OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) - #489

Scope

This PR adds the host driver for the OpenHands issue-to-PR resolver on top of the merged #425 recipe. One explicitly scoped, owner-authored issue can produce one validated patch, one draft PR, one COMMENT review and one repair round. The model's patch is not executed on the host. A draft PR can execute it in GitHub CI under the resolver-mode amendment decided on 2026-10-04: option 1, with a trusted pre-push gate that checks every agent commit before any push (see "Pre-push gate" below).

• Base commit: d2fc3803e01178b4687771d0bf91faf453bb6933, merged in db24156b9 without rebasing or force-pushing. The original PR head 501bcc9e50bf3ffa3acc82b6ecf20aa4e23c593b remains in history. Head: 7c1d24cc5600bed8b56435aef37ec8d267f889fe. On top of 0f7b27578 it corrects this round's dates to 2026-10-04, as date -u gives them, in b763cb294 (text only; the commit also resets the registry to main's copy), and re-registers the rows in 7c1d24cc5 (the last commit). On top of 4eb6b4cc9, 0f7b27578 added the merge 4f963c9b2 of main 6af8e55bd (CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681, CI least privilege, with Port #435: keep jCodeMunch execute off across all four carriers #672, Codex 0.159.3 -> 0.160.0 with the Python SDK pair: pins, qualification receipt, tests and checkpoint #626 and Preserve PR561 lifecycle fixes and retire source-host evidence #679). It also adds the gate fix that merge needed: the derivation follows code that gate code runs, not code it only reads (GateReads.executed), in 57d0dc065. Main's Preserve PR561 lifecycle fixes and retire source-host evidence #679 made tools/adoption/install_claude_profile.py read three workflow scripts, and following them had protected all of blueprints/. The decision record, RESOLVER.md and evidence part 8 are in 85262b1f8, and the registry rows in 0f7b27578 (the last commit). The main-merge list below predates this merge. On top of 21b24dede, 4eb6b4cc9 added the repair round for the cross-family read of 40f12ba5 (GPT-6.1 Sol, findings P1 and P2): the merge db287ea72 of main 3bdacabd5, the gate-data reader, the instruction fix and their tests in 86688e1e1, the decision record, RESOLVER.md and evidence part 7 in 0092ae213, the merge 4a03dd796 of main ba0e8c48f, the figures on that merge in 1ec9d04c3, a receipt test and the final control runs in e1b4f5c68, and the registry rows in 4eb6b4cc9 (the last commit). Before that, on top of 050bca5d5: the zizmor pin read from .github/requirements-ci.txt in a5194090b (registry 4009a96ec and 40f12ba51), then the CI-blocker round for CodeQL alert 90 and validate-macos (the merge d1bb9cf15 of main f474f6d22, 36440d64a, 9602c2274, 8be0c1d39, registry 21b24dede). On top of 456f8fee6, 050bca5d5 added the decided amendment's trusted pre-push gate: code and tests in 00905292d and 48831bc65, the decision record, RESOLVER.md and the evidence log in 868f02501, and the registry rows in 050bca5d5. Before that, on top of b0c11c324, came wording-only fixes for the independent re-check and the coordinator's follow-up: content in f4e7aa2a2 and 54438ce7f, registry rows in d89ad3b44 and 456f8fee6. This description was written for b0c11c324. Parts were updated for 050bca5d5: the "Pre-push gate" bullet, the SOTA "Pre-push gate" line, the evidence rows and commands, the "Decision record" section and the decision item under "What is not done". For 4eb6b4cc9, this line, the main merges, the owned paths, the "Pre-push gate" bullet and a SOTA "Gate data" line are updated; the evidence table and the commands still describe 050bca5d5, and the later rounds' evidence is in evidence/push-gate-fail-first.txt parts 6 and 7 and the PR comments. The SOTA "Step 6 repair round" line was updated for 456f8fee6.

• Main merges during custody. Each followed the hot-file protocol: main's manifests/evidence.json, then this PR's owned rows re-registered.

  • 9b0b8d6d2 in 37cb51899;
  • 4ced29230, which carried main's AGENTS.md update, in 85830e815;
  • 59f8a1e36 in d35633fad;
  • d2fc3803e, which contains ecea28654, in db24156b9;
  • f474f6d22, which carried main's macOS CI scope step (e0c329ae9), in d1bb9cf15;
  • 3bdacabd5 in db287ea72;
  • ba0e8c48f, which carried the OSV and SARIF hardening port, in 4a03dd796.

  Main has since advanced to b5b9c9ddb (Port #435: keep jCodeMunch execute off across all four carriers #672), which is not merged. Its 13 paths are jCodeMunch carrier files, documents, one test and evidence; none is a workflow or a gate script. The coordination merge-tree landing check of 4eb6b4cc9 against it reports LANDABLE: a clean three-way merge, 21 merged-vs-main paths and none outside the PR-owned set, no overlap with main's 13 drifted paths, the registry's foreign rows equal and in order, 20 PR-owned rows, and a sorted files[] without duplicates (9823 rows).

• Lane: lane:foundation.

• Owned content paths: blueprints/runtime-workers/openhands/RESOLVER.md, resolver.py, resolver/{patch_policy,gh_harness,outgoing_guard,push_gate,gate_reads}.py, skills/resolver/SKILL.md, host.py, dispatch.py, worker.py, receipt.py, e2e/task.py, both evidence/stage2-*fail-first.txt logs and evidence/push-gate-fail-first.txt, docs/decisions/2026-09-28-openhands-resolver-isolation.md, and the three OpenHands test modules (tests/test_runtime_worker_openhands_push_gate.py is new). The registry commits re-register these files over main's manifests/evidence.json and regenerate the four foundation reports through their supported commands. The last full pass is in the merge db24156b9. b0c11c324 refreshes the rows of the three files that the step 6 repair round changed. 050bca5d5 refreshes the six rows the gate change touched and adds three new files' rows. 4eb6b4cc9 registers the 20 PR-owned files over main ba0e8c48f's registry: 7 rows updated and 13 added, resolver/gate_reads.py among them. Both generators' --check passed each time, so no report was rewritten.

