@bjoernrochel/sevro 0.1.0-rc.11 → 0.1.0-rc.12

package/docs/README.md

@@ -4,19 +4,19 @@
 
 Start with the task you want to complete. These pages work without an agent.
 
-| I want to…                                    | Read                                                     |
-| --------------------------------------------- | -------------------------------------------------------- |
-| Get a result without a model account          | [Your first evaluation](getting-started.md)              |
-| Install, update, remove, or use a checkout    | [Installation](installing.md)                            |
-| Run evaluations and select a host             | [Running evaluations](running-evaluations.md)            |
-| Create cases and reusable policy              | [Cases and extensions](creating-cases.md)                |
-| Interpret verdicts, evidence, and comparisons | [Reading results](reading-results.md)                    |
-| Run Codex or Claude with isolation            | [Native hosts](native-hosts.md)                          |
-| Reuse host tools or enable goals and hooks    | [Runtime configuration](runtime-v1.md)                   |
-| Resolve a symptom                             | [Troubleshooting](troubleshooting.md)                    |
-| Understand runner responsibilities            | [Architecture](architecture.md)                          |
-| Change Sevro or its documentation             | [Contributing](../CONTRIBUTING.md)                       |
-| Understand licensing and branding             | [Licensing](licensing.md) and [assets](assets/README.md) |
+| I want to…                                     | Read                                                     |
+| ---------------------------------------------- | -------------------------------------------------------- |
+| Get a result without a model account           | [Your first evaluation](getting-started.md)              |
+| Install, update, remove, or use a checkout     | [Installation](installing.md)                            |
+| Run evaluations and select a host              | [Running evaluations](running-evaluations.md)            |
+| Create cases and reusable policy               | [Cases and extensions](creating-cases.md)                |
+| Interpret verdicts, evidence, and comparisons  | [Reading results](reading-results.md)                    |
+| Run Codex or Claude with isolation             | [Native hosts](native-hosts.md)                          |
+| Reuse host tools or enable goals and hooks     | [Runtime configuration](runtime-v1.md)                   |
+| Resolve a symptom                              | [Troubleshooting](troubleshooting.md)                    |
+| Trace runner lifecycle, ownership, and changes | [Architecture](architecture.md)                          |
+| Change Sevro or its documentation              | [Contributing](../CONTRIBUTING.md)                       |
+| Understand licensing and branding              | [Licensing](licensing.md) and [assets](assets/README.md) |
 
 ## Ask the guide
 

package/docs/architecture.md

@@ -4,22 +4,143 @@ Sevro owns generic execution/evidence contracts. Projects own cases and policy.
 This lets Darrow and other integrations use the same runner without importing
 their benchmark policy into it.
 
-| Responsibility                                    | Sources                                                                                                            |
-| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| Parse commands/select explicit routes             | [CLI](../src/cli.ts), [CLI reference](development-cli.md)                                                          |
-| Prepare, execute, grade, retain, clean up         | [Engine](../src/engine.ts), [engine slice](engine-slice.md)                                                        |
-| Negotiate trusted extension calls                 | [Client](../src/extension-client.ts), [session](../src/extension-session.ts), [protocol](extension-protocol-v1.md) |
-| Run native hosts and retain bounded observations  | [Codex](codex-host.md), [native controls](native-controls.md), [host sources](../src/hosts/)                       |
-| Reduce execution/grading/task states              | [Result source](../src/results.ts), [contract](results-v1.md)                                                      |
-| Bind comparison identities and release provenance | [Identity](identity-v1.md), [releases](releases.md)                                                                |
-| Summarize retained results                        | [Report](report-v1.md)                                                                                             |
-
-Completed evidence is retained before cleanup. Missing observations remain
-unavailable; unknown measurements do not become zero. Extensions cannot
-silently replace isolation/persistence or built-in policy. The
+This page explains this checkout's implementation and points to acceptance
+tests for changes. [Current contracts](contracts.md) define public behavior;
+[historical validation](evidence.md) records bounded past observations. The
+[engine slice](engine-slice.md) retains its earlier scope and detailed lifecycle
+explanation. Implementation paths and test scenarios here are navigation, not
+evidence that a particular candidate passed validation.
