[kikashy]

This batch completes the Agent v0.11.0 host, storage and dialect contracts in TypeScript and Go. It adds retained history and feedback, task-step allowances, opt-in routing and usage controls, and the public integration seams needed by Desk. It also fixes delegated-run completion, cancellation and pre-bootstrap Plan continuation.

Behavior

• Current versioned checkpoint, event, policy and report readers preserve the frozen feature-free formats and refuse unsupported records. Task dependencies, per-step delegation and cross-run snapshots retain ownership and resume constraints.
• Routing, usage budgets and repeated-tool detection remain opt-in. Routing grants no new authority. History imports are detached and read-only; host-owned feedback never becomes model input.
• Public declaration enrollment, opening projection, bounded observations, native refusal certification and the first-party ask_user method support the host integration contracts.
• Dialect authoring implements the Spec RC2 contract in both languages with the published Runtime and Runner companions. Unattended runs are an accepted design only; their implementation remains in v0.12.0.
• Review correction Close v0.11.0 review findings: Plan continuation and output-limit ordering #237 admits checkpoint-3 Plan decisions while preserving task claims and original coordinator limits. A released native Plan pause is verified against the ordered basic RunStore journal before a fresh invocation. The original unknown claim remains in the audit; other unknown outcomes still refuse continuation. Composed release acknowledgements update all original owners atomically. Invalid Eino output ceilings now refuse before the route classifier can run.

Public record changes

Durable root-author native invocations with an accepted Plan and AllowConversation append a checkpoint-3/event-2 claimed checkpoint before the physical attempt. Released pauses and explicit decisions add shared planPause/nativeInvocation records; the original coordinator limit and child reserve are retained separately from host configuration. The schemas, both readers, handwritten vectors and documentation change together. Excluded ordinary calls retain their behavior, and normally completed calls gain no mandatory release acknowledgement. The native Plan helper is excluded from public wildcard imports.

Issue traceability

Storage, history and feedback: #160, #207, #208. Usage, routing and tasks: #170, #172, #183, #204. Dialect, taxonomy and package contracts: #171, #199, #201, #202, #209, #214, #215. Host lifecycle and preparation: #216, #217, #218, #219, #221. Release evidence, asking well and unattended design: #213, #220, #206. Review corrections: #237. These are the agreed 22 release issues plus the correction tracker; #223–#230 remain outside this release.

Checks

Candidate: 39803dff8669504453d35770063b9c90507909cd.

The latest two-file correction refreshes six generated writer-link rows and caps Vitest at two concurrent file workers. On this host its default allowed 15 workers. The failed-step diagnostic recorded three 20-second test timeouts; each unchanged case passed separately and with the bounded cap. This establishes local contention evidence, not the exact assertions in the truncated earlier CI log. All test bodies, selection, isolation, product-level concurrency and timeout values remain unchanged.

Focused validation of the committed two-file diff:

PASS reference: 13 pages match; 30 tests passed, 0 failed, 0 skipped
PASS unit-tests: 149 files passed, 2 existing files skipped
                3795 tests passed, 32 existing tests skipped; 3827 selected
2 passed, 0 failed, 0 skipped, 0 not run

One affected-step run completed in 621 seconds. No full local checklist or Go suite was repeated. Exact-head CI now passes 29 checks, 0 failed, 1 optional skip, 0 not run, including Go race (767 seconds). The separate live audit, DCO and mutation execution pass: 15 selected changed rows and 5 sampled rows caught; 494 active rows apply with 0 problems and 5 retired. All latest workflow attempts are attempt 1. Actual-main full mutation shards remain required.

The preceding five-file correction addresses HIGH R4 from the independent confirmation. An acknowledged native Plan decision exempts only its exact earlier claim. A different unknown in that scope refuses before another physical provider call, including when task steps are disabled and terminal persistence was interrupted. Go production already enforced this refusal; both languages exercise the actual-adapter regression.

R4 evidence remains unchanged:

• TypeScript: 38 focused tests passed.
• Paired Go race regressions passed with task steps off and on.
• Removing each language's guard made the off case fail at the intended physical-call assertion: 3 calls instead of 2. The on control and restored cases passed, retaining both unknown audit rows.
• One mutation row appended with the 498-row prior prefix unchanged; its exact applied source matches the executed removal.

Previous head CI at 98d2b53 completed 27 passed, 2 failed (reference and unit-tests), 1 optional skip, 0 not run; Go race passed in 754 seconds. Its mutation checks caught all 15 selected changed rows and 5 sampled rows; 494 active rows passed applicability, with 5 retired. Live audit and DCO passed. The two failures are the subject of this correction.

The stable integrated local checklist passed 30/30 at 277abf65; subsequent grouped fixes use focused verification and full CI. Earlier candidate CI at 571a984 passed 29 checks, 0 failed, 1 optional skip, 0 not run. Original-reviewer confirmation and actual-main full checks remain required.

Review and release gates

The original independent whole-release review and two focused confirmations are complete. Final confirmation at 39803df closes R4 HIGH and residual R1 MEDIUM; R2/R3 remain closed, with no new finding. The reviewer verified the exact-claim recovery boundary, both-language physical-call removal witnesses, unchanged source/evidence applicability and green exact-head CI. Review is OpenAI/Codex gpt-6.1-sol/high under the approved same-vendor exception, not cross-vendor compliance. Actual-main and publication gates below remain required.

Spec v0.3.0-rc.2, Runtime v0.39.0-alpha.2 and Runner v0.26.0-alpha.2 are published and verified. Runner publication evidence. Published Agent consumer pairing remains a post-publication gate.

The scoped dependency exception expires 2026-11-07 00:00 UTC and covers only native Linux/amd64, CGO-enabled, default-tag Go 1.26.10. Fresh assessment at 571a984 queried all 77 resolved module pins, checked 443 native test/generator-inclusive packages and completed a clean symbol scan. The two new HTML advisories are fixed; only GO-2026-5781 and GO-2026-5932 remain. The compatible update changes x/crypto from v0.57.0 to v0.58.0; all 51 OpenPGP files are byte-identical, the affected packages remain absent from the audited closure, and the owning refusal controls are unchanged. Independent confirmation at 571a984 verified the recorded existing-exception scope continuity; this is not a new exception or remediation claim. Six unchanged Python development pins have no findings, and the exact-head live npm audit passed. The R4 and subsequent CI corrections change no dependency pins, Go production, Go test imports, dependency admission/refusal controls or toolchain configuration; the prior dependency evidence is retained with that explicit source-applicability assessment. No new advisory query is claimed. Final-source review and actual-main binding remain pre-release gates.

