opencode-secrets-obfuscation 0.1.0 → 0.1.2

package/docs/history/27-owned-tools-final-review.md

@@ -1,93 +0,0 @@
-# 27 — Owned tools final review
-
-Date: 2026-10-13
-
-## Scope and evidence
-
-Reviewed the current P4 implementation and integration boundary:
-
-- `src/tools/index.ts`
-- `src/opencode/v2/index.ts`
-- `tests/unit/tools.test.ts`
-- `tests/integration/tools.test.ts`
-- `tests/contract/plugin-v2.test.ts`
-- `package.json` and the installed dependency tree
-- histories [24](24-owned-tools-implementation.md), [25](25-v2-plugin-integration.md), and [26](26-owned-tools-review.md)
-- the V2 plugin documentation and `docs/spec/{design,plan}.md`
-
-No source or test files were changed. No OpenCode process, ACL/source-loader probe, or
-host qualification run was performed.
-
-Executed evidence:
-
-```text
-npm run typecheck                         PASS
-node --test tests/unit/tools.test.ts \
-  tests/integration/tools.test.ts \
-  tests/contract/plugin-v2.test.ts        15 pass, 0 fail, 0 skip
-git diff --check                           PASS (line-ending warnings only)
-```
-
-The focused suite is exactly 15 tests: 9 unit, 3 integration, and 3 V2 contract
-tests.
-
-## Decision
-
-**Injected owned-tool boundary: conditional signoff-ready.** The pure P4 boundary
-now resolves the principal findings from history 26: source and catalog inputs must
-be frozen/admitted, source entries are capability/session filtered, output and working
-budgets are bounded, HTTP authorization precedes transport use, response bodies and
-headers are not projected, and non-cooperative requests terminate with a fixed error.
-The native V2 entrypoint typechecks and registers documented Effect hooks and
-`codemode: false` tools.
-
-This is not signoff for an installed plugin-only MVP, a protected deployment, or a
-production transport. The tests exercise injected objects and API shapes; they do
-not establish native host behavior, serialization ordering, captured-executor
-lifecycle, or real network/filesystem security.
-
-## New must-fix findings
-
-### 1. Source budget is not checked after adding source headers — medium
-
-`credentialsRead` checks `maxBytes` and `maxWorkingBytes` while enumerating entries,
-then adds per-source header costs at `src/tools/index.ts:166-169` without checking
-the updated totals. A caller can therefore receive a result exceeding a deliberately
-lower configured source budget when the entries fit but the headers do not. The
-canonical sink's separate ceiling does not enforce the caller's lower source budget.
-Check and fail after header accounting, before constructing `lines`.
-
-### 2. Snapshot/catalog identity uniqueness is not enforced — medium
-
-The admission predicates validate individual records but do not reject duplicate
-source entries/bindings, duplicate source IDs across a published source snapshot, or
-duplicate capability identities/names in a catalog. This conflicts with the design's
-whole-snapshot duplicate rejection rule and makes catalog lookup (`find` in the HTTP
-executor) order-dependent. The native source/catalog adapters must reject ambiguous
-identities atomically before publication.
-
-These findings are implementation follow-ups, not reasons to reject the narrow
-injected-boundary conclusion; they block claiming the complete source-admission
-contract until fixed and tested.
-
-## Explicit remaining limitations
-
-1. **Default unavailable factory.** `makeEffect()` uses
-   `unavailableRuntimeFactory` unless a qualified `CoreRuntimeFactory` is injected.
-   The default tools fail with `CREDENTIAL_RUNTIME_UNAVAILABLE`; this is intentional,
-   not a working source-backed runtime.
-2. **Native source loader absent.** No opened-handle, filesystem/ACL, dotenv parser,
-   source watcher, or source-to-admitted-snapshot adapter is integrated. The current
-   boundary accepts only an already admitted immutable snapshot.
-3. **Trusted HTTP transport absent.** `HttpTransport` is injected. DNS/address
-   selection and pinning, TLS peer/hostname verification, proxy and redirect refusal,
-   header/parser limits, connection policy, and real socket cancellation remain
-   trusted transport responsibilities and are not qualified here.
-4. **Host qualification absent.** No real V2 host was launched. Tool discovery,
-   schema/serialization, hook ordering and abort behavior, progress/publication
-   sinks, reload/unload, captured executors, and host readiness are unverified.
-   The isolated real-host smoke/qualification gates remain open.
