feat(r1): publish accepted P07-P29 foundation and orchestration boundaries - #33
Closed
ajhcs wants to merge 95 commits into
Closed
feat(r1): publish accepted P07-P29 foundation and orchestration boundaries#33ajhcs wants to merge 95 commits into
ajhcs wants to merge 95 commits into
Conversation
…tract Define ProviderDriverV1 as a pure preflight/launch/reconcile/cancel surface with typed results and exact ChildEnvelopeV1 launch proof. Capability declaration reuses the accepted P05 13-field bridge; live progress, restart reattach, cancellation, and detailed events fail closed when unsupported. Process-local transitions deny duplicate dispatch, stale identity, and post-dispatch replay. No provider transport, registry cutover, scheduler, or durable store is claimed.
Drive scripted drivers through the closed P17 lifecycle without a transport. Cover P05 13-field alignment, hostile descriptors, proxies, accessors, symbols, exotic prototypes, sparse/alias/cycle/depth graphs, and transition/correlation/duplicate/stale/tamper cases. Unsupported features and capability-contradicting launch certainty fail typed.
Document the closed envelope/capability contract, P05 13-field alignment, honest feature failures, and that P18/P20/P19/P21 still own concrete transports. Future work keeps the run runtime, candidate composition, and AttentionBatchV1 unimplemented.
Answer exactly one question deterministically and fail closed: is this string a strict portable run-relative artifact path? Accept only NFC, well-formed, forward-slash, relative paths of 1..16 segments (128 UTF-8 bytes each, 1024 total). Reject backslashes, leading/trailing/doubled slashes, empty and dot-only segments, colons (foreclosing drive, UNC, alternate-data-stream, and scheme spellings under one rule), Windows reserved device stems with the extension ignored, edge dots/spaces that Windows tooling strips, C0/C1 controls, invisible/format/bidi/tag code points, solidus look-alikes, non-NFC text, and lone surrogates while keeping well-formed astral characters legal. The fixed validation pipeline raises identical first typed errors from a closed 17-code vocabulary, never echoes hostile bytes (U+ notation and offset only), captures every dynamic intrinsic at import, scans strings by code points, and returns deep-frozen detached descriptors. Pure path policy only: no filesystem, network, or process I/O, and no claim that P08 artifact storage exists. Focused hostile coverage pins the rejection matrix, ordering, bounds parity, predicate agreement, and detachment.
Bind exactly ten keys: exact run/child identifiers reusing the accepted manifest grammars, artifact kind bound to the detached P17 capability vocabulary, raw-vs-sanitized class with class-dependent bounded-evidence caps (sanitized 256 KiB, raw 32 MiB), declared byte length, 64-character lowercase SHA-256, and closed media-type/content-encoding enums. The relative path carries no class marker; consumers trust the ref, never the name. Hostile inputs fail closed before any effect: live/revoked Proxies with zero traps, accessor properties whose getters never run, symbol keys, exotic prototypes, own undefined, sparse/extended arrays, aliases and cycles, depth and size. Parsed results are deep-frozen detached snapshots built property-by-property, so later caller mutation cannot drift a digest or a comparison. Digests follow the accepted P03 framing conventions without touching its closed registry: SHA-256 over validator-owned canonical JSON behind an explicit domain string, big-endian version, ratified private label, and length-prefixed parts, so key order cannot change a digest while any value change must. Ordering is deterministic via one total tuple comparator plus a bounded (64) duplicate-free batch orderer. Pure schema and path policy only: no constructor from bytes, no reader, no sanitizer, no existence check, and no claim that P08 storage exists. Focused hostile coverage pins proxies, accessors, coercion hooks, closure-before-vocabulary ordering, batch hostility, and mid-call mutation inertness.
Document the closed ten-key ArtifactRefV1 schema, the strict portable relative artifact path policy with its fixed denial pipeline, the domain-framed canonical digest authority, deterministic ordering, and the pure schema/path-policy boundary that claims no P08 storage.
…ission Persist P06-bound canonical run records in a caller-supplied existing private directory. Fail closed on symlink, non-directory, and unsafe ownership or mode surfaces, use no-follow opens, and publish through same-directory temps, fsync, and exclusive link without overwriting an authoritative record. Exact same key plus canonical body returns the existing record; conflicting keys or bodies and mismatched protected identity fail closed.
