@xenosystem/agent-sdk 0.9.11 → 0.9.14

package/ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md

@@ -1,86 +1,86 @@
-# Clean-Room Implementation Record: Xeno PTY Runtime
-
-## Identity
-
-- Component: Xeno-owned native PTY binding, artifact loader, and UnifiedExec adapter
-- Replacement milestone: PROPRIETARY-PTY-1
-- Repository and paths: `xeno-agent-cli/apps/xeno-agent-cli/native/xeno-pty/`, `apps/xeno-agent-cli/src/terminal/xeno-pty-*.ts`
-- Record owner: Xeno engineering, final owner assignment pending
-- Implementer(s): Codex implementation assistant; human native-code review pending
-- Contract author(s): Xeno engineering requirements in `switch-to-proprietary.md`
-- Started at (UTC): 2026-07-12
-- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
-- Status: Windows x64, Linux x64, and Linux arm64 engineering complete; remaining architecture and release evidence incomplete
-
-## Frozen behavioral contract
-
-- Public API and observable behavior: spawn an interactive terminal with file, argument, cwd, environment, column, and row inputs; emit ordered UTF-8 data and exactly one exit event; accept input; resize; perform graceful interruption and forced process-tree termination.
-- Compatibility fixtures: `tests/xeno-pty-integration.test.ts`, `tests/xeno-pty-adapter.test.ts`, and `tests/xeno-pty-loader.test.ts`.
-- Intentional incompatibilities and versioning decision: the adapter reports `xeno-conpty` or `xeno-posix-pty`; unavailable platforms explicitly retain pipe mode and are not reported as interactive PTY support.
-- Security and resource limits: direct stable C N-API only; 256-event native queue with producer backpressure; 1 MiB pre-listener output cap; SHA-256 and Ed25519 trust verification before loading; Windows Job Object kill-on-close tree ownership.
-- Supported platforms and architectures: Windows x64, Linux x64, and Linux arm64 are implemented and locally verified. Windows arm64 and macOS x64/arm64 are configured but unobserved and remain outside the achieved capability gate.
-
-## Normative and permitted inputs
-
-| Source | Revision/date | Purpose | Terms reviewed by | Evidence path |
-| --- | --- | --- | --- | --- |
-| Xeno proprietary migration specification | 2026-07-12 | PTY behavior, ownership, packaging, and release constraints | Engineering; counsel pending | `switch-to-proprietary.md` |
-| Microsoft CreatePseudoConsole documentation | accessed 2026-07-12 | ConPTY stream, resize, and lifecycle contract | Engineering | `https://learn.microsoft.com/windows/console/createpseudoconsole` |
-| Microsoft Creating a Pseudoconsole Session documentation | updated 2025-08-13 | Pipe directions, STARTUPINFOEX, process creation, and close ordering | Engineering | `https://learn.microsoft.com/windows/console/creating-a-pseudoconsole-session` |
-| Microsoft CreateProcessW and Job Object documentation | accessed 2026-07-12 | Child startup handles and process-tree containment | Engineering | Microsoft Learn Win32 API documentation |
-| Linux man-pages `forkpty(3)`, `ioctl_tty(2)`, `setsid(2)`, and `kill(2)` | accessed 2026-07-12 | PTY creation, terminal resize, session/process-group ownership, and signal delivery | Engineering | public Linux man-pages documentation |
-| Node stable C N-API headers | Node 24.13.1, N-API v8 target | ABI contract without `node-addon-api` | Engineering | locally installed Node headers and public Node API documentation |
-| Xeno UnifiedExec contract | candidate working tree | Product-side PTY adapter behavior | Engineering | `xeno-agent-sdk/src/runtime/unified-exec.ts` |
-
-## Contributor source-exposure disclosure
-
-| Contributor | Inspected replaced source? | Date/range | Separation or review decision | Counsel reference |
-| --- | --- | --- | --- | --- |
-| Codex implementation assistant | No `node-pty` or `node-addon-api` implementation source was inspected. Work used Xeno contracts and Microsoft/Node public API documentation. | 2026-07-12 | Independent native and provenance review required | Pending |
-| Human contributors | Disclosure not yet collected | Pending | Must be completed before capability approval | Pending |
-
-## Implementation log
-
-| Date (UTC) | Decision | Contract/source basis | Author | Evidence path |
-| --- | --- | --- | --- | --- |
-| 2026-07-12 | Bind ConPTY directly through stable C N-API | FR-030 through FR-035 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_win.cpp` |
-| 2026-07-12 | Bind Linux/macOS PTY primitives directly through stable C N-API | FR-032 through FR-036 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_posix.cpp` |
-| 2026-07-12 | Own each POSIX PTY as a session/process group and drain output before settlement | complete-tree termination and exactly-once lifecycle contract | Codex implementation assistant | POSIX native source and integration tests |
-| 2026-07-12 | Null inherited standard handles before pseudoconsole attachment | Captured-output conformance and CreateProcess startup contract | Codex implementation assistant | `xeno_pty_win.cpp`, integration tests |
-| 2026-07-12 | Use one bounded ordered native event channel and StringDecoder bridge | FR-034 and FR-036 | Codex implementation assistant | native source and `xeno-pty-adapter.ts` |
-| 2026-07-12 | Join and destroy native state at exit settlement | Handle-lifecycle and exactly-once requirements | Codex implementation assistant | native diagnostics and 25-cycle soak |
-| 2026-07-12 | Verify ABI, hash, platform, architecture, and Ed25519 trust before load | FR-038 | Codex implementation assistant | `xeno-pty-loader.ts`, manifest signer |
-| 2026-07-12 | Forbid `node-pty` and `node-addon-api` reintroduction | Phase 3 dependency gate | Codex implementation assistant | ownership policy revision 5 |
-| 2026-07-12 | Resolve Windows N-API exports from the actual host process instead of importing `node.exe` | renamed/self-contained Node hosts must load the same owned addon safely | Codex implementation assistant | `xeno_pty_win.cpp`, PE import verifier, packaged Windows doctor smoke |
-| 2026-07-12 | Standardize release Windows builds on MSVC and reject non-platform PE imports | exclude GNU runtime linkage and undeclared auxiliary DLLs | Codex implementation assistant | `build-windows.ps1`, `verify-pe-imports.mjs` |
-
-## AI assistance
-
-- Models/tools used: OpenAI Codex coding agent, local PowerShell, Microsoft C/C++ 19.44, Node.js, Vitest, and an isolated Debian Docker verifier.
