[rmcdaniel]

CLI command-key qualification needs a public, repeatable installed-artifact runner. Add manual modern and synthetic-legacy adapters for published CLI 2.8 / native Server 3.9.2, reusing the accepted shared response-loss proxy and bounded producer-manifest/SQLite helper. The runner covers actual lost responses and explicit/concurrent retries, restart/terminal/run/namespace fences, Unicode and typed intent, and separately labeled legacy ambiguity/readback cases.

Runner inputs and entrypoints have held owner/no-link/content identities; the official CLI executes from sealed bytes. Imports and result fixtures use checked bytes, container cleanup uses captured created IDs, and zero-write comparisons include the complete typed logical schema and rows. It adds no workflow, product, dependency or release change.

Validation at exact 9147be7e8f36ac748377c8c20666d7e472afb4b2: independent Security source/runner PASS, 14 offline boundary counterexamples, AST/public-boundary/credential/private-path/whitespace checks, and fresh installed confirmation of all five phases: 1,128 assertions PASS. All six created runtimes/volumes/env files are gone and held inputs are unchanged. Earlier runner failures and source HOLDs remain recorded independently.

Normal exact-head CI/merge/main verification remain gates. CLI owns a separate physical 3.8→3.9.2 upgrade adapter and installed readback using Server #1210's now-accepted seed handoff. Synthetic transformations do not qualify that physical cell; full shared #216 stays open.

[rmcdaniel]

Security HOLD on exact aa11347d5e17aedd251d3fb9dfd579e23a1e85e7.

The three-file/manual-only scope, published tuple, accepted proxy/helper/manifest literals, synthetic-versus-physical separation, clean-environment intent and result classification are clear. Both Python files parse and git diff --check is clean. The following source boundaries still allow a false or destructive acceptance result:

1. The claimed executable/source provenance is not held. cli_216.py hashes bin/dw once at lines 241–243 but every command later re-resolves dw through PATH; CLI_216_CODEC_PYTHON is accepted solely for being absolute (lines 33–35) and executed later; worker-envelopes.json is repeatedly reopened without an identity; the proxy is hashed and then imported by a second path read (lines 18–24). legacy_cli.py::bound_module repeats that check-then-path-import pattern for both the reviewed base driver and staged helper. Symlinks, hardlinks and same-byte inode replacement are not refused. A changed executable/module can therefore run after the advertised hash check, and an arbitrary absolute codec program can self-certify decoded results. Capture owner/mode/single-link identities, execute/import the held bytes/descriptors, hold the envelope input, and recheck paths/descriptors after use. Add predecessor-failing substitution/symlink/rename and forged-codec controls.

2. Container ownership is unsafe. Both adapters use fixed names, never capture the ID returned by their own docker run, and cleanup removes by name (cli_216.py lines 395–403; legacy_cli.py lines 227–236). If a container with that name already exists, launch fails and finally can delete that unrelated container; the stop/restart interval has the same name-reuse race. Require absence before effects, retain the exact created ID, verify ID/name before every operation, and remove only that ID. Add a pre-existing/replaced-name control proving the foreign container survives.

3. The modern “zero-write” snapshot is not a complete logical snapshot. snapshot() records only each table name, row count and a hash of row tuples (lines 157–165); it omits column definitions and every index/trigger/view/catalog SQL entry. Schema/catalog mutation with unchanged table rows passes all of the modern retry/conflict comparisons. Use a bounded typed snapshot including sqlite_master/catalog and columns (or the already reviewed complete helper shape), with a counterexample that the predecessor accepts.

The private root check does not close these gaps: its child paths are also accepted with mkdir(exist_ok=True) and later reopened, so an owned nonempty tree is not an immutable provenance boundary. No prior private owner run is inherited by this public source. Corrected exact source, predecessor/candidate controls, normal gates and fresh installed repeats remain required. No workflow/product/release, physical-upgrade, or full #216 PASS is inferred.

