Add isolated Pi and OpenCode trial profiles and native invocation receipts - #1033

Scope

Add four isolated trial Pi/OpenCode profiles for Claude Console and GPT through OmniRoute, native role tool fences, fresh-worktree ns-run dispatch, Windows Terminal fragments and invocation tracking. Bind the gateway template to the measured loopback port 21128 and keep runtime admission subject to the preregistered comparison.

Default preparation creates the role descriptors required by the launchers. Preparation and launch check the installed native release before creating state or a worktree. OpenCode runs in an empty-root Bubblewrap namespace with explicit executable files, Python library paths, selected skill directories and private profile state. Interactive collection propagates native CLI failures, writes an unmeasured failure receipt and retains retry state.

The profiles include named read-only skill permissions and canonical preloads, private Context Mode stores, native role/vendor invocation attribution and receipt-first cleanup of clean inactive worktrees. Every OpenCode profile/role explicitly binds its native database override to an absolute private data path, shared by launch, discovery and collection on both routes. Native OpenCode sessions bind their worktree through cwd/PWD/--dir, disable project grants and load root AGENTS.md through absolute instructions. Full Git/MCP consumer qualification remains an explicit readiness boundary.

• Base commit: 2f59d7448c7e4a51cf592f78818838353ba2dca9. A registry-only rebase of b004238 to631b5711 preceded the single private-state correction described below.
• Lane: lane:foundation.
• Owned paths: runtime profile/discovery tools and tests, skill-usage adapter, MCP token-layer descriptor, gateway template/map, sanitized runtime research/receipts and evidence registration; the Windows tracker source locator.

