candidates, feedback measurements and completion requirements. The local patch has not been committed, pushed or merged. Its guidance changes will receive the required independent cross-provider sentence review.
9. thymikee commented on Nov 10, 2026

   

   thymikee

   on Nov 10, 2026

   MemberAuthor

   More actions

   Decision: coordinated ten-PR remediation batch:

   Create ten independent, reviewable PRs through the children below. Terra and Luna implement bounded waves in separate worktrees; the coordinator provides independent review and publishes only after validation. No merge or release is authorized.

   Scope	Child	Sequencing
   Correct agent context and replace a duplicate alert mock with integration proof	#4370	Independent; verify overlap at start
   Use one safe owner for XCTest build cleanup (TOOL2-1)	#4371	Independent; verify overlap at start
   Bound materialized-path retention before timer construction (DSESS-5)	#4372	Independent; verify overlap at start
   Use contained session-directory resolution for diagnostics and claims (CONTR-5, CONTR2-10)	#4373	Independent; verify overlap at start
   Treat asset release tags as data in shell steps (TOOL2-15)	#4374	Independent; verify overlap at start
   Record managed browser daemons only from proven executable provenance (PROV2-9)	#4375	Wait for #4359
   Preserve typed cloud failure categories instead of forcing reauthentication (SRC-10)	#4376	Independent; verify overlap at start
   Reject non-success artifacts and settle interrupted error bodies (CONTR-7)	#4377	Independent; verify overlap at start
   Enforce network merge bounds before retaining entries (CAP2-6)	#4378	Independent; verify overlap at start
   Make changed-line coverage use verified report provenance (TOOL2-8)	#4379	Independent; verify overlap at start

   First implementation wave: #4371 (Terra), #4372 (Luna), #4376 (Luna). The reviewed context patch is #4370 and stays separate from every worker branch. #4375 waits for #4359; this batch does not take over that external PR. The remaining five scopes are queued, not running.

   Each child verifies the current defect, enforces an invariant at its existing owner, and proves a credible regression. Keep deterministic contract tests where they are strongest. Prefer real request-path integration for command behavior and owned E2E for native behavior. Do not delete weak tests without equivalent retained detection and migration of unique assertions. No broad test deletion, gate relaxation, new framework, claimed suite speedup or unsupported compatibility change is approved.

   Monitoring: subscribe this coordinator to published batch PR review/check events, with an hourly sweep of published PRs as a backstop. Do not poll running delegates. Report exact-head checks, review findings, blockers and next actions honestly; publish a draft if required evidence is unavailable. Stop the recurring sweep when this batch is settled or explicitly stopped.
10. thymikee commented on Nov 10, 2026

    

    thymikee

    on Nov 10, 2026

    MemberAuthor

    More actions

    Current state: first PR in the coordinated ten-PR batch is published.

    • docs(agents): correct context and prefer proven integration coverage #4380 addresses Correct agent context and replace a duplicate alert mock with integration proof #4370: corrected context and integration-first guidance, with one proven redundant alert mock removed. Head d4f39c1512234945c8c4d83f7222d9f922cb0ee9 passed all seven selected affected checks with exactCommit true. Claude review findings and isolated deletion proof are linked in the PR. CI/review remain pending; no merge is claimed.
    • Use one safe owner for XCTest build cleanup (TOOL2-1) #4371 (Terra) and Preserve typed cloud failure categories instead of forcing reauthentication (SRC-10) #4376 (Luna) remain assigned. Bound materialized-path retention before timer construction (DSESS-5) #4372 is retried with Luna: its first worker read the repository successfully but mistook a no-match ripgrep exit for unavailable tools; no implementation files were changed.
    • Use contained session-directory resolution for diagnostics and claims (CONTR-5, CONTR2-10) #4373, Treat asset release tags as data in shell steps (TOOL2-15) #4374, Reject non-success artifacts and settle interrupted error bodies (CONTR-7) #4377, Enforce network merge bounds before retaining entries (CAP2-6) #4378 and Make changed-line coverage use verified report provenance (TOOL2-8) #4379 are queued. Record managed browser daemons only from proven executable provenance (PROV2-9) #4375 waits for fix(host-kit): one async process-identity reader and one identity-checked stop escalation #4359. The hourly PR-review sweep remains enabled, with event subscriptions on published owned PRs.
    • Next: independently review implementation handoffs, publish validated scopes, address incoming reviews. No merge/release authorization.
11. thymikee commented on Nov 10, 2026

