drafael · drafael · Aug 31, 2026 · Aug 31, 2026
diff --git a/skills/autopilot/README.md b/skills/autopilot/README.md
@@ -49,7 +49,7 @@ Return to the same repository and ask Autopilot directly:
 
 After explicit `/autopilot` invocation, natural lifecycle wording works too: `/autopilot What happened overnight?`, `/autopilot Continue the interrupted work`, `/autopilot Fix and resolve the PR comments`, or `/autopilot Clean up the merged run and leave a handoff`. Autopilot discovers the current project’s run. If more than one run matches, it lists short choices and changes nothing until you select one.
 
-`status` reports the last durable milestone, unmet predicate identities, remaining budgets, and next legal action from the journal and receipts. `pause` asks the lock-owning coordinator to cancel active implementation work, prove quiescence, retire the exact lease, and enter nonterminal `WAITING`; cancellation solely for pause does not consume the attempt budget. `resume` reconciles a paused or interrupted nonterminal run. A verified item continues from its durable checkpoint and confirmed effects without rerunning implementation. On supported POSIX hosts, an interrupted supervised implementation execution reattaches through exact attempt artifacts and reaches terminal quiescence before any replacement; legacy, review, or incomplete supervisor state fails closed as `EXECUTION_STATE_UNKNOWN`. `address review comments` snapshots unresolved feedback from the exact open PR/MR, creates a verified amendment successor, updates the same branch, and resolves provider-resolvable threads only after the fix passes. `stop` deliberately ends a run and preserves its work; a stopped run cannot be resumed and requires a sealed successor. `wrap up` is destructive: after live provider checks, it removes the exact remote branches, clean worktrees, local branches, and run-state chain. A handoff writes Markdown and JSON summaries under `.autopilot/handoffs/` before cleanup.
+`status` reports the last durable milestone, unmet predicate identities, remaining budgets, and next legal action from the journal and receipts. `pause` asks the lock-owning coordinator to cancel active implementation work, prove quiescence, retire the exact lease, and enter nonterminal `WAITING`; cancellation solely for pause does not consume the attempt budget. `resume` reconciles a paused or interrupted nonterminal run. A verified item continues from its durable checkpoint and confirmed effects without rerunning implementation. On supported POSIX hosts, an interrupted supervised implementation execution reattaches through exact attempt artifacts and reaches terminal quiescence before any replacement. Autopilot packages no Windows native containment helper; direct Windows CLI execution is session-scoped, and continuity loss fails closed as `EXECUTION_STATE_UNKNOWN`, as do legacy, review, or incomplete supervisor states. `address review comments` snapshots unresolved feedback from the exact open PR/MR, creates a verified amendment successor, updates the same branch, and resolves provider-resolvable threads only after the fix passes. `stop` deliberately ends a run and preserves its work; a stopped run cannot be resumed and requires a sealed successor. `wrap up` is destructive: after live provider checks, it removes the exact remote branches, clean worktrees, local branches, and run-state chain. A handoff writes Markdown and JSON summaries under `.autopilot/handoffs/` before cleanup.
 
 ## Read more
 

diff --git a/skills/autopilot/docs/2026-08-30-continuity-evidence-implementation-plan.md b/skills/autopilot/docs/2026-08-30-continuity-evidence-implementation-plan.md
@@ -487,7 +487,7 @@ skills/autopilot/runtime/test/fault-injection.test.ts
 
 ## Phase 7: Finish documentation and packaging
 
-**Result:** Implemented for Phases 0–6A. Phase 6B is not promoted under the recorded no-receiver decision and is not a current release blocker. The current validation baseline is 200 Node tests locally, including the later Pi process-local backend; the earlier 162-test and 137-test baselines passed at their recorded revisions on Ubuntu and Windows.
+**Result:** Implemented for Phases 0–6A. Phase 6B is not promoted under the recorded no-receiver decision and is not a current release blocker. The current validation baseline is 187 Node tests locally after intentional removal of 13 native-helper-specific tests and their production surface. The earlier 200-test Pi process-local, 162-test, and 137-test baselines passed at their recorded revisions on Ubuntu and Windows.
 