SOTA sources

• https://github.com/earendil-works/pi at 04566631c2b51fb688486bc1f040f60d1518c126, installed 1.1.0: packages/coding-agent/docs/{configuration,skills,mcp,packages,cli,rpc}.md; native version contract at docs/cli.md:245, context and compatible-provider contracts recorded in the vendor-contract notes. The original inference receipt retains its abe508e1 source boundary.
• https://github.com/anomalyco/opencode at installed-release 53d1eabb61e21162157817bf677da0a4ad3332e3, installed 1.18.35: packages/opencode/src/index.ts:51 (version), src/permission/index.ts:28-38,178-214, src/skill/index.ts:310-314, src/tool/read.ts:250-258, src/config/config.ts:420-424,482-489, src/config/variable.ts:33,61, src/cli/cmd/run.ts:134,333-340 and src/session/instruction.ts:123-150. Native config, agents, skills, run/export and request/usage contracts remain qualified at this release. A separately published 2.x line is a parked research input, with no migration in this PR.
• https://github.com/obra/superpowers at bb92a77741419a4ab5f06e711a283343f1ada0c3: supported Pi git package and OpenCode plugin layouts. Selected role directories/preloads and the native read-only Skill loader keep the imported roles' fences.
• https://github.com/astral-sh/uv at 2ad97ed9b2b052144151844d00b2e718564ca2ce: docs/reference/installer.md:5-12 and docs/getting-started/installation.md:270 document configurable standalone executable locations. Executables are file binds; Python's native sysconfig.get_path supplies library paths.
• https://github.com/containers/bubblewrap at 124c4cdf4321f63ef17a1cb0ce8f9dd45bd7adbe, v0.11.1: mirror bwrap.xml:135,218,293-314,317,401-405,409 documents explicit binds, namespace setup and empty read-only masks. Mirrors were read with GIT_NO_LAZY_FETCH=1 and git show <pin>:<path>.
• https://github.com/anthropics/sandbox-runtime at d9aac2098351ca17f3743fbaf6ecbd0051b7e00e, v0.0.79: mirror src/sandbox/sandbox-config.ts:743-748,1138, src/sandbox/sandbox-manager.ts:1919-1930, src/sandbox/linux-sandbox-utils.ts:3370-3382. The supported CLI requires network config and a restricted network namespace; it cannot express this filesystem policy while retaining the original native loopback namespace. Whether its supported proxy can carry the traffic remains untested. The isolation layer's recorded winner is unchanged; the co-op registered a separate comparison row.
• https://github.com/max-sixty/worktrunk at b49ca7eea9b03145791a5b94eccaf9c59412ed37: mirror docs/src/content/docs/config.md:675-698, invocation-local worktree path override. Scratch is under /var/tmp; cleanup uses native Git without force.
• https://github.com/vercel-labs/skills at 7407f3893ad4dceab546ac002c3ef806e4000c73, 1.7.0: manifest installer and Tier2 skills find/SKILLS_API_URL contract. Tier1 lifecycle input is consumed from its owner by path.
• https://github.com/rtk-ai/rtk at e001f773f80b22b7dc4c7a79521b30e35aaef026, 0.51.0: native Pi/OpenCode hook installers. This cited pin is unmirrored; vendor source capture was checked at its pinned URL. The OpenCode installer receives an installer-only HOME.
• https://github.com/b1tank/pi-otel at 3cd674533a8d24c9b8a2a6a94072eec25466e128, @b1tank/pi-otel 0.5.0: native package, content-capture controls and unchanged upstream local-provider/local-collector integration test. This cited pin is unmirrored.
• https://github.com/mksglu/context-mode at 6f0cc6841c687e754059f36714a11233fda1a02b, 1.0.169: start.mjs:19-28,308-311,387-389, src/adapters/base.ts:55, src/session/db.ts:28, scripts/postinstall.mjs:211-227, src/server.ts:167-180,4861-4862. This cited pin is unmirrored; pinned vendor source was checked. Private native npm prefix with parent scripts disabled, followed by the supported named SQLite rebuild: https://docs.npmjs.com/cli/v11/commands/npm-rebuild.
• OpenCode evaluator provenance at 53d1eabb: fixture functions match packages/opencode/src/util/wildcard.ts:3-19, src/permission/index.ts:28-38,178-214 and packages/core/src/npm.ts:45-50 byte-for-byte against the pinned mirror. No custom evaluator is deployed.
• The native DB override follows anomalyco/opencode@53d1eabb packages/core/src/flag/flag.ts:47 and packages/core/src/database/database.ts:22-55, read from its pinned mirror with lazy fetching disabled. An absolute OPENCODE_DB outranks XDG; the shared environment policy explicitly binds it inside the selected profile/role.
• MicrosoftDocs/terminal JSON fragment extensions; auxiliary vendor sources/pins and the cumulative 35-row source screen are recorded under notes/runtime-profiles-20261012/.

Evidence-class table

Local commands run

Current private-state correction at 6eba3d7c28421736425f9636c56935d767335b0b, prepared after the tests-only Claude PASS_WITH_P3 at631b5711:

systemd-run --user --scope -p CPUWeight=idle timeout --signal=TERM --kill-after=5s 180s env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_RUNTIME_DB_BASELINE_SOURCE=<exact-git-show-631b5711-source> NS_OPENCODE_TEST_BIN=<direct-installed-public-1.18.35-binary> python3 -B -m unittest tests.test_runtime_database_isolation -q
exit1;3tests,16assertion failures,0errors,0skips
systemd-run --user --scope -p CPUWeight=idle timeout --signal=TERM --kill-after=5s 180s env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_OPENCODE_TEST_BIN=<same-direct-native-binary> python3 -B -m unittest tests.test_runtime_database_isolation -q
exit0;3tests,0skips;4actual native collector cases,2headless routes,10discovery scopes

Separately bounded named modules at the correction: runtime_profiles24,
runtime_profile_readiness7 (installed Pi/OpenCode inputs), runtime_publication5
(pinned mirror), task_model_routing11, runtime_boot1 (four profile boots with
the qualified Context Mode package). Every command exits0 with0skips. The
same idle/180s/env wrapper above invokes each as python3 -B -m unittest tests.<module> -q; exact commands/results are in the derived receipt and
coordination result. python3 scripts/validate.py exits0 with11,838 public
hashes. No local full suite or new model/API call ran.

