carthagent 1.0.7 → 1.1.0-preview.13

package/docs/opencode-migration.md

@@ -66,20 +66,236 @@ integration check before its PR merges. In-progress does not mean shipped.
 
 | Workstream | State | Acceptance |
 | --- | --- | --- |
-| Baseline/build contracts | In progress | Existing checks recorded; new TS/TSX included in checks |
-| Runtime/isolation | In progress | CTG and normal OpenCode coexist; authenticated persistent service |
-| Native plugin host | In progress | Installed package loads server and TUI entrypoints |
-| Providers/auth/telemetry | In progress | Concurrent requests/refreshes maintain credential and session identity |
+| Baseline/build contracts | Merged #137 | Existing checks recorded; TS/TSX included in checks |
+| Runtime/isolation | Merged #139 | CTG and normal OpenCode coexist; authenticated persistent service |
+| Native plugin host | Bootstrap merged #137; integration in progress | Installed package loads server and TUI entrypoints |
+| Session framing/controls | Merged #144, #145, #147, #148 | Per-session defaults, raw bypass, compaction notes, declared ownership errors, restart recovery |
+| Providers/auth/telemetry | Merged #141 at `e969e44` after independent review and 16 green CI checks | Concurrent requests/refreshes maintain credential and session identity |
 | Delivery/policy/budgets | In progress | Native execution preserves evidence, validators and recovery |
 | Native theme/commands/panels | In progress | CTG commands work; host owns input/rendering; semantic themes |
-| Workspace/worktrees | In progress | Independent worktrees and durable task/session mappings |
-| Review | In progress | Fresh-context findings bound to source and PR head; bounded admission |
-| Legacy archive | In progress | Read-only searchable transcripts; no implicit continuation |
-| CLI/headless/dashboard | Pending | Output/exit/locking behavior verified against native runtime |
-| Packaging/upgrade | Pending | Fresh installation and migration tested from packaged artifact |
+| Workspace/worktrees | Backend merged #138, #146; terminal integration in progress | Independent worktrees and durable task/session mappings |
+| Review | Backend merged #146; terminal integration in progress | Fresh-context findings bound to source and PR head; bounded admission |
+| Legacy archive | Merged #150; launcher discovery integration in progress | Read-only searchable transcripts; no implicit continuation |
+| CLI/headless/dashboard | CLI/headless in progress; dashboard lease fix merged #142 | Output/exit/locking behavior verified against native runtime |
+| Packaging/upgrade | #151, #143, #149 merged; #164 parser split passes parent plain `npm ci`, codegraph tests, lint and typechecks; green composed CI remains required | Fresh installation and migration tested from packaged artifact |
 | Terminal/performance | Pending | PTY, interaction, streaming and reconnect evidence |
 | Default switch/retirement | Pending | No supported default execution path depends on Pi |
 
+### Combined-product acceptance (#155)
+
+The integration branch composes the real server and terminal entrypoints. A
+passing domain fixture alone does not satisfy these gates:
+
+| Probe | Evidence and remaining gate |
+| --- | --- |
+| `test:native-product` | Workspace, archives, controls, execution-event invalidation, disconnected-turn snapshot recovery, and fresh events after reconnect passed through the production entrypoint on 2.0.32 |
+| `test:native-host` | All four archive methods, output schemas, declared errors, and unchanged transcript bytes passed through production registration |
+| `test:native-controls` | Concurrent framing settings and compaction notes reach the real provider; settings persist across service restart |
+| `test:native-outcomes` | Failed/interrupted/succeeded outcomes, HTTP disconnect, neighboring-session isolation, and recovery passed; interruption explicitly uses `resume: false` and leaves a queued prompt pending |
+| `test:native-tasks` | Two real Git worktrees, concurrent isolated turns and framing settings, independent root sessions, and restart reconciliation passed; composed PR tracking also passes cached-list schema and typed cross-task ownership rejection without exposing paths. PR #161 merged at approved `d61fb8a` after atomic lock-publication fixes, independent review, and all 16 CI checks passed |
+| `test:native-review` | Configured-model independent review, receipt persistence, source-change invalidation, and three-review admission cap across restart passed |
+| `test:native-runtime` | Service reuse, repeated turns, provider rejection, recovery, unavailable-provider failure, final response after tools, correct success metadata, active cancellation, neighbor isolation, pre-aborted invocation isolation, and persisted-session continuation after service restart passed |
+| `tests/native-cli-host-smoke.mjs` | Composed CLI at `65b5b9f` passes print, repeated turns, provider failure after prior success in print/JSONL, workspace-isolated continuation, and JSONL tool/failure events against the owned 2.0.32 binary; admitted-but-nonterminal cancellation JSONL remains a separate review finding |
+| CLI follow-up at `b69d30c` | Composed lint/typechecks and 59 focused CLI/runtime/Ship/archive tests pass, with one platform-specific skip. Review finds the admitted-turn JSONL and OAuth prompt issues addressed, but requests updater validation binding the installed Git ref to the advertised release version, including under `--force`. Demo and remaining delivery-option/UI parity are still open |
+| `test:native-pty` | Installed production status, workspace, help, and CTG compact precedence passed after plugin readiness and slash-completion confirmation |
+| UI follow-up at `ad9b3fc` | Composed lint/typechecks and 44 runtime/PR tests pass, but the pinned-host PTY still opens native Help for `/help`; Unix CI also fails binary-path resolution. Independent review additionally found workspace event payload filtering drops updates and inventory refreshes lack a generation guard. #152 remains under changes requested |
+| UI follow-up at `db79377` | Composed lint/typechecks and 25 PR/live-refresh tests pass. Parent PTY still opens native Help for `/help`: the author's helper retains pre-submit slash-completion text, allowing “Carthagent commands” to satisfy its assertion before actual command output. Post-submit help rendering and the refreshed UI implementation require fresh review/proof |
+| UI/readiness follow-up at `c5a3f33`, codegraph at `7da8186` | Staged after restart; eight focused workspace/live/codegraph tests plus composed lint and both typechecks pass. Independent review finds coverage metadata visible but presentation truncation incorrectly changes authoritative completion/gate to incomplete/locked. The author is separating partial view coverage from server readiness; `/help` remains unresolved |
+| UI/readiness correction at `11a3650` | Independent delta review approves the bounded readiness fix, and parent ten focused workspace/live/RPC tests pass. Capped display coverage no longer changes authoritative completion or gate; stale evidence beyond the cap still blocks via the report DTO, and missing metadata is shown as unknown. Bare `/help` and shared CLI/UI operations remain open |
+| Parser dependency split #164 at `f62e420` | Independent scoped review finds no topology blocker: native renderer resolves `web-tree-sitter@0.25.10`, while codegraph explicitly resolves the `0.22.6` legacy alias. After an initial install timeout, the parent clean packed-install retry passes all seven codegraph behavioral tests using the installed artifact (580 ms), alongside parser resolution and owned OpenCode 2.0.32 identity checks. Targeted harness lint also passes. This is a focused result; full product acceptance and green composed CI remain required |
+| Delivery composition at `f27b5e8` | Product entrypoint now registers native delivery and codegraph by default; combined lint/typechecks and real-host product entrypoint/workspace/archive/controls/reconnect checks pass. #163 `e8c93e0` remains under changes requested: independent review reproduced two concurrent same-session calls admitted with a one-tool limit while the stored counter remained one. Atomic admission and composed delivery/SWE acceptance are required |
+| `test:native-package` | Clean production tarball at integration `2b300c0` passed host, controls, outcomes, product reconnect, runtime, tasks, review, and PTY gates with shared renderer resolution; real native SWE passed its separate evaluation-guard fixture, pending composed CTG delivery coverage |
+| Expanded installed gate at `fdf3aa8` | Host, controls, and outcomes passed; product probe failed because the new delivery RPC output schema uses a `pattern` keyword rejected by the pinned host. Subsequent probes did not run; #160 correction and fresh installed proof are required |
+| `test:native-report` with #160 `18c87cb` | Production RPC passes real-host output validation, freshness, false-verified rejection, and session ownership. A separate test-only handler proves the pinned host rejects incomplete `verified` output and accepts the complete active/status-only unavailable/invalid variants. Merged after independent review, parent approval, and all 16 CI checks passed; fresh composed installed proof remains pending |
+| Composed SWE at `d07f4c0` | Run succeeded and external final test passed, but only one native shell call was recorded: the fixture incorrectly accepted the failing baseline's “tests 1” text as success. This does **not** prove post-edit native verification; #153 must require baseline shell failure → edit → a second successful shell check → final response |
+| Composed SWE with #153 `315356a` | Corrected parent real-host run passes native failing shell → completed edit → distinct passing shell → final response: 4 productive turns, 2 shell calls, 1 edit, succeeded outcome, and external verification passed. Independent review found a remaining benchmark tool-admission race: concurrent ledger read/check/write operations can exceed the cap. #153 remains under changes requested; production delivery-policy enforcement remains a separate gate |
+| Delivery-enabled SWE after `f27b5e8` | Fails before tool execution because the fixture expects `edit` while the production planning gate correctly withholds implementation tools. The earlier four-turn proof does not cover enforced delivery. The fixture must follow the real planning, evidence, review, and handoff workflow before full composed acceptance |
+| Delivery/SWE follow-up at `ef6efb1` / `1c781c4` | Parent composed SWE passes 11 productive turns through planning, native failing shell → edit → distinct passing shell, declared check, model-authored review receipt, and verified finish. Independent approval covers atomic delivery admission and the SWE-proof delta, not independent review assurance or full policy enforcement. Parent 11 delivery tests and standard real-host scenario pass. #163 CI remains blocked by legacy disabled-extension budget validation; #153's unapproved product ancestry cannot enter main |
