@bjoernrochel/sevro 0.1.0-rc.8 → 1.0.0

package/docs/cache-ownership-validation.md

@@ -1,49 +0,0 @@
-# Cache ownership validation
-
-The public CLI's curated Claude runtime no longer supplies repository-specific
-cache variables. Tools select their own defaults under an isolated home in the
-trial's Git metadata. Candidate and shell-check homes are separate; their
-curated UV cache is shared within one trial.
-
-## Test-first trace
-
-1. Red — `bun test tests/cli.test.ts -t "CLI curated Claude runtime leaves repository caches to tools"`:
-   the synthetic Claude process rejected the injected `DARROW_CACHE_DIR`;
-   the public result recorded failed execution and exit 2 instead of a passed
-   task. Product code was unchanged.
-2. Green — `bun test tests/cli.test.ts -t "CLI curated Claude runtime leaves repository caches to tools"`:
-   one test passed after removing that override and placing the curated
-   candidate home in Git metadata. An intermediate fixture correction
-   canonicalized macOS path aliases before testing containment.
-3. Red — `bun test tests/cli.test.ts -t "CLI curated shell grading leaves repository caches to tools"`:
-   candidate execution completed, but the isolated shell check rejected the
-   injected cache override and the public task failed. The shell grader was
-   unchanged.
-4. Green — `bun test tests/cli.test.ts -t "CLI curated shell grading leaves repository caches to tools"`:
-   one test passed after removing the shell override. Intermediate test repairs
-   corrected the public check status to `passed` and read checks from the
-   documented CLI result, rather than a nonexistent evidence field.
-
-The two commands remain the literal focused commands for these slices.
-Intermediate fixture/assertion failures are not additional behavior evidence.
-The candidate test supplies an unusable caller cache override and verifies
-that it is absent from the host environment. Both tests write tool-owned cache
-files. The shell test also verifies the curated cache, separate homes, and
-an unchanged Git worktree.
-
-## Final gates
-
-- `bun run typecheck`
-- `bun run format:check`
-- `bun test`
-- `bun run test:package-install`
-
-The installation gate exercises the same environment migration through the
-installed CLI, synthetic Claude executable, and an isolated shell check, with
-no source Git metadata. Darrow separately runs its installed-package parity
-gate against the exact candidate tarball.
-
-These fixtures exercise Sevro's real preparation, execution, shell isolation,
-grading, and package boundary. Claude is synthetic; this is not live model
-evidence or proof of Claude's own sandbox behavior. No release is published by
-these checks.

package/docs/claude-continuation-validation.md

@@ -1,47 +0,0 @@
-# Claude continuation validation
-
-The bundled Claude host now starts and resumes the same UUID-bound native
-session for a declared follow-up prompt. The public CLI regressions use
-synthetic executables and credentials without model calls.
-
-Working directory: `/Users/bjro/Sources/sevro`.
-
-## Public CLI slices
-
-1. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI resumes Claude in the same isolated session and grades its final turn"'`:
-   exit `64`, with `selected host does not support continuation`.
-2. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI resumes Claude in the same isolated session and grades its final turn"'`:
-   one test passed with eight assertions. Both calls use the same native
-   session, settings, credentials, model, and effort. The final response passes;
-   separate turn artifacts, combined usage, and the workspace boundary remain
-   in public evidence. A later guard also confirms exactly one initial and one
-   resume launch, bringing this test to nine assertions.
-3. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI leaves Claude usage unmeasured when a resumed result belongs to another session"'`:
-   foreign-session usage was incorrectly retained as complete with four input
-   tokens, six output tokens, and cost `0.03`.
-4. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI leaves Claude usage unmeasured when a resumed result belongs to another session"'`:
-   one test passed with three assertions. Execution fails, task success is
-   unassessed, and unbound token and cost measurements remain unknown.
-
-The first test initially omitted the generated fixture's `kind`. Its invalid
-configuration was corrected before the meaningful red above; that setup error
-was not a missing-behavior red.
-
-## Additional guards and final gates
-
-Two additional CLI guards passed with 62 assertions. They cover failed,
-missing, foreign, and duplicate native results in either turn, prevent resume
-after an invalid initial result, retain failed event evidence without grading,
-and preserve changed, unmeasured, or incomplete usage observations. They were
-added after implementation, without a test-first claim. One initial assertion
-used the wrong retained-check location; it was corrected to the public CLI
-trial checks.