Add focused and adversarial coverage for idempotent replay, identity and idempotency conflicts, concurrent duplicate submissions, process restart restore, symlink and hardlink refusal, path traversal, malformed truncated oversized and foreign files, torn temps, proxy accessor alias and cycle inputs, and bounded directory floods.
Document the library-only identity-bound run store, its private-root and no-follow constraints, and the explicit non-goals that remain for later slices.
Bind validated ArtifactRefV1 declarations to real bytes under one caller-supplied existing private store root. Map each strict P07 relative path segment-for-segment into disjoint raw/ and sanitized/ namespaces with a strictly parsed canonical sidecar per artifact; no parallel ref or path schema is introduced and traversal, device-name, separator-look-alike, and Unicode hostility inherit the exact accepted P07 denials. Sources are intrinsic Buffer/Uint8Array views or bounded async iterables of such views, denied before any byte is read when proxied, subclassed, SharedArrayBuffer-backed, accessor-dressed, or string-typed. Declared byte_length and sha256 stay untrusted claims: bytes stream into an unpredictable owner-only same-directory temporary with the class cap enforced per chunk before it is written, actual length and digest are computed from streamed bytes, and exact agreement is required before the fsynced temporary is published by exclusive hardlink that refuses to clobber. Root and parent chains use O_NOFOLLOW descriptor discipline, lstat-walked 0700 components, and post-publication identity re-proof. Conflicts, metadata mismatches, and competing publications fail closed with typed content-free errors while identical resubmission stays idempotent.
Twenty-eight focused tests cover the publication contract end to end: frozen detached content-free receipts, buffer/stream equivalence, idempotent replay versus content and metadata conflicts, disjoint raw/sanitized namespaces, untrusted declared claims, class-cap enforcement before over-allocation, bounded ordered batch verification, deterministic concurrent identical and conflicting submissions, and restart-stable inventory fingerprints. The adversarial battery inherits P07 ref hostility (proxies with zero traps, accessors that never run, alias cycles, traversal, device names, separator look-alikes, NFC violations) and adds store-specific attacks: symlinked parents, targets, and sidecars that are never followed; exfil hardlinks; writer-less FIFOs opened without blocking; wholesale root swaps and mid-publication parent swaps interleaved through a hostile chunk source; crash debris including leftover temporaries, orphaned content, and orphaned sidecars; truncated, oversized, same-size-swapped, and malformed stored state; directory floods and depth overruns against bounded enumeration; and a content-freeness sweep proving no denial ever echoes the root, artifact bytes, or an errno.
Document the private-root namespace layout, the untrusted-claim streaming publication with exclusive-link atomicity, idempotency and typed conflict semantics, descriptor/no-follow root and parent discipline, bounded streaming verification and audit with a restart-stable inventory fingerprint, and the explicit non-goals that remain for later slices.
Deny the private temporary-name grammar on every artifact path segment and its sidecar form before publication, not only the leaf, so a reserved parent cannot publish and later self-condemn as crash debris. Verification retains the stored sidecar snapshot, fails mismatches with the same content/metadata split as publish, and measures bytes against the sidecar digest and length rather than the caller view.
…tract Add a narrow serialized P08 store hook that no-follow opens a regular single-link sanitized artifact, re-validates sidecar, ref, identity, size, and digest, hashes the whole file in fixed chunks while retaining only the requested bounded range, and proves before/after stability. The model-facing reader accepts only an exact sanitized ArtifactRefV1, rejects raw before I/O, validates intrinsic integer offset/range options against the fixed range cap, and returns frozen detached JSON-safe metadata plus bounded base64 selected content.
Reader pages record whether the range or wire cap shortened the selected window, and they expose more/next_offset for deterministic paging through the sanitized artifact. Source size, redaction count, sanitizer version, completeness, and upstream truncation stay null until P09 provenance exists — never false and never invented as zero. The serialized page is forced under a fixed wire cap. Optional docs/r1-artifact-reader.md states the contract without claiming later slices.
Add a fixed-version P09 sanitizer/writer that accepts only intrinsic byte views or a bounded async iterable of those views, incrementally UTF-8-decodes identity-encoded text, applies one built-in bounded redaction policy, and publishes raw plus sanitized artifacts through the accepted P08 public store APIs. Caps, declared digest/length, and class separation fail closed without clipping or reading stored raw bytes; provenance is frozen and content-free.