+| Delivery/review assurance composition | `tools/test-native-swe-host.mjs` drives production native calls in one disposable Git project. In the evaluation session, native `shell` is not advertised before planning; no unadvertised call is fabricated and no policy-hook rejection is claimed. The valid planned shell is positively exercised for red/edit/green. Verified finish is attempted with no plan and again before progress; each exact call result must reject, including the unfinished step. The completed planned check/progress/model-authored review then finishes verified. `carthagent.workspace.startReview` runs on the same workspace's delivery session: a fresh root reviewer has persisted read-only permissions and its receipt binds exact source/HEAD. A source mutation makes the receipt stale; the separate stale-source finish probe is asserted against its own tool-call ID and its result shows invalidated required evidence (not a claim that `delivery_finish` consumes the workspace review receipt). Reviewer admission is driven to its cap. Offline 2.0.32 run passed, 14 productive turns. This establishes only the participating paths above—not OS sandboxing or reviewer quality; the verdict is deterministic loopback output, and permission configuration is checked without a prohibited-write probe. The required fixture test passed before the deliberate source mutation and failed afterward. Standard mode permits implementation after a valid required plan; strict design approval remains a separate mode. The evaluation budget plugin applies its handshake only to marked evaluation sessions. |
+| Installed delivery with `ef6efb1` | Parent clean packed install on owned OpenCode 2.0.32 passes all six scenarios: standard (16.295 s), strict (13.999 s), budget (10.725 s), raw (6.288 s), mixed (6.467 s), and concurrent identical-shell calls (7.486 s). This is a focused installed delivery result; the full installed product gate and #163's legacy CLI CI fix remain pending |
+| Delivery compatibility follow-up at `b0f162e` | Restores legacy disabled-extension budget rejection while explicitly allowing native session budgets with `delivery:false`. Parent CLI/budget/session-options tests pass 20/20; independent delta review found no regression and passed 31 focused tests plus native typecheck. Unix CI now reaches the older PTY helper but fails because `/ctg-status` remains at slash completion without submission; a strict post-submit probe correction is pending |
+| Delivery PTY follow-up at `406314a` | Independent review and a real PTY run confirm command submission and post-submit runtime response; all eight exact-head CI checks pass. Merge is blocked by conflicts with approved main after #165; conflict resolution requires fresh exact-head review and CI |
+| Delivery approved-main resolution at `959f11d` | #163 merged as `171c215` after independent review, parent exact-head approval, and all 16 CI checks passed, including both installed-package gates and macOS/Ubuntu/Windows Node 22/24 matrices. Independent checks also passed 39 focused tests, native typecheck, syntax, and post-submit PTY smoke. Product integration retains its fuller fixtures and installed gate. Superseded #156 was closed without merging or deleting its branch. Broader product acceptance and the native default switch remain open |
+| CLI follow-up at `cf098d9` | Parent focused CLI/updater tests pass 55/55; independent review finds release-tag binding and isolated offline demo sound. Review still requests a real consumer for the saved codegraph cap and correct resumed `--no-guide` precedence over saved framing toggles. Native budget/disabled-delivery option wiring remains open |
+| CLI follow-up at `5eec4bf` | Composed lint, legacy/native typechecks, and 44 focused CLI/session-control/codegraph tests pass. Parent host smoke passes print/repeated-turn/failure/workspace and exact resumed no-guide payload, then fails an obsolete missing-budget-capability assertion against the now-capable production plugin; that call also lacks an explicit fixture model. Review requests an actual consumer for saved `--review`, plus `--bash-cap` and `--isolate` behavior. Real capable-host budget enforcement, remaining JSONL probes, and registration-level codegraph-default regression coverage are assigned |
+| Evaluation follow-up #165 at `af124ca` | Merged after independent review, parent approval, and all 16 exact-head CI checks passed. The clean evaluation-only branch avoids #153's unapproved product ancestry; #153 was closed without merging and its branch retained. Its four-turn runtime proof is separate from the product's reviewed eleven-turn composed delivery proof |
+| Owned runtime #166 at `6b816a6` | Changes requested: independent review found client-controlled shell provenance, omitted provenance classified as manual, missing pristine-source enforcement, and an unconditional macOS-incompatible checksum command. Patch hash/application and 22 runtime tests pass. Parent also found mismatched service reuse and Windows artifact naming. The recorded binary predates the final title change; corrected attribution/build/identity, exact-patch binary proof, two-session restart isolation, automatic-overflow compaction, and final title verification remain open |
+| `test:native-performance` | Cached workspace RPC: 30 samples, p95 64.8 ms, maximum 181.6 ms; input and session-switch latency require separate terminal measurements |
+| Terminal semantics #162 at `608ea09` | Author reports exact 18,047-byte Unicode paste received by the loopback provider. Review found picker cancellation and usable 40×12 layout insufficiently asserted, clipboard actions insufficiently correlated to emitted payloads, and title/exit capture incomplete. These checks remain unverified; corrected assertions and an exact-run artifact with executable identity and exit status are required before acceptance |
+| Terminal probe follow-up at `1a79b48` | Independent bounded review finds the six assertion/provenance concerns addressed; static checks pass. Model-only checks are labeled separately, and old-binary title results are superseded. Narrow layout, exact native selection/copy, and final-binary title restoration remain unverified pending the corrected owned-runtime artifact. Product-base CI also exposes a pending CLI login-cancellation promise, assigned to the CLI author |
+| Terminal harness composition | The reviewed #162 commits are staged by cherry-pick so staging does not auto-close the unmerged PR. Parent model self-test passes and explicitly reports `NOT_RUN` for native acceptance. Exact final-binary terminal proof remains required |
+| Composed CI at `f40a176` | Run `39057797799` fails on pending login-cancellation promises (Windows Node 22/24 and Ubuntu Node 22) and the post-submit `/ctg-workspace` assertion (remaining Unix jobs). The packed job passes host, controls, outcomes, product, runtime, tasks, review, and SWE-host probes before the same workspace PTY failure. Browser checks pass. Fixes are assigned; this is not full acceptance |
+| CLI cancellation at `268b544` | Independent exact-head approval covers late OAuth-attempt capture, ordinary/masked prompt cancellation, and SIGINT cleanup. Parent stages the two implementation commits; the intervening budget-expectation change is already present from approved delivery integration. Parent CLI/session-option tests pass 42/42 on Node 22.19.0, 24.21.0, and 26.7.0. Composed quality also passes: lint, syntax build, legacy/native typechecks, and 624 tests with one skip and no failures/cancellations. Whole CLI compatibility, supported-platform CI, and full release acceptance remain separate |
+| Default packed runtime discovery | Parent added a no-override `resolveOpenCode()` check to the fresh installed-package gate. It reproduces a real launcher failure: npm hoists `@opencode/cli` beside `carthagent`, while the resolver searches only `carthagent/node_modules`. Earlier probes explicitly set `CTG_OPENCODE_BIN` and did not cover default discovery. The runtime author owns the correction; the new gate intentionally remains failing until it lands |
+| Follow-up CI at `bd50603` | Run `39058700753` confirms the pending-login-promise failure is gone. Windows Node 22/24 now fail only two updater assertions that expect Unix npm argv instead of the Windows `cmd.exe /d /s /c` wrapper. Unix jobs pass the unit suite and reach the known workspace PTY failure; the packed gate exposes default runtime discovery. These remaining corrections are assigned |
+| Release documentation #167 at `34bf9a9` | Independent and parent scoped approval; staged by cherry-pick. Native preview, read-only archives, owned profile, headless JSONL, exact-tag installation, and current updater limits are documented; the legacy install/provider/Ship/console guide remains linked. Release notes stay explicitly unreleased. Parent Python checks pass 13/13 with pinned Pillow 11.3.0 supplied from a disposable dependency directory |
+| Windows updater assertions at `b8453c1` | Independent and parent scoped approval; staged as `f1adae0`. Both focused tests pass while retaining exact release-tag assertions and allowing the Windows npm command wrapper. The unrelated rejected theme and budget-smoke changes are not staged |
+| Windows plugin startup after `f1adae0` | CI `39060207929` passes the unit suite on Windows Node 22/24, then fails native host startup because the fallback archive root mixes path separators. Parent correction `a6a4290`, independently approved, replaces string concatenation with platform-native `resolve()`. Targeted lint, native typecheck, four archive tests (one Windows-only skip), and the offline native host/archive RPC probe pass locally. Follow-up CI `39061162244` passes both complete Windows Node 22/24 jobs; Unix PTY and packed-install failures remain separate |
+| Owned runtime #166 at `57f2e71` | Independent exact-checkout runtime tests pass 27/27 and syntax checks pass. Earlier Windows artifact-path, dead-registration recovery, and bare-PATH identity defects are corrected. Explicit Windows executable extensions and release-workflow draft/tag/checksum handling still require changes. This head is not staged or approved for release; full clear/autocompact/overflow/provenance behavior and the final installed artifact remain pending |
+| Terminal evidence #162 at `ad15830` | Binary `85bb44a…` has bounded controlled-terminal evidence for Unicode paste, focused selection/copy, and normal-exit title restoration. The full run retains incomplete selection. Ctrl+O covers the recent-sessions menu, not model-picker navigation/cancellation; 40×12 rendering alone does not prove input interaction. Independent review requests those missing checks. Physical OS clipboard behavior remains unverified |
+| Benchmark readiness #157 at `ced188d` | Independent review passes 16 paired guards, three detector tests, and shell syntax checks. Null-plugin provenance and composer detection are corrected in source. Real non-timed readiness must pass before any newly authorized quiet-window run; neither performance nor sustained-memory acceptance is established |
+| Shared updater #171 at `92ed5f0` | Independent and parent scoped approval; staged through `31b1aa4`. Twelve focused tests and lint pass. Clean-clone updates fetch the selected origin tag into a private ref and check out its resolved commit, preserving local tags and dirty files; cancelled/timed-out commands cannot report success. CLI/UI wiring remains a separate gate |
+| Runtime acquisition #172 at `2ae5755` | Independent and parent scoped approval; staged through `263d613`. Twelve focused tests and lint pass, including actual system-tar USTAR extraction, exact archive/executable digests, redirects, offline cache validation, tamper rejection, and cleanup. Producer archives must explicitly use USTAR; platform artifact validation, trusted release-manifest generation, and default-resolver wiring remain pending |
+| Composed quality at `0824cbd` | Parent `npm run quality` passes lint, syntax build, legacy/native typechecks, and 648 tests with one skip, zero failures, and zero cancellations. This includes the reviewed shared updater and artifact acquisition modules; it is not the full installed/native-terminal release gate |