-
-The full `lean-ctx -c 'bun test'` gate passed 210 tests with 1,131 assertions
-across 36 files in 67.67 seconds. Typechecking and formatting passed.
-`lean-ctx -c 'bun run test:package-install'` installed Sevro `0.1.0-dev.0`
-without source Git metadata and passed its public-command checks.
-
-These results verify the implementation and deterministic failure boundaries.
-A live continuation and Darrow's installed-package integration are recorded
-separately when observed. This remains an unpublished development version.

package/docs/concurrency-validation.md

@@ -1,86 +0,0 @@
-# Trial concurrency validation
-
-The public CLI preserves the positive `--jobs` contract required by Darrow's
-extraction. Its default is three; the option bounds trials within one case.
-Tests invoke the actual CLI and replace only the external candidate host with
-synthetic adapters. No live model call was made.
-
-## Observed test-first slice
-
-Working directory: `/Users/bjro/Sources/sevro`.
-
-Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI bounds parallel trials and retains ordered isolated evidence"'`:
-exit `64` because the public CLI did not accept `--jobs`.
-
-Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI bounds parallel trials and retains ordered isolated evidence"'`:
-one test passed with 23 assertions. Five trials reach a peak of two active host
-calls, retain separate workspaces and artifacts, and preserve trial-number order
-in results, run evidence, and checkpoints. Every workspace is removed after
-its trial artifact is retained.
-
-The first implementation run reached the concurrency assertions but exposed
-an incorrect temporary-path oracle: macOS canonicalized `/var` to `/private/var`.
-The fixture now uses its canonical root; the original missing-option red remains
-the test-first evidence.
-
-## Additional guards
-
-Four post-implementation guards cover cancellation of both active trials without
-starting queued work; persistence failure that retains a completed peer before
-diagnostic finalization and keeps the failed fixture; default three-job and
-explicit serial execution with different configuration identities; and invalid
-job limits before result or state storage is created. The complete file passed
-five tests with 70 assertions. These guards do not claim an observed red.
-
-Five prior internal tests require serial host-call order to bind expected trial
-values, or a completed first trial before a later failure or cancellation.
-They now request `jobs: 1` explicitly and retain their original assertions.
-The first three focused repairs passed three tests with 25 assertions.
-The combined command `lean-ctx -c 'bun test tests/engine.test.ts tests/claude-host.test.ts -t "runs trials, applies threshold|host artifacts are retained|host failure retains completed|cancellation retains prior|failed Claude execution"'`
-passed all five serial tests with 51 assertions.
-
-Final gates cover the full Sevro suite, types, formatting, installed-package
-verification, and Darrow public-interface parity against the same tarball.
-The bounded independent review retains its exact scope and checks outside the
-repository. Dry or synthetic execution does not prove live-model stability.
-
-## Review repairs
-
-The independent review identified future-peer sandbox access, late admission
-shutdown on errors, and cancellation before first admission. Each repair has
-an observed public-CLI red and green in `/Users/bjro/Sources/sevro`.
-
-Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI retains interruption before admitting its first trial"'`:
-SIGINT returned `70` instead of `130`.
-
-Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI retains interruption before admitting its first trial"'`:
-one test passed with 20 assertions, covering SIGINT and SIGTERM, no host calls,
-empty trial evidence, retained results, and interrupted ownership. The first
-fixture sent its signal before CLI handlers existed and was corrected before
-the recorded red; that process exit is not red evidence.
-
-Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI sandbox denies read and write access to later admitted peer fixtures"'`:
-the real macOS sandbox allowed access to the later peer, failing the isolation
-check with task exit `1`.
-
-Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI sandbox denies read and write access to later admitted peer fixtures"'`:
-one test passed with four assertions. Trial one can use its own fixture while
-its sandbox denies reading and writing trial three's marker; trial three keeps
-the original content. The initial inline fixture produced an unrelated Git
-metadata grading error. Using a declared generated Git fixture established the
-recorded isolation red. Candidate and semantic roots are reserved before
-execution. Peer roots are denied directly without querying Git metadata that
-may still be under preparation.
-
-Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI closes queued admission when grading fails before advisory retention"'`:
-four candidate calls started instead of two while the failing trial's advisory
-work remained held.
-
-Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI closes queued admission when grading fails before advisory retention"'`:
-one test passed with eight assertions. A required grader error closes admission
-immediately; both admitted trials and advisory results remain retained.