The v0.11.0-only live comparison deferral remains in effect. No live quality, token-saving or monetary-cost claim is made. Exact-head CI, original-reviewer confirmation, actual-main full checks and mutation shards, signed tags, protected publication, attestations and published consumer verification remain required.

[kikashy]

Initial independent review and correction dispositions for PR #236.

The report below is the original review of 5388d096196b87a9fbb4fdff91cb0b6adfcd5741, retained verbatim. Corrections are now pushed at 7b8a8f66ff0b50edfd05a5ec79404b7facd72a9f. Its CI is running; the original reviewer has not yet confirmed the corrections. This record does not approve the new head for merge or publication.

---

Agent PR 236 and v0.11.0 release review

Request changes at 5388d09: two MEDIUM findings; no confirmed HIGH. One LOW documentation correction is also recorded. This is the initial review record, not merge or publication approval. The same reviewer should confirm the grouped fixes after green checks on the new candidate.

Reviewer: OpenAI/Codex, selected gpt-6.1-sol, high reasoning. This is an independent session and a same-vendor OpenAI review, under the operator's explicit exception. It is not a different-vendor review. No builder conversations were loaded; issues, source, contracts and evidence artifacts were the review inputs. No subdelegation.

PR: #236. PR range: 7910ab9269e042cad4ae8eeb2d4bbca6333b3217..5388d096196b87a9fbb4fdff91cb0b6adfcd5741. Release range: e00d2b11d11af4dabb0a4de6c1a5e7322bd8527e..5388d096196b87a9fbb4fdff91cb0b6adfcd5741. Base is an ancestor of the reviewed head. Source was clean at review start and at the final frozen-source check. The source freeze was released to the coordinator only after this review's source probes finished.

Findings

R1 — MEDIUM — pre-bootstrap Plan preparation excludes current records

go/context/plan_preparation.go:127 requires saved.Version == 2. Current valid checkpoint-3 records are therefore refused as ContinuationNotRecoverable before applying a pending Plan decision. Routing, usage budgets, repeat controls and task-aware plans can promote a run to checkpoint 3. A host whose physical bootstrap is correctly closed while that checkpoint is paused cannot use the new #219 seam to continue those runs.

Demonstration: an isolated Go overlay reuses the existing real-store pendingPreparation fixture, sets only its retained checkpoint version to 3, recomputes its digest, verifies that the candidate's ReadExecution accepts it, commits it, restores the exact retained input, then calls PreparePlanDecision. The new assertion fails with valid checkpoint3 Plan decision refused before bootstrap: *runcontext.ContinuationNotRecoverable. No source file was edited. Evidence: plan-preparation-probe.go, plan-preparation-overlay.json, plan-preparation-probe.log in this review directory. The package test itself completed in 0.144 seconds; this is an intended contract-reproduction failure, not a timeout or setup failure.

Contract: #219 must acknowledge the existing canonical Plan decision before dispatch, preserving original state and lineage; checkpoint 3 is the feature-bearing version of this release. Merely allowing version 3 is insufficient. Ordinary CommitPlan reconciles the writer-owned task schedule; PreparePlanDecision currently bypasses that path, and its event is always passed through StampEvent. The correction must preserve/reconcile held task claims, child evidence and envelopes, and select the correct feature event version. Cover accept and reject, actual API/native adapters and no dispatch before acknowledgement, including fresh-writer/restart cases.

For coordinated native task runs, the existing package-owned aggregate envelope is attached through AttachNativeTaskEnvelope and is not necessarily the standalone, retained taskEnvelope. A fresh preparation writer must obtain independently bound original envelope facts or use a supported original-owner transition. It must not synthesize a Session, assume coordinator bounds for standalone runs, accept fresh request configuration as an unpinned grant, reset held claims or increase allowance. A safe native-envelope-required refusal is honest but does not establish complete #219 acceptance for a previously admitted combination. Any unsupported combination must remain explicitly incomplete until supported evidence or an authorized contract disposition exists.

R2 — MEDIUM — invalid output ceiling spends a classifier request before refusal

go/adapter/eino/run.go:173 invokes ResolveTurnRouteClassifier before the output-ceiling validation at lines 181–182. With auto routing configured, an invalid RequestOutputCeiling can therefore spend a physical model generation before the package reports its configuration refusal.

Demonstration: an isolated Go overlay uses the existing actual-Eino routeClassifierRun fixture. For ceilings -1 and 1000000000, it receives a named configuration refusal but observes one physical classifier request in each case. The assertion requiring zero calls fails for both. Evidence: output-ceiling-probe.go, output-ceiling-overlay.json, output-ceiling-probe.log. The package test completed in 2.705 seconds; neither failure is a timeout or compilation failure.

Contract: invalid/unsupported managed request controls must refuse before provider work (#199, interacting with #172). Validate the resolved ceiling before classification or any other physical generation. Add focused actual-adapter tests for negative and above-reserve values; preserve the valid one-token ceiling, context output reserve, classifier limits and normal route behavior.

R3 — LOW — report documentation denies a supported closed member

docs/usage-budgets.md:21 says report 2 admits no feedback fields. The current closed report-2 schema and retained reader deliberately support feedback, and projectHistoryRunReport attaches it for #208. Remove or qualify that sentence so hosts do not reject a supported report. This is documentation drift; the closed schema itself remains authoritative.

Acceptance map

The following assesses all 22 current issue bodies supplied in issues.json. Positive entries describe reviewed implementation/fixture scope and reused green deterministic evidence. They do not claim a live provider or mounted Desk result.