+| CLI budget proof through `f8e1a52` | Independent scoped approval of `32d6296` and `f8e1a52`; staged as `a3d39de` and `2388b65`. Parent composition correction `7068e40`, independently approved, reconciles the native validator option name and isolated diagnostic-plugin RPC contract. Full offline CLI host smoke passes against packaged 2.0.32, including admitted-write positive control, rejected over-limit write, persisted stopped counter, session-bound terminal outcome, repeated turns, provider errors, and workspace isolation. Changed-file lint and native typecheck pass. Previously rejected theme/glyph changes are excluded |
+| Runtime identity helper #173 at `6f067a5` | Independent and parent scoped approval; staged through `f661454`. Seven tests and changed-file lint pass. Owned binary path, bytes, and provenance are checked against trusted release metadata before execution; runtime identity remains distinct from compatibility version. Integration into host, terminal, and installed-package probes remains pending |
+| Owned resolver #166 through `c8b05db` | Independent source and composition review; staged through `1ae6cfc`. Parent runtime/acquisition suite passes 45/45 and changed-file lint passes. Default resolution handles npm hoisting, rejects invalid packaged release manifests, binds service identity to executable bytes, and revalidates automatically selected caches on repeated resolution. Existing product package probe and lifecycle-locked theme provisioning are preserved. Five-platform prebuild/manifest sequencing and final help/theme/glyph acceptance remain pending |
+| Combined assurance #168 through `05090ce` | Staged through `35fa6b0` after independent and parent review. Parent actual offline host run passes 14 productive turns, native red/edit/green, specifically correlated premature/stale finish rejections, and source-bound review receipt invalidation. Parent evaluation regression passes. Pre-plan shell is withheld rather than tested through an execution-hook rejection; reviewer read-only permissions are configured, and deterministic verdicts establish receipt plumbing rather than review quality |
+| Benchmark admission #174 at `4a0c98a` | Independent and parent scoped approval, staged through `6be3e27`. Parent five-test runner suite passes: eight advertised workspace-local reads yield one marker-bearing result and seven call-ID-correlated budget rejections. This isolated benchmark-plugin probe does not establish combined delivery-policy or direct durable-storage behavior. Separate benchmark evaluator/startup/diagnostic regressions remain assigned |
+| Exact picker identity #162 through `167d0df` | Staged through `118a179` after independent review. Parent rerun passes against independently supplied exact owned version and `85bb44a…` executable digest, verified before execution. Selection styling moves from A to B; cancellation preserves A for the subsequent unique provider request. The footer observation is correctly labeled rendered state. This remains bounded evidence, not full terminal acceptance |
+| Bounded terminal follow-up #162 through `dc71da6` | Independent review and parent inspection of the model-picker/40×12 evidence; staged through `7a8eea0`. Parent independently reran the actual model-picker probe on the hash-bound `85bb44a…` binary and observed a bounded pass: A/B navigation, cancellation without provider traffic, restored composer, retained rendered model label, and a subsequent unique request using A. Full-run selection remains incomplete and physical OS clipboard behavior is unverified. Final help/glyph artifacts require fresh evidence |
+| Composed quality at `7a8eea0` | Lint, syntax build, and both typechecks pass. Unit run reports 654 passed, one skipped, and one failure: the legacy budget-engine reset-follow-up child exceeds its 15-second total watchdog while startup alone takes about 17 seconds; it records a budget stop and closes 856 ms later. An isolated run also fails the tools case, this time at the reset command's 15-second watchdog (18.4 seconds observed); seconds and repairs pass. Both failures are retained, and native process-fixture migration remains assigned. An earlier attempted quality run was contaminated by an author's transient edits to two host probes; those edits were removed from the product worktree and are not attributed to committed source |
+| Fresh packed preview at `1ae6cfc` | Parent clean npm-pack/install focused codegraph gate passes, including default runtime discovery without `CTG_OPENCODE_BIN`, parser topology, and installed codegraph behavior. The selected binary is the hoisted upstream-compatible 2.0.32 dependency. This closes the discovered hoisting defect; it does not establish final owned-runtime acquisition or full installed acceptance |
+| Fixture and probe identity composition through `5eece55` | Stages independently reviewed #157 `916610a`, #175 `6aefd61`, #178 `d1bb126`, and #179 `8fe21dd`. Independent conflict-resolution review preserves the product fixture helper, additional-plugin options, debug transport, and build-agent default. Parent focused fixture/guard/identity tests pass 26/26, Python PTY unit tests pass 6/6, and artifact/identity/fixture tests pass 26/26 after composition. Changed-file lint and actual offline host/product probes pass against the preview runtime. Reports distinguish exact runtime from compatibility version. No timed performance or memory run was performed |
+| Portable executable-mode validation #179 | Unix-target execute bits are validated from USTAR headers on every host; cached filesystem execute bits are checked only on POSIX hosts. Parent artifact tests pass 15/15, including simulated Windows checks. Actual Windows CI remains queued; this does not yet close the platform acceptance gate |
+| Composed quality at `5eece55` | Lint, syntax build, and both typechecks pass; 690 tests pass, one is skipped, and none fail. The legacy budget watchdog cases pass in this run; earlier failing runs remain recorded above. This result predates the manifest generator composition |
+| Prebuilt manifest generator #177 through `e05dc50` | Independently reviewed source staged through `dfc50ea`. Parent composition initially fails five tests because the current acquisition API also requires a pinned channel. Independently reviewed correction `66f79b3` supplies that channel from the recipe-derived compatibility version. Parent generator/acquisition tests then pass 27/27 and changed-file lint passes. The generator validates five archives, their actual bytes/provenance, allowed members, and platform package metadata, including Windows `os: ["win32"]`. No real five-platform asset set or production manifest has been generated |
+| Live theme API #166 at `c84300e` | Standalone patch `0bcb146…` staged at `26957f6` after independent and parent source review. Exposes current selected theme/active mode and validates requested theme/mode before applying live changes. Author focused tests pass 2/2; independent syntax checks pass, but reviewer dependencies prevented test execution. Real ThemeProvider and final-binary command/rendering acceptance remain pending |
+| Installed default-runtime gate #176 at `1be5904` | Staged through `c08ed61` after independent source and positive loopback acquisition/identity review. Gate strips runtime/test/profile overrides, uses the installed trusted manifest, independently verifies the selected executable/provenance, and requires an isolated cache. Parent packed codegraph check passes in explicitly labeled preview mode. Required-owned acceptance rejects preview and focused runs; final real-asset installed acceptance remains pending |
+| Natural `/help` #180 at `7d238db` | Standalone patch `c1ce7d9…` staged through `e2a8e4e` after independent source review. Parent rerun of the entire upstream keymap test file passes 5/5 with 11 assertions against clean implementation `242cbb79`. Tests cover natural one-Enter autocomplete dispatch, later extension precedence, and native-help restoration after deactivation. The intermediate existing-test fixture regression is corrected and recorded. Final combined-binary PTY verification remains pending |
+| Owned assurance and identity reporting | Independently reviewed `98479a1` is staged as `a0dd81b`, keeping actual runtime and compatibility versions separate. Parent preview evaluation passes. Parent explicit-staging product and 14-turn SWE probes pass against independently pinned owned binary `85bb44a…`, including source mutation invalidating completion evidence. These diagnostics do not exercise default release acquisition or verify a release archive |
+| Portable path fixtures #181 and owned wrapper preflight #157 | Independently reviewed `65c9fe8` and `2649dd9` are staged through `2556723`. Parent runtime/environment/identity tests pass 46/46. Canonical path assertions cover macOS path normalization; the PATH fixture is portable. Actual shell-child tests verify owned-root/hash binding before execution and selector handoff before seeding. No readiness, timed ABBA, or memory run was performed; the stale retained snapshot was not used |
+| Actual Windows archive validation #179 | CI run `39066364339` passes the archive/acquisition cases on Windows Node 22 and 24, including Unix USTAR mode validation and cache checks. Both jobs still fail the separate PATH fixture now corrected by #181; overall platform CI is not yet green |
+| Release verifier #170 at `0904202` | Independently approved source staged through `42e515a`. Parent verifier/workflow/acquisition tests pass 22/22, including all five loopback USTAR artifacts through the production acquirer and rejection of an embedded channel mismatch. Required-owned installed gate is an effective dependency, and the tag is rechecked immediately before control-plane publication. Real draft-asset access and final release acceptance remain unresolved; no release action was executed |
+| Owned controls #182 at `f0d83b1` | Independently approved proof staged through `36844d3`; parent actual offline run passes against trusted-preflighted staged binary `85bb44a…`. Per-session auto-compaction settings survive a same-database service restart; disabled overflow makes one failed request, enabled overflow follows summary then successful retry. Concurrent identical shell commands correlate provider call IDs, session IDs, hook events, and successful durable tool results. This is Linux staging evidence, not default acquisition or visual `/clear` acceptance |
+| Full-TUI glyph source #183 at `46cdb55` | Standalone v4 patch `37d93c0…` and inventory `8727e2c…` are staged as `858fcb5`, byte-identical to independent source approval. Parent full focused tests pass 11/11 with 146 assertions. The three missing-import regressions are corrected; base and candidate typechecks report the same existing context-shape diagnostic. Final combined-host build and binary-bound ASCII/Unicode rendering remain pending |
+| Composed quality at `f004955` | Lint, syntax build, and both typechecks pass; 713 tests pass, one is skipped, and none fail. This includes the release verifier/generator, wrapper preflight, owned-control probe source, and published glyph review artifacts; the combined runtime and later UI/CLI corrections are not yet included |
+| Focused follow-ups through `5982c88` | Independently reviewed Windows canonical-path assertions `6cb693a`, Windows review-module file-URL loading/CI timeout `7382074`, and native captured-request diagnostics `9fdaac6` are staged. Parent benchmark runner/diagnostic tests pass 8/8. The broader native-default process fixture remains blocked; none of these changes switches the default runtime |
+| Combined host source `9930492` | Patch `81e86a4…` has scoped independent source approval. Parent isolated combined glyph/help/theme run passes 17/18; the remaining glyph test assumes an uncached spinner module and fails when other suites import it first. Test isolation, a new exact combined patch review, and a green recipe run are required before building. The subsequent typecheck was cancelled by a server restart and has no completed result |
