Expose a per-call SQLite worker deadline with exact CLI/MCP recovery controls,
parent-owned execution metadata and historical unknown preservation. Keep fixed
resource limits and cleanup admission intact. Share typed cleanup composition
with one captured-output owner and preserve the timeout after cleanup resolves.
Fixes#5812. Follow-up tracking: #5808. Existing CLI test-oracle failure: #5845.
Verified 155 SQLite tests (3 skipped), static/docs/discovery checks, six real
CLI/MCP pairs and 13 actual Codex sessions including four corrected deadline
recoveries. Three pre-dispatch discovery failures remain explicit, not passes.
Review findings include real retained-cleanup and fixture ownership regressions.
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Expose the existing WABT command deadline as an optional validated per-call CLI/MCP budget, preserving its 30000 ms default and fixed safety allowances.
Retain selected execution profiles in success and rejected-module Evidence. Keep typed timeout recovery through cleanup failures without duplicating command output or making incomplete cleanup retryable.
Verified focused tests, real WABT CLI/MCP workflows and actual Codex recovery/blocked controls; detailed measurements and qualification limits are recorded in issue #5797. Merge uses the explicitly authorized maintainer override with pending CI and unchecked human-review attestations disclosed on PR #5798.
Closes#5797
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* perf(ci): pack each test tier from its own timing history
Fast shards were still ordered with the latest full-suite timing artifact,
which stayed stale across compiled-CLI session reuse. Publish and download
test-timings-fast and test-timings-full separately, and keep the legacy
artifact as a fallback until a tier has its own history.
* perf(ci): drop the shared timing-history fallback
Shard lookup now reads only the artifact for the current tier. A missing
artifact leaves history unset instead of packing from the old test-timings
file.
* test(ci): look up fast history when only full timings exist
The empty-history case now requests the fast tier against a full-tier
artifact and checks that the fast lookup ran and returned nothing. A
missing tier stays a separate test that does not query.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Decode direct Objective-C class names separately from nominal descriptors, retain indirect class bindings as partial facts, and preserve readable protocol and witness evidence when related bytes are unavailable.
Validated with 98 focused tests, check:ci, docs:check, and named-schema CLI/MCP replays of compiler-produced imported-class and struct fixtures plus an inert kind-3 control. The fixtures were inspected statically, never executed.
Fixes#5738
Distinguish CDP session detachment, observed crashes, and transport loss. Preserve the observed window alongside the original typed coverage-stop failure and unconfirmed cleanup.
Validated with 40 focused boundary tests, check:ci, docs:check, and the real Chrome public CLI/MCP verifier on macOS. Browser timing comparison remains incomplete because unchanged-main fixture readiness was intermittent.
Fixes#5756
Decode native binary plists from bounded owned source bytes before conversion can erase scalar values. Share scalar preflight and isolate overlapping decoder records while retaining exact integers, date uncertainty, and original bytes. Refuse numeric payloads that read structural table bytes, and avoid retaining projection metadata when callers only need structural validation.
Closes#5701Closes#5703Closes#5705Closes#5782Closes#5783Closes#5792
Preserve unsupported GGUF version bytes and both UINT32 interpretations without inventing byte order at the shared parser. Keep existing layout support, typed errors, evidence identity, scoped reads and resource limits.
Validation: 78 focused tests, full static/architecture and documentation checks, real CLI/MCP version controls and an independently checked public model. Latest-head Codex found no issues; Greptile is 5/5 and all review threads are resolved.
Some CI remained pending at merge qualification. Merge under the human owner's explicit standing bypass authorization does not claim the full CI suite passed.
Fixes#5749.
* fix(environment): report later bundle write failures as host failures
Only destination admission now refuses the selected directory as invalid
input. A path failure on a nested bundle file after admission, such as a
host pathname-length limit, is reported as an output failure that names the
host cause and the absolute failed path, with recovery guidance for the
partial folder it leaves in place.
Fixes#5522
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): name the host-refused path in export permission failures
A permission failure after earlier bundle files were written was reported
as access denied for the bundle root, so the documented failed path was
lost. The refusal now names the absolute path the host reported, falling
back to the root, and keeps the root as `output_directory`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): attribute pathless bundle write failures to their file
Descriptor operations such as `write` and `fsync` fail without a path, so
a disk-full failure after earlier files named only the bundle root. The
bundle writer now attributes such failures to the file it was writing.