• Existing main defect disclosed. Commits 0c9b7acf6 and 3e3877979 fix the SWE-bench skill contract and instruction. At the merged base, host.py:382 requires verification-before-completion and e2e/task.py:52 tells the worker to invoke it, while the runtime manifest lists that skill under excluded. The fix keeps the excluded skill out of both contracts and preserves the instruction to run and report the reproducing tests before finishing.

• Custody repair. The alias-refusal fixture now builds all seven entries directly in a scratch Git index. It preserves case and decomposed Unicode names on filesystems that fold them, disables Git's macOS argument precomposition for those insertion commands, and exports the cached patch without restaging the worktree. All existing refusal assertions remain, with an added check that every intended name reached the validator.

• Review-round repair (2ede7b871, tests only; its registry row in b2d556c95). The outgoing-guard fixtures no longer depend on TMPDIR. Two host_path assertions now use a synthetic absolute host root. The symlink case needs a real temporary root, so it probes that prerequisite. It skips with an explicit message when the root matches a scripts/validate.py PRIVATE_CONTENT pattern, such as a personal home path; the reason was reworded in cf42c6d08. No assertion or reason label changed.

• Step 6 repair round (cf42c6d08: documentation and one test's comment and skip text; its registry rows in b0c11c324).

  • The decision record's option 2 and RESOLVER.md now state that the resolver pushes to and opens PRs only in this repository. A fork therefore needs a separately reviewed harness change before any run.
  • Both options now address condition 3 and CI egress.
  • The G4 residual gives the actual refusal order.
  • No behaviour changed.

• Pre-push gate (the amendment's decision of 2026-10-04; content in 00905292d, 48831bc65 and 868f02501, registry in 050bca5d5; the cross-family repair in 86688e1e1, 0092ae213, 1ec9d04c3 and e1b4f5c68, registry in 4eb6b4cc9).

  • Push path. GhHarness.push runs resolver/push_gate.py on the exact agent commit before any push and pushes that commit by name (<sha>:refs/heads/<branch>, never HEAD). GhHarness.run refuses any push of a commit the gate did not pass, and any push without a gate.
  • Refusals. The gate diffs the commit against its base. It refuses, with no push, changes to .github/**, a CODEOWNERS anywhere, the resolver's gate and harness code, the workflow-policy tests (tests/**.py naming .github), and every file that a workflow reachable from the push or the PR executes or reads as a gate. That last list is derived from the workflow files by a text-level reader that reuses patch_policy.names_in_text: the files run: steps name, the import closure of the gate scripts, unittest discovery and local actions. It also refuses a step that interpolates untrusted event text.
  • Gate data (cross-family P1). The gate also refuses changes to the data those gate scripts read (ci_read, resolver/gate_reads.py), such as blueprints/convergence-practice/contract.schema.json, which scripts/validate_convergence.py reads. Each gate script's expressions are evaluated to the repository paths they spell. An exact path protects that file, and a computed one protects the directory or glob it resolves under. Code that gate code runs or reads is followed to a fixpoint. A read the reader cannot resolve refuses every commit (gate_input_unresolved) rather than protecting the whole tree; none is unresolved on the merged tree. The cost is breadth. The merged tree 4a03dd796 has 10,528 tracked files, and the gate protects 7,559 of them (441 before). Outside evidence/, tests/ and .github/ it protects 633 of 3,444 (122 before). Most of it comes from tools/sota-convergence/gap_wave_ledger.py's computed evidence/artifacts and docs/*.md paths. The decision record's residual risks name the two deferred narrowings, and a repository test bounds the breadth.
  • zizmor. The gate runs the zizmor CI pins (1.30.1) with its own flags (no config, no ignores, offline). The excessive-permissions, dangerous-triggers, cache-poisoning, artipacked and template-injection audits refuse, and a missing or wrong zizmor fails closed.
  • Trusted copy. The gate runs only from the checkout it sits in, never from inside an agent tree. Its four files (push_gate.py, patch_policy.py, gate_reads.py, gh_harness.py) must equal the trusted commit's and the base's blobs, the trusted commit must be on main at the base, and the trusted commit is recorded. Each check leaves one record per commit in resolver-outcome.json (push_gate) and a code-and-count projection in the receipt.
  • CLI. run takes --zizmor, and the plan reports push_gate: trusted_copy_checked.
  • Agent instructions (cross-family P2). The resolver skill and the generated instruction name every category the gate refuses. When a fix would need such a change, including a new or changed test (tests/** is protected here), they tell the agent to stop and report instead of editing. A test keeps both in step with the gate's rules and the receipt's.

The resolver's Stage 1 logic covers owner/edit provenance, a patch policy derived from the base's host-executed files, fixed gh templates, guarded outgoing text and a bounded PR loop. Stage 2 adds:

• the same O1 containment topology;
• fresh P0-P2 receipts and stage-gates.json;
• G5 checks before container creation and at dispatch;
• a pinned-main checkout with no MCP servers, and a fixed skill set;
• a validated patch whose committed diff must match byte for byte.

Its receipt does not infer successful completion from model-writable data.

Independent review history

1. Stage 1 received a read-only GPT cross-family review (gpt-6-astra, max). Four findings were repaired, and a Claude closure review confirmed them closed: import shadowing, edited issue provenance, missing required contexts, and a review bound to a different commit.

