[cemililik]

Second maintainer review — corrective publication verified

Reviewed publication head: 19c999683ca00f6c760f8d4f52c96b0afdd83581. PR remains OPEN for maintainer review; it has not been merged.

Verified failed-spawn cancellation, finite credential recognition, installed-command/Node-floor acceptance, native lifetime/notice forwarding, sealed UI/refresh, hostile diagnostics and credential-free CI corrections are complete. A subsequent independent review found a real native readonly export-metadata classification defect; the owned SQLite boundary and actual human/JSON/foreign-client/getter controls repair it. Original risk notes have explicit reasoned dispositions; no new deferral or universal secret-detection promise was introduced.

Source acceptance remains exact: NEW R14/R15 are COMPLETE CLEAN at ec0f3e10, 108 corrective paths / 272 ordered U3 hunks each, with a separate CLEAN security sitting (764 source + 148 tooling tests). Later owned Home preparation at 154d832d has two NEW complete CLEAN reviews (3 paths / 3 hunks) and scoped security inspection; ordinary R2 owns its twelve-case execution. Native concurrency at 1c7aec25 has two NEW complete CLEAN reviews (2 paths / 12 hunks) and a separate scoped CLEAN security sitting; all three native reviewers execute nine cases independently. Closing metadata has two NEW limited CLEAN checks at this head, after the earlier attribution error; NONCLEAN history is retained. These are correction/increment scopes, not a new whole-PR review. All product/build/configuration/dependency/CI bytes remain identical to EC0F; only two tests and three documents differ.

Both earlier Windows failures remain retained. The real Home module is prepared through captured/retained fixture work before the unchanged five-second case clock. The native suite uses the neighboring finite 30-second functional case budget, combines runner/scenario cancellation and adds a safely spied real ENOENT/no-PID regression. All eight original native cases and SQLite's five-second busy policy remain. Timers cannot preempt synchronous migration or mint a close/receipt ACK. Actual current PR and push Windows logs both pass nine native plus twelve admission cases, including joined actual child closes and zero cleanup faults; no definitive earlier Windows root cause is claimed.

Verified current-head publication:

• PR CI 39135159217 and push CI 39135153832: 15/15 successful jobs each, including required main/coverage, native advisories and installed consumers. Cached tasks retain their actual log attribution; the author-forced EC0F run remains a separate 24/24-task / 15,974-pass / 21-local-skip result. All 633 author acceptance-tool cases pass.
• Current required coverage reports 748 files / 15,974 passes / 22 established CI skips; the source Node 22.13.0 floor has the same totals. LLM/MCP line/branch floors pass; core is measured and its required-CI promotion remains Step 19.
• Exact-head SonarCloud gate OK, zero open bugs/vulnerabilities. Its 102 nonblocking maintainability recommendations remain visible; no blanket waiver or threshold weakening.
• One actual installed archive, 449,851 bytes / 70 files, SHA-256 b72939dbab25cbea49ee13a4c0f92d04dc43a9364466263b483c2d1c91b72ebc. The same digest passes current Linux/macOS/Windows and minimum Linux Node 22.0.0; each executes the real installed help/version command, 177 bootstrap controls + ten behavior cases. Downloaded bytes and receipts were inspected; remote platforms were not rerun locally and no reproducible-build claim is made.
• Full filesystem evidence: 110 controls / 330 phases / 8160 executions / 188 required witnesses. Full secrets evidence: 57 / 171 / 14919 / 336. Every declared named/marked witness and restoration is verified; zero recorded runner-unhandled errors. Additional removal failures do not substitute for required witnesses.
• Usage 23 mechanisms / eight groups / 3749 executions, with permanent native/100k-scale evidence; wire four mutations / 24-case matrix / 216 executions. Git source, evaluation/runtime/stdio bindings, inventories and restoration are checked. Fresh GitHub ZIP digests/sizes and every extracted byte agree for all nine selected acceptance artifact ZIPs. Absent remote dependency/native executable bytes remain explicit metadata-only limits.

Author-selected partial controls remain complete:false; full publication above is separate. The supplemental source register joins source/read scopes, actual failures and the disclosed old mutable-progress-snapshot limitation. Detailed reviews/receipts remain local and Git-ignored.

Wave 3 Steps 1–8 checkpoint only. Steps 9–19 have NOT STARTED; whole-wave acceptance and core required-CI coverage promotion remain Step 19. No merge, release, new ADR, paid/provider/keychain/GPG operation or new user-decision gate is claimed.

