2604 drift fixes - #846

### Scope

Update sandbox-runtime's repository selection to 0.0.79 at `d9aac2098351ca17f3743fbaf6ecbd0051b7e00e` and synchronize its current saturation-audit identity/receipt references. The sanitized receipt imports the command center's recorded 0.0.79 installation/readback and Claude echo smoke; the existing 0.0.77 filesystem/network evidence keeps its dated scope.

**AgentsView changes are owned by #846.** At head `20e52faf91601e2b501ad89f4750d684b4ec7502`, #846 also carries the plan/display labels, owners mirror, consensus source, generated defaults and handbook chain. All AgentsView edits have been removed from #855 to avoid duplication. The existing owner-pin test is preserved.

- Base commit: `e450e378c6bf1b21dd0bb565812f84afe028bad5`
- Lane: `lane:shared`; the other lane's acknowledgement remains a landing requirement.
- Paths: stack/landscape/upstream snapshot, saturation audit, one sanitized SRT receipt, correction log, then publication registry.

### SOTA sources

- [anthropics/sandbox-runtime v0.0.79 release](https://github.com/anthropics/sandbox-runtime/releases/tag/v0.0.79), published 2026-10-07T17:12:35Z; [package.json at d9aac209](https://github.com/anthropics/sandbox-runtime/blob/d9aac2098351ca17f3743fbaf6ecbd0051b7e00e/package.json) and [version-specific npm metadata](https://registry.npmjs.org/@anthropic-ai%2fsandbox-runtime/0.0.79) independently identify 0.0.79. Native tag lookup resolves the exact source commit. npm has no gitHead, so exact npm artifact-to-commit provenance remains UNVERIFIED.
- Retained command-center S4 row-70 observation, source receipt SHA256 `a35a0577099469de70996dcfa9841a669da20452f1d22432d50df666c7273a61`. The imported record cites the pinned upstream README/vendor npm route; no native command was re-executed by this PR.
- The repository's existing unittest modules and native dispatcher follow [CPython unittest](https://docs.python.org/3.12/library/unittest.html). These are repository integration tests, not a sandbox-runtime upstream test suite.
- Registry refresh follows `docs/lanes.md` through the existing registrar and generated-report commands.

### Evidence-class table

| Claim | Evidence class | Evidence |
| --- | --- | --- |
| Selected source/tag/package version agrees | source_review | Native Git tag/release/commit and npm version reads |
| 0.0.79 installation/readback and Claude smoke succeeded | native_proven, retained observation | Sanitized `native-sandbox-smoke-20261008.json`; not a new currency run |
| Returned stdout/stderr hashes match retained artifacts | independent observation | 12-byte stdout a948904f…; empty stderr e3b0c442… |
| Original three hosted failures reproduce locally | local_integration | Same three-test invocation, rc1 with 3 failures before the repair |
| Final affected-module suite | local_integration | 575 tests, 0 failures, 0 errors, 3 skips; rc0 |
| Publication consistency | structural validation | rc0 — 69 components, 10821 hashed files, 4 profiles, 227 receipts; integrity/scope checks only |

**Limits:** the imported source marks Codex's 0.0.79 smoke pending. Historical 0.0.77 policy acceptance is byte-identical and does not qualify those policies at 0.0.79. The receipt distinguishes source-reported command text from the unavailable original Claude post-hook argv. No new installation, native smoke, upstream policy suite, dual-client acceptance or platform-status promotion is claimed.

### Hosted/local comparison

The failing hosted run [37759591614](https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/37759591614) used Ubuntu 24.04 image `20261004.327.1` and logged CPython 3.12.3, with unittest discovery split into eight shards. Local `python3` is 3.13.16. All original three symptoms reproduced locally: the earlier clean validate.py result covered publication structure but missed the identity and owner-contract tests.

The first broader local run is retained: **10610 tests, 80 failures, 18 errors, 905 skips**, rc1. It exposed 64 line-anchor assertions from inserting an evidence-ID line; the new SRT receipt reference now preserves the established stack line anchors. It also exposed the generated AgentsView producer chain, which remains with #846. Missing local exchange_calendars and local fixture/tool environment failures are recorded; no dependency installation was attempted during the quiet window. The final scoped suite is the separate result above, not a claim that this broader environment has been qualified.