The three-test before/after controls use the unchanged native CLI and synthetic
HOME/configs/databases. Existing outside DBs remain byte-identical, absent ones
and their sidecars remain absent, and private SQLite files open/integrity-check.
Native session listing runs for real; initial agent calls and discovery commands
are controlled. No real account DB or credential is read. Receipt:
notes/runtime-profiles-20261012/receipts/private-database-correction-20261012.json.

Original correction at b004238: focused modules ran separately under idle CPU scopes. <pi-bin>, <opencode-bin> and <mirror> below designate explicit public installed binaries and the pinned source mirror; no install or model/API call ran. Fresh registry-only rebase checks follow the historical results below.

systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_PI_TEST_BIN=<pi-bin> NS_OPENCODE_TEST_BIN=<opencode-bin> python3 -B -m unittest discover -s tests -p test_runtime_profile_readiness.py -q
7 tests, exit 0, no skips
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -p test_runtime_profiles.py -q
24 tests, exit 0
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_OPENCODE_TEST_BIN=<opencode-bin> python3 -B -m unittest discover -s tests -p test_runtime_opencode_native.py -q
1 test, exit 0, host layout
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_RUNTIME_TEST_UV_LAYOUT=home NS_OPENCODE_TEST_BIN=<opencode-bin> python3 -B -m unittest discover -s tests -p test_runtime_opencode_native.py -q
1 test, exit 0
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_RUNTIME_TEST_UV_LAYOUT=local NS_OPENCODE_TEST_BIN=<opencode-bin> python3 -B -m unittest discover -s tests -p test_runtime_opencode_native.py -q
1 test, exit 0
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_OPENCODE_TEST_SOURCE=<mirror> python3 -B -m unittest discover -s tests -p test_runtime_publication.py -q
5 tests, exit 0, no skips
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -p test_task_model_routing.py -q
11 tests, exit 0
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 NS_CONTEXT_MODE_TEST_PACKAGE=<qualified-flat-vendor-prefix> python3 -B -m unittest discover -s tests -p test_runtime_boot.py -q
1 test / four profile boots, exit 0, no skips
systemd-run --user --scope -p CPUWeight=idle env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 python3 scripts/validate.py
exit 0; 11,831 public-file hashes

Readiness before-controls give 16 missing-descriptor/collection assertions and five missing-version-hook errors. The exploratory filesystem fixture's baseline wiring is corrected. Historical fixture results retain their original heads and do not establish the PARKED read-fencing property. Hermetic boot, project-grant, publication and routing controls retain their before/after results. Raw captures stay unpublished and unhashed.

Current derived receipt: notes/runtime-profiles-20261012/receipts/dependency-and-readiness-correction-20261012.json. Historical validation is retained in round2-b1-b4-20261012.json, reopened-corrections-20261012.json and final-adjudication-20261012.json. No local full suite was run. The CC's GitHub published-evidence run 38217782926 passed at historical c9597fb; it does not validate the new head.

Registry-only rebase at 631b57111f180ddbadf135c98ff32696e335b6a6 onto the base above: all six source patches compare equal with git range-diff excluding manifests/evidence.json; the aggregate stable source patch-id is identical. Conflicts were confined to the registry and rehashed per commit through host_receipts.register_file and scripts/evidence_manifest.py --write. Every per-commit integrity validation passes; final count is 11,836 public-file hashes. No source content correction or new inference occurred.

systemd-run --user --scope -p CPUWeight=idle timeout --signal=TERM --kill-after=5s 180s env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -p test_new_wsl_client_config.py -q
231 tests, exit 0
systemd-run --user --scope -p CPUWeight=idle timeout --signal=TERM --kill-after=5s 180s env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -p test_runtime_profiles.py -q
24 tests, exit 0
systemd-run --user --scope -p CPUWeight=idle timeout --signal=TERM --kill-after=5s 180s env TMPDIR=/var/tmp PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -p test_task_model_routing.py -q
11 tests, exit 0

Skip reasons in the Claude verification at 631b571

The CC recorded 718 tests with 19 skips. Its tail omitted eighteen reasons. A bounded skip-only replay selected the same nineteen tests under the omitted native prerequisites and reproduced all nineteen skips in 0 model calls. These are skip reasons, not passing readiness checks. The list below names every case; it is a reconstructed roster, not the unavailable original full log.

