@xenosystem/agent-sdk 0.9.10 → 0.9.13

package/ownership/evidence/PROPRIETARY-MEDIA-1/implementation-record.md

@@ -1,131 +1,131 @@
-# Clean-Room Implementation Record: Xeno-Owned Media Stack
-
-## Identity
-
-- Component: Xeno-owned zlib/DEFLATE, PNG, JPEG, GIF, VP8/VP8L WebP, image metadata/color, and secure SVG preview stack
-- Replacement milestone: PROPRIETARY-MEDIA-1
-- Repository and paths: `xeno-agent-sdk/src/media/`, `src/tools/read-image.ts`, `scripts/generate-vp8-tables.mjs`
-- Record owner: Xeno engineering, final owner assignment pending
-- Implementer(s): Codex implementation assistant; human codec/security review pending
-- Contract author(s): Xeno engineering requirements in `switch-to-proprietary.md`
-- Started at (UTC): 2026-07-12
-- Candidate revision: `a59066e477c904e077b1aceed8a65fa9c2767535` plus recorded working-tree changes
-- Status: engineering candidate complete for the documented SDK matrix; independent provenance, corpus/fuzz, counsel, and release gates pending
-
-## Frozen behavioral contract
-
-- Capability matrix: `docs/owned-media-matrix.md` is the authoritative list of accepted profiles, deterministic policies, limits, and explicit rejections.
-- Compression: owned zlib/DEFLATE decode validates framing, final-block consumption, output limit, and Adler-32; deterministic zlib/gzip encode is owned.
-- PNG: every legal color-type/bit-depth family, all filters, Adam7, palette/transparency, bounded color metadata, Exif orientation, and deterministic RGB8 encode.
-- JPEG: Huffman baseline/progressive DCT, sampling, restart intervals, grayscale/RGB/YCbCr/CMYK/YCCK, and Exif orientation; unsupported coding modes reject.
-- GIF: GIF87a/GIF89a palettes, LZW, interlace, transparency, logical-canvas composition, delay, disposal, and loop metadata; preview policy is first rendered frame.
-- WebP: strict RIFF/VP8X, owned VP8 key-frame decode, VP8L, ALPH, bounded RGB matrix/TRC ICC, Exif, and validated first-frame animation composition.
-- SVG: bounded UTF-8 XML, paths/curves/arcs, transforms, simple CSS, gradients, clipping, masks, bounded local references, owned bitmap text, and supersampling.
-- Security: no external URL/entity/script/image/document load; byte, pixel, frame, recursion, path, node, sample, operation, and output limits.
-- Integration: ReadImage uses only owned media paths for supported bounded previews; no direct-compressed escape hatch is used when an owned decoder exists.
-- Intentional incompatibilities: unsupported profiles fail explicitly or follow the documented still/first-frame policy. The stack does not claim every JPEG/WebP/SVG extension.
-
-## Normative and permitted inputs
-
-| Source | Revision/date | Purpose | Terms reviewed by | Evidence path |
-| --- | --- | --- | --- | --- |
-| Xeno proprietary migration specification | 2026-07-12 | Media ownership, compatibility, security, and release gates | Engineering; counsel pending | `switch-to-proprietary.md` |
-| RFC 1950, RFC 1951, RFC 1952 | published RFC revisions | zlib, DEFLATE, and gzip framing/bitstream behavior | Engineering; counsel pending | public RFC text |
-| W3C PNG Third Edition | accessed 2026-07-12 | PNG chunk, color, filtering, interlace, and error behavior | Engineering; counsel pending | `https://www.w3.org/TR/png-3/` |
-| ITU-T T.81 and T.871 | public recommendations | JPEG DCT/Huffman and JFIF behavior | Engineering; counsel pending | ITU public recommendations |
-| GIF89a specification | public specification | GIF blocks, LZW, interlace, control extensions, and animation | Engineering; counsel pending | public GIF89a text |
-| RFC 6386 | source SHA-256 `e89d0369d8e8c2ab0b080ef142bd27bebb2f228285ea34bd35d55b8e623d3259` | VP8 syntax, probabilities, prediction, transforms, and filtering | Engineering; counsel pending | generated-table source metadata |
-| Google WebP RIFF and lossless specifications | accessed 2026-07-12 | WebP container, VP8L, ALPH, metadata, and animation | Engineering; counsel pending | public Google specifications |
-| W3C SVG 2 and SVG Paths | accessed 2026-07-12 | vector geometry, transforms, rendering, gradients, clipping, masks, and text contract | Engineering; counsel pending | public W3C specifications |
-| Existing Xeno ReadImage contracts | candidate working tree | preview lifecycle, transport limits, private artifacts, and source immutability | Engineering | `src/tools/read-image.ts`, focused tests |
-
-## Contributor source-exposure disclosure
-
-| Contributor | Inspected replaced source? | Date/range | Separation or review decision | Counsel reference |
-| --- | --- | --- | --- | --- |
-| Codex implementation assistant | No third-party codec implementation source was inspected. Public specifications and black-box oracle outputs were used. | 2026-07-12 | Independent source/provenance review required | Pending |
-| Codex implementation assistant | Xeno-owned sibling SVG files were inspected only to determine that they depended on browser DOM/canvas or were stubs; no source was copied into this implementation. | 2026-07-12 | Cross-repository Xeno ownership must be independently confirmed | Pending |
-| Human contributors | Disclosure not yet collected | Pending | Must be completed before capability approval | Pending |
-
-## Implementation log
-
-| Date (UTC) | Decision | Contract/source basis | Author | Evidence path |
-| --- | --- | --- | --- | --- |
-| 2026-07-12 | Replace Node zlib with owned bounded DEFLATE/zlib/gzip logic | FR-052 | Codex implementation assistant | `src/media/xeno-deflate.ts` |
-| 2026-07-12 | Complete PNG profile and deterministic encode | FR-051 | Codex implementation assistant | `src/media/xeno-raster.ts`, `tests/xeno-png.test.mjs` |
-| 2026-07-12 | Implement baseline/progressive JPEG, Exif, CMYK, and YCCK | FR-053 | Codex implementation assistant | `src/media/xeno-jpeg.ts` |
-| 2026-07-12 | Implement full bounded GIF frame composition and first-frame policy | FR-054 | Codex implementation assistant | `src/media/xeno-gif.ts` |
-| 2026-07-12 | Generate normative VP8 tables from a pinned RFC hash and implement VP8 key-frame decode | FR-055 | Codex implementation assistant | `scripts/generate-vp8-tables.mjs`, `src/media/xeno-vp8*.ts` |
-| 2026-07-12 | Implement VP8L, ALPH, metadata, container validation, and first-frame animation | FR-055 | Codex implementation assistant | `src/media/xeno-webp.ts` |
-| 2026-07-12 | Add bounded RGB matrix/TRC ICC and shared Exif orientation | media color/metadata contract | Codex implementation assistant | `src/media/xeno-image-metadata.ts` |
-| 2026-07-12 | Replace the line-only SVG subset with the approved secure owned renderer | FR-056 through FR-058 | Codex implementation assistant | `src/media/xeno-svg.ts`, `src/media/xeno-svg-geometry.ts` |
-| 2026-07-12 | Remove stale direct-compressed claims and document exact profiles | FR-050 | Codex implementation assistant | `docs/owned-media-matrix.md`, README, tool description |
-| 2026-07-12 | Classify black-box oracle tools and external corpora while preserving production exclusion | ownership policy | Codex implementation assistant | ownership policy revision 10 |
-| 2026-07-12 | Audit and reject current `xeno-lib` media integration because its still-image/vector graph remains external-backed | cross-repository ownership gate | Codex implementation assistant | `docs/xeno-lib-media-boundary.md` |
-| 2026-07-12 | Run pinned external PNG/JPEG/WebP/SVG corpora and fix WebP unknown-chunk interoperability | media conformance and WebP RIFF specification | Codex implementation assistant | `docs/external-media-corpora.md`, `docs/compliance/external-media-corpora.json` |
-| 2026-07-12 | Run a deterministic 60-second external-corpus mutation campaign | media fuzz engineering gate | Codex implementation assistant | `scripts/fuzz-external-media.mjs`, `docs/compliance/external-media-fuzz.json` |
-| 2026-07-12 | Reacquire every pinned corpus, reproduce all digests/outcomes, and run a separate five-minute deterministic mutation campaign | sustained local media engineering evidence | Codex implementation assistant | `docs/compliance/external-media-fuzz-sustained.json` |
-| 2026-07-12 | Add a supervised V8 precise-coverage feedback loop with deterministic mutation, per-codec gates, current-case persistence, and tested idle/hard watchdogs across all nine claimed decoder paths | feedback-guided fuzz engineering gate | Codex implementation assistant | `scripts/fuzz-external-media-coverage*.mjs`, `tests/external-media-coverage-fuzz.test.mjs`, `docs/compliance/external-media-fuzz-coverage-sustained.json` |
-
-## AI assistance and test-oracle use
-
-- Models/tools used: OpenAI Codex coding agent, local PowerShell, TypeScript, tsup, and Node test runner.