### Local commands run

These strings come from the native post-hook exec records, through `/bin/bash -lc`; changed emitted commands would be recorded separately. Native records and failed attempts are retained privately.

```text
python3 -m unittest -v tests.test_stack_lifecycle.StackLifecycleTests.test_every_selected_component_has_current_identity_and_receipts tests.test_new_wsl_client_config.PlanConfigurationTests.test_plan_checker_counts_direct_config_installs_and_refuses_an_uncopied_file tests.test_new_wsl_definitive_defaults.InterimPlanChecks.test_the_unchanged_copy_passes
Before: rc1, 3 failures

env PYTHONFAULTHANDLER=1 nice -n 19 python3 -m unittest -v tests.test_stack_lifecycle tests.test_architecture_pin_source tests.test_ecosystem_manifest tests.test_new_wsl_client_config tests.test_new_wsl_definitive_defaults tests.test_new_wsl_handbook tests.test_blind_checkout
575 tests, 0 failures, 0 errors, 3 skips; rc0

python3 scripts/validate.py
rc0 — 69 components, 10821 hashed files, 4 profiles, 227 receipts; integrity/scope checks only

git diff --check
rc0
```

### Decision record

CC093314Z §3 directs the pin correction; CC101427Z §3 directs the CI repair. The missed identity/owner checks and actual failure are recorded in `docs/harness-defaults.md`'s anti-pattern log. #846's owner confirmed the complete AgentsView overlap, and primary read-only branch inspection corroborated those paths.

### Host evidence

No `evidence/hosts/` file is changed. The new public receipt strips private paths and records only the retained SRT observation, returned hashes and explicit limits.

### Checklist

- [x] Current selection and historical native evidence remain distinct.
- [x] No credentials, personal host paths or raw conversations are published.
- [x] No host/runtime install, gateway restart, wave-1 job or paper-key operation was performed.
- [x] #846's ownership and peer worktrees are preserved; the trading-runtime freeze remains binding.

### Scope

The credential status command reported a private store as `ok` even when the key runner refused its first line. It now reports every grammar refusal as `line N: reason_code` and marks the entry unsafe, while valid export-form stores remain `ok`.

- Current-main composition: `618dd6c05ff6750705b52426261748d11e003477`, merged into this branch at `772df26ea7a793e2ffc36afbc4a65b6b47739718` before final affected-module verification.
- Original runner source base: `7a3637f5df7111fda87f2f1408e23963d18caadc`.
- Lane: `lane:foundation`.
- Owned paths: credential status and runner, its existing status test module, boot recorder call, secret-storage documentation, the OpenHands monitoring baseline, and registered evidence hashes.
- Separate from #846; credential paths still require the CC's explicit landing cue.

The runner's existing per-line body is extracted into one `parse_line` function used by both tools. The runner still stops at its first refusal; status collects all refused lines. Status uses the runner's exact `injectable()` predicate, invokes its core-dump guard before the checked file-descriptor reader, and reports completed grammar reads with `values_read`. Raw private files, native sign-in, service-held and undeclared files retain their metadata-only handling. Text output discloses the checked grammar read. The boot recorder explicitly selects its existing metadata-only scan.

The shared reader's lazy import also exposes nine pre-existing runner/setter read sites to the OpenHands advisory import closure. Its committed monitoring baseline follows this PR's native report (330 reads/97 shape locations); classification, enforcement, breadth limits, workflow and assertions are unchanged. Main's independent 321-read baseline remains appropriate for main's source.

