@staix/agent-hub 0.22.0 → 0.23.0

package/docs/verification/2026-10-30-adapter-operational-settings.md

@@ -0,0 +1,261 @@
+# H5 adapters and handshakes: H0 ledger
+
+Reconciliation for #489 group 4. H0 coordinates are frozen inventory locations, not current source line claims. Source audit used main `b974320742752e1d39827cc5c2e39510367444ab`; implementation is based on merged H4 `0c15f546353343c6193bfd33465e55e8ef37daa8`.
+
+The complete area has **232 unique identities**: 96 operational, 96 safety floors, 30 contracts and 10 test seams. The detailed inventory has 259 occurrences; duplicate display rows are counted once. The `src/adapters/` subset contains 154 identities, and all 78 support/benchmark identities are included below.
+
+**3 identities are converted; 229 are excluded**, each with its reason. All use the H1 fixed descriptor/schema/settings/default mechanism in the existing config store. The namespace `adapter_timing` avoids the executable declaration map `adapters`.
+
+| Setting | Bounds | Default | Apply boundary |
+| --- | --- | --- | --- |
+| `adapter_timing.acp_tool_ceiling_min` | 1-30 min | 30 min | next peer launch; effective `max(watchdogMs, ceiling)` and remaining-only rearm |
+| `adapter_timing.acp_activity_batch_ms` | 10-50 ms | 50 ms | next peer launch; no retiming of pending activity batches; existing privacy/text caps |
+| `adapter_timing.jcode_steer_timeout_s` | 5-60 s | 5 s | next Jcode launch; one captured deadline for all native steer phases |
+
+ACP startup/mode/cancel and Jcode readiness remain fixed at 30 seconds. The 65/70-second caller budgets leave no useful raise-only startup range without changing those callers. The MCP reconnect cap remains fixed at 30 seconds; the plugin has no accepted config access and this conversion adds no cross-process projection seam. The unmanaged recovery window retains its existing relationship to that cap.
+
+## Full identity ledger
+
+Each row is one unique JSON identity. H0 classification is retained as evidence; disposition reevaluates its actual runtime role.
+
+| Stable identity | Frozen H0 location(s) | H0 class | Disposition | Reason |
+| --- | --- | --- | --- | --- |
+| `scripts/benchmarks/native-pi-qwen.ts:<anonymous>:inline:String(e).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only <anonymous>/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:<anonymous>:inline:String(s.reason).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1129:89 | safety floor | Excluded: benchmark safety | Benchmark-only <anonymous>/String(s.reason).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:ACTIVE_TRACE_CAP:constant:ACTIVE_TRACE_CAP=4096#0` | scripts/benchmarks/native-pi-qwen.ts:802:7 | operational | Excluded: benchmark follow-up | Trace retention for benchmark evidence only, not daemon delivery retention. |
+| `scripts/benchmarks/native-pi-qwen.ts:activeExit:inline:state.quietMs >= 1000=1000#0` | scripts/benchmarks/native-pi-qwen.ts:727:43 | operational | Excluded: benchmark follow-up | Benchmark quiet-window completion observation, not native session completion authority. |
+| `scripts/benchmarks/native-pi-qwen.ts:allow:inline:a.text.length <= 4000=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1515:137 | safety floor | Excluded: benchmark safety | Benchmark-only allow/a.text.length <= 4000 bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=100#0` | scripts/benchmarks/native-pi-qwen.ts:1603:37, scripts/benchmarks/native-pi-qwen.ts:1665:33 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=100#1` | scripts/benchmarks/native-pi-qwen.ts:1603:37, scripts/benchmarks/native-pi-qwen.ts:1665:33 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=25#0` | scripts/benchmarks/native-pi-qwen.ts:1557:47 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#1` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#2` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:qv.slice=80#0` | scripts/benchmarks/native-pi-qwen.ts:1242:127, scripts/benchmarks/native-pi-qwen.ts:1417:131 | safety floor | Excluded: benchmark safety | Benchmark-only arm/qv.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:batchMs:inline:batchMs=0#0` | scripts/benchmarks/native-pi-qwen.ts:1387:44 | operational | Excluded: benchmark follow-up | Benchmark-local delivery batching input, not the production Bus descriptor. |
+| `scripts/benchmarks/native-pi-qwen.ts:cmd:inline:stderr.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1101:78, scripts/benchmarks/native-pi-qwen.ts:1142:75 | safety floor | Excluded: benchmark safety | Benchmark-only cmd/stderr.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:cmd:inline:timeoutMs=180_000#0` | scripts/benchmarks/native-pi-qwen.ts:1138:62 | test seam | Excluded: benchmark seam | Benchmark-only cmd/timeoutMs bounds fixture deadline injection; no production setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:contextWindow:inline:contextWindow=262144#0` | scripts/benchmarks/native-pi-qwen.ts:1438:121 | operational | Excluded: benchmark follow-up | Benchmark synthetic model declaration; not observed native context admission. |
+| `scripts/benchmarks/native-pi-qwen.ts:effectiveBuild:inline:stderr.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1101:78, scripts/benchmarks/native-pi-qwen.ts:1142:75 | safety floor | Excluded: benchmark safety | Benchmark-only effectiveBuild/stderr.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:String(e).slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1779:678, scripts/benchmarks/native-pi-qwen.ts:1784:110 | safety floor | Excluded: benchmark safety | Benchmark-only error/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:String(e).slice=300#1` | scripts/benchmarks/native-pi-qwen.ts:1779:678, scripts/benchmarks/native-pi-qwen.ts:1784:110 | safety floor | Excluded: benchmark safety | Benchmark-only error/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:error.replace(/(token\|secret\|api[_-]?key)(\s*[:=]\s*)[^\s,;]+/gi, $1$2[redacted]).slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1746:125 | safety floor | Excluded: benchmark safety | Benchmark-only error/error.replace(/(token|secret|api[_-]?key)(\s*[:=]\s*)[^\s,;]+/gi, $1$2[redacted]).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:executeTool:inline:String(a.text).slice=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1395:77, scripts/benchmarks/native-pi-qwen.ts:1472:87 | safety floor | Excluded: benchmark safety | Benchmark-only executeTool/String(a.text).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:failureClass:inline:reason.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:697:64 | safety floor | Excluded: benchmark safety | Benchmark-only failureClass/reason.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:fetch:inline:String(a.text).slice=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1395:77, scripts/benchmarks/native-pi-qwen.ts:1472:87 | safety floor | Excluded: benchmark safety | Benchmark-only fetch/String(a.text).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:main:inline:qv.slice=80#0` | scripts/benchmarks/native-pi-qwen.ts:1242:127, scripts/benchmarks/native-pi-qwen.ts:1417:131 | safety floor | Excluded: benchmark safety | Benchmark-only main/qv.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:maxTokens:inline:maxTokens=4096#0` | scripts/benchmarks/native-pi-qwen.ts:1438:140 | operational | Excluded: benchmark follow-up | Benchmark inference request budget, not adapter handshake latency. |
