fix(repo): harden engine and cli lifetimes (wave 3 steps 1-8)

[cemililik]

Second maintainer review — corrections in progress

The systematic review of a5a5d45e identified PID-less failed-spawn cancellation,
finite credential-pattern gaps, installed-command acceptance and further lifecycle,
coverage and documentation issues. Corrections and permanent regressions are being
completed on development. Do not merge this checkpoint yet. New complete
cumulative review rounds, a separate security review and corrected-source gates
remain pending. The earlier acceptance record below retains its original source
scope and does not certify these new corrections. Wave 3 Steps 9–19 remain unstarted.

Maintainer review corrections — verified publication checkpoint

Long tool arguments could share an effect replay identity, and diagnostic clipping could retain part of a recognized credential. The corrections use the complete redacted v5: projection, preserve own public data, normalize/recognize complete summaries before clipping, and retain the original invocation through actual MCP/native cleanup. All 13 Medium findings and 39 distinct Low concerns have explicit fixes or evidence-based dispositions, including Promise/cancellation boundaries, active-turn SIGINT/EOF, JSON gate purity, required CI guards and canonical documentation.

Published head: a5a5d45ebf9a57dbd8dfe0e20ae71ae9b33408cb. Reviewed runtime: ba14b1bd, against submitted 05061d55. The later delta is four append-only Markdown files / 75 lines; executable, configuration and dependency bytes are identical. Native v5: refuses unversioned and v2:/v3:/v4: rows, including unchanged small arguments, without rewriting history or granting automatic effect retry. Raw host/model/spill handling and finite redaction limits remain explicit.

Two NEW complete cumulative CLEAN rounds, R9 and R10, each use four fresh independent review tasks covering 100 paths / 212 ordered hunks. Root verifies exact file/diff/hunk hashes, coverage unions and substantive assessments. Current code/test bodies and all deleted/replaced branches are read; historical documents receive identity/structure/status/links and complete changed/affected-clause review, not unrelated historical line-by-line recertification. A NEW separate CLEAN security sitting covers 40 paths / 100 hunks, explicitly static-only with zero tests executed. Two further independent CLEAN metadata checks cover the four-file documentation delta. Earlier nonclean/incomplete/interrupted rounds retain their own sources. This is correction-scoped acceptance, not a new whole-PR review.

Verified at the published head:

• Push CI 39086945679 and PR CI 39086948646: 15/15 jobs successful each. Both actual main logs report 748 files / 15,886 passes / 22 established CI skips. Lint/typecheck17/17 and workspace tasks 11/11 each have five cache hits; build 6/6 has six. Cached work is not claimed rerun.
• Fresh local ordinary coverage in CI mode also passes 748 / 15,886 / 22, retaining all three existing core/LLM/MCP 90% line and branch floors. Required remote enforced coverage passes; core's required-CI promotion remains Step 19. The earlier non-CI author workspace15,887/21 snapshot remains separately attributed.
• All four actual installed consumers pass with one selected archive: current Linux/macOS/Windows on Node 24.21.0 and minimum Linux on Node 22.0.0, each 177 bootstrap controls + ten behavior cases. Independently downloaded archive/report and GitHub-origin checks verify 448,223 bytes / 70 files, SHA-256 0fa52c13eb8197bd5ac37e0abca9f2c5a2c3c16b84bcc5d2c73793cce1a52afb. This is physical evidence inspection, not another local Windows/Linux execution or reproducible-build claim. Native Windows and Node 22.13 source advisories also pass.
• Current-source filesystem/secrets artifacts independently verify 110/41 controls and 330/123 phases, exact declarations/source/runtime/evaluation/stdio bindings, ZIP digests, zero recorded unhandled errors and the unchanged 2,000-file/64-MiB bounds. This does not rerun those matrices locally.
• Budget replay smoke verifies 16 strict refusals / two legacy positive controls / zero fetches. All 599 local acceptance-tool cases pass. Eight author removals yield 89 specific assertion failures; every byte-exact restoration passes all 208 focused targets, with zero unhandled errors in committed runner receipts. Overlapping reviewer test selections are not added into a unique total.
• Source-bound Sonar analysis passes at this exact head (GitHub check 117555791121), with no new record since the preceding candidate: 231 records / 90 files = 55 false positives + 86 accepted + 11 fixed + 79 open recommendations. Valid nonblocking recommendations, including the two reasoned regex-maintainability suggestions, remain visible; no rule or quality threshold is weakened.

The completion register owns source/coverage attribution. Detailed private receipts remain Git-ignored. PR stays OPEN for the maintainer's new review. No merge, release or whole-Wave-3 completion is claimed; Steps 9–19 remain unstarted.