## SOTA sources

- [Existing credential runner at the base](https://github.com/seathatflowsinourveins/native-agent-stack/blob/7a3637f5df7111fda87f2f1408e23963d18caadc/tools/credentials/credential_run.py#L195): its supported checked reader, `LINE` pattern, `parse` at lines252-285, and writer-grammar checks. The extracted line body has the same AST as that body except the former comment/blank-line `continue` becomes helper `return`; no grammar is reimplemented in status.
- [Existing credential writer](https://github.com/seathatflowsinourveins/native-agent-stack/blob/7a3637f5df7111fda87f2f1408e23963d18caadc/tools/credentials/set_credential.py): the runner continues using its `BARE_VALUE` and `encode` checks.
- [CPython 3.13 `os` reference](https://docs.python.org/3.13/library/os.html#os.open): the existing reader uses `dir_fd`, `O_NOFOLLOW`, `fstat`, bounded `read`, and descriptor cleanup. This PR reuses that reader.
- [Existing runner safety helpers](https://github.com/seathatflowsinourveins/native-agent-stack/blob/772df26ea7a793e2ffc36afbc4a65b6b47739718/tools/credentials/credential_run.py#L667): `injectable()` at line151 selects only runner-eligible private env files; `check_core_pattern()` and `disable_core_dumps()` at lines667-700 refuse native crash collectors and disable core files before any grammar read. Synthetic review regressions verify raw-private-file isolation and refusal before reading.
- CC decision `cc-crosssession-credstatus` (~08:00Z): require value-free agreement between status and the runner. No host store was inspected or changed for this PR.
- [Existing OpenHands resolver at the reviewed source head](https://github.com/seathatflowsinourveins/native-agent-stack/blob/0ca21c31b36e0a9aa99de949fe77dd5b7dff83c3/blueprints/runtime-workers/openhands/resolver/push_gate.py): native `GitTree`, `derive_ci_protected` and `advisory_gate_reads` generated the candidate-specific monitoring snapshot. Source review found +5 runner/+4 setter sites, no site/shape losses, zero enforced unresolved reads, and unchanged breadth caps. No custom classifier or widened allowance was added.

### Evidence-class table

| Claim | Evidence class | Command / receipt |
| --- | --- | --- |
| Same grammar implementation and refusal ordering | `source_review` | Base runner body versus extracted shared function; exact AST parity except `continue`/`return`. |
| Non-export/other refused lines become unsafe without content in output | `local_integration` / `synthetic` | Two new tests in the existing status module, using temporary fake stores only. |
| Existing writer, runner and boot behavior | `local_integration` / `synthetic` | Existing affected modules below; boot and runner test files unchanged. |
| Registered hashes and repository consistency | `local_integration` | `python3 scripts/validate.py`; `git diff --check`. |

### Local commands run

```text
$ python3 -m unittest tests.test_credential_status.CredentialStatusTests.test_runner_refused_store_lines_are_unsafe_and_value_free tests.test_credential_status.CredentialStatusTests.test_export_form_store_stays_ok_and_value_free
Before the fix: exit 1; invalid-file test failed its eight cases and CLI verdict; export-form control passed. No synthetic content appeared in the returned output.
$ python3 -m unittest tests.test_runtime_worker_openhands_push_gate tests.test_runtime_worker_openhands_resolver tests.test_credential_status tests.test_credential_run
399 tests, OK (skipped=2); exit 0; 193.757 seconds, under the repository's Python 3.12 CI environment at the composed merge head
$ python3 scripts/validate.py
{"components": 70, "hashed_files": 10856, "profiles": 4, "receipts": 232, "status": "passed"}
exit 0; integrity and scope checks only
$ git diff --check
exit 0
```

The two new tests cover the reported non-export defect, ASCII/control/undeclared-variable refusals, the runner's duplicate/empty/writer-grammar refusals, multiple refused lines with correct numbering, and an export-form control. Existing status expectations that prohibited all private-file reads now check the supported descriptor read, continued protection of undeclared/native files, and truthful `values_read` reporting. No value is emitted in text, JSON, test results or PR evidence.

Failed attempts retained: a 60-second runner capture was incomplete; an initial native runner run returned 7 failures/1 error; an intermediate combined run returned 30 failures/1 error. Unchanged reruns on the final source passed 101 and 92 tests. The cause of those transient results was not established; the passing reruns do not erase them. The metadata-only boot call resolved the separate reproducible boot-contract failures. These tests use synthetic stores and do not establish a live credential or provider operation.

### Decision record

`cc-crosssession-credstatus`. Reuse the existing parser and reader so both tools validate through one grammar function. Inverse: revert the PR commits. No install, service change or owner store operation accompanies the fix.