    

    thymikee

    on Nov 10, 2026

    MemberAuthor

    More actions

    Current state: two PRs in the ten-PR batch are published.

    • docs(agents): correct context and prefer proven integration coverage #4380 / Correct agent context and replace a duplicate alert mock with integration proof #4370: context and proven test cleanup; all nine Cubic findings fixed in 91c27979a4e8ca679a99c03ab8120df37252d1c5, with exact-head affected checks passed. Fresh CI/review remains pending.
    • fix(cli): classify cloud failures by HTTP status #4381 / Preserve typed cloud failure categories instead of forcing reauthentication (SRC-10) #4376: cloud HTTP classification and privacy; head 9f634f8b880ccd4243666e784a6e3d30d62f2e4c passed every runnable affected check, including full unit fallback. Terra's P1 review finding was accepted and fixed; isolated regression and receipt evidence are linked in the PR. GitHub-owned skipped lanes remain obligations.
    • Use one safe owner for XCTest build cleanup (TOOL2-1) #4371 has committed implementation and initial regression proof at 003309d4497d2ecba4f3c7ead23e2e7647ff42a2. Coordinator review found a symlink containment regression in the partial cleaner; it stays unpublished until the shared guard and sentinel proof cover that edge.
    • Terra takes Bound materialized-path retention before timer construction (DSESS-5) #4372's remaining caller proof from the preserved Luna patch and Reject non-success artifacts and settle interrupted error bodies (CONTR-7) #4377's HTTP download lifecycle. Luna takes Enforce network merge bounds before retaining entries (CAP2-6) #4378's deterministic collection bound. Each uses a separate prepared worktree; the old implementation turns are complete.
    • Use contained session-directory resolution for diagnostics and claims (CONTR-5, CONTR2-10) #4373, Treat asset release tags as data in shell steps (TOOL2-15) #4374 and Make changed-line coverage use verified report provenance (TOOL2-8) #4379 are queued. Record managed browser daemons only from proven executable provenance (PROV2-9) #4375 waits for fix(host-kit): one async process-identity reader and one identity-checked stop escalation #4359. No merges or releases are authorized. Event monitoring and the hourly published-PR review sweep continue.
12. thymikee commented on Nov 10, 2026

    

    thymikee

    on Nov 10, 2026

    MemberAuthor

    More actions

    Current state: two published PRs and four further committed fixes.