+| `scripts/benchmarks/native-pi-qwen.ts:max_tokens:inline:max_tokens=20#0` | scripts/benchmarks/native-pi-qwen.ts:1367:149 | operational | Excluded: benchmark follow-up | Benchmark tiny probe output budget, not production model policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:minimum:inline:minimum=1#0` | scripts/benchmarks/native-pi-qwen.ts:152:198, scripts/benchmarks/native-pi-qwen.ts:152:238 | contract | Excluded: benchmark contract | Benchmark-only minimum/minimum bounds required invocation count; not a runtime setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:minimum:inline:minimum=1#1` | scripts/benchmarks/native-pi-qwen.ts:152:198, scripts/benchmarks/native-pi-qwen.ts:152:238 | contract | Excluded: benchmark contract | Benchmark-only minimum/minimum bounds required invocation count; not a runtime setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:observe:inline:this.calls.size > 128=128#0` | scripts/benchmarks/native-pi-qwen.ts:446:38 | operational | Excluded: benchmark follow-up | Benchmark outstanding-call evidence retention; changing it would alter measurement. |
+| `scripts/benchmarks/native-pi-qwen.ts:onUsageDiagnostic:inline:qwenUsageDiagnostics.length < 32=32#0` | scripts/benchmarks/native-pi-qwen.ts:1509:89 | operational | Excluded: benchmark follow-up | Benchmark usage diagnostic sample retention, not native quota policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:signal:inline:AbortSignal.timeout=30_000#0` | scripts/benchmarks/native-pi-qwen.ts:1367:185 | operational | Excluded: benchmark follow-up | Benchmark fetch deadline, not production native startup. |
+| `scripts/benchmarks/native-pi-qwen.ts:text:inline:clean(s).slice=500#0` | scripts/benchmarks/native-pi-qwen.ts:1510:75 | safety floor | Excluded: benchmark safety | Benchmark-only text/clean(s).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:timer:inline:opts.timeoutMs ?? 60_000=60_000#0` | scripts/benchmarks/native-pi-qwen.ts:1099:115 | test seam | Excluded: benchmark seam | Benchmark-only timer/opts.timeoutMs ?? 60_000 bounds fixture deadline injection; no production setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:title:inline:clean(String(u.title ?? )).slice=350#0` | scripts/benchmarks/native-pi-qwen.ts:1585:115 | safety floor | Excluded: benchmark safety | Benchmark-only title/clean(String(u.title ?? )).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:title:inline:clean(req.title).slice=900#0` | scripts/benchmarks/native-pi-qwen.ts:1523:99 | safety floor | Excluded: benchmark safety | Benchmark-only title/clean(req.title).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:verifySurfaceSource:inline:entries.length > 32=32#0` | scripts/benchmarks/native-pi-qwen.ts:199:45 | safety floor | Excluded: benchmark safety | Benchmark-only verifySurfaceSource/entries.length > 32 bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:watchdogMs:inline:watchdogMs=300_000#0` | scripts/benchmarks/native-pi-qwen.ts:1442:48, scripts/benchmarks/native-pi-qwen.ts:1502:33 | operational | Excluded: benchmark follow-up | Benchmark-owned peer inactivity input; keep benchmark calibration separate. |
+| `scripts/benchmarks/native-pi-qwen.ts:watchdogMs:inline:watchdogMs=300_000#1` | scripts/benchmarks/native-pi-qwen.ts:1442:48, scripts/benchmarks/native-pi-qwen.ts:1502:33 | operational | Excluded: benchmark follow-up | Benchmark-owned peer inactivity input; keep benchmark calibration separate. |
+| `src/adapters/acp-owned-group.ts:READ_MS:constant:READ_MS=1000#0` | src/adapters/acp-owned-group.ts:18:7 | operational | Excluded: process proof/cleanup | READ_MS/READ_MS bounds process-table proof or validates injected kill grace; preserve same-owner verification and fail-closed cleanup. |
+| `src/adapters/acp-owned-group.ts:stop:inline:killMs > 10_000=10_000#0` | src/adapters/acp-owned-group.ts:62:61 | operational | Excluded: process proof/cleanup | stop/killMs > 10_000 bounds process-table proof or validates injected kill grace; preserve same-owner verification and fail-closed cleanup. |
+| `src/adapters/acp-quota.ts:windowMins:inline:windowMins=300#0` | src/adapters/acp-quota.ts:12:43 | operational | Excluded: provider quota contract | 300minutes is the verified Kimi5h refusal window, not an adapter scheduling preference. |
+| `src/adapters/acp.ts:<anonymous>:inline:activityText(title).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, ).slice=80#0` | src/adapters/acp.ts:516:200 | safety floor | Excluded: ACP input/preview safety | <anonymous>/activityText(title).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, ).slice bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:HANDSHAKE_MS:constant:HANDSHAKE_MS=30000#0` | src/adapters/acp.ts:135:7 | operational | Excluded: fixed startup/fallback contract | Ruling3384d552 leaves HANDSHAKE_MS at30s: configured ACP start caller70s, plus coupled mode ACK/cancel proof fallbacks. No startup knob or split in H5. |
+| `src/adapters/acp.ts:TOOL_CEILING_MS:constant:TOOL_CEILING_MS=30 * 60000#0` | src/adapters/acp.ts:138:7 | operational | Converted: acp_tool_ceiling_min | Existing toolCeilingMs host option; total wait ceiling remains max(watchdogMs, configured ceiling) and rearming uses only remaining allowance. |
+| `src/adapters/acp.ts:TOOL_INPUT_CAP:constant:TOOL_INPUT_CAP=64#0` | src/adapters/acp.ts:137:7 | safety floor | Excluded: ACP input/preview safety | TOOL_INPUT_CAP/TOOL_INPUT_CAP bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:alive:inline:Math.max=10#0` | src/adapters/acp.ts:721:107 | operational | Excluded: derived liveness | Math.max is a clamp on watchdog/3 heartbeat while approval waits; preserve the watchdog relationship, not independent settings. |
+| `src/adapters/acp.ts:alive:inline:Math.min=30_000#0` | src/adapters/acp.ts:721:120 | operational | Excluded: derived liveness | Math.min is a clamp on watchdog/3 heartbeat while approval waits; preserve the watchdog relationship, not independent settings. |
+| `src/adapters/acp.ts:cut:inline:full.length > 600=600#0` | src/adapters/acp.ts:705:31 | safety floor | Excluded: ACP input/preview safety | cut/full.length > 600 bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:input:inline:full.slice=600#0` | src/adapters/acp.ts:706:72 | safety floor | Excluded: ACP input/preview safety | input/full.slice bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:updateWatch:inline:setTimeout=50#0` | src/adapters/acp.ts:223:69 | operational | Converted: acp_activity_batch_ms | Coalesces pending activity emission only; configure next peer construction with10..50ms conservative bounds, never recreate a timer already pending. |