+
+[`engine.ts`](../src/engine.ts) remains the programmatic facade, and
+[`cli.ts`](../src/cli.ts) remains the installed command entrypoint. The CLI
+loads and assembles evaluation options; evaluation modules coordinate the run
+and its trials.
+
+## Evaluation lifecycle
+
+[`runEvaluation`](../src/evaluation/run.ts) prepares inputs before allocating
+run resources, retains preparation artifacts, and reserves candidate and
+semantic workspace roots as needed before calling the trial scheduler. The map
+follows the path of a retained trial; individual stages can be skipped or fail.
+
+```mermaid
+flowchart TD
+    P["Validate and prepare evaluation inputs"] --> R["Allocate run storage and owner; reserve workspace roots"]
+    R --> W["Admit trial and materialize its reserved fixture"]
+    subgraph Trial["Each admitted trial"]
+        W --> C["Initialize grading bases; execute candidate"]
+        C --> E["Retain candidate artifacts; observe output; prepare grading views"]
+        E --> G["Output, shell, Git, semantic, and extension grading"]
+        G --> A["Assess execution, grading, and task separately"]
+        A --> V["Optional independent advisory review"]
+        V --> T["Retain raw candidate response; atomically write trial evidence"]
+        T --> K["Collect completed trial and checkpoint its reference"]
+        K --> D["Release temporary views; clear or retain fixture contents"]
+    end
+    D --> J["All admitted trials drain"]
+    J --> F["Write final run evidence; finalize owner checkpoint"]
+    F --> X["Finalize retained workspaces; release other reservations"]
+```
+
+[`scheduleTrials`](../src/evaluation/scheduler.ts) bounds active work by the
+prepared job limit. It admits a trial before
+[`prepareTrialWorkspace`](../src/evaluation/resources.ts) materializes that
+trial's fixture. Each [`EvaluationTrial`](../src/evaluation/trial.ts) owns its
+mutable state and writer. Its `run()` method keeps candidate execution,
+artifact retention, grading, assessment, advisory review, persistence, and
+cleanup in one visible order. Grading helpers return checks, observations,
+and failures; the coordinator incorporates those results and stops new
+admission when an execution or required grading error is detected, before
+advisory work, persistence, or cleanup. The scheduler also stops admission on
+cancellation and waits for active workers. A failed task check alone does not
+close admission. Already admitted peers drain and retain their evidence, including
+when they finish out of order.
+
+[`runAdvisoryReview`](../src/evaluation/advisory.ts) handles its own host call,
+assessment, retained response, and auxiliary workspace cleanup. It depends on
+candidate completion, independently of the task assessment. The
 [advisory fixture](advisory-fixture.md) gives review a separate Git view with
-evaluator inputs withheld.
+evaluator inputs withheld. Its recommendation or host failure does not change
+task grading; a failure to retain its evidence remains a persistence error.
+
+Successful [semantic response parsing](../src/evaluation/semantic.ts) clears
+auxiliary fixture contents; successful advisory response parsing removes its
+auxiliary fixture. Both retain response evidence first, including valid failed
+check verdicts or advisory recommendations.
+
+The [trial writer](../src/evidence/trial-writer.ts) writes the trial artifact
+before the coordinator marks it persisted and hands it to the
+[result collector](../src/evaluation/collection.ts). The collector registers
+the completed record, orders records by trial number, and checkpoints retained
+artifact paths. After active work drains, the run coordinator validates and
+writes `run.json` before finalizing the owner as complete or interrupted.
+Persistence failures cannot produce a successful result; the run's failure
+path attempts a diagnostic checkpoint while preserving the original failure.
+
+Trial cleanup releases candidate artifact runtimes and transcript views even
+when the trial fails. Persisted successful fixture contents are cleared while
+their empty reserved roots remain until active work drains. Failed, cancelled,
+grading-error, unavailable-evidence, and failed-task fixtures are retained;
+[workspace ownership](../src/fixtures/workspace-state.ts) tracks their inactive
+retention and startup expiry after 24 hours. Saved evidence stays outside that
+cleanup. See the [results retention contract](results-v1.md#identity-and-provenance)
+for the public boundary, including ownership that cannot be verified.