The added native DB collector test separately skips with explicit installed public OpenCode binary required when its input is absent. The author supplied the direct native1.18.35 binary for the three-test DB pass with0skips. Optional native/source inputs remain distinct from portable CI coverage.

Decision record

notes/runtime-profiles-20261012/README.md, vendor contracts, Stage A and W6 preregistration record the sources, evidence and admission rule. A runtime joins only if it blocks a known P1/P2 missed by both incumbent families, with no higher false-blocker rate and measured cost; a harness swap needs equal recall at lower cost. Execution needs a sealed manifest and CC cue.

Scope ruling: the CC's 16:37:44Z ruling retains private profile state and role tool grants. PARKED: read fencing through aliases. All earlier read-fencing readiness claims are withdrawn; fixture observations and implementation guards do not establish that property. It requires a separately preregistered qualification. This PR makes no current alias-containment guarantee.

Untested boundary: live Git and actual committed MCP consumers inside the dependency-limited namespace remain unqualified. Closing test: test_runtime_profile_consumers.NativeNamespaceConsumerTests.test_git_and_committed_mcp_consumers (planned, unimplemented/unrun). It must create a real origin/main Worktrunk worktree, exercise each native OpenCode route under the same wrapper, and verify Git head/status, all admitted MCP connections/tool counts, harmless calls and tracker observations. Optional auxiliary prefix resources need an explicit qualified resource list; a whole prefix is not admitted.

Untested proxy boundary: whether sandbox-runtime's supported proxy can carry native loopback traffic was not tested comprehensively. Closing test: test_runtime_profile_consumers.NativeNamespaceConsumerTests.test_srt_proxy_loopback_route (planned, unimplemented/unrun), using the same native client and rejecting loopback fixture with documented proxy configuration. The co-op registered srt against direct Bubblewrap for runtime-profile isolation; this PR leaves the isolation layer's recorded winner unchanged.

Profiles remain trial. Historical inference/discovery receipts do not establish fresh four-profile acceptance after the namespace correction. After landing, prepare a new private state root before any runtime comparison or shadow review; historical v9 state is not reused. The packet seal, source-screen additions and Harbor registration are parked under the pool rule.

SocratiCode remains pending E1 for an unindexed fresh worktree; Headroom/Grafana/Hindsight are excluded by the CC. OpenCode 1.18.35 lacks a structured MCP tool-count endpoint. Live collector delivery and organic skill-use rates remain unverified. Shared remote MCP stores, Pi's absent filesystem fence and OpenCode's Git common-directory project-id cache remain named blindness inputs.

Cumulative completed-smoke usage-priced spend: Console $1.137788, GPT equivalent $0.3087792, combined $1.4465672. Invoices and the earlier timed-out Claude implementation read's spend are unverified. This correction adds $0. Five clean inactive historical worktrees were removed; six dirty worktrees and the directed Context Mode residue remain.

Follow-ups

Terminal-rule disposition at 6eba3d7: FOLLOW-UP. The 631b571..6eba3d7 code delta adds the private DB binding; the lines identified by the new P1 and four P2s were already present at631b5711. The P1 is independently reproduced by Astra, but item1(a), which requires a defect introduced in the changed lines, does not hold. The process ruling therefore requests a body-only disposition and no further commit. These findings remain valid follow-ups; no repair or readiness pass is inferred from their disposition.