Host-write recovery is applied only to actual host failures; an integrity
refusal keeps its own message without disk-space advice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(environment): attribute package tarball read failures to the tarball
The destination-write attribution also caught failures from reading the
admitted package tarball during the copy, so a source `EIO` named the
destination file and advised freeing disk space. Host failures are now
attributed by direction: tarball reads name the tarball with read
recovery, bundle writes name the file being written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(environment): state which export failures name a path
The export documentation and host-write message promised a failed path
for every later write failure, but a directory sync at commit time fails
without one. They now promise the failed bundle file or package tarball
when the failure is on one, and only the cause for a folder sync.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): refuse invalid binary dates and unknown sub-millisecond instants
Reachable binary plist dates must use marker 0x33. Other type-3 markers are
malformed and are no longer projected as observed timestamps. A valid float64
date stays known only when it is exactly the canonical millisecond instant;
other finite instants remain typed unknown dates with a counted limitation.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): share one decoder copy and bound binary date payloads
Wide-integer rewrites and unrepresentable date payloads now share the
single parser-input copy already reserved by the decode budget. Reachable
date markers and payloads must end at the offset table even when other
decoder-bounds checks read trailing bytes.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(apple): refuse out-of-region dates through the keyed reader
Decoder-bounds date truncation is now asserted on decodeKeyedArchiveBytes,
the path that selects those bounds.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Go, IL2CPP, dylib resolution, and application-workflow tests were still
starting a compiled CLI for every command. They now reuse one process
per file. Warm focused runs dropped from 40s, 46s, 35s, and 21s to
14s, 21s, 20s, and 2s.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* perf(test): reuse one compiled CLI for export-binding parity
The slow export-binding cases each spawned the compiled CLI three times.
One warm process now serves those JSON commands from a single command
instance, so startup and retained registrations are paid once per file.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style(test): format the warm CLI session
oxfmt --check rejected the session and its worker.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): report warm CLI shutdown, deadlines, and exit status
A compiled CLI session that needed a signal after stdin closed reported
success. A command that never answered left later checks waiting, and a
failure recorded only on process.exitCode was returned as status 0.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): close the warm CLI worker when a status check fails
The failure-then-success case only closed the compiled worker after both
assertions passed. Register the close with the test so a failed check still
stops the child.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): retain a timed-out compiled CLI worker until it exits
A request deadline cleared the child before SIGKILL was observed. The next
command could start a replacement, and close could miss the original process.
Retired workers stay owned until exit, and a failed stop remains for a later
close to retry.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): reject a compiled CLI launch that close interrupts
Closing during the ready handshake detached the child before the launch
promise settled. The queued command then waited on the startup timer.
Close now rejects that startup before the child is detached.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Fixes#5771.
Preserve the configuration owner's parsed registration settings and remediation in IDA readiness, retain caller-selected paths, and distinguish configuration selection from validity and live connection. Verified with 84 relevant tests, CLI/MCP negative-case parity, static/docs gates, independent source review and repeated actual Codex recovery tasks. No real IDA engine/GUI analysis qualification.
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Fixes#5767.
Retain exact WABT version-probe output and tool identity, including nonzero command failures, and provide condition-specific configuration recovery. Verified with 54 focused tests, the final 51-case real WABT CLI/MCP lane, actual Codex recovery trials, and independent source reviews. No provider installation, target execution or admission relaxation.
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Apply dyld’s implicit macOS compatibility rule only for a root executable with observed macOS platform and a supported candidate CPU type. Retain the absent platform fields as raw facts and expose the derivation on the candidate. Traverse the selected dylib and report missing required children; preserve unknown platform coverage and the later known fallback graph in other contexts.
Validation: 144 source/reader tests, 14 compiled CLI tests, 18 schema tests, full check:ci and docs:check passed. Four source-built app variants passed CLI and SDK-validated stdio MCP checks with unchanged fixture digests. No fixture executable or Apple dyld comparison was run. Independent review resolved a library-root authority gap before integration.
Sixteen cold/warm task-cost observations are retained locally with sampling limits; the catalog adds 66 bytes. Actual model tokens and maximum-sized inputs were not measured; no speedup is claimed.