-- Prompt or retained prompt-summary path: active Xeno proprietary migration goal and `switch-to-proprietary.md`.
-- Confirmation that no third-party source entered the prompt: no replaced-package implementation source was supplied or inspected; public platform/API documentation and Xeno-owned contracts were used.
-- Human review performed: pending.
-
-## Verification evidence
-
-- Unit and compatibility tests: 13 focused tests pass on Windows; 12 execute and pass in a clean Linux Docker dependency environment with one Windows-only local-load assertion skipped.
-- Conformance corpus: TTY startup, ordered output, Unicode input/output, resize protocol, foreground-to-background PID preservation, Ctrl+C delivery, exactly-once exit, graceful-to-force escalation, early-output bound, descendant cleanup, tampered hash rejection, unsigned-install rejection.
-- Fuzz campaign and duration: deterministic malformed-input and lifecycle/state campaigns pass 100 iterations on the current Windows x64 artifact in 10.064 seconds, 100 iterations on Linux x64, 100 iterations on Linux arm64 under emulation, and 250 Linux x64 iterations under AddressSanitizer and UndefinedBehaviorSanitizer. Coverage-guided native fuzzing remains required before capability approval.
-- Security/resource-limit tests: finite native event queue, bounded early buffer, hash mismatch rejection, malformed manifest rejection, installed unsigned artifact rejection, and isolated Linux AddressSanitizer/UndefinedBehaviorSanitizer smoke plus stress execution.
-- Cross-platform results: Windows x64, Linux x64, and Linux arm64 local/container pass; Windows arm64 and macOS x64/arm64 matrix runs pending.
-- Performance comparison: 25 rapid real-PTY cycles pass with native active-state count returning to zero. The current Windows MSVC artifact measures startup p50/p95 35.31/359.15 ms and approximately 2.6 MB/s observed output; the Linux x64 baseline measures p50/p95 14.76/17.55 ms and approximately 32.6 MB/s. Linux arm64 under emulation measures p50/p95 556.17/612.07 ms and approximately 1.64 MB/s. The dependency-free benchmark enforces conservative CI limits of 2,000 ms p95 and 1 MiB/s; a product-approved comparative release envelope remains pending.
-- Bundle/native/SBOM evidence: artifact audit records Xeno-owned Windows x64 SHA-256 `91d9a464823091603d784cbc3a570b8a0e514576eeb4b8fb2aabcdcbb64bccad` from source SHA-256 `9f6f6248f35f2f6b767b153f66670d5ed8f95cb7d6242c77c652efe5cca2d038`, Linux x64 SHA-256 `a93757b552cb9236fe33773228072df270659d6a015a92fb96d21a9d22c5f2cb`, and Linux arm64 SHA-256 `07f660ac0c32ac7a2900f3abdfa12550f603880f02a1763a12a63064fe802006`; both Linux artifacts derive from source SHA-256 `6ba69e62cf0c0765546afa19f1820c1cc7f64f452802718c20b4a117d6c8f9c6`. The Windows PE imports only `KERNEL32.dll`; two local native rebuilds are byte-identical. Clean Debian candidates execute Linux x64 and Linux arm64 self-contained payloads. The exact cross-built Windows x64 payload (`21386d53c04116f4904da186c873089aac4db57c02281da2c14f615a50a9b616`) executes on Windows with a byte-matching extracted addon and healthy ConPTY diagnostics. The Linux arm64 payload SHA-256 is `92a8583433aec8415c1405b56ad5afe39f7560c216eac4e46684fb03041e6346`. Paired release verification correctly stops at the strict unsigned-native gate; see `docs/compliance/linux-package-candidate.md` and `docs/compliance/linux-arm64-package-candidate.md`. Clean signed-install smoke remains pending.
-
-## Open legal or provenance questions
-
-- Patents/specification terms: operating-system and Node API boundary review pending.
-- Trademarks: historical replaced-package names remain only in migration evidence and forbidden-package rules.
-- Export or distribution constraints: native binary distribution and signing review pending.
-- Other: release trust store is empty and both exercised prebuilds are intentionally marked `unsigned-development`; unobserved architecture CI, coverage-guided fuzzing, independent review, contributor disclosures, and counsel disposition remain mandatory.
-
-## Handoff
-
-- Implementation complete: Windows x64, Linux x64, and Linux arm64 yes; complete PTY milestone no
-- Evidence complete: no
-- Ready for independent provenance review: after signing, coverage-guided fuzzing, and remaining cross-platform package evidence
-- Author/date: Codex implementation assistant, 2026-07-12
+# Clean-Room Implementation Record: Xeno PTY Runtime
+
+## Identity
+
+- Component: Xeno-owned native PTY binding, artifact loader, and UnifiedExec adapter
+- Replacement milestone: PROPRIETARY-PTY-1
+- Repository and paths: `xeno-agent-cli/apps/xeno-agent-cli/native/xeno-pty/`, `apps/xeno-agent-cli/src/terminal/xeno-pty-*.ts`
+- Record owner: Xeno engineering, final owner assignment pending
+- Implementer(s): Codex implementation assistant; human native-code review pending
+- Contract author(s): Xeno engineering requirements in `switch-to-proprietary.md`
+- Started at (UTC): 2026-07-12
+- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
+- Status: Windows x64, Linux x64, and Linux arm64 engineering complete; remaining architecture and release evidence incomplete
+
+## Frozen behavioral contract
+
+- Public API and observable behavior: spawn an interactive terminal with file, argument, cwd, environment, column, and row inputs; emit ordered UTF-8 data and exactly one exit event; accept input; resize; perform graceful interruption and forced process-tree termination.
+- Compatibility fixtures: `tests/xeno-pty-integration.test.ts`, `tests/xeno-pty-adapter.test.ts`, and `tests/xeno-pty-loader.test.ts`.
+- Intentional incompatibilities and versioning decision: the adapter reports `xeno-conpty` or `xeno-posix-pty`; unavailable platforms explicitly retain pipe mode and are not reported as interactive PTY support.