What changes

Complete the first eight approved Wave 3 increments. Declared-secret-derived context is kept out of public expression/template outputs, authored admission and historical replay have distinct validation boundaries, and CLI work stays owned through actual producer, native-process, terminal and database cleanup. Guarded lazy loading and exact installed-package controls make those boundaries testable in the shipped CLI.

This PR is the maintainer-requested Steps 1–8 publication checkpoint. Steps 9–19 have not started; Wave 3 is not complete. The original whole-wave Step 19 review, coverage and publication obligations remain for the later work.

Scope

Accepted increment	Result
1 — Serialized reliability queue	Shared close handling, safe source labels and UTF-8 admission parity, exhaustive surface switches and actual reasoning rendering.
2 — Admission and diagnostics	Consistent value-free authored validation and numeric bounds, with separate historical workflow/session validation and resume compatibility.
3 — Secret provenance	Engine-owned qualified context/input provenance at real VM/template/public sinks, with native SQLite persistence regressions and expression-result parity.
4 — Error/envelope substrate	Shared error ancestry and event-envelope validation while preserving supported family names, discriminants, causes and seam boundaries.
5 — Tool and engine tails	Tool input bounds and advertised semantics, alias/cycle safeguards, cancellation tails, deterministic plans and identifier ordering.
6 — Pure process/discovery substrate	Early option/error/origin authorities, command descriptors and pure discovery projections, invocation work owners and observation priority.
7a/7b — Lazy runtime and installed graph	Guarded entry/import failures, invocation catalog ordering, finite flat ESM chunks, complete emitted-graph checks and exact-tarball consumers.
8a–8d — Native/session/fatal integration	Creation-owned process capabilities, partial-acquisition custody, retained discovery/MCP/media work, workflow/session/Home/management ownership, terminal restoration and fixed fatal/output/background diagnostics.

Packages: shared, llm, core, db, mcp, CLI and acceptance/CI tooling. Decisions: ADR-0110–0113, with append-only forward notes in affected earlier ADRs. No new runtime dependency; the SQLite type addition is development-only. Detailed review/private evidence remains Git-ignored.

Compatibility and boundaries

• Public secret-context access is intentionally tightened under ADR-0113. Previously stored historical output is not retroactively erased.
• Unexpected CLI infrastructure/output failures use fixed cli_internal / output_unavailable diagnostics and exit 9. Classified workflow/turn failures, deliberate chat end, signals and actual workflow money/effect/durability precedence retain their defined meanings.
• Cancellation, timeout, public discovery completion and an SDK close promise never manufacture a native-close, receipt, terminal-delivery or DB-safe-close acknowledgement. POSIX tool groups, SDK MCP PIDs and verified Windows helpers retain distinct authority.
• JSON-help integration, aliases/output-category UX, release maps/encrypted custody, later chat/Home/network-policy work, DB centralisation and whole-wave acceptance remain Steps 9–19. This PR does not activate a release or claim complete Phase 2.5.5/2.6.

Original checkpoint validation and review attribution

The original Step 8 runtime acceptance below applies to c83c8575b0baaa9bf20765b03dffb00623ed96c6. The 00fb72d2 closure and 4762f21f publication were documentation-only. The subsequent Sonar correction source is 887ff47eff6092d035df9442658f0eb24625f9e9; 05061d55 records its scoped evidence. Earlier results retain their source attribution.

• Full source CI run 39044664485: 15/15 jobs successful. Main workspace reports: 743 files / 15,635 passes / 22 established skips. Lint/typecheck 17/17 (five cache hits), serialized workspace 11/11 (five cache hits), build 6/6 (six cache hits); cached results retain that attribution.
• Required source fences, formatting/isolation, compiled smokes, 177 bootstrap controls, replay compatibility, wire/usage acceptance and filesystem/secrets causal jobs pass. Core's required ≥90% line/branch floor promotion remains Step 19; the current enforced job covers LLM/MCP.
• All four actual installed consumers pass with the same tarball: current Linux/macOS/Windows on Node 24.21.0 and minimum Linux on Node 22.0.0. Independently inspected archive: 446,750 bytes / 70 public files, SHA-256 a64f4ff2cbd444d6bc37e6b0938c42e0a6ebca0ddcd7905799c718346764558f.
• Downloaded current-source filesystem/secrets records independently verify 110/41 controls, 330/123 phases, exact source/runtime/restoration/physical bounds and zero unhandled errors. This is inspection of the executed CI artifacts, not another local mutation run.
• Each increment has independent scoped acceptance. For final Step 8, R25 and R26 are two NEW complete cumulative CLEAN rounds, each eight independent reviewers covering 342 disjoint paths / 1,842 ordered hunks from accepted Step 7 d9625ff0 through c83c8575. Root reads every report/path assessment and independently verifies raw results, joins, hashes and matching source/dependency/dist freezes. These are whole-Step-8 reviews, not a new whole-PR review of all changed files.
• A NEW separate CLEAN Step 8 security sitting runs 75 complete files / 1,105 passes / one Windows-only local skip, with explicit empty error channels and actual runtime joins. Earlier steps retain their separately recorded sittings. No operator-TTY, live-provider/keychain, opaque native-undici close or universal descendant-containment certification is inferred.
• Failed reviewer-preparation receipts remain failed. In particular, R25 tooling's arithmetic wrapper and R26 Home's collection wrapper exited nonzero; their passing product-case records and empty error channels were audited directly with explicit qualifications. Missing callback history and native-child source/dist equivalence are not invented. Earlier NONCLEAN reviews and failed old-source CI remain historical.
• Final closure documentation/handoff received an independent read-only review with no confirmed documentation issue; local links and append-only ADR/mirrored status checks pass.

