[rmcdaniel]

Manual CLI command-key acceptance must bind the code, database and evidence it actually exercises. This change loads the outer dispatcher from reviewed Git bytes through a literal isolated-Python bootstrap, verifies every implementation before execution, and holds source/executable/fixture/workspace identities across each phase. Native container startup checks the actual mounted directory/database identity before exec; env/config and consumer state use held descriptors; cleanup uses captured container IDs independently of pathname failures. Reports are emitted through held descriptors with terminal identity/content checks.

The separate physical adapter copies the producer's accepted real3.8 backup and runs published native3.9.2's explicit12→13 upgrade. It preserves every original business row/schema object, permits only exact tagged DDL and narrowly validated version/journal metadata, then exercises installed CLI2.8 original keyed updates across open/completed/continued runs. Original NULL-key signals remain history compatibility only. The synthetic transform and physical upgrade retain separate authority; source/handoff and actual historical seed execution are recorded separately. No product/workflow/release or capability activation changes.

Validation:

• 47 offline controls pass, including pre-open outer/implementation substitution, immutable inputs, workspace/DB/report/consumer-state swaps, schema-only mutation, exact-ID cleanup, transformed SQLite read and exact physical metadata exceptions.
• Five actual-container boundary controls pass on lab4: canonical mount-to-native exec, pre-exec parent/DB substitution refusals and actual held Docker env/config consumption/cleanup. Each container is removed by captured ID.
• Source/runner boundary review: Security exactfcf PASS,47 offline controls and the prior five actual-container boundary controls cover the current guards.
• Fresh exactfcf six-phase literal-bootstrap cohort completed1,274 assertions at19:37:59–19:38:33UTC; captured terminal output equals retained reports, cross-restart workspace identities match, all8 exact created IDs/volumes/env files are removed and original physical inputs are unchanged. All current exact-head normal checks are green. Independent installed-evidence countercheck and merge/main remain pending. Earlier151/237/d2/857 HOLD/NONPASS observations remain separate.

CLI owns exact source review, the fresh six-phase literal-bootstrap cohort on published CLI2.8/native3.9.2/SQLite/linux-amd64, independent installed-evidence review, normal merge/main verification and branch cleanup. Shared#216 retains other SDK/backend/organization gates. No3.10, Cloud, Worker, toolchain or whole-organization acceptance is inferred.

[rmcdaniel]

Security source review HOLD for exact 0406dbb6118b283cbf7f023d2cceab177cbca818.

The database comparison itself is narrowly structured, and I independently reproduced all 10 offline comparison controls. The exact tagged DDL, empty intent table, business/catalog preservation, bounded journal exceptions, captured-ID cleanup, accepted-contract versus historical-seed attribution, and NULL-key compatibility-only scope are coherent.

One provenance gap remains in physical_cli.py: the physical entrypoint calls entry = d.held(Path(__file__).absolute(), None, …) only inside if __name__ == "__main__", after Python has already loaded and executed the file through all definitions and load_legacy(). A path replacement between interpreter load and that capture can make driver_sha256 name the replacement pathname bytes while the already-loaded original bytes perform the physical run. The common entrypoint-replacement control begins with an already-created HeldInput; it proves post-capture replacement refusal, not this pre-capture/load mismatch.

Please bind the physical effectful implementation before it is executed—for example, through a small reviewed bootstrap which holds literal expected implementation bytes and executes only those held bytes—and add a predecessor-failing control which loads one physical implementation, replaces the path before the current capture point, and proves the candidate cannot relabel the executed source. The terminal held/path rechecks should remain.

No physical execution or installed result should begin from 0406 under this HOLD. This finding does not disturb the separately corrected CLI #151 installed verdict.

[rmcdaniel]

The pre-capture source HOLD is addressed in successor 0c4a012 with a minimal physical_cli.py loader and separately pinned effectful physical_impl.py.

The loader verifies the literal implementation SHA256 808cff32ead554ecefc931ead0797097312fec3a5155e49bfdeeffc218016f96, owner/type/mode/single-link identity and held bytes before executing any implementation code. The implementation reports that captured digest and includes it in post-cleanup rechecks. Direct implementation execution refuses before common/effectful initialization. The inherited common source files, database comparison and physical case semantics remain unchanged.

13 offline controls PASS: the previous ten upgrade comparisons plus a predecessor-failing pre-capture path swap, successful literal-bound implementation execution, and direct-entry refusal. The old loaded-code/path-replacement control demonstrates false relabeling; the corrected loader refuses before the implementation effect. AST, whitespace, public-boundary and credential/private-path checks pass.

Exact successor review/current CI and actual physical execution remain gates. No physical run has started. The related common direct-entrypoint threat scope has been referred to Security explicitly; no earlier #151 authority is silently relabeled or carried forward.

[rmcdaniel]

Security source PASS for CLI #152 exact successor 0c4a012c12cf2bd29660294bfccd66618691befd / tree 39f09c1a7253ed9fdb04c1024c71a0a68b8c26ae. The 0406 HOLD is cleared for this physical adapter source.

The small bootstrap now verifies/holds physical_impl.py at literal SHA256 808cff32ead554ecefc931ead0797097312fec3a5155e49bfdeeffc218016f96 before any implementation import/effect, executes only the captured bytes, supplies the held implementation/boundary descriptors to the implementation, and rechecks both after return/cleanup. Direct execution of the implementation refuses before effectful initialization.

I independently reproduced all 13 controls, including the predecessor pre-capture pathname relabel/effect, candidate refusal before the marker effect, direct-implementation refusal, literal held-byte execution, and the 10 schema/business/journal comparison cases. The accepted-contract/historical-seed distinction, fixed original input hashes, captured-ID cleanup, NULL-key compatibility-only semantics and request-window scope remain unchanged.

No physical installed result is inferred. Fresh exact-head gates and a fresh actual physical run/cleanup receipt remain required.

[rmcdaniel]

Bounded producer review of CLI 0c4a012c12cf2bd29660294bfccd66618691befd: the exact frozen backup/packet, tagged intent DDL/checksum, all-row comparison, keyed-update readbacks and NULL-key signal compatibility scope match accepted Server #1210. The accepted contract a09f1563 remains distinct from actual seed 09a4ccda and driver SHA 01c0fa12.

One comparison correction is required before I can pass this producer boundary: physical_impl.py:81 permits any migration execution_time from 0 through 120,000,000,000. The actual tagged 3.9.2 upgrader writes literal 0, in rust/src/runtime/schema.rs:297. This is consolidated migration metadata, not elapsed CLI time. Its exact validation should require ["integer", 0]; the current positive test retains value 1 and therefore demonstrates this gap. Add a small nonzero refusal control and keep the timestamp bounded to the actual upgrade window. The original producer packet also required zero.