2. Stage 2 received three independent Claude reviews. The verifier accepted with low notes; the security and design reviewers requested changes. The retained repair round addressed:

   • patch-content checking before git apply;
   • binding the G4 reviewer argv to a recorded hash;
   • retaining a PR record when GitHub holds the PR;
   • the residuals comment;
   • the receipt after a dispatch failure;
   • the excluded-skill instruction;
   • containment evidence;
   • fourteen smaller items.

   Both fail-first logs are unchanged: their blob SHAs at this head (ed55377f, 3f41c01b) equal those at 501bcc9e.

3. Stage 2's requested separate read-only GPT-6.1 Astra/max review through the packaged lane (custody contract step 6(a)) was pending at b2d556c95. It ran at db24156b9 (job rev-489-astra) and returned repair with one should-fix finding, which cf42c6d08 repairs (see "Step 6 reviews" and "Step 6 repair round"). The builder's diagnosis and tests do not count as that review.

4. The headless Opus 5.5 closure review of the whole repaired head (step 6(b)) was also pending at b2d556c95. It returned repair at db24156b9, with two should-fix and seven minor findings; "Step 6 repair round" gives each disposition. Before the PR leaves draft, the coordinator must still:

   • have the reviewers re-read this delta (contract step 6);
   • resolve every review thread;
   • confirm the required contexts on the final head.

5. A read-only Opus 5.5 custody review of d35633fad returned repair, with two should-fix and six minor findings. Their dispositions are under "Review round" below; reviews 3 and 4 cover the resulting head.

Step 6 reviews (2026-10-03, head db24156)

Items 3 and 4 of "Independent review history" and row 7 of "Review round" call these two reviews pending at b2d556c95; this section records their returned verdicts at db24156b92ac. Findings are condensed to one line each (severity, location, problem) without the reviews' fix proposals. Host paths are replaced by repository-relative paths or <private path>. Line numbers cited for the PR body are those of the body as read at 2026-10-03T19:20Z, before this section was added.

(a) GPT-6 Astra/max cross-family review, run through the packaged lane, job rev-489-astra. Verdict: repair. One finding.

• should-fix | docs/decisions/2026-09-28-openhands-resolver-isolation.md:228-236; blueprints/runtime-workers/openhands/RESOLVER.md:535-537 | The fork option needs explicit implementation and safety prerequisites. The runbook permits proceeding after either choice, but gh_harness.py:44-47,257-259,704-708 still targets the upstream repository and rejects a fork push URL, so following it after choosing a fork would use the same-repository path. Forking also leaves networked CI and final-message publication unresolved, while the unconditional token/secrets guarantee is explicitly unverified.

(b) Opus closure review. Verdict: repair. Nine findings: two should-fix and seven minor.