Issue	Criteria and reviewed paths	Assessment / limits
#160	Versioned chat snapshot/restore and run-store revision binding: context/chatSnapshot.ts, context/chat.ts, context/storedChat.ts; Go chat_snapshot.go, stored_chat.go; shared snapshot vectors, active-turn and cache/eviction/reuse tests.	Portable snapshot validation and atomic run/chat binding are present. Unknown version refuses before live construction. TS additionally validates its existing live thread/question domain; opaque wire data does not become authority. Host backend conformance remains host-owned.
#170	Atomic shared budget store, journal/ticket ownership, each physical attempt, exact upper bounds, unknown holds and report totals: TS storage/usage*, storage/physicalDispatch.ts, writer/session; Go usage_budget*, physical-model wrappers, adapters and model writer; usage vectors and consumer tests.	Native physical model/token guarantees correctly refuse as unsupported; provider invocations remain separate. Missing usage is incomplete, not zero; children are not double-counted. External budget and RunStore commits are separate, with conservative leaks on uncertainty.
#171	Both dialect factories, complete replacement bindings, exact resource/pack/document identities, Spec selector, discovery/validate/check reports, retained draft/proposal receipts, bounded samples and preview. Shared authoring/retention vectors; both certification scenarios and compatibility tests.	Exact published RC2/draft identity and explicit host opt-in are enforced. Maturity-removal witnesses fail at actual proposal-admission assertions in both languages. Published Runtime source interop and Runner fixture evidence are separate from final published Agent pairing and real Desk adoption.
#172	Ordered host/rule/classifier/default selection, narrow-only catalogues, resolved tier boundary, once-only widening, pinned route/resume, usage/events/reports; TS/Go route owners, both Go adapters and TS managed consumers; shared fixtures and barrier tests.	Defaults stay off. Private capability/release/claim proof gates native widening; imported markers supply no execution authority. R2 is an uncovered interaction. Live routed/unrouted comparison is explicitly deferred for this release, with no savings or quality claim.
#183	Dependency cycles/unready starts, step shares, child profile/evidence, concurrent independent children, exact schedule resume: task-step modules, plan actions, original writers and delegation coordinators in both languages; shared task records/scenarios.	The final race fixture preserves production assertions and has a genuine forced-serial overlap failure plus restored pass. R1 covers the pre-bootstrap Plan/schedule interaction.
#199	Fixed schema-only one-generation observation, no executors/retry/failover/uncertain resume, typed bounded calls and managed output ceiling: eino/observation.go, wire ceiling, actual Eino consumer tests.	Actual declared offer and cap1 paths are covered; ordinary cap1 tool closure is retained. Relay is trusted to represent one physical send. R2 requires configuration validation before an optional classifier call. No mounted Settings or live-provider claim.
#201	Distinct native termination certification, source-bound live invocation token/error, no unoffered callback/execution, preserved journal and release proof: adapter/certification native termination code/tests.	Canonical callback-refusal certification remains distinct. Scripted native peers/stand-ins do not certify Desk's private Manager.
#202	Protected structured opening projection after actual instructions/schema assembly, canonical Fit, string-prefix-only paths, closed inputs and final physical budget check: opening projection, both Go adapter paths and consumer projection tests.	Protected values cannot be replaced by arbitrary excerpts; oversized nonreducible input refuses. Callback is trusted host code, not an I/O sandbox. Generic unconfigured previews remain covered.
#204	Exact source/tool/canonical-argument/result repeat identity; acknowledged transaction, one framed reminder, named stop, resume and report projection; repeat modules, writers and shared vectors.	Exact result JSON custody is retained and bounded. Changed results do not count, unknown/reused outcomes do not create observations, and opt-out is preserved. No redispatch is used to detect a repeat.
#206	ADR-0025 decisions 1–6 plus questions, jobs and goal; explicit host/package ownership, authoritative fencing/expiry, unknown-work reconciliation, operation identity distinct from epoch; #223–230 split to v0.12.0.	Substance is coherent with the authorized design-only issue. No unattended implementation is claimed. Proposed-to-accepted status is a coordinator disposition at reviewed merge under existing authority, not a newly invented user gate.
#207	Original history before compaction; revision-pinned query/filter/relationship evidence; typed archive mappings/manifests and redacted display; original capture owner/claims, logical-material redaction, chunk closure and replay readers in both languages.	Missing/altered references fail closure checks; imported archives expose detached reading only. Current coverage honestly remains legacy-incomplete or recording-incomplete; no whole-history/provider-authenticity claim. Oversized logical redaction fails without publication. Cross-chunk positive privacy and arbitrary-size success are not established.
#208	Ordered feedback revisions, immutable target binding, report/archive propagation, redacted pending-review candidates, no prompt/model input: history metadata/feedback/report modules and paired fixtures/tests.	Metadata is outside execution/prompt state. Candidate intake is review-only, not corpus admission or replay authority. R3 documents one stale sentence.
#209	Exact dependency inventory from Go graph/npm lock, license and maintainer metadata/unknown reasons; generator/config/metadata, generated-doc/check mapping and dependency tests.	Inventory is checked in exact-head CI. Live advisory scope is separate and retains the two explicit graph findings/exception below.
#213	Source/workflow/repository/event/ref identities, deterministic latest-run/latest-attempt selection, full job/matrix/summary coverage, immutable artifacts, runtime/tool/input equivalence, pagination, age and tag rechecks: CI evidence helper/config/workflows and handwritten tests.	Main/release still require contract/check and all four full mutation shards. PR evidence cannot qualify. No older-green fallback, automatic dispatch or advisory waiver. Actual future tag verification/duration is still unobserved.
#214	Owner operation/effect, compatibility, derived approval/hints, host narrowing, taxonomy-bound source approval, current descriptor map and signed Gateway receipt: taxonomy/source/gate/descriptor/receipt code in both languages and shared vectors.	Evaluate stays gated Runtime-only. Act retains approval. Ask/pure exception is explicit in accepted ADR and grants no resource access. Full approved Gateway metadata includes unselected siblings; receipts bind admitted call/result, not descriptor authenticity.
#215	Strict detached retained report1/report2 reader, frozen historical graphs, closed members, exact lexical integers, bytes/depth/node bounds, optional absence/order and public export/packed smoke.	Reader is distinct from nonvalidating serializer and from live checkpoint authority. CI packed smoke covers candidate packaging; eventual attested published npm and Go consumer tests remain pending publication.
#216	Distinct live never-admitted versus released disposition, exact token, typed not-started return, zero callbacks, duplicate/mixed/wrong/late refusal: provider-release owner and actual delegation wrapper tests.	No historical record or busy error prose releases another invocation. Started/uncertain invocations still require release proof.
#217	Latest acknowledged root lifecycle during child claims/results and parent continuation: original writer selection, UseAcknowledgedRoot, coordinator saves and real-store running-dispatch regression.	Three-generation parent/child/parent and exact child scopes are covered by deterministic actual-adapter fixtures. No host normalization or dispatch-guard relaxation is added.
#218	Complete detached real contextual declarations before approval continuation/provider/tool work, mandatory acknowledgement when configured, exact equality/collisions and phase narrowing: enrollment callbacks/gate plus both actual adapters.	No executable closure is enrolled, guessed default schema is not authority, optional legacy callback absence proves no enrollment. Completion declaration is included.
#219	Exact retained Plan decision before bootstrap with original accepted Plan/references/current revisions; one CAS decision/checkpoint, no duplicate context/turn/policy, stale/simultaneous/unknown acknowledgement refusals and actual adapters.	Incomplete: R1. Existing tests cover the version-2 seam; current feature-bearing interactions need correction and focused proof.
#220	Pinned first-party asking-well method when exact ask tool is admitted, replacement method validation, derived ask/pure profile, absent/child/capacity/stale refusal: first-party catalogue/skill code and both certification scenarios.	Scripted providers prove instructions, read-versus-ask fixtures and genuine unanswered pause, not general live model judgment. Recommendation is not an answer.
#221	Immediate dispatch closure, original writer bounded host-context finalization, exact earlier results and unknown claim, terminal events/CAS, sticky real storage uncertainty, no terminal replay: writer/model-writer/lifecycle tests in both languages.	Cancellation is distinct from storage failure. Go requires the host store to honor context cancellation, explicitly documented; TS returns bounded uncertainty for a noncooperative store. Desk outer lifecycle/reload integration remains its separate follow-up.