    • docs(agents): correct context and prefer proven integration coverage #4380 now at 37119e3cb92f782c6ce3b9c617251d4cf0d79a8c: behavior-based split wording fixed, outdated threads replied/resolved, rebase range-diff matched exactly, all seven selected local checks passed at the new head. Fresh CI/review remains pending.
    • fix(cli): classify cloud failures by HTTP status #4381 remains published at 9f634f8b880ccd4243666e784a6e3d30d62f2e4c, with exact local validation and subscriptions active.
    • Use one safe owner for XCTest build cleanup (TOOL2-1) #4371 cleanup is ready for final gate at local 71957957be, including the coordinator's symlink guard fix, sentinel regression and successful native iOS Simulator build.
    • Bound materialized-path retention before timer construction (DSESS-5) #4372 retention is committed at ef5af73b8e, with 59 focused unit and 6 provider-scenario tests passed and isolated base failure proof.
    • Reject non-success artifacts and settle interrupted error bodies (CONTR-7) #4377 HTTP downloads is committed at 7d871f5fc0, with 6 real-HTTP fixture tests and separate base reproduction of both defects. Its change is host-side response/file transport; it does not change device dispatch/capture/runtime execution.
    • Enforce network merge bounds before retaining entries (CAP2-6) #4378 network bound is committed at local 95352b2058, including a corrected merge-boundary assertion and isolated base/mutation/restore proof. Final gate is queued after a slot frees.
    • Exact-head gates for cleanup, retention and downloads are being assigned to bounded workers and share the repository validation lock. No source gate is waived or narrowed.
    • Use contained session-directory resolution for diagnostics and claims (CONTR-5, CONTR2-10) #4373, Treat asset release tags as data in shell steps (TOOL2-15) #4374 and Make changed-line coverage use verified report provenance (TOOL2-8) #4379 remain queued. Record managed browser daemons only from proven executable provenance (PROV2-9) #4375 still waits for open, unmerged fix(host-kit): one async process-identity reader and one identity-checked stop escalation #4359 at the dependency refresh. No merge/release authorization.
13. thymikee commented on Nov 10, 2026

    

    thymikee

    on Nov 10, 2026

    MemberAuthor

    More actions

    Current state: three PRs are published: #4380 (context), #4381 (cloud failures), and #4382 (safe XCTest cleanup). All reported Cubic cleanup findings are fixed; its updated summary says all addressed, and Apex reports no current findings. Cleanup has a prior 42-check exact-head pass at 7195795; the two review fixes at ea7459c still need a fresh exact-head run. Retention and artifact downloads have final commits and regression proof, and are entering fresh validation. Network merge bounds have regression/mutation proof and await a validation slot. The remaining containment, release-input, and coverage-provenance scopes remain queued. Process provenance remains assigned to #4375 and blocked on #4359. No merge or release is authorized.
14. thymikee commented on Nov 10, 2026

    

    thymikee

    on Nov 10, 2026

    MemberAuthor

    More actions

    Current state: hourly published-PR sweep:

    • docs(agents): correct context and prefer proven integration coverage #4380 at 37119e3: 17 successful checks and one skipped cache job; no conflicts or unresolved review threads. The documented mutation proof and context safeguards remain intact. Apex excluded all six files, so its approval is not counted as substantive source review.
    • fix(cli): classify cloud failures by HTTP status #4381 at f4107ec: seven successful checks, eight running, one skipped cache job and one neutral check at inspection; no failed checks or conflicts. The malformed 401/403 fixture correction is pushed and all 46 focused tests pass. Rejected response-body restoration with concrete redaction evidence; all threads are resolved. Fresh local exact-head validation is queued behind the shared lock. The prior complete receipt remains attributed to 9f634f8.
    • fix(apple-runner): guard XCTest build cleanup paths #4382 at ea7459c: 16 successful checks and one skipped cache job; no conflicts. Resolved the withdrawn Apex cleanup objection with Use one safe owner for XCTest build cleanup (TOOL2-1) #4371's required containment contract. All threads are resolved. Fresh exact-head validation remains in progress; the prior 42-check and native-build evidence remains attributed to 7195795.

    Retention and artifact validators remain assigned; this sweep did not inspect or poll delegates. Network validation and the remaining independent scopes remain queued. #4375 remains blocked on #4359. Event subscriptions and the hourly backstop remain active. #4050's fallback is unchanged. No merge, release, tag push, gate relaxation, blanket test deletion, or unrelated PR maintenance occurred.
15. thymikee commented on Nov 10, 2026

    

    thymikee

    on Nov 10, 2026

    MemberAuthor

    More actions

    Current state: #4382 at ea7459c now has a verified exact-head affected pass: all 42 runnable checks passed, exactCommit=true, checkoutChanged=false, and the checkout stayed clean. The 25 skips and their owners are published in the receipt excerpt. Current-head CI has 16 successful checks and one skipped cache job, no conflicts, and no unresolved review threads. The earlier native iOS test build remains attributed to 7195795.

