[Proxicon]

Why

The retained beta.9 campaign needs one compatible repair release. This PR integrates the reviewed repair and dependency changes, sets 0.1.2-beta.10, and records the required deployment retests.

Changes

• Include all six merged campaign repairs: Expose incident seen timestamp for independent readback #250, Align owner notification unread counts with visible rows #251, Fix duplicate outer MCP argument validation on HTTP and stdio #255, Handle archived mailbox safely during organization deletion #256, Avoid duplicate notification on settled approval replay #258 and Reject direct administrator mail before queueing when no global sender is ready #260. The Fix duplicate outer MCP argument validation on HTTP and stdio #255 follow-up also handles streamed requests, trailing-slash routes, accepted large bodies and bounded oversized-body rejection.
• Include merged dependency updates Chore: Bump FluentValidation and 36 others #247, Chore: Bump Microsoft.Graph from 5.105.0 to 6.8.0 #149, Chore(deps-dev): bump @playwright/test from 1.63.0 to 1.64.1 in the minor-and-patch group across 1 directory #151, Chore(deps): bump the minor-and-patch group across 1 directory with 3 updates #152 and Chore(deps): bump the minor-and-patch group in /docker/api with 2 updates #237.
• Preserve setup cancellation output with Termina 0.17, including an accurate retained-profile message after a completed save; strengthen real terminal coverage.
• Add bounded browser-consent failure diagnostics that preserve assertions and keep private subprocess output out of public logs.
• Scope the strict consent acknowledgement assertion to the approval panel. The real notification badge no longer causes an unrelated multiple-status match; missing or denied approval still fails.
• Update the single product version owner, release notes and repair/live-retest map.

Queue reconciliation

#238 is superseded by #247. Draft #259 has no unique changes and is closed after the individual repairs merged. #239 is excluded because JsonSchema.Net 9.4.1 fails 16 existing numeric-schema conformance cases after API adaptation; retain 7.4.0.

Validation

Exact reviewed head: 3ec8bcbaf4f3140588bdacc5825396c790fd9271.

• Normal CI 40017086883: success; 3,325 .NET passed, 8 skipped, 0 failed; 408 provider passed, 0 skipped, 0 failed.
• Expanded acceptance 40017229750: all 25 jobs succeeded, with the same .NET/provider totals. Browser, mailbox, Docker, all three archive runtimes, full host lifecycle and the separate legacy initializer passed.
• The six existing API endpoint cases and two Windows-specific ACL cases remain skipped in the Linux full suite. Windows archive/runtime privacy checks are separate evidence.
• Focused local evidence includes 12 MCP framing cases, 66 HTTP/stdio transport cases, 57 Graph cases, 42 setup cases, six actual CLI/stdio terminal scenarios, four consent-diagnostic privacy/error-propagation cases and five acknowledgement browser cases. The original acknowledgement assertion was reproduced failing before the scoped correction; positive and negative controls pass afterward.
• Changed .NET code introduced no Slopwatch findings. Independent source readback verified every follow-up payload and mode. A clean merge with current main produces the identical reviewed tree 640f98ba5cec77a189699a5ffade1d519f787cd4.

Exact final-main normal CI and the complete release workflow remain required before publication.

Live acceptance

Publication and CI do not establish owner deployment or live acceptance. The retained beta.9 campaign remains NOT_READY, and the beta.10 campaign must capture the exact deployed commit and independent live readback.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-23T19:16:14.750276Z	b08acce	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Proxicon]

Independent AI-assisted source review completed at b08acce; no blocking findings. All 17 reviewed changed files match published tree c0f2602ca732f279140c4c333653d8683441f01c by Git blob SHA.

The HTTP guard covers both length-framed and streamed requests after authentication/authorization, rewinds unchanged bodies, keeps valid large requests, and rejects oversized input before downstream execution. New tests verify structured errors and zero business/token calls; existing assertions are preserved. Graph 6.8.0 references and Kiota alignment are consistent. JsonSchema.Net stays 7.4.0 with the integer/exponent conformance cases unchanged. Root product version is 0.1.2-beta.10. Documentation and whitespace validation pass.

Normal hosted combined CI, final-main CI and release verification are still required before publication. The retained live campaign receipts remain unchanged.

[Proxicon]

AI-assisted source review of the terminal compatibility correction at 03ccd24 completed with independent review and no remaining findings. Deep acceptance run 40009407747 exposed loss of the initial host cancellation message after Termina 0.17 shutdown. The correction persists an explicit exit message and writes it to stderr after terminal restoration; a saved client profile is reported as retained with incomplete read-only checks, and the existing sanitized rollback-conflict warning also remains visible. Back/completed-close and existing exit codes are preserved.

Validation: the original Ctrl+C sequence and strengthened real-apphost PTY regression failed before the fix and pass afterward; CLI and stdio client/host/HTTPS-approval paths pass all six PTY cases. The focused Termina suite passes 42/42 with zero skips. Slopwatch reports zero introduced findings versus the exact prior candidate, with no suppressions. The existing hosted Compose lifecycle assertion is unchanged.

The prior candidate b08acce passed normal CI (run 40009144172: 3,323 .NET passed / 8 skipped; 408 provider passed / zero skipped). Those results remain historical to that source. This new head requires its normal and deep hosted validation before the release merge.

[Proxicon]

AI-assisted independent review of ded1b1c: the hosted acceptance run confirmed the terminal cancellation correction, then failed at the temporary verifier browser-consent subprocess. This follow-up exposes only fixed allowlisted stage/error values, strict booleans and bounded counts from that failure; arbitrary subprocess output remains private. It rethrows the original failure and preserves all consent assertions and timeouts. Four focused privacy/error-propagation tests, syntax checks and the public-disclosure gate passed locally. A separate reviewer found no blocking issue. The actual hosted consent failure is not yet diagnosed or accepted; exact-head normal and deep acceptance remain required.

[Proxicon]

AI-assisted independent review of 3ec8bcb: reproduced the consent acknowledgement failure in the real Web app with Playwright 1.64.1 and its exact Chromium version. With an unread-error notification, the global status locator matches both the notification badge and the approval success message and fails strict selection. The shared assertion now requires the same success text inside the approval panel. Five focused browser cases pass: ordinary, verifier and host consent, plus missing/denied genuine results rejected despite an unrelated success-looking status. The host positive requires the real notification badge and two status elements. Four diagnostic privacy/error-propagation cases and the public-disclosure gate also passed. Independent review found no issue; product consent behavior, payload checks and timeouts are unchanged. Full exact-head normal/deep acceptance and final-main/release gates remain required.

[Proxicon]

Final AI-assisted verification of the independently reviewed candidate is complete. Exact-head normal run 40017086883 succeeded (3,325 .NET passed / 8 skipped; 408 provider passed / zero skipped), and deep run 40017229750 succeeded in all 25 jobs, including the previously failing hosted consent lifecycle and separate legacy initializer. Fresh premerge readback confirms the unchanged reviewed head, no outstanding changes-requested review, clean mergeability and current main 3c6c8df. The verified merge tree equals candidate tree 640f98ba5cec77a189699a5ffade1d519f787cd4. No self-approval is represented by this COMMENT review. Proceeding through the normal merge, exact-main CI and immutable prerelease workflow; live campaign acceptance remains separate.