No physical execution or consumer PASS is inherited from this source review. Security retains the independent loader/source verdict and the current normal gates remain required.

[rmcdaniel]

Qualification status correction: Security identified that the direct common modern entrypoint shared the pre-capture source-label gap. The earlier #151 installed PASS is now preserved as a coherent observation with source-provenance HOLD, as recorded by Security. Main tree/CI and cleanup facts remain unchanged; those observations do not qualify the corrected runner automatically.

The common correction is included in #152 successor 23768fa: one small reviewed loader selects only literal-hash modern, legacy or physical implementations, holds their checked bytes before executing any implementation code, and retains terminal path/descriptor rechecks. Direct implementation entrypoints refuse before initialization. Legacy's literal-base loading remains intact; its direct entrypoint now goes through the same loader too.

The producer comparison finding is also fixed: upgraded SQLx execution_time must be typed integer zero, matching tagged Server 3.9.2; nonzero 1 is explicitly refused. The 14 common boundary controls and 16 loader/physical comparison controls pass (30 total), with public-boundary/AST/whitespace/credential checks. Exact successor review/current CI and fresh modern/restart/fresh-selected/typed/legacy and actual physical runs remain required. No physical run has started; earlier results are not relabeled as those runs.

[rmcdaniel]

Bounded producer contract/comparison PASS at exact CLI 23768faf57d8c4a19f303332309af71b52c35e80. The successor now requires ["integer", 0] for consolidated journal execution time, matching tagged Server 3.9.2 schema.rs:297; its happy fixture writes zero and a new nonzero-one control refuses. This closes my earlier finding.

I independently compared the physical comparison/case successor against 0c4a012c: apart from the zero correction and entrypoint/held-source identity integration, the frozen backup/packet/contract/DDL constants, full row/schema projection, bounded installed timestamp, keyed-update three-state readbacks and original NULL-key signal compatibility scope are retained. The tagged DDL SHA fc3ad173 and consolidated SQLx checksum 53b75252 match the accepted producer.

This verdict covers producer semantics and comparison only. Security owns the common loader/source boundary review and current checks. No installed CLI physical execution or full shared #216 acceptance is inferred.

[rmcdaniel]

Security exact-source review: PASS for CLI #152 successor 23768faf57d8c4a19f303332309af71b52c35e80 / tree a320d0654902f80c63a4fca0907c2ab47f45f4d5. This supersedes the narrower 0c4a012 source verdict and closes the common direct-entrypoint provenance HOLD in source.

Independent checks:

• run_cli_216.py has a closed modern|legacy|physical selector and literal hashes for all three implementations. The committed bytes rehash exactly to modern e2656512…, legacy 0f0ceb09…, physical 81ff88b1…; the boundary module rehashes to literal d377e919….
• The bootstrap owner/type/mode/single-link checks and literal-verifies the boundary, compares the held boundary inode with the originally opened descriptor, then owner/type/mode/single-link/literal-verifies and seals the selected implementation before compiling any of its bytes. Both held implementation and boundary are rechecked after return.
• Direct modern and legacy entrypoints refuse before their boundary/input/runtime initialization. Direct physical execution reaches only imports/constants/function definitions before refusing and cannot enter its effectful __main__ body without the two held bootstrap authorities.
• Legacy's nested common driver and physical's nested legacy/common driver remain literal-hash loaded from already-open descriptors and compare the later held path identity to the originally observed inode. Terminal implementation/input rechecks and captured-ID-only cleanup remain present.
• The producer correction is exact: consolidated _sqlx_migrations.execution_time must be typed integer 0; the happy fixture uses zero and a nonzero-one mutation refuses. The tagged DDL/checksum, full schema/row comparison, timestamp window, keyed update states, and NULL-key compatibility-only scope are otherwise unchanged.

I independently ran the exact successor's 14 common boundary/ownership/snapshot controls and 16 loader/physical comparison controls using helper SHA 6fc6054c… and tagged DDL SHA fc3ad173…; all 30 pass. This includes the predecessor pre-capture relabel/effect, candidate refusal before the effect, all direct-entry refusals, unknown selector refusal, literal held-byte execution, exact-zero/nonzero journal cases, executable/module/inode/symlink/hardlink substitution, foreign-name survival, captured-ID cleanup, and schema-only mutation refusal. git diff --check is clean and fresh Sonar/public-boundary/CodeQL checks are green; the Rust unit/parity lane is still running.

This is source authority only. It does not relabel or restore the downgraded #151 installed observations. Fresh corrected modern, restart, fresh-selected, typed, legacy, and actual physical-upgrade executions with exact cleanup remain required, as do terminal current checks. No product/release/toolchain activation or blanket #216 PASS is inferred.

[rmcdaniel]

CLI owns one fresh literal-loader qualification at exact 23768faf57d8c4a19f303332309af71b52c35e80 following Security common+physical source PASS and Server exact comparison PASS. All 30 offline controls passed. Earlier #151 observations/source-provenance HOLD are not inherited.

Run sequentially on the actual lab4 native amd64 engine: corrected modern/restart/fresh-selected/typed phases; a separate synthetic legacy directory; and a separate first actual physical 3.8→3.9.2 copied-seed upgrade plus installed CLI readback. Published CLI 2.8 binary/source and qualified Server 3.9.2 index/platform/source tuple remain the same immutable artifacts. Physical input source is accepted contract a09f and actual original seed execution 09a4, with held backup 7d18 / packet 8c72; originals are preserved.

Every implementation executes only its literal-held bytes through run_cli_216.py. One Docker process at a time, 1 CPU / 1 GiB / 256 PIDs, --init/read-only, loopback-only (upgrade has no network), synthetic data, no build/production credentials/vault. Fresh capacity/Docker facts checked. Parent timeout and cleanup use captured created IDs. Exact current CI, runtime outcomes/nonpasses and final cleanup still gate delivery; no physical PASS is asserted in this claim.

[rmcdaniel]

Qualification HOLD, superseded source boundary: Security found mutable workspace/database/report identities. The 1,274 checks below are preserved positive observations, not a qualifying result. Cleanup and original hashes reconcile; no prior #151 PASS is inherited. CLI owns a held-descriptor correction, predecessor-failing swap controls, source review and a fresh complete cohort before merge.

Fresh literal-loader installed cohort: 1,274 positive observations; qualification HOLD, exact source 23768faf57d8c4a19f303332309af71b52c35e80. Security source PASS / 30 controls and producer comparison PASS precede execution. All current exact-head normal CI checks are terminal with no failure. These are new executions; earlier #151 observations/source-provenance HOLDs remain separate.