The individual changed contracts are declared in `docs/secret-storage.md`, under "Declared test contracts for credential-status grammar (2026-10-08, PR #849)". Main's file at `64a8cda01700d5e823c18e4b989e856de2ee2241`, tested against the PR source, returned exactly four expected failures: `CredentialStatusTests.test_undeclared_store_file_is_reported_by_name_only`, `test_private_file_is_ok_and_output_is_value_free`, `test_never_opens_or_reads_credential_files`, and `test_guard_pin_check_hashes_only_the_installed_guard`. The replacement checked-reader test and export-form fixtures preserve value-free output while permitting the grammar check required by the CC ruling.

The unchanged baseline/category regression passed after the native snapshot refresh (1 test, 7.689 seconds). Final affected push-gate, resolver, credential-status and credential-run modules pass at merge head `772df26ea7a793e2ffc36afbc4a65b6b47739718` (399 tests, 2 skips, 193.757 seconds). Before the merge commit, `python3 scripts/validate.py` passed on the resolved tree: 70 components, 10,856 hashed files, 4 profiles, 232 receipts. Earlier pre-merge evidence at `ff18b4ad141c1c27b5b7e5cd296f2871c490d881` remains separate: 398 tests, 2 skips, 213.895 seconds, and the 69-component validator result. That earlier full-module capture reported a 50-second MCP timeout while the original native process continued; its eventual rc0 and first log are retained. The final merge capture ran once and passed. Main's reviewed 321-read control was green and the pre-fold PR 330-read control was red; no standalone main baseline change was made.

### Host evidence

The final review repair passed 141 credential-status/credential-run tests (79.766 seconds), the focused raw-private/core-collector pair (2 tests), and the unchanged advisory baseline test (1 test, 7.142 seconds) at final composed head `6ea1adfba05b1067d12826c460307c1dae52621f`. The final composition merges current main `0d5672b08beb87a06daee792afeb66481d0c71e6`; credential source and test inputs are byte-identical to the 141-test passing review commit. Validator rc0: 70 components, 10,870 hashed files, 4 profiles, 234 receipts. Main's credential-status test blob `6c666faa014422064f8927c8ee145be0e3256e1a` is unchanged between the previously tested618dd6c0 and current0d5672b0; its 44-method disjoint run against the review-fixed source returned exactly the four declared failures. Previous399-test composition evidence remains explicitly historical; these final checks validate the three review corrections.

The initial raw-private regression fixture used an unsupported path placeholder and returned one missing-versus-ok failure; its corrected canonical STORE_ROOT fixture passed. The original failure is retained without credential content. No operator credential store or host core configuration was changed.

At final fixture head `31e797a9369653a8bc351d4b73e8560844c48b62`, status, writer and runner modules passed together: 175 tests, rc0, 84.045 seconds under the Python3.12 CI environment. Validator rc0: 70 components, 10,870 hashed files, 4 profiles, 234 receipts; evidence registry updated last. Main's two modified test modules at `0d5672b08beb87a06daee792afeb66481d0c71e6`, run against the unchanged candidate production source, returned exactly the four individually declared status-method failures across 78 tests. The writer method retains identical expected values and explicitly observes metadata only. `git diff --check` passed.

Hosted run37815646323 at earlier6ea1adfb is retained as a failed attempt: 20 status subtest failures plus one writer metadata failure. Its Ubuntu core collector made the new production guard correctly return core_pattern_pipe before reading. The existing temporary-store fixtures now also supply a synthetic kernel core-pattern input for in-process and subprocess main(argv) calls, following the existing runner fixture launcher at tests/test_credential_run.py:67,280-309. Default production CLI protection is unchanged, and the pipe-collector-before-read regression remains active. The writer's temporary-file test selects the existing metadata-only flag. These individual test contract/scope adjustments are named in docs/secret-storage.md; no assertion is removed or weakened. This is fixture integration evidence, not acceptance of a live credential host.

No files under `evidence/hosts/` changed.

### Checklist

- [x] No workflow changes; GitHub Actions pin/permission requirements are unaffected.
- [x] No credential values or new required secrets added to public evidence.
- [x] No paid hosting, subscription or billing surface introduced.
- [x] Peer-owned files/worktrees preserved; evidence manifest is in the final commit.