• should-fix | docs/decisions/2026-09-28-openhands-resolver-isolation.md:227-236; blueprints/runtime-workers/openhands/RESOLVER.md:519-521 (also :420-422) | The fork option (option 2) is described incompletely, and RESOLVER.md files it under the wrong kind of change, so the owner cannot see what it costs or leaves open. (i) RESOLVER.md:519-521 lists "pushing to an owner fork" among the "workflow changes outside this PR", but it changes this PR's own harness, which only targets this repository (gh_harness.py:44, :241-254, :257-259, :448, :627-628, :684-689, :704-709; the record's ruleset section, :131-178, binds only this repository's openhands/* refs), so option 2 needs harness changes, a ruleset on the fork and its own review before any run, while option 1 needs no code change. (ii) Option 2 (:230-232) says nothing about condition 3: build_pr_body (resolver.py:547-550, :590-592) publishes up to 6000 characters of the agent's final message wherever the branch lives, so option 2 leaves that deviation open while option 1 explicitly accepts it, and the record's closing sentence (:235-236) implies that accepting either option lets the first live run go ahead. (iii) The fork's owner is not named (the repository is public and owned by a User account; isFork false, forkCount 0), and the record already says GitHub's fork-PR limits were not re-read.
• should-fix | PR OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489 body (gh pr view 489 --json body, read 2026-10-03T19:20Z): lines 5, 6, 8, 46, 52, 149 ("CI on this head"), 151 | The body still describes b2d556c95, not the reviewed head db24156b9: line 5 (base and head); line 6 (main ecea2865 "not merged", and the merge list omits db24156b9, which merges main d2fc3803e, already containing ecea28654); line 8 (last full registry pass d35633fad); lines 46 and 151 (d35633fad as the Linux full-suite evidence, "differs from this head only in the repaired test module"); line 52 and the "CI on this head" paragraph, line 149 (validate failed on main's unsorted registry pair). At db24156b9 the registry has 0 unsorted pairs and validate passed: job 111264954786 (head_sha db24156b9, CI merge 69650a33 onto d2fc3803e) shows validate.py {"hashed_files": 9550, "receipts": 193, "status": "passed"}, component_matrix.py --check {"rows": 32, "status": "checked"}, the new-host grand-list check passed, and python3 -m unittest "Ran 10078 tests ... OK (skipped=968)". Contract step 8 requires the merged main SHA, the local commands with exit codes and an evidence table for the head that lands.
• minor | tests/test_runtime_worker_openhands_resolver.py:1582-1589 | The probe and the assertions are correct; only the skip message is too narrow. The probe string f"{self.tmp}/" (:1584) fires exactly when the guard (outgoing_guard.py:165-170) would refuse as private_content before host_path, and no assertion is weakened (host_path is still asserted at :1565 on the synthetic root, the ValueError cases moved unchanged to :1570-1573 ahead of the skip, and the symlink and realpath assertions at :1590-1592 are unchanged). The skip message (:1588-1589) and the comment (:1582) blame "TMPDIR is under a personal home path", but the probe fires on any scripts/validate.py PRIVATE_CONTENT pattern (validate.py:25-37), such as a session-UUID, task-handle or Windows-user-path TMPDIR, and then the skip names the wrong cause.
• minor | PR OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489 body line 175; blueprints/runtime-workers/openhands/RESOLVER.md:514-516; order at blueprints/runtime-workers/openhands/resolver.py:1589-1591 and host.py:1359-1361 | The body says "G4 remains unrecorded, so a real run refuses with stage_gate_g4_not_recorded", but that reason code applies only once the other gates are recorded. Today there is no <state>/stage-gates.json: plan_run calls host.verify_stage_gates first (resolver.py:1589), and read_stage_gates raises stage_gates_not_recorded (host.py:1360-1361) before verify_reviewer_gate (resolver.py:1591) can raise stage_gate_g4_not_recorded. The gates themselves are intact: no bypass flag or environment override exists, _cmd_run requires --reviewer-command (resolver.py:1663-1664), and at dispatch start verify_isolation (dispatch.py:319) re-checks P0-P2 freshness (host.py:1445-1447), the stage gates and G5 (host.py:1463-1464).
• minor | Required context validate-macos on db24156b9 (run 37144290967, job 111264957003) | Verification gap, not a defect: validate-macos was still pending (queued) at 2026-10-03T19:20:37Z; the other seven required contexts passed on db24156b9. The native-macOS evidence the review read is from the earlier head d35633fad (artifact 11278304065 of run 37129286224, full-suite-macos.log: "Ran 10070 tests ... OK (skipped=1329)", test_case_unicode_and_filesystem_aliases_are_refused ... ok, no FAIL or ERROR in tests.test_runtime_worker_openhands_resolver). That confirms the git-plumbing alias fixture on APFS but predates the TMPDIR repair 2ede7b871; the db24156b9 run is the first native-macOS run of that repair.
• minor | Contract step 6(a) (<private path>:71); PR OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489 review state | Verification gap, not a defect: the separate read-only GPT-6.1 Astra/max cross-family review was still pending when this review ran; GraphQL at 19:20Z showed 0 review threads and 0 reviews on the PR.
• minor | origin/main 1f5a791b02a230aced670c88bab3d3d0ebcf401a versus the merged base d2fc3803e01178b4687771d0bf91faf453bb6933; manifests/evidence.json | Verification gap, not a defect: main moved after the custody merge (Grand dashboard checkpoint 2026-10-03: nine gate rows for work merged through #622 #640, docs: carry the three Claude-owned #613 residual passages #648). Three registry rows changed: docs/harness-defaults.md, observability/grand-dashboard/state.json and docs/token-session-handbook.md. Their hunks do not overlap this PR's evidence.json hunks, but the landing head no longer merges current main.
• minor | Contract step 5 commands at db24156b9 | Verification gap, not a defect: the review ran no acceptance command (it had no Bash; those are the coordinator's commands). Not re-run at db24156b9: the unit-test pair under a neutral TMPDIR and a home-path TMPDIR, the planted-defect mutations, resolver.py --help and run --help, git diff --check and the pre-push gitleaks scan. The body records them only at b2d556c95. CI on db24156b9 covers the Linux full suite, validate.py, the generator checks and secret-scan.
• minor | Items 3-4 and the safety boundary, verified at db24156b9 | No defect (verification record). Scope: d2fc3803e..db24156b9 is exactly the 17 allowed paths (README.md, .github/ and blueprints/us-equities/ untouched; owned files equal b2d556c95). Hot-file merge: all 9541 rows of main's evidence.json kept in order, 9 new and 7 updated owned rows added, all 16 sha256/bytes values match HEAD, receipts[] and convergence_records[] equal main's, files[] sorted with no duplicates. Preserved: both fail-first blobs (ed55377f, 3f41c01b), decision-record lines 1-15 (match 501bcc9e and main), the amendment heading at :208, the skill-contract fix (host.py:408-413, e2e/task.py:46-56) and the A7 env-name read in teardown (host.py:1095). At the merged base the 11 pull_request workflows still declare contents: read and use no secrets, and the SARIF upload jobs still skip pull_request. fold(), HFS_IGNORABLE and the alias rules (patch_policy.py:116-129, :893-897, :953-958) decide from git data, and the outgoing guard's check order and 0600 O_EXCL|O_NOFOLLOW body files are intact.