Evidence and method

Read repository AGENTS.md, current policy and docs/releasing.md; assessed the complete PR/release inventory (640 changed paths; release diff 139,360 additions/7,066 deletions). Full immutable diffs and per-path inventories are retained beside this report. Manual inspection concentrated on boundary implementations, changed existing consumer paths, contracts and associated assertions. Generated contract graphs and large repeated fixture material were evaluated through their schema/generator/reader relationships and verified CI evidence, rather than independently re-executing or byte-by-byte revalidating every generated line. This distinction limits what an independent review can prove; it is not a claim that every possible interaction has been exhaustively tested.

Actual source inspection included Go adapter request/context enrollment, Eino model/observation/opening/routing, native invoke/release/termination, delegation lifecycle/charging, gate/runtime action owner, context controller/state/plan/preparation/writer/model writer/task/budget/repeat/report/feedback/dialect paths; TS managed session and physical consumers, original writer, usage and route owners, task/repeat modules, taxonomy/descriptors/Gateway verifier, report reader, snapshots/stored chat, history archive/query/relations/feedback/capture display boundaries and public package exports. Associated shared vectors, selected actual-adapter tests and mutation witnesses were read. Review did not install dependencies, rebuild the existing valid candidate, modify Git/source, post publicly, clean, merge, tag or publish.

Commands run included read-only Git identity/ancestry/status/diff inspection, rg, bounded sed/cat reads, Python JSON/hash/inventory inspection and these two focused commands under the shared heavy lock:

• go test -overlay <review>/plan-preparation-overlay.json ./context -run '^TestReviewPreparePlanCheckpoint3$' -count=1 -timeout=60s — expected new assertion failed; R1 reproduced.
• go test -overlay <review>/output-ceiling-overlay.json ./adapter/eino -run '^TestReviewInvalidOutputCeilingBeforeClassifier$' -count=1 -timeout=60s — expected zero-dispatch assertions failed; R2 reproduced.

Both probes used the candidate's explicit source, existing Go 1.26.10 toolchain, existing caches and this initialized scratch/TMPDIR. They did not invoke a live provider. No broad suite was repeated. No permission refusal, reserve stop or other actual safeguard stop occurred in this review. Deliberately failing regression probes are not credited as passing checks.

Raw retained CI logs were hashed against 5388d09-green-evidence.json and inspected for checkout identity, actual summary/assertion output and scope. Check status is associated with candidate 5388d09; the raw PR checkout is GitHub synthetic merge 1f82800 of that candidate into base 7910ab9, not a trusted-main release run. Base is already an ancestor of the candidate.

PR CI 40577194001:
  check job 122446666643: setup 2 passed; checklist 29 passed, 0 failed,
                         1 optional dependency-audit-live skip, 0 not run
  contract job 122446667342: 4 passed, 0 failed
Dependency audit 40577193825 / 122446665923: 2 passed, 0 failed
Mutation 40577193915:
  122446666980: 15 changed/sample + 5 sample, all caught
  122446666734: 480 rows apply, 0 problems, 5 retired
  Four full main shards: NOT RUN on PR; still required
DCO: success in retained exact-head check metadata

The earlier stable local checklist at 277abf6 records 30 passed/0 failed in 2,612.795 seconds. It is historical evidence, not a full local run at this candidate. The subsequent seven changed paths are release docs, CI scratch/timeout handling, CI test and the test-only task concurrency fixture; production/dependency code did not change. The two failed earlier PR attempts remain stale failures; they are not relabelled green.

Inspected raw meaningful-removal evidence includes actual taxonomy absence/closed-class and host operation/effect admission failures, closed Runtime-binding failure, paired Spec maturity failures, dependency affected-import rejection versus removed admission assertion, and final task concurrency logs. The final forced-serial witness fails independent child provider calls did not overlap: parent=5 child=2 peak=1; positive and restored race logs pass. Compilation-only artifacts, earlier malformed fixtures and timeout/reserve stops were not counted as intended assertion witnesses. PR's sampled mutations do not prove all 480 rows caught at this head.

Remaining merge and publication gates

Fix R1/R2 in one coherent correction round, update the LOW sentence and ADR acceptance status as appropriate, preserve issue traceability, and obtain required green checks on the actual new candidate. Same-reviewer confirmation should target the changed findings and relevant interactions; do not claim this initial-head report approves later code.

Main must pass its complete deterministic CI and all four full mutation shards at the merge/release commit. Release evidence reuse must actually admit exact-source trusted-main evidence with compatible current inputs, age and attempts; PR samples and tree-equivalent/different commits do not qualify. Keep actual-tag upgrade admission, package/version and paired Go-tag identity, signed annotated tag, main membership, current protection, protected release approval, package/checksum build, exact draft/published assets and attestations, and eventual published npm/Go consumer validation. No Agent artifact has yet been published by this review.

#169 and the dependent live routed/unrouted comparison are deferred for Agent v0.11.0 only. No live quality, token-saving, monetary-cost or subscription-usage claim is established. Routing remains off by default.

The dependency evidence retains unresolved GO-2026-5781 and GO-2026-5932 in the module graph. The scoped maintainer exception applies only to Agent v0.11.0/go-v0.11.0, native Linux/amd64, CGO=1, default tags, Go 1.26.10, and expires 2026-11-07 00:00 UTC. The retained final-source assessment found no affected import in its package/test/generator closure and no affected govulncheck symbols; neither result withdraws or fixes graph findings. Later production/source/configuration/advisory changes require reassessment. The exact-head separate live npm audit is green; Python known-advisory assessment is exact-pin, not an environment-wide audit. Preserve explicit approval and freshness at release.

Companion publication records identify Spec RC2 bcac15b7537ce21879201b5e5dfe795496225121, Runtime alpha.2 57c854abb9ace8a91013a75ab688bd70d063797c, Gateway alpha.1 55e2d150b7e96d1dcc3f36479ae5fa447c532709 and Runner alpha.2 85cbcfc83e589904fa165e908f6fd0e08f71fe9c. Inspected retained result/publication manifests and limitations; did not repeat publication or live artifact verification. Synthetic Runtime/Runner/source pairings and package stand-ins do not establish final published Agent pairing, real Desk/history/grant/stdout or live provider behavior. Desk source was not changed or certified by this review.