Closes#5696
* perf(test): reuse one compiled CLI process per JavaScript application file
analyzeJavaScriptDirectory CLI cases were still starting a fresh process
after stdio MCP reuse. Keep one compiled process for the same child
environment so later cases skip Node and CLI startup.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): bound shared CLI worker lifetime
Retire a worker that reports a fatal failure before resolving that command,
and wait for it to exit before the next command starts. Join a session frame
once its bytes are complete instead of copying the unfinished buffer on every
chunk. Restart the shared process after 32 commands or a reported 1 GiB
resident set so one file does not keep a single heap high-water mark.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): retire a shared CLI worker after a transport failure
A malformed session frame rejected the command and sent SIGTERM without
clearing the worker. signalCode stays unset until the process exits, so the
next queued command could write to that same process. Transport failures now
use the fatal-reply retirement path and the queue waits for that exit.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Preserve valid empty TShark protocol stacks at the shared parser, retain frame and other fact inventories, and cover malformed producer output and mixed-frame ordering.
Validated with focused source/boundary tests, full static checks, docs checks, real Linux CLI/MCP and a mixed-interface public HTTP pcapng. Latest-head Codex found no issues; Greptile is 5/5 and its test-coverage thread is addressed. Remaining queued CI was bypassed under the human owner's explicit authorization; this does not claim that the full CI suite passed.
Fixes#5734.
* fix(process): token-check identityless exit-refresh replacements
A launcher-exit refresh could drop a reparented grandchild that was absent
from the prior snapshot and report cleanup complete, or publish a verified
empty lineage, without reading its run token.
Fixes#5206
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): re-read identityless refresh rows when relations change
Lineage refresh classified every pre-existing process as a newcomer, and it
skipped a row after caching its first parent and group. Seed the exclusion
set from the initial snapshot and read a row again when that relation changes.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format files oxfmt rejects on main
Repo-wide format:check fails on these two files at current main. Align them
so the process-ownership fix can pass the required static check.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): keep owned groups found while confirming exit
An unreadable exit-refresh row used to hide the confirmation table, and
revalidation dropped groups discovered after the plan was built. Both now
stay in the same cleanup, and confirmation reads are bounded.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): reclassify lineage rows when tree membership changes
Initial outsiders and cached refresh rows are read again when a parent,
group, or ancestor move changes launcher-tree membership. Unchanged
initial rows stay unread.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): re-read cached identityless lineage tokens
Parent and group do not identify a process generation. A row whose token
was read is read again on the next refresh, so a reused PID cannot keep
a verified descendant.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): revalidate an owned group that reappears
A group discovered after it was already processed is queued once more.
Another appearance stays unresolved instead of reporting cleanup complete.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): recheck a helper that changes groups during confirmation
The confirmation table can move a token-matched member into a new group.
That row is read again, and cleanup signals the group it belongs to now.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): publish one lineage row when a descendant returns
A refreshed descendant replaces the initial row for the same PID, including
when its group moves away and then returns to the original relation.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): re-read foreign PIDs on the exit confirmation table
A readable foreign token does not identify a process that later reuses
that PID. The confirmation table reads those newcomers again.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): recheck a pre-exit PID whose relation changes
An unchanged pre-existing row stays unread. A prior PID whose parent or
group changed is token-checked, so a reused owned process is not skipped.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): recheck an initial descendant after its token matches
A successful read in the first lineage pass marks that PID token-checked.
A later refresh reads it again, so a reused PID cannot stay verified.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): recheck the launcher on each lineage refresh
A later refresh reads the launcher PID again. A missing or unowned
launcher is unavailable instead of rooting a verified lineage.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): publish lineage from the latest refresh table
A descendant missing from the latest refresh is omitted. A refreshed
launcher whose group or command no longer matches stays unavailable.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(process): cover a refreshed launcher parent mismatch
A same-token launcher whose parent no longer matches the committed
expected parent is unavailable, same as a group or command change.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(process): recheck a token-read helper that returns to its group
A confirmation table dropped a previously matched PID once its parent and
group matched the pre-exit row, so cleanup could signal only the group it
had joined and report success while that helper survived.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Resolve relative pointers using field-owned ABI encodings. Keep null, raw, rebased, imported and unknown targets distinct, and retain imported conformance rows with exact Mach-O binding provenance. Decode legacy rebase membership with source-derived memory and work bounds, preserving validated prefix facts when streams are incomplete.
Validation: check:ci, docs:check and build passed; 158 source tests and 20 schema/acceptance tests passed. Ten source-built Apple dispatch variants and four issue-specific CLI/MCP workflows passed without executing targets. Paired cold/warm CLI/MCP cost observations retained locally; model tokens and maximum-sized input runtime were not measured.