+
+Dry preparation still validates and materializes fixtures, including declared
+fixture setup, and retains trial records. It skips candidate execution and
+grading, recording `not_run` / `not_requested` / `not_assessed`, as exercised by
+the [engine acceptance suite](../tests/engine.test.ts). Missing observations
+remain unavailable; missing required evidence cannot become a pass. Optional
+unknown measurements remain unknown rather than becoming zero. Extensions
+cannot silently replace isolation, persistence,
+or built-in policy. The [results](results-v1.md) and
+[extension protocol](extension-protocol-v1.md) contracts define those semantics.
+
+## State ownership
+
+[`EvaluationContext`](../src/evaluation/context.ts) carries four explicit
+collaborators: prepared inputs, run resources, the result collector, and retained
+preparation-artifact references. It does not combine mutable trial fields with
+the preparation plan.
+
+| Data or state                  | Owner                                                                                                                                                           | Boundary                                                                                                                                                                                                                                                                          |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Prepared inputs                | [`PreparedEvaluation` in `plan.ts`](../src/evaluation/plan.ts)                                                                                                  | Named fixture, check, and invocation groups plus routes, provenance, redacted configuration, and comparison identity. Preparation completes before run allocation.                                                                                                                |
+| Run resources and reservations | [`RunResources` and `RunWorkspaceReservations` in `resources.ts`](../src/evaluation/resources.ts)                                                               | Run ID, evidence/state locations, process owner, and candidate/semantic reservations. Reservations outlive completed fixture contents; retained workspaces are tracked separately from completed roots.                                                                           |
+| Mutable trial state            | [`TrialRuntimeState` and `EvaluationTrial` in `trial.ts`](../src/evaluation/trial.ts)                                                                           | Candidate result, observations, checks, assessment, temporary views, advisory result, and persisted milestone belong to one admitted trial. Grading receives narrow inputs and explicit effects rather than this state object.                                                    |
+| Collected run results          | [`ResultCollector` in `collection.ts`](../src/evaluation/collection.ts)                                                                                         | Private completed summaries, evidence, and diagnostics; trial-number ordering, snapshots for aggregation, and checkpoint requests. [`run-owner.ts`](../src/run-owner.ts) verifies process ownership and writes owner/checkpoint state.                                            |
+| Evidence writes                | [`TrialEvidenceWriter`](../src/evidence/trial-writer.ts), [preparation retention](../src/evaluation/resources.ts), [run finalization](../src/evaluation/run.ts) | The trial writer owns filenames, private writes, hashes, artifact references, and typed trial-persistence failures. Resource helpers retain preparation bytes; run finalization writes aggregate evidence. [`storage.ts`](../src/storage.ts) supplies atomic private JSON writes. |
+
+Fixture modules own materialization and workspace preparation. Runtime modules
+own declared host runtime policy and private state. Evidence modules validate
+host observations and artifacts, verify retained bytes, and normalize optional
+usage without constructing fixtures. Native host implementations and graders
+remain in their own families.
+
+## Where to change behavior
+
+Start with the responsibility, then inspect its observable acceptance scenarios.
+These are useful starting suites, not an exhaustive validation list. The
+[contribution checks](../CONTRIBUTING.md#quality-contract-and-checks) still govern
+candidate acceptance.