+| CLI #140 cumulative review at `ba40d0b` | The isolation/bash-cap delta has scoped approval, but cumulative compatibility composition is not approved. Preserve the product's lifecycle-locked theme provisioning; the author branch lacks it. The isolated smoke must configure its offline provider and require a successful, correlated request through a real CLI `--isolate` invocation before claiming instruction suppression. Automatic self-review remains separately incomplete |
+| Readiness portability #157 at `049afbd` | Independent review requests canonical filesystem containment: a lexically contained import can escape the snapshot through a symlink. Linux focused tests pass 24/24 and PTY units 6/6; these do not establish Windows execution. Follow-up source remains unstaged; no readiness, timed ABBA, or memory workload ran |
+| Runtime workflow #166 at `bc6c57b` | Source fixes address candidate paths and reviewed-branch prebuilds. Independent workflow approval remains blocked because the claimed executable positive/tamper/stale-tag fixture is not committed and reproducible from this revision. No build, workflow dispatch, or release upload is approved by this result |
+| Restart recovery at `5982c88` | The pushed product commit was restored to a clean worktree after temporary checkouts and staged runtime artifacts disappeared. Prior completed results remain historical evidence; the lost binary and cancelled checks cannot establish fresh final-artifact acceptance. Author work is recovered from surviving files or saved commits without modifying the original dirty checkout |
+| Readiness containment follow-up #157 at `f7b7192` | Independently approved cumulative portability and canonical-containment fixes are staged through `6439c3f`. Parent focused fixture/wrapper/guard tests pass 25/25, including actual symlink escape rejection, in-root symlink acceptance, traversal/cross-drive cases, and pre-execution hash rejection. Dependencies were restored with `npm ci`. Windows execution, real readiness, performance, and release acceptance remain separate pending gates |
+| Restored composed quality at `2efdb60` | Lint, syntax build, and both typechecks pass. Full tests report 714 passed, one failed, and one skipped. The repair-budget restoration/reset test fails its second child at the child-exit watchdog after 22.152 seconds, with no provider-start or budget-stop phase recorded for that child. The first repair child completed naturally after a recorded budget stop. Process-fixture investigation remains open; this run is not green and does not supersede the earlier passing run at `f004955` |
+| Draft transport #185 at `808ebb5` | Cumulative independent and parent source approval; staged through `47b2a7c`. Parent runtime, credential-boundary, transport, identity, and release-verifier tests pass 60/60, including five fixture draft assets through production acquisition and wrong-digest rejection. Changed-file lint passes. Mixed-case download-token keys are removed from npm, runtime, version-check, and PTY children. Actual authenticated GitHub draft acquisition and final installed acceptance remain pending |
+| Glyph PTY harness #187 at `f2475f6` | Cumulative independent and parent source approval; staged through `71d8a11`. Parent portable helper tests pass 3/3 and lint passes. The harness requires the exact ordered Unicode payload in the rendered composer, with separate startup-logo chrome assertions; mutation tests reject altered payloads. Unix PTY imports are isolated from portable helper tests. The historical `85bb44a…` result is a negative control only; no positive final-binary rendering result exists yet |
+| Benchmark startup/evaluator #189 at `7cc2292` | Cumulative independent source approval and parent review; staged through `045f189`. Parent guard/runner/startup checks pass 9/9, including a real offline native startup sequence with 17 productive turns, checkpoint, declared check, review receipt, and verified finish. Ambiguous repeated same-tool Code Mode invocations fail before execution with an attribution error and no extra reservation. Independent Firefox/HTTP reference and mutant checks passed; no performance, ABBA, or memory acceptance is claimed |
+| Real theme-provider proof #190 through `afd820e` | Independently reproduced test-only patch `1afe790…` and parent-reviewed documentation are staged through `483ab54`. The actual ThemeProvider, ConfigProvider, and plugin context show live palette/mode changes and invalid-request rejection; five independent runs pass 18 assertions each, with TUI typecheck passing. The injected in-memory config service proves settings updates, not filesystem or restart persistence. Final combined-binary acceptance remains pending |
+| CI at `1419592` (run `39063828436`) | Browser job passes. Unix jobs fail the existing natural workspace PTY gate; package job fails the pre-resolver-fix hoisting check. Windows Node 22/24 fail acquisition tests because Unix-target executable bits are checked on a Windows filesystem. A focused cross-target archive-validation correction is assigned; prior Windows passes do not cover this newer acquisition module |
+| Persistent recovery and spinner isolation | Product and active author checkouts are restored under persistent OpenCode worktree storage. Independently approved test-only #194 `5b8020d` is staged as `a0822b5`; patch SHA-256 remains `651f4d08959ed657c94fc77fb6af48992b928f2b63eb922719f34dcb38cd8f26`. The combined runtime source still requires all 19 focused tests in one process and its TUI typecheck before build. |
+| Exact canonical selectors #157 through `6fdcbbe` | Independent exact-head approval and parent review; staged through `612a9e2`. Parent wrapper tests pass 4/4, requiring exactly two ordered canonical path lines. Actual macOS CI remains pending at this correction. |
+| Portable pure terminal helpers #157 at `b67f08e` | Independent exact-head approval and parent review; staged as `f7ba91c`. POSIX imports occur only inside PTY execution. Parent pure-helper tests pass 6/6; actual Windows CI remains pending. No performance, readiness, ABBA, or memory workload ran. |
+| CI at `73e308a` (run `39076427693`) | Browser passes. Windows Node 22 passes the Node suite and host/controls/outcomes checks, then fails Python helper import with missing `fcntl`, now addressed by `b67f08e`. macOS Node 22 fails the selector canonicalization assertion now addressed by `6fdcbbe`. Ubuntu Node 22 reaches the existing workspace PTY failure (`CARTHAGENT` not rendered). These results do not establish green composed CI. |
+| Release workflow integration review | Parent found the draft consumer required five total assets while the approved producer uploads five archives plus manifest and checksums (seven assets). Correction and exact-head review are pending. Draft visibility also requires push-capable credentials in metadata-checking jobs, including the producer's validation job; GET-only behavior must not be described as a read-only token capability. No runtime release workflow was dispatched. |
+| Browser fixture isolation at `d4983b5` | User reported repeated placeholder authentication tabs. Parent identified simulated-TTY OAuth tests calling the real OS browser launcher. Runtime browser launch is now injectable; all CLI fixtures default to a no-op and the OAuth lifecycle test captures the exact intended URL. Independent approval and parent checks pass 40/40, with changed-file lint passing. Browser Control was disconnected, so existing tabs could not be closed through the tool. Active authors were instructed to apply the fix before running authentication-sensitive or full suites. |
+| Draft acceptance #191 through `08394e5` | Independently approved cumulative source and parent review; staged through `b688c7b`. Parent draft/release workflow tests pass 15/15 and changed-file lint passes. The positive fixture supplies the actual seven producer asset names independently of the verifier constant; missing, duplicate, renamed, and extra assets fail. Trusted-main ancestry and job-scoped draft visibility capability are enforced. No live draft validation or release operation has occurred. |
+| Visual clear proof #186 through `7e0222d` | Independently approved cumulative source and parent review; staged through `7f1c009`. Parent five pure environment/transcript tests pass. Canonical complete-message comparisons cover A before/after clear, continued prompting and reopen, and neighboring B; reordered equivalent messages compare equal while changed text or IDs fail. Parent caught and the author corrected the original newest-first/ascending mismatch and a follow-up neighbor comparison regression. Live final-binary proof remains pending. |
+| Composed source checks at `7f1c009` | ESLint, both typechecks, and JavaScript syntax checks pass. Python suite passes 19/19 after restoring isolated Pillow 11.3.0 from its SHA-256-verified PyPI wheel; the initial attempt failed because Pillow was absent after recovery. These checks do not supersede the unresolved full-suite repair-budget timeout or final installed/runtime acceptance. |
+| Version-aware draft fixtures #191 at `ef4bb4a` | Independently approved and parent-reviewed follow-up staged as `7296e1d`. Parent verifier tests pass 12/12. Independent review temporarily used package version `9.8.7` in its isolated checkout and passed all 12 tests, then restored the checkout; the unrelated local Git ancestry fixture retains its own version. |
+| Installed owned probes #195 through `846afe9` | Independently approved cumulative source and parent review; staged through `8761156`. Installed Linux owned acceptance now includes host controls, glyph rendering, controlled terminal semantics, and visual clear/reopen. Parent offline contract/glyph tests pass 6/6 and changed-file lint passes. Wrappers reuse the resolver's options object for identity, bind proof bytes to packaged trust metadata, and strip the optional draft token before runtime/PTY children while preserving trusted harness cache-miss acquisition. The glyph entrypoint import is corrected. Preview skips are explicit and cannot satisfy required-owned acceptance. Live final-binary installed acceptance remains pending. |
+| Combined runtime #166 at `7088226` | Independently approved source and dependency-complete reproduction; staged through `2fbb600`. Combined patch SHA-256 `94a18eece950da260213e66168583f83e44923638f014efa2e58ff74f315bae7` changes only three test-file sections relative to the approved `81e86a4…` base. Independent frozen Bun 1.4.2 install, TUI typecheck, and one-process four-file suite pass 19 tests / 186 assertions (fixture listener warnings reported). Parent composition preserves reviewed patch/recipe/workflow/fixture bytes and all draft transport protections; 48 focused runtime/workflow/transport/token checks pass. Exact full Linux recipe build is authorized in a clean persistent upstream checkout. Final binary and installed acceptance remain pending. |
+| Workflow registration #197 at `669696b` | Independently approved source bootstrap from `main` at `171c215`; only the byte-identical reviewed manual workflow and a registration note are added. Parent reviewed dispatch-only behavior and selected-source checkout. Platform CI remains in progress; merge and real five-platform prebuild have not occurred. |
+| UI review follow-ups | Independent review requests changes at #188 `9818f88` (upstream-compatible PTY hash argument), #192 `13e4915` (explicit variant overwritten by picker; actual workspace PTY still fails), and post-run consumer `d48707d` (local review substituted for promised legacy PR/review/fixes kickoff, global cross-session suppression, stale/repeated offer admission). Authors are correcting these; none is composed as accepted behavior. |