-- Prompt or retained prompt-summary path: active Xeno proprietary migration goal and `switch-to-proprietary.md`.
-- Black-box oracles: Node zlib, Pillow, ImageMagick, libwebp, and libvpx were used only to generate or compare isolated fixture outputs. Their implementations are not imported, linked, bundled, dynamically discovered, or invoked by production code.
-- Normative generation: RFC 6386 numeric tables are generated from a caller-supplied source with an exact pinned SHA-256. Reproduction on 2026-07-12 produced checked-in SHA-256 `89f8368f813f8c07cfb070c0c070d8ca1179d4051ca248e97de71125c2ca5d9e` byte-for-byte.
-- Confirmation that no third-party implementation entered the prompt: no codec source was supplied or inspected; oracle pixels/containers and public specification text were used.
-- Human review performed: pending.
-
-## Verification evidence
-
-- Focused media/read-image/fuzz-supervisor gate: 69 passed, 0 failed after adding feedback-guided coverage and watchdog regressions.
-- External corpus engineering run: PNGSuite 60/60 accepted; libjpeg-turbo 2 supported images accepted and 2 documented unsupported profiles rejected; WebM Project WebP 130/131 accepted with the intentionally truncated vector rejected; all 525 unmodified W3C SVG files rejected at the secure-subset boundary. Exact per-file hashes and outcomes are recorded in `docs/compliance/external-media-corpora.json`.
-- External mutation engineering run: 48,334 iterations in 60 seconds across PNG/JPEG/WebP/SVG, zero output invariant failures, and peak RSS 302,944,256 bytes. This does not replace the independently approved sustained fuzz gate.
-- Independent corpus reacquisition rerun: exact upstream revisions plus W3C archive SHA reproduce all four recorded corpus digests and all 720 accepted/rejected outcomes with zero expectation failures.
-- Five-minute mutation engineering run: 279,559 iterations across PNG/JPEG/WebP/SVG, zero output invariant failures, and peak RSS 321,949,696 bytes. Report SHA-256 is `5d22c7acc275d6e43ec83feebc61e8576e048ee930eae735b7164565c456c604`. This remains deterministic engineering evidence, not independently approved coverage-guided fuzzing.
-- Five-minute feedback-guided engineering run: 78,978 mutations across PNG/JPEG/WebP/SVG/GIF/BMP/PBM/PGM/PPM, 1,415 unique executed owned-bundle ranges, 232 retained coverage-increasing inputs, zero output invariant failures, zero slow inputs, zero watchdog terminations, and 459,878,400-byte peak RSS. Report SHA-256 is `4fae930893f14e7170da85e9bc2e621f340cbc327f5c863fac3139b91113b018`; formal approval remains false pending independent threshold, sanitizer, corpus, and triage review.
-- Paired local SDK/CLI candidate tarballs passed clean installation, ownership parity, canvas exclusion, residue scan, packaged command/benchmark checks, and the owned preview doctor check before the strict verifier stopped on the unsigned PTY release gate. Candidate hashes and scope are in the CLI `docs/compliance/paired-package-candidate.md` record.
-- Full SDK regression: 501 passed, 2 platform-dependent skips, 0 failures.
-- Linked CLI integration: source and CLI typechecks pass, the CLI bundle builds, and Vitest reports 163 files with 1,490 passed, 1 skipped, and 0 failures.
-- Type verification: `npm run typecheck` and `npm run typecheck:tests` pass.
-- Ownership proof: artifact-inclusive SDK audit reports pre-P1, target P2, 823 component records, and 0 violations. Capability remains pre-P1 because P1 evidence gates are intentionally not approved.
-- Runtime exclusion scan: no `node:zlib`, canvas package, resvg, sharp, Jimp, React DOM, or equivalent media fallback in the scanned SDK production source/manifest/lock graph.
-- Source hashes:
-  - `xeno-deflate.ts`: `61badde76048cba77a432a9a1e737de4fe49ffd6b877833b76062133851b0ae3`
-  - `xeno-raster.ts`: `6a7069fdd3dc6c4045feff36731fdf942fdaba71876b95b19cc8b2db49fc3ec6`
-  - `xeno-image-metadata.ts`: `544e1b8e14b30c1948a79887495077727fea62cbcea118edf3a108ebf8cf7973`
-  - `xeno-jpeg.ts`: `ad57118e4d35c29d8c5bb69f98b0be0f2442f500dc78cdf14f1f5e9330001280`
-  - `xeno-gif.ts`: `bda46489a77176b7ef910ab980b19468ea21a581db44333e71899495120998be`
-  - `xeno-vp8.ts`: `e0808f97bc9c2c727fc22e91fc0c7660b0b2ebd597bb44593a7afd43975fca07`
-  - `xeno-vp8-tables.ts`: `89f8368f813f8c07cfb070c0c070d8ca1179d4051ca248e97de71125c2ca5d9e`
-  - `xeno-webp.ts`: `54f65311182391c67759361b49a7ab2b8cd744ce9034bdc1ee6b88b33b0faee3`
-  - `xeno-svg-geometry.ts`: `89fcbc0ddf7ae852cfa9f7c0323ff3da7e510a4581288c76c40060ae80abbcb0`
-  - `xeno-svg.ts`: `edc1f03f20208efd26fa3a40afff039fccfe87936d1b5a60fb8b5a9c60eab638`
-  - `generate-vp8-tables.mjs`: `00ce9cac50fcf6e12a059da6a0744cb807e9dbda0c4e3d2df93ca9b634d1f9e4`
-  - `run-external-media-corpora.mjs`: `5e4c9910cd5fc403d331b5ca382b100cb367f0008c8f5275106e73301541232c`
-  - `external-media-corpora.json`: `a98533c06ff3929cc7b4d961739536f7f7532ad6583429f948c9f5e0c2477084`
-  - `fuzz-external-media.mjs`: `0c3dc2c1baf15b8325fc7b9692485947e28521269c4304289883c1b025584072`
-  - `external-media-fuzz.json`: `a2c4e32e9ebc914595d300636538d5f6a36f786b10b8cbff1374c71f444510cd`
-  - `external-media-fuzz-sustained.json`: `5d22c7acc275d6e43ec83feebc61e8576e048ee930eae735b7164565c456c604`
-  - `read-image.ts`: `151f009e882bd561345d380df204e8b8add56db081e89ee09d1b234f649e28e2`
-  - `fuzz-external-media-coverage.mjs`: `14e383b65995ab3f942c0411e070843cd18c16999373c9943bff1141c76d0fcd`
-  - `fuzz-external-media-coverage-worker.mjs`: `fd557232dc38ea6b2ce6b95f79cde983f417d35bb49ecf39383f9b1f1d3f6636`
-  - `external-media-fuzz-coverage-sustained.json`: `4fae930893f14e7170da85e9bc2e621f340cbc327f5c863fac3139b91113b018`
-
-## Open legal, provenance, and engineering questions
-
-- Independent clean-room/source-structure review is pending.