+
+| Responsibility                                                    | Implementation and reference                                                                                                                                                                                                                      | Relevant acceptance tests                                                                                                                                                                                         |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Parse commands/select explicit routes                             | [CLI entrypoint](../src/cli.ts), [invocation parsing](../src/cli/invocation.ts), [CLI reference](development-cli.md)                                                                                                                              | [Invalid invocations](../tests/cli/invocation-validation.test.ts)                                                                                                                                                 |
+| Load and prepare a CLI evaluation                                 | [Input loading](../src/cli/loading.ts), [preparation](../src/cli/preparation.ts), [host construction](../src/cli/hosts.ts), [extension resolution](../src/cli/extension.ts), [evaluation assembly](../src/cli/evaluation.ts)                      | [Case/configuration validation](../tests/cli/case-validation.test.ts)                                                                                                                                             |
+| Present CLI results and own cancellation                          | [Presentation](../src/cli/presentation.ts), [cancellation](../src/cli/cancellation.ts), [command lifecycle](../src/cli/command.ts)                                                                                                                | [CLI states and exits](../tests/cli/results.test.ts), [signal retention](../tests/cli/trial-retention.test.ts)                                                                                                    |
+| Prepare evaluation inputs and grade trials                        | [Engine facade](../src/engine.ts), [plan](../src/evaluation/plan.ts), [grading](../src/evaluation/grading.ts), [semantic grading](../src/evaluation/semantic.ts), [evaluation modules](../src/evaluation/), [engine slice](engine-slice.md)       | [Preparation refusals](../tests/evaluation/preparation-validation.test.ts), [semantic grading failures](../tests/evaluation/semantic-grading-failures.test.ts), [engine lifecycle](../tests/engine.test.ts)       |
+| Schedule trials, retain evidence, and finalize ownership          | [Scheduler](../src/evaluation/scheduler.ts), [trial coordinator](../src/evaluation/trial.ts), [reservations](../src/evaluation/resources.ts), [collection](../src/evaluation/collection.ts), [run owner](../src/run-owner.ts)                     | [Concurrent admission and ordering](../tests/cli-concurrency.test.ts), [trial failures and retention](../tests/evaluation/trial-retention.test.ts), [checkpoint refusals](../tests/run-owner-checkpoints.test.ts) |
+| Prepare, construct, and clean up fixtures                         | [Fixture modules](../src/fixtures/), [construction](../src/fixtures/create.ts), [preparation artifacts](../src/fixtures/preparation.ts), [content cleanup](../src/fixtures/cleanup.ts), [workspace ownership](../src/fixtures/workspace-state.ts) | [Artifact preparation](../tests/fixtures/artifact-preparation.test.ts), [workspace lifecycle](../tests/fixtures/workspace-lifecycle.test.ts)                                                                      |
+| Resolve runtime policy, discovery, and private state              | [Runtime modules](../src/runtime/), [configuration](../src/runtime/config.ts)                                                                                                                                                                     | [Runtime environment](../tests/runtime/environment.test.ts), [candidate artifact lifetime](../tests/runtime/candidate-artifacts.test.ts)                                                                          |
+| Validate host results and retain bounded evidence                 | [Host results](../src/evidence/host-results.ts), [trial writer](../src/evidence/trial-writer.ts), [retained artifacts](../src/evidence/retained-artifacts.ts), [usage](../src/evidence/usage.ts)                                                  | [Host evidence refusals](../tests/evaluation/host-evidence.test.ts), [failed-host evidence retention](../tests/evaluation/trial-retention.test.ts)                                                                |
+| Negotiate trusted extension calls                                 | [Client](../src/extension-client.ts), [session](../src/extension-session.ts), [extension grading](../src/evaluation/grading.ts), [protocol](extension-protocol-v1.md)                                                                             | [Negotiated engine behavior](../tests/extension-engine.test.ts), [extension grading outcomes](../tests/evaluation/extension-grading.test.ts)                                                                      |
+| Run independent advisory review                                   | [Advisory execution](../src/evaluation/advisory.ts), [blind fixture](../src/fixtures/advisory.ts), [advisory fixture explanation](advisory-fixture.md)                                                                                            | [Advisory failures](../tests/evaluation/advisory-failures.test.ts), [blind change view](../tests/advisory-fixture.test.ts)                                                                                        |
+| Run native hosts and retain bounded observations                  | [Codex](codex-host.md), [native controls](native-controls.md), [host sources](../src/hosts/), [shared process mechanics](../src/process-lifecycle.ts), [native waiting](../src/hosts/process-lifecycle.ts)                                        | [Native process admission and byte bounds](../tests/hosts/native-process-boundaries.test.ts)                                                                                                                      |
+| Reduce execution/grading/task states and maintain contract shapes | [Result reduction](../src/results.ts), [shared semantic types](../src/contract-types.ts), [wire types](../src/schema-types.ts), [runtime schema boundary](../src/schema.ts), [results contract](results-v1.md)                                    | [State and exit precedence](../tests/results.test.ts), [evidence schema boundaries](../tests/schema/evidence-boundaries.test.ts)                                                                                  |
+| Bind comparison identities and release provenance                 | [Preparation identity inputs](../src/evaluation/plan.ts), [identity hashing](../src/identity.ts), [provenance](../src/provenance.ts), [identity contract](identity-v1.md), [releases](releases.md)                                                | [CLI identity](../tests/cli/identity.test.ts), [package release provenance](../tests/release.test.ts)                                                                                                             |
+| Summarize retained results                                        | [Report implementation](../src/report.ts), [report contract](report-v1.md)                                                                                                                                                                        | [Report states and CLI](../tests/report.test.ts)                                                                                                                                                                  |
 
-These paths describe this checkout. [Historical validation](evidence.md) records
-bounded past observations. [Rust research](https://github.com/BjRo/sevro/issues/2)
-does not establish a migration; public interfaces remain useful independently.
