docs: record scoped release stabilization and verification gates

devlog/_plan/261003_release_stabilization/000_plan.md

@@ -0,0 +1,77 @@
+# Stabilize the next production release
+
+The recovered train is integrated, but new request failures and pending account,
+pairing and accounting reviews need disposition before publication. Five isolated
+implementation lanes prepare reviewed changes; this coordinator lands ready PRs
+serially, verifies the complete candidate, and publishes the next stable release.
+
+## Loop contract
+
+- Archetype: satisfy-spec, C4 integration/release; trigger: explicit maintainer request
+  to use inherited parallel worktree tasks and leaf subagents through deployment.
+- Goal: address the listed scope, land safe changes progressively and verify production
+  publication. Each lane owns its goal/FSM; leaves own neither and cannot spawn.
+- Non-goals: unrelated features, native GitHub stacks, changing branch protection,
+  new credentials, account preference changes, or replacing the operator's installed app.
+- Verifier: focused activated regressions and exact-head required PR CI, then final
+  candidate lane=all CI, release-line push CI and actual publication/artifact checks.
+- Stop: all five work phases have evidence and production deployment is verified.
+  Missing native evidence remains missing; closing an issue does not prove acceptance.
+- Artifacts: this numbered unit, lane-owned numbered units, and ignored
+  `.tmp/release-stabilization/` receipts. Unpublished security notes stay in scratch.
+- Outcomes: DONE only with verified release; unresolved gates remain open. Host blocked
+  status follows its recurrence rule; timeout/compaction is not a terminal result.
+- Escalation: unavailable required access or policy conflict; no invented approval or
+  weakened verification. Main reclaims only failed/retired lane work with provenance.
+- Resources: existing repository/GitHub access and configured environments only; no
+  new paid resources. No user token/time budget. Bounded commands, one CI observer,
+  focused local tests under concurrent-worktree resource exception; CI covers breadth.
+
+## Dependency order
+
+1. `roadmap`: docs-only proposal, main dispositions, architect reflection, independent
+   audit and document checks. Locks this ownership and acceptance map.
+2. `stabilize`: execute [010](010_stabilization.md). Five worktree tasks prepare
+   implementation PRs with inherited leaf reviews. Main integrates serially as ready.
+3. `regression`: execute [015](015_independent_regression.md), a separate PABCD cycle
+   with parallel independent inherited regression subagents before publication.
+4. `candidate`: execute [020](020_candidate.md) after regression closure.
+5. `publish`: execute [030](030_publication.md) after candidate acceptance.
+
+Lane P phases own exact patch plans based on the current source. This coordinator
+roadmap owns their dispatch and integration interfaces, not speculative implementations
+of defects not yet diagnosed. No lane enters B without its own audited diff-level plan.
+
+## Measured starting state
+
+At initial inspection the previous full CI was successful at `7c59baf9597fbad188c49bb562bdd4858275766d`
+(run 37110109894). Dev subsequently advanced; the initial fetched baseline for this
+unit is `b82b39018b48ad489110b4165ee2cd9ba30433d5`, including #6501, #6506 and #6498.
+The version sources report 2.77.0; latest stable is v2.76.0. Re-read both before selecting
+the publication version. The current branch is `codex/release-stabilization-261003`.
+
+Repository authorities: `MAINTAINERS.md`, `scripts/release.ts`,
+`structure/ops/docs-and-release.md`, `.github/workflows/ci.yml`,
+`.github/workflows/service-lifecycle.yml`, `.github/workflows/release.yml`.
+Structure ownership remains with each implementation area; each lane updates its
+matching structure and user documentation in the same implementation PR.
+
+## Consultation and continuity
+
+Architect (receipt retained in private coordination evidence) proposed ARC-01 through ARC-05.
+Main accepts ARC-01 five lanes, ARC-02 B-before-E shared ownership, ARC-03 serial
+integration with A preceding final E composition, ARC-04 native acceptance ownership,
+and ARC-05 version pre-move and exact release-event proof. The same architect read
+these four concrete documents and returned ALIGNED with ARC-01 through ARC-05,
+with no remaining architectural gaps. Independent reviewer
+(receipt retained in private coordination evidence) passed the original plan and ARC-06 supplement.
+Its gate-recording clarification was folded into 010 and rechecked: VERDICT PASS,
+no remaining blockers. No implementation or
+release readiness is claimed by this roadmap. The preceding completed recovery unit
+established integration readiness, explicitly not a publication receipt; this new unit
+adds the user-authorized fixes, acceptance and publication.
+
+User steering added ARC-06: a separate independent parallel regression PABCD cycle.
+The same architect reflected ALIGNED and identified one SHA handoff gap. Main folded
+it into 020: candidate C must equal the regression-approved SHA; intervening product
+changes require affected regression and matrix review. This preserves the accepted flow.