New push and PR checks run at the publication head. Their current results must be evaluated separately from the successful runtime-source run above.

Historical Sonar review corrections — 2026-10-18 (source 05061d55)

The complete initial review covered 214 open Sonar records in 80 files. One confirmed tooling performance defect appeared at two sites: stack indentation could consume newlines and cause quadratic rescanning. 0eae1b8b bounds those scans to one line; permanent tests inspect the actual source assertion operands and retain stack/canary/file-URL detection. Each independent removal fails its regression, and exact restoration passes. Small equivalent CLI/tooling clarifications address seven other records without changing native ACKs, control inventories or deadlines.

• Two NEW independent complete cumulative CLEAN rounds, two reviewers per round, cover all 8 paths / 11 hunks at 887ff47e. A separate final documentation/receipt check is clean. These are correction-scoped reviews, not a new whole-PR review.
• Author validation: workspace lint/typecheck 17/17 (15 cache hits), serialized workspace tasks 11/11 (10 cache hits), fresh CLI 362 files / 5,665 passes / 10 established skips, build 6/6 (five cache hits), and 551 acceptance-tool tests with no skips. Tooling lint/typecheck, formatting, seam/dependency fences pass.
• The actual local macOS / Node 22.23.1 installed consumer passes 177 bootstrap controls / 8 smoke cases, tarball SHA-256 2dd80f46204a60e17d4abb72c5442425e29d09c73e60642cad40ccc254125d4e. This is one local consumer; fresh remote platform consumers are reported separately.
• 52 false-positive and 86 intentional-design records have reasoned online dispositions, independently joined by exact key and saved comment. No rule, gate threshold or approved deferral changed. The trusted-host PATH assumption of the local Git fallback is explicit.
• 67 valid nonblocking maintainability suggestions remain open, including larger decomposition suggestions; they were not labelled false positive or silently closed. All nine code-corrected records are now FIXED in fresh analysis; no new open issue was introduced. This does not start Steps 9–19 or grant a new deferral.

Fresh Sonar analysis is successful at 05061d55, with security/reliability/maintainability A/A/A, zero bugs/vulnerabilities, nine FIXED records and 67 remaining open maintenance suggestions. GitHub Sonar check 117511184731 independently confirms that exact head. All four actual PR installed consumers now pass: current Linux/macOS/Windows on Node 24.21.0 and minimum Linux on Node 22.0.0, each with 177 bootstrap controls and eight smoke cases. Downloaded artifacts independently verify the same 446,752-byte / 70-file tarball, SHA-256 192b281eab895241c35ad07fdb988c4420b4679539664de8af9ebb3ee54e999c. Their actual checkout is synthetic PR merge a9a921c1; its Git tree is independently identical to 05061d55. New-head push CI 39071766923 and PR CI 39071769451 still contain running causal/coverage/main jobs; aggregate completion is not claimed. Earlier green runs retain their historical source attribution.

Navigation and continuation

• Current Wave 3 queue
• Approved nineteen-increment plan
• Step 8d and whole Step 8 acceptance
• Maintainer-authorized scoped publication

The timestamped detailed handoff is local/private and is not published in this PR. Before Step 9, the next agent must inspect this PR's state: further commits on development would extend this PR's scope. No Step 9 implementation or production release operation is performed here.

Conformance

• Accepted decisions and canonical contracts cited; ADR history append-only.
• Strict TypeScript, SDK seam, engine platform purity and runtime-dependency boundaries preserved.
• Increment-scoped reviews/security and runtime evidence attributed to their actual sources.
• Private handoff/review records and credentials excluded from Git/public artifacts.
• No whole-wave completion or later-step implementation claimed.
• New correction-head push/PR checks and fresh Sonar analysis completed successfully.
• Maintainer whole-PR review completed.

Refs: ADR-0110, ADR-0111, ADR-0112, ADR-0113; Phase 2.5.5 / Wave 3 Steps 1–8

Prepared with Codex assistance.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE