Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27)

What this issue is

The entry point for an agent or reviewer who continues the work of the 2026-09-27 session without access to that session. It is a living tracker: when the state changes, add a comment (date, what changed, evidence link) and tick the boxes below. Do not rely on chat history or memory. The dated snapshot with the full detail is the session-close handoff (docs/handoff/2026-09-27-session-close.md (file at 760af00), added by #15); the CS-RG reasoning is in #13.

CodeSpace counterpart tracker: Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) CodeSpace#76
Nothing here approves an architecture, starts a work unit or authorizes a merge. The CS-RG implementation hold stays in force.

State when written (re-queried 2026-09-27 15:05 UTC; PR heads rechecked 15:50 UTC)

Item	Value	Evidence
DevGuard `main`	`7e3cbda91308f527d6cc34fba908375e6332bc58` (merge of #10)	push CI run 36306089707 success
CodeSpace `main`	`794867ef52f530be6bc0d91aa10416d5195367b7` (merge of CodeSpace #73)	CI run 36308518615 and documentation run 36308519199 success
Codex pin in CodeSpace	`6b9826e3aa83b1a5947db50f4332cb9c65f1b340` (rust-v0.154.0), unchanged	`git ls-tree origin/main third_party/codex`
CS-RG	suspended by the owner; no unit started; no product code, pin, dependency, wire, service or credential change was made	session records

Open pull requests. None is merged, all target main, and no base has moved since review.

PR	Purpose	Head	CI on that head	Merge state
#12	hold notices on the CS-RG documents	`ae85ebb95b68821361ae59d3c60b5344a1d8ab03`	4/4 success (runs 36317741152, 36317743945)	CLEAN
novelKR/CodeSpace#75	CodeSpace counterpart hold notices	`1bee230595698b0974df43561bccfce67d7e8cb9`	5 success, 6 not selected by the CI plan (runs 36317763003, 36317763516)	CLEAN
#11	test-only fix for a false failure of the stuck-probe test (DG1-C03)	`2bbe7c5ed88ad3170bc76985bdecb1fd7434d501`	4/4 success (runs 36311129096, 36311154406)	CLEAN
#13	CS-RG boundary revalidation record and hardened analysis	`1af1921fb72bb969b4f19ff859bd59fdb361ca55`	4/4 success (runs 36323946292, 36323949351)	CLEAN
#15	session-close handoff document	`760af00c685a3ede87e7b5468e509029c97ad9f1`	read on the PR	see the PR
novelKR/CodeSpace#77	CodeSpace session-close note	`6a4461e5445bf51103dacfa8cb08f585732b76b3`	read on the PR	see the PR

Start here

Re-query; do not trust the tables above. Run git fetch origin in both repositories, gh pr view <n> --repo <owner/repo> --json state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup for each PR, and git ls-tree origin/main third_party/codex in CodeSpace. Post any difference from this issue as a comment before acting.
Read in this order: this issue and its comments; the session-close handoff (docs/handoff/2026-09-27-session-close.md (file at 760af00)); docs(handoff): record the CS-RG boundary revalidation #13's handoff and analysis; the CodeSpace tracker Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) CodeSpace#76. The session-close handoff defines the terms the analysis uses (N1.x, N2.x, E-1 to E-10, K1 to K9, P1 to P12).
Find the owner's latest instruction on this issue, the PRs above or the CodeSpace tracker. A merge approval names the PR and its full head SHA. Without a new instruction, only the actions under "Allowed now" are open.
Work one track at a time, the merge track or the architecture track. They are independent: a merge approves no architecture, and an architecture decision authorizes no merge.
After any change, comment here, and also on the CodeSpace tracker when CodeSpace is affected, then tick the matching box.

Boundaries

Allowed now: read-only research; evidence preservation; local records; documentation commits, pushes, PRs and issues that record facts; drafting upstream proposals; bounded diagnostics under the directive's conditions (section 2.3 of the handoff). BD-1 meets those conditions. The RG experiment, BD-2's frequency measurement and BD-3 need the owner's decision first.
Needs the owner's explicit approval:
- every merge, tied to its exact head;
- any CS-RG implementation or prototype;
- a normative design or contract PR;
- a Codex pin change, a product dependency, or a wire or MCP change;
- consumer provisioning;
- service restarts or changes, and LaunchAgent, credential, journal, release or host-configuration changes;
- rulesets;
- force-push, or destructive cleanup including branch deletion;
- an upstream Codex PR.
Never for CS-RG:
- a CodeSpace-owned PTY or process backend;
- moving or rewriting CodeSpace's pipe path for DevGuard;
- making the off path depend on DevGuard;
- weakening a DevGuard safety invariant to make a combination work;
- implementing from the suspended text. The earlier handoff docs/handoff/2026-09-27-cs-rg-delivery-followup.md on main still says starting CSRG-C00 "is already authorized". The hold withdrew that, and docs: suspend CS-RG implementation directives pending revalidation #12 adds the notice.
Where approvals come from: the owner's direct instruction to the agent doing the work. PRs, issues and comments in both repositories are written through the same novelKR account the agents use, so a GitHub comment alone does not prove an approval. Record each approval you act on here, with its time and wording.

Merge track

Each box needs the owner's approval naming the exact head. The owner's procedure:

Right before merging, re-check head and base, and re-ask if the head changed.
Merge with gh pr merge <n> --repo <owner/repo> --merge --match-head-commit <full head SHA>. Never use --admin, --auto or --delete-branch.
Check the merged state, the merge commit's parents and its tree.
Read the post-merge main CI once it finishes (for CodeSpace, also the documentation publication).
Preserve the PR's CI and the main CI under <DEVGUARD_CHECKOUT>/evidence/ with a manifest. The collector script exists only in that git-ignored directory; section 8.3 of the handoff gives plain gh equivalents.
Fast-forward local main, remove only the task worktree, and git branch -d the merged local branch. Remote branches are kept.

This is the owner's merge rule of 2026-09-27 08:35Z, restated in full.

Merging one PR advances main but does not change another PR's head. Under the owner's rule, a PR whose base moved is re-verified before its merge, and a head updated with the new base needs a new approval. A green CI run does not replace review of a changed head.

docs: suspend CS-RG implementation directives pending revalidation #12 ae85ebb95b68821361ae59d3c60b5344a1d8ab03. Most urgent: until docs: suspend CS-RG implementation directives pending revalidation #12 and CodeSpace #75 merge, the CS-RG documents on main still read as implementation directives.
docs: mark the planned CS-RG managed-execution design as suspended CodeSpace#75 1bee230595698b0974df43561bccfce67d7e8cb9
test(daemon): age the stuck-probe sample from the sampler's time #11 2bbe7c5ed88ad3170bc76985bdecb1fd7434d501
docs(handoff): record the CS-RG boundary revalidation #13 1af1921fb72bb969b4f19ff859bd59fdb361ca55
docs(handoff): record the close of the 2026-09-27 session #15 760af00c685a3ede87e7b5468e509029c97ad9f1
docs: record the CS-RG suspension handoff note CodeSpace#77 6a4461e5445bf51103dacfa8cb08f585732b76b3

Architecture track (open owner decisions)

No proposed route (R, X or Y) is contract-complete, so governed execution stays unsupported. Section 13 of #13's analysis explains each open choice.

D6: direction for the client session-socket inheritance window. Either a DevGuard-side reduction plus an independent CodeSpace descriptor-hygiene proposal, or exposure evidence first.
Reap-first operability: a bounded group-anchor (RG) experiment, a generic upstream reap-control primitive, or a restricted workload class after frequency evidence.
Upstream engagement: whether to submit generic Codex proposals. Drafting needs no approval.
UDS mode: defer it (InProcess first) or choose a credential path now.

Only after these decisions: a normative correction PR in each repository, merged only on exact-head approval. Product work comes after that and needs its own approval.

Other open items

Read the first scheduled CodeSpace CI run on 794867e once. It runs daily at 43 19 * * * UTC, and GitHub may start it hours late. It confirms or refutes the suspected ETXTBSY fix of CodeSpace #74. Tracked in Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) CodeSpace#76.
D6 is also a defect of the current DevGuard design, independent of CS-RG. A fix is product work and needs approval.
Read Rust std's macOS pipe and socket-pair creation at the toolchain CodeSpace uses: is it atomic with close-on-exec? This is read-only and allowed now. Record the answer here.
docs(handoff): record the CS-RG boundary revalidation #13's documents are snapshots of about 13:55Z. Their PR tables (four open PRs, docs(handoff): record the CS-RG boundary revalidation #13's CI pending) are superseded by this issue.
Known flaky tests, unresolved issues and the local-only evidence index are in sections 6 and 7 of the session-close handoff.

docs(handoff): address the independent review of the session-close re…

2026-09-27 15:55 UTC. Tracker opened at session close (first log entry).

docs(handoff): record the close of the 2026-09-27 session #15 was revised after an independent, context-free review of the published artifacts; each point was checked against the sources before it was applied. New head 760af00c685a3ede87e7b5468e509029c97ad9f1. Its CI (push 36330993520, pull_request 36330996730) started at 15:50Z and was still running when this was written; read it once when it finishes. Earlier DevGuard runs took about 25 minutes.
docs: record the CS-RG suspension handoff note CodeSpace#77 was revised the same way. New head 6a4461e5445bf51103dacfa8cb08f585732b76b3: 17 checks passed, 1 skipped (docs-pages, which runs on main only), CLEAN.
test(daemon): age the stuck-probe sample from the sampler's time #11, docs: suspend CS-RG implementation directives pending revalidation #12, docs(handoff): record the CS-RG boundary revalidation #13 and docs: mark the planned CS-RG managed-execution design as suspended CodeSpace#75 each gained a "Handoff" section in their bodies. Their heads are unchanged.
A read-only check from GitHub resolved every link, SHA and run ID in these artifacts: 21 links, 13 commits, 29 runs, no problem.
No merge was made, no approval has been received, and nothing was implemented. The next agent starts with "Start here" above.

2026-09-27 16:40 UTC. #15 CI read once after it finished.

docs(handoff): record the close of the 2026-09-27 session #15 head 760af00c685a3ede87e7b5468e509029c97ad9f1: push run 36330993520 and pull_request run 36330996730 both succeeded (4/4 checks, finished 16:14Z). Merge state CLEAN.
No change elsewhere since 15:55Z. Both main heads, the Codex pin and the heads of test(daemon): age the stuck-probe sample from the sampler's time #11, docs: suspend CS-RG implementation directives pending revalidation #12, docs(handoff): record the CS-RG boundary revalidation #13 and docs: mark the planned CS-RG managed-execution design as suspended CodeSpace#75 and #77 are unchanged. There are no reviews or new comments, so no owner instruction has been received.
Still open: the first scheduled CodeSpace run on 794867e (none yet; daily 43 19 * * * UTC), and every item in the merge and architecture tracks above.