-
-Accordingly, the correct release wording is **injected, trusted-boundary component
-ready subject to the two fixes above**, not “MVP qualified,” “host protected,” or
-“production ready.”

package/docs/history/28-owned-tools-signoff.md

@@ -1,98 +0,0 @@
-# 28 — P4 owned-tools sign-off
-
-Date: 2026-10-13
-
-## Scope and evidence
-
-Reviewed the current owned-tool and native V2 boundary:
-
-- `src/tools/index.ts`
-- `src/opencode/v2/index.ts`
-- `src/store/index.ts` (`ActivationStore.isEnrolled`)
-- `package.json` and `package-lock.json`
-- tests and histories 24–27
-
-No source files, tests, or package files were changed. No OpenCode process was
-launched.
-
-Executed evidence:
-
-```text
-npm run typecheck                                      PASS
-node --test tests/contract/*.test.ts                  3 pass, 9 TODO, 0 fail
-node --test tests/unit/tools.test.ts \
-  tests/integration/tools.test.ts                     15 pass, 0 fail
-git diff --check                                       PASS (line-ending warnings only)
-```
-
-The direct package pins are exact and agree between the manifest, lockfile, and
-installed tree: `@opencode/plugin` 2.0.28, `effect` 4.0.1, `typescript` 5.9.3,
-and `@types/node` 24.19.2.
-
-## Findings
-
-The latest fixes address the owned-tool findings from history 27:
-
-- Source and catalog admission validates the complete frozen snapshot before
-  publication. Duplicate source entries, bindings, and catalog identities are
-  rejected atomically; duplicate source IDs are rejected before read output.
-- Source headers are included in byte and working-memory accounting before any
-  output lines are constructed. Entry counts, UTF-8 sizes, fixed ceilings, and
-  sink budgets are bounded.
-- Read visibility is bound through source/key/capability bindings and session
-  membership. `ActivationStore.isEnrolled` checks active state, generation,
-  location, session, and agent, and is used before both tools proceed.
-- Admitted snapshots and catalogs are immutable/frozen and generation-bound;
-  callers cannot supply arbitrary mutable source objects to the read path.
-- HTTP authorization and store proof precede transport use. Timeout/abort and
-  resolved-response cleanup require bounded cancellation completion, with a
-  fixed operation error on failure. Response bodies and headers are not
-  projected.
-- The native V2 adapter has typed tool executors and documented hook
-  registration. Its default runtime remains explicitly unavailable.
-
-## Decision
-
-**CONDITIONAL GO — injected owned-tool boundary only.** The pure executors are
-sign-off-ready as an injected component when supplied an already admitted
-immutable snapshot and a separately trusted/qualified transport. This is not a
-claim that the component protects an installed OpenCode deployment.
-
-**NO-GO — installed plugin.** The default plugin factory is
-`unavailableRuntimeFactory`; its credential tools intentionally fail with
-`CREDENTIAL_RUNTIME_UNAVAILABLE`. No source loader, activation assembly, or
-production core factory is installed.
-
-**NO-GO — default factory as a functional runtime.** `makeEffect()` without an
-injected factory is a safe unavailable fallback, not a working credential
-runtime and not a shipping/default-runtime claim.
-
-**NO-GO — host qualification.** No real OpenCode host was launched. Contract
-tests prove package/API shape only; they do not qualify discovery,
-serialization, hook ordering, abort behavior, reload/unload, or host readiness.
-
-## Residual gates
-
-### Source/admission
-
-Implement and qualify native source opening, ACL/location binding, dotenv
-parsing, handle allocation, reload/watch behavior, and the adapter that
-constructs and publishes complete admitted snapshots. Prove aggregate quotas,
-generation transitions, teardown ordering, and no stale snapshot/executor
-visibility under reload.
-
-### Transport
-
-Provide a separately trusted transport and tests for DNS/address selection and
-pinning, TLS peer/hostname verification, proxy and redirect refusal, parser and
-header limits, connection reuse policy, secret-safe logging, and real socket
-cancellation. The current tests qualify only the injected transport contract.
-
-### Host/plugin
-
-Supply a qualified `CoreRuntimeFactory`, then run the isolated real-host smoke
-and qualification gates for tool discovery, schema/result serialization,
-session/agent mapping, hook ordering, error publication, captured-executor
-lifecycle, teardown, reload, and abort behavior. Until those gates pass, do
-not describe this as an installed MVP, protected host, or production-ready
-plugin.