+- Security and resource limits: direct stable C N-API only; 256-event native queue with producer backpressure; 1 MiB pre-listener output cap; SHA-256 and Ed25519 trust verification before loading; Windows Job Object kill-on-close tree ownership.
+- Supported platforms and architectures: Windows x64, Linux x64, and Linux arm64 are implemented and locally verified. Windows arm64 and macOS x64/arm64 are configured but unobserved and remain outside the achieved capability gate.
+
+## Normative and permitted inputs
+
+| Source | Revision/date | Purpose | Terms reviewed by | Evidence path |
+| --- | --- | --- | --- | --- |
+| Xeno proprietary migration specification | 2026-07-12 | PTY behavior, ownership, packaging, and release constraints | Engineering; counsel pending | `switch-to-proprietary.md` |
+| Microsoft CreatePseudoConsole documentation | accessed 2026-07-12 | ConPTY stream, resize, and lifecycle contract | Engineering | `https://learn.microsoft.com/windows/console/createpseudoconsole` |
+| Microsoft Creating a Pseudoconsole Session documentation | updated 2025-08-13 | Pipe directions, STARTUPINFOEX, process creation, and close ordering | Engineering | `https://learn.microsoft.com/windows/console/creating-a-pseudoconsole-session` |
+| Microsoft CreateProcessW and Job Object documentation | accessed 2026-07-12 | Child startup handles and process-tree containment | Engineering | Microsoft Learn Win32 API documentation |
+| Linux man-pages `forkpty(3)`, `ioctl_tty(2)`, `setsid(2)`, and `kill(2)` | accessed 2026-07-12 | PTY creation, terminal resize, session/process-group ownership, and signal delivery | Engineering | public Linux man-pages documentation |
+| Node stable C N-API headers | Node 24.13.1, N-API v8 target | ABI contract without `node-addon-api` | Engineering | locally installed Node headers and public Node API documentation |
+| Xeno UnifiedExec contract | candidate working tree | Product-side PTY adapter behavior | Engineering | `xeno-agent-sdk/src/runtime/unified-exec.ts` |
+
+## Contributor source-exposure disclosure
+
+| Contributor | Inspected replaced source? | Date/range | Separation or review decision | Counsel reference |
+| --- | --- | --- | --- | --- |
+| Codex implementation assistant | No `node-pty` or `node-addon-api` implementation source was inspected. Work used Xeno contracts and Microsoft/Node public API documentation. | 2026-07-12 | Independent native and provenance review required | Pending |
+| Human contributors | Disclosure not yet collected | Pending | Must be completed before capability approval | Pending |
+
+## Implementation log
+
+| Date (UTC) | Decision | Contract/source basis | Author | Evidence path |
+| --- | --- | --- | --- | --- |
+| 2026-07-12 | Bind ConPTY directly through stable C N-API | FR-030 through FR-035 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_win.cpp` |
+| 2026-07-12 | Bind Linux/macOS PTY primitives directly through stable C N-API | FR-032 through FR-036 | Codex implementation assistant | `native/xeno-pty/src/xeno_pty_posix.cpp` |
+| 2026-07-12 | Own each POSIX PTY as a session/process group and drain output before settlement | complete-tree termination and exactly-once lifecycle contract | Codex implementation assistant | POSIX native source and integration tests |
+| 2026-07-12 | Null inherited standard handles before pseudoconsole attachment | Captured-output conformance and CreateProcess startup contract | Codex implementation assistant | `xeno_pty_win.cpp`, integration tests |
+| 2026-07-12 | Use one bounded ordered native event channel and StringDecoder bridge | FR-034 and FR-036 | Codex implementation assistant | native source and `xeno-pty-adapter.ts` |
+| 2026-07-12 | Join and destroy native state at exit settlement | Handle-lifecycle and exactly-once requirements | Codex implementation assistant | native diagnostics and 25-cycle soak |
+| 2026-07-12 | Verify ABI, hash, platform, architecture, and Ed25519 trust before load | FR-038 | Codex implementation assistant | `xeno-pty-loader.ts`, manifest signer |
+| 2026-07-12 | Forbid `node-pty` and `node-addon-api` reintroduction | Phase 3 dependency gate | Codex implementation assistant | ownership policy revision 5 |
+| 2026-07-12 | Resolve Windows N-API exports from the actual host process instead of importing `node.exe` | renamed/self-contained Node hosts must load the same owned addon safely | Codex implementation assistant | `xeno_pty_win.cpp`, PE import verifier, packaged Windows doctor smoke |
+| 2026-07-12 | Standardize release Windows builds on MSVC and reject non-platform PE imports | exclude GNU runtime linkage and undeclared auxiliary DLLs | Codex implementation assistant | `build-windows.ps1`, `verify-pe-imports.mjs` |
+
+## AI assistance
+
+- Models/tools used: OpenAI Codex coding agent, local PowerShell, Microsoft C/C++ 19.44, Node.js, Vitest, and an isolated Debian Docker verifier.
+- Prompt or retained prompt-summary path: active Xeno proprietary migration goal and `switch-to-proprietary.md`.
+- Confirmation that no third-party source entered the prompt: no replaced-package implementation source was supplied or inspected; public platform/API documentation and Xeno-owned contracts were used.
+- Human review performed: pending.
+
+## Verification evidence
+
+- Unit and compatibility tests: 13 focused tests pass on Windows; 12 execute and pass in a clean Linux Docker dependency environment with one Windows-only local-load assertion skipped.
+- Conformance corpus: TTY startup, ordered output, Unicode input/output, resize protocol, foreground-to-background PID preservation, Ctrl+C delivery, exactly-once exit, graceful-to-force escalation, early-output bound, descendant cleanup, tampered hash rejection, unsigned-install rejection.
+- Fuzz campaign and duration: deterministic malformed-input and lifecycle/state campaigns pass 100 iterations on the current Windows x64 artifact in 10.064 seconds, 100 iterations on Linux x64, 100 iterations on Linux arm64 under emulation, and 250 Linux x64 iterations under AddressSanitizer and UndefinedBehaviorSanitizer. Coverage-guided native fuzzing remains required before capability approval.
+- Security/resource-limit tests: finite native event queue, bounded early buffer, hash mismatch rejection, malformed manifest rejection, installed unsigned artifact rejection, and isolated Linux AddressSanitizer/UndefinedBehaviorSanitizer smoke plus stress execution.