• P1, thread4250834056 — inherited unrelated credentials in GPT child environments. Astra reproduced this using synthetic credentials and real children/wrapper. Use an explicit native-child environment policy with positive selected-provider/private-storage controls in a separately released change. This PR does not claim inherited credentials are filtered on the GPT routes.
• P2, thread4250834062 — partial preparation is marked launchable before all installation steps succeed. A controlled installation failure leaves a trial descriptor and blocks retry. Publish only after success or add explicit incomplete-state recovery, with failure/retry/launch-admission regressions.
• P2, thread4250834068 — relative executable spelling persists after absolute-path qualification. Preparation in one directory and launch in another can refuse a qualified binary. Persist the admitted absolute spelling or reject relative input, with a cross-directory regression. This is separate from the npm launcher spelling follow-up.
• P2, thread4251314288 — post-worktree startup failure lacks recovery receipt/cleanup. Missing namespace prerequisites or an unavailable slot need explicit recovery that preserves the original failure and safely cleans or retains the tree. Ordinary nonzero collection return handling remains repaired.
• P2, thread4251314273 — general landscape gateway default and shipped service disagree. The general default uses21128 while its service/README still select20128. Retain the general20128 contract and pass the measured new-WSL21128 endpoint explicitly, or migrate every general consumer consistently with a regression. Astra demonstrated a configuration mismatch, without claiming a live provider outage.

All five belong to Follow-ups under the CC's item1/item3 process ruling. The prior alias-read property remains PARKED. The original verdict is CHANGES_REQUESTED; this disposition is the terminal-rule determination, not a replacement technical verdict. Gate/landing authority remains with the CC.

• Fix4 P3s: qualify/refuse npm .bin/opencode launcher spellings; harden exceptional startup/collection and malformed session entries; add specific upstream role/CLI error-contract citations to two earlier fix-record entries; preserve bounded full-consumer/boot provenance, missing source/capture/archived-locator verification, and inherited hostname hygiene. None is promoted to repaired by the DB binding.
• PARKED: alias-read fencing. Outside the two retained acceptance properties; no current claim. Historical mechanism fixture observations do not replace full qualification.
• Exceptional launch/collection exits can still bypass normal receipts and cleanup; preserve original errors and remove only clean inactive worktrees in a separate change. The normal nonzero listing/export paths are repaired here.
• Native CI inputs remain optional. Portable checks do not qualify native boot, full consumers or source-byte provenance. The native baseline wiring follow-up is repaired here.
• Automatic subtree AGENTS.md loading is disabled with project config; historical flag-truthiness and 2026-09-24 community sweep: effort-guard SessionStart notice, working plugin-install commands, dated dispositions #161 locator gaps remain. The exact current Sol assignment locator is tested.
• Context Mode/RTK/pi-otel cited pins are unmirrored; historical author captures and the npm-rebuild page were absent from the independent packet. No missing capture is promoted to independently verified evidence. The output-hash regression covers named keys in this notes subtree; broader publication coverage remains separate.
• Canonical supporting-file reads, absent security-reviewer preloads, ignored-only worktree retention and retained runtime branches remain boundaries. Context Mode's hardcoded ephemeral /tmp sentinel ignores TMPDIR; the historical persistent-store fixture does not claim production-wide zero ephemeral writes.
• Oversized rendered ns-run prompts can hit the 128 KiB single-argument limit; use documented file/stdin input or a specific UTF-8-size refusal in a separately released fix. Pi discovery does not gate success on auth readiness; interactive Pi with no prompt does not automatically invoke its role template.
• Inherited hostname references and the unused returned invocation source map remain recorded hygiene follow-ups. No historical record rewrite or new key-shaped publication exception is introduced.

Host evidence

No evidence/hosts/ changes. Only sanitized derived facts are published; native config/auth/session/lock roots and unpublished-output digests remain private.

Checklist

• No GitHub Actions changes.
• No secrets printed, logged or committed; no new required secret.
• No new paid hosting/subscription surface.
• Peer files/worktrees preserved.
• Final-head independent reads and CI; CC landing cue required.