 ### Files
 

diff --git a/skills/autopilot/docs/2026-08-31-cooperative-harness-execution-plan.md b/skills/autopilot/docs/2026-08-31-cooperative-harness-execution-plan.md
@@ -1,6 +1,6 @@
 # Cooperative harness execution implementation plan
 
-- **Status:** Approved design; PR 1 decision/promotion shutdown, PR 2 execution assurance, PR 3 fenced unknown-execution recovery, and PR 4 Pi process-local integration are complete; Windows native-path removal remains pending
+- **Status:** Implemented through PR 5: decision/promotion shutdown, execution assurance, fenced unknown-execution recovery, Pi process-local integration, and Windows native-path removal are complete; later provider investigations remain separate
 - **Date:** 2026-08-31
 - **Audience:** Autopilot implementers and reviewers
 - **Related:** [Architecture](architecture.md), [continuity implementation plan](2026-08-30-continuity-evidence-implementation-plan.md), [durable event engine ADR](adr/0001-durable-event-engine.md)
@@ -337,6 +337,8 @@ Validation in a disposable repository:
 
 ### PR 5: Remove Windows native containment
 
+**Status:** Completed.
+
 **Objective:** Complete the binary-removal boundary after cooperative behavior is available.
 
 Remove:

diff --git a/skills/autopilot/docs/README.md b/skills/autopilot/docs/README.md
@@ -39,4 +39,4 @@ Both figures use the vendored Diagram Design default profile. The PNG exports ar
 
 ## Verification status
 
-The runtime has 200 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, descendant process cancellation, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository; disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on authorized private disposable targets with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on authorized private disposable targets with `glab` 1.115.0.
+The runtime has 187 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, POSIX descendant process cancellation, native-free package inventory, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository; disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `glab` 1.115.0.
diff --git a/skills/autopilot/docs/adr/0002-use-cooperative-harness-execution-on-windows.md b/skills/autopilot/docs/adr/0002-use-cooperative-harness-execution-on-windows.md
@@ -88,11 +88,12 @@ Costs:
 
 ## Follow-up
 
-Implementation follows the ordered boundaries in the cooperative harness execution plan:
-
-1. record this decision and stop native artifact promotion;
-2. separate continuity from quiescence in the adapter and journal contracts;
-3. add fenced abandon, adopt, and stop recovery;
-4. implement and fault-test Pi structured delegation in-process;
-5. remove the retained Windows helper source, build, protocol, and test surfaces;
-6. investigate other harnesses independently after Pi proves the boundary.
+The first five ordered boundaries in the cooperative harness execution plan are complete:
+
+1. this decision stopped native artifact promotion;
+2. the adapter and journal contracts separate continuity from quiescence;
+3. fenced abandon, adopt, and stop recovery is available;
+4. Pi structured delegation runs in-process with fault coverage;
+5. the retained Windows helper source, build, protocol, and test surfaces have been removed.
+
+Codex, OpenCode, and Claude harness-owned execution remain separate investigations. No provider inherits Pi's assurance without equivalent evidence.
diff --git a/skills/autopilot/docs/architecture.md b/skills/autopilot/docs/architecture.md
@@ -1,6 +1,6 @@
 # Harness-agnostic Autopilot design
 
-- **Status:** Developer-preview implementation available; POSIX attempt-scoped process reattachment, fenced unknown recovery, Pi process-local cooperative execution, and controlled-fixture sealed restack successors are packaged. Windows native-path removal remains pending; notification wake is not promoted, and live restack mutation remains unverified without renewed target authority.
+- **Status:** Developer-preview implementation available; POSIX attempt-scoped process reattachment, fenced unknown recovery, Pi process-local cooperative execution, native-free Windows packaging, and controlled-fixture sealed restack successors are complete. Notification wake is not promoted, and live restack mutation remains unverified without renewed target authority.
 - **Date:** 2026-08-22
 - **Audience:** Coding-harness maintainers and adapter authors
 - **Implementation plan:** [Autopilot implementation plan](implementation-plan.md)
@@ -297,7 +297,7 @@ interface ExecutionAssurance {
 
 `restartReattachment` remains a protocol-v1 compatibility field for older manifests and journals. New attempts persist their selected assurance before launch in `ATTEMPT_STARTED`, then persist the exact adapter, backend, and subject identity in `ATTEMPT_EXECUTION_ADMITTED`. A lost single-shot admission or cooperative continuity boundary becomes `EXECUTION_STATE_UNKNOWN`; the engine never converts a missing reattachment into a new launch.
 
