[opencdlee-dotcom]

Precision plan, pass 2, step P2a-2: the replay harness now uses the config parser for agent exec entries. Base: agent/fable-precision/assembly.

The defect

_reobserve_agent_surface_answer rebuilt a target or materialized exec entry directly from the recorded fingerprint and the recorded program, then passed it to diff_agent_surface. The config parser never ran, and P2d's fixes live in that parser:

• Codex's runtime process table no longer registers an exec (#521).
• A guarded hook line now resolves to its script, not the glue command in front of it (#453: /bin/mkdir became aikit's hook_postwrite.py).

The replay still counted both incidents as re-derived and re-opening.

The fix (harness only)

For target and materialized records, the harness now reads the config at path through snapshot_agent_surface, limited to that one file (_agent_config_files overridden, memoized per path). The parse, the process-table refusal and the resolver are therefore the ones a scan runs.

today's parse	outcome
entry no longer registered	dropped: "the current parser registers no such entry"
resolves to a different file	re-derived against that file: its bytes and custody, matched on the fingerprint the sensor mints for them. If it resolves to nothing with content: dropped
entry and target unchanged	as before: held to the recorded bytes, moved-on if they changed
config gone	gone
config unreadable	not re-derivable
pre-identity positional exec key	not re-derivable, never read as a missing entry

A dropped answer can now carry the sensor's reason, counted in stats["dropped_why"] and printed under the not-re-derivable line. Dropped findings still count as re-observed and no longer emitted, so the accounting, the split and the self-check are unchanged.

Live replay (backtest replay --days 30 --reobserve)

• Before, measured on this base: noise re-opened: 59 of 214 — re-derived 9 (the target), as recorded 50. Re-derived: #352 #382 #406 #413 #414 #432 #452 #453 #521.
• After: noise re-opened: 57 of 214 — re-derived 7 (the target), as recorded 50. Re-derived: #352 #382 #406 #413 #414 #432 #452.
• #453: all 424 findings now re-derive against hook_postwrite.py, going from HIGH/- to MEDIUM/local-commit. #521: dropped by the current parser.
• The self-check passes: re-derived 7 + as recorded 50 = 57 re-opened.

Tests

tests/test_backtest_replay_persistence.py: the agent exec-target class now writes a real config that the parser reads, under the sandbox. It adds five cases: dropped (process table), re-resolved, unchanged-but-moved-on, config gone, and positional key.

Pre-existing red on this base, fixed here: test_a_target_now_proven_committed_is_demoted fails on agent/fable-precision/assembly as it stands (1 != 0 on custody_changed). P2d asks custody at the target's realpath, and the stub compared the temp path as written. On macOS those differ, because the temp dir sits under /var -> /private/var. The stub now compares real paths.

Full suite at 0594c36, python3 -m pytest tests/ -q -p no:cacheprovider: 2417 passed, 7 skipped, 30 xfailed, 41 subtests passed in 1160.08s. The tree sha was 2e56a655 both before and after the run, ~/.aegis/custody.jsonl was byte-identical before and after, and S7's conftest guard is in the tree.

🤖 Generated with Claude Code