+- Cross-platform results: Windows x64, Linux x64, and Linux arm64 local/container pass; Windows arm64 and macOS x64/arm64 matrix runs pending.
+- Performance comparison: 25 rapid real-PTY cycles pass with native active-state count returning to zero. The current Windows MSVC artifact measures startup p50/p95 35.31/359.15 ms and approximately 2.6 MB/s observed output; the Linux x64 baseline measures p50/p95 14.76/17.55 ms and approximately 32.6 MB/s. Linux arm64 under emulation measures p50/p95 556.17/612.07 ms and approximately 1.64 MB/s. The dependency-free benchmark enforces conservative CI limits of 2,000 ms p95 and 1 MiB/s; a product-approved comparative release envelope remains pending.
+- Bundle/native/SBOM evidence: artifact audit records Xeno-owned Windows x64 SHA-256 `91d9a464823091603d784cbc3a570b8a0e514576eeb4b8fb2aabcdcbb64bccad` from source SHA-256 `9f6f6248f35f2f6b767b153f66670d5ed8f95cb7d6242c77c652efe5cca2d038`, Linux x64 SHA-256 `a93757b552cb9236fe33773228072df270659d6a015a92fb96d21a9d22c5f2cb`, and Linux arm64 SHA-256 `07f660ac0c32ac7a2900f3abdfa12550f603880f02a1763a12a63064fe802006`; both Linux artifacts derive from source SHA-256 `6ba69e62cf0c0765546afa19f1820c1cc7f64f452802718c20b4a117d6c8f9c6`. The Windows PE imports only `KERNEL32.dll`; two local native rebuilds are byte-identical. Clean Debian candidates execute Linux x64 and Linux arm64 self-contained payloads. The exact cross-built Windows x64 payload (`21386d53c04116f4904da186c873089aac4db57c02281da2c14f615a50a9b616`) executes on Windows with a byte-matching extracted addon and healthy ConPTY diagnostics. The Linux arm64 payload SHA-256 is `92a8583433aec8415c1405b56ad5afe39f7560c216eac4e46684fb03041e6346`. Paired release verification correctly stops at the strict unsigned-native gate; see `docs/compliance/linux-package-candidate.md` and `docs/compliance/linux-arm64-package-candidate.md`. Clean signed-install smoke remains pending.
+
+## Open legal or provenance questions
+
+- Patents/specification terms: operating-system and Node API boundary review pending.
+- Trademarks: historical replaced-package names remain only in migration evidence and forbidden-package rules.
+- Export or distribution constraints: native binary distribution and signing review pending.
+- Other: release trust store is empty and both exercised prebuilds are intentionally marked `unsigned-development`; unobserved architecture CI, coverage-guided fuzzing, independent review, contributor disclosures, and counsel disposition remain mandatory.
+
+## Handoff
+
+- Implementation complete: Windows x64, Linux x64, and Linux arm64 yes; complete PTY milestone no
+- Evidence complete: no
+- Ready for independent provenance review: after signing, coverage-guided fuzzing, and remaining cross-platform package evidence
+- Author/date: Codex implementation assistant, 2026-07-12

package/ownership/evidence/PROPRIETARY-PTY-1/provenance-review.md

@@ -1,52 +1,52 @@
-# Independent Provenance Review: Xeno PTY Runtime
-
-## Review identity
-
-- Component: Xeno-owned native PTY runtime
-- Replacement milestone: PROPRIETARY-PTY-1
-- Implementation record path: `ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md`
-- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
-- Reviewer: pending
-- Domain reviewer (required): pending native/runtime security reviewer
-- Review date (UTC): pending
-- Reviewer independent of implementation: pending
-
-## Evidence checks
-
-- [ ] Behavioral contract predates or is independent from implementation work.
-- [ ] Normative and public sources are listed with revisions and evidence paths.
-- [ ] Contributor source-exposure disclosures are complete.
-- [ ] Required separation/counsel decisions are attached.
-- [ ] No copied source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
-- [ ] AI inputs and human review satisfy the contributor guide.
-- [ ] Intentional incompatibilities are approved and versioned.
-- [ ] Conformance, malformed-input, security, resource-limit, and fuzz evidence meets the component gate.
-- [ ] Bundle graph, native hashes, SBOM, ownership inventory, and clean-install graph agree.
-- [ ] Licenses, patents, trademarks, and specification terms have an explicit disposition.
-
-## Similarity and provenance review method
-
-- Files and revisions reviewed: pending
-- Comparison method and tools: pending
-- Findings: pending
-- False positives and disposition: pending
-
-## Verification summary
-
-| Gate | Evidence | Result | Notes |
-| --- | --- | --- | --- |
-| Windows contract compatibility | focused PTY unit/integration suite | engineering pass | 13 tests, independent rerun pending |
-| Security/resource limits | bounded queue/buffer, hash and manifest rejection, Job Object tree cleanup, Linux ASan/UBSan campaign | engineering pass | independent native security review and coverage-guided fuzzing pending |
-| Lifecycle/soak | 25 integration cycles plus 100 Windows, 100 Linux, and 250 sanitized Linux stress iterations; active native state returns to zero | engineering pass | longer soak and platform handle tooling pending |
-| Performance envelope | dependency-free startup/throughput benchmark | engineering pass | Windows p95 42.08 ms / ~8.7 MB/s; Linux p95 17.55 ms / ~32.6 MB/s; product approval pending |
-| Cross-platform | Windows x64 and Linux x64 | partial | 12 Linux tests pass with one Windows-only assertion skipped; Windows/Linux ARM64 and macOS matrix evidence pending |
-| Artifact ownership | ownership audit and dry-run tarball | partial | unsigned development binary; signed clean install pending |
-
-## Decision
-
-- Engineering provenance decision: needs-work
-- Capability gate may be marked achieved: no
-- Public clean-room/proprietary claim approved by this review: no
-- Required follow-up: produce and observe the remaining claimed-architecture prebuilds, sign with an approved release key, run native fuzz/sanitizer and performance campaigns, collect contributor disclosures, assign independent reviewers, and attach counsel disposition.