+[Rust research](https://github.com/BjRo/sevro/issues/2) does not establish a
+migration; public interfaces remain useful independently. Return to the
+[documentation hub](README.md).

package/docs/builtin-graders-v1.md

@@ -38,8 +38,10 @@ The shell-check process runner accepts a bounded evaluator-owned `run` string,
 optional `expectedExitCode` and `timeoutMs`, plus `expectExact`, `expectRegex`,
 `notRegex`, and regex `flags` for stdout. Exact matching removes one final
 newline; regex matching always uses multiline mode. The runner executes with
-`sh -e`. On macOS and Linux it runs through the outer sandbox with network access denied,
-a credential-free environment, and caller-declared protected roots. Without a
+`sh -e`. On macOS and Linux it runs through the outer sandbox with network access denied
+by default, a credential-free environment, and caller-declared protected roots.
+The runtime [local HTTP option](runtime-v1.md#local-http-test-servers) permits
+socket-using upstream tests while retaining outbound isolation. Without a
 stdout assertion, process output is discarded. With one, the runner captures
 at most 1 MiB in memory and retains only its digest and byte length. Oversized
 or invalid UTF-8 output is a grading error.

package/docs/codex-host.md

@@ -31,8 +31,8 @@ because its parent directory belongs to a mounted skill; an existing mounted
 target that fails or produces incomplete bytes remains partial. A completed direct
 `cat` of one mounted `SKILL.md`, alone or alongside literal documentation
 paths, counts only when the command output contains that file's exact body.
-Batched reads naming multiple `SKILL.md` files or more than 64 paths remain
-partial, as do failed, malformed, or incomplete recognized reads. Direct
+Batched reads naming more than 64 paths remain partial, as do failed,
+malformed, or incomplete recognized reads. Direct
 `sed -n` pages count after their verified line ranges cover the whole body. An
 exact `cat` wrapped by `lean-ctx -c` is accepted only when its reported output
 still contains the full body; a compressed summary cannot prove the read.
@@ -47,18 +47,36 @@ cat .agents/skills/darrow-guide/SKILL.md; cat docs/specs/repository-guide.md; rg
 ```
 
 This sequence uses the shared stream and native read check. Quoted separators
-remain part of their literal operand. The initial skill body must match the
-beginning of the retained output, so later documentation or search output cannot
-replace an altered or incomplete initial read. Subsequent reads must not name
-another `SKILL.md` or resolve to a mounted or receipt-bound skill through an alias.
+remain part of their literal operand. The ordered file bodies must match the
+retained output, so documentation or search output cannot replace an altered
+or incomplete skill read. Literal `cat` commands may read multiple mounted
+skills and documentation, before or after skills, with or without a terminal
+search. Multiple literal terminal `rg` commands are accepted within the command
+bound. Each verified skill receives its own ordered receipt. Documentation
+must resolve within the workspace or a receipt-bound installed plugin root;
+each file is bounded to 1 MiB. Aliases of mounted skills without a literal
+`SKILL.md` operand remain unsupported.