Published artifacts:

• CLI 2.8.0, source f16883ccff4cd39cf3f2ff41c9a67dfd36869b9e, binary SHA256 da366c79c90978a3c0a92d723c66a96a2d0963f9dccbd41c8207f2c41848f814.
• Native Server 3.9.2, source 5614274d2629d03f92932a07dfee0fb10349ddd9, index sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9, linux/amd64 child sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128. Raw OCI tuple binding and observed image/runtime source/platform/version/protocol checks remain exact.
• Accepted proxy 117118c8, file SHA256 bd1e8ccbbf76f63fc2eafa278a023eb181d405b68d9c30016392e395a1eff725; accepted snapshot/transform helper SHA256 6fc6054ce087c136a86d7b6b222daeefaa87c58fa0b613b155a5df39e6a26fad. Official SDK 2.17.1 codec fixture SHA256 68dac0826e251d0450d458224fa3d4d8714aba8e432df7e241909b8c4b877767 supplies known Avro values only; no external codec program executes or SDK Worker qualification is inferred.

Actual lab4, native linux/amd64, 2026-11-13 UTC:

Phase	Time	Assertions
Modern/generated/explicit/Unicode/concurrent/namespace/terminal	18:26:31.233–18:26:38.819	277 PASS
Actual process restart and explicit-selected terminal recovery	18:26:38.980–18:26:44.457	148 PASS
Fresh explicit-selected-run literal markers	18:26:44.609–18:26:46.354	27 PASS
Typed intent loss/retry/conflict	18:26:46.487–18:26:55.066	226 PASS
Separate synthetic legacy copy/readback	18:26:55.210–18:27:02.925	450 PASS
Actual copied 3.8 physical upgrade and installed CLI readback	18:27:03.060–18:27:05.505	146 PASS

The loader held each literal implementation before executing any implementation code. Captured SHA256 values agree with the reviewed closed table: modern e26565125bb122e6d84cd6a6e230c7d47a56ca043eda7bffa7025b9c19fdbbbe, legacy 0f0ceb09676d38109bbd57ed9c4d22e0c448a78c65999fe82a5feb3b3ce1062b, physical 81ff88b11a7c402d2206c2856b08080eb149528b31cd0f616ccd676e459fcd3f; loader SHA256 8d8b4b8fbb94cd10cbdaf5dddb9a41fe0a93f4ac7523fe2a6f381a10c1609a77. All held file/descriptor/source identities are unchanged after cleanup.

Modern/typed cells establish 24 complete upstream 202 response losses with one original POST, zero implicit resend, explicit same-byte recovery and original identities. Four concurrent retries admit one command. Unicode 255-code-point two-/four-byte keys, fresh and retained markers, case/namespace fences, actual process restart and ordinary/selected closed/continued runs pass. Typed cases cover int64, null, Unicode byte distinction, reordered nested maps, integer versus float and positive versus negative zero. Equal retries retain original events; different intent refuses without writes. Complete typed schema/catalog/table-row comparisons guard every zero-write assertion. Transport records contain metadata/counts/hashes only.

The synthetic cell uses manifest da1990000c611d7377690c7526487d6415fa4f9cb42d299f59585a7c2eebf769. Exactly twelve accepted transformations affect a stopped disposable copy of real current-producer admissions; all other schema/rows are preserved. Both command kinds support concurrent changed-input unverified retained reads in open/completed/continued states, original-run reads and name/target fences. All six ambiguity shapes fail closed, and SQLite's case-different key admits a distinct new command. Fourteen full logical request-window comparisons are identical. Transform fingerprints: 1245b36ff22963ec36785db66bc0f66838f9c79febece3b6b0dab8fee8468738 → 032a6b85df4733a69b8ddde151364ebeef38ffdd55d31902c670a29d50bfeafe.

Physical upgrade authority is separate. Accepted contract/handoff is Server a09f156399416216d2f097c257a2164f83c7eda7, manifest ceb4695643e48c7bfe3f81eea380c6ab9aa0b973da830cb552d070344047319f. Actual original 3.8 seed execution remains 09a4ccda3da11853606af031a8970bbde4b2d6ec, driver 01c0fa1251ac3c809723e58d71817881fe2c5c9498579bc4c2e6097324a3618b. Held original backup 7d1826f7681342bb3a5974509648e2e8d75e7a21d262f65f3ec1f58727ccbc0c and packet 8c728ce827df3a11621dfb0e82cdd404bbab48784182a5e92c8d632d49047fc5 are rehashed unchanged after use.

The exact published image ran its real schema-upgrade on a newly created copy and exited zero without OOM, reporting SQLite 12 → 13. Every old business row/schema object is preserved through upgrade. Only tagged intent-table/index DDL and the explicitly validated schema-version/consolidated SQLx journal metadata change; the journal requires the exact tagged checksum/description/version/success, bounded timestamp and integer-zero execution time, with an empty intent table. Original and post-upgrade logical fingerprints are 1ea2d24dd439b27e6716f746933121cd30c5acd7079dc32b6c2963e630b722a3 / acf89eb8809b673b1a2b8fd20934a97c7dee42a3c9e693db6a01c4175468553c.

Installed CLI calls then recover each original keyed update with four concurrent changed-input retries, explicit original-run read and correct name/target fences across open/completed/continued states; old completed updates remain completed-null. Original 3.8 NULL-key signals retain exact histories/identities as compatibility controls only. The whole physical request window is unchanged, before/after SHA256 acf89eb8809b673b1a2b8fd20934a97c7dee42a3c9e693db6a01c4175468553c. No synthetic transform or manufactured signal key substitutes for this upgrade.

All eight exact created container IDs, anonymous volumes and runtime-env files are gone on the actual lab4 Docker engine. Fresh parent absence checks and original-input rehashes pass. At most one 1-CPU/1-GiB/256-PID Docker process ran at a time, with --init/read-only and loopback-only runtime ports; the upgrade had no network. No build, production credentials/provider resource or vault read. Generated synthetic diagnostics retain at most seven days. Earlier preflight/parser/cleanup/source HOLDs remain in history, without PASS inheritance.

Independent installed-evidence countercheck, normal merge/main equality/branch cleanup/readback remain the delivery steps. This receipt is scoped to installed CLI 2.8 / native 3.9.2 / SQLite / linux-amd64. It does not qualify another SDK/backend, Cloud adoption or close shared #216 for the organization.

[rmcdaniel]

Security exact-head review: HOLD for 23768faf57d8c4a19f303332309af71b52c35e80 and its installed receipt.

The literal implementation loader, immutable input capture, complete schema/row comparison, exact created-container-ID cleanup, and physical comparator are coherent. I independently reconciled the retained packet: all six cells report PASS / 1,274 checks, the physical cell reports 146 checks with driver 81ff88b1…, baseline 7d1826f7…, packet 8c728ce8…, contract ceb46956…, before 1ea2d24…, after/request-window acf89eb8…, and all eight exact created IDs are absent on the actual lab4 engine. The original baseline and packet still hash to their recorded values.