-- Reviewer signature/date: pending
-- Counsel approval reference (required for public claim): pending
+# Independent Provenance Review: Xeno PTY Runtime
+
+## Review identity
+
+- Component: Xeno-owned native PTY runtime
+- Replacement milestone: PROPRIETARY-PTY-1
+- Implementation record path: `ownership/evidence/PROPRIETARY-PTY-1/implementation-record.md`
+- Candidate revision: `87ae64b55aa1b8c2e126294e717b229e0945db65` plus recorded working-tree changes
+- Reviewer: pending
+- Domain reviewer (required): pending native/runtime security reviewer
+- Review date (UTC): pending
+- Reviewer independent of implementation: pending
+
+## Evidence checks
+
+- [ ] Behavioral contract predates or is independent from implementation work.
+- [ ] Normative and public sources are listed with revisions and evidence paths.
+- [ ] Contributor source-exposure disclosures are complete.
+- [ ] Required separation/counsel decisions are attached.
+- [ ] No copied source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
+- [ ] AI inputs and human review satisfy the contributor guide.
+- [ ] Intentional incompatibilities are approved and versioned.
+- [ ] Conformance, malformed-input, security, resource-limit, and fuzz evidence meets the component gate.
+- [ ] Bundle graph, native hashes, SBOM, ownership inventory, and clean-install graph agree.
+- [ ] Licenses, patents, trademarks, and specification terms have an explicit disposition.
+
+## Similarity and provenance review method
+
+- Files and revisions reviewed: pending
+- Comparison method and tools: pending
+- Findings: pending
+- False positives and disposition: pending
+
+## Verification summary
+
+| Gate | Evidence | Result | Notes |
+| --- | --- | --- | --- |
+| Windows contract compatibility | focused PTY unit/integration suite | engineering pass | 13 tests, independent rerun pending |
+| Security/resource limits | bounded queue/buffer, hash and manifest rejection, Job Object tree cleanup, Linux ASan/UBSan campaign | engineering pass | independent native security review and coverage-guided fuzzing pending |
+| Lifecycle/soak | 25 integration cycles plus 100 Windows, 100 Linux, and 250 sanitized Linux stress iterations; active native state returns to zero | engineering pass | longer soak and platform handle tooling pending |
+| Performance envelope | dependency-free startup/throughput benchmark | engineering pass | Windows p95 42.08 ms / ~8.7 MB/s; Linux p95 17.55 ms / ~32.6 MB/s; product approval pending |
+| Cross-platform | Windows x64 and Linux x64 | partial | 12 Linux tests pass with one Windows-only assertion skipped; Windows/Linux ARM64 and macOS matrix evidence pending |
+| Artifact ownership | ownership audit and dry-run tarball | partial | unsigned development binary; signed clean install pending |
+
+## Decision
+
+- Engineering provenance decision: needs-work
+- Capability gate may be marked achieved: no
+- Public clean-room/proprietary claim approved by this review: no
+- Required follow-up: produce and observe the remaining claimed-architecture prebuilds, sign with an approved release key, run native fuzz/sanitizer and performance campaigns, collect contributor disclosures, assign independent reviewers, and attach counsel disposition.
+- Reviewer signature/date: pending
+- Counsel approval reference (required for public claim): pending

package/ownership/evidence/PROPRIETARY-RUNTIME-1/implementation-record.md

@@ -1,68 +1,68 @@
-# Runtime Boundary Decision Record: Current Xeno CLI Distributions
-
-## Identity
-
-- Component: npm Node-host profile and self-contained external-runtime profiles
-- Replacement milestone: PROPRIETARY-RUNTIME-1
-- Repository and paths: `xeno-agent-cli/scripts/build-standalone.mjs`, compatibility shell wrapper, `scripts/audit-self-contained-runtime.mjs`, release workflow, install scripts, and runtime-boundary documentation
-- Record owner: Xeno engineering, final owner assignment pending
-- Decision date (UTC): 2026-07-12
-- Status: Phase 6 decision complete; P3 explicitly declined for the current architecture and release series
-
-## Decision
-
-- The supported npm profile requires a separately installed Node.js 20 or newer host.
-- The `pkg` self-contained profile embeds Node.js, including the Node V8, libuv, OpenSSL, and zlib runtime boundary.
-- The Bun self-contained profile embeds the third-party Bun runtime and its transitive runtime components.
-- All three profiles have a maximum ownership claim of P2 after the separate P1/P2 capability and provenance gates pass.
-- The `owned-standalone-runtime` P3 capability remains `achieved: false`.
-- Current self-contained assets may not be described as P3, fully proprietary, 100% Xeno-owned, native-owned, or free of third-party runtime code.
-- Replacing `pkg` with another third-party packager or embedded runtime does not advance P3.
-
-## Installer and Packaging Audit
-
-| Surface | Actual behavior | Runtime boundary | Claim disposition |
-| --- | --- | --- | --- |
-| `scripts/install.sh` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
-| `scripts/install.ps1` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
-| `build-standalone.mjs pkg` | Compiles self-contained platform payloads with pinned `pkg` through an owned cross-platform orchestrator | Embedded Node/V8/libuv/OpenSSL/zlib | External embedded runtime; not P3 |
-| `build-standalone.mjs bun` | Compiles self-contained platform payloads with a preinstalled Bun through the same orchestrator | Embedded Bun and transitive runtime | External embedded runtime; not P3 |
-| GitHub `cli-v*` release | Publishes payloads, archives, runtime manifest, and checksums | Profile declared by `RUNTIME-BOUNDARY.json` | Release notes must state external runtime and not P3 |
-
-## Enforcement
-
-- `scripts/audit-self-contained-runtime.mjs` hashes every raw self-contained payload and writes a deterministic `RUNTIME-BOUNDARY.json`.
-- Verification fails for a missing payload, unknown packaging mode, changed payload hash, changed manifest, or ownership ceiling above P2.
-- The build script cleans the release staging directory so Bun and Node profiles cannot be mixed.
-- Target validation fails closed unless the corresponding audited PTY manifest and native payload exist.
-- Before `pkg` runs, the owned orchestrator invokes the pinned `pkg-fetch` entry point with `--force-fetch`; existing/downloaded bases must match the packager's expected SHA-256, and fetch failures terminate explicitly instead of falling back to an implicit Node.js source build.