-
-A post-implementation guard also covers an execution failure with an already
-active peer, retained trial artifacts, and completed ownership. It makes no red
-claim. These repairs require fresh checks and verification of the original
-closed finding set before committing.

package/docs/configuration-root-validation.md

@@ -1,70 +0,0 @@
-# Configuration root validation
-
-The public CLI imports one explicit Codex setting from a separate configuration
-root, binds each used role's effective value into retained configuration and
-evaluation identity, and protects that repository's primary and linked worktrees.
-The runtime TOML dependency is pinned to `smol-toml` 1.8.0.
-
-Working directory: `/Users/bjro/Sources/sevro`.
-
-## Observed test-first slices
-
-1. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI imports only the Codex limit from its separate configuration root"'`:
-   exit `64`, `sevro.invocation.invalid`, because `--config-root` was unsupported.
-2. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI imports only the Codex limit from its separate configuration root"'`:
-   one test passed with eight assertions. The synthetic Codex process requires
-   the imported limit in its isolated configuration and rejects an unrelated
-   model marker. Changed limits are retained and change evaluation identity.
-3. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI isolates a separate configuration repository and its linked worktree"'`:
-   task exit `1`; the primary configuration secret was denied, but the linked
-   worktree secret remained readable by the isolated shell grader.
-4. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI isolates a separate configuration repository and its linked worktree"'`:
-   one test passed with three assertions; both protected-source reads fail.
-5. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI refuses a dangling Codex configuration link before execution"'`:
-   incorrectly returned `0` for a declared unreadable configuration link.
-6. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI refuses a dangling Codex configuration link before execution"'`:
-   one test passed with three assertions; exit `64`, execution `not_run`.
-
-Before implementation, the first test's identity assertion was corrected to
-read `evaluationIdentity.digest` from retained evidence rather than an absent
-CLI result field. The second test's check status oracle was also corrected
-from `pass` to the documented `passed` before implementation. Both literal red
-commands were rerun and still failed for the missing product behavior above.
-
-Additional guards were added after implementation without a test-first claim.
-They cover missing files and settings, all three Codex roles, malformed TOML,
-non-table agent settings, invalid numeric types and ranges, a non-file config,
-and relative, missing, or non-directory configuration roots. Together the five
-new tests contain 65 assertions. No live model call is involved; macOS isolation
-tests use the installed Codex sandbox and a synthetic candidate executable.
-
-## Test timeout repair
-
-The first full `bun test` gate completed 214 tests and timed out the existing
-eight-scenario Claude continuation guard after its default five seconds. Timeout
-cleanup removed its active fixture, producing a subsequent ownership diagnostic.
-The test now has an explicit ten-second bound, with every assertion unchanged.
-`lean-ctx -c 'bun test tests/cli.test.ts -t "Claude continuation never grades failed or unbound native results"'`
-then passed one test with 52 assertions in 3.96 seconds. This is test harness
-maintenance, without a product-behavior red/green claim.
-
-## Independent review repairs
-
-The bounded independent review found two medium blocking findings: a dangling
-intermediate `.codex` directory link was treated as absent configuration, and
-an explicitly empty `--config-root` silently selected the project root. The
-original candidate-bound report is retained at
-`/Users/bjro/.darrow/reviews-issue95-configuration-root/8794a1ce3463a83e1434abc110042a76e2397e27951a9a5cbf42214d9bbfc77b/darrow-review.k328difz/review.md`.
-
-1. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI distinguishes absent Codex configuration from a dangling directory link"'`:
-   returned `0` for the unreadable declared directory link; absent and ordinary
-   empty directories already retained the null host default.
-2. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI distinguishes absent Codex configuration from a dangling directory link"'`:
-   one test passed with seven assertions; the link fails with `64`, execution
-   `not_run`, and an absolute configuration-path diagnostic.
-3. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI rejects an explicitly empty configuration root"'`:
-   returned `0` when the supplied empty option should fail.
-4. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI rejects an explicitly empty configuration root"'`:
-   one test passed with four assertions for both separate and equals option
-   forms; each returns `64` and execution `not_run`. Omission still defaults
-   to the project root through the existing retained-role guards.

package/docs/engine-slice.md

@@ -1,114 +0,0 @@
-# First engine slice
-
-`runEvaluation` accepts a resolved inline, generated Git, or repository fixture case and an injected host
-adapter. It is an internal API while the host isolation adapters, extension
-lifecycle, and public CLI are being built. The synthetic adapter in the tests
-exercises the actual engine path without a model call.