 The 64-operand bound applies across all reads in the sequence. Shell expansions,
 including unquoted glob and tilde operands, are unsupported in this form.
 
+The bounded composed-read grammar also accepts `unset` with literal variable
+names, `pwd` or `pwd -P`, `git rev-parse --show-toplevel` (optionally with
+`-C "$PWD"`), `printenv` with literal variable names, and `rg --files` with
+literal arguments before the reads. Prefix `printenv` requires the reads to
+end the command, so environment output cannot replace missing read bytes.
+Literal `printenv` commands may follow reads without prefix `printenv`.
+The fixed pair `repo=$(git -C "$PWD" rev-parse --show-toplevel)` and
+`cd "$repo" && pwd -P` is supported only with absolute read operands. Other
+assignments, substitutions, directory changes, or control flow remain
+unsupported. Prefix and environment output cannot supply skill frontmatter;
+ambiguous repeated output cannot establish an attributable read.
+
 The check also accepts a chain of literal
 `cat` fallbacks with `2>/dev/null` and `||`, ending in `true` followed by a newline
 and one literal `rg` discovery command. A fallback chain must resolve to one
 canonical file across all its read operands; absent alternate targets do not
-invalidate the read. Multiple existing targets, including unmounted copies,
+invalidate the read. Each fallback `cat` names one literal file. Multiple
+existing targets, including unmounted copies,
 cannot establish an attributable read. The total read operands remain bounded
 at 64. The complete command must succeed and expose the mounted file's entire
 exact body. `cat` accepts literal file operands and the optional `--` delimiter;
@@ -99,6 +117,10 @@ The host also retains separate `sevro.codex.initial-skill-reads` and
 `sevro.codex.follow-up-skill-reads` observations. Each applies the same exact
 mounted-skill read check to one completed turn, so an extension can grade read
 order or a missing repeat read without inferring it from the combined list.
+For `app-server`, the verified same-thread feedback boundary separates the
+initial phase from the follow-up phase, including subsequent native goal turns.
+Absent, duplicated, foreign-thread, or failed boundaries do not yield phase
+receipts.
 
 It also checks native parent command records for exact mounted skill bodies,
 including sessions with no spawn request. The bounded diagnostic distinguishes
@@ -137,12 +159,20 @@ discarded. Extensions interpret task names and decide whether a nested reader
 satisfies their policy.
 The record proves an invocation attempt, not its success. A missing, ambiguous,
 unreadable, oversized, or malformed session is unavailable or partial, so its
-absence cannot prove that a control was unused. Calls made through submitted
-code are not classified by this first observation.
+absence cannot prove that a control was unused. Code Mode submissions now have
+separate bounded `execCalls` inspection receipts, described in the
+[native control contract](native-controls.md). Direct native call ordinals and
+acceptance receipts keep their original meaning; submitted requests do not
+acquire direct native acceptance receipts.
 For an explicitly declared `$plugin:skill`, the host verifies that the installed
 skill exists and that the exact token occurs once in the delivered prompt. A
-completed turn yields `sevro.codex.explicit-invocation` with the owner first and
-verified supporting reads after it. Incomplete reads make that receipt partial.
+completed turn yields a complete `sevro.codex.explicit-invocation` with the owner
+first and verified supporting reads after it. This receipt proves verified
+owner dispatch independently of file reads; it does not prove that all
+supporting skills were read. Consumers requiring complete supporting-read
+evidence must also require `sevro.codex.skill-reads` (or the applicable phase
+receipt) to be complete. Failed execution cannot yield a complete dispatch
+receipt.
 The `sevro.codex.repository-invocation` capability supports an explicitly
 declared `$skill` from `.agents/skills/<skill>/SKILL.md`. The host checks that
 the repository mount is a bounded regular file with no symlink components and
@@ -158,7 +188,11 @@ symlinks, and installs it with `codex plugin marketplace add` followed by
 `codex plugin add`. It checks each installation receipt against the private
 plugin cache. Candidate commands can read that cache, while the rest of the
 private Codex home, including authentication and configuration, remains denied.