-- The owned orchestrator writes normalized ZIP/TAR archives and SHA-256 records without Bash, `npx`, or external archive/checksum utilities.
-- The release workflow verifies the runtime manifest before uploading assets.
-- `SHA256SUMS.txt` is generated after the runtime manifest and therefore covers the claim record as well as payloads and archives.
-- Compatibility labels `standalone` and `native` remain in scripts/environment values, but documentation defines them as self-contained distribution labels rather than ownership claims.
-
-## Verification Evidence
-
-- Runtime-boundary self-test creates a synthetic PE payload, writes and verifies the Node profile, mutates the payload, and confirms verification rejects it.
-- Focused install-documentation tests assert the profile scripts, workflow gate, manifest name, and not-P3 language.
-- A clean Debian Node 24.18.0 run builds the exact SDK and CLI candidates, packages Linux x64 and Windows x64, executes and verifies the Linux payload, and reaches only the required unsigned-native release blocker.
-- A clean Debian Linux arm64 run under QEMU builds the exact SDK and CLI candidates, packages and executes `xeno-linux-arm64`, verifies owned PTY/preview plus bubblewrap containment, and reaches only the required unsigned-native release blocker. See `docs/compliance/linux-arm64-package-candidate.md`.
-- Focused packaging tests verify Linux arm64 and Windows arm64 base-prefetch arguments plus unsupported-target rejection. A transient GitHub `503` was reproduced as the historical trigger for implicit source compilation; the new preflight converts that condition into a bounded explicit failure.
-- The exact clean cross-built Windows payload executes under its real `xeno-win-x64.exe` name with healthy process-tree, ConPTY, owned-preview, and ownership-policy diagnostics.
-- Two consecutive same-environment Windows runs produce byte-identical executable, ZIP, runtime manifest, and checksum files. Independent-environment reproducibility remains a P4 gate.
-- CLI build, typecheck, release-package smoke, compliance, and artifact inventory must still pass for each release candidate.
-- No current release artifact was published by this implementation work.
-
-## P3 Reconsideration Gate
-
-P3 requires either an owned native runtime rewrite or a sustained Xeno-owned JavaScript-compatible runtime, followed by cross-platform conformance, deterministic artifacts, provenance, SBOM, signing, and independent review. It is a separate multi-year program and is not part of the current P2 release target.
-
-## Handoff
-
-- Phase 6 decision complete: yes
-- P3 implementation complete: no
-- P3 evidence complete: no
-- P3 capability gate may be marked achieved: no
-- Public not-P3 boundary ready for engineering use: yes
-- Counsel/public ownership approval: pending
-- Author/date: Codex implementation assistant, 2026-07-12
+# Runtime Boundary Decision Record: Current Xeno CLI Distributions
+
+## Identity
+
+- Component: npm Node-host profile and self-contained external-runtime profiles
+- Replacement milestone: PROPRIETARY-RUNTIME-1
+- Repository and paths: `xeno-agent-cli/scripts/build-standalone.mjs`, compatibility shell wrapper, `scripts/audit-self-contained-runtime.mjs`, release workflow, install scripts, and runtime-boundary documentation
+- Record owner: Xeno engineering, final owner assignment pending
+- Decision date (UTC): 2026-07-12
+- Status: Phase 6 decision complete; P3 explicitly declined for the current architecture and release series
+
+## Decision
+
+- The supported npm profile requires a separately installed Node.js 20 or newer host.
+- The `pkg` self-contained profile embeds Node.js, including the Node V8, libuv, OpenSSL, and zlib runtime boundary.
+- The Bun self-contained profile embeds the third-party Bun runtime and its transitive runtime components.
+- All three profiles have a maximum ownership claim of P2 after the separate P1/P2 capability and provenance gates pass.
+- The `owned-standalone-runtime` P3 capability remains `achieved: false`.
+- Current self-contained assets may not be described as P3, fully proprietary, 100% Xeno-owned, native-owned, or free of third-party runtime code.
+- Replacing `pkg` with another third-party packager or embedded runtime does not advance P3.
+
+## Installer and Packaging Audit
+
+| Surface | Actual behavior | Runtime boundary | Claim disposition |
+| --- | --- | --- | --- |
+| `scripts/install.sh` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
+| `scripts/install.ps1` | Resolves npm integrity and runs global npm install | Separately installed Node/npm | External host; maximum P2 |
+| `build-standalone.mjs pkg` | Compiles self-contained platform payloads with pinned `pkg` through an owned cross-platform orchestrator | Embedded Node/V8/libuv/OpenSSL/zlib | External embedded runtime; not P3 |
+| `build-standalone.mjs bun` | Compiles self-contained platform payloads with a preinstalled Bun through the same orchestrator | Embedded Bun and transitive runtime | External embedded runtime; not P3 |
+| GitHub `cli-v*` release | Publishes payloads, archives, runtime manifest, and checksums | Profile declared by `RUNTIME-BOUNDARY.json` | Release notes must state external runtime and not P3 |
+
+## Enforcement
+
+- `scripts/audit-self-contained-runtime.mjs` hashes every raw self-contained payload and writes a deterministic `RUNTIME-BOUNDARY.json`.
+- Verification fails for a missing payload, unknown packaging mode, changed payload hash, changed manifest, or ownership ceiling above P2.
+- The build script cleans the release staging directory so Bun and Node profiles cannot be mixed.
+- Target validation fails closed unless the corresponding audited PTY manifest and native payload exist.
+- Before `pkg` runs, the owned orchestrator invokes the pinned `pkg-fetch` entry point with `--force-fetch`; existing/downloaded bases must match the packager's expected SHA-256, and fetch failures terminate explicitly instead of falling back to an implicit Node.js source build.
+- The owned orchestrator writes normalized ZIP/TAR archives and SHA-256 records without Bash, `npx`, or external archive/checksum utilities.
+- The release workflow verifies the runtime manifest before uploading assets.
+- `SHA256SUMS.txt` is generated after the runtime manifest and therefore covers the claim record as well as payloads and archives.
+- Compatibility labels `standalone` and `native` remain in scripts/environment values, but documentation defines them as self-contained distribution labels rather than ownership claims.
+
+## Verification Evidence
+
+- Runtime-boundary self-test creates a synthetic PE payload, writes and verifies the Node profile, mutates the payload, and confirms verification rejects it.