    #4380 remains green with resolved review threads. #4381 has its fixture correction pushed and validation/CI in progress; one full Apex review was requested to expose a finding omitted from its delta summary. Retention and artifact validators remain assigned; network validation and the other independent scopes remain queued. #4375 remains blocked on #4359. No delegates were polled or duplicated. No merge or release is authorized; subscriptions and the hourly backstop remain active.
16. 167 remaining items

    Load more

    Load more actions

17. thymikee commented on Nov 13, 2026

    

    thymikee

    on Nov 13, 2026

    MemberAuthor

    More actions

    Current state: PR #4533 now contains both requested test fixes at9d7993318de5d202ecb7c653ff099baca1f43e8f. Both review threads were replied to and resolved; none were open in the post-update query. Its exact-head local gate passed (11 passed, 8 named skips, 1 provider deduplication; full unit19,771 passed/10 skipped, related390 passed), with meaningful old-order and missing-cleanup discrimination. Evidence: #4533 (comment) . New-head CI is pending; the watch remains active. No merge/release/tag is authorized.

    The original selected tranche remains21closed scopes out of25. There are23merged owned PRs plus open4533; the five new child contracts remain part of the authorized scope. This is not an overall audit completion percentage. The other audit carryovers and design blockers are unchanged. No queued implementation or cleanup wave was started by this PR feedback continuation.
18. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: PR #4533 is green at9d7993318de5d202ecb7c653ff099baca1f43e8f: 21 reported checks succeeded and1was skipped; none failed or remain pending. Both requested review fixes are pushed, both original threads have replies and are resolved, and the final thread query shows zero open threads. Cubic reports all issues addressed and Sentinel approves with no open findings. The PR is mergeable with CLEAN merge state.

    The exact-head local gate, original-order regression experiments, skipped-cleanup mutation and source-identical native retention/fresh-reinstall controls are recorded in #4533 (comment) . The Chief of Staff's watch-until-green/no-open-feedback request is complete. Returning the PR to the user's inbox; no merge, release or tag occurred. Child issues remain open until their implementation merges.

    The original selected tranche remains21closed scopes out of25, with23older owned PRs merged and4533open. This is not an overall audit percentage. Other authorized carryovers and protocol-policy blockers remain unchanged, so the single published-only backstop stays enabled. No queued implementation,device allocation or cleanup wave was started.
19. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: PR #4533 merged on2026-11-14 at07:27UTC; GitHub closed#4516 and#4517 as completed. All24owned published PRs are now merged. The original selected tranche remains21closed scopes out of25; the Claude additions are now2completed out of5. These are selected-scope counts,not an overall audit completion percentage.

    Seven implementation scopes remain: #4442 typed Apple screenshot recovery; #4426 typed Android boot polling; #4441 transfer deadlines and lifecycle; #4448 native recording coordinate basis; #4519 helper session authentication; #4520 truthful IME type outcomes; and #4518 client-owned artifact destinations. #4512 remains an open validation diagnosis with historical causes unproven. External#4511 is still open,so#4518 remains reproduce-first/blocked for implementation. Required finite protocol/transport Decisions remain before affected code.

    Recommended next execution is#4442 proof/exact/native completion,then#4426 readiness proof and validation,with one local execution slot. No workers,queued implementation or cleanup were started by this reminder. Cleanup of#4533-owned inactive resources can be scheduled after checking shared dependencies and preserving evidence. The single published-only backstop remains enabled because authorized scopes remain unfinished. No merge was performed by the coordinator.
20. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Decision: November 14 Claude completion batch:

    The user requested another batch and an updated automation message. Continue the seven existing unfinished contracts: #4442, #4426, #4441, #4448, #4519, #4520 and #4518. Reuse their candidate source and canonical queue records. This is continuation membership, not seven new implementations. All 24 published owned PRs are merged. #4516/#4517 completed in #4533, whose owned inactive resources are now cleaned and evidence archived. CONTR2-4 remains covered by #4369.