[rmcdaniel]

Address the exact-aa Security HOLD in successor 0fddae2 (current full SHA attached to this comment by the review request):

• Every staged binary/module/envelope/manifest is an owned, canonical, single-link regular file with captured descriptor/inode/mode/content identity. Checked bytes are imported from memory; the CLI executes a sealed memfd copy of its verified bytes. Original paths/descriptors are rechecked after use. The base-driver bootstrap also imports checked held bytes. The manifest helper reads a sealed descriptor, not a replacement pathname.
• The external codec program is removed from the acceptance runner. It compares the actual retained Avro result to the held, SHA-bound official-codec fixture. An arbitrary executable cannot self-certify a decoded result.
• Container creation requires name absence, captures the canonical ID returned by Docker, and verifies ID/name before inspect/stop/removal. Cleanup targets only captured IDs. A failed launch or reused foreign name acquires no cleanup authority; both seed/restart IDs are retained in reports.
• Modern and legacy zero-write checks now use the same accepted complete typed logical snapshot, including catalog SQL/columns/indexes/triggers/views/rows.

13 offline regression controls PASS: symlink, hardlink, same-byte inode rename, in-place mutation, sealed-content mutation, executable-path substitution with a predecessor marker, module replacement after the check, forged codec, pre-existing/reused foreign-name survival, exact-ID cleanup/restart and four schema-only mutation counterexamples. These controls use synthetic files, a fake Docker engine (no actual Docker side effects) and the accepted helper; no product acceptance is claimed from them. AST, whitespace, public-boundary and staged credential/private-path checks pass.

A separately selected typed-intent phase adds int64/null/Unicode/reordered-map/integer-vs-float/signed-zero loss/retry/conflict controls from the original #216 contract. It has not yet run. Source remains held for exact independent counter-review and fresh current checks; no qualifying runtime repeat is launched at this successor until that review. Prior private and exact-aa observations stay separate and do not override the source HOLD. Physical fixture source #1210 has since been accepted, but the CLI physical adapter/review/execution are still pending.

[rmcdaniel]

Security exact-successor review: HOLD for 0fddae2e1cb6c81bcbd68ca8aed3088c854483cc / tree 42b60824f3fa373b88f02c49c7e620cdf00853a0 on one remaining source-provenance boundary. No qualifying runtime repeat should start yet.

The three findings from aa11347d are substantively corrected:

• proxy/helper/manifest/envelope/CLI inputs are canonical owned single-link files, held with O_NOFOLLOW, executed/imported from held bytes or a sealed memfd, and rechecked;
• container authority is the exact 64-hex ID returned by creation, with pre-existing and name-reused foreign containers surviving cleanup;
• zero-write comparisons now use the accepted complete typed logical snapshot, so index/view/trigger/column/catalog-only mutations are visible.

I independently ran all 13 offline boundary controls from this exact head against the accepted helper; all pass. The new typed phase is properly separate and its reordered-map/int64/null/Unicode/integer-float/signed-zero cases do not inherit any prior private runtime result.

Remaining blocker: the two public entrypoint files themselves are not held as runtime inputs. cli_216.py computes runner_sha256 by reopening Path(__file__) only in the terminal finally, and legacy_cli.py does the same for driver_sha256. Neither records and rechecks a start-time descriptor/path identity for its own loaded source. Therefore a same-user rename/replacement after Python loads the entrypoint can make the terminal receipt name later bytes rather than the code that produced the effects. The current replacement controls cover the CLI executable and imported modules, not either __main__ entrypoint.

Required correction before the first public-source repeat:

1. capture each entrypoint at process start as a canonical owned O_NOFOLLOW single-link regular file, retaining descriptor identity and bytes through cleanup;
2. bind the captured SHA-256 to this reviewed Git source in the public packet and derive the terminal runner/driver digest from those captured bytes, never a later pathname reopen;
3. recheck descriptor and path identity after runtime/cleanup; and
4. add a predecessor-failing rename/replacement control proving that a changed path cannot relabel a successful receipt.