+- Focused install-documentation tests assert the profile scripts, workflow gate, manifest name, and not-P3 language.
+- A clean Debian Node 24.18.0 run builds the exact SDK and CLI candidates, packages Linux x64 and Windows x64, executes and verifies the Linux payload, and reaches only the required unsigned-native release blocker.
+- A clean Debian Linux arm64 run under QEMU builds the exact SDK and CLI candidates, packages and executes `xeno-linux-arm64`, verifies owned PTY/preview plus bubblewrap containment, and reaches only the required unsigned-native release blocker. See `docs/compliance/linux-arm64-package-candidate.md`.
+- Focused packaging tests verify Linux arm64 and Windows arm64 base-prefetch arguments plus unsupported-target rejection. A transient GitHub `503` was reproduced as the historical trigger for implicit source compilation; the new preflight converts that condition into a bounded explicit failure.
+- The exact clean cross-built Windows payload executes under its real `xeno-win-x64.exe` name with healthy process-tree, ConPTY, owned-preview, and ownership-policy diagnostics.
+- Two consecutive same-environment Windows runs produce byte-identical executable, ZIP, runtime manifest, and checksum files. Independent-environment reproducibility remains a P4 gate.
+- CLI build, typecheck, release-package smoke, compliance, and artifact inventory must still pass for each release candidate.
+- No current release artifact was published by this implementation work.
+
+## P3 Reconsideration Gate
+
+P3 requires either an owned native runtime rewrite or a sustained Xeno-owned JavaScript-compatible runtime, followed by cross-platform conformance, deterministic artifacts, provenance, SBOM, signing, and independent review. It is a separate multi-year program and is not part of the current P2 release target.
+
+## Handoff
+
+- Phase 6 decision complete: yes
+- P3 implementation complete: no
+- P3 evidence complete: no
+- P3 capability gate may be marked achieved: no
+- Public not-P3 boundary ready for engineering use: yes
+- Counsel/public ownership approval: pending
+- Author/date: Codex implementation assistant, 2026-07-12

package/ownership/evidence/PROPRIETARY-RUNTIME-1/provenance-review.md

@@ -1,32 +1,32 @@
-# Independent Provenance Review: Runtime Boundary Decision
-
-## Review Identity
-
-- Component: current npm and self-contained runtime profiles
-- Replacement milestone: PROPRIETARY-RUNTIME-1
-- Implementation record: `ownership/evidence/PROPRIETARY-RUNTIME-1/implementation-record.md`
-- Reviewer: pending independent reviewer
-- Review date (UTC): pending
-- Reviewer independent of implementation: pending
-
-## Current Evidence Status
-
-- [x] The npm Node-host boundary is explicitly disclosed.
-- [x] The `pkg` profile is classified as an embedded Node/V8/libuv/OpenSSL/zlib runtime.
-- [x] The Bun profile is classified as an embedded external Bun runtime without unsupported transitive-absence claims.
-- [x] Product language and release notes are bounded to maximum P2 and explicitly reject P3.
-- [x] A deterministic artifact-hash manifest and tamper self-test are present.
-- [ ] A real release candidate for every claimed platform has been built and audited.
-- [ ] Per-build SBOMs and native import/symbol inventories have been reconciled.
-- [ ] Reproducibility has been demonstrated in two clean environments.
-- [ ] Independent engineering and counsel review is signed.
-
-## Decision
-
-- Engineering boundary decision: needs independent review
-- Phase 6 no-P3 strategy may be used internally: yes
-- P3 capability gate may be marked achieved: no
-- Public claim that the standalone runtime is proprietary: no
-- Required follow-up: audit real release payloads, reconcile SBOM/import evidence, and obtain independent/counsel approval
-- Reviewer signature/date: pending
-- Counsel approval reference: pending
+# Independent Provenance Review: Runtime Boundary Decision
+
+## Review Identity
+
+- Component: current npm and self-contained runtime profiles
+- Replacement milestone: PROPRIETARY-RUNTIME-1
+- Implementation record: `ownership/evidence/PROPRIETARY-RUNTIME-1/implementation-record.md`
+- Reviewer: pending independent reviewer
+- Review date (UTC): pending
+- Reviewer independent of implementation: pending
+
+## Current Evidence Status
+
+- [x] The npm Node-host boundary is explicitly disclosed.
+- [x] The `pkg` profile is classified as an embedded Node/V8/libuv/OpenSSL/zlib runtime.
+- [x] The Bun profile is classified as an embedded external Bun runtime without unsupported transitive-absence claims.
+- [x] Product language and release notes are bounded to maximum P2 and explicitly reject P3.
+- [x] A deterministic artifact-hash manifest and tamper self-test are present.
+- [ ] A real release candidate for every claimed platform has been built and audited.
+- [ ] Per-build SBOMs and native import/symbol inventories have been reconciled.
+- [ ] Reproducibility has been demonstrated in two clean environments.
+- [ ] Independent engineering and counsel review is signed.
+
+## Decision
+
+- Engineering boundary decision: needs independent review
+- Phase 6 no-P3 strategy may be used internally: yes
+- P3 capability gate may be marked achieved: no
+- Public claim that the standalone runtime is proprietary: no
+- Required follow-up: audit real release payloads, reconcile SBOM/import evidence, and obtain independent/counsel approval
+- Reviewer signature/date: pending
+- Counsel approval reference: pending

package/ownership/evidence/PROPRIETARY-TOOLCHAIN-1/implementation-record.md

@@ -1,53 +1,53 @@
-# Toolchain Boundary Record: Current Xeno Build System
-
-## Identity
-
-- Component: TypeScript/Node development, test, analysis, bundling, packaging, native-build, and CI toolchain
-- Replacement milestone: PROPRIETARY-TOOLCHAIN-1
-- Repository and paths: CLI/SDK manifests and lockfiles, build/test configs, native build scripts, CI workflows, and generated compliance inventories
-- Record owner: Xeno engineering, final owner assignment pending
-- Audit date (UTC): 2026-07-12
-- Status: boundary inventory and anti-overclaim controls complete; P4 implementation not started
-
-## Current Boundary
-
-- Product target: P2.
-- P4 capability gate: false.