package/docs/history/3-p0-harness-foundation.md

@@ -1,105 +0,0 @@
-# P0 harness foundation
-
-Status: implemented test infrastructure only; no product or OpenCode runtime was launched.
-
-## Scope
-
-- `tests/support/run-directory.ts` creates a unique directory below an explicit
-  absolute root, writes an exact ownership marker, and verifies private
-  permissions. POSIX mode is verified as `0700`; Windows uses `icacls` with
-  inheritance removed and verifies the resulting full-control ACL query. Any
-  permission/verification uncertainty fails closed.
-- Cleanup first validates the directory, regular single-link marker, and exact
-  marker bytes. It traverses with `lstat`, removes links as links, never follows
-  them, and removes only that validated directory.
-- `tests/support/child-process.ts` requires an explicit executable, argument
-  vector, absolute cwd, explicit allowlisted environment, and bounded startup,
-  overall, and output limits. It never invokes a shell or inherits the parent
-  environment. Failures expose fixed error codes only; captured output remains
-  in the private result/error boundary.
-- `tests/fixtures/process-child.mjs` is a synthetic Node-only child fixture.
-
-## Process-tree boundary
-
-The helper tracks and kills only the PID returned by its own `spawn` call. It
-does not discover, signal, or claim to terminate arbitrary descendants. A
-future real-service harness must add an OS-native process-group/job boundary
-and qualify its behavior per platform before making a process-tree cleanup
-claim. Timeouts and cancellation are therefore only a guarantee about the
-owned direct child within this helper's boundary.
-
-## Evidence
-
-The unit suite covers marker ownership, exact cleanup, link-safe cleanup where
-the platform permits link creation, supplied environment/cwd, output limits,
-overall timeout, and pre-cancellation. It launches only `process.execPath`
-with the checked-in synthetic fixture and synthetic values.
-
-Initial red run (before the support modules existed): `npm.cmd run test:unit`
-failed with `ERR_MODULE_NOT_FOUND` for `tests/support/run-directory.ts`.
-Passing focused run after implementation: `node --test
-tests/unit/harness.test.ts` — 6 passed, 0 skipped.
-
-Repository `npm.cmd run check` remains blocked by a concurrent untracked
-`tests/unit/recording-endpoint.test.ts`, which imports the missing
-`tests/support/recording-endpoint.ts`; that file is outside this task's owned
-paths and was not modified. The owned files pass standalone TypeScript
-checking.
-
-## Corrective evidence (review 6)
-
-The infrastructure review found lifecycle, cancellation, executable identity,
-ACL, and recursive-cleanup defects. The owned files were repaired without
-claiming a hostile real-host boundary:
-
-- Child failures now stop accepting output, signal the directly spawned PID,
-  escalate to a forced signal after a grace period, and reject only after child
-  and stdio close. If that cannot be proven within the bound they return the
-  fixed `TEARDOWN_FAILED` code. Pre-cancel is checked before hashing/spawn and
-  the fixture's marker test makes an accidental launch observable.
-- Options are runtime-validated, the explicit executable is an actual
-  regular-file SHA-256 match supplied by the caller, and Windows environment
-  names are case-insensitively de-duplicated. Hash-before-launch is an
-  artifact identity check, not a hostile replacement/race-proof launch claim.
-- Existing roots are never chmod/ACL-modified. POSIX roots/ancestors are
-  checked for ownership and unsafe write permissions. Windows uses the current
-  SID and fixed System32 Windows PowerShell/.NET ACL introspection; new
-  directories are assigned exactly one current-SID full-control ACE with
-  container/object inheritance, and child ACL verification is tested.
-- Cleanup is intentionally narrowed: after exact marker validation it removes
-  only an empty marker-only directory. Nested content, links, and races are
-  refused as `RUN_DIRECTORY_CONTENT_UNSAFE`; tests remove their own known
-  synthetic paths in `finally` blocks. This is not handle-relative,
-  race-free recursive cleanup.
-
-Focused corrective run: `node --test tests/unit/harness.test.ts` — 11 passed,
-1 platform skip. Standalone TypeScript checking of the three owned TypeScript files
-also passed. The current `npm.cmd run check` reaches the full suite but fails
-the concurrent agent's `tests/integration/windows-job.test.ts` (`P0-JOB`:
-five Windows job containment cases with native `CreateProcess failed: 87` or
-missing child PID); that integration test and host fixture are outside this
-task's owned paths and were not modified.