    Current main is d78be6c. The first bounded Claude wave has one execution owner: #4442 refreshes the preserved typed Apple recovery chain, runs focused cases/typecheck and one exact-head affected gate. A second worker reviews the existing #4426 readiness proof and its assumptions without execution or edits. A third worker resolves the #4441 proxy design review and finite policy choices, source-only, before production code. Completion events advance the next phase; do not poll workers. Native evidence, independent review and regression discrimination remain separate obligations; a local gate is not whole-issue readiness.

    Fresh file-level checks show no upstream drift in #4442 or #4426 owned files. External #4111 still overlaps Apple screenshot paths. #4441 has upstream command-descriptor drift and overlaps external #4511 and #4505; resolve at its owners without maintaining those PRs. Its current proxy plan is not adopted: correct lifecycle joins, typed-cause propagation, early responses, 308 resume behavior, runtime/transport boundaries and demand-aware idle ownership before code. Do not silently relax the adopted 30/30/120/600-second policy. The coordinator records the finite transport decision after the bounded verification.

    Then sequence #4442 regression/native evidence and independent current-head review, #4426 proof execution and exact validation, and the adopted #4441 source slices. #4448 needs captured-canvas measurement before positive producer claims. #4519 and #4520 need bounded owned-device feasibility and finite protocol decisions; serialize their shared helper packaging changes. #4518 remains reproduce-first and implementation-blocked on external #4511 until the recorded dependency changes. No outside-T3 device launch is authorized.

    Preserve #4050 full-unit fallback, meaningful request-route/integration/E2E/regression/live evidence, every historical failed receipt, and cause-unproven status for #4512 and API36 Back/diff. Do not widen timeouts, delete tests wholesale, retry unchanged CI blindly, merge, release, push tags, touch foreign/dirty resources or duplicate work. Publish only reviewed/validated scopes, or explicitly blocked drafts under existing authorization. The existing hourly automation message has been updated in place; its published-PR/missed-human-comment scope remains unchanged and it cannot start this implementation queue or cleanup waves. Keep one timer until all authorized scopes settle or the user stops it.
21. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: The November 14 continuation is running with three bounded Claude tasks under Decision #4368 (comment). #4442 alone owns local focused/typecheck/exact validation on a refreshed candidate. #4426 receives a source-only independent readiness-proof review. #4441 receives a source-only transport design/policy resolution; no unadopted proxy implementation is started.

    The four other unfinished scopes remain #4448, #4519, #4520 and reproduce-first/blocked #4518. All 24 published owned PRs are merged; #4516/#4517 are complete and #4533-owned cleanup is complete with proof archived. The existing single hourly automation message was updated in place and remains published-feedback-only. Completion events advance active work; the timer does not launch queued implementation, poll workers or run cleanup waves. All historical failed receipts, native gaps, finite-policy requirements and #4050 remain preserved. No merge, release or tags are authorized.
22. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: Refreshed #4442 source at54812974 passed33focused tests and typecheck, but its exact gate FAILED at candidate test lint (1passed,1failed,7not-run,4skipped). The old failed receipt is retained. The coordinator fixed catch-variable names and replaceAll, and moved four predicate tests byte-identically to an adjacent discovered file, preserving every assertion. Production source is unchanged.

    New unpublished head b80056b passes full pinned format/lint,67focused tests across5files,and repo typecheck. A new Claude worker owns one exact-head affected gate. #4050 remains unchanged. Regression/mutation discrimination, native simulator evidence,current-head independent review and CI/publication are still pending. External#4111 remains open with screenshot overlap; it is not maintained by this work. No merge,release,tags or readiness claim.
23. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: #4442 exact local validation passed at b80056b:8checks passed,1provider integration deduplicated,4skipped,none failed/not-run;19825unit tests passed with10skipped and377related passed. #4050 remains unchanged. Earlier54812974 lint failure stays historically failed. Native evidence, independent current-head review, regression/mutation detection and GitHub/publication obligations remain open.