-- Generated CLI development graph at audit: 397 records, including 392 build-only and 5 external-runtime records.
-- Unique development package names at audit: 324.
-- Direct tool groups: TypeScript/type contracts, tsup/esbuild, TSX, Vite/Vitest/Rollup, ESLint/typescript-eslint, npm/lockfile tooling, and @yao-pkg/pkg.
-- Native and hosted boundaries: operating-system compilers/SDKs/linkers, Node/N-API headers, shell/PowerShell, and GitHub Actions remain external.
-- License review: seven installed development entries require review; no claim resolves those entries automatically.
-
-## Controls Added
-
-- `@yao-pkg/pkg@6.21.0` is exact and committed to the lockfile.
-- The cross-platform owned packaging orchestrator invokes the exact installed `@yao-pkg/pkg@6.21.0` entry point directly; release packaging does not use `npx` or download a moving package compiler.
-- Deterministic ZIP/TAR generation, checksums, target validation, and runtime-manifest orchestration are Xeno-owned control logic.
-- Optional Bun packaging requires a preinstalled executable and never downloads Bun in the build script.
-- `scripts/verify-toolchain-boundary.mjs` reconciles direct manifest requests to lockfile versions, generated development records, license-review entries, and the false P4 policy gate.
-- `npm run compliance:toolchain` writes and immediately verifies `docs/compliance/toolchain-boundary.json`.
-- Human-readable scope and exit criteria are in `docs/TOOLCHAIN_BOUNDARIES.md`.
-
-## P4 Replacement Scope
-
-P4 requires owned language parsing/type analysis/transpilation, bundling and source maps, test runtime/assertions/mocking/coverage, static analysis, package resolution/integrity/packing/publication, executable packaging, native build orchestration, and deterministic provenance. The accepted OS/compiler/SDK/hosted-CI boundary must be approved before implementation.
-
-## Verification Evidence
-
-- Toolchain boundary write/verify passes against the current lock, policy, ownership graph, and license inventory.
-- The packaging control path passes focused deterministic archive and PE-import tests, a clean Debian dual-target run, exact Windows cross-built execution, and same-environment byte comparison.
-- CLI build and TypeScript checks pass with the sibling SDK junction restored.
-- CLI compliance reports zero ownership violations; artifact-inclusive audit reports 927 records and zero violations.
-- These results prove classification, control-path behavior, and same-environment reproducibility only. They do not prove P4 or independent-environment byte reproducibility.
-- No release was published by this work.
-
-## Handoff
-
-- Phase 7 inventory and claim boundary complete: yes
-- P4 implementation complete: no
-- P4 evidence complete: no
-- P4 capability gate may be marked achieved: no
-- Ready to scope a separately funded compiler/toolchain program: yes
-- Counsel/public P4 approval: pending
-- Author/date: Codex implementation assistant, 2026-07-12
+# Toolchain Boundary Record: Current Xeno Build System
+
+## Identity
+
+- Component: TypeScript/Node development, test, analysis, bundling, packaging, native-build, and CI toolchain
+- Replacement milestone: PROPRIETARY-TOOLCHAIN-1
+- Repository and paths: CLI/SDK manifests and lockfiles, build/test configs, native build scripts, CI workflows, and generated compliance inventories
+- Record owner: Xeno engineering, final owner assignment pending
+- Audit date (UTC): 2026-07-12
+- Status: boundary inventory and anti-overclaim controls complete; P4 implementation not started
+
+## Current Boundary
+
+- Product target: P2.
+- P4 capability gate: false.
+- Generated CLI development graph at audit: 397 records, including 392 build-only and 5 external-runtime records.
+- Unique development package names at audit: 324.
+- Direct tool groups: TypeScript/type contracts, tsup/esbuild, TSX, Vite/Vitest/Rollup, ESLint/typescript-eslint, npm/lockfile tooling, and @yao-pkg/pkg.
+- Native and hosted boundaries: operating-system compilers/SDKs/linkers, Node/N-API headers, shell/PowerShell, and GitHub Actions remain external.
+- License review: seven installed development entries require review; no claim resolves those entries automatically.
+
+## Controls Added
+
+- `@yao-pkg/pkg@6.21.0` is exact and committed to the lockfile.
+- The cross-platform owned packaging orchestrator invokes the exact installed `@yao-pkg/pkg@6.21.0` entry point directly; release packaging does not use `npx` or download a moving package compiler.
+- Deterministic ZIP/TAR generation, checksums, target validation, and runtime-manifest orchestration are Xeno-owned control logic.
+- Optional Bun packaging requires a preinstalled executable and never downloads Bun in the build script.
+- `scripts/verify-toolchain-boundary.mjs` reconciles direct manifest requests to lockfile versions, generated development records, license-review entries, and the false P4 policy gate.
+- `npm run compliance:toolchain` writes and immediately verifies `docs/compliance/toolchain-boundary.json`.
+- Human-readable scope and exit criteria are in `docs/TOOLCHAIN_BOUNDARIES.md`.
+
+## P4 Replacement Scope
+
+P4 requires owned language parsing/type analysis/transpilation, bundling and source maps, test runtime/assertions/mocking/coverage, static analysis, package resolution/integrity/packing/publication, executable packaging, native build orchestration, and deterministic provenance. The accepted OS/compiler/SDK/hosted-CI boundary must be approved before implementation.
+
+## Verification Evidence
+
+- Toolchain boundary write/verify passes against the current lock, policy, ownership graph, and license inventory.
+- The packaging control path passes focused deterministic archive and PE-import tests, a clean Debian dual-target run, exact Windows cross-built execution, and same-environment byte comparison.
+- CLI build and TypeScript checks pass with the sibling SDK junction restored.
+- CLI compliance reports zero ownership violations; artifact-inclusive audit reports 927 records and zero violations.
+- These results prove classification, control-path behavior, and same-environment reproducibility only. They do not prove P4 or independent-environment byte reproducibility.
+- No release was published by this work.
+
+## Handoff
+
+- Phase 7 inventory and claim boundary complete: yes
+- P4 implementation complete: no
+- P4 evidence complete: no
+- P4 capability gate may be marked achieved: no
+- Ready to scope a separately funded compiler/toolchain program: yes
+- Counsel/public P4 approval: pending
+- Author/date: Codex implementation assistant, 2026-07-12