+| `src/adapters/acp.ts:updateWatch:inline:this.activityPending.text.length + item.text.length > 4096=4096#0` | src/adapters/acp.ts:220:110 | operational | Excluded: activity buffer safety | 4096-character pending text boundary forces an immediate flush and bounds memory; it is not a batching timeout. |
+| `src/adapters/adapter-api.ts:ADAPTER_API:constant:ADAPTER_API=1#0` | src/adapters/adapter-api.ts:2:14 | contract | Excluded: wire/schema contract | ADAPTER_API/ADAPTER_API defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/agy/entry.ts:timeout:inline:timeout=5000#0` | src/adapters/agy/entry.ts:59:80 | operational | Excluded: version proof bound | 5s bounds native binary/version probe before launch; preserve bounded output and identity checks. |
+| `src/adapters/agy/hooks.ts:<anonymous>:inline:path.length <= 4096=4096#0` | src/adapters/agy/hooks.ts:16:87 | safety floor | Excluded: hook input safety | <anonymous>/path.length <= 4096 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:cap:inline:cap=4 * 1024 * 1024#0` | src/adapters/agy/hooks.ts:58:17 | safety floor | Excluded: hook input safety | cap/cap bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:call.name.length > 128=128#0` | src/adapters/agy/hooks.ts:19:124 | safety floor | Excluded: hook input safety | decodeAgyHook/call.name.length > 128 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:value.transcriptPath.length > 4096=4096#0` | src/adapters/agy/hooks.ts:14:119 | safety floor | Excluded: hook input safety | decodeAgyHook/value.transcriptPath.length > 4096 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:value.workspacePaths.length > 32=32#0` | src/adapters/agy/hooks.ts:15:110 | safety floor | Excluded: hook input safety | decodeAgyHook/value.workspacePaths.length > 32 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:readAgyTranscript:inline:Math.min=window * 2#0` | src/adapters/agy/hooks.ts:59:59 | operational | Excluded: transcript scan arithmetic | 64KiB initial scan and doubling recurrence are capped by4MiB; completion evidence must not depend on a new uncoordinated scan knob. |
+| `src/adapters/agy/hooks.ts:window:inline:window=64 * 1024#0` | src/adapters/agy/hooks.ts:59:23 | operational | Excluded: transcript scan arithmetic | 64KiB initial scan and doubling recurrence are capped by4MiB; completion evidence must not depend on a new uncoordinated scan knob. |
+| `src/adapters/channel-peer.ts:waitForAttach:inline:this.attachmentWaiters.length >= 64=64#0` | src/adapters/channel-peer.ts:39:99 | safety floor | Excluded: attachment safety | Attachment waiter count bounds parked native attachment work; no unbounded attach queue. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:2 ** Math.max(attempt, 0)=2#0` | src/adapters/claude-channel.ts:256:62, src/adapters/claude-channel.ts:317:60 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:2 ** Math.max(attempt, 0)=2#1` | src/adapters/claude-channel.ts:256:62, src/adapters/claude-channel.ts:317:60 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:Math.min=1000#0` | src/adapters/claude-channel.ts:256:55, src/adapters/claude-channel.ts:317:53 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:Math.min=1000#1` | src/adapters/claude-channel.ts:256:55, src/adapters/claude-channel.ts:317:53 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:setTimeout=1000#0` | src/adapters/claude-channel.ts:333:86 | operational | Excluded: bounded metadata retry | <anonymous>/setTimeout is the two-attempt1s ListTools/lifecycle reannouncement retry, not reconnect authority or peer adoption. |
+| `src/adapters/claude-channel.ts:HELD_CLOSE:constant:HELD_CLOSE=4000#0` | src/adapters/claude-channel.ts:103:7 | contract | Excluded: wire/schema contract | HELD_CLOSE/HELD_CLOSE defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:INBOX_CAP:constant:INBOX_CAP=200#0` | src/adapters/claude-channel.ts:105:7 | safety floor | Excluded: offline inbox safety | Plugin inbox count bounds retained disconnected envelopes; no new storage/retention authority. |
+| `src/adapters/claude-channel.ts:MAX_RECONNECT_DELAY_MS:constant:MAX_RECONNECT_DELAY_MS=30000#0` | src/adapters/claude-channel.ts:91:7 | operational | Excluded: reconnect ruling | Ruling3384d552 refuses reconnect conversion under any name. Preserve fixed30s cap, both loops and upgrade coupling; add no status projection, policy reader or other seam. |
+| `src/adapters/claude-channel.ts:callTool:inline:args.tool_use_id.length > 256=256#0` | src/adapters/claude-channel.ts:401:104 | contract | Excluded: wire/schema contract | callTool/args.tool_use_id.length > 256 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:callTool:inline:res.pollingAdvice.count >= 3=3#0` | src/adapters/claude-channel.ts:424:92 | contract | Excluded: wire/schema contract | callTool/res.pollingAdvice.count >= 3 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:callTool:inline:res.pollingAdvice.minutes <= 10=10#0` | src/adapters/claude-channel.ts:424:212 | contract | Excluded: wire/schema contract | callTool/res.pollingAdvice.minutes <= 10 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:reannounce:inline:tries < 2=2#0` | src/adapters/claude-channel.ts:333:44 | operational | Excluded: bounded metadata retry | reannounce/tries < 2 is the two-attempt1s ListTools/lifecycle reannouncement retry, not reconnect authority or peer adoption. |
+| `src/adapters/claude-implementer.ts:maxFrameBytes:inline:maxFrameBytes=4096#0` | src/adapters/claude-implementer.ts:57:107 | safety floor | Excluded: bounded native output | maxFrameBytes/maxFrameBytes caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-implementer.ts:maxOutputBytes:inline:maxOutputBytes=4096#0` | src/adapters/claude-implementer.ts:57:129 | safety floor | Excluded: bounded native output | maxOutputBytes/maxOutputBytes caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-implementer.ts:timer:inline:setTimeout=3000#0` | src/adapters/claude-implementer.ts:59:91 | operational | Excluded: native reviewer proof | Bounded version/print proof uses isolated child/environment and awaits cleanup; not ordinary conversation timeout. |
+| `src/adapters/claude-print-child.ts:frameLimit:inline:options.maxFrameBytes ?? 256 * 1024=256 * 1024#0` | src/adapters/claude-print-child.ts:45:49 | safety floor | Excluded: bounded native output | frameLimit/options.maxFrameBytes ?? 256 * 1024 caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print-child.ts:outputLimit:inline:options.maxOutputBytes ?? 4 * 1024 * 1024=4 * 1024 * 1024#0` | src/adapters/claude-print-child.ts:45:101 | safety floor | Excluded: bounded native output | outputLimit/options.maxOutputBytes ?? 4 * 1024 * 1024 caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print.ts:DIFF_CAP:constant:DIFF_CAP=100000#0` | src/adapters/claude-print.ts:49:7 | safety floor | Excluded: bounded native output | DIFF_CAP/DIFF_CAP caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print.ts:timeout:inline:timeout=15_000#0` | src/adapters/claude-print.ts:57:224 | operational | Excluded: metadata proof group | 15s Git diff read supports bounded review/private screening; do not create adapter-level Git budget alongside metadata policy. |