The qualification blocker is the writable workspace authority:

• private_directory() validates each work directory once and returns only a Path; it does not retain a directory descriptor/identity for later rechecks.
• DB = ROOT / "data/database.sqlite" is created with O_EXCL|O_NOFOLLOW, but the created file identity is not captured. full_snapshot() repeatedly reopens it by pathname.
• Both the schema-upgrade container and the installed runtime bind ROOT/data by pathname. No held parent/database identity is checked immediately around create/inspect/use, and the physical runner does not prove that the file compared before upgrade, the file upgraded by the container, and the file exercised by the installed CLI are the same object.
• physical-result.json is likewise emitted with Path.write_text() into that unheld workspace, so the retained report path has no captured file/parent identity either.

A same-UID rename/replacement of data or database.sqlite after an earlier snapshot can therefore substitute the database presented to the upgrade container or the later installed readback while all immutable source/seed checks still pass. A replacement after comparison can also decouple the retained report from the object actually reviewed. The current offline controls cover source/executable swaps and logical schema mutations, but not these workspace swaps.

Please capture and recheck no-follow owner/mode/link identities for the private root/data directory and created database across copy, every snapshot, container creation/inspect, restart/readback, and cleanup; bind the emitted report through an owned no-follow descriptor/identity; and add predecessor-failing controls for parent/database replacement between copy→upgrade, compare→runtime start, and result emission. Then repeat the installed cohort from the corrected exact source.

The present execution remains useful positive observation and its cleanup is accepted, but it is not a qualifying #152/physical acceptance receipt and does not inherit prior #151 authority.

[rmcdaniel]

Corrected workspace source is frozen at a38f93d for independent review. This supersedes 23768faf's workspace HOLD; the old 1,274 checks remain observations, with no inherited #151 qualification. The PR is draft again.

• Owned no-follow root/data descriptors retain device/inode/mode/UID/GID/link identities. The first phase creates and holds the single-link mode-0600 DB; later phases hold that existing inode. SQLite opens through the held directory and verifies the opened main file, retaining WAL/SHM semantics.
• Both Docker mounts use held local /proc/<pid>/fd sources, one for the data directory and one for the actual DB file. Inspect must show the exact two read/write bind sources. Root/data/DB checks immediately surround snapshots, create/inspect, API/CLI calls, cleanup and emission. Cleanup by captured container ID remains possible after a workspace failure.
• Physical copy and upgrade preserve one held runtime DB inode. The synthetic transform now operates on a stopped sibling copy, checks complete accepted-helper fingerprints, then writes the transformed bytes through the held DB descriptor before restart. No rename replaces the DB later exercised by Docker.
• Environment and evidence files use held no-follow descriptors; output bytes and parent/file identities are rechecked after writing. Reports include held workspace identities for the parent's cross-process comparison. A failed emission check cannot print a terminal PASS.

41 offline controls PASS: 25 common controls, including predecessor pathname-positive/root-data-DB replacement refusals at copy→upgrade and compare→runtime, report path/parent swaps during emission, in-place report tampering, symlink/hardlink rejection, exact two descriptor mounts, positive mutable WAL use and exact-ID cleanup after workspace failure; plus unchanged 16 literal-loader/physical-comparison controls. No Docker or installed cohort has run from this successor. Secret/private-path scan and diff checks pass. Current normal CI, exact Security source review, fresh complete installed phases, independent installed-evidence review, merge/main and branch cleanup remain gates.

Source hashes:

File	SHA256
boundaries.py	8e1374d497741cf1668c43bd884af69f72282448bc7151d00f6ff4718c4546b8
cli_216.py	cd8638f7594b8fd72ac0e72dd44d38f6be27167430518b4bebd6c5c244c7c0cd
legacy_cli.py	7324676373db9d44c63423fc50cb995a9040a791fa16a26a04690f00d5b0259e
physical_impl.py	f1babc7103039e18e3d88a9d780926e5b73a0447ba17b56173d9dffd06c1c353
run_cli_216.py	575bc347f86fbd1917c1025a5c7b98305517ef66983d7034993ab9dba7af157b

CLI remains the implementation/run owner. The artifact cohort remains published CLI 2.8 / qualified native Server 3.9.2 / SQLite / linux-amd64; later Server 3.10 does not change this frozen correction or imply acceptance on another tuple.

[rmcdaniel]

Security exact-source review: HOLD / no runtime execution for a38f93ddb4488fd3bc8a39a6ab98143716e05658 / tree e1d720093c3c7c1c0882dd10a45a7a7702eb9258.

The new held root/data/database/report implementation is a real improvement: directory/file identities are no-follow and descriptor-bound; SQLite opens through the held directory and checks the main inode; report writes retain an exclusive descriptor and content digest; exact-ID cleanup remains available after a workspace refusal; the synthetic transform preserves the runtime database inode; and the new substitution/WAL/report controls exercise useful predecessor failures.

Three gaps still precede an installed cohort:

1. run_cli_216.py is still the first code Python opens from a host pathname. Its literal table then binds boundary/implementation bytes, but a same-owner pre-open replacement of this outer dispatcher can bypass the whole table. Add a small literal trusted bootstrap (or equivalent held-FD/memfd invocation) that independently binds the exact dispatcher Git blob/hash before compile/exec, plus a predecessor-failing outer-path swap control.
2. Modern and legacy runtime creation write runtime.env through the held workspace but pass the ordinary canonical pathname to --env-file. The Docker configuration directory is likewise passed as an unheld pathname; HOME/config/tmp children are not individually held. A rename/substitution between WORKSPACE.recheck() and Docker/CLI opening those paths can change runtime or client authority while the database-mount checks still pass. Pass the held env descriptor, bind the Docker config/consumer state directories, and keep cleanup independent of those mutable paths.
3. Workspace.mount_arguments() supplies /proc/<controller-pid>/fd/<directory> and <file> directly as Docker bind sources, and inspect_mounts() requires those literal sources. This exact directory-FD bind shape was rejected by the same lab4 Docker/runc boundary in the Python321 ae35 attempt. The current controls use a fake Docker model, so they do not prove the proposed CLI mount is runnable or that Docker inspect preserves those source strings. Use the now-proved pattern: canonical host bind acquisition plus a literal in-container preflight that verifies the mounted directory/file device, inode, uid/gid, mode and link count before native execution. Retain host before/after guards and full-ID cleanup.

The earlier 23768fa 1,274-check cohort remains observation-only and cannot qualify this successor. Please send one frozen exact successor with actual-container mount/env/config substitution controls before any modern/legacy/physical execution.