    A new bounded Claude wave is running: #4442 isolated mutation/control proof has the sole execution slot, #4442 current-head independent source review is read-only, and #4441 source-only phase-owner work follows adopted Decision #4441 (comment). The transfer worker reuses existing remote commits with explicit local dependency layers; it cannot execute checks, implement the proxy adapter or claim independent publication yet.

    #4426 review corrections are committed at0e98de50e462c1c6975637e23998eabe8aaa1966, authored-unrun and queued behind the proof slot; its historical gate/native/#4512 limitations remain. Seven implementation scopes remain overall: #4442,#4426,#4441,#4448,#4519,#4520,#4518. The last remains reproduce-first/blocked on external4511. No duplicate implementation,merge,release,tags,delegate polling or timer-launched work is authorized. The one published-only backstop remains enabled.
24. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: Apple4442 b80056b passed its exact gate and all four production mutants were caught with67/67restored controls. Evidence remains attributed to b800. Independent source review found no correctness defect but two Low hygiene issues, now root-fixed at600d51dc49c06b44c3e66e098cff3629fee72b71: remove test-only probe injection, answer the real listing in tests, and correct redundant/fixture assertions. Pinned format/lint/typecheck and77tests across6files pass. A new Claude worker owns the sole execution slot for600d mutation controls and one exact gate. Native,CI and publication remain open; prior review input omissions are disclosed.

    Transfer4441 source review found a real completed-hop timer leak that could replace a resumed hop's retryable failure with the old timeout. The coordinator fixed lower watchdog retirement at6089d90d905071810c1b4ab4e5c89d7aabc7258c, restacked, and retired the upper observer at43abdfa8020b19290dd1dd5174c00274868b29f9. Misleading budget prose is corrected. The finite low-level wrapper stays until its fixture proof migrates to the outer lifecycle owner. Phase expiry remains intentionally terminal under adopted policy; ordinary transport resets retain their retry. These transfer changes are unformatted/unvalidated and still need real-loopback detection,wire/closure checks and exact receipts. Nothing is published.

    Android4426 at0e98de50 remains authored-unrun and queued. Seven implementation scopes remain:#4442,#4426,#4441,#4448,#4519,#4520,#4518; the last remains reproduce-first/blocked on external4511. Historical failed receipts,#4512 and API36causes stay as recorded. No merge,release,tags,delegate polling or new timer.
25. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: #4442 at600d51dc49c06b44c3e66e098cff3629fee72b71 has passing focused controls77/77 and all four production mutants fail intended assertions(6,1,4,1failures),with source restored. Its exact affected gate FAILEDunit; exactCommit=true,checkoutChanged=false,failOpen=false. Seven checks passed including377related tests;unit had19821passed,3failed,10skipped. Provider integration did not run;four checks were skipped. #4050 remains intact.

    The three failures are5000ms timeouts in scripts/tests/release-publish.test.ts at89,104,113. Cause is UNPROVEN. No unchanged-base comparison was run by that worker,and no contention/base-fault diagnosis is made. A new bounded Claude task now owns one identical check:unit run on unchanged based78be6c8 and one on candidate600d,strictly sequentially,with no gate retry. A separate source-only recheck addresses the current-head review corrections and missing normative inputs.

    The old b800 exact pass remains atb800;it is not a passing600d receipt. Native owned-simulator evidence,review,GitHub and publication remain open. The recent-boot memo,provider narrowing and capture-signal gaps remain disclosed. #4512/API36historical causes are not conflated with this new release-test cluster. Transfer4441 and Android4426 wait for execution capacity. No blind retry,source weakening,merge,release,tags,device allocation or worker polling.
26. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: #4442 source recheck at600d found no production correctness defect and confirmed the test-only probe injection is gone. It found one Low coverage gap:R1. The retained real-probe test compares its timeout to the producer constant itself,so a30000ms probe could pass. The coordinator's earlier claim that it pinned5000ms was incorrect and is retracted.