Closes#5683Closes#5685
BREAKING CHANGE: Swift conformance type_name and protocol_name can be null when names cannot be resolved; consumers must use typed type_binding and protocol_binding evidence. MachoImportBinding replaces the former Objective-C-specific binding type and schema.
Preserve load-command paths as evidence while passing a separate root-relative lookup path to the bounded tree resolver. Apply the same containment rule to absolute install names and rpath bases, including caller-selected root symlink spellings.
Validation: 140 source tests, full check:ci, docs and runtime build passed. Compiler-built literal, rpath and relative fixtures passed CLI/stdio MCP parity, preserved both dependency edges and left all bytes unchanged. External system paths stayed outside-target; relative control was unchanged. Fixtures were not executed, and actual dyld execution was not qualified.
Closes#5637
Count each admitted unique class or metaclass object at its parsing owner. Preserve emitted metadata, independent class-list scan bounds, partial failures, and truncation.
Closes#5706
Count examined and decoded vtable slots in the same population, preserving all returned slots and partial descriptor failures. Document the coverage unit and retain malformed-sibling and unresolved-slot checks.
Closes#5681
Join provider class observations only when selected-image identity and exact import bindings establish equivalence. Preserve distinct observations and unsupported coverage.
Refs #5607
Keep malformed or missing CDP opcodes and payload facts unknown, retain observed zero and empty payloads, and avoid false capture differences while preserving independently known facts.
Validation: 59 source tests; compiled public CLI and stdio MCP fake-CDP acceptance; check:fast; docs:check; changed-file formatting. Real Chromium malformed-event behavior was not tested.
BREAKING CHANGE: WebSocket event opcode is nullable and numeric values are restricted to the four-bit protocol range.
Fixes#5666
Add a read-only app resource session shared by CLI and MCP. Preserve resource-root provenance without inventing executable identity, reject binary-only snapshots and operations, and retain failed cleanup owners across switches and retries.
Keep filesystem admission failures typed and preserve cancellation ordering from observed cleanup facts. Document resource routing in the packaged investigation skill.
BREAKING CHANGE: resource-only observations may have a null Evidence subject and null executable target digests. Clients must use resource_root and reported per-resource provenance instead.
Refs #5589
Reuse the shared object-member owner for literal spreads, retain known property names under unresolved membership, and distinguish complete, partial, unknown, and absent projections. Keep historical coverage omission unchanged and preserve own keys across prototype setters.
Refs #5075
* test(acceptance): split competing loader ownership across files
The loader matrix was one 578-second file, which set the floor for any
shard that received it. Three files keep every CLI and MCP case and let
workers overlap them.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* perf(ci): run eight fast built shards under a ten-minute budget
Charge each Vitest project by its resolved worker width so serial
process-boundary files spread as tail time. Fast feedback uses eight
built shards. The npm download cache stays; node_modules is too large
to ship as a shared artifact.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): keep each scheduled file on one worker lane
Dividing a file by maxWorkers dropped its own wall-time floor and could
pack a parallel file onto a serial tail. Place each file whole on a lane,
overlap peers only inside a sequence group, and add later groups after.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* docs(testing): separate the shard budget from workflow time
The ten-minute figure is the built shard job. Classification, build, and
the portable-test merge are measured separately on run 39451548945.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* docs(testing): match fast shard count to lane scheduling
Main still described five shards and half-duration weights. Fast
qualification uses eight shards, and each file keeps its full duration
on one worker.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): seed split loader durations from pre-split history
Timings published before the file split still name one 578-second path.
Until a new file appears in that artifact, share the recorded duration
by the pre-split case counts.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep npm download caches from Turbo snapshot growth
Per-commit static and portable Turbo snapshots had filled the 10 GB Actions
cache, which is what makes warm npm ci cheap. Trusted static runs now keep two
generations and one download-cache writer per host.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): declare cache retention types for strict checks
Typecheck imports cache-retention.mjs and needs a sibling declaration.