---

Coordinator dispositions at 7b8a8f6

Finding	Correction	Evidence and remaining gate
R1 MEDIUM — checkpoint-3 Plan preparation	Implemented in the corrected candidate. Preserve original task claims and coordinator bounds; verify the actual released native pause against the bounded ordered basic RunStore journal before accepting a decision and a fresh invocation. Retain the original unknown claim, and refuse unrelated unknown outcomes. Composed release acknowledgement updates all original owners atomically.	Actual paired native continuation, recovery/refusal tests and 13 paired controls are recorded. The final grouped fixes pass canonical readers and field-removal tests, checkpoint-writer removal/restoration, and Go capture/composition invalid-owner removal/restoration. Exact-head CI and original-reviewer confirmation remain pending.
R2 MEDIUM — invalid ceiling invokes classifier	Implemented: validate the resolved output ceiling before route classification or physical generation. Preserve normal configuration refusal and terminal delivery.	Actual Eino negative/above-reserve tests and valid-control checks pass. Restoring the old order fails both zero-call assertions; restored source passes. Exact-head CI and original-reviewer confirmation remain pending.
R3 LOW — optional report feedback documentation	Corrected the report-2 documentation to acknowledge its declared optional feedback member.	Included in the committed candidate; reviewer confirmation remains pending.
ADR-0025 acceptance status	The design is accepted for v0.11.0 under the maintainer's full-scope release authority.	Design-only: implementation issues #223–#230 remain in v0.12.0. No unattended implementation is claimed.

The configured durable root-author native invocation with an accepted Plan and conversational controls now appends checkpoint-3/event-2 claim evidence before the physical attempt. This is documented in design, upgrade and release notes. Excluded ordinary calls retain their behavior; normal successful calls gain no release-acknowledgement obligation. No byte-equivalence claim is made for this configured native Plan combination.

The correction's local integrated attempt at ab82341 found stale vector coverage, mutation anchors, a direct checkpoint aggregate write and an invalid-then-valid positive capture fixture, then stopped at the disk reserve during race compilation. These results remain failures/incomplete, not passes. The grouped fixes passed all 12 focused command groups, a fresh build and the 30 reference tests. Seven metadata checks passed; stale parity metadata was then corrected and its focused rerun passed. The full deterministic checklist and race validation remain required in CI at 7b8a8f6; original-head CI does not approve this candidate.

Fresh dependency reassessment at the clean corrected head retains the same 77 versioned Go modules and 441 native test/generator-inclusive packages, no affected imports and no govulncheck symbol findings. The two graph advisories remain under the existing scoped #192 approval; no broader clearance is asserted. Exact-head dependency audit, contract and mutation applicability jobs have passed; CI and selected mutation execution are still running at the time of this record.

After green exact-head CI, the original independent reviewer will confirm the changed findings and relevant interactions. Full trusted-main checks/mutation shards, signed tags, protected publication, attestations and published npm/Go consumer verification remain required. This is a same-vendor Codex review under the explicit exception, not cross-vendor compliance.

[kikashy]

Agent PR236 / v0.11.0 finding confirmation at 571a984

Request changes: new HIGH R4 reproduces an extra physical native provider dispatch after a different unknown invocation. R2 and R3 are closed. The original checkpoint-v3 defect in R1 is corrected, but its complete native continuation acceptance remains open because of R4. No other new defect was demonstrated in this bounded confirmation.

Reviewer: OpenAI/Codex, retained launch gpt-6.1-sol / high reasoning for durable ownership, release composition, cancellation and paired-language contracts. This is the same independent reviewer as the initial review, under the explicitly authorized same-vendor OpenAI/Codex exception. It is not cross-vendor review. No builder conversations or subagents were used. Source and Git were read-only; only initialized, owned review scratch was written. No installs, cleanup, commits, push, merge, tags, release or public post.

Candidate: 571a984b7f52d3f916ad5d590e2d316d95dbfe73, clean at start and after probes. PR236 base: 7910ab9269e042cad4ae8eeb2d4bbca6333b3217. This pass inspected the grouped correction 5388d096196b87a9fbb4fdff91cb0b6adfcd5741..571a984b7f52d3f916ad5d590e2d316d95dbfe73 (74 changed paths), including the final fourteen-file correction from 637b64e. The original complete-release review, its 22-issue acceptance map, inventory, source inspection and limitations remain in review.md (SHA-256 a45c2fdd54ddb0b3eed728d2986fb724cd4ae5252f13916ab4c6d09c942bce03). The release range remains e00d2b11d11af4dabb0a4de6c1a5e7322bd8527e..571a984b7f52d3f916ad5d590e2d316d95dbfe73; this confirmation does not restart or replace that complete-release review.

R4 — HIGH — another unknown native invocation is replayed when task budgets are off

Location: packages/harness/storage/writer.ts:561–563, interacting with prepared at line670. Contract: #219's certified native Plan pause exempts only the exact earlier invocation selected by its explicit acknowledged decision. A different unknown must remain a dispatch barrier. Accepted Plan/conversation enables this new native pause path independently of optional taskSteps.

supersededNative returns true for the exact recorded Plan row. For a different native row with no widened route, it returns false, without the Go counterpart's refusal when a native Plan disposition already exists. prepared then relies on hasTaskSteps/taskSchedule to refuse that unknown. With these optional features off, ordinary read-recovery substitutes the unknown request and invoke starts another physical provider call under a new claim. Go's supersededNativePlanLocked already refuses the distinct row.

Demonstrated through the actual TypeScript Codex adapter and the supported basic RunStore port:

1. Start a durable root-author run with an accepted Plan and conversational controls, without task budgets. Its actual provider callback calls the package update_plan, causing a real Plan pause, drains, and acknowledges the exact release capability.
2. Restart with the explicit pending Plan decision. The original unknown retains its planPause/decision identity. A second physical provider invocation starts, then throws an unrelated unknown error.
3. The store rejects only the stopped terminal checkpoint write, simulating interrupted terminal persistence. Its previously acknowledged head remains running, with two unknown native rows. The fixture explicitly verifies the running status, exact prior Plan disposition and both unknown rows before continuing. It does not modify or fabricate the retained checkpoint or journal.
4. Fresh restart dispatches the provider a third time. The assertion requiring two total calls fails: expected3 to be2. The identical task-budget-enabled fixture passes and refuses before that dispatch.