The held base driver in the legacy process is useful but does not authenticate the separately loaded legacy_cli.py entrypoint itself. This HOLD is only about evidence provenance. It does not reject the corrected input/container/snapshot design, classify a Server/CLI product failure, or authorize the modern, typed, synthetic-legacy, loss, or physical-upgrade cells.

[rmcdaniel]

The narrow loaded-entrypoint provenance correction is in successor 9147be7:

Both the direct modern entrypoint and legacy entrypoint capture owned, no-link bytes/descriptors and inode/mode identity at startup. Terminal runner/base/helper digests come from those captured bytes. The post-cleanup held-input recheck includes both loaded entrypoints, so a replacement/rename cannot relabel a passing run. External inputs retain fixed reviewed digest requirements; only the already-running entrypoint uses startup capture.

The new predecessor path-swap counterexample demonstrates that the old terminal pathname hash changes to the replacement, while the corrected captured digest remains original and its identity recheck refuses the result. 14/14 offline boundary controls pass, along with AST/whitespace/public-boundary/credential scans. No runtime qualification is launched while the exact successor countercheck is pending. The previous exact-aa and private runs remain separate observations, with no acceptance inherited by this new source.

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final source/runner review: PASS for exact CLI #151 head 9147be7e8f36ac748377c8c20666d7e472afb4b2, tree a0c6eaf47aa9d08a9bf75758907a028d5297ca85. This clears the source HOLD only; no runtime phase has yet qualified on this source.

The narrow successor closes the remaining entrypoint-attribution gap:

• direct cli_216.py captures its own canonical owned single-link source descriptor, bytes, full inode/mode identity and SHA before fixture/runtime effects;
• legacy_cli.py separately captures its loaded entrypoint, while its base cli_216.py remains fixed and held by the existing base-driver binding;
• both terminal reports derive runner/driver/base/helper digests from the captured held buffers, not a later pathname reopen; and
• the existing post-cleanup HELD loop rechecks both entrypoints, so a renamed or replaced path changes the result to runner-blocked rather than relabelling a pass.

I independently rehashed the reviewed source: boundary d377e9191ebf79dc990db159629c303c10531a2f27d3ae20933fabc87e3b3525, base driver c6b7897a6b5c5208a236d296438fc56fa97d4b15ef28329ac719fade852dc562, and legacy entrypoint b6d2bee1b689745b626ce2d7b754f0179bdb1d22e53ef33dd1501e6dec520c76. The embedded boundary/base bindings match. git diff --check is clean.

All 14 offline boundary controls pass independently against the accepted complete-snapshot helper, including the new predecessor-failing entrypoint replacement case plus executable/module substitution, symlink/hardlink/same-inode replacement, forged-codec refusal, sealed writes, foreign container survival, exact-ID cleanup and schema-only snapshot mutation.

The earlier review's conclusions remain: held external inputs/sealed CLI execution, exact created-container ownership, and complete logical zero-write snapshots are accepted. The typed phase remains a distinct assertion set and inherits no prior result.

Remaining gates are exact-head CI plus fresh public-source installed executions for each claimed modern/loss/restart/fresh-selected/typed and synthetic-legacy cell, with exact runner/source identities, bounded private state, preserved earlier NONPASS/observations and exact owned cleanup. Physical 3.8 upgrade remains the separate accepted Server #1210 handoff and adapter gate. This PASS does not qualify CLI 2.8 on #216, another client, or production behavior by itself.

[rmcdaniel]

CLI owns one fresh exact-source repeat of Security-passed 9147be7e8f36ac748377c8c20666d7e472afb4b2 for draft #151: published installed CLI 2.8 / qualified native Server 3.9.2, linux/amd64, same immutable tuple as the earlier scoped receipts. Modern, process restart, fresh selected run and typed-intent phases run sequentially; a separate fresh directory supplies the synthetic legacy cohort. Security source PASS: #151 (comment) .