-
-The engine validates check configuration and fixture paths before execution.
-Repository sources must be declared under an explicit source root, clean, and
-committed. Each trial clones the fixed commit without hardlinks or remotes.
-The source revision contributes to fixture identity; a changed or dirty source
-is refused before it can silently alter a trial. Submodules and preparation
-artifacts targeting `.git/` are refused.
-Generated Git fixtures validate a bounded commit list, optional working-tree
-files, and staged overlay paths before execution. Each trial builds the same
-history with a fixed local identity and date, then applies its own working-tree
-state. The declarative history enters fixture identity; no trial can inherit a
-previous trial's edits.
-The engine runs up to the configured positive `jobs` limit at once, defaulting
-to three. Each admitted trial owns its workspace and artifact names. Completed
-trial evidence is checkpointed before cleanup and retained in trial-number order,
-including when trials complete out of order. Errors stop later admission and
-active work drains before finalization. Use one job when serial ordering is needed;
-custom hosts must support independent concurrent calls when the limit is higher.
-Reserve all candidate and semantic workspace roots before launching a process;
-prepare fixture contents only after admission. Sandbox deny lists include future
-peers. Clear completed candidate contents after retention, keep their empty roots
-until active work drains, and then remove unused and completed reservations.
-Close admission when an execution or required grading error is detected, before
-advisory work, persistence, or cleanup. Already admitted peers still retain evidence.
-For each trial it creates a separate workspace, asks the adapter to run the
-prompt, grades its bounded final message, writes the raw-message reference and
-trial artifact, and only then removes the workspace. An adapter exception
-becomes an execution failure; a later failure leaves earlier trial artifacts
-intact. A failed trial checkpoint retains its fixture and cannot produce a
-successful result.
-Dry preparation still validates the case, runs extension preparation, creates
-the fixture, and retains a trial record. It skips the host and all grading,
-records `not_run` / `not_requested` / `not_assessed`, and has a separate
-evaluation identity from an executed run.
-
-The final `run.json` follows the v1 evidence schema and contains separate
-execution, grading, and task states. It records the exact runner build and
-project content digests derived by the CLI or explicitly supplied by the
-caller, plus a computed evaluation identity. Missing optional usage stays
-`null` and incomplete. Results storage
-is explicit and independent of the project root. A packaged runner records its
-package identity without Git; a private development checkout reads its own Git
-revision and hashes tracked and untracked changes for the local runner
-identity. A Git-backed project records its own revision and dirty content;
-a project without a commit retains unknown Git provenance alongside a bounded
-project content snapshot digest. An optional independent
-run-state root holds an active record and a checkpoint pointing to each
-retained trial. An evaluation-identity claim uses a short SQLite transaction
-to admit one verified process owner. A live owner blocks an equivalent run;
-an unverifiable owner is refused, while a confirmed dead owner is marked
-interrupted and its prior attempt files are kept before a new claim starts.
-The active record reaches `complete` only after final run evidence is written.
-Process identity includes the PID, host, and operating-system start time to
-protect against PID reuse. If start time cannot be verified, the run stops
-before host execution.
-The CLI passes SIGINT and SIGTERM through an abort signal. A cooperating host
-stops its work; the engine retains completed trial artifacts, records the
-cancelled trial, finalizes the active attempt as `interrupted`, and exits 130
-or 143 after writing run evidence. An adapter that ignores cancellation cannot
-be force-stopped by the injected-host interface.
-
-The host can return bounded, namespaced observations alongside its final
-message and bounded evidence artifacts. The engine retains them before
-extension grading. It passes observations and artifact file references to the
-extension without copying artifact bytes into run JSON. Missing or partial
-required host evidence makes grading unavailable; malformed host evidence
-fails execution. The engine also accepts shell checks when the caller supplies
-protected source roots. They run through the macOS outer sandbox after host
-execution, and their exit observations are retained with the trial. An
-unavailable boundary produces a grading error rather than a passing check.
-Semantic checks use a separately supplied host identity and an empty grader
-workspace. A complete candidate final message is sent to that route with the
-declared propositions. The engine requires one bounded verdict per check,
-retains the raw response and grader artifacts outside the fixture, and records
-the route and per-check observations. Missing candidate output makes semantic
-checks unavailable; failed or malformed grader output makes grading an error.