-It refuses fixture-local `.codex` configuration, unsupported enforced
+With the [Codex state opt-in](runtime-v1.md#candidate-codex-configuration-and-user-skills),
+commands may read generated configuration and write actual non-system user skills;
+graders retain read-only access to that request's original paths. Fixture-local
+configuration is accepted as inert represented input on this route. Otherwise,
+the host refuses fixture-local `.codex` configuration. It also refuses unsupported enforced
 conditions, unreadable or oversized auth files, malformed event streams, and
 incomplete turns. The host bounds output and runtime, kills its process group
 on timeout or cancellation, and removes private state after the turn. It is
@@ -180,14 +214,18 @@ explicit workspace rule, denies all other filesystem roots except minimal
 runtime files and the selected executable's install directories, and
 specifically denies protected roots and the private Codex home. An executable
 inside a protected root is rejected. The profile also disables command
-network access and clears inherited command environment variables. The Codex
+network access by default and clears inherited command environment variables.
+The runtime [local HTTP option](runtime-v1.md#local-http-test-servers) enables
+Codex's managed network proxy and local binding for socket-using tests.
+The Codex
 parent can read authentication before it starts sandboxed commands. Tests
 invoke the installed `codex sandbox` CLI to prove fixture access, denied
 source/auth reads, and executable access. The process adapter verifies these
 properties in one sandbox invocation before each fresh host request, with a
 60-second bounded startup deadline. The combined probe still requires readable
 private command storage, denied project listing, denied authentication and
-configuration reads, and a successful native executable `--version`. Continuation
+configuration reads (unless configuration access was explicitly enabled), and a
+successful native executable `--version`. Continuation
 turns reuse the same isolated state. The longer deadline accommodates observed
 native policy startup; it is not counted as a performance saving.
 
@@ -207,3 +245,8 @@ yielded chunk count, and separate `completedCall` and `literalCommandCall`
 flags. These facts distinguish recovery sources without retaining commands,
 submitted code, or skill bodies. The diagnostic's completeness and truncation
 fields still determine whether its read evidence can support grading.
+
+[Issue #70 representative retests](evidence/skill-reads-70/results.json) retain
+separate task, activation, and phase-read outcomes from the private candidate,
+plus its source fingerprints and test-first regression results. Private native
+transcripts remain outside the repository.

package/docs/development-cli.md

@@ -323,7 +323,13 @@ isolated shell checks receive `.git/fixture-bin` on `PATH`. Host adapters
 receive `fixtureBinDir` and must add it to their native tool environment; the
 bundled Codex adapter also preserves it across login shells. A negotiated
 fixture setup command may then prepare the clone before the host runs.
-Repository submodules and preparation artifacts targeting `.git/` are refused.
+Repository fixtures preserve committed `.gitmodules` files and submodule gitlink
+revisions. Trial clones leave submodules uninitialized and do not fetch their
+contents, even when the source has initialized submodules. A fixture that needs
+those contents must initialize them during its negotiated setup. Modified or
+untracked files and revision changes in initialized source submodules are
+refused, including when Git's submodule ignore settings hide them. Preparation
+artifacts targeting `.git/` are refused.
 
 A direct case or extension can declare a generated Git fixture:
 

package/docs/evidence/code-mode-controls-71.md

@@ -0,0 +1,64 @@
+# Code Mode control evidence for issue 71
+
+On 2026-10-14, the implementation for [issue 71](https://github.com/BjRo/sevro/issues/71)
+replayed the four retained complete Codex native transcript bundles named in
+that ticket through the changed Sevro observers. This is artifact rechecking,
+not a fresh authenticated model trial. The original task checks and activation
+outcomes were preserved separately from the new control-absence assessment.
+Private native bundles, commands and output remain outside Git.
