🔒 Protect marked elicitation values during execution and replay - #1100

Independent Fable review and affected closeout: PASS on 33005881b274c862583a41fb9326f66ca467af9b.

The complete feature was reviewed at 3fd110e3, covering all six accepted behavior clauses. The original reviewer then checked the eight-file correction at this head, carrying that coverage forward. No blocking finding remains.

• The host-tail cleanup blocker is fixed. Both original held-prefix/no-newline and trailing-newline probes finish cleanly; the real REPL regression covers both channels and normal, silent and bound command routing.
• Ordinary missing-final-member interpolation is restored, and the stale workflow-provider comment is corrected.
• Two observations remain nonblocking: document-time Context selection differs from stronger literal wording in the boundary packet while publication enforcement captures its owner; unmarked forwarded bytes normalize invalid UTF-8, with per-chunk cost unmeasured. Their retention grants no rule waiver or claim of literal packet compliance.

Architect and Planner also pass this exact head. Focused correction evidence passes (Core 15 groups/83 steps; host 6 groups/11 steps), alongside the retained frozen matrix and its candidate attribution. Required CI remains a separate merge gate.

Independent Fable affected closeout: PASS at 624dba0124760cd5c2a2bb1718a16ad4435567b1 (parent 33005881). The completed full review and prior F1 closeout remain retained evidence; this is the seven-file CI repair closeout, covering B1–B6 with no blocking finding.

The repair preserves the existing TypeScript target, removes a validation initialization cycle without changing error identities, omits optional secret metadata on unmarked fields, and serializes errors before the existing selective disclosure projection. The serialization is in-memory and followed by the same redaction; protocol/codec identities and the R1/F1 paths remain intact. Existing D1, X1 and UI13 assertions are unchanged. Recorded focused Node typechecking, 14 separate-process Deno/Bun initialization runs, REPL assertions and protected-input controls pass. Original Architect and Planner also pass this exact head.

Two earlier nonblocking observations remain explicit: consumer-time Context selection differs from the stronger design-packet wording, with no waiver claimed; unmarked forwarded output normalizes invalid UTF-8 and its per-chunk cost is unmeasured. No full review or UX benchmark was repeated for this repair.

Required CI2416 is pending on this corrected commit. This comment records the independent review outcome; it is not a merge approval.

Independent Fable affected closeout: PASS at aff1410b2c605c775796a58b5d3aae0cfea2b716 (parent 624dba01). This covers only the Node fixture repair, carrying the completed feature review and B1–B6 coverage.

The committed file is byte-identical to its parent after exactly four provider.ts → provider.mjs substitutions. The temporary providers contain plain ESM JavaScript; .mjs selects the same module mode already used by other CLI plugin fixtures. The captured first stderr shows Node refused the .ts plugin before document work because CommonJS loading reached the import-only remend dependency. Recorded affected-file checks pass under Node, Deno and Bun.

Every disclosure assertion, unmarked negative control, real child invocation and controlled npm command spelling is preserved. No production loader, dependency, exclusion or assertion changed. The affected Planner also passes this exact head. Prior architecture coverage stands because production is unchanged.

The earlier N1 Context-selection and N3 invalid-UTF8/unmeasured-cost observations remain nonblocking and unwaived. No full feature review, architecture review or UX benchmark repeated. New corrected-head CI remains required; this comment records review findings and is not merge approval.

Independent Fable mechanical-rebase closeout: PASS at e1392f5d2167bd9c9c76873f3f57feb5e9dc08dc.

Mechanical-rebase closeout at e1392f5 (six feature commits replayed onto main 25368ab), carrying prior B1–B6 coverage. Independently recomputed from immutable Git objects: range-diff marks all six patches equal; the cumulative feature patch ID (acdd48b7…) is identical before and after; the new tree 9b473dd7 equals a conflict-free merge-tree of old head aff1410 with exact main; main is an ancestor; all six rewritten commits verify with a good signature; checkout clean at HEAD. Only architecture.md and specs/repl-spec.md overlap with main's changes, and per-path patch IDs show both the feature hunks and main's hunks preserved exactly. Every reviewed protected-input source and test blob is byte-identical to the previously passed head. No new execution was needed; no new-head CI success is claimed.

• Rebase equivalence verified independently: git range-diff 32b53ab9..aff1410b 25368ab1..e1392f5d shows six = rows; git diff 32b53ab9 aff1410b | git patch-id --stable and git diff 25368ab1 e1392f5d | git patch-id --stable both yield acdd48b798f090d16eb7f37b4ea92a37ae43d3fc; git merge-tree --write-tree 25368ab1 aff1410b returns 9b473dd7f699d060a49648ae526d5b75f3aedaad with exit 0, equal to e1392f5d^{tree}; path intersection of feature and main deltas is exactly architecture.md and specs/repl-spec.md, whose feature-side and main-side patch IDs are preserved; inputs.ts, input-host.ts, policy.ts, input-schema.ts, elicit-journal.ts, execute.ts, foreground.ts and protected-input-cli.test.ts have identical blob IDs at aff1410 and e1392f5; git verify-commit succeeds for all six new commits.

• Retained N1 (unchanged by the rebase): consumer-time inputValues() Context selection remains a literal discrepancy with the boundary's captured-owner sentence; no waiver or compliance claimed.

• Retained N3 (unchanged by the rebase): route() decodes and re-encodes forwarded bytes for all foreground commands; invalid UTF-8 becomes replacement characters and the per-chunk cost is unmeasured.

Prior full feature review and affected closeouts remain retained. This is exact-head equivalence review; required CI and repository merge gates remain authoritative.