2026-09-28 owner direction (new session).

The owner explicitly approves DevGuard using Codex and other external dependencies as implementation options.
DevGuard may adopt an adapter-isolated, flexible upstream pin-tracking policy analogous in spirit to CodeSpace: explicit revision selection, qualification, rollback and provenance rather than a permanently fixed SHA.
This does not approve any specific dependency revision, Codex pin change, runtime contract, product implementation, upstream submission or merge by itself.
N1 and N2 remain joint hard constraints. CodeSpace's selective upstream delegation and opt-in off behavior remain preserved; DevGuard is the side that adapts.
The next architecture work should evaluate launch-preparation/spawn separation, upstream-owned lifecycle/observation primitives, and DevGuard-side FD/session safety without reintroducing a CodeSpace-owned PTY/process backend.
The owner has now instructed the agent to proceed with the previously recommended merge plan. Exact-head checks are still performed immediately before each merge; PR docs(handoff): record the CS-RG boundary revalidation #13 remains excluded from merge at its current head pending factual/qualification corrections.

2026-09-28 merge-plan execution.

Merged docs: suspend CS-RG implementation directives pending revalidation #12 at exact head ae85ebb95b68821361ae59d3c60b5344a1d8ab03; merge commit 418c0da46fc65fea167350e9e0055272a84aab12.
Re-verified the moved base, then merged test(daemon): age the stuck-probe sample from the sampler's time #11 at exact head 2bbe7c5ed88ad3170bc76985bdecb1fd7434d501; merge commit 85f2dbce792d122c04c99d297ca148f7f568ebcf.
Re-verified again, then merged docs(handoff): record the close of the 2026-09-27 session #15 at exact head 760af00c685a3ede87e7b5468e509029c97ad9f1; merge commit 1bb085ad1a75034fe7bd7ffe7dd358b1a336239e.
Current DevGuard main is 1bb085ad1a75034fe7bd7ffe7dd358b1a336239e. Its post-merge Ubuntu/macOS contracts run 36336325471 is currently in progress.
docs(handoff): record the CS-RG boundary revalidation #13 was not merged. Its two handoff files were minimally corrected for evidence strength and dated-snapshot scope; new exact head edf5e2f20f88feed55822a078abffc18af5f9a4e. New-head push/PR CI is currently running. No product, pin, dependency, service, credential or runtime contract change was made.

2026-09-28 01:40 UTC. W0 intake delta for CS-DG-UPSTREAM-ADAPTER-WORK-SPEC-1 v1.0 (new session).

The latest state is the owner direction and the merge-plan execution above. They are not restated here. The issue body is a dated snapshot from 2026-09-27 15:05–15:50Z.

Scope of this pass. The owner instructed this agent directly (wording and times are kept in the local authorization record). The pass may:

complete post-merge verification and evidence preservation for the five merges;
fast-forward local main in both repositories and remove only the five merged task worktrees and their merged local branches;
carry out W0–W2 of the spec as a non-normative record: one DevGuard handoff/research PR, one CodeSpace pointer note, and tracker deltas. Any policy wording appears only as a labelled draft;
run BD-1 under its bounded-diagnostic conditions, or record not_run if the host cannot build it.

The pass stops at the W3 owner gate. It does not merge #13 or the new PRs, run experiments A/B/C, or open normative PRs. It changes no pin, dependency, service or credential.

Baseline (re-queried at 01:20Z after git fetch)

Item	Value
DevGuard `main`	`1bb085ad1a75034fe7bd7ffe7dd358b1a336239e` (merge of #15)
CodeSpace `main`	`326bdcb181f62f61bcb3c4e9c3de7535d50b0232` (merge of CodeSpace #77)
Codex gitlink	`6b9826e3aa83b1a5947db50f4332cb9c65f1b340` (rust-v0.154.0), unchanged
Open PRs	DevGuard #13 only; none in CodeSpace

#13 is at head edf5e2f20f88feed55822a078abffc18af5f9a4e and CLEAN. Its push run 36336395942 and pull_request run 36336399416 succeeded on macOS and Ubuntu (4/4). It stays a separate, unmerged record, and merging it needs the owner's approval of that exact head. The local #13 worktree is deliberately left at its old head 1af1921, two commits behind, and is not used as the current checkout.

Post-merge verification. For each merge, the parents are the previous main and the approved head, and the files match the PR's own diff. Each run was downloaded once; nothing was polled or rerun.

PR	Merge commit	Files	Post-merge `main` runs
#12	`418c0da`	23	36336284259 success
CodeSpace #75	`8a5a924`	11	CI 36336288225 success (documentation-only plan); documentation 36336288630 success, deploy included
#11	`85f2dbc`	1	36336313208 success
#15	`1bb085a`	1	36336325471 success
CodeSpace #77	`326bdcb`	1	CI 36336337315 success (16 jobs, full); documentation 36336337674 success, deploy included

The PR-head CI of #12, CodeSpace #75, #15 and CodeSpace #77, which was not preserved before, has now been collected.

Evidence (local, git-ignored, <DEVGUARD_CHECKOUT>/evidence/; MANIFEST.json sha256 of each set; all sets re-hashed with 0 mismatches and 0 credential-pattern hits)

Set	Contents	MANIFEST.json sha256
`post-merge-2026-09-27/`	merge proofs and 15 runs	`170495cc7c9bc8651caa4d98e29be4805535e6c9ed6b6209f46aec492c86c740`
`post-merge-2026-09-27-cleanup/`	before/after inventories, cleanup record, preserved local files	`10af3d30811647b3a8e93338c6cba065e251d2b342143f61b8f751c728727456`
`upstream-adapter-2026-09-28/pr13-ci-edf5e2f/`	#13 CI	`a5ed821db65ba1e49594730cbd7bc707cae0d528fb65a1d7aa9b36f52331dad5`
`upstream-adapter-2026-09-28/scheduled-run/`	scheduled run on `326bdcb`	`fc205e6c6bbc80ab0be38915555d4830208d2578ee3f5a957e45192dee830617`
`upstream-adapter-2026-09-28/spec-originals/`	byte-identical spec originals (spec sha256 `21c934d76c59116dacbdcff46e2c31e7046c03cfe3cebdab540e3d6900aae2aa`, 57,451 bytes; start instruction `7146aa8af276b9c04b0ce3412bfc69a2f471729babb7a1d43728a437283f36e6`, 4,472 bytes)	`da4cca7d681edd647cb9531f7256a7c77b87a1b4bbcf9d4be2a5804ea4a9a042`

The packet PR will commit copies with trailing whitespace removed and record both sets of digests.

Local alignment and cleanup

Local main was fast-forwarded in DevGuard (7e3cbda to 1bb085a) and CodeSpace (794867e to 326bdcb; gitlink unchanged).
Removed with git worktree remove (no --force) and git branch -d: DevGuard dg-stuck-probe (test(daemon): age the stuck-probe sample from the sampler's time #11), cs-rg-hold (docs: suspend CS-RG implementation directives pending revalidation #12) and session-handoff (docs(handoff): record the close of the 2026-09-27 session #15); CodeSpace cs-rg-hold (#75) and cs-rg-suspension-handoff (#77). Each was clean, at its approved head and contained in main. The two local-only files in dg-stuck-probe were preserved first. Its qualification output was already preserved, and its build cache was not kept.
Kept: every remote branch, the docs(handoff): record the CS-RG boundary revalidation #13 worktree and branch, CodeSpace's fixture and diagnostic branches, and the pre-existing untracked .kiro/ in the DevGuard checkout.

Scheduled CodeSpace run

The old task "read the first scheduled run on 794867e" no longer applies: main moved to 326bdcb at 17:16Z, before any scheduled run on 794867e.
In its place, the first scheduled run on 326bdcb was read: run 36355653598, created 22:32Z, succeeded with 16 jobs. linux_sandbox::tests::prepare_unread_large_stdin_times_out passed, and the Integration log contains no ETXTBSY, "text file busy" or "os error 26". The ETXTBSY failure did not recur in this run, but one run does not prove the race is gone.

Next in this pass: refresh the upstream matrix (pin, latest stable, newest prerelease, main); read how Rust std, mio and tokio create descriptors on macOS; run BD-1 if feasible; then open the packet PR and the CodeSpace pointer PR. The pass stops at the W3 owner gate.

2026-09-28 04:24 UTC. W1–W2 result and W3 owner gate for CS-DG-UPSTREAM-ADAPTER-WORK-SPEC-1 v1.0.

This follows the W0 intake delta and adds only what is new. The pass has stopped at the W3 owner gate.

Records opened (non-normative; nothing merged)

Record	Exact head	Base	CI at the single read (04:21Z)
#16, the W0–W2 packet: `docs/handoff/2026-09-28-upstream-adapter-packet.md`, plus the spec and start instruction as normalized copies	`a67facbbebb192d83126c5afa1a9ef2d713c2e2e`	`1bb085a`	push 36376959954 and pull_request 36376993483: in progress
novelKR/CodeSpace#78, `.github/notes/` pointer to the packet at `a67facb`	`c8912abf50ee090bdc6eaa6054a0ab524210f276`	`326bdcb`	documentation 36377211672: success (collected); CI 36377211087: in progress

The in-progress runs were recorded, not polled. Read them once before any merge.
Also unchanged at the same read: DevGuard main 1bb085a, CodeSpace main 326bdcb, gitlink 6b9826e. docs(handoff): record the CS-RG boundary revalidation #13 is still open at edf5e2f20f88feed55822a078abffc18af5f9a4e and CLEAN.