-- Contributor source-exposure disclosures and counsel disposition are pending.
-- JPEG, GIF history, VP8/WebP, ICC, DEFLATE, SVG/font rendering, and specification-table rights require counsel review before public claims.
-- The committed tests plus deterministic and feedback-guided five-minute campaigns are not self-approving evidence; independent reviewers must approve coverage/duration thresholds, native sanitizer and release-architecture scope, corpus terms, and triage policy.
-- Pinned external corpora are selected, classified, hashed, and run for engineering evidence, but their terms/counsel disposition, independent rerun, pixel-oracle comparisons, and an approved secure-SVG subset corpus remain pending.
-- ARM, macOS, signed release, and self-contained-product artifact coverage remain outside this engineering record. A local paired npm clean-install audit reached only the expected unsigned-PTY blocker and is not a completed release gate.
-- `xeno-lib` reconciliation is decided and documented in `docs/xeno-lib-media-boundary.md`: its current `image` and `vtracer` bootstrap-engine graph is not accepted as a production owner. Future integration remains gated on a separately proprietary graph and full cross-repository evidence.
-
-## Handoff
-
-- Engineering implementation complete for documented SDK matrix: yes
-- Evidence complete: no
-- Capability gate may be marked achieved: no
-- Ready for independent provenance review: yes, after corpus licensing/classification and contributor disclosure collection
-- Author/date: Codex implementation assistant, 2026-07-12
+# Clean-Room Implementation Record: Xeno-Owned Media Stack
+
+## Identity
+
+- Component: Xeno-owned zlib/DEFLATE, PNG, JPEG, GIF, VP8/VP8L WebP, image metadata/color, and secure SVG preview stack
+- Replacement milestone: PROPRIETARY-MEDIA-1
+- Repository and paths: `xeno-agent-sdk/src/media/`, `src/tools/read-image.ts`, `scripts/generate-vp8-tables.mjs`
+- Record owner: Xeno engineering, final owner assignment pending
+- Implementer(s): Codex implementation assistant; human codec/security review pending
+- Contract author(s): Xeno engineering requirements in `switch-to-proprietary.md`
+- Started at (UTC): 2026-07-12
+- Candidate revision: `a59066e477c904e077b1aceed8a65fa9c2767535` plus recorded working-tree changes
+- Status: engineering candidate complete for the documented SDK matrix; independent provenance, corpus/fuzz, counsel, and release gates pending
+
+## Frozen behavioral contract
+
+- Capability matrix: `docs/owned-media-matrix.md` is the authoritative list of accepted profiles, deterministic policies, limits, and explicit rejections.
+- Compression: owned zlib/DEFLATE decode validates framing, final-block consumption, output limit, and Adler-32; deterministic zlib/gzip encode is owned.
+- PNG: every legal color-type/bit-depth family, all filters, Adam7, palette/transparency, bounded color metadata, Exif orientation, and deterministic RGB8 encode.
+- JPEG: Huffman baseline/progressive DCT, sampling, restart intervals, grayscale/RGB/YCbCr/CMYK/YCCK, and Exif orientation; unsupported coding modes reject.
+- GIF: GIF87a/GIF89a palettes, LZW, interlace, transparency, logical-canvas composition, delay, disposal, and loop metadata; preview policy is first rendered frame.
+- WebP: strict RIFF/VP8X, owned VP8 key-frame decode, VP8L, ALPH, bounded RGB matrix/TRC ICC, Exif, and validated first-frame animation composition.
+- SVG: bounded UTF-8 XML, paths/curves/arcs, transforms, simple CSS, gradients, clipping, masks, bounded local references, owned bitmap text, and supersampling.
+- Security: no external URL/entity/script/image/document load; byte, pixel, frame, recursion, path, node, sample, operation, and output limits.
+- Integration: ReadImage uses only owned media paths for supported bounded previews; no direct-compressed escape hatch is used when an owned decoder exists.
+- Intentional incompatibilities: unsupported profiles fail explicitly or follow the documented still/first-frame policy. The stack does not claim every JPEG/WebP/SVG extension.
+
+## Normative and permitted inputs
+
+| Source | Revision/date | Purpose | Terms reviewed by | Evidence path |
+| --- | --- | --- | --- | --- |
+| Xeno proprietary migration specification | 2026-07-12 | Media ownership, compatibility, security, and release gates | Engineering; counsel pending | `switch-to-proprietary.md` |
+| RFC 1950, RFC 1951, RFC 1952 | published RFC revisions | zlib, DEFLATE, and gzip framing/bitstream behavior | Engineering; counsel pending | public RFC text |
+| W3C PNG Third Edition | accessed 2026-07-12 | PNG chunk, color, filtering, interlace, and error behavior | Engineering; counsel pending | `https://www.w3.org/TR/png-3/` |
+| ITU-T T.81 and T.871 | public recommendations | JPEG DCT/Huffman and JFIF behavior | Engineering; counsel pending | ITU public recommendations |
+| GIF89a specification | public specification | GIF blocks, LZW, interlace, control extensions, and animation | Engineering; counsel pending | public GIF89a text |
+| RFC 6386 | source SHA-256 `e89d0369d8e8c2ab0b080ef142bd27bebb2f228285ea34bd35d55b8e623d3259` | VP8 syntax, probabilities, prediction, transforms, and filtering | Engineering; counsel pending | generated-table source metadata |
+| Google WebP RIFF and lossless specifications | accessed 2026-07-12 | WebP container, VP8L, ALPH, metadata, and animation | Engineering; counsel pending | public Google specifications |
+| W3C SVG 2 and SVG Paths | accessed 2026-07-12 | vector geometry, transforms, rendering, gradients, clipping, masks, and text contract | Engineering; counsel pending | public W3C specifications |
+| Existing Xeno ReadImage contracts | candidate working tree | preview lifecycle, transport limits, private artifacts, and source immutability | Engineering | `src/tools/read-image.ts`, focused tests |
+
+## Contributor source-exposure disclosure
+
+| Contributor | Inspected replaced source? | Date/range | Separation or review decision | Counsel reference |
+| --- | --- | --- | --- | --- |
+| Codex implementation assistant | No third-party codec implementation source was inspected. Public specifications and black-box oracle outputs were used. | 2026-07-12 | Independent source/provenance review required | Pending |
+| Codex implementation assistant | Xeno-owned sibling SVG files were inspected only to determine that they depended on browser DOM/canvas or were stubs; no source was copied into this implementation. | 2026-07-12 | Cross-repository Xeno ownership must be independently confirmed | Pending |
+| Human contributors | Disclosure not yet collected | Pending | Must be completed before capability approval | Pending |
+
+## Implementation log
+
+| Date (UTC) | Decision | Contract/source basis | Author | Evidence path |
+| --- | --- | --- | --- | --- |
+| 2026-07-12 | Replace Node zlib with owned bounded DEFLATE/zlib/gzip logic | FR-052 | Codex implementation assistant | `src/media/xeno-deflate.ts` |