+| First real prebuild dispatch | Bootstrap #197 passed all CI jobs and parent exact-head approval, then merged as `bd1292c8c4f76a74808eb751446f58873d8d5968`. GitHub registered workflow `388117402`. Parent dispatched non-publishing prebuild run `39089640210` against exact reviewed source `70882269e25ebcb62c843f9265345342b9e6844d` for planned version `1.1.0`; initial status is queued. This is the first actual five-platform runtime workflow run. No final manifest/version commit, tag, draft release, runtime asset upload, publication, or control-plane POST has occurred. |
+| Prebuild results after restart | Run `39089640210` completed with both Darwin native builds succeeding and archived artifacts `12122875012` (x64) and `12122810274` (arm64). Linux x64/arm64 failed the same combined-suite glyph assertion (`ext .` expectation); Windows failed the pristine `bun.lock` digest check. Assembly was skipped, so no five-platform candidate exists. The runtime author is investigating platform-specific test and checkout behavior before another reviewed build. The local Linux recipe process survived the server restart and was still running; it was not duplicated. |
+| Recipe-selected provenance follow-up #198 | Generator source through `69f8896` received scoped approval, but parent found the release verifier still hardcodes the historical base patch and would reject a manifest bound to the new combined patch. Cumulative acceptance is HOLD pending a shared validated patch reader and verifier tests with the distinct base patch retained. No manifest was generated from the incomplete platform set. |
+| Recipe-selected provenance #198 resolved at `3d7919c` | Independent cumulative approval and parent review; staged through `d5c25b1`. Both generator and verifier now use the same validated recipe-selected patch reader, with no missing-file fallback. Parent combined suites pass 29/29; changed-file lint passes. Reading the actual composed recipe returns combined patch `94a18eec…` and the expected upstream/lock pins. The preserved historical base patch is not used as final provenance. |
+| Retained real Darwin artifacts | Parent downloaded both successful artifacts from failed aggregate run `39089640210` into persistent storage and checked archive/executable SHA-256 against their build records. Production `acquireOwnedRuntime` also accepted both actual USTAR archives through an injected local-byte fetch, validating extraction and embedded provenance. This is real archive-format/provenance coverage, not anonymous/authenticated release acquisition or native execution. Darwin x64 archive/executable: `c1b80729c2b55f57ba5ebe2931ad4c64e24bf4ad1e817d9c4471fbead753dfa0` / `f503b8ce9809f6adcd2c6e212b1902a459551b68ca2d4ceae02947d2255492fc`; arm64: `bd04e6720baeecc26e14f348924bef49b9c459aa85caffaf20ce6b37ee9bc98c` / `e1a8fc696c61bd0d351e2ff318c4f64b4cd396f1bfad44a8c47fc7f67a49bbe2`. Both bind patch `94a18eec…`; they cannot be reused as final evidence after a patch-pin change. Composed `npm run build` also passes at `36a5ffc`. |
+| Continued UI review | Independent reviews request changes on PTY follow-up `8e9dd67` (upstream digest fixed, owned digest omitted by the new argument helper), model/theme head `999f528` (explicit variant fixed, actual workspace PTY unresolved), and review consumer `d394236` (composer-append event is not submission; restored persisted loop cannot reset). Parent reproduced the latter: a fresh consumer with persisted active loop leaves it active and performs zero persistence updates after `onPromptSubmitted`. Corrected heads remain uncomposed. |
+| CLI smoke checkpoint `6cb6901` | Author reports actual Code Mode delivery-plan success, correlated shell timeout at 500 ms, absent delayed side effect, uncapped positive control, and admitted/rejected budget write tool-result checks. Focused composition/publication and independent review remain assigned. Actual updater child spawn also confirmed case-insensitive draft-token leakage; CLI author owns the focused correction while UI author avoids that file. |
+| Product CI at `079a075` | Run `39091689558` failed all six Node/OS test jobs and native-package; browser passed. Linux's test failure is a stale draft-gate assertion requiring documentation to describe already-composed probes as pending. Windows additionally exposes Unix-only `fcntl` import in a glyph-entrypoint test, fake `gh` falling through to real GitHub CLI, and CRLF-sensitive workflow extraction. Focused cross-platform fixture fixes are assigned. Installed-package still fails the known hoisted PTY binary path, awaiting reviewed #188/#199 composition. |
+| Reviewed platform fixtures #202 | Independent and parent review approve exact source `97f7d6a6f9da57f6f37927c45bf74c9f20f53a6a`, composed as `a73e5719a5`. The real verifier CLI runs under an offline child-process preload; malformed, moved, and published release negatives remain covered. Actual workflow shell blocks are extracted with CRLF normalization and executed against local Git repositories. Only the Unix-only PTY import is skipped on Windows. Parent composed tests pass 16/16; author reports Windows Node 22/24 CI passes. Final package/runtime acceptance remains pending. |
+| Delivery child environment `87e96710b4` | Exact commit `87e96710b4e8b9f89f3e2603083caf1f13922edb` strips the draft transport token case-insensitively from `runCommand` and Windows `taskkill` children, preserving the parent environment. Independent review approves with 65 focused tests and a cancellation probe; parent source review and 31 delivery/token tests pass. Process deviation: the author committed and pushed directly to product before review despite an explicit separate-worktree instruction. This entry records subsequent acceptance, not prior approval. Shared updater and dashboard child corrections remain separately assigned. |
+| Retained Linux staging build | The surviving full recipe at reviewed source `70882269` completed all checks and produced executable SHA-256 `72572a2249967756946c65bdeb021b2f43dfa5af7cc29d8665d7fe2309695212`. Parent retained the artifact, complete log, and explicitly single-platform staging manifest under `/home/baissi/.local/share/opencode/ctg-owned-linux-70882269`. Its USTAR archive hash is `a86f79fca8fcb649e867cca07b7639b6ca157cc8626616cd312f0917ae8d9abc`; provenance still binds patch `94a18eec…`. It is not the forthcoming corrected release candidate. |
+| Binary-bound staging probes | On that retained Linux artifact, parent host-controls passed same-database restart, autocompaction off/on, and concurrent identical-shell attribution. Paired actual-TUI glyph proof passed ASCII/Unicode chrome and exact Unicode composer preservation. Production SWE host proof passed 14 productive turns, failing baseline → edit → passing test, real review receipt and subsequent source-mutation invalidation. First SWE invocation selected upstream because the generic fixture uses `CTG_OWNED_OPENCODE_RUNTIME`, not `CTG_TEST_RUNTIME_ARTIFACT_ROOT`; only the corrected `swe-owned.log` run establishes owned staging behavior. These are explicit-artifact staging probes, not installed release acquisition. |
+| Actual terminal blockers | Staged visual-clear failed waiting for persisted session A transcript cutoff; staged terminal-semantics failed because no loopback request followed picker cancellation and multiline paste. Focused harness diagnoses are separately assigned, preserving canonical transcript and actual input/terminal assertions. Physical clipboard and final installed acceptance remain unproved. |
+| Runtime v2 review `b9d6404` | Independent and parent request changes despite complete Linux prebuild checks and CI-mode 19/188 TUI assertions passing. Windows-style CTG checkout changes patch bytes to CRLF (`576f2e7c…`, not pinned `f66c58da…`), affecting copy/hash/assembly paths. Recipe also force-restores `bun.lock` before checking cleanliness, discarding local changes. Canonical input handling and dirty-lock fail-closed tests are required before dispatch. |
+| Product checks at `85fc2d2` | CI `39093505484` passes both Windows Node versions and browser; Linux/macOS pass `npm test` then fail actual workspace PTY (`CARTHAGENT` absent); native-package remains blocked. Local full test attempt reached 762 passes, zero assertion failures, one skip, and one cancelled budget-engine suite at the 120-second command timeout; it is not a full local pass. CLI #203 is published and under independent/parent review; parent found remaining Windows updater taskkill credential inheritance and notified its author. |
+| Owned task/product probes | The retained `72572a…` executable also passes two real Git worktrees, two independent root sessions, concurrent turns, isolation, and restart reconciliation (`tasks-owned.log`). Product entrypoint, workspace, archive, controls, event invalidation, reconnect snapshot, and reconnect event probes pass (`product-owned.log`). Both records report the owned runtime and exact executable digest. |
+| Live review-reset ordering | Parent source inspection and an actual three-prompt stream on `72572a…` show inbox enqueue → execution start → inbox delivery. #200 follow-up `dbc9ab0` reads the previous cached user message at execution start, so it still cannot reliably distinguish kickoff from later user work. Parent requests changes; authoritative delivery identity/metadata and coalesced-prompt behavior are assigned. `review-event-order.json` retains runtime identity and event ordering without provider credentials. |
+| Further staging checks | On `72572a…`, controls pass framed/raw sessions, compaction notes, location ownership, and restart. Outcomes pass provider failure, cancellation, neighboring-session isolation, recovery, and preservation of queued work after interruption. Review receipts pass independent-root identity, persistence, stale-source invalidation, and persistent admission limits (`remaining-domain.log`). Production acquisition accepts the actual retained Linux USTAR bytes through an injected local-byte fetch; this does not establish GitHub transport. Product `npm run build` passes at `4415b38796` (157 syntax checks, both typechecks). |
+| Follow-up review findings | #200 `59d8be0` uses exact inbox-delivered message lookup, but parent reproduces a delayed-lookup race: success marks the run finished while restored suppression is still active; the later lookup clears suppression without admitting review. Per-session event ordering and bounded/cancellable lookup are assigned. #203 `247eadb` independently passes 115 focused tests, native typecheck, and actual CLI host smoke on owned `72572a…`, but cancellation leaves its private fetched Git ref because cleanup receives an already-aborted signal. Parent also assigns sanitization of native review Git/gh children and Windows updater taskkill. None of these heads is composed. |
+| Owned delivery matrix | Parent preflighted retained `72572a…` and passed actual standard, strict, budget, raw, and concurrent production-composition delivery probes (`delivery-matrix-owned.log`). The first attempt using acquisition-oriented artifact-root options was correctly rejected because the single-platform staging manifest does not satisfy the current package-version/five-platform release contract; the successful explicit-owned-root staging run does not establish installed acquisition. |
