[kikashy]

An explicitly enabled local-admin-manual-pack/1 workspace now requires an exact approved Policy adoption, registered job release, original manual intent and fresh anchored start commitment before Runner can launch Runtime. A one-use proof binds the original authority session to verified Pack, input, Runtime, signing and ownership material. Lost replies and restored history remain observations and cannot launch work.

The offline nonexecuting helper prepares store schema 4 under Desk's continuously held executor lease. Sticky external demand and the prepared store prevent silent fallback to legacy execution. Enabled workspaces refuse triggers, acquisition, mappings, workflows and upgrades; unconfigured workspaces preserve their existing behavior. Public list projections omit private admission metadata.

Validation includes actual Desk → Runner → Runtime race acceptance for exact numeric input, withdrawal ordering, delayed physical spawn, lost reserve/start replies and restart, plus the Linux live Runtime lease/authority-descriptor observer. Focused helper, copied-store, old-Runner, material mutation, failed persistence, one-use proof, privacy and affected CLI checks pass. CI requires named real helper/gate passes on both native hosts and the Linux descriptor observer.

Independent Codex review resolved the held-directory helper and public-list privacy findings; targeted final confirmation covers activation and integration evidence. This is same-vendor review under the maintainer's temporary waiver. Policy companion support remains experimental; this does not publish Runtime v0.35.0, alter published Desk component pins or change a live installation.

[kikashy]

Independent Codex review is complete for 5b1dc848914b3f94e7b3498e6131cfad5b6c33f0, tree f88ae29d1c88ef6ccb91642f04db1152dfee0b54. All 55 committed paths/modes match the reviewed manifest (sha256:374d2df1f6e5f46738ca6c08ade4a006205f3bb691a972c2b6bc84ce3c2f656f). Builder and independent reviewer used GPT-6.1 Sol with xhigh reasoning. This is same-vendor review under the maintainer's standing temporary waiver, not different-vendor review.

Resolved findings:

• Helper reopened the named state directory after pinning it. Marker, lock and sync now use the held root; SQLite targets its retained directory descriptor. Complete-copy substitution refuses without migrating either store; a separate adapter test proves writes target the held original.
• Raw run-list projection exposed private admission metadata. Both list routes now use typed public summaries; the regression verifies exact public fields and unchanged private durable preimages.

No open P1/P2 remain. Final confirmation was limited to the authorized readiness switch, affected tests/docs, CI and formatting; unchanged gate/helper material and prior passing checks were reused.

Focused race evidence covers helper custody/lost reply, exact numeric bytes, changed execution material, journal failures, one-use proofs, old-schema refusal and private-list isolation. The actual Desk → this Runner candidate → same authoring Runtime acceptance passed all four scenarios in 16.787s: exact registered input/withdrawal first, committed start before later withdrawal, lost start reply, and lost reserve reply. Linux also identified the live pinned Runtime, its audit and ownership lease, with no authority endpoint inherited. Candidate binary SHA256: 302a17724f199a81ca8ae2c93b08eaf8f31f48e9113e6a50e50a5c8edb26eb7b.

Required full native CI is still a merge gate. Linux descriptor evidence does not establish native Darwin behavior; CI exercises that host. No guarantee is made against a hostile same-OS-user restoring the entire trusted plane. No release, live enrollment or installed Desk change is approved by this record.

[kikashy]

Reviewed final head 278381c2057ae0772ce1a8ff70b58b68e5b0e5b7, tree cf1c843d6b07122ea34a1a9795d121699cc466e7, including the native adapter, ABI correction and test-only native descriptor correction.

The first native CI run exposed three issues: private-field reflection coverage, a /dev/fd enumeration assumption in the descriptor fixture, and Darwin's unsupported descriptor-directory SQLite path. The targeted correction has completed independent same-vendor Codex review under the existing waiver, with no open source P1/P2.

The dedicated nonexecuting helper now has a process-terminating entry point. Only this entry uses a held working directory and a uniquely named nondefault clone of SQLite's native VFS. Its bounded xFullPathname wrapper preserves only runs.sqlite as relative; native open, locking, fsync, delete, access and sidecar behavior remain intact. Ordinary Runner/library calls do not change working directory or the default VFS. A plain fchdir was rejected during review because the pinned Darwin VFS would reconstruct an absolute named path.

Subprocess regressions replace the named directory after adapter setup and prove database, journal, WAL and SHM writes reach the retained original. Actual preparation refuses replacement without publishing schema/demand/marker into either store. The FD observer now has a deliberately inherited socket negative control. Export coverage still asserts the exact public member set and explicit private exclusion.

Affected helper race checks passed in 6.382s; the positive/negative FD checks passed in 3.235s after an isolated sandbox syscall refusal; export/CLI checks passed in 1.146s. Darwin arm64 compilation passed. The corrected actual binary (sha256:6238c017c380c35957b0b097f2800cb6505f4c0103f25995bc5ade4403f0482c) then passed the four-scenario real Desk → Runner → same Runtime race acceptance in 14.850s, including Linux live lease/no-authority-descriptor evidence.

The review verified all 14 correction files and the combined 58-file manifest (sha256:ad70192d58b5e9ff7c57c303cd70d622305ba74a0a68a32c5bde8483a1eb2513), reusing unchanged source and passing evidence. Native execution on macOS remains a required CI gate before merge; cross-compilation is not treated as that proof.

The next CI attempt stopped at vet before any tests: three native-address casts were flagged. The reviewed one-file correction uses pinned libc native memcpy and typed compiler offsets/assignment, without suppressions or behavior changes. Explicit Linux and Darwin-target vet passed; the narrow actual helper/VFS race regressions passed in 11.481s. Other source bytes are unchanged. Final native CI remains the merge gate; Desk CI will run the final merged Runner source in the mandatory real acceptance fixture.

On 7a389b1, the complete Ubuntu job passed in 9m34s. macOS reported only an observer false failure on an unrelated unsupported native socket; helper/storage had no reported failure. The final reviewed test-only correction checks SO_TYPE first, distinguishes the precise unsupported-family/protocol cases using Apple/XNU and Go source, retains fatal handling of other errors, and passes both a deliberate Unix stream leak and an unrelated datagram control (race PASS4.489s). The existing mandatory cohort moved byte-for-byte ahead of the full suite. Production source is unchanged. Required final native CI remains pending.

Final required CI is green at exact reviewed head 278381c2057ae0772ce1a8ff70b58b68e5b0e5b7: run 39270753757, Ubuntu 9m27s, native macOS 10m16s, release contents and DCO. Both hosts passed the mandatory manual cohort before their full suites. All source findings are closed; merge is within the maintainer’s standing same-vendor waiver. No release or live activation is part of this merge.