-Adapters return observations. They never write the journal or choose lifecycle transitions. On POSIX hosts, built-in CLI implementation executions run beneath a detached, attempt-scoped supervisor that owns the harness pipes and bounded output/activity capture. Before harness launch, a separately detached watchdog durably confirms readiness. The harness then joins the supervisor's known process group. All terminal publication is a watchdog-owned handshake: the supervisor publishes a bounded completion candidate, the watchdog terminates and confirms the group is quiescent, and only then publishes the durable result and terminal status. This also covers supervisor exit before child-identity publication. The reviewed Windows x64 Job Object helper will not be packaged because a custom process-management executable creates antivirus, application-reputation, architecture, and provenance risk. The source and runtime path remain temporarily for ordered removal, but the artifact-producing workflow is gone and Windows continues to report restart reattachment as unsupported. Windows currently uses `taskkill` only for the existing session-scoped direct-execution fallback. The approved replacement is version-pinned cooperative harness execution: only an exact terminal response from the uninterrupted harness instance may proceed to repository verification. Harness loss becomes `EXECUTION_STATE_UNKNOWN`, launches no replacement, and requires operator recovery. This boundary does not prove process-tree quiescence. The supervisor writes only fenced operational artifacts under `runs/<run-id>/executions/<execution-id>/`; it cannot write `events.jsonl`, receipts, leases, snapshots, or Git state. On supported POSIX attempts, a fresh coordinator reconstructs the exact request from the journaled attempt and immutable context, reattaches to running or terminal supervisor artifacts, and waits for terminal process-tree evidence before allowing a replacement attempt. Review executions remain session-scoped.
+Adapters return observations. They never write the journal or choose lifecycle transitions. On POSIX hosts, built-in CLI implementation executions run beneath a detached, attempt-scoped supervisor that owns the harness pipes and bounded output/activity capture. Before harness launch, a separately detached watchdog durably confirms readiness. The harness then joins the supervisor's known process group. All terminal publication is a watchdog-owned handshake: the supervisor publishes a bounded completion candidate, the watchdog terminates and confirms the group is quiescent, and only then publishes the durable result and terminal status. This also covers supervisor exit before child-identity publication. The reviewed Windows x64 Job Object helper was not packaged because a custom process-management executable creates antivirus, application-reputation, architecture, and provenance risk. Its source, runtime path, build scripts, and native-specific tests have been removed, and Windows reports restart reattachment as unsupported. Windows uses `taskkill` only for best-effort cancellation of the existing session-scoped direct-execution fallback; failed cancellation cannot prove terminality. The approved replacement is version-pinned cooperative harness execution: only an exact terminal response from the uninterrupted harness instance may proceed to repository verification. Harness loss becomes `EXECUTION_STATE_UNKNOWN`, launches no replacement, and requires operator recovery. This boundary does not prove process-tree quiescence. The supervisor writes only fenced operational artifacts under `runs/<run-id>/executions/<execution-id>/`; it cannot write `events.jsonl`, receipts, leases, snapshots, or Git state. On supported POSIX attempts, a fresh coordinator reconstructs the exact request from the journaled attempt and immutable context, reattaches to running or terminal supervisor artifacts, and waits for terminal process-tree evidence before allowing a replacement attempt. Review executions remain session-scoped.
 
 The runtime inspects the real worktree after an agent exits. Unexpected commits, refs, or out-of-scope edits become reconciliation findings.
 

diff --git a/skills/autopilot/docs/getting-started.md b/skills/autopilot/docs/getting-started.md
@@ -70,7 +70,7 @@ Natural requests work too:
 
 `status` rebuilds progress from the sealed charter, hash-linked journal, Git identities, and receipts. It reports the last durable milestone, unmet predicate identities, normalized failure, remaining budgets, repeated no-change attempts, and next legal action. `pause` asks the live coordinator to cancel active implementation work, prove quiescence, retire the exact lease, and enter nonterminal waiting. A cancellation caused solely by pause remains auditable but does not consume an attempt. `resume` continues a paused or interrupted nonterminal run within its original limits. Verified items reconcile their checkpoint and effects without rerunning implementation. It does not restart a run that still has a live coordinator. `stop` asks a live coordinator to cancel active adapter work and record a durable terminal stop; if the coordinator is gone, Autopilot records the stop under the run lock. Branches, worktrees, receipts, and evidence remain intact.
 
-A stopped run cannot be resumed. Changed authority, budgets, or objectives require a sealed successor. After coordinator loss on supported POSIX hosts, Autopilot reattaches built-in supervised implementation executions and waits for terminal process-tree evidence. Legacy attempts, review executions, and incomplete or mismatched supervisor artifacts record `EXECUTION_STATE_UNKNOWN` and refuse a replacement launch until quiescence can be proven. Pi in-process implementations also become unknown when their exact owning extension instance is lost. Resume them through `/autopilot-resume [run-id]` in a loaded Autopilot extension; use fenced `/autopilot-recover` or the runtime CLI to abandon, adopt, or stop an unknown attempt.
+A stopped run cannot be resumed. Changed authority, budgets, or objectives require a sealed successor. After coordinator loss on supported POSIX hosts, Autopilot reattaches built-in supervised implementation executions and waits for terminal process-tree evidence. Autopilot contains no Windows native containment helper, so direct Windows CLI execution is session-scoped and continuity loss becomes `EXECUTION_STATE_UNKNOWN`. Legacy attempts, review executions, and incomplete or mismatched supervisor artifacts also refuse a replacement launch until quiescence can be proven. Pi in-process implementations become unknown when their exact owning extension instance is lost. Resume them through `/autopilot-resume [run-id]` in a loaded Autopilot extension; use fenced `/autopilot-recover` or the runtime CLI to abandon, adopt, or stop an unknown attempt.
 