Reproducer: confirmation-native-off.test.ts and confirmation-native-off.config.mjs in this review scratch. Raw evidence: confirmation-native-off-interrupted-terminal.log. Actual command: timeout 60s node <candidate>/node_modules/vitest/vitest.mjs run --config <review>/confirmation-native-off.config.mjs --reporter=verbose, serialized under <shared-heavy-check-lock>, using Node22.23.1, repository jsdom/test-host setup, owned TMPDIR and the 2,576,980,378-byte reserve. Result: one passing control, one intended failing regression, 8.06s total. This is a physical dispatch count, not an error-message-only failure or a timeout. The provider is a deterministic stand-in at the real application boundary; no live provider or repeated host side effect is claimed.

Severity is HIGH under repository AGENTS.md:56: a path executes twice. The normal terminal-write variant stayed at two calls because a successfully saved stopped checkpoint masks the missing guard. Its stricter error-event assertion failed, which is not evidence of replay. The first three scratch attempts omitted the repository test-host setup; their failures are preserved and excluded. The final reproduction uses the supported setup and reaches every stated precondition.

Required correction: refuse any distinct unresolved native claim after restoring a Plan-pause disposition, independently of task budgets and without broadening the exemption or changing ordinary no-Plan recovery. Add the interrupted-terminal actual-adapter regression with task budgets both on and off, preserve Go/TS equivalence and the existing exact-pause, release, journal, acknowledgement and allowance controls. Fix before merge; obtain affected checks and exact-new-head green CI, then perform a finding-specific same-tier confirmation. No further broad review or suite was run here.

Original finding dispositions and changed interactions

• R1, original MEDIUM: original defect corrected; full acceptance still open via R4. PreparePlanDecision admits retained checkpoint2/3, reconciles acknowledged task schedule facts, preserves raw journal members and existing claims/child evidence, and stamps feature event2. The new original coordinator pin is distinct from the standalone host envelope; the original writer binds it before candidate/dispatch, the helper derives remaining bounds from it, and restarted coordinator attachment compares the original binding. Missing or changed enrollment cannot become a new grant. Actual Go API/native accept/reject paths include fresh writers and first-departure/allocated schedules. The supported in-provider native pause was implemented, rather than replacing it with an easier completed-invocation/out-of-provider fixture.
• R2, MEDIUM: closed. Eino validates negative/above-reserve output ceilings before route classification. The current source and actual-adapter regression match the retained focused evidence hashes. Positive and restored logs pass; old ordering fails both explicit zero-model-call assertions with one classifier request each. Valid small output ceilings and normal routing remain covered.
• R3, LOW: closed. docs/usage-budgets.md now correctly includes optional feedback among the declared closed report2 members. Feedback does not become model input or execution authority.
• Long-running unattended runs: one driver, durable waits, deadlines, re-authorization and attention (ADR-0025) #206 acceptance status: disposed. ADR0025 now records acceptance as a design decision, retaining the v0.12 implementation split. The previously reviewed substantive boundaries are unchanged; this creates no new scheduler implementation or separate maintainer approval flow.

The new native pause implementation preserves the old dispatch as unknown. Live private slots require the actual package pause, exact original claim and callback drain; host error prose or a checkpoint field is insufficient. Exact release owners compose with routing/delegation. Go composition locks all private owners in stable order and records an all-or-nothing disposition; TS private acknowledgements are synchronous and invalidate all owners on failed composition. The basic journal proof is a trusted-resource consistency check, not cryptographic provenance. Bounded ordered pagination, closed JSON/schema/record checks, identity and retention checks, pinned-head reload and subsequent CAS remain necessary. No optional HistoryRunStore is imposed. Missing release/evidence, head races, lost decision acknowledgement and later unknowns have real refusal tests; the later-unknown coverage was incomplete for taskSteps-off, as R4 demonstrates.

Checkpoint3/event2 fields are closed and consumed in both languages, including coordinator pins, pause tuples and decision invocation references. Historical checkpoint2/event1 graphs are unchanged. The private TS owner is excluded from public package wildcard imports; current packed-smoke CI passes. Old whole-file hashes for writer.ts, taskSteps.contract.test.ts and native_plan_pause_test.go do not match the current correction; I inspected those changes and reused their additional integration evidence and current CI rather than claiming old file equality.

The latest matcher/JSON changes use one private workspace per MatchRanges call or JSON guard invocation, never a shared guard field or retained text/range cache. Dense counters/active lists reset on all returns, including exhausted work budgets; sorted instruction traversal, UTF-16 positions and shared budget charging are retained. Integer object keys insert into the existing numeric prefix while ordinary names append, preserving JavaScript enumeration and detached clone behavior. Focused race and hand-counted edge/budget tests, meaningful removal assertions and restored passes support these changes. All14 final correction source hashes and19 raw log hashes match current source/evidence. The single representative adapter profile supports its measured allocation result; it is not itself proof that the entire race suite fits its timeout. The new full CI pass supplies that separate evidence. Python vector witness priority reorders rather than drops vectors, retains default full-error behavior and fresh mutation graphs, and now rejects an invalid baseline before omission probing. The approval concurrency fixture coordinates at the unlocked original claim observer, recognizes the named sibling refused result and honors both cancellation contexts; no production approval safeguard was relaxed.

Evidence inspected and commands run

Read applicable AGENTS, current policy and releasing instructions; read the correction brief. Actual source inspection covered Go Plan preparation/plan/state/task pin/writer/native pause/turn-route owner, actual native invoke/delegation composition, Eino validation, Go record/event writers and private release owner; TS native pause, writer/session/delegation/routing/Codex loop, task/plan/state/readers/record producers/private exports; current schemas, selected canonical vectors/readers and actual-adapter/refusal tests; final matcher/output guard/JSON implementation and tests; dependency graph, guards and public HTML regression; ADR/host-preparation/upgrade/release documentation. Generated reference/table deltas and large repeated vectors were assessed through producer/schema/reader relationships and verified CI, not an independent byte-by-byte regeneration. The complete list of changed paths and their current hashes is in confirmation-571a984-evidence.json; that inventory is not a claim to have independently read every generated line.

Commands were read-only Git identity/status/diff, rg/sed/cat/nl source and log inspection, Python JSON/hash/stream inspection, one read-only GitHub fetch of the actual #192 approval, and the bounded scratch probe commands above. Five executions of the one scratch test family were performed: three excluded setup/diagnostic failures, the normal-stop control variant, and the final supported interrupted-write comparison. No full test suite, build, install or broad mutation run was repeated. No sandbox, disk reserve or approval safeguard refused an action. The GitHub connector rejected a check-run GET as an unsupported endpoint; I used the coordinator's saved raw check-runs response and did not bypass that connector restriction.