+| `src/adapters/codex-appserver.ts:<anonymous>:inline:this.opts.steerTimeoutMs ?? 10_000=10_000#0` | src/adapters/codex-appserver.ts:316:42, src/adapters/codex-appserver.ts:355:116 | operational | Excluded: existing host seam | Existing steerTimeoutMs already controls ACK wait; no second generic deadline in this H5 slice. |
+| `src/adapters/codex-appserver.ts:adopt:inline:this.opts.usagePollMs ?? 600_000=600_000#0` | src/adapters/codex-appserver.ts:678:84 | operational | Excluded: already configured | Daemon supplies usagePollMs from budget.poll_min; preserve that single accepted configuration authority. |
+| `src/adapters/codex-appserver.ts:alive:inline:Math.max=10#0` | src/adapters/codex-appserver.ts:635:77 | operational | Excluded: derived liveness | Clamp on watchdog/3 approval heartbeat, not independent inactivity policy. |
+| `src/adapters/codex-appserver.ts:alive:inline:Math.min=30_000#0` | src/adapters/codex-appserver.ts:635:90 | operational | Excluded: derived liveness | Clamp on watchdog/3 approval heartbeat, not independent inactivity policy. |
+| `src/adapters/codex-appserver.ts:data:inline:launchId.length <= 128=128#0` | src/adapters/codex-appserver.ts:174:78 | safety floor | Excluded: Codex identity safety | data/launchId.length <= 128 bounds launch identity or approval tombstones; do not weaken replay/approval fences. |
+| `src/adapters/codex-appserver.ts:interceptActionApproval:inline:link.approvalIds.size >= 1024=1024#0` | src/adapters/codex-appserver.ts:621:34 | safety floor | Excluded: Codex identity safety | interceptActionApproval/link.approvalIds.size >= 1024 bounds launch identity or approval tombstones; do not weaken replay/approval fences. |
+| `src/adapters/codex-appserver.ts:readUsage:inline:setTimeout=30_000#0` | src/adapters/codex-appserver.ts:691:115, src/adapters/codex-appserver.ts:705:47 | operational | Excluded: pending-request cleanup | 30s expires a usage request bookkeeping entry; does not admit quota/context by guess. |
+| `src/adapters/codex-appserver.ts:spawnAppServer:inline:Bun.sleep=100#0` | src/adapters/codex-appserver.ts:448:23 | operational | Excluded: readiness arithmetic | 100ms poll combines with100-iteration health loop and stated10s readiness; do not tune cadence separately from deadline. |
+| `src/adapters/codex-appserver.ts:timer:inline:setTimeout=30_000#0` | src/adapters/codex-appserver.ts:691:115, src/adapters/codex-appserver.ts:705:47 | operational | Excluded: mutation ACK bound | 30s thread/revert acknowledgement bound preserves unknown/refusal and identity fence on missing reply. |
+| `src/adapters/codex-appserver.ts:timer:inline:this.opts.steerTimeoutMs ?? 10_000=10_000#0` | src/adapters/codex-appserver.ts:316:42, src/adapters/codex-appserver.ts:355:116 | operational | Excluded: existing host seam | Existing steerTimeoutMs already controls ACK wait; no second generic deadline in this H5 slice. |
+| `src/adapters/codex-review-isolation.ts:CAP:constant:CAP=128 * 1024#0` | src/adapters/codex-review-isolation.ts:16:7 | safety floor | Excluded: isolation safety | CAP/CAP bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:MAX_SERVERS:constant:MAX_SERVERS=64#0` | src/adapters/codex-review-isolation.ts:16:25 | safety floor | Excluded: isolation safety | MAX_SERVERS/MAX_SERVERS bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:names.length > 64=64#0` | src/adapters/codex-review-isolation.ts:20:22 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/names.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:segment.length > 256=256#0` | src/adapters/codex-review-isolation.ts:43:57 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/segment.length > 256 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:segments.length > 64=64#0` | src/adapters/codex-review-isolation.ts:20:46 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/segments.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:source.length > 256=256#0` | src/adapters/codex-review-isolation.ts:23:55 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/source.length > 256 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:deadline:inline:deadline=12_000#0` | src/adapters/codex-review-isolation.ts:190:42 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/codex-review-isolation.ts:hostCredentialRoots:inline:configured.length > 64=64#0` | src/adapters/codex-review-isolation.ts:84:27 | safety floor | Excluded: isolation safety | hostCredentialRoots/configured.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:killMs:inline:killMs=500#0` | src/adapters/codex-review-isolation.ts:205:81 | safety floor | Excluded: isolation safety | killMs/killMs bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:prepare:inline:ctx.privatePaths.length > 128=128#0` | src/adapters/codex-review-isolation.ts:221:77 | safety floor | Excluded: isolation safety | prepare/ctx.privatePaths.length > 128 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:proveDisabledFeatures:inline:rows.length > 512=512#0` | src/adapters/codex-review-isolation.ts:162:21 | safety floor | Excluded: isolation safety | proveDisabledFeatures/rows.length > 512 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:termMs:inline:termMs=100#0` | src/adapters/codex-review-isolation.ts:205:68 | safety floor | Excluded: isolation safety | termMs/termMs bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:timer:inline:Math.max=1#0` | src/adapters/codex-review-isolation.ts:201:102 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/codex-review-isolation.ts:timer:inline:Math.min=2000#0` | src/adapters/codex-review-isolation.ts:201:114 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/compat.ts:MAX_BYTES:constant:MAX_BYTES=64 * 1024#0` | src/adapters/compat.ts:104:7 | safety floor | Excluded: compatibility safety | MAX_BYTES/MAX_BYTES bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/compat.ts:MAX_TRUST:constant:MAX_TRUST=64#0` | src/adapters/compat.ts:101:7 | safety floor | Excluded: compatibility safety | MAX_TRUST/MAX_TRUST bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/compat.ts:plain:inline:text.length <= 64=64#0` | src/adapters/compat.ts:28:48 | safety floor | Excluded: compatibility safety | plain/text.length <= 64 bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/configured-acp.ts:configuredAcpDefinitions:inline:Object.keys(declarations).length > 64=64#0` | src/adapters/configured-acp.ts:53:42 | safety floor | Excluded: declaration safety | configuredAcpDefinitions/Object.keys(declarations).length > 64 bounds executable adapter declaration count/text; existing machine-local provenance must remain unchanged. |
+| `src/adapters/configured-acp.ts:text:inline:max=4096#0` | src/adapters/configured-acp.ts:29:47 | safety floor | Excluded: declaration safety | text/max bounds executable adapter declaration count/text; existing machine-local provenance must remain unchanged. |