-Git HEAD checks capture the base commit before the candidate turn and grade
-unchanged HEAD, changed HEAD, or base ancestry afterward. Candidate edits to
-fixture files cannot rewrite the expected base revision.
-An optional negotiated extension can add declared checks. The engine calls its
-`prepare` method before host execution and its `evaluate` method for each
-trial. It retains extension identity, configuration digest, protocol,
-capabilities, grader selection, check evidence references, and metrics.
-Missing declared extension checks remain unavailable; extension errors cannot
-become a passing assessment. Inline preparation artifacts are decoded, checked
-against their SHA-256 digests, mounted into each fixture, and retained outside
-it for later inspection. Source-reference artifacts resolve only through a
-caller-declared ID-to-file-URL map under an explicit case source root. Their
-bytes receive the same size, path, and digest checks before mounting and
-retention.
-An explicitly selected extension task-verdict policy receives its policy ID
-during `evaluate` and must return a recommendation. The engine uses that
-recommendation only when execution and grading completed with all required
-evidence available. It retains the selected policy and trial recommendation;
-missing recommendations are grading errors. An explicitly replaced built-in
-grader still has its declaration validated, but its checks do not run or count
-toward the task verdict. At least one declared extension check must take its
-place. The selection enters comparison identity and retained evidence.
-An extension may request a negotiated host instrumentation capability during
-`prepare`. The engine checks the host-declared capability and whether it
-changes execution before starting a trial. Execution-changing requests are
-refused in a passive condition. The host receives the request and must report
-exactly what it applied; a mismatch or an unconfirmed enforced condition fails
-execution. Run and trial evidence retain requested and applied instrumentation
-separately. The bundled Codex adapter advertises no instrumentation capabilities.
-
-Additional host adapters and host-specific instrumentation implementations
-remain in progress.

package/docs/evidence/runtime-startup-30/README.md

@@ -1,185 +0,0 @@
-# Runtime startup measurements for issue 30
-
-The matched synthetic native-host benchmark reduced candidate setup plus the
-controlled participant from 14.37–14.92 seconds to 6.20–6.66 seconds. The response-only
-grading host call, including its separate native startup, fell from 13.49–15.03
-seconds to 5.45–5.65 seconds. These are runner-boundary measurements with synthetic
-model responses, not measurements of API latency or live model quality.
-
-## Reproduction and conditions
-
-Run the same maintained [benchmark harness](../../../scripts/benchmark-runtime-startup.ts)
-against an unchanged checkout of `c205482b25d4d52a395c70434f2b392f6acfb279` and this
-candidate, sequentially on one machine:
-
-```sh
-bun scripts/benchmark-runtime-startup.ts /absolute/baseline /tmp/before.json
-bun scripts/benchmark-runtime-startup.ts /absolute/candidate /tmp/after.json
-```
-
-The retained [before](before.json) and [after](after.json) observations used
-macOS arm64, Bun 1.3.13, Codex CLI 0.162.1, the same synthetic plugin/response case,
-`synthetic-candidate` and `synthetic-semantic` model labels, and `low` effort.
-There were three candidate/semantic repetitions in each process, with a 32 MiB,
-2,049-entry public dependency tree. Every role received a fresh private home and
-native plugin installation. The first candidate used a cold verified-snapshot
-cache; repetitions two and three reused the policy. OS filesystem caches were
-uncontrolled and are not described as cold. Baseline ran before candidate;
-order effects and three repetitions limit generalization.
-
-The harness wraps the same production functions and process boundaries without
-changing their arguments or timeout. Only external model output is replaced by a
-fixed event stream. The native plugin installer and `codex sandbox` remain real.
-This fixture does not claim live skill invocation; separate native integration
-coverage and consumer smoke own that evidence. Timings overlap: runtime and
-sandbox phases are inside candidate/grading-host totals, and plugin commands are
-inside plugin installation. Do not sum both levels. The `grading` measurement surrounds the semantic host
-call with its response-only policy; it excludes engine fixture preparation,
-verdict parsing, and extension bookkeeping.
-
-## Observed timings
-
-All values below are milliseconds, in repetition order.