Maintainer review corrections — verified publication checkpoint

Long tool arguments could share an effect replay identity, and diagnostic clipping could retain part of a recognized credential. The corrections use the complete redacted v5: projection, preserve own public data, normalize/recognize complete summaries before clipping, and retain the original invocation through actual MCP/native cleanup. All 13 Medium findings and 39 distinct Low concerns have explicit fixes or evidence-based dispositions, including Promise/cancellation boundaries, active-turn SIGINT/EOF, JSON gate purity, required CI guards and canonical documentation.

Published head: a5a5d45ebf9a57dbd8dfe0e20ae71ae9b33408cb. Reviewed runtime: ba14b1bd, against submitted 05061d55. The later delta is four append-only Markdown files / 75 lines; executable, configuration and dependency bytes are identical. Native v5: refuses unversioned and v2:/v3:/v4: rows, including unchanged small arguments, without rewriting history or granting automatic effect retry. Raw host/model/spill handling and finite redaction limits remain explicit.

Two NEW complete cumulative CLEAN rounds, R9 and R10, each use four fresh independent review tasks covering 100 paths / 212 ordered hunks. Root verifies exact file/diff/hunk hashes, coverage unions and substantive assessments. Current code/test bodies and all deleted/replaced branches are read; historical documents receive identity/structure/status/links and complete changed/affected-clause review, not unrelated historical line-by-line recertification. A NEW separate CLEAN security sitting covers 40 paths / 100 hunks, explicitly static-only with zero tests executed. Two further independent CLEAN metadata checks cover the four-file documentation delta. Earlier nonclean/incomplete/interrupted rounds retain their own sources. This is correction-scoped acceptance, not a new whole-PR review.

Verified at the published head:

• Push CI 39086945679 and PR CI 39086948646: 15/15 jobs successful each. Both actual main logs report 748 files / 15,886 passes / 22 established CI skips. Lint/typecheck17/17 and workspace tasks 11/11 each have five cache hits; build 6/6 has six. Cached work is not claimed rerun.
• Fresh local ordinary coverage in CI mode also passes 748 / 15,886 / 22, retaining all three existing core/LLM/MCP 90% line and branch floors. Required remote enforced coverage passes; core's required-CI promotion remains Step 19. The earlier non-CI author workspace15,887/21 snapshot remains separately attributed.
• All four actual installed consumers pass with one selected archive: current Linux/macOS/Windows on Node 24.21.0 and minimum Linux on Node 22.0.0, each 177 bootstrap controls + ten behavior cases. Independently downloaded archive/report and GitHub-origin checks verify 448,223 bytes / 70 files, SHA-256 0fa52c13eb8197bd5ac37e0abca9f2c5a2c3c16b84bcc5d2c73793cce1a52afb. This is physical evidence inspection, not another local Windows/Linux execution or reproducible-build claim. Native Windows and Node 22.13 source advisories also pass.
• Current-source filesystem/secrets artifacts independently verify 110/41 controls and 330/123 phases, exact declarations/source/runtime/evaluation/stdio bindings, ZIP digests, zero recorded unhandled errors and the unchanged 2,000-file/64-MiB bounds. This does not rerun those matrices locally.
• Budget replay smoke verifies 16 strict refusals / two legacy positive controls / zero fetches. All 599 local acceptance-tool cases pass. Eight author removals yield 89 specific assertion failures; every byte-exact restoration passes all 208 focused targets, with zero unhandled errors in committed runner receipts. Overlapping reviewer test selections are not added into a unique total.
• Source-bound Sonar analysis passes at this exact head (GitHub check 117555791121), with no new record since the preceding candidate: 231 records / 90 files = 55 false positives + 86 accepted + 11 fixed + 79 open recommendations. Valid nonblocking recommendations, including the two reasoned regex-maintainability suggestions, remain visible; no rule or quality threshold is weakened.

The completion register owns source/coverage attribution. Detailed private receipts remain Git-ignored. PR stays OPEN for the maintainer's new review. No merge, release or whole-Wave-3 completion is claimed; Steps 9–19 remain unstarted.

What changes

Complete the first eight approved Wave 3 increments. Declared-secret-derived context is kept out of public expression/template outputs, authored admission and historical replay have distinct validation boundaries, and CLI work stays owned through actual producer, native-process, terminal and database cleanup. Guarded lazy loading and exact installed-package controls make those boundaries testable in the shipped CLI.

This PR is the maintainer-requested Steps 1–8 publication checkpoint. Steps 9–19 have not started; Wave 3 is not complete. The original whole-wave Step 19 review, coverage and publication obligations remain for the later work.