[rmcdaniel]

Corrected exact source d2bdd0a is frozen for independent review after a38 source HOLD. No modern/legacy/physical cohort has executed from this successor.

1. Outer source authority: git_bootstrap.py is a literal command-line -c template, obtained from the reviewed frozen Git object and independently hashed before execution. It loads only the same commit's dispatcher Git blob, verifies fixed SHA256 5762dd388597e1a5fcb7e088a6abb54aee8ad6976a240aebd88be1f615314150, then compile/execs captured bytes. Direct pathname execution of the bootstrap/dispatcher refuses. The predecessor-failing isolated-Git control replaces the outer dispatcher with a self-certifying marker: direct execution runs it; the frozen Git bootstrap ignores it, executes the fixed Git bytes and refuses before workspace/Docker creation. Reports bind dispatcher SHA and source commit, separately from implementation hashes.
2. Runtime/consumer state: env-file and Docker client config use inherited held descriptors. HOME/config/tmp/bin directories are each no-follow held, inherited by actual consumers and checked around use. Cleanup uses the held Docker config and captured container ID even after pathname refusal; credential removal uses the held parent/file and preserves substituted foreign entries.
3. Native mount acquisition: replaced unproved direct Docker FD binds with a guarded canonical data bind and a literal in-container preflight, adapted from SDK Python 377a3eee. The actual mounted data directory and DB must match held dev/inode/UID/GID/mode/link identities before native exec. Host checks remain immediately around acquisition/inspect/snapshots/readback/emission. Complete DB/report guards from a38 remain.

45 offline controls PASS (27 common +18 bootstrap/physical comparison). All five actual-container boundary controls PASS on actual lab4 native amd64 Docker: canonical mount reaches the exact native executable; directory and DB substitution exit 78 without native work; the actual Docker env reader consumes held original bytes after pathname substitution; the actual Docker config reader and exact-ID cleanup work after config-directory substitution. All five captured IDs/volumes are removed. No network/ports/build, 1 CPU/512 MiB/128 PIDs per sequential container, --init/read-only and disk-backed synthetic state; no production credentials or vault reads.

The positive mount control deliberately uses native schema-check with SQLite, expecting its exact unsupported-command diagnostic. That proves preflight-to-native exec without starting a runtime or performing the held physical qualification. Initial controls incorrectly expected SQLite schema-bootstrap success (first missing DB_CONNECTION, then unsupported backend); both attempts remain runner NONPASS, all their created IDs removed. The corrected five-control run is retained separately; no product failure or installed result is inferred.

Source hashes:

File	SHA256
boundaries.py	5de532a128931b56bd7ca2232d60e07a2fa65d550cfbf56d9cd78d16ed3a5095
cli_216.py	f8a51ec2119cd24acf6b861b0a3c09e5ab7f651539136db506d6d8ef4b8e448b
legacy_cli.py	c2d19bd944bfb1cca7d370de923be2ccbd788f51b7ed4131622de691d58a08eb
physical_impl.py	446676dbfb755cc2f3aebeffdcf56977d3d064e2796bf4f86379bda0cf341ddc
run_cli_216.py	5762dd388597e1a5fcb7e088a6abb54aee8ad6976a240aebd88be1f615314150
literal Git bootstrap (including final newline)	368d78748c12bb51b60a01336702f942a9fe11f9dff918edacdb710a8950ed44

No source/fixture overlay is accepted in place of these fixed bytes. CLI owns the exact source review follow-through, fresh literal-bootstrap modern/restart/fresh/typed/synthetic/physical cohort, independent evidence review and normal merge/main. Current normal CI is running. Earlier #151 and 23768/1,274 observations remain HOLD; native 3.10 does not alter the frozen CLI2.8/native3.9.2/SQLite/amd64 correction.

[rmcdaniel]

Security exact-source/boundary review: PASS for CLI #152 at d2bdd0a0789abfd8c83e580e4c76085d71204137 / tree 08094986f87ab0be96e51aed25a4e81121fd1e01, before any installed cohort.

The three prior HOLD findings are closed:

• the literal -c bootstrap hashes to 368d7874…, uses git --no-replace-objects, and binds dispatcher bytes 5762dd38… before compile/exec; direct bootstrap/dispatcher pathname execution refuses, and the predecessor path-substitution control cannot replace the reviewed Git bytes;
• the runtime env, empty Docker config, HOME/config/tmp/bin directories and report/database objects are held no-follow identities. Actual consumers inherit the relevant descriptors, while exact-ID cleanup and credential unlink remain independent of substituted workspace/config paths;
• Docker now receives the guarded canonical data bind, then the pinned image's literal preflight requires exact mounted directory/file dev/inode/UID/GID/mode/link identities before executing the native binary. Host acquisition/snapshot/report checks remain around that boundary.

The fixed source hashes for boundary, modern, legacy, physical, dispatcher and bootstrap all match the review packet. The 45 offline controls cover the path/identity/report counterfactuals. I also inspected the retained five actual-container controls and independently confirmed their five captured IDs are absent on the actual lab4 engine: the positive canonical mount reaches the intended native diagnostic; directory and DB substitutions exit 78 before native work; held env bytes survive pathname substitution; and held Docker config plus exact-ID cleanup survive config-path substitution. The two earlier unsupported SQLite bootstrap attempts remain NONPASS and are not inherited.

This is source and runner-boundary approval only. The old 23768faf / 1,274-check observation remains HOLD. Fresh literal-bootstrap modern/restart/fresh-selected/typed/synthetic/physical execution, exact retained evidence, terminal current-head CI, normal merge and accepted-main equality remain required. No native 3.10, publication, or blanket #216 claim is implied.

[rmcdaniel]

CLI owns one new complete installed cohort at exact d2bdd0a0789abfd8c83e580e4c76085d71204137 after Security source/runner-boundary PASS. This invokes the reviewed literal Git bootstrap (368d7874…) via isolated Python -c, fixed dispatcher 5762dd38…, then the held exact implementations. All45 offline +5 actual-container boundary controls pass. Old #151 and237/1,274 observations remain HOLD and are not inherited.

Fresh private modern/restart/fresh-selected/typed, separate synthetic legacy, and separate real copied3.8→3.9.2 physical/readback phases run sequentially on actual lab4, published CLI2.8 binary/source and qualified native3.9.2 index/platform/source. The accepted physical contract a09f and actual original seed09a remain separate, with original backup7d18/packet8c72 preserved. Root/data/DB/report/consumer/env/config identities and actual native mount preflight are required throughout; parent checks workspace identities across modern process restarts. Current capacity/Docker facts checked; one process at a time1CPU/1GiB/256PIDs, --init/read-only, runtime loopback-only and upgrade networknone, no build/credentials/vault. Exact created-ID/volume cleanup and seven-day synthetic diagnostic retention remain owned by CLI.