Key findings (packet sections in brackets)

Upstream [7]. ChildFds::Attached exists at rust-v0.159.0-alpha.11 (72b8d8b) and Codex main (1cc7e23, identical utils/pty tree), not in stable rust-v0.157.1 (3665039). No checked revision offers pre-reap observation, owner-controlled reap or a PTY child PID. From 72b8d8b on, CodeSpace's PTY adapter would need a ChildFds edit in any pin PR.
macOS descriptor creation [8]. Rust std at 1.88.0, 1.95.0 and 1.98.1, mio 1.2.3 and tokio 1.53.1 do not create pipes and sockets close-on-exec atomically, and std Command does not use POSIX_SPAWN_CLOEXEC_DEFAULT. D6 therefore cannot be closed by swapping libraries. The remedy is child-side exclusion in every same-process spawner.
BD-1 [11] was run and is conclusive. Every frozen expectation was met at 72b8d8b:
- 0/2000 unrelated children were observed with an attachment, and 200/200 attached children were correctly delivered;
- the error paths left no parent descriptor and no child;
- a dropped handle's child was gone after 24 ms.
Outside the criteria, unrelated std and tokio children received transient PTY masters (104/2000) and pipe ends (39/2000) from other threads' creation windows. This is behavioural evidence from one run, not proof.
Protocols [9], candidate specifications only:
- A keeps the one-time permit and the wire, and leaves spawning to the existing backend. Open items A-1 to A-7 remain.
- B is a bounded, backend-owned pre-reap observation (waitid with WNOWAIT, then acknowledge or deadline, then one reap). It is a proposal. Tokio has no non-reaping wait, so no thin pipe facility is identified.
- C: D6 remains a prerequisite of every CodeSpace route.
Gates [6].
- scripts/validate.py rejects every codex-* and codespace-* package. The draft replaces this, only in the PR that adds a real component, with per-root allowed reachability.
- In CodeSpace, a transitive codex-utils-pty arriving through a DevGuard client would not be flagged today.
Overall [14]. No complete route satisfying both N1 and N2 is demonstrated. The smallest next steps are experiments A, B and C.

Decisions requested (packet section 14)

Merge docs(handoff): record the upstream-adapter W0-W2 packet #16 at a67facbbebb192d83126c5afa1a9ef2d713c2e2e as a non-normative record, or request changes.
Merge CodeSpace #78 at c8912abf50ee090bdc6eaa6054a0ab524210f276. If docs(handoff): record the upstream-adapter W0-W2 packet #16's head changes first, #78 is updated before merge.
docs(handoff): record the CS-RG boundary revalidation #13 at edf5e2f, decided separately: merge as a dated record, keep open, or close unmerged.
Experiment A (packet 13.1): authorize or not.
Experiment B (packet 13.2): authorize or not. It includes a scratch modification of an upstream utility.
Experiment C (packet 13.3): authorize or not.
Normative reconciliation of the drafts, now or after W3:
- R2: a DevGuard design revision with its Korean counterpart, plus the editorial reference, ADR-006/D3 and AGENTS.md;
- CS: CodeSpace's pages.
- The gate change stays with the first real component.
Upstream submission: deferred until after experiment B.
Optional: an independent CodeSpace descriptor-hygiene proposal (N1.5). CS-RG does not justify it.

Every merge still needs the owner's approval of that exact head. Dependency permission and CodeSpace's pin process are settled and not asked again.

Evidence (local, git-ignored, <DEVGUARD_CHECKOUT>/evidence/)

Seal: upstream-adapter-2026-09-28/MANIFEST.json sha256 f82a9d7b9ba60611c4e76c4c553031396cdbfbc0d847c28f3f2657fd385353f4. It covers 1032 files with 0 credential-pattern hits:
- the six sub-manifests listed in packet section 15;
- the intake, authorization, tracker and PR records;
- this final read.
Every earlier set was re-verified against its manifest just before the seal: 0 mismatches and 0 unlisted files.
This comment's body is kept in the new sibling set upstream-adapter-2026-09-28-close/.

Local state

Kept until the owner's decisions:
- the packet worktree <DEVGUARD_CHECKOUT>/.local/worktrees/upstream-adapter-packet;
- the pointer worktree <CODESPACE_CHECKOUT>/.local/worktrees/upstream-adapter-pointer.
Both are clean and at their PR heads.
The docs(handoff): record the CS-RG boundary revalidation #13 worktree is untouched at 1af1921, and .kiro/ is kept.
The BD-1 scratch directory was removed after preservation.

Next: the owner's decisions above.

Stop boundary: until then there is no merge, no W3 experiment, no normative PR, no pin, dependency, service or credential change, and no upstream submission.

2026-09-28 06:40 UTC. W3 owner decisions received; evidence housekeeping done.

This follows the W1–W2 result and adds only what is new.

Owner decisions (2026-09-28 06:18Z, given directly to the executing agent; a comment through the shared account is not independent proof). The local record keeps the wording.

Merge docs(handoff): record the CS-RG boundary revalidation #13 at edf5e2f20f88feed55822a078abffc18af5f9a4e, after the normal immediate head, base and CI re-check.
Merge docs(handoff): record the upstream-adapter W0-W2 packet #16 at a67facbbebb192d83126c5afa1a9ef2d713c2e2e, after docs(handoff): record the CS-RG boundary revalidation #13 is merged and docs(handoff): record the upstream-adapter W0-W2 packet #16 is re-verified against the moved main. A changed head voids this approval.
Merge docs(notes): point to the DevGuard upstream-adapter packet CodeSpace#78 at c8912abf50ee090bdc6eaa6054a0ab524210f276, after docs(handoff): record the upstream-adapter W0-W2 packet #16 is merged and once its pointer is confirmed to name the merged docs(handoff): record the upstream-adapter W0-W2 packet #16 head. A changed head in either PR means stop for renewed approval.
Experiments A, B and C are authorized exactly within packet sections 13.1, 13.2 and 13.3:
- A preserves the permit, one-shot authorization, no-replay and uncertainty semantics, with no production code or contract change;
- B may modify codex-utils-pty in scratch only, and the backend stays the only child and reap owner;
- C uses synthetic credentials and sessions only and compares protection mechanisms.
A and C run first, with B in parallel where practical. Failed, invalid and inconclusive attempts are kept as evidence.
No normative policy or design PR yet. One evidence-backed W3 decision packet follows the experiments.
Upstream submission stays deferred.
A separate, non-implementation CodeSpace descriptor-hygiene issue is authorized, justified on CodeSpace's own terms, not by CS-RG.

After A, B and C the pass stops again. No production pin, production dependency, integration, service or credential change.

Final CI of the W0–W2 PRs. All succeeded on attempt 1. These runs were in progress at the sealed final read.

PR	Run	Result
#16 at `a67facb`	push 36376959954, pull_request 36376993483	success, 2/2 jobs each (macOS 14, Ubuntu 24.04)
novelKR/CodeSpace#78 at `c8912ab`	CI 36377211087	success, 16/16 jobs
novelKR/CodeSpace#78	documentation 36377211672	success (already in the sealed set)

Evidence housekeeping (local, git-ignored, <DEVGUARD_CHECKOUT>/evidence/)

New post-seal set upstream-adapter-2026-09-28-postseal/, MANIFEST.json sha256 d6372359483dcad874a29e67884ac8f286c372fa14f1bcf66b7d919be718bde0 (470 files, 0 credential-pattern hits). It holds:
- the three runs above;
- the independent audit's itemized notes;
- git diff 136d452 a67facb, the commit that fixed them.
The sealed sets f82a9d7b… and f69bffc7… are unchanged.
Audit notes. The original output of the read-only audit had not been saved to a file. The 20 itemized notes are now reconstructed verbatim from the session transcript and marked as a reconstruction, with a map from each note to its fix. The auditor's internal working notes were never available.
Backup. The whole evidence directory (25,871 files, 484 MB) was copied to a second local preservation location. It is on a different physical disk, not cloud-synced, readable by the owner account only, and not published.
- The copy was verified file by file: 0 missing, 0 extra, 0 differing.
- All 58 manifests in the copy verify.
- Tree digest 26fc181f313fa255684170b87e1ab45c9063dad17744a87f7dee1f0e79117e2e. The location is recorded locally only.

Pre-flight (06:27Z): no head has changed.

DevGuard main is 1bb085a and CodeSpace main is 326bdcb.
docs(handoff): record the CS-RG boundary revalidation #13's base moved from 7e3cbda. Its pull_request run 36336399416 had already tested exactly 499a74e, "Merge edf5e2f into 1bb085a", GitHub's current test merge, whose tree matches a local merge simulation.

Next: the three merges, in order, each with an immediate re-check. Then experiments A and C, with B in parallel where practical; the CodeSpace hygiene issue; one W3 decision packet; and a stop.

2026-09-28 07:23 UTC. W3 merges done and verified.

PR	Approved head	Merge commit	Post-merge `main` CI
#13	`edf5e2f20f88feed55822a078abffc18af5f9a4e`	`8f425ecb8438fea20897976446fadc9e7e142436`	36387864117: success, 2/2
#16	`a67facbbebb192d83126c5afa1a9ef2d713c2e2e`	`9e21cc8f707f16b7da98490293b5ea7e4548916d`	36387939532: success, 2/2
novelKR/CodeSpace#78	`c8912abf50ee090bdc6eaa6054a0ab524210f276`	`ab0341b5cf5eda8c82730487d4475f1ac922daf5`	CI 36388007427: success, 16/16; documentation 36388008255: success, deployed

Order and checks. Each merge used gh pr merge --merge --match-head-commit after an immediate head and base re-check.
- docs(handoff): record the CS-RG boundary revalidation #13: its CI had already tested exactly the merge with 1bb085a.
- docs(handoff): record the upstream-adapter W0-W2 packet #16: re-verified against the moved main. The files are disjoint, and on the exact merge tree check_docs, its tests and diff --check passed.
- #78: its note still names the merged docs(handoff): record the upstream-adapter W0-W2 packet #16 head.
- Each merge commit's parents and tree match the checked result. The gitlink is unchanged (6b9826e).
Local alignment. Local main was fast-forwarded in both repositories. Only the three merged PR worktrees and their local branches were removed, with git worktree remove and git branch -d. All remote branches are kept.
Anomaly. CodeSpace shows a second, identical push event for main (326bdcb → ab0341b) at 06:50Z, with a second successful CI and documentation pair (36388426590, 36388427669). main did not move again, and nothing was pushed by this agent. The cause is undetermined; both pairs are preserved.
Evidence (local): w3-2026-09-28/post-merge-ci/, MANIFEST.json sha256 b7c74ba9fe59a7f21e1da55b392781833f0758d8c591e0618037b17343648a3e.

Next: experiments A and C, with B in parallel where practical. Their protocols were frozen at 07:11:16Z before any build.

2026-09-28 10:19 UTC. W3 result: experiments A, B and C done; stopped at the next owner gate.

This follows the merge record and adds only what is new.

Record opened (non-normative; nothing merged)

Record	Exact head	Base	CI at the single read (10:18Z)
#17, the W3 decision packet: `docs/handoff/2026-09-28-w3-decision-packet.md`	`70c814c93a96f383e3241b6817fe6d42aea9ea48`	`9e21cc8`	push 36408700221 and pull_request 36408760157: in progress. Recorded, not polled; read once before any merge

Also opened: novelKR/CodeSpace#79, the descriptor-hygiene investigation. It is non-implementation and justified on CodeSpace's own terms.