Scope

Accepted increment	Result
1 — Serialized reliability queue	Shared close handling, safe source labels and UTF-8 admission parity, exhaustive surface switches and actual reasoning rendering.
2 — Admission and diagnostics	Consistent value-free authored validation and numeric bounds, with separate historical workflow/session validation and resume compatibility.
3 — Secret provenance	Engine-owned qualified context/input provenance at real VM/template/public sinks, with native SQLite persistence regressions and expression-result parity.
4 — Error/envelope substrate	Shared error ancestry and event-envelope validation while preserving supported family names, discriminants, causes and seam boundaries.
5 — Tool and engine tails	Tool input bounds and advertised semantics, alias/cycle safeguards, cancellation tails, deterministic plans and identifier ordering.
6 — Pure process/discovery substrate	Early option/error/origin authorities, command descriptors and pure discovery projections, invocation work owners and observation priority.
7a/7b — Lazy runtime and installed graph	Guarded entry/import failures, invocation catalog ordering, finite flat ESM chunks, complete emitted-graph checks and exact-tarball consumers.
8a–8d — Native/session/fatal integration	Creation-owned process capabilities, partial-acquisition custody, retained discovery/MCP/media work, workflow/session/Home/management ownership, terminal restoration and fixed fatal/output/background diagnostics.

Packages: shared, llm, core, db, mcp, CLI and acceptance/CI tooling. Decisions: ADR-0110–0113, with append-only forward notes in affected earlier ADRs. No new runtime dependency; the SQLite type addition is development-only. Detailed review/private evidence remains Git-ignored.

Compatibility and boundaries

• Public secret-context access is intentionally tightened under ADR-0113. Previously stored historical output is not retroactively erased.
• Unexpected CLI infrastructure/output failures use fixed cli_internal / output_unavailable diagnostics and exit 9. Classified workflow/turn failures, deliberate chat end, signals and actual workflow money/effect/durability precedence retain their defined meanings.
• Cancellation, timeout, public discovery completion and an SDK close promise never manufacture a native-close, receipt, terminal-delivery or DB-safe-close acknowledgement. POSIX tool groups, SDK MCP PIDs and verified Windows helpers retain distinct authority.
• JSON-help integration, aliases/output-category UX, release maps/encrypted custody, later chat/Home/network-policy work, DB centralisation and whole-wave acceptance remain Steps 9–19. This PR does not activate a release or claim complete Phase 2.5.5/2.6.

Original checkpoint validation and review attribution

The original Step 8 runtime acceptance below applies to c83c8575b0baaa9bf20765b03dffb00623ed96c6. The 00fb72d2 closure and 4762f21f publication were documentation-only. The subsequent Sonar correction source is 887ff47eff6092d035df9442658f0eb24625f9e9; 05061d55 records its scoped evidence. Earlier results retain their source attribution.

• Full source CI run 39044664485: 15/15 jobs successful. Main workspace reports: 743 files / 15,635 passes / 22 established skips. Lint/typecheck 17/17 (five cache hits), serialized workspace 11/11 (five cache hits), build 6/6 (six cache hits); cached results retain that attribution.
• Required source fences, formatting/isolation, compiled smokes, 177 bootstrap controls, replay compatibility, wire/usage acceptance and filesystem/secrets causal jobs pass. Core's required ≥90% line/branch floor promotion remains Step 19; the current enforced job covers LLM/MCP.
• All four actual installed consumers pass with the same tarball: current Linux/macOS/Windows on Node 24.21.0 and minimum Linux on Node 22.0.0. Independently inspected archive: 446,750 bytes / 70 public files, SHA-256 a64f4ff2cbd444d6bc37e6b0938c42e0a6ebca0ddcd7905799c718346764558f.
• Downloaded current-source filesystem/secrets records independently verify 110/41 controls, 330/123 phases, exact source/runtime/restoration/physical bounds and zero unhandled errors. This is inspection of the executed CI artifacts, not another local mutation run.
• Each increment has independent scoped acceptance. For final Step 8, R25 and R26 are two NEW complete cumulative CLEAN rounds, each eight independent reviewers covering 342 disjoint paths / 1,842 ordered hunks from accepted Step 7 d9625ff0 through c83c8575. Root reads every report/path assessment and independently verifies raw results, joins, hashes and matching source/dependency/dist freezes. These are whole-Step-8 reviews, not a new whole-PR review of all changed files.
• A NEW separate CLEAN Step 8 security sitting runs 75 complete files / 1,105 passes / one Windows-only local skip, with explicit empty error channels and actual runtime joins. Earlier steps retain their separately recorded sittings. No operator-TTY, live-provider/keychain, opaque native-undici close or universal descendant-containment certification is inferred.
• Failed reviewer-preparation receipts remain failed. In particular, R25 tooling's arithmetic wrapper and R26 Home's collection wrapper exited nonzero; their passing product-case records and empty error channels were audited directly with explicit qualifications. Missing callback history and native-child source/dist equivalence are not invented. Earlier NONCLEAN reviews and failed old-source CI remain historical.
• Final closure documentation/handoff received an independent read-only review with no confirmed documentation issue; local links and append-only ADR/mirrored status checks pass.