SOTA sources

• git/git v2.43.0, matching installed Git 2.43.0: the native index-fixture reference, git-hash-object(1), git-update-index(1), and index insertion implementation. The additional macOS requirement follows git.c's argument conversion, precompose_utf8.c, and core.precomposeUnicode. Installed help, versioned release notes and these primary sources were read on 2026-10-03. Earlier resolver patch handling also follows git-apply(1), git-diff(1) and git-merge-base(1) at this revision.
• Gitleaks v8.30.1: release notes, native Git-range and directory commands, and installed CLI help. The sandbox tests select the same installed upstream binary directly because the host wrapper's lock directory is outside the writable sandbox.
• Existing resolver implementation references: OpenHands/extensions bea7a20, skills/github-issue-to-pr/scripts/main.py (branch naming and loop) and skills/github-pr-reviewer/scripts/worker.py; OpenHands/software-agent-sdk fcc102a, v1.49.6; OpenHands/OpenHands 7bc33009, the retired resolver comparison. These are the original implementation's historical reviewed pins; the custody change adds no runtime or orchestration alternative.
• cli/cli v2.101.0 (0cf10924), including pkg/cmd/pr/checks/aggregate.go, credential-helper behavior and fixed api/PR operations; GitHub create-review documentation (commit_id) and GraphQL issue/edit provenance, read in the original 2026-09-28/29 implementation review; CPython v3.12.3, importlib._bootstrap_external.FileFinder, for package-before-module resolution.
• Repository: docs/decisions/2026-09-28-openhands-resolver-isolation.md, docs/lanes.md, .github/pull_request_template.md, the merged Runtime worker: OpenHands on GPT-6 via OmniRoute (recipe, O1 isolation, reviewed repair round) #425 recipe, Runtime-worker skills program: project-scoped installs and a 137-skill manifest #429's runtime skill exclusion and Agent branch ruleset: no history rewrite on openhands/* (applied as 24132241) #465's agent-branch ruleset. The registry follows the hot-file protocol: main's copy at each merge, then scripts/host_receipts.py:register_file for the owned rows and the supported report generators.
• Review-round fixture repair: git/git v2.43.0 t/test-lib-functions.sh (test_lazy_prereq, a probed prerequisite; filesystem examples such as SYMLINKS and CASE_INSENSITIVE_FS in t/test-lib.sh), and CPython v3.13.15 Lib/unittest/case.py (_Outcome.testPartExecutor records a SkipTest raised inside subTest as that subtest's skip; subTest, :538-565, resumes after the block and stops the method under failfast). Read on 2026-10-03; the installed interpreter's case.py is byte-identical to that tag.
• Step 6 repair round: repository source read at b0c11c324, covering resolver/gh_harness.py (REPO, op_push, push, op_pr_create and its allowlist entry, check_repository and branch_rules), resolver.py build_pr_body and plan_run, and host.py read_stage_gates. The repository's owner type, visibility and fork count were read with gh api on 2026-10-03. GitHub's fork-PR token and secret limits come from Events that trigger workflows, "Workflows in forked repositories", for pull_request runs from a fork. Forks, "Which repositories can be forked?" says nothing on forking one's own repository, so the decision record marks the fork's holder undetermined. Both pages were read 2026-10-03 and re-read 2026-10-04T00:23Z.
• Pre-push gate (2026-10-04). The GPT-family job 004's six sources, which also cover the command center's proposal, were each fetched on 2026-10-04 (HTTP 200) and quoted in the decision record:
  • GitHub Secure use reference: "Any user with write access to your repository has read access to all secrets configured in your repository", plus untrusted checkout and hosted runners;
  • Workflow syntax: unspecified permissions are set to none, cache-mode, steps[*].run, working-directory and local uses: ./;
  • Events that trigger workflows: push "includes workflows that are not merged into the default branch", and the fork limits;
  • Dependency caching reference: PR runs restore base and default-branch caches, and their own caches are scoped to the merge ref;
  • OpenSSF Scorecard checks: Token-Permissions and Dangerous-Workflow;
  • zizmor audits: the five audits the gate fails on, each working offline.
    The gate's mechanisms add three more: GitHub Script injections (the untrusted-context endings), Python unittest, "Test Discovery" with the installed CPython 3.13.15 unittest/loader.py, and the installed zizmor 1.30.1 --help. In-repository references: patch_policy.py's reviewed derivation, tests/test_workflow_hardening.py's text-level workflow reading, and .github/requirements-ci.txt and validate.yml for CI's zizmor pin and flags.
• Gate data (cross-family repair, 2026-10-04). The Python behaviour the reader models, from docs.python.org/3.13 (read 2026-10-04, HTTP 200) and checked on the installed CPython 3.13.15: pathlib ("If a segment is an absolute path, all previous segments are ignored (like os.path.join())"; Path.rglob), fnmatch ("the filename separator ('/' on Unix) is not special to this module"), tomllib and csv (read through a file object), and the comprehension scopes of the Language Reference 6.2.4 and PEP 572. In-repository: scripts/validate_convergence.py (P1's example) and tools/sota-convergence/gap_wave_ledger.py (the main source of breadth).

Evidence-class table

Local commands run

# Head 050bca5d5 (pre-push gate), 2026-10-04 04:00-04:02Z. TMPDIR=/var/tmp/489-gate, nice -n 19, after
# git fetch origin main (origin/main aecfaaaa6, merge base d2fc3803e). The tree was clean at this head.
$ python3 -m unittest tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_openhands
exit 0; Ran 249 tests in 20.319s; OK
$ python3 -m unittest -v tests.test_runtime_worker_openhands_push_gate
exit 0; Ran 31 tests in 8.958s; OK (skipped=1: the PyYAML cross-check; the real-zizmor test ran)
$ /usr/bin/python3 -m unittest tests.test_runtime_worker_openhands_push_gate.RepositoryWorkflowTests
exit 0; Ran 3 tests; OK (PyYAML 6.0.1 cross-check of the workflow reader)
$ python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9553, "profiles": 4, "receipts": 193, "status": "passed"}
$ python3 scripts/evidence_manifest.py --check
exit 0; {"files": 9553, "status": "passed"}
$ python3 scripts/component_matrix.py --check; python3 scripts/new_host_grand_list.py --check   # before the registry commit
exit 0 {"rows": 32, "status": "checked"}; exit 0 {"status": "passed", "layers": 32, "winners": 66}; no --write needed
$ git diff --check origin/main...HEAD
exit 0
$ python3 blueprints/runtime-workers/openhands/resolver.py --help; ... run --help
exit 0; exit 0 (run --help lists --zizmor)
$ gitleaks git . --config .gitleaks.toml --log-opts=origin/main..HEAD --redact --timeout 600
exit 0; 44 commits scanned; no leaks found (the four commits' pre-commit scans: no leaks)
$ python3 <the coordinator's merge-tree landing check> aecfaaaa6 050bca5d5
exit 0; clean three-way merge; merged-vs-main paths 20, outside PR-owned 0; main drift 304 paths, overlap 0;
registry foreign rows equal, order preserved, PR-owned rows 19; merged files[] sorted, no duplicates (9735 rows); LANDABLE
$ git push origin HEAD:claude/openhands-resolver-20260928
exit 0; pre-push registry tests: Ran 3 tests, OK; 456f8fee6..050bca5d5, no force
Failing-first, planted-defect and rehearsal runs: blueprints/runtime-workers/openhands/evidence/push-gate-fail-first.txt.
Not run: the host full suite (about 43 minutes here); CI runs it on the pushed head.