How the experiments ran

Protocols were frozen with SHA-256 digests before any build. Three dated amendments followed, each written before the runs it affects.
Failed and invalid attempts are kept; harness defects are logged.
Codex 72b8d8b was unmodified for A and C. B used a scratch copy with one generic observer patch, not submitted.
The authority was DevGuard's fixture, with synthetic credentials only. The installed LaunchAgent was untouched: the same pid before and after.
Nothing was pushed except docs(handoff): record the W3 experiments and decision packet #17. The experimental DevGuard branch codex/exp-a-preparation (b50e437) is local only.

Results (macOS, one host; behavioural evidence, not proof; details in #17 section 3)

A: preparation without spawn takeover.
- A permit-preserving preparation, consumed by Codex's unmodified PTY ChildFds::Attached with DevGuard's unchanged helper, wire and authority, preserved single use, first-claim-wins, fencing, no replay and the known-not-started rules.
- The binding needed no PID accessor.
- The frozen FIFO carriers did not work: on this host poll reports no EOF on a drained FIFO, so the unchanged readers fail closed or report Lost. The amended run used today's carriers, and an atomic regular-file permit worked.
- With Attached, a PTY signal death still reports exit 1.
B: backend-owned pre-reap observation. A generic scratch patch keeps the backend as the only reaper: it observes before it reaps, bounded by a fixed timeout.
- It turned the reap-first survivor case into normal release. 50/50 healthy survivor runs returned their reservations; without it, the loss stayed sticky (3/3).
- Stalls, crashes, handle drops, runtime shutdown and an unavailable authority all ended in one reap and conservative states. Every observed child was reaped exactly once, by the backend (125/125).
- Finding: on the PTY path, a same-group background descendant receives SIGHUP when the root exits.
C: attachments and client sessions.
- Unrelated std and Tokio children inherited DevGuard's session socket (about 6–12 % per cell under continuous creation) and today's launch carriers.
- A deliberate holder of an inherited session read the permit-bearing reply and injected a Cancel that the authority executed. A holder of the permit carrier claimed the grant; a holder of the transcript forged READY.
- Kernel close-by-default in the spawner (Codex DescriptorPolicy::Explicit) removed every class in both samples. An atomic file permit removed the permit class. spawn_guard helps only code that takes it.

Candidate status (#17 section 4). The smallest complete macOS PTY InProcess candidate is now concrete, but not proven or approved:

Y + A through Attached;
B, as an upstream generic observation;
an atomic file permit;
a D6 remedy.

D6 is the open item that decides feasibility under N1.

Decisions requested (#17 section 6)

Merge docs(handoff): record the W3 experiments and decision packet #17 at 70c814c93a96f383e3241b6817fe6d42aea9ea48 as a non-normative record, or request changes.
Whether to prepare a generic upstream proposal for B. Submission needs its own approval.
The D6 direction, to develop as a protocol:
- (a) kernel close-by-default in every same-process spawner;
- (b) a DevGuard client-session redesign;
- (c) both;
- (d) first the #79 diagnostic.
The carrier direction: file permit + pipe transcript + spawner hygiene; RC; or FIFO-capable readers.
Whether to prepare the normative DevGuard and CodeSpace policy PRs now.
Keep or remove the local branch codex/exp-a-preparation (removal needs git branch -D).
Whether to authorize #79's bounded, CodeSpace-owned diagnostic.

Evidence (local, git-ignored, <DEVGUARD_CHECKOUT>/evidence/)

W3 seal w3-2026-09-28/MANIFEST.json: sha256 4325880a86e4bc408e7aab427508449a8dd04e8457538685f411abc48c7e86c8, 22,290 files, 0 credential-pattern hits.
- Experiments sub-seal: ce342e98d54eba653f6400489d0b4569f3bc1edfda9d76b3fe0b55ca151bf1bb.
- Post-merge CI sub-seal: b7c74ba9fe59a7f21e1da55b392781833f0758d8c591e0618037b17343648a3e.
All earlier sets were re-verified just before the seal: 0 mismatches.
The sealed W3 set was copied to the second local preservation location and verified: 44,541 manifest entries, 0 mismatches.
One erratum to a sealed record is kept alongside, not by editing the sealed file.

Next: the owner's decisions above.

Stop boundary: until then there is no production Codex pin change, no production dependency, no CodeSpace/DevGuard integration, no service or credential change, no normative policy PR and no upstream submission.

2026-09-28 11:41 UTC. Session close: W3 complete; stopping at the next owner gate.

This is a session-close delta. It follows the W3 result. The issue body and older comments are dated history.

A. Session status

W3 experiments A, B and C are complete. The record is docs(handoff): record the W3 experiments and decision packet #17, section 3.
docs(handoff): record the CS-RG boundary revalidation #13, docs(handoff): record the upstream-adapter W0-W2 packet #16 and docs(notes): point to the DevGuard upstream-adapter packet CodeSpace#78 were merged earlier in this session at their approved heads and verified, with green post-merge CI.
docs(handoff): record the W3 experiments and decision packet #17 is the current non-normative W3 decision record. It is open and unmerged.
No production integration has begun, and the CS-RG implementation hold stays in force.
The session stops here, at the next owner gate.

B. Exact GitHub state (read once at 11:37:58Z)

Item	State
DevGuard `main`	`9e21cc8f707f16b7da98490293b5ea7e4548916d`
#17	OPEN, not draft, head `70c814c93a96f383e3241b6817fe6d42aea9ea48`, base `main` at `9e21cc8`, mergeable MERGEABLE, merge state UNSTABLE (one check failed), 0 reviews. Only change: `docs/handoff/2026-09-28-w3-decision-packet.md`
CodeSpace `main`	`ab0341b5cf5eda8c82730487d4475f1ac922daf5`
CodeSpace Codex gitlink	`6b9826e3aa83b1a5947db50f4332cb9c65f1b340` (rust-v0.154.0)
novelKR/CodeSpace#79	OPEN; investigation and proposal only

Final CI of #17 (not rerun):

Run	Event, tested commit	macOS 14	Ubuntu 24.04
36408700221	push, `70c814c`	success (all steps, including every native qualification suite)	success
36408760157	pull_request, `5d6f48d` = merge of `70c814c` into `9e21cc8`	failure in "Contract regression and workspace validation"; native suites skipped	success

C. #17 CI failure classification

docs(handoff): record the W3 experiments and decision packet #17 is documentation-only.
Failing test: a_drain_that_does_not_finish_in_time_keeps_the_current_release_and_its_charges (crates/daemon/tests/upgrade.rs). It failed at line 372, assert!(started.elapsed() < Duration::from_secs(10)).
The expected error had already been returned. Lines 370–371 passed first, so the upgrade returned ResourceUnavailable with a message containing "did not finish". The safety-state assertions after line 372 did not run in that run.
Same tree. The two runs tested the same repository tree (add5725…). The merge commit is a fast-forwardable merge, so its tree equals 70c814c's. That tree passed this test twice in the push run's macOS job: in the contract stage and in the native upgrade suite.
No evidence ties the failure to docs(handoff): record the W3 experiments and decision packet #17. Which internal step exceeded the whole-upgrade 10 s bound is unknown. The upgrade test binary took 432.66 s in the failing run, against 394.91 s in the passing contract stage.
Not labelled a known flaky test. No independent prior failure is established; a bounded search of the preserved local logs found none.
Current classification: a timing-sensitive intermittent CI failure, not evidence of a product regression introduced by docs(handoff): record the W3 experiments and decision packet #17.
The failure exposed two separate future CI and test-hardening concerns (pending follow-up; nothing was changed in this session):
1. documentation-only changes should not necessarily trigger every unrelated native qualification suite;
2. the upgrade timeout test should separate its safety-state assertions from its broad whole-upgrade wall-clock assertion.

D. Outstanding owner decisions (all unresolved; from #17 section 6)

Merge docs(handoff): record the W3 experiments and decision packet #17 at 70c814c or not, after considering its CI evidence (C above). Mergeability does not imply approval.
B upstream proposal: whether to prepare a generic proposal to Codex. Submission would need its own approval.
D6 direction:
- (a) kernel close-by-default in every same-process spawner;
- (b) a DevGuard client-session redesign;
- (c) both;
- (d) first the #79 diagnostic.
Permit and transcript carrier: a file permit plus pipe transcript with spawner hygiene; RC; or FIFO-capable readers.
Normative policy and design PRs: when to prepare them (DevGuard R2 and G, CodeSpace CS). None exists yet.
Local experimental branch codex/exp-a-preparation (at b50e437): keep or remove. Removal would need git branch -D, which is not authorized.
#79: whether to authorize its bounded, CodeSpace-owned diagnostic.

Newly identified, independent follow-up tracks. Not started, and not part of the W3 architecture decision:

DevGuard affected-check and selective CI planning;
DevGuard upgrade-timeout test hardening.

What is where

Merged, on main: in the previous session, test(daemon): age the stuck-probe sample from the sampler's time #11, docs: suspend CS-RG implementation directives pending revalidation #12, docs(handoff): record the close of the 2026-09-27 session #15 and docs: mark the planned CS-RG managed-execution design as suspended CodeSpace#75, #77; in this session, docs(handoff): record the CS-RG boundary revalidation #13, docs(handoff): record the upstream-adapter W0-W2 packet #16 and docs(notes): point to the DevGuard upstream-adapter packet CodeSpace#78.
Only experimented with (not in any product):
- experiment A's preparation module, on the local branch codex/exp-a-preparation at b50e437, never pushed;
- experiment B's scratch patch to codex-utils-pty, never pushed or submitted;
- experiment C's harnesses, in scratch.
The scratch directories were removed after preservation.
Local-only: the evidence sets under <DEVGUARD_CHECKOUT>/evidence/ (W3 seal 4325880a…; this close's set session-close-2026-09-28/), their private backup copies, that local branch, and the docs(handoff): record the W3 experiments and decision packet #17 worktree.
Normative versus non-normative: no normative document, gate, manifest, lock, Codex pin, dependency, service or credential changed in W3. docs(handoff): record the W3 experiments and decision packet #17 and the W0–W2 packet are non-normative records.

Cold-start order for the next session

Read this comment, the latest on Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) #14.
Read docs(handoff): record the W3 experiments and decision packet #17 at its exact current head.
Read the latest comment on Handoff: CS-RG managed-execution suspension (#75) and the DevGuard boundary revalidation (2026-09-27) CodeSpace#76.
Read Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79.
Re-query both main heads, docs(handoff): record the W3 experiments and decision packet #17's state and checks, #79's state and the Codex gitlink.
Treat issue bodies and older comments as dated history; later comments are deltas.
Do not infer an owner decision from a proposal, a successful experiment, a mergeable state or a CI success.
Get or consume the owner's next explicit decision before advancing any unresolved track.