Verified and inspected:

• agent237-parent-final/ci571-green.json and its three raw logs: all3 SHA-256 values match; checkout is synthetic PR merge 8db18fc9d506426a198ab47a6c6cf85b632cc59b of571a984 into7910ab9. CI40669766523/check122753280794: full30 selection, 29pass0fail1optional live-audit skip0notrun, including Python157 tests and go-race1230s. Separate audit40669766439/job122753279655: both dependency checks pass, live audit clean. The saved exact-head check-runs response records contract122753280287 and DCO122753261353 success as well.
• Mutation40669766515: applicability122753279963 has493active rows,0problems,5retired; changed/sample122753280718 catches15changed plus5sample, none undecided or not applying. The four complete main mutation shards are skipped on PR and remain required.
• Corrected Go v3 fixture/control manifest:12 fresh removal-log hashes and all named intended witnesses verified, plus restored positives; the13th atomic composition witness/source is separately verified. The earlier nil-Execution refusal fixture and schema filename collision are not credited.
• TS native evidence:21 raw log hashes verified, including meaningful release/original pin/journal/single-unknown/schema/version failures and restored26 native tests plus7 contract pins. The single-unknown test's taskSteps-on limitation is recorded in R4, rather than hidden by its green result.
• Latest correction manifest:14 exact current source hashes,19 raw log hashes verified. Dense/reset/reuse/JSON insertion/sharing removals fail their intended assertions; restored checks pass. Old x/net HTML API controls fail the literal-markup/allocation assertions; the upgraded graph passes.
• Final028 dependency manifest: all36 file hashes verified; parsed443 native package/test/generator entries with no listing errors or affected imports; parsed198 symbol-scan messages with no findings. Exact query covers77 module pins with complete non-paginated responses. Component summaries are used for navigation; these conclusions also use the raw outputs and assertions.

Dependency decision and remaining gates

The final candidate resolves x/net0.62.0; the new HTML advisories are remediated with actual public Parse/Render regression evidence. Its seven compatible MVS updates retain the Go1.26.0 minimum. OpenPGP GO-2026-5932 and PDF GO-2026-5781 remain unresolved graph findings, despite no native affected imports or symbols.

I read the actual #192 maintainer approval. It names crypto0.57.0 and explicitly calls for reassessment when modules/inputs change. The final028 reassessment now covers crypto0.58.0: the51 OpenPGP files are byte-identical, the same advisory/family remains, affected module admission/deny functions and their owning package-list assertion are unchanged, and fresh exact-head closure/symbol evidence retains absence. I assess this as continuity under that explicit reassessment clause, not a new exception or a claim that0.58 fixes OpenPGP. The original scope remains Agent v0.11.0/go/v0.11.0 only, native Linux/amd64, CGO1, default tags, Go1.26.10, expiring 2026-11-07 00:00UTC. A later fix must reassess final-source/advisory applicability again; no future release or other configuration is covered.

R4 must be corrected before merge, with fresh exact-head required CI and finding-specific confirmation. Actual main must then pass complete deterministic CI, contract checks and all4 full mutation shards at the merge/release commit. PR green and sampled mutations do not satisfy trusted-main/tag evidence reuse. Preserve exact-source/current-input/freshness checks, actual-tag upgrade admission, signed annotated tag and main membership, exact package/lock versions and paired Go tag, current release protection and required approval, immutable publication checks, package/checksum identities, provenance attestations, and draft-to-published asset verification. Parent reports the protected environment exists and target tags remain absent; this review did not perform publication.

Actual eventual published Agent npm and Go consumer validation remains pending publication. Existing companion publication/source probes and synthetic Runtime/Runner/package stand-ins do not prove that future pairing, real Desk history/grants/stdout, or live model quality. #169 live external comparison and routed/unrouted comparison remain deferred for v0.11 only; no live quality/cost/token-saving claim is established, and routing remains off by default. All original complete-release review limitations remain.

Coordinator dispositions

The report above is verbatim except for machine-local path redaction.

Finding	Disposition
R1	Original preparation defect corrected; complete acceptance remains open through R4.
R2	Closed by independent confirmation at571a984.
R3	Closed by independent confirmation at571a984.
R4 HIGH	Accepted; existing builder assigned same-PR refusal correction and paired task-steps-on/off interrupted-write regression. Merge and release remain blocked until corrected exact-head CI and same-tier independent confirmation.

The same-vendor exception remains explicit. No release gate is waived and no publication is claimed.

[kikashy]

Agent PR236 / v0.11.0 confirmation at 39803df

R4 HIGH is closed. Residual R1 is closed; R2 and R3 remain closed. No new finding was identified in this bounded confirmation. This confirms the corrections to the complete-release review; it does not assert that main, tag or publication gates have run.

PR: #236. Reviewed clean frozen head: 39803dff8669504453d35770063b9c90507909cd. Base: 7910ab9269e042cad4ae8eeb2d4bbca6333b3217. Confirmation range: 571a984b7f52d3f916ad5d590e2d316d95dbfe73..39803dff8669504453d35770063b9c90507909cd, seven changed paths: the five-file R4 correction at98d2b53 and two reference/test-runner files at39803df. The complete release range is e00d2b11d11af4dabb0a4de6c1a5e7322bd8527e..39803dff8669504453d35770063b9c90507909cd.

Reviewer: same independent OpenAI/Codex session, actual retained launch gpt-6.1-sol / high, appropriate to the HIGH repeated-dispatch/durable ownership boundary. The explicit same-vendor OpenAI/Codex exception remains in effect; this is not cross-vendor review. No subdelegation or builder conversations. The original review.md complete-release acceptance map and confirmation-571a984.md source/evidence assessment are reused with their stated limitations, rather than restarting a broad review.

Finding dispositions

R4 — HIGH — fixed at packages/harness/storage/writer.ts:564. The exact previously certified Plan-pause claim still takes the existing identity-checked exemption. A different unresolved native claim now raises HostOutcomeUnknown when that same scope contains a verified Plan disposition. This refusal does not depend on taskSteps or taskSchedule, so it precedes request substitution or an additional physical provider dispatch in the failing interrupted-terminal case.

The predicate compares the complete canonical scope on both the new row and original disposition row, including execution, role and optional task. A disposition in another scope does not activate this added guard. Without a verified Plan disposition, the new branch is inactive and existing no-Plan recovery behavior remains. The exact exemption still verifies the unknown row's full retained bytes, read/kind and scope; no journal/claim identity test was removed, no unknown becomes successful, and no allowance or action grant is added. The Go production safeguard is unchanged and supplies the paired semantics already assessed in the571 review.

The new TypeScript and Go actual-adapter tests reproduce the original boundary: actual in-provider update_plan pause and exact release; explicit acknowledged decision; a different native invocation becomes unknown; the basic store rejects only terminal stopped persistence, leaving an acknowledged running checkpoint; fresh restart refuses before a third provider call. Each test checks task budgets off and on. They verify the legitimate decision and exact original invocation reference, the retained two distinct unknown rows, the interruption precondition, the refusal, and unchanged audit rows. The TypeScript fixture also verifies a single retained decision event. These are deterministic provider/store stand-ins at the real adapter boundaries, not live-provider or repeated-host-side-effect certification.