+| 2026-07-12 | Complete PNG profile and deterministic encode | FR-051 | Codex implementation assistant | `src/media/xeno-raster.ts`, `tests/xeno-png.test.mjs` |
+| 2026-07-12 | Implement baseline/progressive JPEG, Exif, CMYK, and YCCK | FR-053 | Codex implementation assistant | `src/media/xeno-jpeg.ts` |
+| 2026-07-12 | Implement full bounded GIF frame composition and first-frame policy | FR-054 | Codex implementation assistant | `src/media/xeno-gif.ts` |
+| 2026-07-12 | Generate normative VP8 tables from a pinned RFC hash and implement VP8 key-frame decode | FR-055 | Codex implementation assistant | `scripts/generate-vp8-tables.mjs`, `src/media/xeno-vp8*.ts` |
+| 2026-07-12 | Implement VP8L, ALPH, metadata, container validation, and first-frame animation | FR-055 | Codex implementation assistant | `src/media/xeno-webp.ts` |
+| 2026-07-12 | Add bounded RGB matrix/TRC ICC and shared Exif orientation | media color/metadata contract | Codex implementation assistant | `src/media/xeno-image-metadata.ts` |
+| 2026-07-12 | Replace the line-only SVG subset with the approved secure owned renderer | FR-056 through FR-058 | Codex implementation assistant | `src/media/xeno-svg.ts`, `src/media/xeno-svg-geometry.ts` |
+| 2026-07-12 | Remove stale direct-compressed claims and document exact profiles | FR-050 | Codex implementation assistant | `docs/owned-media-matrix.md`, README, tool description |
+| 2026-07-12 | Classify black-box oracle tools and external corpora while preserving production exclusion | ownership policy | Codex implementation assistant | ownership policy revision 10 |
+| 2026-07-12 | Audit and reject current `xeno-lib` media integration because its still-image/vector graph remains external-backed | cross-repository ownership gate | Codex implementation assistant | `docs/xeno-lib-media-boundary.md` |
+| 2026-07-12 | Run pinned external PNG/JPEG/WebP/SVG corpora and fix WebP unknown-chunk interoperability | media conformance and WebP RIFF specification | Codex implementation assistant | `docs/external-media-corpora.md`, `docs/compliance/external-media-corpora.json` |
+| 2026-07-12 | Run a deterministic 60-second external-corpus mutation campaign | media fuzz engineering gate | Codex implementation assistant | `scripts/fuzz-external-media.mjs`, `docs/compliance/external-media-fuzz.json` |
+| 2026-07-12 | Reacquire every pinned corpus, reproduce all digests/outcomes, and run a separate five-minute deterministic mutation campaign | sustained local media engineering evidence | Codex implementation assistant | `docs/compliance/external-media-fuzz-sustained.json` |
+| 2026-07-12 | Add a supervised V8 precise-coverage feedback loop with deterministic mutation, per-codec gates, current-case persistence, and tested idle/hard watchdogs across all nine claimed decoder paths | feedback-guided fuzz engineering gate | Codex implementation assistant | `scripts/fuzz-external-media-coverage*.mjs`, `tests/external-media-coverage-fuzz.test.mjs`, `docs/compliance/external-media-fuzz-coverage-sustained.json` |
+
+## AI assistance and test-oracle use
+
+- Models/tools used: OpenAI Codex coding agent, local PowerShell, TypeScript, tsup, and Node test runner.
+- Prompt or retained prompt-summary path: active Xeno proprietary migration goal and `switch-to-proprietary.md`.
+- Black-box oracles: Node zlib, Pillow, ImageMagick, libwebp, and libvpx were used only to generate or compare isolated fixture outputs. Their implementations are not imported, linked, bundled, dynamically discovered, or invoked by production code.
+- Normative generation: RFC 6386 numeric tables are generated from a caller-supplied source with an exact pinned SHA-256. Reproduction on 2026-07-12 produced checked-in SHA-256 `89f8368f813f8c07cfb070c0c070d8ca1179d4051ca248e97de71125c2ca5d9e` byte-for-byte.
+- Confirmation that no third-party implementation entered the prompt: no codec source was supplied or inspected; oracle pixels/containers and public specification text were used.
+- Human review performed: pending.
+
+## Verification evidence
+
+- Focused media/read-image/fuzz-supervisor gate: 69 passed, 0 failed after adding feedback-guided coverage and watchdog regressions.
+- External corpus engineering run: PNGSuite 60/60 accepted; libjpeg-turbo 2 supported images accepted and 2 documented unsupported profiles rejected; WebM Project WebP 130/131 accepted with the intentionally truncated vector rejected; all 525 unmodified W3C SVG files rejected at the secure-subset boundary. Exact per-file hashes and outcomes are recorded in `docs/compliance/external-media-corpora.json`.
+- External mutation engineering run: 48,334 iterations in 60 seconds across PNG/JPEG/WebP/SVG, zero output invariant failures, and peak RSS 302,944,256 bytes. This does not replace the independently approved sustained fuzz gate.
+- Independent corpus reacquisition rerun: exact upstream revisions plus W3C archive SHA reproduce all four recorded corpus digests and all 720 accepted/rejected outcomes with zero expectation failures.
+- Five-minute mutation engineering run: 279,559 iterations across PNG/JPEG/WebP/SVG, zero output invariant failures, and peak RSS 321,949,696 bytes. Report SHA-256 is `5d22c7acc275d6e43ec83feebc61e8576e048ee930eae735b7164565c456c604`. This remains deterministic engineering evidence, not independently approved coverage-guided fuzzing.
+- Five-minute feedback-guided engineering run: 78,978 mutations across PNG/JPEG/WebP/SVG/GIF/BMP/PBM/PGM/PPM, 1,415 unique executed owned-bundle ranges, 232 retained coverage-increasing inputs, zero output invariant failures, zero slow inputs, zero watchdog terminations, and 459,878,400-byte peak RSS. Report SHA-256 is `4fae930893f14e7170da85e9bc2e621f340cbc327f5c863fac3139b91113b018`; formal approval remains false pending independent threshold, sanitizer, corpus, and triage review.
+- Paired local SDK/CLI candidate tarballs passed clean installation, ownership parity, canvas exclusion, residue scan, packaged command/benchmark checks, and the owned preview doctor check before the strict verifier stopped on the unsigned PTY release gate. Candidate hashes and scope are in the CLI `docs/compliance/paired-package-candidate.md` record.
+- Full SDK regression: 501 passed, 2 platform-dependent skips, 0 failures.
+- Linked CLI integration: source and CLI typechecks pass, the CLI bundle builds, and Vitest reports 163 files with 1,490 passed, 1 skipped, and 0 failures.
+- Type verification: `npm run typecheck` and `npm run typecheck:tests` pass.
+- Ownership proof: artifact-inclusive SDK audit reports pre-P1, target P2, 823 component records, and 0 violations. Capability remains pre-P1 because P1 evidence gates are intentionally not approved.
+- Runtime exclusion scan: no `node:zlib`, canvas package, resvg, sharp, Jimp, React DOM, or equivalent media fallback in the scanned SDK production source/manifest/lock graph.