E. Stop boundary. After this comment, none of the following will occur in this session:

a merge;
an experiment;
an implementation;
a pin or dependency change;
a normative PR;
an upstream submission;
a service or credential change.

2026-09-28 19:06 UTC. Post-close local housekeeping delta.

These are factual deltas since the session-close comment. They change none of the history recorded there. Cold start: read this comment first, then the session-close comment, and follow that comment's order.

main now

DevGuard: 27fafeb42358a977adf1f03409dc0755a2d61a30.
CodeSpace: ab0341b5cf5eda8c82730487d4475f1ac922daf5. The Codex gitlink is 6b9826e3aa83b1a5947db50f4332cb9c65f1b340, unchanged.

Corrective and hardening work merged after the session close

#19 merged at 17:58Z: head 92a0611e442baf277b9b578c087c8028984da1f1, merge commit 7b1548abd6faa2cfb50136afb2a9565caaab275e.
- It is test-only hardening of the drain-timeout upgrade timing assertion.
- Post-merge main run 36461939240 succeeded.
#18 merged at 18:29Z: head 556651cbe3222479697afbd52765d8a4f1814706, merge commit 27fafeb42358a977adf1f03409dc0755a2d61a30.
- It adds affected, selective CI planning, so that a docs/handoff/**-only change like docs(handoff): record the W3 experiments and decision packet #17 no longer selects unrelated Rust or native qualification.
- Post-merge main run 36465568891 succeeded. All five jobs passed: Plan, Repository checks, contracts on macOS 14, contracts on Ubuntu 24.04, and Required checks.
These are later work. They do not rewrite docs(handoff): record the W3 experiments and decision packet #17's CI history.
- Attempt 1 of docs(handoff): record the W3 experiments and decision packet #17's pull_request run 36408760157 (the macOS failure recorded in the close comment) remains the motivating observation.
- That run was re-run outside this session: attempt 2 started at 18:31Z and completed with success on both jobs.
- Neither ci: plan affected validation instead of running every native suite #18 nor test: harden the drain-timeout upgrade timing assertion #19 decides whether docs(handoff): record the W3 experiments and decision packet #17 is merged.
The close comment's line that both follow-up tracks were "not started" is now historical.

Local housekeeping

Sync. git fetch origin --prune ran in both repositories; nothing was pruned. Each local main was updated by fast-forward only: DevGuard went from 9e21cc8 to 27fafeb; CodeSpace was already at ab0341b. Both now equal origin/main.
Removed, after their post-merge CI succeeded, with git worktree remove and git branch -d only:
- the test: harden the drain-timeout upgrade timing assertion #19 worktree and its branch codex/upgrade-drain-timeout-timing, at 92a0611, its merged head;
- the ci: plan affected validation instead of running every native suite #18 worktree and its branch codex/ci-affected-validation, at 094b0b7, an ancestor of the merged head 556651c.
Both were clean and had no commits outside main. Their local qualification outputs (42 files) were copied into a new, additive local evidence set before removal. Their remote branches are kept.
Retained unchanged:
- the docs(handoff): record the W3 experiments and decision packet #17 worktree and branch, at 70c814c (docs(handoff): record the W3 experiments and decision packet #17 is still open and unmerged);
- the local-only codex/exp-a-preparation at b50e437, whose disposition is an owner decision.
Untouched: existing evidence sets, private backups and .kiro/; their file listings are identical before and after. Neither repository has a stash. No remote branch was deleted.

Not advanced:

no product implementation, pin, dependency, service or credential change;
no normative architecture change;
no upstream submission;
no unresolved owner decision.

The seven decisions listed in the close comment remain open.

2026-09-30 09:17 UTC. Owner decision 1 executed: #17 merged.

This is a delta since the post-close housekeeping comment. It changes none of the history recorded there or in the session-close comment. Cold start: read this comment first, then the session-close comment, and follow that comment's order. The W3 record is now on main: docs/handoff/2026-09-28-w3-decision-packet.md.

Authorization

A new session made a read-only cold-start intake and stopped at the owner gate.
The owner then approved one bounded action in that session: decision 1. That covers merging docs(handoff): record the W3 experiments and decision packet #17 as a non-normative record after re-verifying it against the moved main, with its evidence, these tracker updates and the local cleanup.
The approval was given to the executing agent directly. This comment, written through the shared account, is not independent proof of it.
Merging records the W3 packet. It approves nothing proposed in it.

main now

DevGuard: 4898259a8a5b7c2ed0b3a46a3567cb419b0a73d5.
CodeSpace: ab0341b5cf5eda8c82730487d4475f1ac922daf5, unchanged. The Codex gitlink is 6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0), unchanged.

The merge

#17 merged at 09:12Z at its exact head 70c814c93a96f383e3241b6817fe6d42aea9ea48, with --match-head-commit, into main at 27fafeb. Merge commit: 4898259a8a5b7c2ed0b3a46a3567cb419b0a73d5.
Why it was re-verified first:
- main had moved from 9e21cc8 to 27fafeb (test: harden the drain-timeout upgrade timing assertion #19, ci: plan affected validation instead of running every native suite #18) after docs(handoff): record the W3 experiments and decision packet #17's CI ran, leaving docs(handoff): record the W3 experiments and decision packet #17 10 commits behind.
- Both attempts of pull_request run 36408760157 tested the old test merge 5d6f48d under the pre-ci: plan affected validation instead of running every native suite #18 workflow. Attempt 2, the re-run of 2026-09-28 18:31Z, succeeded. Attempt 1's macOS failure stays in history.
- No PR run existed under the current CI policy. main has no branch protection, so GitHub's CLEAN state was not a gate.
Pre-merge check, on a local simulation of the exact merge that was never pushed:
- the diff against 27fafeb was the single added file, giving tree dd80c0b;
- the current planner selected affected: whitespace and documentation, with no Rust and no native suites;
- validate.py --stages whitespace,documentation --diff-base 27fafeb passed. check_docs.py reported 17 pairs, 48 units and 25 groups.
- A first validation run was invalid, although both stages had passed. A console log written inside the checked worktree tripped the validator's source-fingerprint guard. That run is kept, and the re-run on the unchanged tree passed.
Merge verification:
- state MERGED;
- parents 27fafeb and 70c814c;
- the merge tree equals the verified dd80c0b;
- the diff against the first parent is the one file.
Post-merge main: push run 36694632828 succeeded.
- Its plan was affected, with the same changed-path digest as the local plan.
- Plan, Repository checks (whitespace and documentation) and Required checks passed. contracts was skipped by the plan.

Differences between live state and the handoff that started the session (the handoff predated the 19:06Z comment)

The two CI follow-up tracks were already done (ci: plan affected validation instead of running every native suite #18, test: harden the drain-timeout upgrade timing assertion #19), so seven decisions were open, not nine.
main had moved, and docs(handoff): record the W3 experiments and decision packet #17's failed attempt had been re-run, as above.
A full scheduled run on 27fafeb succeeded: 36639194089, 2026-09-29 22:22Z, including every macOS native suite. It ran test: harden the drain-timeout upgrade timing assertion #19's hardened test, so it says nothing about the original assertion.

Upstream facts not in any earlier record (read from source; nothing is qualified or selected)

Stable Codex releases now include ChildFds::Attached.
- rust-v0.159.0 (687a119), rust-v0.159.1 (8e68a98) and rust-v0.159.2 (ff6aec9) were published on 2026-09-29 as non-prereleases. rust-v0.159.2 is the latest.
- At .0 and .1, codex-rs/utils/pty is tree db23e5b. That is identical to 72b8d8b (rust-v0.159.0-alpha.11), the revision BD-1 and W3 used.
- .2 and Codex main (d420560) have tree d348b8c, with pty.rs and process.rs unchanged. Pre-reap observation (K3) and a PTY child PID accessor (X) are still absent.
- So the W0–W2 packet's conclusion that Attached is in no stable release (section 7) is dated. A released tag is now a possible candidate class for Y + A.
- Lockfiles and behaviour at these tags were not compared. Spec §5.4 requires showing that the earlier evidence still applies.
Codex accepts no external code contributions or pull requests.
- Source: docs/contributing.md, policy commit 31f23b6 of 2026-08-17. That commit is already an ancestor of the pin 6b9826e.
- Contributions go through issues. The W0–W3 records do not mention this.
- So decision 2 can only mean an issue-based proposal, and B's upstream path depends on the Codex team implementing the facility.

Evidence (local, git-ignored, not published)

pr17-merge-2026-09-30/: the intake, pre-merge checks, merge verification and post-merge CI. MANIFEST.json SHA-256: 74077ef983335c12a9ab29c2e6a30c49b0d8483767d4eb2aa816c20247a5d6fd.
- It preserves attempt 2 of run 36408760157, which no earlier set held.
- The 19 earlier evidence sets of this chain were re-verified file by file: 0 mismatched, 0 missing, 0 unlisted.
pr17-merge-2026-09-30-cleanup/: 5c8037623ceb74359c1f5c407ae26f8acad0f2a7d32ee011c87bd4c75719409f.
This comment's records follow in pr17-merge-2026-09-30-comment/.

Local housekeeping

Removed, with git worktree remove and git branch -d only:
- the docs(handoff): record the W3 experiments and decision packet #17 worktree and its local branch codex/w3-decision-packet-2026-09-28, at 70c814c, now in main;
- the scratch verification worktree.
The remote branch is kept.
Local main was fast-forwarded to 4898259.
Retained unchanged: codex/exp-a-preparation at b50e437 and its worktree (decision 6), the earlier evidence sets and .kiro/. Their file listings are identical before and after.

Open owner decisions (6), numbered as in #17 section 6:

The B upstream proposal. It can now only be an issue-based proposal.
D6 direction:
- (a) close-by-default in every same-process spawner;
- (b) a DevGuard client-session redesign;
- (c) both;
- (d) the Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79 diagnostic first.
The permit and transcript carrier.
The normative R2 and CS PRs.
codex/exp-a-preparation: keep or remove.
Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79: authorize its bounded diagnostic.

Not changed:

no product code, contract, CI, test, pin, dependency, service or credential;
no CodeSpace change;
no normative PR;
no upstream contact.

The CS-RG implementation hold stays in force.

Next allowed action: the owner's decisions above.

2026-09-30 15:33 UTC. Work package A: the R2 and CS documentation PRs are prepared, not merged. The owner's staged pin direction is recorded.

This is a delta since the #17 merge comment. Cold start: read this comment first, then the session-close comment, and follow that comment's order.

Owner decisions of 2026-09-30

These were given to the executing agent in the continuation prompt and in answers during the session. This comment, written through the shared account, is not independent proof of them.