The generation count stays module-private so knip does not report it.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): keep compatible caches and qualification read-only
Npm dedupe deletes a record only when another has the same key, version,
and ref. Cache deletion moves to a follow-up workflow so reusable
qualification can keep its read-only token.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): retain caches after failed default-branch runs
Static and build save Turbo snapshots before later lanes finish. Retention
now follows a failed, timed-out, or cancelled trusted run, not only a green one.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(cli): pass application trace input as a file
The CLI already reads workflow JSON from a path. Putting the full
application Evidence document on argv exceeds the runner argument limit.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(ci): retain deep and Knip snapshots without deleting a repeated id
Fast and deep static checks publish rea-static-deep-v1 and knip-meta-v1
entries per commit. Retention prunes those families with the same two-generation
rule. A cache id listed twice is one record; inconsistent repeats abort
before any delete.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* perf(test): reuse one stdio MCP server per JavaScript application file
Repeated analyzeJavaScriptDirectory MCP cases started a full server for
every case. Share one file-scoped server and compile cache so later cases
skip that startup while CLI cases still launch a fresh process.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): close in-flight shared MCP startup with the file
File teardown waits for a stdio session that is still starting, skips a
server once close has begun, and still closes one registered during that
wait. The later-case reuse test can run without the earlier case.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): keep a failed MCP handshake when cleanup fails
The shared session reports the startup error and carries the cleanup failure
as its cause. A cleanup that failed stays owned and is retried on close
without running a cleanup that already succeeded.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): fail shared MCP cleanup when the rejection has no reason
A cleanup rejection of undefined still fails the drain and stays owned.
Close caches completion only after every retained cleanup succeeds, so a
later close can release it.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(test): keep one MCP server while failed cleanup is retained
A later call retries retained cleanup before opening another server. The
new server starts only after that cleanup succeeds.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(kuna): reject dangling cache roots in doctor
Treat a cache path as creatable only when no directory entry occupies it.
A dangling symbolic link, including one hidden by a trailing separator,
fails the cache check and clears provider availability while the installation
check and caller-selected registration settings remain.
Fixes#5554Fixes#5105
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): admit the same settings native analysis rejects
Project parseConfig failures into scoped engine readiness. Invalid provider
preferences, startup timeouts, and other shared settings now fail the
selected provider and the full audit, while a JEB-only timeout stays outside
that admission.
Fixes#5454
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): report an invalid log level from doctor
The dispatcher rejected REA_LOG_LEVEL before every command, so doctor never
emitted its readiness check. Doctor now runs and names that setting; other
commands still stop before execution.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): require log-level failures in every scope
An invalid REA_LOG_LEVEL stops the executable and MCP server before a client
or skill can run, so those scopes now fail readiness too. Other native
admission failures stay limited to a selected provider.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(kuna): strip only the platform cache separator
On Darwin and Linux a trailing backslash is a filename character. Doctor now
removes only the selected platform separator before inspecting the cache path.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): fail every provider on an invalid Hopper timeout
REA_HOPPER_STARTUP_TIMEOUT_MS is rejected before any native engine starts.
A selected non-Hopper provider now includes the existing timeout check.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style(doctor): format the Hopper timeout regression
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(doctor): fail client scopes on MCP startup errors
A registered client starts the MCP server, and parseConfig rejects every
native admission failure before that server starts. Client readiness now
includes those failures, not only REA_LOG_LEVEL.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Retain absent or invalid Runtime timestamps as null and mark console event coverage incomplete. Preserve observed finite timestamps, including zero, and document the epoch-millisecond clock.
BREAKING CHANGE: console event timestamps may now be null when the protocol does not provide a finite number.
Refs #5656
* fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads
Parse the linkedit install name for lazy-load info commands, resolve those
edges without traversing them, and stop inspect-macho from treating an otool
dependency list as exhaustive when that payload is omitted.
Fixes#5551Fixes#5649
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load payload reads and image offsets
Reuse identical LC_LAZY_LOAD_DYLIB_INFO ranges, cap their combined size,
and reject flag or chain-start offsets outside the slice VM range.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load string scans and contained reads
Reject payload strings that start in the 24-byte header, validate each
file-offset string once, and reuse payload bytes already read for a
containing range.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): reject cached lazy-load strings outside a payload
Remember each cached string's terminating offset and require that NUL to
fall inside the payload being decoded.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load payload range lookups
Count containment checks across earlier payload reads and stop at the
existing 16 MiB work limit.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): count every lazy-info string reference
Charge repeated and overlapping LC_LAZY_LOAD_DYLIB_INFO scans against the
16 MiB validation budget, and stop a scan once that budget is exhausted.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): cap retained lazy-info dependency results
Stop after 1024 LC_LAZY_LOAD_DYLIB_INFO commands so a load-command region
full of identical commands cannot become a million traced edges.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): reject a lazy-load path NUL in the final byte
dyld stops the load-path scan before the payload's last byte, so a
terminator in that byte leaves the image malformed.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): keep may-be-missing lazy loads optional
A missing LC_LAZY_LOAD_DYLIB_INFO with the may-be-missing bit is weak, so the lazy finding says dyld continues on first use instead of failing.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): cap lazy-info symbol string references
A payload of distinct one-byte symbol strings stayed under the byte budgets while caching one entry per offset. A slice now stops at 65536 symbol references.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: split fast and deep static checks
Fast PRs run typecheck, lint, and format before provider admission.