-
-| Boundary                                     | Before                   | After                 |
-| -------------------------------------------- | ------------------------ | --------------------- |
-| Configuration fingerprint (once)             | 262                      | 299                   |
-| Candidate runtime preparation                | 1,969 / 1,357 / 1,273    | 721 / 431 / 443       |
-| Candidate hook dependency preparation        | 1,226 / 1,465 / 1,235    | No invocation         |
-| Fresh native plugin installation             | 385 / 141 / 143          | 188 / 141 / 143       |
-| Candidate sandbox probes, summed per role    | 10,938 / 11,032 / 11,622 | 5,490 / 5,404 / 5,448 |
-| Controlled participant process               | 27 / 29 / 39             | 27 / 27 / 24          |
-| Candidate total                              | 14,925 / 14,369 / 14,666 | 6,659 / 6,199 / 6,257 |
-| Semantic runtime preparation                 | 1,174 / 1,236 / 2,262    | Under 1 each          |
-| Semantic hook dependency preparation         | 1,105 / 1,087 / 1,363    | No invocation         |
-| Semantic sandbox probes, summed per role     | 10,855 / 10,803 / 11,032 | 5,548 / 5,360 / 5,365 |
-| Controlled semantic response process         | 28 / 44 / 27             | 29 / 28 / 28          |
-| Grading host total, including native startup | 13,495 / 13,534 / 15,030 | 5,647 / 5,454 / 5,460 |
-
-The probe count fell from two to one per fresh role. Candidate dependency
-materialization reuses immutable verified bytes after its first capture, and
-response-only grading no longer materializes implicit candidate dependencies.
-Configuration hashing remains necessary for identity. Fresh-install warm timings
-were essentially unchanged; no plugin-install speedup is claimed. Participant
-and semantic outputs are synthetic controls, so no API/model saving is claimed.
-
-## Startup deadline diagnosis
-
-A separate authenticated Darrow baseline using Codex 0.162.1 and `gpt-6-luna`
-with medium effort failed before participant execution: the first sandbox probe
-hit its 10-second deadline at 10,004.8 ms. A seedless control retained the same
-tool declarations and also timed out at 10,004.2 ms. With only the diagnostic
-probe deadline increased to 60 seconds, both original full-policy probes passed
-at 10,649.1 and 10,690.4 ms. Participant execution was deliberately withheld in
-that diagnostic. A minimal-policy control without tool grants or seeds passed
-at 5,372.8 and 5,681.1 ms.
-
-Raw diagnostic records are retained for the [original timeout](baseline-timeout.jsonl),
-[seedless timeout](seedless-timeout.jsonl), [full policy with diagnostic deadline](full-policy-diagnostic.jsonl),
-and [minimal policy](minimal-policy-diagnostic.jsonl). The maintained
-[diagnostic preload](../../../scripts/diagnose-codex-startup.ts) records bounded
-phase timing/errors and withholds app-server participant execution. To reproduce
-against an explicit checkout, set `SEVRO_DIAGNOSTIC_SOURCE_ROOT` and
-`SEVRO_DIAGNOSTIC_PHASE_FILE`, then use a CLI wrapper running:
-
-```sh
-bun --preload /absolute/candidate/scripts/diagnose-codex-startup.ts /absolute/baseline/src/cli.ts "$@" --runner-checkout-root /absolute/baseline
-```
-
-Point Darrow's `SEVRO_PACKAGE_BIN` at that wrapper and run:
-
-```sh
-bun evals/runner/run.ts --harness codex --owner-evaluation passive --skill create-commit --case create-commit-conventional-format --model gpt-6-luna --effort medium --trials 1 --jobs 1 --threshold 1 --results-root /absolute/outside-project-results --output /absolute/selection.json
-```
-
-For the deadline control, additionally set `SEVRO_DIAGNOSTIC_TIMEOUT_MS=60000`.
-For runtime controls, append `-- --runtime-config-file /absolute/runtime.json`:
-seedless keeps the original policy except `runtime.seedDirectories=[]`; minimal
-keeps only `format`, `nativeTranscripts: true`, and `hooks.nativeGoal: true`.
-The original diagnostic used the same wrappers with fixed paths; the retained
-preload makes those paths explicit through environment variables.
-
-These one-off controls locate the failure in native sandbox startup and show
-that dependency copying is not necessary for the timeout. Declared tool grants
-increase observed startup on this machine. They do not establish the exact
-native CLI mechanism or a general policy-size scaling law. The product now uses
-a bounded 60-second preflight; the measured saving comes from eliminating the
-second invocation and repeated preparation, not from increasing that deadline.