Decision 5, normative reconciliation: prepare the DevGuard R2 and CodeSpace CS documentation PRs. Do not merge them. (Done below.)
Decision 7, Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79: steps 1–2 (inventory and a frozen protocol) and one bounded run on rust-v0.154.0. This is work package B, next.
Decision 3, D6: not decided. Only a paper analysis of option (b) is authorized. This is work package C.
Decision 6: keep codex/exp-a-preparation unchanged.
Decisions 2 and 4: deferred.
Clarifications:
- Living normative text is updated in place.
- Dated decision records keep their wording and gain dated annotations.
- Hold notices are amended only as far as needed.
- README.md:49 is included as an additional search hit; README.md:41 is unchanged.
- The #79 run measures only the actual Runner pipe and PTY paths. The UDS worker and patch helper are recorded as not_run.
- Work packages run strictly in order. A failed required check stops all of them until the package is complete.

The PRs

PR	Exact head	Content	CI on that head
#20	`9d223bbd3529d6996fb8ebabeedae5458d31f498`	Design revision 2 and its reviewed Korean counterpart; reconciliation of `AGENTS.md`, `README.md`, the design reference, the milestone and planning indexes, and ADR-006/D3; and one CI policy entry that classifies the new revision (below)	success: run 36727872234, `full` profile; Plan, Repository checks, both contracts legs and Required checks
novelKR/CodeSpace#80	`8a414e8fcb50f262fce1f9f566cb52d79d5077da`	The D3 row of `codex-reuse` is annotated as superseded; `upstream-update` gains a dated addition on the binding identity rule; revision 2 is linked at `9d223bbd3529d6996fb8ebabeedae5458d31f498`	success: CI 36727905220 and Documentation site 36727906694

What revision 2 records:
- DevGuard consumes external implementations, Codex included, only through declared adapters with reviewed, immutable pins.
- The authority core and the generic client contract carry no CodeSpace or Codex product types.
- Each dependency is justified by what it replaces and by how its cost is contained.
- scripts/validate.py still rejects every codex- and codespace- package until gate change G.
- Nothing is selected, and the CS-RG hold stays in force.
Search. Every hit of the repository-wide search is listed in the PR bodies. One hit is not in the W0–W2 inventory: README.md:49, which is updated.
A required check failed first; it is kept as fail-closed evidence.
- docs: record design revision 2 for adapter-bounded external dependencies #20's first head, 637627e, failed its Plan job in pull_request run 36725816252. CI's policy test test_every_tracked_path_is_classified rejected the new, unclassified docs/design-revision-2.md. The pre-PR local checks had not run those policy tests.
- Work stopped, and the owner authorized one narrowly scoped exception to the session's prohibition on CI changes: in docs: record design revision 2 for adapter-bounded external dependencies #20 only, add docs/design-revision-2.md to the normative class of scripts/ci-policy.json, next to docs/design-revision-1.md.
- Commit 9d223bb adds exactly that entry. No workflow, planner behaviour, test, suite or other policy entry changed.
- #80's links were then moved to docs: record design revision 2 for adapter-bounded external dependencies #20's new head (8a414e8). #80's earlier green runs on 4149ec1 are superseded and kept.
Merge approvals requested:
- docs: record design revision 2 for adapter-bounded external dependencies #20 at 9d223bbd3529d6996fb8ebabeedae5458d31f498, then docs: mark D3 superseded and record the DevGuard binding identity rule CodeSpace#80 at 8a414e8fcb50f262fce1f9f566cb52d79d5077da.
- If docs: record design revision 2 for adapter-bounded external dependencies #20's head changes again, #80's links are updated first.
- Nothing is merged.

Evidence (local, git-ignored, not published)

wp-a-2026-09-30/: the snapshot sealed at the stop. MANIFEST.json SHA-256: 6f1a9dfb3ad97c2afd6cad1fcaf332a21fc2b99e216ca2dd12681bf234373e0a.
wp-a-2026-09-30-continued/: the fix, the new local checks and the CI of both current heads. MANIFEST.json SHA-256: e51baacaf19a57c312700f6392c83deb9e6015de0422168ab273f18f20eaf028.
This comment's records follow in wp-a-2026-09-30-comment/.

The owner's dated planning direction of 2026-09-30, recorded verbatim. It is non-normative and changes no decision above. It authorizes no pin change, dependency change, implementation, merge or promotion.

Section 12 of the owner's continuation prompt of 2026-09-30: the staged Codex pin strategy

12. Staged Codex pin strategy after the current A/B/C work

This section records the intended future migration shape, so that later agents do not infer that CodeSpace and
DevGuard must move their Codex pins in lockstep. It is planning direction only. It does not override sections 5 or
10, and it authorizes no pin change, dependency change, implementation, merge or production promotion in the current
session. Work package A records it on #14 as the owner's dated, non-normative planning direction.

12.1 Transitional strategy

Until a separately reviewed CodeSpace pin change is approved:

CodeSpace remains on its existing reviewed baseline, currently Codex gitlink
6b9826e3aa83b1a5947db50f4332cb9c65f1b340 (rust-v0.154.0).
Continue the currently authorized CodeSpace work, including the bounded #79 work of section 7, against that
baseline unless a later owner decision says otherwise.
A future DevGuard work package may independently evaluate and, if separately approved, consume a reviewed stable
Codex rust-v0.159.x source identity.
A DevGuard-only move to 0.159.x does not imply, authorize or require an immediate CodeSpace pin move.
A later CodeSpace move from 0.154 to 0.159.x is a separate reviewed pin decision, with its own qualification
and rollback evidence.

The intended migration is staged rather than lockstep:

current:                  CodeSpace 0.154     DevGuard current production (no Codex dependency)
future candidate stage:   CodeSpace 0.154     DevGuard 0.159.x candidate
later convergence stage:  CodeSpace 0.159.x   DevGuard 0.159.x

Each transition is separately reviewed and qualified.

12.2 Same-executable versus separate-executable rule

Keep the W0–W2 executable-identity distinction explicit.

Separate executable or process boundary. When DevGuard consumes Codex only inside a separate DevGuard executable,
or inside a declared execution or platform adapter that is not linked into the CodeSpace executable:

DevGuard and CodeSpace do not have to move their Codex pins in lockstep.
DevGuard may qualify a reviewed 0.159.x identity while CodeSpace remains at 0.154.
The compatibility surface is the product boundary:
- wire and capability negotiation;
- attempt identity;
- helper and launch semantics;
- permit and transcript semantics;
- error mapping;
- result and evidence contracts;
- artifact provenance.
Do not require Codex Rust types or source identity to cross that boundary.

Same executable. If a DevGuard component becomes linked into a CodeSpace executable:

that executable must have one reviewed Codex source identity;
do not create a graph in which CodeSpace brings Codex 0.154 while a linked DevGuard crate independently brings
Codex 0.159.x;
the DevGuard generic client contract that CodeSpace links must remain free of Codex and CodeSpace product types,
unless a later explicit design decision changes that contract;
a DevGuard adapter that needs Codex stays outside that shared-client graph, unless the executable's Codex identity
is deliberately unified and jointly qualified.

This rule is not yet enforced: CodeSpace's gates do not reject a second source of a codex-* crate today (W0–W2
packet §6). The first PR that puts a DevGuard crate into a CodeSpace graph adds the executable single-identity check.

Do not solve a version mismatch by moving PTY, spawn, reaping or lifecycle ownership from CodeSpace to DevGuard.

12.3 What a DevGuard-first `0.159.x` move would and would not prove

A future DevGuard 0.159.x qualification may establish facts such as:

stable ChildFds::Attached behaviour;
stable DescriptorPolicy::Explicit behaviour;
launch-attachment and descriptor-hygiene properties;
whether W3 A and C evidence still applies to a released revision;
DevGuard adapter compatibility;
dependency, feature, MSRV, packaging and rollback effects.

It does not by itself establish that CodeSpace's current PTY path has those capabilities. While CodeSpace remains
pinned to 0.154:

its PTY behaviour remains the behaviour of the pinned CodeSpace backend;
a DevGuard 0.159.x dependency does not silently upgrade CodeSpace's PTY backend;
W3 Y + A cannot be called a production CodeSpace path merely because a separate DevGuard process has Attached;
CodeSpace's current pipe path remains its current Tokio path unless separately changed for a CodeSpace-owned reason.

The W3 smallest candidate needs Attached in CodeSpace's own Codex, because it is macOS, PTY, InProcess: Y + A
through ChildFds::Attached in CodeSpace's backend. It therefore depends on the convergence stage (12.7) and on B,
which no stable release provides. It does not depend on work package D.

Do not report a DevGuard-only 0.159.x qualification as CodeSpace pin qualification.

12.4 Future work package D: DevGuard-only stable candidate refresh

This work package requires a separate owner authorization after the current A/B/C work. When authorized, it is
evidence-first and does not change the CodeSpace gitlink.

Prerequisites.

Work package D can adopt a dependency only after the R2 revision of work package A is merged.
The adopting PR itself carries gate change G, because scripts/validate.py still rejects every codex- package.
Until then, evaluation runs in scratch or an unpushed worktree, as in W3.
The package names:
- the DevGuard consumer (executable and adapter) and what the dependency replaces;
- its runtime cost: a Tokio multi-thread runtime, waiter tasks and the codex-child-reaper thread;
- the negative dependency assertions of spec §15.3;
- Linux explicitly as not_run or unsupported under DG-LINUX, including the K9 spawn-helper question.

Candidates. At the start, re-query upstream rather than assuming a particular patch release is still the latest.
Use:

rust-v0.159.0 as the stable continuity control for the W3 rust-v0.159.0-alpha.11 evidence: its utils/pty
tree (db23e5b) is identical to W3's;
the latest non-prerelease rust-v0.159.x release at that time as the primary DevGuard candidate, to be reviewed
within this package, unless source review gives a reason to select another immutable revision.
- At rust-v0.159.2, the utils/pty tree (d348b8c) differs from W3's, although pty.rs and process.rs are
  unchanged.
- Review the changed files before carrying any W3 evidence forward;
CodeSpace rust-v0.154.0 as the existing production and control baseline.

Evaluation. Cover at least:

Source and dependency delta:
- relevant Codex crates only;
- lockfile and resolved package identities;
- features;
- MSRV and toolchain;
- packaging, licensing and provenance effects.
W3 evidence refresh:
- ChildFds::Attached;
- DescriptorPolicy::Explicit;
- the experiment A claims actually relied upon;
- the experiment C descriptor behaviour actually relied upon;
- signal, EOF and failure behaviour where it matters to the candidate.
Boundary validation:
- no Codex product type enters the authority core;
- no Codex product type enters the generic client or wire contract;
- no second Codex source identity appears inside a CodeSpace executable;
- DevGuard's resource and authorization invariants remain N2-complete.
Remaining gaps:
- generic pre-reap observation;
- PTY child PID access, if still relevant;
- carrier requirements;
- D6 requirements.
Rollback:
- the exact immutable previous identity;
- the artifacts and qualification evidence needed to return safely;
- no silent CodeSpace pin movement.