+| `src/adapters/conformance/acp.ts:permissionModeTimeoutMs:inline:permissionModeTimeoutMs=40#0` | src/adapters/conformance/acp.ts:61:36 | test seam | Excluded: existing seam | permissionModeTimeoutMs/permissionModeTimeoutMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/kit.ts:deadline:inline:deadline=5000#0` | src/adapters/conformance/kit.ts:7:33 | test seam | Excluded: existing seam | deadline/deadline is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/kit.ts:until:inline:Bun.sleep=10#0` | src/adapters/conformance/kit.ts:8:65 | test seam | Excluded: existing seam | until/Bun.sleep is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/local-pi.ts:<anonymous>:inline:expect((await event({ type: agent_start, generation: 3, sessionId: saved-session })).status).toBe=200#0` | src/adapters/conformance/local-pi.ts:90:109 | contract | Excluded: wire/schema contract | <anonymous>/expect((await event({ type: agent_start, generation: 3, sessionId: saved-session })).status).toBe defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/definitions/native-cli-entry-jcode.ts:timer:inline:setTimeout=200#0` | src/adapters/definitions/native-cli-entry-jcode.ts:32:40 | operational | Excluded: fixed startup budget | Ruling3384d552 leaves owned-daemon readiness at30s; fixed65s CLI start and default30s callers do not admit a raised startup deadline. Preserve ownership and failed-start cleanup. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:document:inline:stat.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:13:82 | safety floor | Excluded: MCP input safety | document/stat.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:readBoundedJson:inline:info.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:89:82 | safety floor | Excluded: MCP input safety | readBoundedJson/info.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:readBoundedJson:inline:open.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:95:59 | safety floor | Excluded: MCP input safety | readBoundedJson/open.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:timeout:inline:timeout=3000#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:55:119 | operational | Excluded: MCP provenance proof | 3s bounds Git metadata read that verifies MCP configuration provenance; unknown remains refused. |
+| `src/adapters/definitions/native-cli-preview-claude.ts:previewClaude:inline:launch.args.slice=2#0` | src/adapters/definitions/native-cli-preview-claude.ts:29:58 | contract | Excluded: wire/schema contract | previewClaude/launch.args.slice defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/definitions/native-config-defaults.ts:max_steps:inline:max_steps=30#0` | src/adapters/definitions/native-config-defaults.ts:11:143, src/adapters/definitions/native-config-defaults.ts:12:112 | contract | Excluded: existing native config | max_steps is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-defaults.ts:max_steps:inline:max_steps=30#1` | src/adapters/definitions/native-config-defaults.ts:11:143, src/adapters/definitions/native-config-defaults.ts:12:112 | contract | Excluded: existing native config | max_steps is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:efficient_wait_ms:inline:v.number=0#0` | src/adapters/definitions/native-config-policy.ts:12:126 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:efficient_wait_ms:inline:v.number=119999#0` | src/adapters/definitions/native-config-policy.ts:12:129 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1#0` | src/adapters/definitions/native-config-policy.ts:6:176, src/adapters/definitions/native-config-policy.ts:9:171 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1#1` | src/adapters/definitions/native-config-policy.ts:6:176, src/adapters/definitions/native-config-policy.ts:9:171 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1_000_000#0` | src/adapters/definitions/native-config-policy.ts:6:179, src/adapters/definitions/native-config-policy.ts:9:174 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1_000_000#1` | src/adapters/definitions/native-config-policy.ts:6:179, src/adapters/definitions/native-config-policy.ts:9:174 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-policy-aux.ts:absoluteContinuityPath:inline:value.length <= 4096=4096#0` | src/adapters/definitions/native-policy-aux.ts:127:75 | safety floor | Excluded: native policy safety | absoluteContinuityPath/value.length <= 4096 bounds continuity path or plugin inventory bytes used for native policy/proof. |
+| `src/adapters/definitions/native-policy-aux.ts:text:inline:st.size > 1024 * 1024=1024 * 1024#0` | src/adapters/definitions/native-policy-aux.ts:65:35 | safety floor | Excluded: native policy safety | text/st.size > 1024 * 1024 bounds continuity path or plugin inventory bytes used for native policy/proof. |
+| `src/adapters/external-metadata.ts:MAX_MODULES:constant:MAX_MODULES=16#0` | src/adapters/external-metadata.ts:5:7 | safety floor | Excluded: external module safety | MAX_MODULES/MAX_MODULES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-module-scan.ts:code:inline:depth > 128=128#0` | src/adapters/external-module-scan.ts:54:17, src/adapters/external-module-scan.ts:71:17 | safety floor | Excluded: external module safety | code/depth > 128 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-module-scan.ts:template:inline:depth > 128=128#0` | src/adapters/external-module-scan.ts:54:17, src/adapters/external-module-scan.ts:71:17 | safety floor | Excluded: external module safety | template/depth > 128 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MAX_MODULES:constant:MAX_MODULES=16#0` | src/adapters/external-modules.ts:16:7 | safety floor | Excluded: external module safety | MAX_MODULES/MAX_MODULES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MAX_MODULE_BYTES:constant:MAX_MODULE_BYTES=2 * 1024 * 1024#0` | src/adapters/external-modules.ts:16:25 | safety floor | Excluded: external module safety | MAX_MODULE_BYTES/MAX_MODULE_BYTES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MODULE_IMPORT_TIMEOUT_MS:constant:MODULE_IMPORT_TIMEOUT_MS=2000#0` | src/adapters/external-modules.ts:196:7 | safety floor | Excluded: external module safety | MODULE_IMPORT_TIMEOUT_MS/MODULE_IMPORT_TIMEOUT_MS bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:path:inline:text=4096#0` | src/adapters/external-modules.ts:26:33 | safety floor | Excluded: external module safety | path/text bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:snapshot:inline:depth > 12=12#0` | src/adapters/external-modules.ts:106:15 | safety floor | Excluded: external module safety | snapshot/depth > 12 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/jcode.ts:<anonymous>:inline:buffer.length > 1024 * 1024=1024 * 1024#0` | src/adapters/jcode.ts:109:27 | safety floor | Excluded: Jcode input safety | <anonymous>/buffer.length > 1024 * 1024 bounds native reply buffering or saved-session bytes before identity/adoption proof. |
+| `src/adapters/jcode.ts:<anonymous>:inline:setTimeout=3000#0` | src/adapters/jcode.ts:259:174 | operational | Excluded: failed-start cleanup | 3s waits for the owned failed-start child to exit; it is cleanup proof, not successful startup admission. |
+| `src/adapters/jcode.ts:STEER_TIMEOUT_MS:constant:STEER_TIMEOUT_MS=5000#0` | src/adapters/jcode.ts:80:7 | operational | Converted: jcode_steer_timeout_s | Existing steerTimeoutMs host option, captured once by nativeSteer; ONE timer spans ping/subscribe/state/sent, with uncertain outcome after send. |