+| Focused harness review | #205 `974308a` correctly selects the pre-clear newest-first cutoff, and independent tests/live proof pass, but both parent and independent review hold approval because it removes assistant viewport assertions from control/reopen. #204 `7f17ea3` improves picker cancellation but independent review finds its picker-only mode never opens the picker; its empty-Enter session-opening claim is unsupported by host behavior. Both authors are restoring meaningful behavioral coverage. Review of dirty author source does not approve #200 `59d8be0`; the reviewer corrected its verdict to request changes on the exact commit. |
+| Current follow-ups | #203 `60316b8` reports 130 focused tests and CLI host smoke passing; fresh exact review is underway, with parent flagging workspace ownership before model mutation and standalone provider/thinking handling. Runtime #166 `4a0b60` fixes canonical blob extraction and dirty-lock preservation, but independent Windows-style handoff still fails the pristine guard after command-local autocrlf normalization. No corrected candidate dispatch is approved yet. Browser Control remains disconnected with zero targets, so historical test-tab cleanup cannot be verified. Product lint passed ESLint and reached native typecheck before its 120-second command timeout; the earlier complete build remains the typecheck evidence. |
+| Completed remaining baseline probes | Full product lint subsequently completed successfully with a sufficient command timeout. Owned `72572a…` passes mixed delivery policy (`delivery-mixed-owned.log`), runtime-wrapper service reuse/repeated turns/final answer after tool/success metadata/failure/recovery/cancellation/neighbor/pre-abort/restart (`runtime-owned.log`), and evaluation success/failure, exact session usage attribution, unrelated-session isolation, and pre-admission budget handshake rejection (`evaluation-owned.log`). #205 follow-up `9e99262` restores unique assistant visibility in matched-size control and reopen views; parent source review and 6 Python tests pass, with exact independent live review pending. #206 `ec008cf` corrects focused picker control flow but full controlled terminal semantics remain incomplete; source review and deterministic diagnosis continue. |
+| Visual-clear #205 accepted | Independent and parent approve cumulative exact source `9e99262155311841c74382dd7c5b3ec961a090a0`, composed as `6852a6a379` + `632f425da1`. Parent reran the composed live probe on owned `72572a…`: PASS, with exact durable conversation unchanged by clear, unique follow-up user/assistant visibly rendered after reopen, matched uncleared control, preserved cutoff, and unaffected neighbor. Evidence: `clear-composed-proof.json`. Final installed-artifact acceptance remains separate. |
+| Host/report and latest CLI review | Owned host probe passes active paired plugin, archive RPC/output schemas/declared failures, and offline device authorization start/cancel. Report probe passes schema variants, freshness, ownership, and verified fail-closed behavior (`host-owned.log`, `report-owned.log`). Independent #203 review of `60316b8` confirms the foreign-workspace model mutation blocker; 68 CLI/updater and 51 workspace/runtime tests pass, and earlier ref-cleanup and child-environment fixes are accepted in scope. #206 `ec008cf` is held because new Python-import tests would import POSIX-only `fcntl` on Windows. |
+| Complete product checks at `d867a88709` | Full `npm test` completes: 763 passed, 1 skipped, zero failures/cancellations (104.98 seconds), including all three legacy engine budget lifecycle cases. The previous timeout is not evidence of a legacy budget defect. Python suite passes 19/19 with the retained verified Pillow dependency. Native repair-budget lifecycle evidence remains separately assigned; it is not implied by legacy tests or the simpler native budget scenario. CLI author is also adding its discovery fixture to the precise package allowlist so installed host-smoke imports resolve. |
+| Review admission #200 composed | Independent and parent approve exact `40a11f94542e3164b0f1897c2446132f0e7c7c03`; focused review-only commits compose through `3166193123`. Parent preserves existing theme/bridge imports and passes all 10 consumer tests plus native typecheck. The exact inbox lookup completes before terminal review admission; ordered/coalesced/stale/disposed paths are covered. |
+| Corrected v2 prebuild dispatched | Independent and parent approve `0e38142bff30ca2a8b2a66394e5055d541fce489`. Isolated Windows-style Git configuration keeps checkout bytes and recipe status consistent; the real recipe reaches controlled Bun installation, and dirty lock/source fail closed. Composed `da09e6463609b179b475533c474456b0b6aa195e` retains exact reviewed patch/recipe/workflow/tests; parent 40 workflow/runtime/acquisition checks pass. Five-platform prebuild `39097151119` dispatched at that exact SHA for planned `1.1.0`; no publish or upload has occurred. |
+| Digest and workspace harness progress | #201 `c1312ffc` independently/parent source-approved; extracted six exact PTY resolver/invocation/Python/test files as `e3eb3db76f`, with parent 8/8 tests passing. Independent full suite on its older base had two budget shutdown timing failures, with focused rerun 3/3; no unconditional full-suite pass is claimed there. Parent diagnosed workspace non-dispatch: after plugin readiness, first Enter selected argument-taking autocomplete rather than dispatching. #207 `67dc6c1c8f` dismisses autocomplete then submits once; live owned `72572a…` renders `Workspace native sessions` in 13 seconds. Independent #207 review is pending; this is staging, not installed acceptance. |
+| CLI #203 composed | Independent and parent approve cumulative exact `d73db85dbc78dfb98f633cec70ecdc4564a9ed8d`, composed through `828331be12`. Parent CLI/updater/workspace/runtime suite passes 123/123; full build passes. Foreign-workspace ownership precedes resumed mutation/launch, model/provider/thinking options are explicit, validator metadata merges, updater cleanup survives cancellation, child credentials are stripped, and installed smoke fixtures are precisely included. The final test-only correction injects all native ports so ownership tests cannot fall back to the user's service. |
+| Second prebuild outcome | Run `39097151119` successfully builds all five targets, including Windows; Linux x64/arm64 and Darwin x64/arm64 archive/upload jobs succeed. Windows fails in archive creation because GNU tar interprets `D:\a\…` as a remote archive host (`Cannot connect to D: resolve failed`). Assembly is skipped, so there is still no complete candidate. A focused archive-path fix is assigned; successful v2 artifacts are retained separately from v1 staging. |
+| Exact workspace rendering proof | Independent #207 proof now uses its own clean dependency-complete exact `67dc6c1c8fa732a7d6ba848c76679d07ea76a1e2` plugin tree and trusted runtime preflight; workspace renders after one submit Enter. Parent also verifies the composed #201 harness at `0942e67afa` using its existing `--dismiss-completion` path: actual `Workspace native sessions`, one Enter, 23.58 seconds (`/tmp/opencode/ctg-composed-workspace-c131.log`). #207 is not blindly cherry-picked over #201 because their flag/invocation baselines differ; final theme/model harness composition remains pending. |
+| Archive fix and third prebuild | Independent and parent approve `ccc59b09688070d61a189bbf93c91b309614e5ca`; both workflow suites pass 7/7, including execution of the relative archive path and USTAR command in a drive-letter-style workspace. Composed `20d555ce885f137ce97d02e141caaa6ac19aab00`; new five-platform run `39097969783` dispatched at that exact SHA. |
+| Complete five-platform candidate | Run `39097969783` succeeds for Linux x64/arm64, Darwin x64/arm64, and Windows x64, including archive uploads and candidate assembly. The candidate binds exact source `20d555ce885f137ce97d02e141caaa6ac19aab00`. Parent verifies all five archives through production acquisition/extraction with injected local-byte fetch, matching manifest/source/patch/lock/executable pins. Candidate Linux archive `b6bb2b59f0fa2c67759d9b00f4597a5a1f6232c67d6b985bc82f08d1e2545fe4`, executable `e9af36982c82a38666450376ebc80026348269bce1663163f3043a99bc70303c`. Independent candidate verification is assigned; no release tag, draft upload, or publication is implied. |
+| Remaining command parity findings | Current product still has obsolete plugin `/clear` and `/autocompact` unavailable handlers despite the owned host extensions; explicit auto-compaction arguments and dispatch are assigned a focused correction. #208 bridge extraction also needs portable temp assertions and follow-up login/update/billing-plan behavior. A direct `/help` probe on the pre-#208 plugin incorrectly submitted a prompt to a built-in provider; the probe failed, and the PTY harness is being made strictly offline before further command probes. Retained v2 (`a7f0dc…`) visual-clear, glyph payload-preservation, and host restart/automatic-compaction/shell-identity probes pass. |
+| Candidate independent approval and core probes | Independent exact-source/candidate review confirms successful workflow/run identity, exact 13-file bundle, five archive/build-record/checksum matches, and production extraction in a separate cache. Candidate manifest SHA-256 is `925399a2ad6ce111d046ab0159e2e4777ff27c403cf06a526e058a9cc3dd080b`. Parent core matrix passes all 11 probes on candidate executable `e9af3698…`: owned host controls, host activation, controls, outcomes, product, wrapper, tasks, review receipts, SWE host, evaluation, and report. Product source began at `a91c307933`; subsequent bridge composition overlapped the end of the matrix, so this does not substitute for immutable installed-product acceptance. |
+| Latest product checks and delivery readiness | Full product tests at `a91c307933`: 803 passed, 2 failed, 1 skipped, zero cancellations. Both failures are legacy budget child-exit watchdogs; focused rerun passes tools/seconds/repairs 3/3. Full lint passes. Candidate standard-delivery startup separately fails its 15-second plugin-visibility wait while plugin files are loading; the matrix stops there. A focused state-based readiness correction is assigned, with remaining candidate delivery cases pending. |
+| Focused bridges #208 composed | Independent approves exact `d9829452237d6dfa14c7d9f149d763358257f2db`, including portable temporary-path follow-ups. Parent composes through `171439d12dd21716c467469cf542dfba14225de0`, preserving CLI #203's typed Ship auth errors and `CTG_NODE_EXECUTABLE` while adding demo cancellation/output, resume, Ship/archive bridges, and shared release-fetch cancellation. The composed test fixture supplies the typed `call.error` port and asserts `unauthenticated`; 47 focused tests and native typecheck pass. Independent exact composition review approves: 37 bridge/resume/RPC/update tests, 72 CLI/update tests, and native typecheck pass. Actual Bun-hosted `/demo` still requires the assigned Node-executable environment handoff and live TUI proof. |
+| Retained v2 Linux staging | All four retained archives from `39097151119` match their build records and reviewed patch/source/lock pins. Linux archive SHA-256 `d79ce866a0a1214dc8c78180c3035e02377c44afb843d130430ba13fb4449897`, executable `a7f0dc2bf2c362a9227f9da37624ed925d9706f9b44005329f392314d63a4078`; trusted preflight and production owned identity pass. Composed CLI host smoke, runtime-wrapper lifecycle, report, evaluation, and two-worktree concurrent/restart probes pass on that exact executable. A matrix wrapper typo referenced nonexistent `test-native-worktrees.mjs` after its first three successes; the correct `test-native-tasks.mjs` then passes separately. This remains retained staging evidence, not the final assembled candidate. |
+
+PR #157 adds a real-terminal measurement harness. Its corrected editor-cell input
+detector still needs a controlled paired assessment against the 50 ms target.