-The unavailable baseline participant, activation, and grading evidence remain
-unavailable rather than being assigned successful outcomes.
-
-## Snapshot and copy-on-write assessment
-
-The production snapshot owns verified bytes only in runner memory, keyed by the
-policy's seed descriptor. Candidate, peer, checker, and hook writable files never
-alias it. First capture must match the configured digest; later source changes
-do not change that snapshot. Regression coverage changes candidate files and the
-operator source between trials and verifies that the next trial still receives
-the original bytes. Executable modes, internal-link dereferencing, empty
-directories, source protection, offline environment, and role separation remain
-checked.
-
-The benchmark also exercised `COPYFILE_FICLONE_FORCE` on a 32 MiB file. It
-succeeded in about one millisecond in both runs, and changing the destination
-left the source length unchanged. This establishes local copy-on-write support,
-not portable availability or an immutable directory snapshot. The current
-in-memory snapshot deliberately avoids a persistent cache path and its cleanup,
-source-mutation, and cross-process trust requirements. Native clone reuse is not
-implemented; ordinary materialization works on filesystems without cloning.
-Retained policies retain their verified bytes until garbage collection, up to
-the existing per-seed bounds. This memory tradeoff should be measured separately
-for substantially larger dependency sets.
-
-## Native installation reuse assessment
-
-Every actual native installation in both benchmark runs produced configuration
-containing its private home and fixture workspace paths, as retained in the
-`installation-assets` observations. Native install receipts bind an
-`installedPath` inside that particular home's plugin cache; production verifies
-it before accepting explicit invocation. Authorized hook wrappers also bind the
-private runtime, sandbox profile, and execution receipt directory.
-
-A separate [native cache-only reuse experiment](plugin-template-assessment.json)
-installed a local synthetic plugin into a fresh credential-free home. The native
-registration wrote `source_type = "local"` and the original absolute marketplace
-path; the receipt contained the original private `installedPath`. After copying
-only `plugins/cache` into a second fresh home, `codex plugin list --json` returned
-empty `installed` and `available` arrays. To reproduce, use fresh `HOME` and
-`CODEX_HOME`, run `codex plugin marketplace add /absolute/market --json` and
-`codex plugin add probe@sevro-assessment --json`, copy `plugins/cache` to another
-fresh home, and list there. Paths in the raw record use `<assessment>` for the
-throwaway root; no credential file was present.
-
-An entire installed-home template therefore cannot be replayed into a new trial
-without rewriting and reverifying those identities, isolating credentials and
-configuration, and obtaining evidence for the new installed paths. Reusing
-just package files would still require native registration and receipt checks.
-For the measured fixture, warm fresh installation costs about 140 ms versus
-roughly 5.4 seconds for one sandbox startup. No template reuse is implemented.
-Fresh authentication/configuration, native registration and plugin installation,
-receipt validation, hook projection, the combined preflight, and native
-invocation evidence remain per-request work. Fresh-install integration coverage
-is retained.
-
-## Authenticated consumer smoke
-
-The [bounded consumer summary](consumer-smoke.json) records Darrow revision
-`34606ad9e1952b7f4e9c56befa446c18e1a2eb5d`, with no tracked consumer edits. The
-candidate's explicit `tdd-explicit-invocation` case passed execution, shell and
-semantic grading, and complete native explicit-invocation activation. Candidate
-and semantic routes used Codex 0.162.1, `gpt-6-luna`, medium effort, one trial,
-one job, and threshold one:
-
-```sh
-SEVRO_CHECKOUT=/absolute/candidate bun evals/runner/run.ts --harness codex --owner-evaluation passive --skill tdd --case tdd-explicit-invocation --model gpt-6-luna --effort medium --semantic-check-model gpt-6-luna --semantic-check-effort medium --trials 1 --jobs 1 --threshold 1 --results-root /absolute/outside-project-results --output /absolute/selection.json
-```
-
-The earlier implicit `create-commit-conventional-format` smoke completed
-execution and grading on the candidate, including its three shell checks, but
-failed the expected HEAD-change assertion. Its fixture mounted the backend under
-`.agents` without plugin manifests required by the launcher; the participant
-refused the commit. Activation stayed unavailable. The unchanged baseline had
-failed that case before participant execution at sandbox preflight. These
-outcomes are retained honestly; neither the fixture failure nor the later
-single-trial success establishes a matched live latency comparison or repeated
-model reliability. Private native transcripts and credentials remain outside Git.