# Head b0c11c324 (step 6 repair round), 2026-10-03 19:53-19:56Z. TMPDIR is a neutral
# directory outside the home directory and every repository, unless the line says
# home-path TMPDIR. The commands ran on the working tree, which was then committed
# unchanged as cf42c6d08 and b0c11c324.
$ git diff --check
exit 0
$ nice -n 19 python3 -c '<host_receipts.register_file(Path("."), p) for each path>' <the record> <RESOLVER.md> <the resolver test module>
exit 0
$ nice -n 19 python3 scripts/component_matrix.py --write
exit 0; {"flip_rule_violations": 0, "rows": 32, "status": "written"}; no file changed
$ nice -n 19 python3 scripts/new_host_grand_list.py --write
exit 0; {"status": "written", "layers": 32, "winners": 66}; no file changed
$ nice -n 19 python3 scripts/evidence_manifest.py --check
exit 0; {"files": 9550, "status": "passed"}
$ nice -n 19 python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9550, "profiles": 4, "receipts": 193, "status": "passed"}
$ nice -n 19 python3 -m unittest tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_openhands
exit 0; Ran 248 tests in 22.014s; OK
$ (home-path TMPDIR, a throwaway directory removed afterwards) nice -n 19 python3 -m unittest -v <the same pair>
exit 0; Ran 248 tests in 24.993s; OK (skipped=2); both skips give the reworded reason
$ nice -n 19 python3 blueprints/runtime-workers/openhands/resolver.py --help
exit 0
$ nice -n 19 python3 blueprints/runtime-workers/openhands/resolver.py run --help
exit 0
$ nice -n 19 git diff --check origin/main...HEAD
exit 0 (origin/main 463a57b98, merge base d2fc3803e); git diff --name-only origin/main...HEAD: the 17 contract paths
$ cmp <(git show 501bcc9e:<record> | sed -n 1,15p) <(sed -n 1,15p <record>)    # and the same against origin/main
exit 0; exit 0
$ git rev-parse HEAD:<log> 501bcc9e:<log>    # both evidence/stage2-*fail-first.txt logs
ed55377f232aa64f46f1b7dce004fce1be5cc7a7 and 3f41c01b05feff7bf199c16266ea96c73ffa14c5, equal at both commits
$ nice -n 19 gitleaks git . --config .gitleaks.toml --log-opts=origin/main..HEAD --redact --timeout 600
exit 0; 36 commits scanned; no leaks found (the pre-commit scans of cf42c6d08 and b0c11c324: no leaks)
$ nice -n 19 python3 <the coordinator's merge-tree landing check> 463a57b98 b0c11c324
exit 0; clean three-way merge; merged-vs-main paths 17, outside PR-owned 0; main drift 30 paths, overlap 0;
registry foreign rows equal, order preserved, PR-owned rows 16; merged files[] sorted, no duplicates (9571 rows); LANDABLE
$ git push origin HEAD:claude/openhands-resolver-20260928
exit 0; pre-push registry tests: Ran 3 tests, OK; db24156b9..b0c11c324, no force
Not run in this round: the host full suite (about 43 minutes here, which would overrun a scheduled
measurement window; the CI full suites on db24156b9 are below) and the planted-defect mutations
(recorded at 2ede7b871; no assertion has changed since).

# Head b2d556c95, 2026-10-03 17:08-17:10Z (historical). Same TMPDIR convention.
$ nice -n 19 python3 scripts/validate.py
exit 0; {"components": 69, "hashed_files": 9429, "profiles": 4, "receipts": 187, "status": "passed"}
$ nice -n 19 python3 -m unittest tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_openhands
exit 0; Ran 248 tests in 19.862s; OK
$ (home-path TMPDIR) nice -n 19 python3 -m unittest tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_openhands
exit 0; Ran 248 tests in 20.310s; OK (skipped=2)
$ nice -n 19 python3 blueprints/runtime-workers/openhands/resolver.py --help
exit 0
$ nice -n 19 python3 blueprints/runtime-workers/openhands/resolver.py run --help
exit 0
$ nice -n 19 git diff --check origin/main...HEAD
exit 0 (origin/main ecea2865, merge base 59f8a1e36)
$ git diff --name-only origin/main...HEAD
exit 0; exactly the 17 contract paths
$ nice -n 19 gitleaks git . --config .gitleaks.toml --log-opts=origin/main..HEAD --redact --timeout 600
exit 0; 34 commits scanned; no leaks found
$ nice -n 19 python3 scripts/component_matrix.py --write
exit 0; {"flip_rule_violations": 0, "rows": 32, "status": "written"}; no file changed
$ nice -n 19 python3 scripts/new_host_grand_list.py --write
exit 0; {"status": "written", "layers": 32, "winners": 66}; no file changed
$ git push origin HEAD:claude/openhands-resolver-20260928
exit 0; pre-push registry tests: Ran 3 tests, OK; d35633fad..b2d556c95, no force

# Head d35633fad, before the fixture repair, 16:55-16:57Z
$ nice -n 19 python3 scripts/validate.py
exit 0; "status": "passed"
$ nice -n 19 python3 -m unittest tests.test_runtime_worker_openhands_resolver tests.test_runtime_worker_openhands
exit 0; Ran 248 tests in 20.274s; OK
$ (home-path TMPDIR) the same pair
exit 1; Ran 248 tests in 20.300s; FAILED (failures=2)
OutgoingGuardTests.test_host_paths_and_the_user_name_are_refused and
PullRequestLoopTests.test_pr_body_follows_the_template_and_renders_model_text_inert: 'private_content' != 'host_path'