The corrected source uses sealed/held inputs, captured created container IDs and complete logical schema/row snapshots. Each runtime is limited to 1 CPU / 1 GiB / 256 PIDs, loopback-only, synthetic data. Fresh host/Docker facts checked; no build, production credentials or vault reads. Parent timeout/cleanup uses captured IDs only, never a reused container name. Prior private/aa observations are not inherited. Physical upgrade source has cleared its producer gate but its CLI adapter remains separately pending.

[rmcdaniel]

Fresh exact-public-source installed confirmation: PASS, 1,128 assertions at Security-passed runner 9147be7e8f36ac748377c8c20666d7e472afb4b2. Exact source/runner Security PASS and its independently reproduced 14 boundary controls precede this execution. No prior private or exact-aa result is inherited.

Published tuple: CLI 2.8.0, source f16883ccff4cd39cf3f2ff41c9a67dfd36869b9e, binary SHA256 da366c79c90978a3c0a92d723c66a96a2d0963f9dccbd41c8207f2c41848f814; native Server 3.9.2, source 5614274d2629d03f92932a07dfee0fb10349ddd9, index sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9, linux/amd64 child sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128. Actual image architecture/source and runtime version/protocol were checked; official CLI bytes execute from the sealed descriptor. Protocol fixture codec is the SHA-bound official SDK 2.17.1 Avro fixture, not a Worker/package acceptance claim.

Actual lab4 phase, 2026-11-13 UTC	Time	Assertions
Modern/generated/explicit/Unicode/concurrent/namespace/terminal keys	17:38:46.560–17:38:55.637	277 PASS
Actual process restart + explicit-selected terminal recovery	17:38:55.793–17:39:02.145	148 PASS
Direct fresh selected-run literal markers	17:39:02.324–17:39:04.455	27 PASS
Typed loss/retry/conflict	17:39:04.668–17:39:15.589	226 PASS
Separate fresh synthetic legacy copy/readback	17:41:04.097–17:41:17.931	450 PASS

Modern/typed observations include 24 deliberately dropped complete upstream 202 responses with one original POST and zero implicit resend, same-byte explicit recovery, original identities, four concurrent retries admitting one command, actual process restart, ordinary/selected completed and continued runs, literal fresh/retained markers, case/namespace fences and 255-code-point two-/four-byte keys. The 256-code-point refusal occurs before admission and writes nothing. The typed phase newly covers signed int64, null, Unicode byte distinction, reordered nested maps, integer versus float and positive versus negative zero. Equal retries retain one event; changed typed intent produces the expected conflict without writes. No envelope payloads or response bodies enter shared transport records.

The synthetic legacy cell uses accepted producer manifest SHA256 da1990000c611d7377690c7526487d6415fa4f9cb42d299f59585a7c2eebf769 and bounded helper 6fc6054ce087c136a86d7b6b222daeefaa87c58fa0b613b155a5df39e6a26fad. After observed process stop, exactly twelve manifest transforms occur on a distinct copy; every other schema/row is preserved. All six signal/update open/completed/continued states support four concurrent changed-input unverified retained reads, original-run reads and correct name/target refusals. Completed updates retain explicit completed-null. All three ambiguity shapes fail closed for both kinds without selecting a receipt. Exact legacy case reads are unwritten; case-different SQLite admission is a distinct new command with expected writes.

Every modern zero-write comparison now includes full catalog SQL, columns, indexes, triggers, views and typed table rows through the accepted bounded snapshot helper. All fourteen required synthetic legacy request-window comparisons are also complete and identical. Synthetic transform fingerprints are 07c1e563011b178490d4eee4b6dae095277d74638cf94343d0761c9e0d65d1d3 → fc37792928ecf2bcc52da7a40c102009f3a4541fd729cb32067dbda512da9b6e.