 If several runs match, Autopilot lists their title, short ID, state, progress, and last update. It changes nothing until you choose one, for example `resume 1` or `status spring-boot-4`.
 

diff --git a/skills/autopilot/docs/implementation-plan.md b/skills/autopilot/docs/implementation-plan.md
@@ -1,6 +1,6 @@
 # Harness-agnostic Autopilot implementation plan
 
-- **Status:** Developer-preview implementation available; POSIX attempt-scoped reattachment, versioned execution assurance, fenced unknown recovery, and the Pi process-local structured delegation backend are packaged. The reviewed Windows x64 Job Object artifact will not be packaged; its source and runtime path remain only until the ordered native-removal change.
+- **Status:** Developer-preview implementation available; POSIX attempt-scoped reattachment, versioned execution assurance, fenced unknown recovery, and the Pi process-local structured delegation backend are packaged. The Windows native-helper source, runtime path, build scripts, and tests have been removed; Windows restart reattachment remains unsupported.
 - **Date:** 2026-08-22
 - **Audience:** Autopilot implementers and reviewers
 - **Governing design:** [Autopilot architecture](architecture.md)

diff --git a/skills/autopilot/docs/runtime-cli.md b/skills/autopilot/docs/runtime-cli.md
@@ -57,7 +57,7 @@ If no coordinator owns the run, `stop` acquires the run lock and records the ter
 
 `recover` requires an inactive coordinator and the exact current unknown item, attempt, and lease epoch. Every action records the owning run-lock token hash and explicit operator attestation. `abandon` permanently moves the uncertain worktree aside before a fresh attempt; `adopt` requires the exact freshly observed `--tree` and runs verification without an implementation launch; `stop` preserves the evidence and terminalizes the run.
 
-`stop` is terminal. A stopped or successful run requires a sealed successor for changed work. On supported POSIX hosts, built-in adapters reattach supervised implementation executions after coordinator loss and wait for terminal process-tree evidence before retrying. Legacy attempts, review executions, and incomplete or mismatched supervisor artifacts record `EXECUTION_STATE_UNKNOWN` and refuse a replacement launch.
+`stop` is terminal. A stopped or successful run requires a sealed successor for changed work. On supported POSIX hosts, built-in adapters reattach supervised implementation executions after coordinator loss and wait for terminal process-tree evidence before retrying. Autopilot packages no Windows native containment helper: direct Windows CLI executions are session-scoped, and continuity loss records `EXECUTION_STATE_UNKNOWN` without a replacement launch. Legacy attempts, review executions, and incomplete or mismatched supervisor artifacts fail closed the same way.
 
 ## Journal repair
Original file line number	Diff line number	Diff line change
Expand Up		@@ -39,4 +39,4 @@ Both figures use the vendored Diagram Design default profile. The PNG exports ar

		## Verification status

		The runtime has 200 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, descendant process cancellation, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository; disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on authorized private disposable targets with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on authorized private disposable targets with `glab` 1.115.0.
		The runtime has 187 Node tests locally covering deterministic attempt context, predicate evidence maps, exact-tree review fixtures, local Git lifecycle behavior, crash reconciliation, intentional pause, exact-subject provider waiting, hooks, queues, stacks, sealed review-feedback amendments, GitHub and GitLab provider contracts, sibling worktrees, POSIX descendant process cancellation, native-free package inventory, and wrap-up. Controlled Pi 0.84.4 with pi-subagents 0.60.0 process-local tests cover exact admission, cancellation, extension-context loss, direct fallback, and runtime-core completion in a reused local repository; disposable exact-tree reviews also passed with Pi 0.84.4, Codex 0.151.0, and OpenCode 1.18.25; Claude Code 2.1.251 remains unverified because its identity-linked API key requires an `ANTHROPIC_WORKSPACE_ID` that is not present in the validation environment. GitHub PR creation, marker reconciliation, exact review-thread resolution, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `gh` 2.98.0. GitLab MR creation and reconciliation, exact discussion resolution, duplicate-status latest selection, exact-head amendment, merge, and wrap-up passed on an authorized private reusable validation project with `glab` 1.115.0.