-
-Remaining blockers are unchanged for real-host use: no qualified POSIX
-process-group or Windows Job Object tree boundary, no hostile-race-proof
-opened-object executable launch, and no handle-relative private-tree cleanup.
-This direct-child helper is unavailable as an actual OpenCode host/service
-isolation boundary until those platform qualifications and the P0 native/host
-gates are complete.
-
-## Follow-up correction
-
-The final staging review identified three test-infrastructure issues and an
-inaccurate cancellation comment. Ancestor validation now permits trusted
-root-owned Linux ancestors when their write/sticky permissions are safe, while
-new run directories must remain current-UID-owned and `0700`. Missing root
-hierarchy components are created one at a time with private permissions; no
-existing ancestor is chmodded or ACL-modified. Tests cover both a fresh nested
-root and a root-owned sticky ancestor.
-
-Child containment now rejects absolute cross-volume `relative()` results and
-proper `..` components before ACL inspection. The Windows-only cross-volume
-test is an explicit platform skip elsewhere, not a false pass. The child
-helper comment now distinguishes pre-spawn cancellation checks from the
-post-spawn cancellation listener; the post-spawn test confirms cancellation
-waits for teardown before cleanup.

package/docs/history/4-p0-source-opening.md

@@ -1,78 +0,0 @@
-# P0-C — source-opening feasibility spike
-
-Date: 2026-10-13
-Status: **Windows partial feasibility; not a platform qualification (corrected 2026-10-13, infrastructure follow-up)**
-
-## Environment inspected
-
-- Windows 11 Pro, build 26200, ARM64.
-- The fixture proved the opened handle is on `NTFS` using
-  `GetVolumeInformationByHandleW`; the separate `fsutil` query was denied.
-- No `cl`, `clang`, `clang-cl`, `gcc`, CMake, or .NET SDK was installed.
-- PowerShell's legacy `Add-Type` C# compiler was available. No WSL/Linux tool
-  environment was found or installed.
-
-## Executed evidence
-
-`tests/p0-native/windows-handle-loader.tests.ps1` was added as a dependency-free
-native API fixture. It uses P/Invoke rather than ordinary `ReadAllText` or an
-`icacls` preflight. The test creates and ACL-hardens its private temporary
-directory before writing a synthetic source, then:
-
-1. opens the directory and final file by component-relative `NtCreateFile` with
-   both `OBJ_DONT_REPARSE` and `FILE_OPEN_REPARSE_POINT` active (the prior
-   report incorrectly described this as untested because it overlooked the
-   masked options defect);
-2. obtains final-handle identity/link count and reads via that same handle;
-3. attempts to create a symbolic link, reporting Win32 error `1314`
-   (`ERROR_PRIVILEGE_NOT_HELD`) without treating setup failure as rejection;
-4. creates a native hard link successfully and asserts the opened object's link
-   count is two; and
-5. attempts an ancestor directory junction through the native reparse ioctl
-   (setup error `4392`, `ERROR_REPARSE_TAG_INVALID`), then uses the OS Junction
-   primitive to create the same synthetic adversary and verifies the ancestor
-   is rejected. The native creator error remains recorded; the fallback is not
-   counted as native-creator qualification.
-6. inspects owner/DACL through native `GetSecurityInfo` on opened handles. The
-   policy accepts only the current service SID, SYSTEM, and built-in
-   Administrators; rejects unknown/broad ACEs, deny ACEs, wrong owners, and
-   missing current-SID read or ancestor replacement masks. A one-link source is
-   accepted; a genuine native hard link is rejected by policy with link count
-   two. A broad inherited `BUILTIN\Users` ancestor/file fixture is rejected.
-7. renames the opened positive file, creates a replacement at the original
-   name, then rewinds and reads through the original handle; identity remains
-   unchanged before/after the swap and the original handle remains readable.
-
-The corrected fixture was executed on this host and returned the deliberate
-partial result
-`P0-C-WINDOWS: PARTIAL (NTFS/relative/identity/read/post-read/hardlink; gaps=reparse-create-1314,junction-native-create-4392)`.
-The core relative-open/identity/read/post-read checks and genuine native
-hard-link setup ran. Symlink setup was unavailable for the precise privilege
-error above; the OS Junction fallback allowed the actual ancestor rejection
-assertion to run. The `fsutil` denial does not establish hard-link support or
-filesystem type; the handle APIs establish those tested facts instead.