+At `22109cb`, a 30-switch diagnostic reports p95 573.526 ms and maximum 696.095 ms,
+above the 150 ms target. Independent review found both destinations warmed and no
+intentional delay inside the timed interval. The measurement is an Enter-to-parsed-
+PTY-screen proxy, including terminal read/parse overhead, not a compositor
+presentation timestamp. A controlled, alternating baseline/CTG comparison remains
+pending; this diagnostic neither establishes acceptance nor attributes latency to CTG.
+The prepared ABBA runner at `08d8bf8` remains under changes requested: its CTG
+staging omits required runtime files, it does not verify observed plugin activation
+or baseline absence, artifact identities are missing, and failed conditions do not
+propagate a failing runner exit status. Correct these before the controlled run.
+The author reports ten passing offline guard tests for the follow-up changes. Select
+the intended current product commit explicitly for the run: the earlier `f5bf070`
+snapshot predates production delivery and later CLI composition and cannot stand
+in for current-product acceptance.
+The follow-up is published at `18e8642`. Parent and independent review found a
+preflight blocker: double-quoting the JSON-encoded checkout status makes the
+generated manifest invalid for both clean and dirty checkouts. Cleanup is also
+registered too late to cover setup failures. Source staging, plugin observations,
+and failure aggregation appear improved, but actual runner-path regressions are
+required alongside these fixes before a timed run can proceed.
+At `e6d401b`, independent source review confirms typed manifest serialization is
+wired into the runner and cleanup precedes staging. Eleven author guard tests
+pass, including the real JSON generator. Review still requires rejecting a
+selected source commit that differs from current integration HEAD. Parent also
+requested portable test-path handling and offline coverage of actual runner
+failure/cleanup paths. No controlled measurement or performance approval exists.
+The `d5ad57c` follow-up adds current-HEAD validation and shared ABBA/cleanup tests
+(14 author tests pass), but parent inspection found the early validator's exit
+code is ignored before `set -e`, and a callback's nonzero exit can be hidden by
+an already-recorded zero status. Actual shell-exit regressions and corrections
+are assigned; independent review is in progress and ABBA remains on hold.
+At `198e66b`, independent review approves the harness for a scheduled run. Parent
+isolated execution passes all 15 guard tests, including actual stale-source
+rejection, cleanup, and conflicting callback-status/nonzero process-exit cases.
+A quiet measurement window is being coordinated; no timed result or performance
+acceptance is established by these harness checks.
+The authorized attempt ran on 2026-10-17 from 18:15:41 to 18:16:54 UTC using
+source `38ad06f` and harness `198e66b`, then exited 1 with no valid samples.
+Both baseline seeders failed on a null plugin path; CTG inventory was active,
+but both CTG measurements failed to locate the editor placeholder. Artifacts
+remain at `/tmp/opencode/ctg-native-terminal-paired-approved-20261017T181325Z`.
+These are setup failures, not latency measurements. The quiet window ended;
+baseline startup and actual PTY readiness fixes need review before another run.
+Short idle observations showed no PTY output; they do not establish long-running
+memory bounds.
+
+Native runtime-wrapper acceptance, delivery enforcement, provider authentication,
+command compatibility, installed SWE workflows, reconnect behavior, and performance
+remain release gates. PR #154 removes per-stream shared-dispatcher destruction and
+uses captured-dispatcher cleanup at print-mode shutdown. Parent verification of
+`46c9ae9` reproduced the pristine patch exactly; seconds and repairs tests passed,
+while tool-mode startup hit its total watchdog. The subsequent `d85579b` fixture
+separates a bounded startup phase from its 15-second post-stop shutdown deadline.
+A controlled clean exact-head parent run passed all three modes and all twelve
+natural exits, including successful requests after reset; initial stop-to-close
+times were 36–102 ms. Independent review and all fifteen CI checks passed, and
+#154 merged. Earlier contended failures remain recorded rather than treated as
+passing evidence.
+Native execution remains opt-in until these gates pass.
+
+Pinned-host extension gaps remain for visual-only transcript `/clear` and
+per-session `/autocompact`. The 2.0.32 plugin interface exposes neither a
+transcript presentation boundary nor a per-session automatic-compaction policy.
+CTG-owned host extension work must prove these behaviors without deleting history
+or mutating shared compaction settings. Theme acceptance also requires installing
+the semantic JSON theme in the owned profile and verifying actual rendered colors.
+
 ## Review workflow
 
 Implementation uses `lattice/gpt-6-luna#high` in separate worktrees. A different

package/docs/opencode-owned-runtime.md

@@ -0,0 +1,241 @@
+# CTG-owned OpenCode v2.0.32 UI runtime
+
+Published native releases select a CTG-owned, source-pinned runtime through the
+packaged `lib/opencode/runtime-release.json`. The default resolver downloads the
+exact platform asset for that release, verifies archive and executable checksums
+and source/patch/lock provenance, and caches it under Carthagent's private profile.
+It never replaces a regular OpenCode installation or rewrites `@opencode/cli`.
+Selecting the owned runtime is fail-closed: a missing or invalid release asset is
+an error, not permission to fall back to a different executable.
+
+`CTG_OWNED_OPENCODE_RUNTIME` is a separate staging/developer selector, not the
+normal end-user installation path. An explicit directory must contain the
+matching `ctg-runtime.json`, `SHA256SUMS`, and platform artifact. Native is the
+CLI default in the unpublished preview.9 candidate, inherited from preview.8;
+`ctg native` remains an alias. The legacy
+`--engine-cli` option cannot restore the retired console.
+
+## Current preview.9 candidate (unpublished)
+
+Prebuild run `40151970983` succeeded for all five native targets and assembly
+using source `c51c5ae11293e63b658df297abc732db88d9109a` for package
+`1.1.0-preview.9`. The original 13-file bundle was independently verified with
+the production acquirer; regenerated manifest bytes matched exactly. Candidate
+manifest SHA-256:
+`aa5de65b633219423d21b1cc645945028a2d5565714b71760cbcc18badc5f4e5`.
+Upstream, patch, lock and detached runtime identity are unchanged from preview.8;
+the release-bound archive set and manifest must still be treated as preview.9
+artifacts, never replaced with preview.8 assets.
+
+The new Linux ARM64 bytes passed isolated staged native-host and Ship-model
+probes. Other platforms' independent execution, final-tag/default-resolver
+acceptance against a draft, and anonymous public installed acceptance remain
+pending. No preview.9 tag, draft, asset upload or publication is included in
+this candidate preparation. See the [current notes](release-notes-preview.9.md)
+and [explicit unpublished-artifact instructions](native-manual-testing.md).
+The older source/build observations below are historical, not claims that all
+preview.8 or preview.9 acceptance gates have passed.
+
+## Pinned inputs and reproducible source application
+
+- Upstream: `https://github.com/anomalyco/opencode`
+- Tag/revision: `v2.0.32` / `843a6c514e606b436a7fe713422ace0a93ad3d61`
+- CTG patch: `docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch` (combined-v4 plus the directory-first Projects rail, folder-browser dialog, shared folder/model session setup, and the isolated source-preview launcher)
+- Patch SHA-256: `ec4bb182308ed8b311513aad5c9c7d57dcd0db103f0882f3dc3517d535b4c975`
+- Previous combined-v4 patch SHA-256 (preview.11 and preview.12): `1f2309bb3a31dfb8e8a0827a6a1144a1f76a005abff58f6f48857639ec02478a`
+- Lock SHA-256: `9d78379cd264584a495440a217b9d2ecab524c9a56f7f8b4b5bed3926daa330d`
+- Historical combined preview.8 source verification: 136 retained TUI rendering/loader/theme/selection
+  regressions, 24 core recovery/shell regressions, and core/server/plugin/client/tui
+  typechecks passed. Exact five-platform archives and full installed-package
+  acceptance remain per-release gates; source tests alone do not satisfy them.
+- Historical migration verification: Bun 1.4.2 frozen-lockfile install passed, TUI
+  typecheck passed, and glyph/keymap/plugin-theme/real-provider-theme tests
+  passed together (19 tests / 188 assertions, one process,
+  `--timeout 60000`). Independent review approved exact corrected head
+  `0e38142bff30ca2a8b2a66394e5055d541fce489`, including the canonical
+  Windows-style checkout-to-recipe handoff and dirty-input rejection.
+  At that historical revision, five-platform build and installed-artifact acceptance were still pending.
+- Historical workflow registration: independently and parent-approved bootstrap #197
+  passed CI and merged on `main` as `bd1292c8c4`. The workflow is registered;
+  actual prebuild run `39089640210` was dispatched at reviewed source
+  `70882269e25ebcb62c843f9265345342b9e6844d` for planned version `1.1.0`.