This is a claim, not a PASS. Fresh results/nonpasses, independent installed review, exact current CI, normal merge/main/tree equality and remote-branch absence still gate delivery.

[rmcdaniel]

Fresh exact d2bdd0a cohort is runner-blocked, not a complete qualification. Four modern phases completed with277/148/27/226 assertions (678 total); held root/data/DB identities matched the parent across process restarts and every created ID/env was removed. The synthetic phase admitted its real seed and completed the accepted12-row transform, then failed before readback with OperationalError: unable to open database file while opening the sealed memory-file path as SQLite. Its88 checks are observations only; its exact created ID/volumes/env are gone. The parent stopped dependent execution, so physical did not start. No product failure or inherited PASS is claimed.

The narrow successor 8579c73 fixes only that stopped transformed-copy verification. It opens the owned immutable disk sibling through the already-held data directory, checks SQLite's actual main-file identity against the full held input identity, takes the accepted complete logical snapshot, and rechecks the held input afterward. Captured bytes then populate the same held runtime DB inode, with the existing helper-result/full-snapshot equality checks. Root/data/DB/report/env/config guards, native preflight, modern implementation and producer comparator are unchanged. Literal legacy/physical/dispatcher/bootstrap hashes are updated normally; no suppression or fallback.

46 offline controls PASS (28 common +18 bootstrap/comparison), including a new predecessor-failing reproduction: sealed-memfd SQLite read fails; held disk read opens the exact inode and returns expected rows; a same-byte disk replacement refuses. The prior five actual-container mount/env/config boundary controls remain source-identical and are not rerun for this read-only disk-path correction. Secret/private-path and diff checks pass.

CLI owns exact successor source counter-review and then a fresh complete six-phase literal-bootstrap cohort, independent final evidence review and normal CI/merge/main. Original physical backup/packet remain unchanged; no physical execution from this or d2 is asserted. All prior237/1,274 and151 HOLD observations stay separate. The frozen artifact tuple remains published CLI2.8/native3.9.2/SQLite/amd64.

[rmcdaniel]

Security review of exact successor 8579c734e5c1b75b687e6d153d57043fd3abfcf1: HOLD.

The narrow memfd diagnosis is valid and the 28 focused boundary controls pass with the accepted helper. However, the replacement still does not prove which inode SQLite opened:

db = sqlite3.connect(named_path, ...)
opened = db.execute("PRAGMA database_list").fetchone()[2]
os.stat(opened)

PRAGMA database_list returns a pathname. The subsequent os.stat(opened) resolves that name after SQLite has already opened the database; it is not an identity query on SQLite's open file. I reproduced a swap-away/open-replacement/swap-back sequence against this pattern: the post-open stat matched the held original inode while the live SQLite connection returned the replacement's row.

Use the already-held original disk descriptor (copied_input.fd, not the sealed memfd) as the SQLite URI through /proc/self/fd/<fd>, or otherwise bind the actual SQLite-opened inode without a pathname re-open. A normal disk-backed held descriptor works with SQLite's read-only immutable open and remains on the captured inode across a name replacement. Retain the existing before/after descriptor/content checks and full logical fingerprint comparison.

Add a predecessor-failing control that replaces the name for SQLite open and restores the held name before the post-open check. The successor must read the held original or refuse; a matching post-open pathname stat is insufficient.

The failed d2bdd0a cohort remains NONPASS. No physical execution occurred, and no result from that cohort or 8579c73 is qualifying.

[rmcdaniel]

Exact successor fcfcdce is frozen after Security's857 swap/open/swap-back reproduction. No857 or fcf installed cohort has run.

Both common runtime snapshots and the immutable transformed-copy snapshot now open held real disk-file descriptors via /proc/<pid>/fd/<fd> / /proc/self/fd/<fd>. Neither path uses the sealed executable memfd or a mutable filename followed by PRAGMA database_list/stat as inode authority. Existing descriptor/path/content/fingerprint guards remain before and after use. The common snapshot also had the pathname-open interval, so it receives the same correction; the positive WAL/SHM reader/writer control passes with its real DB descriptor. Native canonical-bind preflight, env/config/consumer guards, exact-ID cleanup and producer comparison remain unchanged.

47 offline controls PASS (29 common +18 bootstrap/comparison). The new exact race control swaps the main DB away, opens a replacement, swaps the original back, and proves the predecessor's post-open name/stat checks pass while it reads99. The corrected held-FD connection reads original1 under the same interval. The transformed-copy control separately reproduces sealed-memfd failure and proves real-disk-FD read, held bytes and replacement refusal. All five prior actual-container boundary controls exercise unchanged mount/env/config/preflight behavior; their source and removal receipts remain available.

Updated SHA256s:

File	SHA256
boundaries.py	49f44b870296b27955f116295f4e177a1fd285cc976809c13e5f57dc3cb1ebbf
cli_216.py	507ff78a1a25bca43f4b5ce84abd395d59d24641bbac6db8c6ee86a665113417
legacy_cli.py	cc4018a807ff01e557676fa7ff4cb73f30872b004d04b42338fe96f65e18aec2
physical_impl.py	640a3a8b9e3c802e965971ca1e8980200493513a81249a9265817b9a9bce3ba4
dispatcher	b19a7a7be644f708f9855cbc5e9cc07e8bd67c60d17996ab69948f15d6db28ae
literal Git bootstrap, final newline included	4b34ceb7b8c1366bc46405310bc4779df6a3ee63eb274af41868265028a5bc12

CLI owns exact successor review then the full fresh literal-bootstrap installed cohort and independent result/cleanup review. No physical execution is inferred; the d2 run remains runner NONPASS and earlier observations stay HOLD. Current normal CI, merge/main and remote-branch cleanup remain gates. Secret/private-path and diff checks pass; no product/workflow/release/profile change.

[sonarqubecloud]

Quality Gate passed

Issues
8 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-source counter-review: PASS for fcfcdce7bac92f5aa71a3c01cb32587a796c6b1a / tree dfcfad2adb150676dae69205a4e9d564826e8770.

I independently reviewed the complete 8579c73..fcfcdce delta and reran the committed controls against the exact accepted helper and tagged SQLite migration inputs:

• 29 boundary/ownership/snapshot/workspace controls pass.
• 18 physical-comparator and literal-bootstrap controls pass.
• All literal dependency/dispatcher hashes recompute to their committed values.