+
+| Case                                   | Inspected exec submissions | Submitted tool calls | Rechecked control absence | Original task checks    | Original activation |
+| -------------------------------------- | -------------------------- | -------------------- | ------------------------- | ----------------------- | ------------------- |
+| guide-mutation                         | 2                          | 4                    | passed                    | 7 passed, 1 unavailable | passed              |
+| guide-orchestration                    | 3                          | 6                    | passed                    | 8 passed, 1 unavailable | passed              |
+| code-review-empty-diff                 | 6                          | 8                    | passed                    | 6 passed, 1 unavailable | passed              |
+| code-review-reviewer-route-unavailable | 11                         | 12                   | passed                    | 6 passed, 1 unavailable | unavailable         |
+
+The recheck found no submitted agent launch or prohibited goal mutation in any
+case. All submission receipts had complete inspection and matching native
+ordinals. No accepted-agent count was substituted for invocation evidence.
+The older Darrow consumer still requires zero submitted exec calls; it needs
+to adopt the [receipt validation contract](../native-controls.md) to grade
+these new observations. Its original unavailable outcomes were not rewritten.
+
+The reviewer-route case's first read used a literal Git environment reset and
+repository-root query before its final mounted skill read. Its retained output
+ended with the exact 20,627-character skill body still present in the Darrow
+validation checkout. Rehydrating that independently matching mount and rebasing
+its expired private path let the changed skill-read observer establish a
+complete `code-review` receipt. This rechecked skill-file receipt is separate
+from the original unavailable activation outcome; no historical trial was
+changed to passed.
+
+Durable Bun regressions exercise the host's public observations for completed
+and rejected submissions, opaque code, and the repository-prefixed skill read.
+Additional real session/file regressions cover malformed/truncated completion,
+missing and duplicate receipts, forged textual labels, ambiguous code, namespace
+and size limits, and contradictory receipt counts/ordinals. Existing integration
+tests remain in place.
+
+## Observed test-first slices
+
+Each command below was run with its new regression present and its corresponding
+product behavior unchanged, then rerun after the product fix. Commands invoke
+the existing Bun harness; the shell routed their output through lean-ctx.
+
+1. Red — `bun test tests/codex-native-calls.test.ts -t "Code Mode exposes completed literal"`: missing submitted-call inventory.
+   Green — `bun test tests/codex-native-calls.test.ts -t "Code Mode exposes completed literal"`: 1 passed.
+2. Red — `bun test tests/codex-native-calls.test.ts -t "Code Mode portable"`: rejected request receipt missing and opaque submission reported complete.
+   Green — `bun test tests/codex-native-calls.test.ts -t "Code Mode portable"`: 2 passed.
+3. Red — `bun test tests/codex-native-calls.test.ts -t "Code Mode inspects the retained"`: both retained parallel-read shapes reported partial.
+   Green — `bun test tests/codex-native-calls.test.ts -t "Code Mode inspects the retained"`: 2 passed.
+4. Red — `bun test tests/codex-native-calls.test.ts -t "Code Mode refuses malformed"`: malformed and truncated completion envelopes reported complete.
+   Green — `bun test tests/codex-native-calls.test.ts -t "Code Mode refuses malformed"`: 2 passed.
+5. Red — `bun test tests/codex-native-calls.test.ts -t "Code Mode accepts native array"`: the native array envelope reported partial.
+   Green — `bun test tests/codex-native-calls.test.ts -t "Code Mode accepts native array"`: 1 passed.
+6. Red — `bun test tests/codex-host.test.ts -t "reviewer-route repository-prefixed"`: complete mounted body did not establish a skill read.
+   Green — `bun test tests/codex-host.test.ts -t "reviewer-route repository-prefixed"`: 1 passed.
+7. Red — `bun test tests/native-controls.test.ts -t "contradictory Code Mode"`: mismatched submission ordinal reported complete.
+   Green — `bun test tests/native-controls.test.ts -t "contradictory Code Mode"`: 1 passed.
+8. Red — `bun test tests/codex-native-calls.test.ts -t "attributable control evidence"`: foreign namespace and oversized tool labels reported complete.
+   Green — `bun test tests/codex-native-calls.test.ts -t "attributable control evidence"`: 2 passed.
+
+These focused slices do not substitute for the full GitHub CI acceptance gate
+on the PR's exact published commit.