Knip, duplication, architecture guards, and Python stay on the full tier.
Shared-boundary fallbacks keep the Linux x64 baseline, and Turbo jobs
export remote-cache credentials when they are configured.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep pull requests from writing the remote cache
Trusted default-branch runs still receive TURBO_TOKEN. Pull requests get an
empty token and remote read-only mode. Knip saves a per-commit cache key so
the next trusted full run can refresh the restored snapshot.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: forward the release cache token and upload deep static reports
Release qualification now passes TURBO_TOKEN into the called workflow.
Labeled pull requests still do not. The deep static job records its task
context and uploads duplication reports after a failed gate.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format the turbo cache policy test
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep fast checks exclusive and trusted cache writes explicit
Declare the static artifact name and context script so typecheck matches the
implementations. Lock check:ci:fast around dist, and publish the remote cache
only for release qualification or default-branch push, schedule, and dispatch.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: record static task graphs without nesting the artifacts lock
Keep check:ci:fast locked, and point graph recording at the unlocked
check:ci:fast:tasks script so check:pr and check:test can record hashes
while they already hold that lock.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep unauthenticated Turbo runs on the local cache
Open pull requests do not receive TURBO_TOKEN, so a remote read mode cannot
authenticate. Those runs now use the local cache. Trusted runs still publish.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): treat unchanged invalid requests as nonretryable
Main already stopped marking invalid_request retryable. The pull request
merge runs that projector, while the IDA lookup tests still expected
retryable true. Match the merged behavior.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Sample the browser monotonic clock with observation already subscribed, filter historical lifecycle and network facts, and preserve scope and termination handling when event time is unknown.
Bound pre-arm retention using transport-owned wire bytes. Fail closed when the relevant-event buffer fills, and keep unrelated protocol payloads outside that budget.
BREAKING CHANGE: observe_web_session timeline timestamps can be null when the producer supplies no comparable timestamp. Consumers must handle unknown time explicitly.
Refs #5609
Add opt-in Frida session status summaries linked to complete retained Evidence. Share canonical session facts across contracts and preserve observed state, source identity and capture truncation.
Validated with native SDK/client workflows, default delivery compatibility, lifecycle and provenance tests. The completed large-history task uses 50.9% fewer estimated request tokens; no general CPU or latency improvement is claimed.
Fixes#5640
Prepare native process ownership outside short command deadlines. Reuse the shared cleanup adapter and resource scope for direct/nested preparation failures and command cleanup.
Fixes#5094.
Teach client deadline recovery before REA results can be discarded, distinguish
producer-owned server budgets, and preserve Evidence/cleanup uncertainty.
Include actual Codex CLI recovery probes and CLI/MCP regression coverage.
Fixes#5598
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Use shared owned command supervision for all evaluation helpers, join streamed output, and retain/retry incomplete cleanup before deleting run files.
Fixes#5094.
Reuse the cancellable segmented wait and settle observation termination through one cleanup owner. Preserve caller cancellation and release timers/listeners across early target end.
Fixes#3929.
Add opt-in Go build summaries and selected retained metadata pages while preserving complete Evidence and source identity.
Validated with 258 focused tests, full static/docs checks, real CLI/SDK workflows and native metadata oracles. CI baseline remediation assertions reproduce on unmodified main; fail-fast cancels two other shards. Owner authorized bypass with those coverage limits recorded in PR #5524.
Fixes#5499.
Reject browser scenario waits and action deadlines beyond the underlying signed 32-bit timer interval in the shared input contract. Preserve maximum legal values and omitted deadlines; prevent unsupported input from opening a browser.
Strengthen the rejection oracle and verify public CLI/MCP canonical validation in both schema profiles, actual Chromium timing/cancellation/cleanup, Evidence export and compatibility with current main.
Fixes#3392.
Replace the superseded fixed 64 MiB process-input refusal with the shared reader diagnostic and recovery text. Restore CSV field boundaries in the adjacent import-limit catalogue entry.
Refs #5077. Verification is source consistency and CSV parsing, without a new large-file runtime claim.
gensokyo-dev