The correction closes the held-database finding. Both Workspace.connection() and the transformed immutable read now ask SQLite to open the already-held real disk file descriptor. The regression demonstrates the prior weakness concretely: a swap-away/open-substitute/swap-back causes the pathname+post-open-stat predecessor to read the replacement row while its named identity appears restored, whereas the candidate reads the original held inode. The separate writable test uses a second SQLite connection through that descriptor and observes the committed row under WAL mode, so ordinary disk-backed WAL/SHM behavior is covered.

The canonical Docker mount and literal native device/inode/owner/mode/link preflight, ID-only cleanup, report guards, comparison semantics, and accepted external input identities are unchanged except for mechanically updated source hashes.

Scope: this is a source verdict only. The d2bdd0a cohort and all 8579c73 observations remain NONPASS / nonqualifying; the physical cell in that cohort never started. A fresh complete cohort from this exact literal-bound head, exact cleanup/readback, terminal current CI, and separate installed-result review remain required before merge or any #216 qualification claim.

[rmcdaniel]

CLI owns one fresh complete six-phase installed cohort on exact fcfcdce7bac92f5aa71a3c01cb32587a796c6b1a, after Security's exact source PASS and all47 offline controls. Literal -c Git bootstrap SHA256 4b34ceb7b8c1366bc46405310bc4779df6a3ee63eb274af41868265028a5bc12 binds dispatcher b19a7a7be644f708f9855cbc5e9cc07e8bd67c60d17996ab69948f15d6db28ae, then each held implementation. Parent captures terminal child output in memory and reconciles retained reports and workspace identities; no later report pathname alone supplies authority.

Fresh modern/restart/fresh-selected/typed, synthetic legacy and real copied3.8 physical/readback phases run sequentially. Same frozen published CLI2.8/native3.9.2/SQLite/linux-amd64 tuple, accepted a09f contract versus actual09a original seed, original backup7d18/packet8c72 preserved. Current actual lab4 capacity/Docker facts checked. One1CPU/1GiB/256PID process at a time, --init/read-only, loopback runtime / networknone upgrade, no build/production credentials/vault. Exact-ID/volume/env cleanup and seven-day private diagnostic retention remain CLI-owned.

This is a new claim, not a PASS. d2's678 modern observations plus blocked legacy are not inherited;857 never ran;237/151 HOLDs stay preserved. Full fresh results/nonpasses, independent installed review, terminal normal CI, merge/main/tree and remote-branch cleanup remain gates.

[rmcdaniel]

Fresh exact-source cohort completed with all1,274 assertions passing, source fcfcdce7bac92f5aa71a3c01cb32587a796c6b1a. Exact Security source PASS and47 offline controls precede this run. All current exact-head normal CI checks are terminal with no failure. Independent installed-evidence countercheck and normal merge/main remain delivery gates; this is new evidence, without inheriting any held151/237/d2/857 result.

Published immutable artifacts:

• CLI2.8.0, source f16883ccff4cd39cf3f2ff41c9a67dfd36869b9e, binary SHA256 da366c79c90978a3c0a92d723c66a96a2d0963f9dccbd41c8207f2c41848f814.
• Native Server3.9.2, source 5614274d2629d03f92932a07dfee0fb10349ddd9, index sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9, linux/amd64 child sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128. Previously independently bound raw OCI/source/platform identities remain exact; actual native version/protocol/preflight checks pass. No acceptance on later3.10 is inferred.
• Accepted response-loss fixture117118c8 / SHA256 bd1e8ccbbf76f63fc2eafa278a023eb181d405b68d9c30016392e395a1eff725; accepted snapshot/transform helper4add871b / 6fc6054ce087c136a86d7b6b222daeefaa87c58fa0b613b155a5df39e6a26fad; official-codec data fixture 68dac0826e251d0450d458224fa3d4d8714aba8e432df7e241909b8c4b877767 (no external codec execution or SDK Worker claim).

Actual lab4, native linux-amd64,2026-11-13 UTC:

Phase	Actual interval	Assertions
Modern admission/loss/Unicode/concurrency/terminal/namespace	19:37:59.744–19:38:08.156	277 PASS
Actual process restart / selected terminal runs	19:38:08.322–19:38:14.073	148 PASS
Fresh explicit-selected literal markers	19:38:14.196–19:38:15.798	27 PASS
Typed intent loss/retry/conflict	19:38:15.915–19:38:23.976	226 PASS
Separate synthetic legacy readback	19:38:24.105–19:38:31.154	450 PASS
Real copied3.8 upgrade + installed CLI readback	19:38:31.300–19:38:33.569	146 PASS

The independently fixed literal -c Git bootstrap 4b34ceb7b8c1366bc46405310bc4779df6a3ee63eb274af41868265028a5bc12 obtained and verified dispatcher b19a7a7be644f708f9855cbc5e9cc07e8bd67c60d17996ab69948f15d6db28ae from frozenfcf Git bytes before exec. It loaded the reviewed held implementations: modern 507ff78a…, legacy cc4018a8…, physical 640a3a8b… and boundary 49f44b87…. No mutable outer pathname supplied executable authority.

Each phase retained root/data/DB/source/report/env/config/consumer identities. Common and transformed snapshots opened held real disk-file descriptors, preserving WAL behavior and closing the reproduced swap/open/swap-back interval. Native preflight checked the actual mounted directory/file before exec. The parent captured each terminal child report in memory, reconciled it with retained JSON, and verified root/data/DB identities after exit; all four modern process restarts used the exact same held inode identities. Report and original-source rechecks pass after cleanup.

Modern/typed:24 complete upstream202 responses were dropped before downstream status (8/4/0/12 by phase), one initial admission POST with zero implicit resend, explicit same-byte recovery and stable original identities. Four concurrent retries admit one command.255-code-point two-/four-byte keys, fresh/retained literal markers, case/namespace fences, actual restart, ordinary/selected closed and continued runs pass. Typed int64/null/Unicode/reordered-map/integer-versus-float/signed-zero equal retries preserve original events; different intent refuses without writes. Complete typed schema/catalog/column/index/trigger/view/table-row snapshots guard zero-write windows. Transport evidence remains metadata/counts/hashes only.

Synthetic authority remains separate: accepted manifest da199000…, exactly12 transformations on a stopped copy of real current-producer admissions, all other schema/rows preserved. The accepted transformed bytes populate the same held runtime DB inode; held snapshot reads and helper fingerprints agree. Both command kinds cover concurrent changed-input unverified retained reads across open/completed/continued states, original-run/name/target fences, all6 ambiguity shapes and SQLite case distinction. All14 complete logical request windows are identical. Transform SHA256: 3b10a15617dca7e85878685a58434a536d4a6f5f59d696e69f26d333e2dbbb4c → 03b33d8636383f870c797887858c651d60fc85d8351a63e2f871e9666d13d12c.