I verified all five current R4 source hashes and all24 retained artifact hashes against r4/final-manifest.json. The unfiltered TypeScript focused run passes38 tests, including genuine accept/reject native continuations, missing/invalid release, retained-proof refusals, scope recovery and no-Plan/no-conversation controls. Both corrected and restored paired Go race commands pass. Removing only the new TypeScript predicate fails the taskSteps-off test at expected3 provider calls to be2, while the on control passes. Removing only the corresponding Go nativePlanSuperseded guard term fails calls=3 want=2. Restored off/on tests pass in both languages. The raw removals compile and reach these physical-count assertions; setup errors, the initial Go fixture row-selection failure and unrelated timeouts are not credited.

The mutation catalog preserves all498 prior rows unchanged and appends one row; an independent parsed-value comparison confirms the complete prior prefix. Its unique find text removes exactly the executed TypeScript safeguard; the resulting whole-file SHA-256 matches the retained removal source. No new refusal relies on broader table or schema relaxation.

R1 — MEDIUM — closed. The original checkpoint3 metadata-preparation, task schedule reconciliation, retained original coordinator pin and real native Plan pause/release/restart work was assessed at571. R4 was its only remaining native acceptance gap; this correction closes that gap independently of task budgets. The preceding exact-claim, unknown-acknowledgement, release/evidence, accept/reject, original-envelope and allowance controls remain unchanged and green. This disposition reuses the original22-issue acceptance map and the571 analysis; it does not claim exhaustive interaction coverage.

R2/R3 remain closed. Eino output-ceiling validation still precedes classification, and the report2 documentation correctly admits optional declared feedback. #206 remains an accepted design decision with its v0.12 implementation split, as previously reviewed. No further code finding blocks merge within this review's scope.

Final two-file correction and check evidence

The98d2b53..39803df diff changes only six generated writer-link rows in docs/reference/events.md and adds maxWorkers:2 to the harness Vitest configuration. It preserves test selection, bodies, assertions, isolation and the existing20-second test timeout; no product, dependency or Go change occurs in that last commit. The bounded worker count changes file-level contention, not concurrency exercised inside the adapter tests. Both current source hashes and full final local reference/unit log hashes match the retained verification. Local affected checks pass: reference30 tests; unit3795 passed with32 existing skips out of3827 selected. Earlier failed diagnostics remain historical failures and are not relabelled as proof of a semantic fix.

I verified the five current CI raw-log hashes, inspected their checkout identities and actual summaries, and read the saved exact-head check-runs response including DCO. PR jobs run synthetic merge c65e2ab1ac83afa82d719eefc389c7babfc12c64 of39803df into7910ab9, rather than trusted-main release evidence.

Exact head39803dff8669504453d35770063b9c90507909cd
CI40686720170 / check122810846850:
  29 passed,0 failed,1 optional live-audit skip,0 not run
  Go race767s; Python157 tests; contract, packed smoke and reference pass
Contract122810846380:4 passed,0 failed
Live audit40686720279 /122810846838:2 passed,0 failed; clean
Mutation40686720239:
  /122810846818:494 active rows applicable,0 problems,5 retired
  /122810847189:15 changed plus5 sample caught;0 undecided/not applying
DCO122810839281:success
Four complete main mutation shards:skipped on PR; still required

Actual inspection in this pass: current AGENTS and applicable policy; concise handoff; all seven changed-file diffs; TypeScript supersededNative/prepared/recovering call sites and canonical scope comparison; unchanged Go native-plan counterpart; new actual-adapter tests and helper; exact TS/Go scratch removals; mutation append/equivalence; raw focused/removal/restored outputs and current full CI/audit/contract/mutation summaries; raw exact-head check metadata; final reference/unit logs and dependency-input diff. Commands were read-only git/rg/sed/cat and Python hash/JSON/diff inspection. The compact evidence file records identities and hashes. No additional probe, Go rebuild, suite, installation, cleanup, source/Git mutation or public action was necessary. Only this initialized review scratch was written. No safeguard stopped this pass.

Remaining main and publication requirements

The final028 Go advisory assessment and571 independent approval-continuity decision remain applicable to unchanged module pins, production imports, admission/deny guards, test import blocks and toolchain configuration. This confirmation performed source applicability checks; it does not claim a new Go advisory query. The current exact-head npm live audit is separately green. Final-main source/advisory freshness still requires explicit binding and reassessment if inputs change.

GO-2026-5781 and GO-2026-5932 remain unresolved module-graph findings. Preserve the explicit #192 approval, scoped solely to Agent v0.11.0/go/v0.11.0, native Linux/amd64, CGO1, default tags, Go1.26.10, expiring 2026-11-07 00:00UTC. The prior reassessment covers crypto0.58 continuity with the originally approved OpenPGP family; no remediation, withdrawal, broader configuration or new advisory exception is claimed.

Actual main must pass the full deterministic checklist and all four full mutation shards at the merge/release commit. PR green and samples cannot qualify as trusted-main release evidence. Preserve exact-source/current-input/freshness admission, final-source audit binding, actual-tag upgrade admission, signed annotated tag/main membership, matching package/lock versions and paired Go tag, current release protection and required approval, immutable publication, checksum/asset identities and provenance attestation, and draft-to-published artifact verification. The actual published Agent npm and Go consumer validation remains pending publication. Parent owns merge and public posting; this report performs neither.

The prior release-review limits remain: no real Desk certification or live quality/cost/token-saving claim; existing companion source/publication probes and synthetic fixtures do not certify future published Agent pairing. #169 live external and routed/unrouted comparisons remain deferred only for v0.11, with routing off by default.

Coordinator dispositions

Finding	Disposition at reviewed head39803df
R1 MEDIUM	Closed by original reviewer, including remaining R4 recovery interaction.
R2 MEDIUM	Closed; pre-classifier Eino ceiling refusal preserved.
R3 LOW	Closed; report2 feedback documentation corrected.
R4 HIGH	Closed; exact-claim exemption preserves refusal of a distinct unknown, independent of task budgets.

The independent report above is reproduced verbatim without redactions. Source report SHA-256: 32753d36c2379e7862cdf6bfa65c13aab72bee993773e45811018c3c0ca8d1f7. Same-vendor Codex exception remains explicit. All actual-main, advisory, tag, protected publication, attestation and published-consumer gates remain; this record does not claim a published release.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation
• Agent harness and adapters