+| `src/adapters/jcode.ts:jcodeVersionAsync:inline:timeoutMs=10_000#0` | src/adapters/jcode.ts:160:79 | test seam | Excluded: existing seam | jcodeVersionAsync/timeoutMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/jcode.ts:savedSession:inline:before.size > 32 * 1024 * 1024=32 * 1024 * 1024#0` | src/adapters/jcode.ts:53:65 | safety floor | Excluded: Jcode input safety | savedSession/before.size > 32 * 1024 * 1024 bounds native reply buffering or saved-session bytes before identity/adoption proof. |
+| `src/adapters/jcode.ts:timeout:inline:timeout=10_000#0` | src/adapters/jcode.ts:140:169 | operational | Excluded: version proof bound | Synchronous native version/capability preflight has bounded10s execution/output; not model startup readiness. |
+| `src/adapters/jcode.ts:timer:inline:setTimeout=30_000#0` | src/adapters/jcode.ts:222:114 | operational | Excluded: fixed startup budget | Ruling3384d552 leaves owned-daemon readiness at30s; fixed65s CLI start and default30s callers do not admit a raised startup deadline. Preserve ownership and failed-start cleanup. |
+| `src/adapters/kimi-review.ts:<anonymous>:inline:text.length > 4096=4096#0` | src/adapters/kimi-review.ts:94:94 | safety floor | Excluded: reviewer input safety | <anonymous>/text.length > 4096 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:read:inline:limit=262_144#0` | src/adapters/kimi-review.ts:32:37 | safety floor | Excluded: reviewer input safety | read/limit bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:scalar:inline:Object.keys(value).length <= 32=32#0` | src/adapters/kimi-review.ts:40:53 | safety floor | Excluded: reviewer input safety | scalar/Object.keys(value).length <= 32 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:scalar:inline:depth > 4=4#0` | src/adapters/kimi-review.ts:37:15 | safety floor | Excluded: reviewer input safety | scalar/depth > 4 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:stopKimiReview:inline:Bun.sleep=50#0` | src/adapters/kimi-review.ts:105:114 | operational | Excluded: OAuth-lock cleanup cadence | 50ms observes native lock disappearance during existing grace; never bypass or widen token-lock policy. |
+| `src/adapters/kimi-review.ts:stopKimiReview:inline:graceMs=10_000#0` | src/adapters/kimi-review.ts:100:95 | test seam | Excluded: existing seam | stopKimiReview/graceMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/kimi-review.ts:timer:inline:setTimeout=5_000#0` | src/adapters/kimi-review.ts:91:37 | operational | Excluded: native reviewer proof | Bounded version/print proof uses isolated child/environment and awaits cleanup; not ordinary conversation timeout. |
+| `src/adapters/kimi-wire-usage.ts:DEFAULT_CHUNK:constant:DEFAULT_CHUNK=1024 * 1024#0` | src/adapters/kimi-wire-usage.ts:71:7 | operational | Excluded: existing read-budget seam | DEFAULT_CHUNK already overridden by options.maxBytes with a LINE_CAP*2 floor; preserve cursor/parser contract instead of new timer settings. |
+| `src/adapters/kimi-wire-usage.ts:INDEX_CAP:constant:INDEX_CAP=16 * 1024 * 1024#0` | src/adapters/kimi-wire-usage.ts:70:7 | safety floor | Excluded: usage parser safety | INDEX_CAP/INDEX_CAP bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:LINE_CAP:constant:LINE_CAP=64 * 1024#0` | src/adapters/kimi-wire-usage.ts:69:7 | safety floor | Excluded: usage parser safety | LINE_CAP/LINE_CAP bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:MAX_AGENTS:constant:MAX_AGENTS=256#0` | src/adapters/kimi-wire-usage.ts:67:7 | safety floor | Excluded: usage parser safety | MAX_AGENTS/MAX_AGENTS bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:PRINT_HEAD:constant:PRINT_HEAD=64#0` | src/adapters/kimi-wire-usage.ts:78:7 | contract | Excluded: storage identity contract | PRINT_HEAD/PRINT_HEAD fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:PRINT_TAIL:constant:PRINT_TAIL=256#0` | src/adapters/kimi-wire-usage.ts:78:24 | contract | Excluded: storage identity contract | PRINT_TAIL/PRINT_TAIL fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:id:inline:createHash(sha256).update(this.sessionId).update(\0).update(agent).update(\0).update(String(offset)).digest(hex).slice=32#0` | src/adapters/kimi-wire-usage.ts:300:146 | contract | Excluded: storage identity contract | id/createHash(sha256).update(this.sessionId).update(\0).update(agent).update(\0).update(String(offset)).digest(hex).slice fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:readFile:inline:buffer.subarray=256#0` | src/adapters/kimi-wire-usage.ts:267:42 | safety floor | Excluded: usage parser safety | readFile/buffer.subarray bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/local-worker.ts:HISTORY_CHARS:constant:HISTORY_CHARS=100000#0` | src/adapters/local-worker.ts:56:7 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:TURN_CHARS:constant:TURN_CHARS=120000#0` | src/adapters/local-worker.ts:58:7 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:alive:inline:setInterval=30_000#0` | src/adapters/local-worker.ts:267:104 | operational | Excluded: tool liveness heartbeat | 30s marks a still-running managed tool active; changing independent of watchdog can falsely cancel valid work. |
+| `src/adapters/local-worker.ts:elide:inline:(m.content?.length ?? 0) > 200=200#0` | src/adapters/local-worker.ts:482:59 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:max_tokens:inline:maxTokens ?? 2048=2048#0` | src/adapters/local-worker.ts:113:137 | operational | Excluded: existing model seam | maxTokens already comes from host/model routing; no adapter-wide competing output budget. |
+| `src/adapters/local-worker.ts:note:inline:e.message.slice=200#0` | src/adapters/local-worker.ts:204:119 | safety floor | Excluded: error text safety | Error-note text is capped before transport/logging; not native timeout policy. |
+| `src/adapters/pi.ts:<anonymous>:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | <anonymous>/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:<anonymous>:inline:this.opts.stopGraceMs ?? 5_000=5_000#0` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | <anonymous>/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:<anonymous>:inline:this.opts.stopGraceMs ?? 5_000=5_000#1` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | <anonymous>/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:TERMINAL_OWNER_MAX_AGE_MS:constant:TERMINAL_OWNER_MAX_AGE_MS=1000#0` | src/adapters/pi.ts:62:7 | operational | Excluded: terminal identity freshness | 1s owner proof freshness and500ms monitoring are coupled authority/revocation limits, not launch latency settings. |
+| `src/adapters/pi.ts:deadline:inline:deadline=2_000#0` | src/adapters/pi.ts:583:33 | operational | Excluded: verified cleanup cadence | deadline/deadline bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:expiresAt:inline:expiresAt=30_000#0` | src/adapters/pi.ts:330:105 | operational | Excluded: one-use authority expiry | 30s expires idle-bash reservation authority; never turn an old reservation into durable permission. |