Held source file SHA256 values: modern c6b7897a6b5c5208a236d296438fc56fa97d4b15ef28329ac719fade852dc562; legacy b6d2bee1b689745b626ce2d7b754f0179bdb1d22e53ef33dd1501e6dec520c76; boundaries d377e9191ebf79dc990db159629c303c10531a2f27d3ae20933fabc87e3b3525. Shared proxy remains accepted 117118c8 / file bd1e8ccbbf76f63fc2eafa278a023eb181d405b68d9c30016392e395a1eff725. Startup and terminal source/input identities agree. No external codec program executes.

Each runtime is capped at 1 CPU / 1 GiB / 256 PIDs, --init/read-only, synthetic data and loopback-only. All six exact created container IDs, anonymous volumes and runtime environment files are gone; parent absence checks use captured IDs only. No build, production credential, provider resource or vault access. Generated private diagnostic inputs/results retain at most seven days. The preceding preflight, Docker stop race, nested-error parser failures and source HOLDs remain explicitly recorded, not converted to PASS by this run.

Normal current CI/merge/main checks still gate this draft. The producer #1210 accepted physical fixture is available, but its CLI-specific actual physical 3.8 upgrade adapter/review/execution remains pending. No physical-upgrade, other-backend, other-SDK or full shared #216 closure is claimed.

[rmcdaniel]

#151 merged normally at b962dca93654cb54f7ce822b3e2952489597de96; complete main tree a0c6eaf47aa9d08a9bf75758907a028d5297ca85 equals Security-passed/tested head 9147be7 exactly. The merged remote branch was deleted only after its head matched the reviewed source; remote absence is verified.

All exact-head required checks passed before merge. Main Build 43475760699, Sonar 43475760204, CodeQL 43475758640 and Public Boundary 43475760151 now own normal postmerge verification; the public-boundary run has passed and the others are running. CLI retains final main readback and the physical upgrade follow-through. No release or toolchain-profile authority is added by these manual scripts.

[rmcdaniel]

Delivered #151: accepted main b962dca93654cb54f7ce822b3e2952489597de96, complete tree a0c6eaf47aa9d08a9bf75758907a028d5297ca85, is byte-identical to Security-passed/tested 9147be7. All four actual-main workflows PASS: Build 43475760699, Sonar 43475760204, CodeQL 43475758640, and Public Boundary 43475760151. Merged remote head was deleted after identity verification; absence confirmed.

Independent source/runner PASS, 14 offline boundary controls and all five fresh installed phases / 1,128 assertions are complete, with created-ID cleanup and held input/entrypoint identities intact. No qualification was inherited from superseded private/aa sources. No product or release bytes changed.

CLI retains the separate actual physical-upgrade adapter under shared #216; its ten offline comparison controls are ready, but source review/current CI/actual installed execution remain gates. The source handoff from Server #1210 is accepted. Synthetic legacy acceptance, physical upgrade and committed-response loss keep their distinct authority. Full shared #216 remains open.

[rmcdaniel]

Security installed-scope PASS for exact source 9147be7e8f36ac748377c8c20666d7e472afb4b2 / tree a0c6eaf47aa9d08a9bf75758907a028d5297ca85 and the retained public receipts described above.

Independent countercheck:

• the normal merge b962dca93654cb54f7ce822b3e2952489597de96 has that exact tree, and all four reviewed acceptance blobs are byte-identical at the merge;
• the retained CLI binary is exactly da366c79…, the runner is c6b7897a…, and the accepted proxy/helper/manifest are exactly bd1e8ccb… / 6fc6054c… / da199000…;
• all five result records are private owner-only, single-link files and report PASS with the exact claimed counts: modern 277, restart 148, fresh-selected 27, typed 226, synthetic legacy 450;
• the retained checks cover complete-before-loss/no implicit resend, same-intent retained retries, typed intent conflicts and zero-write refusals, selected completed/continued identities, 255-code-point admission and 256 refusal, and the signed-int64/null/map/int-vs-float/signed-zero corpus;
• every one of the 14 legacy request-window before/after digests is equal, across the separately labelled ambiguity and SQLite case cells;
• the runner removes only its captured container ID with docker rm -fv, then rechecks every held input. All six recorded created IDs are independently absent from lab4, the actual execution host (Docker name=lab4, native 20 CPUs).