# Clean-main comparison of the 11 non-OpenHands IDs that failed in the host full suite below
$ git worktree add --detach <scratch> origin/main      # ecea28654a835fff2cc3651bab77ca0e46b9bec5, clean
$ git -C <scratch> checkout --detach 59f8a1e36          # the then-merged base, clean
$ nice -n 19 python3 -m unittest <the 11 IDs>          # same command in every tree and TMPDIR
tree                     neutral TMPDIR          home-path TMPDIR
b2d556c95                exit 1; failures=1      exit 1; failures=9
d35633fad                exit 1; failures=1      exit 1; failures=9
origin/main ecea2865     exit 1; failures=1      exit 1; failures=9
merged base 59f8a1e36    exit 1; failures=1      exit 1; failures=9
Within each TMPDIR, the failing IDs are identical on every tree:
- under both: tests.test_windows_terminal_defaults.OverlayTests.test_the_installed_client_knows_no_notification_type_without_a_decision
  (the installed client knows a notification type, auth_storage_failure, that has no decision)
- under the home-path TMPDIR only, in tests.test_token_e2e_grader:
  F19c_Stage3Mutants.test_M17c_manifest_canary_off, F19d_RepairRoundMutants.test_M56c_the_export_backstop_is_off,
  F29_Export (3 tests), F29b_CheckHtml (2 tests), F29c_ArgvSanitizer.test_a_grade_run_that_spells_its_flags_with_equals_records_no_path
- passed on every tree under both:
  tests.test_gpt6_family_tiering_20260926.RunnerTests.test_sigterm_records_the_running_call_as_interrupted_without_counting_it,
  tests.test_order_throughput.CapacityRunTests.test_cli_refuses_live_base_url_from_env_file_without_network
$ git worktree remove <scratch>; git worktree prune
exit 0

# Host full suite, registry commit 96b96c681, home-path TMPDIR (coordinator run before the custody review round)
$ nice -n 19 python3 -m unittest
exit 1; Ran 10070 tests in 2568.426s; FAILED (failures=12, errors=1, skipped=850)
13 failing IDs: the 2 OpenHands fixture cases (repaired in 2ede7b871) and the 11 IDs compared above
earlier control, superseded by the comparison above: the 11 IDs in a clean 4ced2923 clone, FAILED (failures=10, errors=1)

# CI, read-only, 2026-10-03T19:57-19:59Z (gh api jobs and check-runs, gh run view --log, gh run download)
db24156b9 validate job 111264954786: success. CI merge 69650a33 (db24156b9 into d2fc3803e);
validate.py {"components": 69, "hashed_files": 9550, "profiles": 4, "receipts": 193, "status": "passed"};
component matrix {"rows": 32, "status": "checked"}; new-host grand list {"status": "passed", "layers": 32, "winners": 66};
python3 -m unittest: Ran 10078 tests in 1664.615s; OK (skipped=968)
db24156b9 validate-macos job 111264957003: success at 19:29:18Z. full-suite-macos.log: Ran 10078 tests in 1794.871s;
OK (skipped=1329); no FAIL or ERROR block; the alias test and both TMPDIR-repair tests ok
db24156b9 required contexts: all eight success; a later validate re-run (job 111278594671) was cancelled at
19:56:39Z, after b0c11c324 was pushed
b0c11c324 at 19:58:50Z: dependency-review, osv-scanner, sota-sources, token-report and verdict-review-gate success;
validate and secret-scan in progress; validate-macos queued

# CI, read-only, historical
$ gh pr checks 489 --required        # 2026-10-03T17:16:15Z
b2d556c95: dependency-review, osv-scanner, secret-scan, sota-sources, token-report and verdict-review-gate pass;
validate fail, job 111250877246: "files[2392]: files[] must be sorted by path (found
'docs/decisions/2026-10-03-omniroute-sdk-worker-0160.md' after
'docs/decisions/2026-10-03-retire-pr320-loki-denominator-host-receipts.md')", the pair main's job 111240392112 reports;
validate-macos pending
d35633fad: all eight passed: dependency-review, osv-scanner, secret-scan, sota-sources, token-report,
validate (29m39s), validate-macos (36m58s), verdict-review-gate
d35633fad validate job 111220987213: Ran 10070 tests in 1679.211s; OK (skipped=968)
d35633fad validate-macos job 111220987307, full-suite-macos.log: Ran 10070 tests in 1849.584s; OK (skipped=1329)

# Builder's sandbox record, before the 4ced2923 and 59f8a1e36 merges (superseded where marked).
# Its first pair run, with the host Gitleaks wrapper, exited 1 on the wrapper's unavailable lock;
# that failed attempt is retained separately, and PATH then selected native Gitleaks 8.30.1.
$ nice -n 19 python3 -m unittest tests.test_runtime_worker_openhands_resolver.PatchValidatorTests
exit 0; Ran 11 tests in 1.185s; OK
$ nice -n 19 python3 -m unittest        # superseded by the host and CI runs above
exit 1; Ran 10046 tests; FAILED (failures=485, errors=195, skipped=863); errors=168 with native Gitleaks on PATH
$ nice -n 19 gitleaks git . --config .gitleaks.toml --pre-commit --redact --timeout 600
exit 0; actual working diff scanned; no leaks found
$ nice -n 19 python3 scripts/validate.py   # superseded: the 4ced2923 merge brought main's AGENTS.md
exit 1; only the AGENTS.md SHA-256 and byte-count mismatch

These are repository integration checks, not unchanged upstream acceptance suites.

CI on this head. The workflows test GitHub's merge of the head with main.