New push and PR checks run at the publication head. Their current results must be evaluated separately from the successful runtime-source run above.

Historical Sonar review corrections — 2026-10-18 (source 05061d55)

The complete initial review covered 214 open Sonar records in 80 files. One confirmed tooling performance defect appeared at two sites: stack indentation could consume newlines and cause quadratic rescanning. 0eae1b8b bounds those scans to one line; permanent tests inspect the actual source assertion operands and retain stack/canary/file-URL detection. Each independent removal fails its regression, and exact restoration passes. Small equivalent CLI/tooling clarifications address seven other records without changing native ACKs, control inventories or deadlines.

• Two NEW independent complete cumulative CLEAN rounds, two reviewers per round, cover all 8 paths / 11 hunks at 887ff47e. A separate final documentation/receipt check is clean. These are correction-scoped reviews, not a new whole-PR review.
• Author validation: workspace lint/typecheck 17/17 (15 cache hits), serialized workspace tasks 11/11 (10 cache hits), fresh CLI 362 files / 5,665 passes / 10 established skips, build 6/6 (five cache hits), and 551 acceptance-tool tests with no skips. Tooling lint/typecheck, formatting, seam/dependency fences pass.
• The actual local macOS / Node 22.23.1 installed consumer passes 177 bootstrap controls / 8 smoke cases, tarball SHA-256 2dd80f46204a60e17d4abb72c5442425e29d09c73e60642cad40ccc254125d4e. This is one local consumer; fresh remote platform consumers are reported separately.
• 52 false-positive and 86 intentional-design records have reasoned online dispositions, independently joined by exact key and saved comment. No rule, gate threshold or approved deferral changed. The trusted-host PATH assumption of the local Git fallback is explicit.
• 67 valid nonblocking maintainability suggestions remain open, including larger decomposition suggestions; they were not labelled false positive or silently closed. All nine code-corrected records are now FIXED in fresh analysis; no new open issue was introduced. This does not start Steps 9–19 or grant a new deferral.

Fresh Sonar analysis is successful at 05061d55, with security/reliability/maintainability A/A/A, zero bugs/vulnerabilities, nine FIXED records and 67 remaining open maintenance suggestions. GitHub Sonar check 117511184731 independently confirms that exact head. All four actual PR installed consumers now pass: current Linux/macOS/Windows on Node 24.21.0 and minimum Linux on Node 22.0.0, each with 177 bootstrap controls and eight smoke cases. Downloaded artifacts independently verify the same 446,752-byte / 70-file tarball, SHA-256 192b281eab895241c35ad07fdb988c4420b4679539664de8af9ebb3ee54e999c. Their actual checkout is synthetic PR merge a9a921c1; its Git tree is independently identical to 05061d55. New-head push CI 39071766923 and PR CI 39071769451 still contain running causal/coverage/main jobs; aggregate completion is not claimed. Earlier green runs retain their historical source attribution.

Navigation and continuation

• Current Wave 3 queue
• Approved nineteen-increment plan
• Step 8d and whole Step 8 acceptance
• Maintainer-authorized scoped publication

The timestamped detailed handoff is local/private and is not published in this PR. Before Step 9, the next agent must inspect this PR's state: further commits on development would extend this PR's scope. No Step 9 implementation or production release operation is performed here.

Conformance

• Accepted decisions and canonical contracts cited; ADR history append-only.
• Strict TypeScript, SDK seam, engine platform purity and runtime-dependency boundaries preserved.
• Increment-scoped reviews/security and runtime evidence attributed to their actual sources.
• Private handoff/review records and credentials excluded from Git/public artifacts.
• No whole-wave completion or later-step implementation claimed.
• New correction-head push/PR checks and fresh Sonar analysis completed successfully.
• Maintainer whole-PR review completed.

Refs: ADR-0110, ADR-0111, ADR-0112, ADR-0113; Phase 2.5.5 / Wave 3 Steps 1–8

Prepared with Codex assistance.

[sonarqubecloud]

Quality Gate passed

Issues
102 New issues
86 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.3% Duplication on New Code

See analysis details on SonarQube Cloud