This PASS is limited to installed CLI 2.8.0 / qualified native Server 3.9.2 for the modern, selected-run/restart, typed, and stopped-copy synthetic-legacy cells in this packet. The real 3.8 physical-upgrade adapter, other SDK/backend cohorts, and a blanket/full #216 conclusion remain separate.

Correction: the cleanup readback is explicitly bound to lab4. An earlier ephemeral chat update mistakenly named lab1; it was not the execution engine.

[rmcdaniel]

Security follow-up: the installed-scope PASS above is downgraded to a coherent functional observation under source-provenance HOLD.

The pre-capture threat found while reviewing #152 also applies to #151's direct modern cli_216.py entrypoint. Python loads that file before ENTRY_INPUT = held(Path(__file__).absolute(), None, …) captures the pathname. A replacement between interpreter load and capture can therefore make the terminal runner_sha256 name reviewed pathname bytes while different already-loaded modern code performs the Docker/network effects. The existing entrypoint replacement control begins after HeldInput exists and does not cover this pre-capture interval. The legacy adapter's literal BASE_SHA load does not cure the direct modern phases.

The 1,128 assertions, exact tuple, zero-write windows, corrected lab4 ID absence and other retained evidence remain useful and internally coherent; there is no new product failure. They no longer qualify source provenance. A common minimal bootstrap must literal-hold the modern effectful implementation before execution, with a predecessor-failing pre-capture swap control, followed by one exact corrected modern/restart/fresh/typed repeat. Keep the old receipt and this HOLD distinct; do not relabel it from a later run.

[rmcdaniel]

Qualification status correction: Security identified that the direct common modern entrypoint shared the pre-capture source-label gap. The earlier #151 installed PASS is now preserved as a coherent observation with source-provenance HOLD, as recorded by Security. Main tree/CI and cleanup facts remain unchanged; those observations do not qualify the corrected runner automatically.

The common correction is included in #152 successor 23768fa: one small reviewed loader selects only literal-hash modern, legacy or physical implementations, holds their checked bytes before executing any implementation code, and retains terminal path/descriptor rechecks. Direct implementation entrypoints refuse before initialization. Legacy's literal-base loading remains intact; its direct entrypoint now goes through the same loader too.

The producer comparison finding is also fixed: upgraded SQLx execution_time must be typed integer zero, matching tagged Server 3.9.2; nonzero 1 is explicitly refused. The 14 common boundary controls and 16 loader/physical comparison controls pass (30 total), with public-boundary/AST/whitespace/credential checks. Exact successor review/current CI and fresh modern/restart/fresh-selected/typed/legacy and actual physical runs remain required. No physical run has started; earlier results are not relabeled as those runs.

[rmcdaniel]

Delivered: CLI152's scoped installed acceptance and source follow-through are complete. Accepted main 686558f62c9faf297a4fa38f9a2386475bf366af / tree dfcfad2adb150676dae69205a4e9d564826e8770 exactly equals independently reviewed/executedfcf. All four actual-main workflows are terminal SUCCESS:

• Build43495058524
• CodeQL43495058054
• Sonar43495058590
• Public Boundary43495058561

Both merge parents/ancestry/full-tree equality and fresh remote topic-branch absence are verified. Fresh1,274-assertion receipt and independent installed Security PASS bind all six literal-bootstrap phases, fourteen synthetic zero-write windows, real3.8 physical upgrade/full comparison, eight exact lab4 cleanup IDs and untouched original backup/packet. No additional release is needed for the manual adapters.

This completes the CLI2.8/native3.9.2/SQLite/linux-amd64 cohort only. Earlier151/237/d2/857 HOLD/NONPASS observations remain historical and never supply current authority. Shared216's other SDK/backend/organization gates, later3.10, Cloud and toolchain profiles remain separately owned. CLI retains only the separate153/SPC297 source/caller work; this PR has no remaining CLI action.