-No result is represented as a qualification pass.
-
-## Result against R8
-
-The native API route is feasible without a product package dependency, but the
-P0 gate is **not met**. The fixture demonstrates a narrow handle-relative
-primitive candidate; it now proves the configured no-reparse flags on a real
-NTFS handle path, native owner/DACL inspection for the tested ACE shapes,
-single-link policy, ancestor replacement-mask policy, and post-swap identity
-stability for this run. It does not prove all effective-token combinations,
-service-SID resolution, every ACE/tag variant, final size consistency under
-mutation, concurrent ACL changes, or safe concurrency. Linux/ext4 is entirely
-untested. Alternate data streams, mount types, symbolic-link tag variants, and
-other reparse tags remain untested. Ordinary path reads and ACL preflights
-remain insufficient.
-
-## Recommendation / blocker
-
-Do not select a JavaScript-only or path-based loader. Before architecture is
-committed, build or adopt one small audited Windows helper exposing only a
-bounded handle-relative open/read/identity operation, with native ACL effective
-rights and ancestor replacement checks, and a matching Linux `openat2`
-implementation. Pin and review its source/build artifact. If those tests cannot
-be completed, advertise no filesystem source platform rather than weakening R8;
-the fallback should be a dedicated supervised helper/service, not `readFile`.

package/docs/history/5-qualification-gate-review.md

@@ -1,133 +0,0 @@
-# Qualification gate review
-
-Scope: `tests/support/qualification.ts` and `tests/unit/qualification.test.ts` only.
-This is a review of the bookkeeping assessor, not evidence that any host, plugin,
-capture, or security property has been qualified.
-
-## Verdict
-
-**Not a real qualification gate yet.** The selected-case bookkeeping logic is
-mostly fail-closed for well-typed, schema-validated inputs: it rejects empty or
-oversized selections, duplicate required IDs, missing/duplicate/unexpected
-evidence, stale run/build/profile/platform/expectation identity, non-passing
-statuses, and missing assertion/capture references. The tests cover those paths.
-That is useful bookkeeping, but it does not establish runtime evidence.
-
-## Must fix before treating this API as a safety boundary
-
-1. **Malformed runtime input can throw instead of returning a safe failure** —
-   `tests/support/qualification.ts:56-64,72-74,92-94`. TypeScript types do not
-   validate JSON. Values such as a non-string `runID`/case `id`, a null record,
-   or a non-array/null `captureIDs` can make regex/string operations or
-   `.length`/`.some` throw. If the caller guarantees schema validation, that
-   validator must be a mandatory, explicit adapter at this boundary; otherwise
-   validate all shapes here and return a safe `INVALID_*` result. Add unit tests
-   proving malformed external objects cannot escape as exceptions and that
-   diagnostics contain only safe codes/counts.
-
-## Qualification blockers that belong to the future real harness
-
-1. **No authoritative case binding or completeness** —
-   `tests/support/qualification.ts:47-68` accepts any syntactically valid
-   selected ID. It does not load/bind `tests/smoke/cases.json`, reject an ID
-   absent from the inventory, require the profile/expectation declared by the
-   inventory, or require the complete enforced-profile selection. A caller can
-   therefore qualify an invented subset. The file's header at lines 2-5
-   correctly disclaims this. The future runner must reject unknown IDs, empty
-   selections, missing implementations, stale evidence, and incomplete
-   enforced-profile selections, as required by `docs/testing.md:76-83`.
-
-2. **Capture IDs are only nonempty opaque references** —
-   `tests/support/qualification.ts:92-94` checks syntax/count, not that a
-   capture exists, is owned by the run, has the expected sink/network artifact,
-   or contains an independent oracle. It also does not validate capture
-   identity uniqueness or artifact references. This is a future real-host
-   harness/evidence-store requirement, not something these unit tests can
-   prove. `docs/testing.md:99-116` and `docs/spec/plan.md:37` require actual
-   restricted captures and oracles.
-
-3. **Evidence truth is explicitly unverified** — the module header
-   (`tests/support/qualification.ts:2-5`) correctly says it does not verify
-   hashes, contents, assertions, or completeness. Consequently, passing
-   `tests/unit/qualification.test.ts:19-23` demonstrates only bookkeeping with
-   synthetic records; it must never be reported as capture-truth or artifact
-   qualification. The real runner must inspect actual sink/network bytes and
-   keep raw evidence out of diagnostics, per `docs/testing.md:99-104`.
