sync: reconcile 8 unpushed local commits, land browser-bridge coverage honesty, unblock the CodeQL bump

[intellegix]

Reconciles the toolkit repo with the machine. origin/master was 25 commits ahead of local and local had 8 commits origin had never seen; this lands the content of those 8, plus today's browser-bridge fix, plus the dependency work that was stuck.

What is in here

council-automation (2026-08-22 work, never pushed) — the session/auth/CDP-wedge fixes to council_browser.py, council_query.py, extended_research_runner.py, refresh_session.py and session_keeper.py, plus cdp_health.py and three new test modules.

browser-bridge (today) — the fix for the 2026-09-10 incident where browser_get_tabs returned a bare list from the one browser it is connected to, with nothing saying a second Chrome existed. An agent read that silence as absence and reported a confident false negative.

• lib/browser-discovery.js (new) — detect-and-declare browser census. It never attaches to another browser; it only counts them.
• server.js — browser_get_tabs now returns a coverage envelope (status, negativeEvidence, observedCount/detectedCount, unobserved[] with the CDP endpoint to try) and prepends a RESULT STATUS: PARTIAL — NEGATIVE EVIDENCE UNSAFE banner when a negative conclusion would be invalid. browser_navigate now reports requestedTabId / retargeted / retargetReason instead of silently opening a different tab and returning success: true.
• lib/websocket-bridge.js + lib/config.js — a relay disconnect used to close that session's tabs on the same tick. Measured in mcp-debug.log: a lane's server exited at 12:43:06 and its replacement connected 2.3s later, so the cleanup destroyed a tab the caller was still using. Cleanup is now deferred 45s and cancelled if the same project reconnects.
• test-coverage-honesty.js — 18 tests, all passing. They fail against the pre-fix code.

No tool was added, renamed or re-described, and no tool description changed — a tool-list change invalidates the prompt cache for every lane on this machine.

Dependencies — all four github/codeql-action references move to v4.37.9 in one commit, and Dependabot gets a group so it stops splitting them.

Two things deliberately left out

The CRLF flip. Local commit 0ec3912 rewrote 211 of 218 tracked text files from LF to CRLF without changing one line of content (+61050/-61050). Every text blob on origin/master is LF-only — verified across all 218. These files are staged as LF, so the diff above is content only. The new .gitattributes pins that so the next automated sweep cannot repeat it.

Ten .bak-2026-08-22-* snapshots (~14k lines). Every one still exists on disk under ~/.claude, git already holds the prior versions of those files, and a public repo does not need more unreviewed copies of old code.

Verification

• Secret and PII scan over the exact staged bytes of all 21 files, with a positive control to prove the scanner was actually reading them: 0 credentials, 0 PII, 0 path signposts.
• github/codeql-action SHA cdf488f5… verified against the upstream repository — the annotated tag v4.37.9 resolves to it, and the SHA being replaced resolves to v4.37.6. Not taken from the PR title.
• 18/18 new browser-bridge tests, 10/10 npm test, 60/60 across the existing handler/context/reliability suites.
• Perplexity verified working end to end through the patched server after the change, since the research pipeline for every lane runs through this bridge.
• CI touches automated-loop, health-check and mcp-servers/minecraft only, none of which this changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F7yhQQARuYRqGTdJJZWvZH

[intellegix]

Austin, this one needs you for two separate reasons and the second is the real one.

First, mechanically: master requires one approving review, so nothing here can merge without you. That is branch protection doing its job, not a problem.

Second, and this is the decision: merging this publishes about twenty nine hundred more lines of your agent tooling into a repository that is public, and whether it should be public at all is a question you have never actually decided. I did not decide it for you and I did not change anything about it. Everything in here scans clean, no credentials anywhere, but that is a different question from whether you want more of your setup on the open internet.

There is also something already public that you should know about before you answer, and it is in the handoff: two commits that are already on origin carry your name, your role, your three email addresses, and one line pointing at the folder path where your API keys live. No key values, just the path. It has been reachable since February. I did not touch it, because rewriting public history is yours to call and doing it quietly would be worse than leaving it.

So the ask is: do you want this merged, and separately, do you want that repository to stay public.