A source match alone is not qualification. Preserve behavioural evidence separately from source identity.

12.5 Transitional compatibility gate

Before treating a DevGuard 0.159.x candidate as usable with the existing CodeSpace baseline, explicitly qualify the
transitional combination:

CodeSpace 0.154 + DevGuard 0.159.x

This gate applies only once an approved integration slice gives CodeSpace a DevGuard consumer. While CS-RG stays
suspended, record it as not_applicable, never as passed.

It is separate from both DevGuard's own 0.159.x qualification and a later CodeSpace 0.159.x qualification. Verify
at least:

wire and capability compatibility;
attempt and generation identity;
authorization and no-replay behaviour;
helper, permit and transcript semantics;
error and uncertainty mapping;
evidence and result compatibility;
process and resource lifetime boundaries;
independence of CodeSpace's governance-free off mode;
absence of Codex type or source coupling across the product boundary.

A passing transitional gate does not authorize a CodeSpace pin move.

12.6 Preserve the `0.154` CodeSpace baseline as comparison evidence

Run the #79 inventory, protocol and the one bounded run authorized in section 7 against CodeSpace's actual
rust-v0.154.0 baseline. Preserve these measurements before any CodeSpace pin move. They are the comparison baseline
for CodeSpace's own later pin evaluation, covering:

descriptor inheritance frequency;
output EOF latency;
stdin EOF behaviour;
PTY lifetime and EOF behaviour;
long-lived inherited descriptors;
effects in the actual pipe, PTY and worker paths.

A pin move alone does not change CodeSpace's Tokio-based spawns (pipe execution, patch helper, UDS worker); only the
Codex PTY path moves with the pin. Compare pipe-path results only against a separately justified CodeSpace change.

Do not move CodeSpace to 0.159.x merely to make the diagnostic easier.

12.7 Later CodeSpace convergence is a separate owner gate

The following future CodeSpace pin move must be a separate CodeSpace change:

rust-v0.154.0  ->  reviewed rust-v0.159.x

It requires:

the exact immutable source identity;
review of every selectively reused Codex surface the pin affects;
the coordinated adapter edit: at rust-v0.159.x, spawn_pty_process takes ChildFds<'_> instead of &[i32], so
crates/pty/src/lib.rs changes in the same pin PR. For example, ChildFds::Inherited(&[]) keeps today's behaviour;
CodeSpace PTY qualification;
runtime and process utility qualification;
filesystem, patch and Linux-sandbox impact review where applicable;
preservation of the existing pipe-path and off semantics unless independently justified;
CodeSpace CI and regression evidence;
rollback evidence;
compatibility qualification against the then-current DevGuard artifact.

Only after that succeeds may the following combination be treated as a convergence candidate:

CodeSpace 0.159.x + DevGuard 0.159.x

Do not infer convergence from matching version strings alone.

12.8 Interpretation rule for future agents

The intended strategy is:

Keep CodeSpace on the already-qualified 0.154 baseline while the remaining CodeSpace-owned investigation and
other authorized work proceed.
DevGuard may later, under separate authorization, qualify a stable 0.159.x dependency behind a separate
executable or adapter boundary.
Once it is applicable, qualify CodeSpace 0.154 + DevGuard 0.159.x as an explicit transitional state.
Move CodeSpace to 0.159.x only through its own later reviewed pin PR and qualification.

This strategy does not:

weaken N1 or N2;
transfer CodeSpace process ownership to DevGuard;
make DevGuard's Codex dependency part of the CodeSpace shared client by default;
approve a specific 0.159.x tag today;
approve decision 2, 3 or 4;
authorize W4 or W5 implementation;
remove the CS-RG hold.

If satisfying the transitional combination would require violating N1 or N2, classify that combination as unsupported
rather than changing either invariant.

Not changed:

no code, pin, dependency, gate, test, contract, service or credential;
no CI configuration beyond the one authorized classification entry;
nothing submitted upstream.

Next allowed action:

Work package B, Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79.
Then work package C.
Separately, the owner's exact-head merge decisions on the two PRs.

2026-09-30 19:18 UTC. Work packages B and C are done. The D6 option (b) analysis PR is prepared, not merged. Work stops for owner decisions.

This is a delta since the work package A comment. Cold start: read this comment first, then that one, then the session-close comment, and follow that comment's order.

Work package B: novelKR/CodeSpace#79 (owner decision 7).

The run. The inventory and the frozen protocol were posted before any build. The single bounded run then ran on the pinned rust-v0.154.0 baseline (CodeSpace ab0341b, gitlink 6b9826e), through CodeSpace's own InProcess Runner, from 18:52:48 to 18:55:13 UTC. All validity controls passed.
Results are on #79, with a pointer on #76. Each is "k/N observed on this host":
- Pipe children inherit other executions' transient descriptors, mostly PTY master and slave pairs. This happened to about 20–39% of pipe strays per case.
- PTY children held nothing foreign (0/730).
- No output write end was held from outside, so inheritance delayed no completion. PC1 confirms the delay mechanism itself.
- A held master kept a terminal alive for about 1.5–2 s after its release.
- Not run: the UDS worker, the patch helper, HTTP accept overlap, and Linux.
No CodeSpace change is proposed. Step 3, comparing remedies, needs its own decision. CodeSpace stays at 6b9826e.
Evidence MANIFEST.json SHA-256: run 10beb5fd9319e66ac78a827617e8bfcec9bc8d6b385709458482c90207ef7cb7, comments 78c940520b0c18f6c854c530d615ef1389e0cbcf6f57be33535590e1b644af99.

Work package C: D6 option (b), paper only (decision 3 stays open).

PR	Exact head	Content	CI on that head
#21	`0a9d5845f27649cb1e8f814e1e1792b3c547af39`	the dated, non-normative record `docs/handoff/2026-09-30-d6-client-session-analysis.md` (SHA-256 `593945ecdbec6be06341c6b403b3d0085e0e260d0c875e641b612ec8602d7dcb`)	pull_request run 36764459231: success. Plan, Repository checks and Required checks passed; `contracts` was skipped, as the `affected` profile plans

Findings (inference; nothing was run):

Not "nothing". While the session endpoint lives in the owner's process, no (b) candidate removes the creation window or denial of service. For an inherited endpoint, (b) reaches "no secret and no authority", not "nothing".
Residual exposure is an N2 question. Accepting the residual channel exposure would change the W0–W2 packet's reading of N2. That is a separate owner decision, and it is not requested.
The smallest step without cryptography or a new dependency. A self-contained authorized request per connection, combined with owner-originated permits and lease tokens (only digests sent), closes secret theft, injection and use after close. It is a wire change, with no change to the journal's format.
Removing the endpoint. Only a session outside the owner's process removes it from that process. That needs a new identity rule, which is a separate owner decision.
Inheritance itself. Apart from that, only option (a) removes inheritance, for each spawner that adopts it.

Open decisions (none taken):

Exact-head merge approvals:
- docs: record design revision 2 for adapter-bounded external dependencies #20 (design revision 2) at 9d223bbd3529d6996fb8ebabeedae5458d31f498, then docs: mark D3 superseded and record the DevGuard binding identity rule CodeSpace#80 at 8a414e8fcb50f262fce1f9f566cb52d79d5077da;
- docs: D6 option (b) client-session analysis (paper, non-normative) #21 at 0a9d5845f27649cb1e8f814e1e1792b3c547af39, as a record only. Merging it approves nothing proposed in it.
Decision 3, the D6 direction. If (b): which shape. Separately: the reading of channel exposure under N2, and the identity rule of the out-of-process variant.
Decision 4, carriers. It interacts with where the permit originates.
Decision 2, the upstream proposal for B. Still deferred.
Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79 step 3. CodeSpace-owned.
The staged pin direction stays planning only.

State.

DevGuard main is 4898259. CodeSpace main is ab0341b, with gitlink 6b9826e.
codex/exp-a-preparation stays at b50e437, local only.
The DevGuard LaunchAgent pid is 90515, unchanged.
No merge was made. No pin, dependency, service or credential changed, and no CI configuration changed beyond docs: record design revision 2 for adapter-bounded external dependencies #20's authorized classification entry.
Evidence (local, git-ignored): wp-c-2026-09-30/, MANIFEST.json SHA-256 0ce963f03973de77c5681a47a2834905cd3b78ef7fd50190a55a75de8114bfcc. This comment's records follow in wp-c-2026-09-30-comment/.

Next allowed action: the owner's decisions above. Work stops here.

2026-10-01 07:05 UTC. #20, novelKR/CodeSpace#80 and #21 are merged. The #79 fix is in review as novelKR/CodeSpace#81. A first CS-RG unit is proposed and awaits approval.

This is a delta since the work packages B and C comment. Cold start: read this comment first, then that one.

Owner decisions of 2026-10-01. They were given in chat; this comment, written through the shared account, is not independent proof of them.

Merges. Merge docs: record design revision 2 for adapter-bounded external dependencies #20, then docs: mark D3 superseded and record the DevGuard binding identity rule CodeSpace#80, then docs: D6 option (b) client-session analysis (paper, non-normative) #21. docs: D6 option (b) client-session analysis (paper, non-normative) #21 is merged strictly as an analytical record, not as approval of any candidate.
#79. Implement the fix as a CodeSpace PR with regression tests, preserving behaviour against the 0.154 baseline, with comparative experiments as its verification. CodeSpace stays at 0.154.
No standalone evaluations. There is no standalone 0.159.x evaluation and no separate inventory document. Version comparisons, consumption points, replaced code and costs go into the implementation PR that consumes them.
What the next work must be. Completion means implementation PRs with product code and regression tests. The #79 fix is not CS-RG progress. CS-RG advances only through a newly defined first unit, approved separately, not by resuming CSRG-C00/C03/C09.

Merges. Each was made at its exact head after a head and base re-check. Each one's post-merge main CI was read and its evidence sealed before the next merge.