    A small patch now asserts the observed timeout is literal5000ms and below the capture budget. It is PREPARED,NOT APPLIED,because the running unchanged-base/candidate unit comparison must retain its frozen600d head. No additional worker or execution was started. After the comparison completion event,the coordinator will apply/format/test/commit the correction and prove a30000ms mutant is caught;the next head still requires its own exact receipt.

    The600d exact gate remains FAILED with three release-publish5000ms timeouts,cause unproven. Its77/77focused controls and four detected mutants remain valid at600d,but do not cover this missing budget assertion. Native,CI and publication remain open. No retries,timeout widening,merge,release,tags,device allocation or delegate polling.
27. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    Last edited by thymikee

    MemberAuthor

    More actions

    Current state: The paired check:unit runs passed on unchanged base d78be6c and candidate 600d: 19,791 and 19,824 unit tests passed, respectively, with 10 skips each. The tmpdir and smoke checks also passed. None of the three release-publish timeouts reproduced. Their cause remains unproven; the failed exact receipt at 600d is retained. The comparison report records the differing report environment, foreign host activity and the worker's idle wait without assigning a cause.

    After the comparison finished, the coordinator fixed R1 in 855aa4a. The test now checks the observed probe timeout against literal 5,000 ms and below the capture budget. Production code is unchanged. Pinned format, lint, typecheck and 77 focused tests passed. In the isolated experiment, changing the production probe budget to 30,000 ms caused the intended assertion failure: 1 failed, 76 passed. Restoring the source returned all 77 tests to passing, with the experiment clean.

    One new exact-head gate is running at 855a. The worker will not run extra tests, retry a failure or wait for a quiet host. Earlier evidence remains attributed to its original SHA. Native simulator evidence, GitHub checks and publication remain open. Other scopes wait for execution capacity. No merge, release, tags, device allocation, worker polling or timer change.
28. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: #4442 passed one exact affected gate at 855aa4a. The receipt records exactCommit=true, checkoutChanged=false and failOpen=false: eight checks passed, provider integration was deduplicated, four checks were skipped, and none failed or remained unrun. Unit: 19,824 passed and 10 skipped. Related: 377 passed. #4050 remains unchanged. The earlier 600d failed receipt is retained; its release-test timeouts did not reproduce in the comparison or this gate, and their cause is still unknown.

    The next bounded Claude wave has one native execution owner on the assigned stopped iPhone 17 Pro (iOS 27.0), through T3 tools and the returned CLI. It must prove candidate-backend binding and the real screenshot recovery route, or report the exact native gap, then clean only its owned resources. A separate source-only recheck verifies the final R1 literal-budget correction and the previously unread test-helper path. Native and final review results are not yet claimed; nothing is published.

    Seven implementation scopes remain. Android #4426 and transfer #4441 checks wait for execution capacity; #4448, #4519, #4520 and blocked/reproduce-first #4518 retain their policies and proof requirements. No merge, release, tags, foreign resource changes, worker polling or new timer.
29. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: #4442 is published as blocked draft PR #4544 at 855aa4a. Its exact local gate passed, independent review has no remaining findings, and regression mutants detected the intended invariants. GitHub checks and review are pending; no readiness or merge claim is made.

    The owned native run proved candidate-daemon binding and a successful ordinary Settings screenshot on iOS 27.0. It did not reach the recovery seam: T3 shutdown removed the bound CLI and the subsequent screenshot exited 127 before daemon dispatch. No fresh probe, boot, re-capture or real code-60 header was observed. The native obligations remain open; the attempt was not repeated as a race. The assigned simulator is stopped, this thread has no open devices, and the worker closed its private session and identity-checked daemon and removed private configuration/state. Daemon termination used SIGTERM, with no graceful-stop receipt. Evidence: #4442 (comment).