On the reviewed head db24156b9, all eight required contexts passed:

• validate job 111264954786 tested merge 69650a33 (db24156b9 into d2fc3803e). validate.py reported "status": "passed" with 9,550 hashed files and 193 receipts. The component matrix and new-host grand list checks passed. python3 -m unittest ran 10,078 tests: OK (skipped=968).
• validate-macos job 111264957003 passed. Its full-suite-macos.log shows 10,078 tests, OK (skipped=1329) and no FAIL or ERROR block.

The merged registry is sorted. The b2d556c95 validate failure (job 111250877246) on main's unsorted registry pair no longer applies.

The new head b0c11c324 changes only the decision record, RESOLVER.md, one test's comment and skip text, and three registry rows. Its required contexts were still running when this description was written. The head that lands must show all eight SUCCESS, and a macOS full-suite artifact with no failure in tests.test_runtime_worker_openhands_resolver.

Linux full-suite acceptance item.

• CI's Linux and macOS full suites passed on db24156b9, which differs from b0c11c324 only in the files listed above.
• On the host, the PR's two test modules pass at b0c11c324 under both TMPDIRs.
• The host full suite was not re-run in this round. At b2d556c95, its 11 other failing IDs failed identically on clean main and on the then-merged base, environment by environment.

Review round

The custody review of d35633fad (independent Opus 5.5, read-only) returned repair. This is its one repair round. Numbers are the findings' indices in the review record, counted from 0, as in commit 2ede7b871's message.

Step 6 repair round

This is the one repair round for the two step 6 reviews of db24156b9. A is the GPT-6 Astra/max review, and O1-O9 are the Opus closure review's findings in the order listed under "Step 6 reviews". The fixes are in cf42c6d08, with their registry rows in b0c11c324.

Decision record

docs/decisions/2026-09-28-openhands-resolver-isolation.md records the resolver-mode narrowing and its amendment, proposed 2026-09-28 and decided 2026-10-04: option 1 with trusted pre-push enforcement.

The decision section records the following:

• the owner's delegation, in their words: "max quality sota convergenced resolution automation workflow at highest quality";
• the command center's proposal (option 1 with an in-CI tripwire);
• the GPT-family job 004 vote: disagree on sufficiency, because a check inside PR CI cannot protect against the commit under test. Each reason is re-checked against the GitHub, OpenSSF Scorecard and zizmor sources;
• the gate and its trusted-copy invariant;
• the separate defence-in-depth PR for workflow hardening;
• the residuals, the evidence, and the overturn to option 2 if the gate cannot be kept immutable to the agent.

Option 2's text stays as the alternative; only its line citations moved with the harness change.

The history below describes the amendment before the decision. After cf42c6d08 and the wording fixes f4e7aa2a2 and 54438ce7f, the amendment's option 2:

• states that the resolver as built pushes to and opens PRs only in this repository;
• lists the separately reviewed harness change and fork ruleset it needs before a first run;
• marks the fork's holder undetermined: an organization the owner creates, or a second account. The choice changes the push identity, the fork's ruleset and the --head <holder>:<branch> value;
• sources the token and secret guarantee, for pull_request runs from a fork, in GitHub's "Workflows in forked repositories".

Both options now address condition 3 and CI egress. The 2026-10-03 fixture-repair section records native Git sources, the skipped-check alternative, the argument-normalization completeness finding, evidence limits and the native macOS condition that would overturn the repair. Lines 1-15 remain unchanged.

What is not done, and what needs the owner

• Owner decision: decided 2026-10-04. It chose option 1 with trusted pre-push enforcement; the owner delegated the choice to converged practice. Still open:

  • workflow hardening, in a separate defence-in-depth PR: permissions: {} defaults, persist-credentials: false, cache, runner and timeout policy, a protected zizmor configuration, and a strict tripwire test on main. Until then, code under test runs with network, and that residual is accepted;
  • the first live run, which waits until this gate lands on main, its negative controls pass there and the stage gates are recorded;
  • the protected list, which is broad by design: all of tests/**, and every file a reachable step names. A resolver task that needs those files fails at the gate with no push;
  • option 2, an owner fork, which stays the overturn target and would need its own harness change.

  Resolver-PR check results are still not evidence of model-code safety.

• G4 remains unrecorded. Because no stage-gates.json exists, a real run today refuses earlier, at the gates stage, with stage_gates_not_recorded. Once the recorded stage gates and G5 pass, it refuses with stage_gate_g4_not_recorded until the coordinator records the isolated reviewer argv hash.

• G5 and stage-gates.json remain required. Both gateways' provider settings and the confinement design still need their own acceptance.

• These remain separate required steps:

  • fresh P0-P2 receipts, P3-P5 and G2 image qualification;
  • the reviewers' re-read of the step 6 delta;
  • the required contexts on the final head;
  • the first live draft-PR attempt.

  The native macOS check of the alias repair and the TMPDIR repair passed on db24156b9. A7's environment-name read at teardown stays in place.

Host evidence

Not applicable: no file under evidence/hosts/ changes. The historical macOS artifact is distinguished from a new native run, and no live resolver acceptance is claimed.

Checklist

• No GitHub Actions or workflow files changed; workflow hardening remains a separate defence-in-depth PR.
• New Actions permissions or pins are not introduced by this change.
• No credential value was read or published. Gitleaks scans of the history (36 commits at b0c11c324) and of both step 6 commits report no leaks, and the pre-push registry tests passed.
• No new paid hosting, subscription or billing surface.
• Peer-owned files and worktrees preserved.
• Separate Stage 2 GPT review and whole-head Opus closure verdicts recorded, including residuals.
• The reviewers' re-read of the step 6 delta recorded.
• Every review thread resolved and all eight required contexts SUCCESS on the pushed head.