+| `src/adapters/pi.ts:grace:inline:this.opts.stopGraceMs ?? 5_000=5_000#0` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | grace/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:event.id.length <= 100=100#0` | src/adapters/pi.ts:780:112 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/event.id.length <= 100 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:event.toolCallId.length <= 512=512#0` | src/adapters/pi.ts:752:108 | contract | Excluded: wire/schema contract | handleBridgeEvent/event.toolCallId.length <= 512 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:this.abortedToolIds.size >= 64=64#0` | src/adapters/pi.ts:758:41 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/this.abortedToolIds.size >= 64 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:this.usageSeen.size > 1000=1000#0` | src/adapters/pi.ts:782:33 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/this.usageSeen.size > 1000 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleToolRequest:inline:setTimeout=10#0` | src/adapters/pi.ts:303:12 | operational | Excluded: event-ordering yield | 10ms lets expiration reply finish before sibling abort/native turn end; not a tool timeout knob. |
+| `src/adapters/pi.ts:idleTimeout:inline:idleTimeout=60#0` | src/adapters/pi.ts:367:77 | operational | Excluded: bridge transport contract | 60s is HTTP bridge idle socket behavior; not native owner freshness or conversation inactivity. |
+| `src/adapters/pi.ts:maxRequestBodySize:inline:maxRequestBodySize=2_000_000#0` | src/adapters/pi.ts:367:101 | safety floor | Excluded: Pi input/lifecycle safety | maxRequestBodySize/maxRequestBodySize bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:snapshot:inline:this.waitRpc=15_000#0` | src/adapters/pi.ts:182:42, src/adapters/pi.ts:417:51 | operational | Excluded: native snapshot ACK proof | 15s native get_state wait proves session/idle state; timeout must stay unknown rather than empty or fresh. |
+| `src/adapters/pi.ts:startOwnerMonitor:inline:setInterval=500#0` | src/adapters/pi.ts:895:62 | operational | Excluded: terminal identity freshness | 1s owner proof freshness and500ms monitoring are coupled authority/revocation limits, not launch latency settings. |
+| `src/adapters/pi.ts:state:inline:this.waitRpc=15_000#0` | src/adapters/pi.ts:182:42, src/adapters/pi.ts:417:51 | operational | Excluded: native snapshot ACK proof | 15s native get_state wait proves session/idle state; timeout must stay unknown rather than empty or fresh. |
+| `src/adapters/pi.ts:stop:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stop/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:stopSurvivingOwner:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stopSurvivingOwner/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:stopSurvivingOwner:inline:Bun.sleep=50#1` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stopSurvivingOwner/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:timer:inline:setTimeout=30_000#0` | src/adapters/pi.ts:845:10, src/adapters/pi.ts:853:377 | operational | Excluded: native command ACK bound | 30s bounds sendTui/sendRpc acknowledgement; retain uncertain receipt and current-session fences. |
+| `src/adapters/pi.ts:timer:inline:setTimeout=30_000#1` | src/adapters/pi.ts:845:10, src/adapters/pi.ts:853:377 | operational | Excluded: native command ACK bound | 30s bounds sendTui/sendRpc acknowledgement; retain uncertain receipt and current-session fences. |
+| `src/adapters/registry.ts:roleValues:inline:roles.length <= 4=4#0` | src/adapters/registry.ts:123:87 | contract | Excluded: wire/schema contract | roleValues/roles.length <= 4 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/reviewer-mcp.ts:BODY_CAP:constant:BODY_CAP=256 * 1024#0` | src/adapters/reviewer-mcp.ts:15:7 | safety floor | Excluded: reviewer transport safety | BODY_CAP/BODY_CAP caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-mcp.ts:RESULT_CAP:constant:RESULT_CAP=4 * 1024 * 1024#0` | src/adapters/reviewer-mcp.ts:15:30 | safety floor | Excluded: reviewer transport safety | RESULT_CAP/RESULT_CAP caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-mcp.ts:message:inline:sanitize(failure.message).slice=4000#0` | src/adapters/reviewer-mcp.ts:77:87 | safety floor | Excluded: reviewer transport safety | message/sanitize(failure.message).slice caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-print.ts:onSpawn:inline:setInterval=100#0` | src/adapters/reviewer-print.ts:343:93 | operational | Excluded: review-token revocation | 100ms checks current task/head/revision authorization while child runs; widening permits stale review work. |
+| `src/hub/action-enforce.ts:<anonymous>:inline:limits[key] > 1=1#0` | src/hub/action-enforce.ts:87:67 | safety floor | Excluded: authority safety | The single admitted action limit is an authorization ceiling, not a tuning parameter. |
+| `src/hub/child-process.ts:check:inline:setTimeout=1_000#0` | src/hub/child-process.ts:203:89 | operational | Excluded: shared cleanup proof | check/setTimeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:processTable:inline:attempt < 2=2#0` | src/hub/child-process.ts:71:35, src/hub/child-process.ts:85:35 | operational | Excluded: shared cleanup proof | processTable/attempt < 2 bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:readProcessTable:inline:attempt < 2=2#0` | src/hub/child-process.ts:71:35, src/hub/child-process.ts:85:35 | operational | Excluded: shared cleanup proof | readProcessTable/attempt < 2 bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=100#0` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=100#1` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=50#0` | src/hub/child-process.ts:313:23 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopOwnedProcess:inline:Bun.sleep=100#0` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopOwnedProcess/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:timeout:inline:timeout=10_000#0` | src/hub/child-process.ts:73:93 | operational | Excluded: shared cleanup proof | timeout/timeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:timer:inline:setTimeout=10_000#0` | src/hub/child-process.ts:88:57 | operational | Excluded: shared cleanup proof | timer/setTimeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/instance-execution.ts:GIT_BUDGET_MS:constant:GIT_BUDGET_MS=5000#0` | src/hub/instance-execution.ts:14:7 | operational | Excluded: root validation proof budget | 5s is one total synchronous Git allowance over up to4 calls; exposed host seam already exists, and overflow must refuse workspace authority. |
+| `src/hub/instance-execution.ts:GIT_OUTPUT_BYTES:constant:GIT_OUTPUT_BYTES=1024 * 1024#0` | src/hub/instance-execution.ts:14:29 | safety floor | Excluded: root proof safety | Git output byte cap bounds synchronous workspace/root validation; preserve unknown/refusal on overflow. |
+| `src/hub/permission-payload.ts:title:inline:full.length > 600=600#0` | src/hub/permission-payload.ts:14:45 | safety floor | Excluded: permission preview safety | title/full.length > 600 bounds sanitized public permission preview, not permitted effects. |
+| `src/hub/permission-payload.ts:title:inline:full.slice=600#0` | src/hub/permission-payload.ts:14:65 | safety floor | Excluded: permission preview safety | title/full.slice bounds sanitized public permission preview, not permitted effects. |