    Execution capacity now transfers to #4426: one Claude execution worker owns isolated regression/mutation proof and one exact-head gate at 0e98de50e462c1c6975637e23998eabe8aaa1966. A separate Claude reviewer checks the correction without running checks or changing files. #4441 execution remains queued; #4448/#4519/#4520 and blocked reproduce-first #4518 retain their recorded requirements. These assignments follow this active completion event, not the scheduled backstop.

    There are now 25 published owned PRs: 24 merged and one blocked draft. Seven implementation scopes remain unfinished. Preserve the historical failed receipts and unknown causes, #4050, foreign resources and one timer. No merge, release, tags, worker polling or cleanup wave.
30. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: #4426 passed its exact 0e98de50 gate: eight checks, 19,783 unit tests passed with 10 skipped, and 376 related tests passed. Focused controls passed 21/21; six mutants were detected and one post-read cancellation mutant survived. The coordinator then fixed a source-review P3 in typed timeout diagnostics and strengthened that cancellation test at local a804bea4b7aee0f5c4b850186ee0ceec38cda323. Its 24 focused tests pass; new exact validation and regression proof are pending.

    Blocked draft PR #4544 remains at published 855aa4a. Coverage failed on a process-fixture assertion that exactly matches existing unchanged-main CI at d78be6c; the test and production source are byte-identical across those SHAs. The fixture mocks ps but leaves Linux proc facts live. The coordinator committed a bounded fixture-isolation correction at local 50034fe, preserving every assertion and dedicated Linux-proc case. macOS focused tests pass 15, with six Linux-only cases skipped. It is not pushed and Linux correctness is not yet claimed. Native screenshot recovery and code60 remain unproven.

    One Claude execution owner will verify the fixture regression boundary and run the Apple exact gate, then verify the Android corrections and run its exact gate. A separate Claude reviewer reads both small deltas without execution. #4441 remains queued behind this owner; the other unfinished scopes retain their recorded requirements. Seven implementation scopes remain; 24 owned PRs are merged and one is an open blocked draft. No merge, release, tags, blind CI retries, worker polling, cleanup wave or extra timer.
31. thymikee commented on Nov 14, 2026

    

    thymikee

    on Nov 14, 2026

    MemberAuthor

    More actions

    Current state: The #4544 process-fixture correction is pushed at 50034fe. Its exact local gate passed: eight checks, 19,824 unit tests passed (10 skipped) and 377 related tests passed; provider integration was deduplicated and coverage/replays skipped. The simulated Linux process/filesystem boundary passed 21 tests, removal of the isolation failed the exact PID-202 assertion, and restoration passed 21. This is model evidence, not a real Linux-host run. Real Linux CI remains authoritative. The existing PR watch is retained, and the draft still has unproven native Shutdown/code60 obligations. Evidence: #4544 (comment).

    Android #4426 caught both new mutants at a804bea4, but its exact gate FAILED at typecheck: the AppError type guard narrowed the following OR operand to never. The coordinator fixed the one-line operand order at 8c939217cf2f5d6bdea22003b3b82ddabef40881. Full pinned format, whole-repository typecheck and 24 focused tests pass. A bounded source recheck found no issues in the type/semantic change, with unread mandatory policy/evidence inputs explicitly disclosed; it is not a complete policy or readiness review. One Claude worker now owns the sole exact gate at the repaired SHA. No result is inferred and no worker was polled.

    The failed a804 receipt, passed 0e receipt, mutation proofs and older unknown-cause failures retain their original SHAs. Android native boot remains unproven. Transfer #4441 and other unfinished scopes retain their sequence and policies; seven implementation scopes remain. No merge, release, tags, blind retry, cleanup wave or new timer.