Physical authority: accepted producer contract/handoff a09f156399416216d2f097c257a2164f83c7eda7, manifest ceb4695643e48c7bfe3f81eea380c6ab9aa0b973da830cb552d070344047319f; actual original3.8 seed execution remains 09a4ccda3da11853606af031a8970bbde4b2d6ec, seed-driver SHA256 01c0fa1251ac3c809723e58d71817881fe2c5c9498579bc4c2e6097324a3618b. Original backup 7d1826f7681342bb3a5974509648e2e8d75e7a21d262f65f3ec1f58727ccbc0c and packet 8c728ce827df3a11621dfb0e82cdd404bbab48784182a5e92c8d632d49047fc5 remain unchanged.

The exact published image executed real schema-upgrade on a newly created held copy, exit0/noOOM, reporting SQLite12→13. Every original business row/schema object is preserved. Only tagged intent DDL and explicitly validated schema-version/consolidated SQLx journal metadata change, including exact checksum/description/version/success, bounded timestamp and typed integer-zero execution time; the intent table starts empty. Logical before/after: 1ea2d24dd439b27e6716f746933121cd30c5acd7079dc32b6c2963e630b722a3 / 9528e428076bac298a86b8934dbadf7d3ec7843652a76203cc808174183e8da2.

Installed CLI recovers every original keyed update with four concurrent changed-input retries, original-run read and typed name/target fences in all3 states; old completed updates remain completed-null. Original NULL-key signals preserve histories/identities as compatibility controls only. The entire physical request window is unchanged at 9528e428076bac298a86b8934dbadf7d3ec7843652a76203cc808174183e8da2. No synthetic seed/key substitutes for that upgrade.

All eight exact created IDs, their anonymous volumes and runtime-env files are removed on the actual lab4 engine. The parent independently rechecked every ID absent and original backup/packet hashes unchanged. Source tree remains clean atfcf. One1CPU/1GiB/256PID Docker process ran at a time, --init/read-only, runtime loopback only / upgrade networknone. No build/production credentials/vault; private synthetic diagnostics retain at most7days. Earlier sealed-memfd runner NONPASS and all provenance HOLDs remain preserved.

CLI owns independent installed review, normal merge/main/tree/branch verification next. This is scoped to installed CLI2.8/native3.9.2/SQLite/linux-amd64; shared216's other SDK/backend/organization gates and Cloud adoption remain separately owned.

[rmcdaniel]

Security installed-evidence counter-review: PASS for the fresh six-phase cohort on exact source fcfcdce7bac92f5aa71a3c01cb32587a796c6b1a / tree dfcfad2adb150676dae69205a4e9d564826e8770.

I independently inspected the retained packet and current public gates:

• the literal Git bootstrap, dispatcher, three implementations, boundary module, installed CLI, accepted loss fixture/helper/manifest, physical contract and tagged SQLite migration all recompute to their reviewed hashes;
• each of the six terminal stdout JSON objects is byte-semantically equal to its retained result, with pass outcome, null error, exact head, expected phase count (277 + 148 + 27 + 226 + 450 + 146 = 1,274), matching workspace identities and captured created IDs;
• the four modern phases retain the same root/data/database identities across restart and terminal reconciliation;
• all 14 synthetic legacy request windows have identical complete logical before/after fingerprints, while the accepted stopped-copy transform records exactly 12 intended transformations;
• I independently reopened the retained physical database with the accepted helper and recomputed logical fingerprint 9528e428076bac298a86b8934dbadf7d3ec7843652a76203cc808174183e8da2, matching both the reported post-upgrade state and unchanged installed request window;
• I independently reran the exact physical comparator against the original baseline and tagged migration: every original business row/schema object is preserved, and only the reviewed schema-version, tagged intent DDL and bounded journal metadata exceptions are accepted;
• the original baseline/packet still hash to 7d1826f7… / 8c728ce8…; the independent lab4 engine read finds all eight exact created container IDs absent after cleanup;
• every current PR check is terminal green at the same head, including target-branch qualification, and the PR reports a clean merge state.

The installed claims are accepted only for the stated CLI 2.8.0 / native Server 3.9.2 / SQLite / linux-amd64 tuple: modern direct/loss/restart/selection/typed cases, the separately labeled synthetic legacy transform/readback, and the separately labeled real 3.8→3.9.2 physical upgrade/readback. Original NULL-key signals remain compatibility controls only.

Earlier #151/23768fa, d2bdd0a, and 8579c73 observations remain HOLD/NONPASS and contribute no authority to this verdict. This does not establish another SDK/backend, later Server version, Cloud adoption, or whole shared #216 acceptance. Normal merge, exact main-tree verification, main checks, and remote-branch cleanup remain CLI-owned delivery gates.

[rmcdaniel]

Independent fresh installed-evidence Security PASS cleared the final review gate at exactfcf; all same-head normal checks were green. CLI152 merged normally at 686558f62c9faf297a4fa38f9a2386475bf366af.

Full accepted main tree equals the reviewed/executedfcf tree, including all literal source/input guards; both parents/ancestry are verified. The completed remote cli/216-physical-upgrade branch was deleted only after its head matchedfcf, and remote absence is verified. The qualifying1274 receipt and exact8-ID cleanup/original hashes remain the fresh fcf evidence, without restoring any older held observation.

CLI owns the four actual-main workflows/readback next; they are running on the accepted commit. No release is required for these manual adapters. Scope remains installed CLI2.8/native3.9.2/SQLite/linux-amd64, with distinct synthetic/physical authority. Shared216 closure/other SDK/backend and later3.10/Cloud acceptance remain separate.

[rmcdaniel]

Delivered: CLI152's scoped installed acceptance and source follow-through are complete. Accepted main 686558f62c9faf297a4fa38f9a2386475bf366af / tree dfcfad2adb150676dae69205a4e9d564826e8770 exactly equals independently reviewed/executedfcf. All four actual-main workflows are terminal SUCCESS:

• Build43495058524
• CodeQL43495058054
• Sonar43495058590
• Public Boundary43495058561

Both merge parents/ancestry/full-tree equality and fresh remote topic-branch absence are verified. Fresh1,274-assertion receipt and independent installed Security PASS bind all six literal-bootstrap phases, fourteen synthetic zero-write windows, real3.8 physical upgrade/full comparison, eight exact lab4 cleanup IDs and untouched original backup/packet. No additional release is needed for the manual adapters.

This completes the CLI2.8/native3.9.2/SQLite/linux-amd64 cohort only. Earlier151/237/d2/857 HOLD/NONPASS observations remain historical and never supply current authority. Shared216's other SDK/backend/organization gates, later3.10, Cloud and toolchain profiles remain separately owned. CLI retains only the separate153/SPC297 source/caller work; this PR has no remaining CLI action.