Focused pages cover frozen JSON-safe output, deterministic range paging, cap/EOF boundaries, raw denial before I/O, disjoint raw/sanitized siblings, wire-cap clipping versus unknown P09 provenance, Unicode and binary encodings, and the absence of sanitizer/server imports. The adversarial battery reuses P08-published sanitized fixtures and inherits P07 ref hostility (proxies with zero traps, accessors that never run, traversal and device names) plus option proxies. It proves chunked hashing never requests a whole-file buffer, same-size tampers and sidecar/ref conflicts fail closed, symlinks/hardlinks/FIFOs are not followed, torn debris and root swaps stay rejected, mid-read mutation cannot pass digest or path-identity checks, and every denial stays content-free.
Hold a finite decoded overlap so credential, bearer, env, URL, and prompt matches that straddle ingest chunks redact identically to the unsplit source. Streaming UTF-8 decode preserves astral sequences across every byte split, and malformed or unpaired input becomes U+FFFD deterministically without clipping a truncated multi-byte sequence.
Pin every byte-split of credential, bearer, env, URL, prompt, and astral/malformed/unpaired UTF-8 streams to the unsplit digest and counts. Fail closed on over-cap, endless, huge, short, and over- declared sources without publishing, and deny Proxy, revoked Proxy, subclass, SharedArrayBuffer, accessor, arbitrary, and invalid chunk sources with content-free errors.
Bind provider slot grok onto the accepted P17 preflight/launch/reconcile/cancel contract and the P05 13-field capability record. An injected bounded ACP transport confirms launch only after acknowledgement; post-spawn loss is dispatch_uncertain and is never replayed.
Prove pre-spawn failure versus post-spawn uncertainty, acknowledgement, duplicate launch, attention/reply identity, cancellation races, restart reattach, event/cursor bounds, malformed and forged receipts, and hostile direct-JS inputs without a live Grok client.
State that the adapter is not live-transport qualification and does not cut the supervisor over or claim durable P19/P21 state.
Combine the accepted possible-send replay repair with the accepted terminal latch, idempotent terminal cancellation, and closed blocked-preflight diagnostics. Preserve legitimate not-sent retry while denying replay after any possible send.
Inspect own property descriptors on Buffer/Uint8Array sources and stream chunks before reading buffer, byteOffset, byteLength, or subarray. Reject own accessors and data overrides without executing getters, and keep ordinary intrinsic views and their digests unchanged.
# Conflicts: # CHANGELOG.md
…x Alpha Additive P20 adapter over the accepted P17 ProviderDriverV1 contract. It hard-binds provider dsh plus exactly muse-spark-1.2-contributor or stealth/ox-alpha, drives preflight/launch/reconcile/cancel through an injected bounded ACPX one-shot transport port, and inherits every envelope, capability, transition, and denial rule from the accepted contract (no parallel envelope or capability schema). ACPX provides no authoritative prompt-sent acknowledgement: after spawn intent the launch posture stays uncertain; post-intent exceptions and loss are reported as dispatch_uncertain and are never replayed, retried, or fallback-substituted. Only provably pre-spawn failures may report not_sent. Same-session reply is unsupported: unresolved attention surfaces honestly and no replacement prompt or session is started. Live progress, detailed events, cancellation confirmation, and restart recovery read recorded ACPX evidence through bounded pages; exact model/config/credential identity and task/session correlation fail closed on drift; forged receipts fail closed while loss degrades to uncertainty. Events, records, cursors, lanes, attempts, operations, and clock readings are capped, and detail telemetry is composed only from closed vocabulary words and validated integers so prompt, reply, or event content can never leak into protected telemetry. The module claims no real transport, durable P19/P21 store, scheduler, registry cutover, supervisor cutover, or merge/PR authority.