+  That first run produced Darwin archives but failed the other three targets.
+  That initial run was not a complete five-platform candidate; later previews have separate tagged manifests.
+- Historical separate parent-quality follow-up: native CLI browser-launch isolation
+  `d4983b57328a187e8be6bc0e2c6bd2dda7518920` is not part of this upstream source
+  patch and must be integrated in its applicable parent branch before the
+  parent's full-quality result is claimed.
+- Toolchain: Bun `1.4.2` as pinned by the upstream source
+- Compatibility version: `2.0.32`; detached CTG version/channel:
+  `0.0.0-ctg.2.0.32` / `ctg.2.0.32`
+
+The patch includes visual-only `/clear` backed by a durable per-session
+transcript presentation cutoff (no server message deletion),
+`/autocompact` persisted in that session's metadata (manual `/compact` still
+works), authoritative shell-origin/session/call correlation and capability
+gating, and the terminal title-stack save/restore lifecycle. Native tool,
+CodeMode child calls, and explicitly manual shell are distinguished; missing
+external shell provenance stays unowned/fail-closed and is never inferred from
+cwd or command text. The shell-origin capability is advertised only by a CTG
+channel build.
+
+To apply/build, use a clean checkout of the exact revision, install Bun 1.4.2,
+copy this patch and `script/ctg/build-owned-runtime.sh` into it, then run:
+
+```sh
+script/ctg/build-owned-runtime.sh opencode-linux-x64
+```
+
+For a local CTG checkout, copy the artifact contents (not the 180 MB binary
+into Git) to a managed directory and opt in explicitly:
+
+```sh
+CTG_OWNED_OPENCODE_RUNTIME="$HOME/.carthagent/runtimes/opencode-ctg-2.0.32" npm run ctg -- tui
+```
+
+The resolver rejects a wrong source/patch manifest, a different OS/architecture,
+an unlisted or modified executable, or an unexpected runtime version before it
+starts a service. The TUI is pointed at the already-owned temporary-profile
+service just as for the existing package-owned runtime.
+
+Release installation must use only a canonical CTG tag-bound asset/version,
+cache under a CTG-owned data directory, validate the asset manifest and exact
+runtime binary digest, and fail clearly offline or on unsupported platforms.
+It must never silently fall back to `@opencode/cli` after selecting the owned
+runtime, nor rewrite that package's binary. The release gate must install the
+normal package with no runtime environment override and prove it starts this
+owned runtime. Preview.9 assets have not yet been published; historical preview
+assets do not satisfy its release gate.
+
+Use a matching native OS/architecture for other upstream-supported targets;
+cross-compilation is rejected. The script fails closed on source revision,
+Bun version, patch hash, and `git apply --check`; it applies the patch, runs
+the affected typechecks/tests, builds with web UI omitted, and writes
+`ctg-runtime.json`, `SHA256SUMS`, and the upstream MIT license into the output.
+The runtime resolver validates every manifest contract field, the native
+platform, executable checksum, and exact detached `--version` before launch.
+It does not search PATH or silently fall back when the opt-in is selected.
+
+The CTG workflow has separate `prebuild` and `publish` dispatch modes. Prebuild
+uses a reviewed source commit and planned package version, performs five native
+builds, records executable digests from the built bytes, and carries the exact
+USTAR archives and records through the manifest generator into a reviewable
+candidate artifact. It does not require a final tag. Publish accepts only a
+successful run of this workflow, downloads that run's candidate bytes,
+regenerates and compares the manifest against the final tagged package, and
+refuses to overwrite an existing runtime asset on the draft release. Prebuild
+may be dispatched from a reviewed branch before product merge, but its explicit
+source SHA must equal the dispatch workflow commit; this is non-publishing and
+does not constitute product or release approval. Publish remains restricted to
+the default branch and verifies again against the final tagged package.
+
+Release sequencing is deliberately split across two manual workflows. First,
+build and review the immutable five-platform-archive set, package the final
+trusted runtime manifest, tag the exact package commit, create a GitHub draft
+release, and upload the identical reviewed release assets. The draft contains
+the five `opencode-*.tar.gz` archives plus exactly one `runtime-release.json`
+and one `runtime-release-SHA256SUMS.txt` combined checksum file (seven assets
+total), as uploaded by the approved publish workflow. Then run
+`Accept draft runtime release` for that exact tag. The final acceptance workflow must be dispatched from the
+approved `main` branch. Before checking out the release tag or executing any
+tag-sourced verifier, a trusted inline bootstrap reads `package.json` from
+`origin/main`, checks the exact version tag, and verifies that the peeled
+annotated or lightweight tag commit is an ancestor of `origin/main`. The same
+main/tag ancestry and exact-SHA relationship is checked again after acceptance.
+It requires the release to remain a draft with exactly those seven assets, runs
+`npm ci` and full `npm run quality`, and runs the current full,
+non-focused installed-package gate with `CTG_REQUIRE_OWNED_RUNTIME=1` and the
+normal default resolver. The independently reviewed host-controls, glyph,
+controlled-terminal semantics, and visual-clear/reopen probes are now composed
+into that gate. Their live final-artifact results remain pending. GitHub
+documents that only callers
+with push access receive draft releases from the release-list endpoint. The
+workflow therefore grants its job `contents: write`, the minimum `GITHUB_TOKEN`
+permission that provides the required push capability. This is a write-capable
+token, not a read-only token: the workflow deliberately uses it only for
+read-only GETs to inspect draft/release metadata and retrieve the runtime assets.
+There are no POST/PATCH/PUT/DELETE requests, release creation/publication or
+asset-upload commands, or control-plane calls in this gate. The acceptance step
+clears `GH_TOKEN` and passes the token only as `CTG_RUNTIME_GITHUB_TOKEN` for
+asset reads; checkout credentials are not persisted. The workflow checks the
+same draft ID and tag target again after acceptance.
+
+Only after that gate succeeds and the release owner approves should the release
+be published. The existing `Release` workflow is the post-publication gate. Its
+installed-package acceptance uses `CTG_RUNTIME_GITHUB_TOKEN` explicitly empty,
+proving the ordinary anonymous public resolver path. Its stable-only
+`publish-release-manifest` job verifies the published asset set and five-platform
+manifest before publishing the control-plane manifest. Prerelease tags such as
+preview.9 skip that job and never advance the stable control-plane pointer;
+experimental selection reads published prereleases from GitHub. Neither workflow creates a release,
+uploads assets, publishes a release, or dispatches another workflow. This
+sequence still requires separate approval and execution against the final
+preview.9 release artifacts; candidate prebuild verification is not that gate.
+
+When a release is still a GitHub draft, CI may opt in to authenticated asset
+retrieval by setting `CTG_RUNTIME_GITHUB_TOKEN` for the resolver/verifier
+process. This transport is optional: without it, installed products use the
+normal anonymous public release-download URL. With it, the token is used only
+for read-only `GET` requests to the fixed `api.github.com/repos/B-icy/Carthagent`
+release and asset APIs. The transport requires one exact `v<packaged-version>`
+release and one exact expected asset name; it does not fall back to public
+downloads if the requested draft release or asset is absent or ambiguous.
+GitHub asset redirects are followed without forwarding the credential. The
+token is removed from OpenCode, workspace, and runtime identity-check child
+environments, and the
+existing packaged runtime-release manifest remains the sole source of archive,
+executable, and provenance trust pins. The normal no-token installed-package
+acceptance remains required after publication.
+
+## Historical source-level full-TUI glyph evidence
+
+The pending-build statements in this section describe the original composition
+checkpoint, not the current preview.9 prebuild status above. They do not establish
+complete acceptance of any later release.
+
+The approved glyph-v4 patch is composed into the reviewed `81e` base patch. A
+combined candidate adds the separately approved spinner test-isolation
+follow-up and real-provider theme integration test. Exact-digest source review
+and independent combined-suite reproduction passed; the final build and live
+acceptance remain pending. The host patch adds
+a centralized host-chrome registry to the full TUI while preserving arbitrary
+user text. The glyph author reports independent source approval and 11 focused
+tests/146 assertions passing on the author worktree. This is source evidence,
+not final-binary evidence; the exact composed binary must still be built and
+tested before claiming compatibility.
+
+The source patch centralizes host-chrome glyphs (borders, selection/status
+markers, spinners, and structural tree/connector marks) for the full TUI. It maps
+only registered chrome tokens to readable ASCII alternatives, preserves theme
+colors and typography, and does not sanitize or transliterate arbitrary user
+text, filenames, diffs, shell output, or code. The exact final binary still needs
+the reviewed full-TUI terminal matrix and unknown/legacy-terminal proof.
+
+Any source-patch change invalidates prior binary, manifest, and title evidence;
+rebuild and revalidate the exact resulting artifact before making
+terminal-compatibility claims.
+
+The approved `/help` patch gives bare `/help` deterministic extension-over-native
+dispatch and restores native help when an extension claim is removed. The help
+author reports the parent’s full keymap suite passed 5/5. The exact final binary
+still must demonstrate the agreed bare-help UI behavior before release claims.
+
+## Historical artifact and bounded title evidence
+
+At this historical checkpoint, no binary had been built from the final composed
+patch yet. Earlier Linux
+artifact and PTY title observations used the pre-composition patch and are
+superseded for release acceptance. Build, executable digest, runtime manifest,
+full-TUI glyph/help/theme proofs, and title restore/readback must all be recorded
+against the exact reviewed composed patch before release.
+
+No paid provider traffic or real profile was used. Core compaction and shell
+retention tests passed 16/16, server shell HTTP-provenance passed 1/1, renderer
+tests passed 5/5, and the clear UI test reported 3 passing assertions with a
+cleanup lock warning. The native build recipe includes all focused source
+gates; Bun's upstream provenance verification was independently reviewed but
+could not be rerun in the review environment. Full two-session state isolation
+across restart, visual clear preservation in a real service, auto-compaction
+on/off through overflow, manual compact, concurrent authoritative shell
+attribution, final title restoration, glyph/help behavior, approved artifact
+distribution, and installed default selection remain release gates.