devlog/_plan/261003_release_stabilization/010_stabilization.md

@@ -0,0 +1,71 @@
+# Scoped stabilization and progressive integration
+
+Depends on the roadmap. The change is from open/unverified source PRs to reviewed,
+tested PRs landed on dev with traceable authorship and issue dispositions.
+
+## Dispatch change map
+
+NEW ignored `.tmp/release-stabilization/lanes.json`: per lane id, canonical task/host,
+worktree, branch, base SHA, scope, PR/head, status and evidence. Creation receipts
+retain provisional IDs separately until host evidence establishes canonical identity.
+MODIFY this unit with source PR dispositions and integration proof as each lands.
+No runtime edits are authorized by the roadmap cycle itself.
+
+Five ordinary worktree tasks start on freshly fetched dev, use inherited model settings,
+and may commit, push their own branches, create/revise PRs and run relevant CI. Only the
+coordinator merges, closes superseded sources, promotes or publishes. Existing PRs are
+preferred when writable and coherent; carries preserve Co-authored-by trailers.
+
+Creation during the coordinator roadmap is planning-only: P/A/docs are allowed,
+but runtime edits, pushes and CI dispatch wait for the coordinator's explicit
+`ROADMAP LOCKED` message after the roadmap D receipt. Record its commit/receipt
+and per-lane delivery result in the manifest. Pending creation is not permission
+to recreate a lane; verify the canonical task identity before delivering the gate.
+
+| Lane | Scope | Primary runtime owners | Required activated evidence |
+| --- | --- | --- | --- |
+| A | #6504, #6508 | `src/server/responses/fetch-helpers.ts`, Messages/Responses error translation | oversized input yields actionable non-retrying error; large native UTF-8 upload preserves bytes and completes; small/non-native paths unchanged |
+| B | #6496, #6507, #6505 | `src/codex/auth-api/`, `src/codex/main-account.ts`, account runtime/store, `src/combos/failover.ts`, Responses auth/combo files | revoked credential refresh/refusal; caller-owned bearer separation; plan-ineligible target hops while unrelated 400 remains terminal |
+| C | #6502/#6497, #6509 | `src/providers/antigravity-models.ts`, `src/usage/expected-prices.ts`, `src/adapters/ollama-native.ts` | actual discovered wire IDs/effort routes including saved selection; live 404 comparison if accessible; tool batch/commentary/results replay with orphan and duplicate negatives |
+| D | #6076 | `src/cli/gui.ts`, `src/lib/gui-pair-capability.ts`, `src/server/gui-session.ts`, management link routes/registry | independent security review; legitimate enrollment and join remain usable; unpaired attempts rejected; real bounded enrollment/join/restart acceptance |
+| E | #6370, #6378 | spend ledger/continuity/budget, request accounting, `src/oauth/anthropic-routing.ts`, `src/oauth/index.ts`, token detection/store | historical upgrade admission and budget conservation; unresolved/corrupt history preserves guard; account rotation cannot adopt unrelated identity |
+
+Each lane owns adjacent tests and its structure/user docs. Test inventory edits are
+additive and the coordinator reconciles both inventories. B owns auth changes in
+`core-options.ts`/`core-combo.ts`; E owns spending changes and rebases after B before
+claiming merged-tree proof. A must coordinate any auth/combo overlap before writing.
+A also lands before E's final composition checks; C and D prepare independently.
+No concurrent checkout has authority over another lane's branch.
+
+## Integration procedure
+
+1. Refresh live dev, source PR head/base, membership and current reviews. Capture exact
+   diff/commit provenance in scratch; do not replay stale patches unreviewed.
+2. Each lane plans and audits its exact changes, performs activated focused tests,
+   typecheck, privacy/structure and applicable GUI/docs checks, then independent review.
+   Findings are fixed or rebutted against source evidence, never cleared by fiat.
+3. PR readiness requires successful exact-head required CI with actual expected tests;
+   absent, skipped, cancelled or old-head tests do not pass. Record security approval
+   for auth/pairing/accounting boundaries. No lane runs final lane=all CI.
+4. Coordinator verifies the returned diff, attribution, live head/base and review state,
+   records authorized maintainer integration, and merges one PR at a time. A failed
+   validation prevents the merge command. Refresh the next lane against landed dev.
+5. Resolve post-merge review threads, close actually superseded source PRs with carry
+   links, and close resolved issues with truthful acceptance limits.
+
+Coordinator additionally owns #6220 launcher replay and #6473 Windows autostart acceptance.
+Use available isolated environments, preserve production state and redact observations.
+An absent launcher/account/Windows session is an explicit unmet native acceptance row,
+not a passing fixture test. Classify its actual release consequence before candidate GO.
+
+Security-sensitive findings or draft repair reasoning remain in ignored scratch.
+Public plan text records only already-public scopes. A source PR with unresolved
+adoption defects may be excluded only with an explicit evidence-backed disposition;
+an unresolved existing release blocker cannot be hidden by excluding its proposed fix.
+
+## Completion evidence
+
+For every named item: current state, source and landed SHA or precise exclusion,
+test commands/results, CI event/run/attempt/SHA, review/security disposition and
+remaining native limits. Preserve failures. Do not run five full local suites in
+parallel; focused local coverage plus required hosted coverage is the declared strategy.