r1-dsh-acpx-driver drives the real adapter over a deterministic fake one-shot port: hard provider/model binding for Muse Spark 1.2 Contributor and Ox Alpha, the full preflight/launch/reconcile/cancel lifecycle, honest post-spawn uncertainty with no replay after any launch observation, provably-pre-spawn not_sent with a one-attempt budget, identity and per-field correlation drift denials before spawn, bounded cursor-monotonic event pages that stop at the recorded-event cap, lane/operation/clock budgets, cancellation outcome mapping, restart_reattach recovery from recorded evidence only, the accepted P17 provider-neutral conformance suite run unmodified against the DSH driver, and content-free detail telemetry. r1-dsh-acpx-driver-adversarial proves hostile direct-JS options, transport surfaces, forged spawn/poll/event/cancel receipts, unprovable pre-spawn markers, digest-only launches, tampered envelopes, direct-mode/merge/fallback/resend/reply keys, bounds abuse, and cross-model evidence substitution all fail closed with stable typed codes without executing caller code or advancing lanes toward a second dispatch. Shared fixtures keep the fake port exactly on its validated five-function surface.
Document the DSH ACPX provider driver surface: hard Muse/Ox model binding, honest post-spawn uncertainty with no replay or fallback, unsupported same-session reply, bounded recorded-evidence reconcile/restart/cancel behavior, fail-closed identity and correlation drift denials, caps, content-free telemetry, and the exact injected-port contract plus non-claims for later real DSH Muse/Ox ACPX lifecycle conformance. Update future-work: P20 is in-tree as an adapter over an injected port; Grok/Cursor driver transports, registry cutover, scheduler, and durable store remain open.
Add disposable P15 fixtures and tests for in-scope mutations, overlap, read-only dirt, merge history, symlink/gitlink/type-change, NFC versus confusable paths, untracked state, and pre/post observation races.
Document ScopeVerifierV1 as additive 3.3.0 work that does not own command policy, composition, or Git mutation.
Execute a genuine immutable P16B ExecutionIntent plus trusted P16A policy once in a disposable workspace disjoint from the candidate. Spawn the exact owner-approved absolute executable and argv with shell=false, an empty-by-default environment, timeout, output caps, network deny, and host-available process isolation. Audit candidate Git identity before and after, fail closed on mutation, races, escaped descendants, floods, timeouts, and cleanup uncertainty, and never trust provider-reported PASS.
Pin genuine-intent execution, exact argv, empty default env, host-observed fail vs stdout PASS, P13 fact projection, timeout/flood/signal/descendant fail-closed paths, candidate mutation and identity mismatch, exact workspace cleanup, default unshare network-deny execution, and hostile proxies, accessors, tampered receipts, allowlists, PATH lookup, and symlink/special-file denial. Tests inject spawn/Git/cleanup boundaries and use local fixtures only.
Note the additive runner surface and keep future-work clear that the run runtime, candidate composition, and AttentionBatchV1 remain later work. The runner is not wired into the MCP server, supervisor, or scheduler.
…itor holes Enumerate ignored worktree paths, fail closed on assume-unchanged and skip-worktree, observe chmod despite core.fileMode=false, inspect HEAD parents when base_sha equals head_sha, detect unchanged-source copies, lstat-prove untracked paths, and disable fsmonitor on every Git spawn.
Bind the accepted P17 ProviderDriverV1 contract to an injected local Cursor session transport. One spawn and one acknowledged prompt dispatch per lane keep pre-spawn not_sent strictly distinct from post-spawn dispatch_uncertain; exact provider/model/session/repository/base/run/ assignment/envelope provenance is bound on every request with no omitted- field derivation or substitution. Same-session attention replies are attempt-once and bound to the exact session/question/answer; cancel, reattach, reconcile, restart, the terminal latch, and already-terminal behavior preserve identity and never bind an uncorrelated session. All host-visible evidence flows through a persistent per-lane redaction window and UTF-8 byte bounds so signatures cannot recombine across leaves, chunks, events, or reconciliations; every error surface stays closed and content-free. Managed local worktrees and run_base_sha only. Offline coverage lives in r1-cursor-local-driver with the scripted r1-cursor-local-transport fixture.
Adversarial offline coverage for the P19 cursor-local driver: hostile option/request trees (proxies, revoked proxies, accessors, symbols, non-enumerables, exotic prototypes, sparse, cyclic, aliased, unknown-key, oversized depth) are rejected inside the same content-free quarantine with zero getter or trap executions and no hostile name or value in any code, path, or message; provenance substitution (foreign provider, model, base sha, flipped digest, tampered envelope bytes) is refused; replay, fallback keys, and second dispatches are impossible after a possible send; pre-spawn not_sent stays distinct from post-spawn dispatch_uncertain; uncorrelated sessions are never bound; lying, throwing, promise-returning, and getter-bearing transports fail closed; signature recombination across chunks, events, and reconciliations is prevented; UTF-8 byte bounds hold under flood overflow without corrupting multi-byte characters.
Document the P19 cursor-local driver: exact provenance binding over the P17 ProviderDriverV1 contract, the one-spawn/one-acknowledged-dispatch lifecycle with distinct not_sent and dispatch_uncertain outcomes, attempt-once same-session attention replies, cancel/reattach/terminal- latch identity rules, persistent-window evidence redaction and UTF-8 byte bounds, the content-free structural quarantine shared by every surface, and the explicit non-goals (no direct-mode widening, supervisor/registry/ server cutover, durable store, or live qualification).
Drive the option quarantine to full content-free closure: symbol-keyed and non-enumerable own properties on driver options are now rejected explicitly, and unknown-key refusals no longer echo the hostile property name into codes, paths, or messages. The scripted transport gains a correlation-loss scenario whose observation reports a reborn session id, proving the lane refuses to bind an uncorrelated session while cancellation still addresses the exact original one.
…a3b94ca75d305a898c18895200b1f3eef679' into codex/lead-r1-w20-p23-provider-registry-composition-20260824
Add the additive v3 provider-registry.mjs (P23): one deterministic, closed
composition authority behind provider selection. It registers exactly the
four accepted ProviderDriverV1 adapters (grok, cursor-local, cursor-cloud,
dsh) in the frozen P02 grammar order, re-derived from the grammar leaf so
the slot vocabulary cannot drift. Selection maps an exact {provider, model}
pair onto one entry under exact_closed_slot_no_fallback with no preference
walk, substitution, fallback, retry, or replay; closed model lists are
enforced against accepted constants and grammar-owned models stay with
their adapters. Composition gates the provider before reading any option
byte, quarantines hostile inputs content-free without running caller code,
delegates to the one exact accepted factory, and returns its value
untouched so adapter lane stores, evidence maps, and identity binding keep
accepted semantics. Inventory quotes each accepted describe surface in
detached frozen clones instead of restating capability claims. The P22
future harness is inventoried as mock/conformance evidence only: never a
fifth slot. No ambient discovery, no supervisor cutover, no live
qualification, and no version change.
Prove the registry is the composition authority: each accepted adapter (P18 Grok ACP, P19 Cursor Local, P20 DSH ACPX, P21 Cursor Cloud) composes exclusively through composeProviderDriverV1 and drives its accepted preflight/launch/reconcile/cancel lifecycle with exact identity echo (run_id, assignment_id, lane_index, base_sha, child_envelope_digest), honest dispatch certainty (Grok and Cursor Cloud confirmed only after an authoritative acknowledgement; DSH stays uncertain after spawn with replay_denied on a second launch), terminal absorption, one-spawn/one-ack local dispatch, no cross-talk between four coexisting lanes, inventory surfaces byte-faithful to every accepted describe function, exact factory identity for all four slots, and the P22 kit still passing against the inert template as evidence that never qualifies a live route.
Add docs/provider-registry.md describing the closed invariants (four grammar-ordered slots, deterministic exact_closed_slot_no_fallback selection, one accepted factory per slot, no ambient discovery, content-free typed failure, quoted-not-restated accepted claims), the registered surfaces table, the API, the non-goals (no supervisor/server/ scheduler/durable-store cutover, no live qualification, no merge/PR authority, no direct mode, no version change), and the test commands. Update docs/future-work.md so the registry cutover is recorded as in-tree while supervisor/server cutover onto it, real-route qualification, scheduler, durable store, evidence bundles, cloud-worker sinks, cleanup, run runtime, and AttentionBatchV1 stay later work. Record the P23 registry entry under [Unreleased] -> Added.
Add the additive P26 RunPreflightV1 launch-side validation gate. It validates ONLY: no workspace, branch, task dispatch, credential projection, remote mutation, or reservation is ever created on success or failure; the only spawns are read-only git observations run argv-only under the accepted closed git environment with --no-replace-objects --no-optional-locks and disabled hooks/fsmonitor. One preflight quarantines hostile requests (Proxies, symbols, non-enumerables, aliases), composes the complete accepted P02 contract through parseRunManifestV1(), re-checks writer-scope disjointness over the frozen snapshot, and observes exact canonical repository/base identity on the host: canonical realpath identity, non-bare work-tree toplevel equality, trusted .git layout (directory, linked-worktree pointer, symlink rejection), base existing as exactly one immutable commit object with symbolic spellings denied structurally before any process runs, and no replace refs shadowing object identity. The receipt is detached, deeply frozen, carries all-false launch side-effect nonclaims, and binds a P03 GitIdentityV1 for direct P24 run-store compatibility. P05 resolution and P23 composition stay behind their own authorities and are not invoked.
The preflight now enforces the public maximum of eight children per run against its own frozen PREFLIGHT_MIN_CHILDREN/PREFLIGHT_MAX_CHILDREN literals BEFORE composing the accepted upstream contract, so a routine quota change anywhere else can never widen the invariant: a nine-child submission fails with the boundary's own preflight_child_count_exceeded denial and zero git observations. Absent or non-array child sets keep their accepted upstream denials. Independence is re-asserted over the detached frozen snapshot: no dependency edge of any shape survives (preflight_dependency_edge_denied) and child ids stay unique within one run (preflight_duplicate_child_id). The receipt's checks list grows child_bounds and independent_fanout evidence.
The preflight now denies submissions the host cannot carry before any process spawns: every concurrently running child must get one schedulable CPU slot (cpu_parallelism >= max_concurrency) and its own 256 MiB RAM floor (available_ram_bytes >= concurrency * floor), with typed host_cpu_capacity_exceeded / host_ram_capacity_exceeded denials whose fixed-template messages never echo requested or observed numbers. Host facts come from the ambient host unless injected through the closed options.host seam. Overlapping writer scopes were already re-checked pairwise over the frozen snapshot; the receipt now carries scope_pair_checks evidence proving how many pattern pairs the disjointness check compared, and the overlap denial is proven to fire with zero git observations.
Add the side-effect proof suite. For every failure mode in the battery (invalid envelope, nine children, overlapping writer scopes, CPU and RAM capacity denial, missing repository, absent base commit) plus bare repositories and symlink aliases, and for the success path as well, the observed world must come back identical: same files with the same bytes and modes, the same refs, nothing added or removed. A recording spawn wraps the whole battery and proves every observation stayed inside the closed read-only rev-parse / cat-file / for-each-ref posture under the frozen closed git environment, so no lock file, branch, dispatch artifact, or reservation can appear from any preflight outcome.
Project a closed provider/operation environment so Git, SSH, hosting tokens, control secrets, key-file paths, and other-route credentials never reach launch or readiness children. Muse and Ox stay isolated; Grok and Cursor Cloud receive only their required route.
Read owner-only credential files with no-follow regular-file, owner, mode, link-count, size, and race checks. Hand secrets to systemd-run through a bounded owner-only file and loader so values never appear in argv, and clean the handoff after spawn failure, stop, or consume.
Harden worker Git env, deny credential-bearing remotes and worker push/merge/rebase/PR/tag/release mutation, and redact exact credential values including 16 KiB secrets split across events. Cursor Cloud's local SDK keeps only its key plus bounded repo/ref/prompt data.
Owner
Author
|
Closed as retained failed-intermediate publication evidence. Exact head 0fd091e remains accepted within the final supersession chain but is not CI-standalone on GitHub (release-candidate 1320/1324). It was never merged. The branch and failure receipt are retained; publication proceeds only from exact Gate A accepted head 5f322b5. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes exact accepted combined head 0fd091e (tree adf52bf779cb7dae27d2db9672da53bdd4149ad6), the first accepted head containing current P06 ancestry. Scope covers artifact/evidence authorities, provider drivers and registry, durable run store/preflight, and credential isolation. Superseded intermediate 5fb5691c7aecafb029cebf00760c124e671dd2ae remains negative evidence; closure authority applies only to exact final head 0fd091e/tree adf52bf. PR #28 head 9a37eba is unrelated and absent. Preserve history with a regular merge only; no squash or rebase.