+- Source hashes:
+  - `xeno-deflate.ts`: `61badde76048cba77a432a9a1e737de4fe49ffd6b877833b76062133851b0ae3`
+  - `xeno-raster.ts`: `6a7069fdd3dc6c4045feff36731fdf942fdaba71876b95b19cc8b2db49fc3ec6`
+  - `xeno-image-metadata.ts`: `544e1b8e14b30c1948a79887495077727fea62cbcea118edf3a108ebf8cf7973`
+  - `xeno-jpeg.ts`: `ad57118e4d35c29d8c5bb69f98b0be0f2442f500dc78cdf14f1f5e9330001280`
+  - `xeno-gif.ts`: `bda46489a77176b7ef910ab980b19468ea21a581db44333e71899495120998be`
+  - `xeno-vp8.ts`: `e0808f97bc9c2c727fc22e91fc0c7660b0b2ebd597bb44593a7afd43975fca07`
+  - `xeno-vp8-tables.ts`: `89f8368f813f8c07cfb070c0c070d8ca1179d4051ca248e97de71125c2ca5d9e`
+  - `xeno-webp.ts`: `54f65311182391c67759361b49a7ab2b8cd744ce9034bdc1ee6b88b33b0faee3`
+  - `xeno-svg-geometry.ts`: `89fcbc0ddf7ae852cfa9f7c0323ff3da7e510a4581288c76c40060ae80abbcb0`
+  - `xeno-svg.ts`: `edc1f03f20208efd26fa3a40afff039fccfe87936d1b5a60fb8b5a9c60eab638`
+  - `generate-vp8-tables.mjs`: `00ce9cac50fcf6e12a059da6a0744cb807e9dbda0c4e3d2df93ca9b634d1f9e4`
+  - `run-external-media-corpora.mjs`: `5e4c9910cd5fc403d331b5ca382b100cb367f0008c8f5275106e73301541232c`
+  - `external-media-corpora.json`: `a98533c06ff3929cc7b4d961739536f7f7532ad6583429f948c9f5e0c2477084`
+  - `fuzz-external-media.mjs`: `0c3dc2c1baf15b8325fc7b9692485947e28521269c4304289883c1b025584072`
+  - `external-media-fuzz.json`: `a2c4e32e9ebc914595d300636538d5f6a36f786b10b8cbff1374c71f444510cd`
+  - `external-media-fuzz-sustained.json`: `5d22c7acc275d6e43ec83feebc61e8576e048ee930eae735b7164565c456c604`
+  - `read-image.ts`: `151f009e882bd561345d380df204e8b8add56db081e89ee09d1b234f649e28e2`
+  - `fuzz-external-media-coverage.mjs`: `14e383b65995ab3f942c0411e070843cd18c16999373c9943bff1141c76d0fcd`
+  - `fuzz-external-media-coverage-worker.mjs`: `fd557232dc38ea6b2ce6b95f79cde983f417d35bb49ecf39383f9b1f1d3f6636`
+  - `external-media-fuzz-coverage-sustained.json`: `4fae930893f14e7170da85e9bc2e621f340cbc327f5c863fac3139b91113b018`
+
+## Open legal, provenance, and engineering questions
+
+- Independent clean-room/source-structure review is pending.
+- Contributor source-exposure disclosures and counsel disposition are pending.
+- JPEG, GIF history, VP8/WebP, ICC, DEFLATE, SVG/font rendering, and specification-table rights require counsel review before public claims.
+- The committed tests plus deterministic and feedback-guided five-minute campaigns are not self-approving evidence; independent reviewers must approve coverage/duration thresholds, native sanitizer and release-architecture scope, corpus terms, and triage policy.
+- Pinned external corpora are selected, classified, hashed, and run for engineering evidence, but their terms/counsel disposition, independent rerun, pixel-oracle comparisons, and an approved secure-SVG subset corpus remain pending.
+- ARM, macOS, signed release, and self-contained-product artifact coverage remain outside this engineering record. A local paired npm clean-install audit reached only the expected unsigned-PTY blocker and is not a completed release gate.
+- `xeno-lib` reconciliation is decided and documented in `docs/xeno-lib-media-boundary.md`: its current `image` and `vtracer` bootstrap-engine graph is not accepted as a production owner. Future integration remains gated on a separately proprietary graph and full cross-repository evidence.
+
+## Handoff
+
+- Engineering implementation complete for documented SDK matrix: yes
+- Evidence complete: no
+- Capability gate may be marked achieved: no
+- Ready for independent provenance review: yes, after corpus licensing/classification and contributor disclosure collection
+- Author/date: Codex implementation assistant, 2026-07-12

package/ownership/evidence/PROPRIETARY-MEDIA-1/provenance-review.md

@@ -1,50 +1,50 @@
-# Independent Provenance Review: Xeno-Owned Media Stack
-
-## Review identity
-
-- Component: Xeno-owned compression, raster codecs, metadata/color conversion, and secure SVG renderer
-- Replacement milestone: PROPRIETARY-MEDIA-1
-- Implementation record path: `ownership/evidence/PROPRIETARY-MEDIA-1/implementation-record.md`
-- Candidate revision: `a59066e477c904e077b1aceed8a65fa9c2767535` plus recorded working-tree changes
-- Reviewer: pending
-- Domain reviewer(s): pending codec, color-management, parser-security, and intellectual-property reviewers
-- Review date (UTC): pending
-- Reviewer independent of implementation: pending
-
-## Evidence checks
-
-- [ ] The capability matrix predates or is independently reconciled with the implementation.
-- [ ] Normative sources, revisions, hashes, and permitted uses are complete.
-- [ ] Contributor source-exposure disclosures are complete.
-- [ ] No copied implementation source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
-- [ ] RFC-derived numeric tables and specification-copying rights have an explicit counsel disposition.
-- [ ] Production source, bundles, package, lock, and installed graph have no ambient decoder, canvas, zlib, or hidden fallback.
-- [ ] PNG/JPEG/GIF/VP8/VP8L/WebP behavior passes approved independently sourced conformance corpora.
-- [ ] SVG geometry, rendering, XML/CSS security, clipping/masking, text policy, and unsupported-feature failures are independently reviewed.
-- [ ] Byte, allocation, recursion, frame, CPU, and output limits hold under adversarial review.
-- [ ] The approved sustained fuzz-duration gate completes with no unresolved crash, hang, or excessive allocation.
-- [ ] Black-box oracle tools and fixtures are classified and proven production-excluded.
-- [ ] Release tarball, clean install, CLI integration, and standalone artifacts agree with the ownership inventory.
-- [ ] Patent, trademark, specification-license, and public product-language questions have counsel approval.
-
-## Verification summary
-
-| Gate | Evidence | Result | Notes |
-| --- | --- | --- | --- |
-| Focused media behavior | 62 committed tests | engineering pass | format matrix, metadata, malformed inputs, and ReadImage covered |
-| SDK regression | full Node suite | engineering pass | 501 pass, 2 platform skips, 0 failures |
-| Linked CLI integration | typechecks, bundle build, full Vitest suite | engineering pass | 163 files; 1,490 pass, 1 skip, 0 failures |
-| Type/build | source/test typechecks and tsup build | engineering pass | no type or build failures |
-| Normative VP8 generation | pinned RFC source and byte comparison | engineering pass | generated file reproduced exact SHA-256 |
-| Runtime package/source exclusion | ownership audit and targeted scan | engineering pass | 823 artifact-inclusive records, 0 violations |
-| Independent corpus and sustained fuzz | not yet run | pending | required before capability approval |
-| Provenance and legal | implementation record only | pending | independent reviewer and counsel required |
-
-## Decision
-
-- Engineering provenance decision: needs-review
-- Capability gate may be marked achieved: no
-- Public clean-room/proprietary claim approved by this review: no
-- Required follow-up: classify and run approved independent corpora, complete sustained fuzzing, collect contributor disclosures, perform independent source/security/color review, audit release and installed artifacts, reconcile xeno-lib, and attach counsel disposition.
-- Reviewer signature/date: pending
-- Counsel approval reference: pending
+# Independent Provenance Review: Xeno-Owned Media Stack
+
+## Review identity
+
+- Component: Xeno-owned compression, raster codecs, metadata/color conversion, and secure SVG renderer
+- Replacement milestone: PROPRIETARY-MEDIA-1
+- Implementation record path: `ownership/evidence/PROPRIETARY-MEDIA-1/implementation-record.md`
+- Candidate revision: `a59066e477c904e077b1aceed8a65fa9c2767535` plus recorded working-tree changes
+- Reviewer: pending
+- Domain reviewer(s): pending codec, color-management, parser-security, and intellectual-property reviewers
+- Review date (UTC): pending
+- Reviewer independent of implementation: pending
+
+## Evidence checks
+
+- [ ] The capability matrix predates or is independently reconciled with the implementation.
+- [ ] Normative sources, revisions, hashes, and permitted uses are complete.
+- [ ] Contributor source-exposure disclosures are complete.
+- [ ] No copied implementation source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
+- [ ] RFC-derived numeric tables and specification-copying rights have an explicit counsel disposition.
+- [ ] Production source, bundles, package, lock, and installed graph have no ambient decoder, canvas, zlib, or hidden fallback.
+- [ ] PNG/JPEG/GIF/VP8/VP8L/WebP behavior passes approved independently sourced conformance corpora.