-
-4. **No actual smoke execution or implementation-status binding** —
-   `tests/unit/qualification.test.ts:5-17` fabricates two records and never
-   launches a pinned host/provider/plugin. The statuses tested at lines 31-40
-   are correctly rejected, but there is no test that a case is bound to a real
-   executable, host/build/checksum identity, or observed execution. This is a
-   future runner requirement; TODO/skipped/scaffold passes cannot be security
-   evidence (`AGENTS.md:17-20`, `docs/testing.md:26-30,73-78`).
-
-## Positive coverage
-
-- Duplicate required IDs and unexpected evidence are rejected
-  (`tests/unit/qualification.test.ts:95-99`).
-- Run/build/profile/platform/expectation mismatches and zero assertions or
-  captures are rejected (`tests/unit/qualification.test.ts:51-63`).
-- `expected-gap` is isolated to active-only and requires `observed-gap`; it
-  cannot satisfy enforced (`tests/unit/qualification.test.ts:65-83`,
-  `tests/support/qualification.ts:66,90-91`).
-- Result diagnostics contain failure codes only; the invalid ID is not echoed
-  (`tests/unit/qualification.test.ts:86-93`).
-
-## Checks run
-
-- `node --test tests/unit/qualification.test.ts`: **pass**, 13/13.
-- `npm.cmd run typecheck`: **fails in unrelated existing scope** at
-  `tests/unit/recording-endpoint.test.ts:3` because
-  `../support/recording-endpoint.ts` is missing. No qualification-file type
-  error was reported.
-
-## Revision: 2026-10-13 — repaired helper re-review
-
-Scope expanded for this revision to the four files named by the review request:
-`tests/support/qualification.ts`, `tests/unit/qualification.test.ts`,
-`tests/support/recording-endpoint.ts`, and `tests/unit/recording-endpoint.test.ts`.
-
-### Revised verdict
-
-**Usable as test helpers only; not source/host qualification.** The prior
-qualification malformed-input finding is resolved: `assessCases` now accepts
-unknown inputs, validates bounded plain-data descriptors and array elements,
-rejects accessors without invoking them, catches reflection failures, and
-returns the fixed `INVALID_INPUT` result (`qualification.ts:47-101`). The
-focused tests cover malformed values and accessor behavior
-(`qualification.test.ts:102-128`).
-
-The recording fixture is also suitable synthetic loopback infrastructure: it
-validates options with fixed errors (`recording-endpoint.ts:34-80`), bounds
-request/response data, tracks sockets and pending buffers, separates parsed
-request counts from malformed connections, and has idempotent bounded close
-cleanup (`:83-211`). The nine focused tests exercise those repaired behaviors,
-including malformed options, incomplete bodies, and active-socket close.
-
-### Remaining concrete observations
-
-- **No new must-fix defect found in these four files.** The assessor still
-  intentionally accepts a caller-selected, syntactically valid case set and
-  opaque capture IDs (`qualification.ts:2-5,109-151`). The smoke runner must
-  supply authoritative inventory binding, completeness, capture ownership and
-  capture/oracle truth. This is a qualification limitation, not evidence that
-  the helper validates artifact hashes or capture contents.
-- The recording fixture retains successful request bodies until `close()`;
-  its configured maxima permit up to 64 requests × 1 MiB (plus copies made by
-  `captures()`) (`recording-endpoint.ts:71-79,141-145,175-178`). This is bounded,
-  and not a current correctness/security finding for a test-only helper, but a
-  future harness should set an explicit aggregate capture budget if it runs
-  adversarial workloads.
-- `counts().attempted` deliberately counts parsed HTTP requests, while
-  malformed connections are reported only by `malformed`
-  (`recording-endpoint.ts:28,87-90,157-178`). It is therefore not a total
-  connection-attempt or zero-egress oracle; callers must not interpret it as
-  one.
-
-### Focused verification
-
-- `node --test tests/unit/qualification.test.ts tests/unit/recording-endpoint.test.ts`:
-  **pass, 24/24** (15 qualification, 9 recording-endpoint).
-- No full typecheck was run in this revision because unrelated agents are
-  editing adjacent support files; the focused result is the primary evidence.