devlog/_plan/261003_release_stabilization/011_native_and_merge_acceptance.md

@@ -0,0 +1,72 @@
+# Coordinator stabilization acceptance
+
+Consumes 010 after roadmap D at commit 2152fdfeb8. The prior conclusion was a
+locked five-lane plan with a separate final regression phase, not runtime success.
+Architect decisions S-01 through S-06 below refine that same direction.
+
+## S-01: native acceptance receipts
+
+NEW ignored `launcher-acceptance.json` and `windows-acceptance.json` under
+`.tmp/release-stabilization/`: source/artifact SHA, prerequisites, invoked synthetic
+scenario, expected/observed result, cleanup and verification boundary.
+
+For #6220:
+
+1. Read-only discovery establishes whether the actual launcher is installed, reachable
+   and already authenticated. Do not install a browser extension or retrieve cookies.
+2. If available, use a fresh isolated CLI home/session and the same synthetic prompt
+   against the launcher directly and through an isolated proxy at the candidate SHA.
+   Both must complete the same minimal current-turn request. Then exercise one bounded
+   synthetic client-owned tool result and its follow-up through both routes.
+3. Enable only the carried per-provider compatibility opt-ins in the isolated proxy
+   config; preserve ordinary-provider stripping and xAI ID repair in focused tests.
+4. Capture structural/error metadata only, never cookies, tokens or private histories.
+   Stop only owned processes and remove only owned temporary state. If the required
+   launcher/account is missing, record NOT EXECUTED with prerequisites and rationale;
+   fixtures cannot certify this acceptance.
+
+For #6473:
+
+1. Read-only discovery checks available Windows host/toolchain and installed artifact
+   identity. Do not toggle the operator's existing Start at Login setting or overwrite
+   its Run entry as an incidental test.
+2. If the patched packaged app can be exercised in an isolated Windows user/session,
+   verify first registration quotes the executable under a path containing spaces;
+   seed the legacy unquoted entry in that isolated profile, run the repair path, and
+   read back the quoted command with arguments intact. Exercise login startup there.
+3. If only native test execution is available, run a source-derived bounded probe with
+   a unique temporary registry value and owned executable path; verify registration,
+   repair and cleanup through actual Windows APIs. Report this as native component
+   proof, not packaged-installer or login acceptance.
+4. No unavailable package/session is treated as tested. Final release disposition
+   distinguishes the report's observed registration defect from an unconfirmed startup
+   failure and states precisely which behavior the collected evidence covers.
+
+## S-02 through S-04: merge handoff
+
+S-02 preserves A/B-before-E final composition and permits C/D in independent ready slots.
+S-03 adds per-head merge receipts: source PR/head, carry authors, current base, test
+coverage, exact-head CI event/run/attempt, independent review/security verdict and limits.
+S-04 uses `scripts/ci/assert-mergeable-review.sh --maintainer-integration` for dev only.
+The helper is actor/review evidence, not CI/security proof. A failed command stops the
+dependent merge. Immediately re-read live head, dev target, actor and objections before
+head-pinned merge, then verify the actual merge commit and late review threads.
+
+The helper has been read from source and its command shape verified. It is intentionally
+not run against an arbitrary PR during planning: no lane candidate exists yet. Each
+candidate's actual invocation is recorded before its own merge; no passing claim exists now.
+
+## S-05 and S-06: phase handoff
+
+S-05 sends completed stabilization to 015 independent parallel regression; native
+receipts and lane reviews do not replace that phase. S-06 keeps publication outside
+this work phase, preserves main approval/push-CI policy and retains actual native gaps
+for the final release-impact decision. A goalplan label never grants bypass authority.
+
+## Consultation
+
+Architect (receipt retained in private coordination evidence) proposed these six decisions.
+Main accepted them. The same architect reflected ALIGNED on 011/010/015 with no
+material gaps. Independent reviewer (receipt retained in private coordination evidence)
+checked 010/011/015 and the policy boundary: VERDICT PASS, no blockers. This is
+plan acceptance only; runtime/native and merge evidence is still required.