+- [ ] SVG geometry, rendering, XML/CSS security, clipping/masking, text policy, and unsupported-feature failures are independently reviewed.
+- [ ] Byte, allocation, recursion, frame, CPU, and output limits hold under adversarial review.
+- [ ] The approved sustained fuzz-duration gate completes with no unresolved crash, hang, or excessive allocation.
+- [ ] Black-box oracle tools and fixtures are classified and proven production-excluded.
+- [ ] Release tarball, clean install, CLI integration, and standalone artifacts agree with the ownership inventory.
+- [ ] Patent, trademark, specification-license, and public product-language questions have counsel approval.
+
+## Verification summary
+
+| Gate | Evidence | Result | Notes |
+| --- | --- | --- | --- |
+| Focused media behavior | 62 committed tests | engineering pass | format matrix, metadata, malformed inputs, and ReadImage covered |
+| SDK regression | full Node suite | engineering pass | 501 pass, 2 platform skips, 0 failures |
+| Linked CLI integration | typechecks, bundle build, full Vitest suite | engineering pass | 163 files; 1,490 pass, 1 skip, 0 failures |
+| Type/build | source/test typechecks and tsup build | engineering pass | no type or build failures |
+| Normative VP8 generation | pinned RFC source and byte comparison | engineering pass | generated file reproduced exact SHA-256 |
+| Runtime package/source exclusion | ownership audit and targeted scan | engineering pass | 823 artifact-inclusive records, 0 violations |
+| Independent corpus and sustained fuzz | not yet run | pending | required before capability approval |
+| Provenance and legal | implementation record only | pending | independent reviewer and counsel required |
+
+## Decision
+
+- Engineering provenance decision: needs-review
+- Capability gate may be marked achieved: no
+- Public clean-room/proprietary claim approved by this review: no
+- Required follow-up: classify and run approved independent corpora, complete sustained fuzzing, collect contributor disclosures, perform independent source/security/color review, audit release and installed artifacts, reconcile xeno-lib, and attach counsel disposition.
+- Reviewer signature/date: pending
+- Counsel approval reference: pending

package/ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md

@@ -1,86 +1,86 @@
-# Clean-Room Implementation Record: Xeno PTY Runtime
-
-## Identity
-
-- Component: Xeno-owned native PTY binding, artifact loader, and UnifiedExec adapter
-- Replacement milestone: PROPRIETARY-PTY-1
-- Repository and paths: `xeno-agent-cli/apps/xeno-agent-cli/native/xeno-pty/`, `apps/xeno-agent-cli/src/terminal/xeno-pty-*.ts`
-- Record owner: Xeno engineering, final owner assignment pending
-- Implementer(s): Codex implementation assistant; human native-code review pending
-- Contract author(s): Xeno engineering requirements in `switch-to-proprietary.md`
-- Started at (UTC): 2026-07-12
-- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
-- Status: Windows x64, Linux x64, and Linux arm64 engineering complete; remaining architecture and release evidence incomplete
-
-## Frozen behavioral contract
-
-- Public API and observable behavior: spawn an interactive terminal with file, argument, cwd, environment, column, and row inputs; emit ordered UTF-8 data and exactly one exit event; accept input; resize; perform graceful interruption and forced process-tree termination.
-- Compatibility fixtures: `tests/xeno-pty-integration.test.ts`, `tests/xeno-pty-adapter.test.ts`, and `tests/xeno-pty-loader.test.ts`.
-- Intentional incompatibilities and versioning decision: the adapter reports `xeno-conpty` or `xeno-posix-pty`; unavailable platforms explicitly retain pipe mode and are not reported as interactive PTY support.
-- Security and resource limits: direct stable C N-API only; 256-event native queue with producer backpressure; 1 MiB pre-listener output cap; SHA-256 and Ed25519 trust verification before loading; Windows Job Object kill-on-close tree ownership.
-- Supported platforms and architectures: Windows x64, Linux x64, and Linux arm64 are implemented and locally verified. Windows arm64 and macOS x64/arm64 are configured but unobserved and remain outside the achieved capability gate.
-
-## Normative and permitted inputs
-
-| Source | Revision/date | Purpose | Terms reviewed by | Evidence path |
-| --- | --- | --- | --- | --- |
-| Xeno proprietary migration specification | 2026-07-12 | PTY behavior, ownership, packaging, and release constraints | Engineering; counsel pending | `switch-to-proprietary.md` |
-| Microsoft CreatePseudoConsole documentation | accessed 2026-07-12 | ConPTY stream, resize, and lifecycle contract | Engineering | `https://learn.microsoft.com/windows/console/createpseudoconsole` |
-| Microsoft Creating a Pseudoconsole Session documentation | updated 2025-08-13 | Pipe directions, STARTUPINFOEX, process creation, and close ordering | Engineering | `https://learn.microsoft.com/windows/console/creating-a-pseudoconsole-session` |
-| Microsoft CreateProcessW and Job Object documentation | accessed 2026-07-12 | Child startup handles and process-tree containment | Engineering | Microsoft Learn Win32 API documentation |
-| Linux man-pages `forkpty(3)`, `ioctl_tty(2)`, `setsid(2)`, and `kill(2)` | accessed 2026-07-12 | PTY creation, terminal resize, session/process-group ownership, and signal delivery | Engineering | public Linux man-pages documentation |
-| Node stable C N-API headers | Node 24.13.1, N-API v8 target | ABI contract without `node-addon-api` | Engineering | locally installed Node headers and public Node API documentation |
-| Xeno UnifiedExec contract | candidate working tree | Product-side PTY adapter behavior | Engineering | `xeno-agent-sdk/src/runtime/unified-exec.ts` |
-
-## Contributor source-exposure disclosure
-
-| Contributor | Inspected replaced source? | Date/range | Separation or review decision | Counsel reference |
-| --- | --- | --- | --- | --- |
-| Codex implementation assistant | No `node-pty` or `node-addon-api` implementation source was inspected. Work used Xeno contracts and Microsoft/Node public API documentation. | 2026-07-12 | Independent native and provenance review required | Pending |
-| Human contributors | Disclosure not yet collected | Pending | Must be completed before capability approval | Pending |
-
-## Implementation log
-
-| Date (UTC) | Decision | Contract/source basis | Author | Evidence path |
-| --- | --- | --- | --- | --- |
-| 2026-07-12 | Bind ConPTY directly through stable C N-API | FR-030 through FR-035 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_win.cpp` |
-| 2026-07-12 | Bind Linux/macOS PTY primitives directly through stable C N-API | FR-032 through FR-036 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_posix.cpp` |
-| 2026-07-12 | Own each POSIX PTY as a session/process group and drain output before settlement | complete-tree termination and exactly-once lifecycle contract | Codex implementation assistant | POSIX native source and integration tests |
-| 2026-07-12 | Null inherited standard handles before pseudoconsole attachment | Captured-output conformance and CreateProcess startup contract | Codex implementation assistant | `xeno_pty_win.cpp`, integration tests |
-| 2026-07-12 | Use one bounded ordered native event channel and StringDecoder bridge | FR-034 and FR-036 | Codex implementation assistant | native source and `xeno-pty-adapter.ts` |
-| 2026-07-12 | Join and destroy native state at exit settlement | Handle-lifecycle and exactly-once requirements | Codex implementation assistant | native diagnostics and 25-cycle soak |
-| 2026-07-12 | Verify ABI, hash, platform, architecture, and Ed25519 trust before load | FR-038 | Codex implementation assistant | `xeno-pty-loader.ts`, manifest signer |
-| 2026-07-12 | Forbid `node-pty` and `node-addon-api` reintroduction | Phase 3 dependency gate | Codex implementation assistant | ownership policy revision 5 |
-| 2026-07-12 | Resolve Windows N-API exports from the actual host process instead of importing `node.exe` | renamed/self-contained Node hosts must load the same owned addon safely | Codex implementation assistant | `xeno_pty_win.cpp`, PE import verifier, packaged Windows doctor smoke |
-| 2026-07-12 | Standardize release Windows builds on MSVC and reject non-platform PE imports | exclude GNU runtime linkage and undeclared auxiliary DLLs | Codex implementation assistant | `build-windows.ps1`, `verify-pe-imports.mjs` |
-
-## AI assistance
-
-- Models/tools used: OpenAI Codex coding agent, local PowerShell, Microsoft C/C++ 19.44, Node.js, Vitest, and an isolated Debian Docker verifier.
-- Prompt or retained prompt-summary path: active Xeno proprietary migration goal and `switch-to-proprietary.md`.
-- Confirmation that no third-party source entered the prompt: no replaced-package implementation source was supplied or inspected; public platform/API documentation and Xeno-owned contracts were used.
-- Human review performed: pending.
-
-## Verification evidence
-
-- Unit and compatibility tests: 13 focused tests pass on Windows; 12 execute and pass in a clean Linux Docker dependency environment with one Windows-only local-load assertion skipped.
-- Conformance corpus: TTY startup, ordered output, Unicode input/output, resize protocol, foreground-to-background PID preservation, Ctrl+C delivery, exactly-once exit, graceful-to-force escalation, early-output bound, descendant cleanup, tampered hash rejection, unsigned-install rejection.
-- Fuzz campaign and duration: deterministic malformed-input and lifecycle/state campaigns pass 100 iterations on the current Windows x64 artifact in 10.064 seconds, 100 iterations on Linux x64, 100 iterations on Linux arm64 under emulation, and 250 Linux x64 iterations under AddressSanitizer and UndefinedBehaviorSanitizer. Coverage-guided native fuzzing remains required before capability approval.
-- Security/resource-limit tests: finite native event queue, bounded early buffer, hash mismatch rejection, malformed manifest rejection, installed unsigned artifact rejection, and isolated Linux AddressSanitizer/UndefinedBehaviorSanitizer smoke plus stress execution.
-- Cross-platform results: Windows x64, Linux x64, and Linux arm64 local/container pass; Windows arm64 and macOS x64/arm64 matrix runs pending.
-- Performance comparison: 25 rapid real-PTY cycles pass with native active-state count returning to zero. The current Windows MSVC artifact measures startup p50/p95 35.31/359.15 ms and approximately 2.6 MB/s observed output; the Linux x64 baseline measures p50/p95 14.76/17.55 ms and approximately 32.6 MB/s. Linux arm64 under emulation measures p50/p95 556.17/612.07 ms and approximately 1.64 MB/s. The dependency-free benchmark enforces conservative CI limits of 2,000 ms p95 and 1 MiB/s; a product-approved comparative release envelope remains pending.
-- Bundle/native/SBOM evidence: artifact audit records Xeno-owned Windows x64 SHA-256 `91d9a464823091603d784cbc3a570b8a0e514576eeb4b8fb2aabcdcbb64bccad` from source SHA-256 `9f6f6248f35f2f6b767b153f66670d5ed8f95cb7d6242c77c652efe5cca2d038`, Linux x64 SHA-256 `a93757b552cb9236fe33773228072df270659d6a015a92fb96d21a9d22c5f2cb`, and Linux arm64 SHA-256 `07f660ac0c32ac7a2900f3abdfa12550f603880f02a1763a12a63064fe802006`; both Linux artifacts derive from source SHA-256 `6ba69e62cf0c0765546afa19f1820c1cc7f64f452802718c20b4a117d6c8f9c6`. The Windows PE imports only `KERNEL32.dll`; two local native rebuilds are byte-identical. Clean Debian candidates execute Linux x64 and Linux arm64 self-contained payloads. The exact cross-built Windows x64 payload (`21386d53c04116f4904da186c873089aac4db57c02281da2c14f615a50a9b616`) executes on Windows with a byte-matching extracted addon and healthy ConPTY diagnostics. The Linux arm64 payload SHA-256 is `92a8583433aec8415c1405b56ad5afe39f7560c216eac4e46684fb03041e6346`. Paired release verification correctly stops at the strict unsigned-native gate; see `docs/compliance/linux-package-candidate.md` and `docs/compliance/linux-arm64-package-candidate.md`. Clean signed-install smoke remains pending.
-
-## Open legal or provenance questions
-
-- Patents/specification terms: operating-system and Node API boundary review pending.
-- Trademarks: historical replaced-package names remain only in migration evidence and forbidden-package rules.
-- Export or distribution constraints: native binary distribution and signing review pending.
-- Other: release trust store is empty and both exercised prebuilds are intentionally marked `unsigned-development`; unobserved architecture CI, coverage-guided fuzzing, independent review, contributor disclosures, and counsel disposition remain mandatory.
-
-## Handoff
-
-- Implementation complete: Windows x64, Linux x64, and Linux arm64 yes; complete PTY milestone no
-- Evidence complete: no
-- Ready for independent provenance review: after signing, coverage-guided fuzzing, and remaining cross-platform package evidence
-- Author/date: Codex implementation assistant, 2026-07-12
+# Clean-Room Implementation Record: Xeno PTY Runtime
+
+## Identity
+
+- Component: Xeno-owned native PTY binding, artifact loader, and UnifiedExec adapter
+- Replacement milestone: PROPRIETARY-PTY-1
+- Repository and paths: `xeno-agent-cli/apps/xeno-agent-cli/native/xeno-pty/`, `apps/xeno-agent-cli/src/terminal/xeno-pty-*.ts`
+- Record owner: Xeno engineering, final owner assignment pending
+- Implementer(s): Codex implementation assistant; human native-code review pending
+- Contract author(s): Xeno engineering requirements in `switch-to-proprietary.md`
+- Started at (UTC): 2026-07-12
+- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
+- Status: Windows x64, Linux x64, and Linux arm64 engineering complete; remaining architecture and release evidence incomplete
+
+## Frozen behavioral contract
+
+- Public API and observable behavior: spawn an interactive terminal with file, argument, cwd, environment, column, and row inputs; emit ordered UTF-8 data and exactly one exit event; accept input; resize; perform graceful interruption and forced process-tree termination.
+- Compatibility fixtures: `tests/xeno-pty-integration.test.ts`, `tests/xeno-pty-adapter.test.ts`, and `tests/xeno-pty-loader.test.ts`.
+- Intentional incompatibilities and versioning decision: the adapter reports `xeno-conpty` or `xeno-posix-pty`; unavailable platforms explicitly retain pipe mode and are not reported as interactive PTY support.
+- Security and resource limits: direct stable C N-API only; 256-event native queue with producer backpressure; 1 MiB pre-listener output cap; SHA-256 and Ed25519 trust verification before loading; Windows Job Object kill-on-close tree ownership.
+- Supported platforms and architectures: Windows x64, Linux x64, and Linux arm64 are implemented and locally verified. Windows arm64 and macOS x64/arm64 are configured but unobserved and remain outside the achieved capability gate.
+
+## Normative and permitted inputs
+
+| Source | Revision/date | Purpose | Terms reviewed by | Evidence path |
+| --- | --- | --- | --- | --- |
+| Xeno proprietary migration specification | 2026-07-12 | PTY behavior, ownership, packaging, and release constraints | Engineering; counsel pending | `switch-to-proprietary.md` |
+| Microsoft CreatePseudoConsole documentation | accessed 2026-07-12 | ConPTY stream, resize, and lifecycle contract | Engineering | `https://learn.microsoft.com/windows/console/createpseudoconsole` |
+| Microsoft Creating a Pseudoconsole Session documentation | updated 2025-08-13 | Pipe directions, STARTUPINFOEX, process creation, and close ordering | Engineering | `https://learn.microsoft.com/windows/console/creating-a-pseudoconsole-session` |
+| Microsoft CreateProcessW and Job Object documentation | accessed 2026-07-12 | Child startup handles and process-tree containment | Engineering | Microsoft Learn Win32 API documentation |
+| Linux man-pages `forkpty(3)`, `ioctl_tty(2)`, `setsid(2)`, and `kill(2)` | accessed 2026-07-12 | PTY creation, terminal resize, session/process-group ownership, and signal delivery | Engineering | public Linux man-pages documentation |
+| Node stable C N-API headers | Node 24.13.1, N-API v8 target | ABI contract without `node-addon-api` | Engineering | locally installed Node headers and public Node API documentation |
+| Xeno UnifiedExec contract | candidate working tree | Product-side PTY adapter behavior | Engineering | `xeno-agent-sdk/src/runtime/unified-exec.ts` |
+
+## Contributor source-exposure disclosure
+
+| Contributor | Inspected replaced source? | Date/range | Separation or review decision | Counsel reference |
+| --- | --- | --- | --- | --- |
+| Codex implementation assistant | No `node-pty` or `node-addon-api` implementation source was inspected. Work used Xeno contracts and Microsoft/Node public API documentation. | 2026-07-12 | Independent native and provenance review required | Pending |
+| Human contributors | Disclosure not yet collected | Pending | Must be completed before capability approval | Pending |
+
+## Implementation log
+
+| Date (UTC) | Decision | Contract/source basis | Author | Evidence path |
+| --- | --- | --- | --- | --- |
+| 2026-07-12 | Bind ConPTY directly through stable C N-API | FR-030 through FR-035 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_win.cpp` |
+| 2026-07-12 | Bind Linux/macOS PTY primitives directly through stable C N-API | FR-032 through FR-036 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_posix.cpp` |
+| 2026-07-12 | Own each POSIX PTY as a session/process group and drain output before settlement | complete-tree termination and exactly-once lifecycle contract | Codex implementation assistant | POSIX native source and integration tests |
+| 2026-07-12 | Null inherited standard handles before pseudoconsole attachment | Captured-output conformance and CreateProcess startup contract | Codex implementation assistant | `xeno_pty_win.cpp`, integration tests |
+| 2026-07-12 | Use one bounded ordered native event channel and StringDecoder bridge | FR-034 and FR-036 | Codex implementation assistant | native source and `xeno-pty-adapter.ts` |
+| 2026-07-12 | Join and destroy native state at exit settlement | Handle-lifecycle and exactly-once requirements | Codex implementation assistant | native diagnostics and 25-cycle soak |
+| 2026-07-12 | Verify ABI, hash, platform, architecture, and Ed25519 trust before load | FR-038 | Codex implementation assistant | `xeno-pty-loader.ts`, manifest signer |
+| 2026-07-12 | Forbid `node-pty` and `node-addon-api` reintroduction | Phase 3 dependency gate | Codex implementation assistant | ownership policy revision 5 |
+| 2026-07-12 | Resolve Windows N-API exports from the actual host process instead of importing `node.exe` | renamed/self-contained Node hosts must load the same owned addon safely | Codex implementation assistant | `xeno_pty_win.cpp`, PE import verifier, packaged Windows doctor smoke |
+| 2026-07-12 | Standardize release Windows builds on MSVC and reject non-platform PE imports | exclude GNU runtime linkage and undeclared auxiliary DLLs | Codex implementation assistant | `build-windows.ps1`, `verify-pe-imports.mjs` |
+
+## AI assistance
+
+- Models/tools used: OpenAI Codex coding agent, local PowerShell, Microsoft C/C++ 19.44, Node.js, Vitest, and an isolated Debian Docker verifier.
+- Prompt or retained prompt-summary path: active Xeno proprietary migration goal and `switch-to-proprietary.md`.
+- Confirmation that no third-party source entered the prompt: no replaced-package implementation source was supplied or inspected; public platform/API documentation and Xeno-owned contracts were used.
+- Human review performed: pending.
+
+## Verification evidence
+
+- Unit and compatibility tests: 13 focused tests pass on Windows; 12 execute and pass in a clean Linux Docker dependency environment with one Windows-only local-load assertion skipped.
+- Conformance corpus: TTY startup, ordered output, Unicode input/output, resize protocol, foreground-to-background PID preservation, Ctrl+C delivery, exactly-once exit, graceful-to-force escalation, early-output bound, descendant cleanup, tampered hash rejection, unsigned-install rejection.
+- Fuzz campaign and duration: deterministic malformed-input and lifecycle/state campaigns pass 100 iterations on the current Windows x64 artifact in 10.064 seconds, 100 iterations on Linux x64, 100 iterations on Linux arm64 under emulation, and 250 Linux x64 iterations under AddressSanitizer and UndefinedBehaviorSanitizer. Coverage-guided native fuzzing remains required before capability approval.
+- Security/resource-limit tests: finite native event queue, bounded early buffer, hash mismatch rejection, malformed manifest rejection, installed unsigned artifact rejection, and isolated Linux AddressSanitizer/UndefinedBehaviorSanitizer smoke plus stress execution.
+- Cross-platform results: Windows x64, Linux x64, and Linux arm64 local/container pass; Windows arm64 and macOS x64/arm64 matrix runs pending.
+- Performance comparison: 25 rapid real-PTY cycles pass with native active-state count returning to zero. The current Windows MSVC artifact measures startup p50/p95 35.31/359.15 ms and approximately 2.6 MB/s observed output; the Linux x64 baseline measures p50/p95 14.76/17.55 ms and approximately 32.6 MB/s. Linux arm64 under emulation measures p50/p95 556.17/612.07 ms and approximately 1.64 MB/s. The dependency-free benchmark enforces conservative CI limits of 2,000 ms p95 and 1 MiB/s; a product-approved comparative release envelope remains pending.
+- Bundle/native/SBOM evidence: artifact audit records Xeno-owned Windows x64 SHA-256 `91d9a464823091603d784cbc3a570b8a0e514576eeb4b8fb2aabcdcbb64bccad` from source SHA-256 `9f6f6248f35f2f6b767b153f66670d5ed8f95cb7d6242c77c652efe5cca2d038`, Linux x64 SHA-256 `a93757b552cb9236fe33773228072df270659d6a015a92fb96d21a9d22c5f2cb`, and Linux arm64 SHA-256 `07f660ac0c32ac7a2900f3abdfa12550f603880f02a1763a12a63064fe802006`; both Linux artifacts derive from source SHA-256 `6ba69e62cf0c0765546afa19f1820c1cc7f64f452802718c20b4a117d6c8f9c6`. The Windows PE imports only `KERNEL32.dll`; two local native rebuilds are byte-identical. Clean Debian candidates execute Linux x64 and Linux arm64 self-contained payloads. The exact cross-built Windows x64 payload (`21386d53c04116f4904da186c873089aac4db57c02281da2c14f615a50a9b616`) executes on Windows with a byte-matching extracted addon and healthy ConPTY diagnostics. The Linux arm64 payload SHA-256 is `92a8583433aec8415c1405b56ad5afe39f7560c216eac4e46684fb03041e6346`. Paired release verification correctly stops at the strict unsigned-native gate; see `docs/compliance/linux-package-candidate.md` and `docs/compliance/linux-arm64-package-candidate.md`. Clean signed-install smoke remains pending.
+
+## Open legal or provenance questions
+
+- Patents/specification terms: operating-system and Node API boundary review pending.
+- Trademarks: historical replaced-package names remain only in migration evidence and forbidden-package rules.
+- Export or distribution constraints: native binary distribution and signing review pending.
+- Other: release trust store is empty and both exercised prebuilds are intentionally marked `unsigned-development`; unobserved architecture CI, coverage-guided fuzzing, independent review, contributor disclosures, and counsel disposition remain mandatory.
+
+## Handoff
+
+- Implementation complete: Windows x64, Linux x64, and Linux arm64 yes; complete PTY milestone no
+- Evidence complete: no
+- Ready for independent provenance review: after signing, coverage-guided fuzzing, and remaining cross-platform package evidence
+- Author/date: Codex implementation assistant, 2026-07-12