+| `src/hub/start-mode.ts:PEER_START_RETRY_MS:constant:PEER_START_RETRY_MS=30000#0` | src/hub/start-mode.ts:8:14 | operational | Excluded: start authority/retry guard | 30s shared terminal-start guard and dashboard unconfirmed-response hold prevent duplicate native launch; changing it requires caller/launch proof coordination. |
+| `src/hub/terminal-open.ts:SETTLE_MS:constant:SETTLE_MS=1500#0` | src/hub/terminal-open.ts:16:7 | operational | Excluded: terminal readiness contract | 1.5s classifies still-running template as terminal success (documented shortcut); not native ready/session evidence and outside H5 adapter paths. |
+| `src/local/proxy.ts:onData:inline:head.length > 8192=8192#0` | src/local/proxy.ts:97:27 | safety floor | Excluded: proxy input safety | Header byte cap bounds sandbox network proxy parsing; do not expand bridge attack surface. |
+| `src/local/sandbox.ts:<anonymous>:inline:setTimeout=500#0` | src/local/sandbox.ts:213:94 | operational | Excluded: sandbox execution/cleanup seam | <anonymous>/setTimeout is existing timeoutMs command ceiling or500ms post-exit pipe-holder reap; preserve sandbox and owned-child cleanup, not handshake config. |
+| `src/local/sandbox.ts:OUTPUT_CAP:constant:OUTPUT_CAP=20000#0` | src/local/sandbox.ts:10:14 | safety floor | Excluded: sandbox safety | OUTPUT_CAP/OUTPUT_CAP bounds captured command output or sandbox path traversal depth; no execution authority changes. |
+| `src/local/sandbox.ts:timer:inline:opts.timeoutMs ?? 120_000=120_000#0` | src/local/sandbox.ts:199:55 | operational | Excluded: sandbox execution/cleanup seam | timer/opts.timeoutMs ?? 120_000 is existing timeoutMs command ceiling or500ms post-exit pipe-holder reap; preserve sandbox and owned-child cleanup, not handshake config. |
+| `src/local/sandbox.ts:walk:inline:depth > 8=8#0` | src/local/sandbox.ts:63:17 | safety floor | Excluded: sandbox safety | walk/depth > 8 bounds captured command output or sandbox path traversal depth; no execution authority changes. |
+| `src/local/tools.ts:maximum:inline:maximum=600#0` | src/local/tools.ts:105:258 | contract | Excluded: tool schema contract | maximum/maximum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#0` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#1` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#2` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:out:inline:Number(a.limit) \|\| 2000=2000#0` | src/local/tools.ts:143:74 | safety floor | Excluded: local tool safety | out/Number(a.limit) || 2000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:runTool:inline:command.length > 4000=4000#0` | src/local/tools.ts:181:30 | safety floor | Excluded: local tool safety | runTool/command.length > 4000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:runTool:inline:statSync(file).size > 5_000_000=5_000_000#0` | src/local/tools.ts:140:35 | safety floor | Excluded: local tool safety | runTool/statSync(file).size > 5_000_000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:timeoutMs:inline:Number(a.timeout_s) \|\| 120=120#0` | src/local/tools.ts:184:189 | operational | Excluded: public per-call tool timeout | 120s is bash default under existing1..600s public schema; no new per-call override/control path. |
+| `src/local/tools.ts:timeoutMs:inline:timeoutMs=(Number(a.timeout_s) \|\| 120) * 1000#0` | src/local/tools.ts:184:165 | contract | Excluded: tool schema contract | timeoutMs/timeoutMs declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/pi/ceiling.ts:piToolStepCeiling:inline:e.sessionId.length > 200=200#0` | src/pi/ceiling.ts:51:79 | safety floor | Excluded: ceiling evidence safety | Session-id length bounds structured tool-ceiling evidence before it is associated with the native turn. |
+| `src/pi/extension.ts:<anonymous>:inline:setTimeout=250#0` | src/pi/extension.ts:124:66 | operational | Excluded: bridge settlement/retry contract | <anonymous>/setTimeout is250ms disconnected bridge retry or5s bounded prior-settlement wait; idle/session/generation guards remain mandatory after waiting. |
+| `src/pi/extension.ts:<anonymous>:inline:setTimeout=5_000#0` | src/pi/extension.ts:76:112 | operational | Excluded: bridge settlement/retry contract | <anonymous>/setTimeout is250ms disconnected bridge retry or5s bounded prior-settlement wait; idle/session/generation guards remain mandatory after waiting. |
+| `src/pi/extension.ts:contextWindow:inline:m.contextWindow ?? 131072=131072#0` | src/pi/extension.ts:135:178 | operational | Excluded: existing model declaration | Fallback model context/output declaration is overridden by host relay model metadata; not native context observation or handshake setting. |
+| `src/pi/extension.ts:maxSteps:inline:process.env.AGENTHUB_PI_MAX_STEPS ?? 30=30#0` | src/pi/extension.ts:29:62 | operational | Excluded: already configured | Existing Pi max_steps is passed by host launch; extension fallback must agree with that same native schema. |
+| `src/pi/extension.ts:maxTokens:inline:m.maxTokens ?? 8192=8192#0` | src/pi/extension.ts:135:212 | operational | Excluded: existing model declaration | Fallback model context/output declaration is overridden by host relay model metadata; not native context observation or handshake setting. |
+| `src/pi/launch.ts:AGENTHUB_PI_MAX_STEPS:inline:opts.maxSteps ?? 30=30#0` | src/pi/launch.ts:18:594 | operational | Excluded: already configured | opts.maxSteps is existing native Pi config; host passes it through the native environment, not a new H5 env setting. |
+| `src/pi/tool-receipts.ts:PI_TOOL_RESULT_CAP:constant:PI_TOOL_RESULT_CAP=100000#0` | src/pi/tool-receipts.ts:7:14 | contract | Excluded: receipt contract | PI_TOOL_RESULT_CAP/PI_TOOL_RESULT_CAP bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+| `src/pi/tool-receipts.ts:execute:inline:callId.length > 512=512#0` | src/pi/tool-receipts.ts:40:72 | contract | Excluded: receipt contract | execute/callId.length > 512 bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+| `src/pi/tool-receipts.ts:execute:inline:session.length > 512=512#0` | src/pi/tool-receipts.ts:40:49 | contract | Excluded: receipt contract | execute/session.length > 512 bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+
+## Runtime boundaries
+
+- The daemon captures accepted values as primitive constructor options at the new peer start. Active peers keep their original values and deadlines.
+- Tool-ceiling, activity privacy/size and Jcode pre-send/post-send outcome fences retain their existing implementations. No session, permission, recovery, cleanup or quota capability is inferred from a timing value.
+- The excluded proof/identity/teardown bounds, wire/storage caps, existing configuration/test seams and benchmark-only values remain unchanged. The complete rows below preserve H0's classification separately from the code-read disposition.
+- Default and configured behavior tests are fixtures, not native/account timing evidence. Exact-head test and gate results are recorded in the PR; live editing and account-backed execution remain unverified.