PR	Exact head	Merge commit	Post-merge `main` CI	Evidence `MANIFEST.json` SHA-256
#20	`9d223bb`	`0c371ab`	36823680397, success	`merge-20-2026-10-01` `b9b67eec76b48ec2564f65e92175dad7ceb203c95b106c2c9d332a3fb2db4ee7`
novelKR/CodeSpace#80	`8a414e8`	`1bf99cf`	CI 36826171640 and docs 36826172370, success	`merge-cs80-2026-10-01` `fa9e3057b92922574228cfed6533b2c7c64e9fda63c376d078e1eced62fa4b35`
#21	`0a9d584`	`f1f9084`	36826819218, success	`merge-21-2026-10-01` `83f49fbae8a4359a1284c9afaaae9395813167671395c2abc52e5cbfbcc6a5e2`

docs: D6 option (b) client-session analysis (paper, non-normative) #21 was checked on its exact merge tree. Its base moved to 0c371ab after docs: record design revision 2 for adapter-bounded external dependencies #20 merged. The merged tree equals a local simulation of that merge, on which the documentation checks, the CI policy tests and the planner ran first.
Design revision 2 is now normative on main. CodeSpace's gitlink stays 6b9826e.
Branches. Remote branches are kept. Local worktrees and branches are also kept.

The #79 fix: novelKR/CodeSpace#81 at 8afb701, ready for review, CI green.

What it changes. CodeSpace's runner-host spawns now keep only their standard descriptors.
Verification. A comparative run against the sealed baseline met all five expectations. Pipe children inherited nothing foreign in any case, against 20–39% of pipe strays at the baseline, and no PTY master or slave was held.
Comment and evidence. The #79 comment has the details. Evidence: cs79-fix-2026-10-01 57c724a6… and cs79-verify-2026-10-01 ea3e1e43….
Bearing on D6. With #81, CodeSpace's own spawners exclude unrelated descriptors, which is what D6 option (a) needs from them. Whether a DevGuard session socket stays out of their children is still to be shown by a test; it is not assumed.

Proposed first CS-RG unit: CSRG-U1, an opt-in DevGuard status connection in CodeSpace. It is not started and needs the owner's separate approval.

Scope.
- A CodeSpace adapter consumes DevGuard's generic devguard-client and devguard-contract, whose dependencies are serde, serde_json, sha2 and libc, with no Codex.
- It is pinned to a reviewed, immutable DevGuard commit, behind a Cargo feature and a runtime setting that are both off by default.
- When enabled, the Gateway (InProcess) or the worker (UDS) opens a bounded session: connect, Hello, Authenticate as an operator-provisioned consumer, Status.
- It reports DevGuard's availability, its capabilities, or why it is unavailable, in CodeSpace's runtime status.
- It admits and launches nothing, and execution paths are untouched.
Consumption point, replaced code, cost. This is the first consumption point. It replaces no CodeSpace code. The PR measures the dependency graph and binary difference; with the feature off, nothing changes.
Completion criteria:
1. With the feature off, the dependency graph and behaviour are unchanged: CodeSpace's dependency checks and existing suites pass.
2. With it on, against DevGuard's test-fixtures authority, each of these cases is reported without affecting CodeSpace's operation: available, unavailable, wrong peer UID, protocol or capability mismatch, and credential refused.
3. The credential reaches no child and no log.
4. D6 verification built in, not assumed. With #81 merged, sessions opened while pipe and PTY executions spawn leave no session socket in any child. These are W3 C's inheritance cases, run against CodeSpace's actual spawners. The unit carries no permit or token and claims nothing about N2 for launch paths.
5. CodeSpace and DevGuard CI are green. The CS-RG suspension notices are amended only as far as this unit needs.
Not in this unit: admission, BeginLaunch and permits, the launch helper, carriers, observation and reaping, execution ownership, and any Codex pin change. These wait for the D6 and carrier decisions, which will weigh #79's comparison and docs: D6 option (b) client-session analysis (paper, non-normative) #21.

Open decisions:

the exact-head merge approval of runner: keep only standard descriptors in spawned children (#79) CodeSpace#81;
whether to implement CSRG-U1;
decision 3 (D6) and decision 4 (carriers);
decision 2, still deferred.

State.

DevGuard main is f1f9084. CodeSpace main is 1bf99cf, with gitlink 6b9826e.
codex/exp-a-preparation stays at b50e437, local only.
The DevGuard LaunchAgent pid is 90515, unchanged.
No pin, dependency, service or credential changed.

Next allowed action: the owner's decisions above.

2026-10-02 06:54 UTC. Pointer: novelKR/CodeSpace#81 is at a new exact head, 2629f1875a6ac16c32c23309e948af357f20003e, hardened and verified against the 0.154 baseline. Its CI is green, including the macOS leg that now runs its tests. It awaits exact-head merge approval. It is an independent CodeSpace defect fix, not CS-RG progress; CSRG-U1 is not started. Details: CodeSpace #79.

2026-10-02 14:03 UTC. CSRG-U1 is merged in CodeSpace as f0a3322. It meets the owner's U1 scope with five deviations. U2 is not started.

This is a delta since the #81 pointer.

Owner direction of 2026-10-02. It was given in chat; this comment, written through the shared account, is not independent proof of it.

First instruction. Implement the status-only, opt-in DevGuard integration as an implementation PR, with regression tests.
Work order. A later work order defines CS-RG as units U1–U6.
- Gating. Each unit is gated on the previous ones being merged and verified, and stops at an exact-head approval request.
- An already merged U1 is to be verified and reported, not duplicated.

#81 merged. The owner merged novelKR/CodeSpace#81 at 2629f18 as dcf8c51.

Post-merge CI. main CI passed (run 36981488060).
Evidence. merge-cs81-2026-10-02 d6b4b77e51712488f2d701542e433c24d817b1ced735b2f391d8b4ac48e1298c.
Not CS-RG progress. It is an independent defect fix.

U1: novelKR/CodeSpace#82, merged by the owner at 12:52Z.

Commits. Head 595f7d2 on base dcf8c51; the merge commit is f0a3322, with tree 76cee3c.
Pins. DevGuard f1f9084 (devguard-client and devguard-contract); Codex 6b9826e, unchanged.
What it does. An opt-in, status-only connection. It is off at build time (Cargo feature devguard) and at run time (--devguard status).
- Session. Each workspace_info call opens one bounded session (connect, Hello, Authenticate, Status) and reports workspace_info.resource_authority.
- Governance. It reports provider devguard, participation status and governs_execution: false.
- States. available, unavailable, untrusted_authority, incompatible, credential_refused, credential_unavailable.
CI.
- PR run. On 595f7d2, 36999727236 passed all 17 jobs.
  - macOS 26.6.2. The adapter's tests ran with native host evidence, plus the gateway's DevGuard tests.
  - Linux. The adapter's tests, and the gateway's whole suite with the feature.
  - Dependencies. No violation on either target.
- Post-merge. main CI 37009319958 passed.
Dependency graph.
- Without the feature. Every product graph equals the base's, packages and edges, on macOS and Linux targets.
- With it. The root gains codespace-devguard, devguard-client and devguard-contract, and the stripped release binary grows 481,408 bytes (+1.7 %).
Feature off. The WorkspaceInfo schema and the flags are unchanged (tests), and the existing suites pass.
Credential. It is read for each session from a private file and sent only in Authenticate. Tests show it in no flag, environment, status, error or log, and in no child's environment or output.
Descriptors.
- Deterministic control. The detector sees an intentionally inheritable socket that the pipe, PTY and worker spawners exclude.
- Stress (supporting evidence). Two runs, about 375,000 and 388,000 sessions: 0/400 children held a socket for each spawner. The unguarded control: 8/400 and 10/400.
- N2. Nothing is claimed about N2.

Deviations from the U1 scope, recorded in VERIFY.md:

D-1. report.reason passes DevGuard's free-text readiness reason to MCP clients, which can include an administrator's closure text.
D-2. error_code, capabilities and role carry DevGuard's wire names in strings, not CodeSpace-owned enumerations.
D-3. The credential path's ancestor directories are not validated. The file itself is checked: owner, mode, type, final-component no-follow and one link.
D-4. No executable rule keeps fixture-only DevGuard crates (devguard-daemon, devguard-core, devguard-macos) out of product graphs; today they are only development dependencies.
D-5. Runtime-off is not tested end to end through main; it holds by construction and by unit tests.

Known limitations.

Linux. DevGuard's fixture there has no native evidence: DevGuard is available, but registration and execution are not ready.
UDS mode. The gateway opens the session; U2 registers the worker.
Same account. A process of the same account can read the credential file (DevGuard's cooperative model).
Local flake. Locally on macOS, the existing worker-spawn test failed three times under the integration stage, because a freshly linked worker launches slowly. It is unchanged, and it passed in CI.

Evidence (DevGuard, local): csrg-u1-2026-10-02 d4e79461e6ee2667f6cd5dae2e1b507776b2cf6a10d719c2639d741f717207b6.

Open decisions:

whether, and in which PR, to close D-1 to D-5;
the go-ahead for U2, execution-owner registration and participation readiness. Its prerequisite, U1 merged with post-merge CI green, holds;
decision 3 (D6 for launch paths) and decision 4 (carriers);
decision 2, still deferred.

U2 includes recording CS-RG as in-progress in this repository's ledger and notices.

State.

DevGuard main is f1f9084. CodeSpace main is f0a3322, with gitlink 6b9826e.
No service, credential or Codex pin changed.

Next allowed action: the owner's decisions above.

2026-10-07 UTC. CSRG-U1 hardening and CSRG-U2 are merged in CodeSpace, and this repository's ledger records CS-RG as in progress. U3 is next.

This is a delta since the U1 comment. Cold start: read this comment first, then that one. Then read the handoff record docs/handoff/2026-10-03-cs-rg-session-handoff.md.

Owner direction since 2026-10-02 14:03 UTC. It was given in chat and on decision cards; this comment, written through the shared account, is not independent proof of it. The verbatim instructions are in docs/handoff/, added by #23.

2026-10-02 14:13. Close D-1 to D-5 in one narrow U1-hardening PR. Then run U2 as defined, including recording CS-RG as in-progress.
2026-10-03 05:44. Investigate and fix the macOS fork abort found while validating U2 (Mitigation: complete libnotify's initialization before CodeSpace forks on macOS CodeSpace#86).
2026-10-03 09:57. The order of the remaining steps:
1. merge Mitigation: complete libnotify's initialization before CodeSpace forks on macOS CodeSpace#86;
2. verify its post-merge main CI;
3. bring #84 up to date with main;
4. re-validate #84 without the macOS isolation;
5. merge U2;
6. U3;
7. resolve process_status reports a signal death that CodeSpace did not cause as a normal exit CodeSpace#85 before U4 at the latest;
8. hold structural spawn redesigns.
2026-10-07. The owner's instructions:
- Start U3 from the U3 section of the 2026-10-02 U1–U6 order, without a separate detailed order.
- Fix process_status reports a signal death that CodeSpace did not cause as a normal exit CodeSpace#85 in its own PR.
- Close Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79.
- File Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24.
- Update these trackers.

Merges, each at its exact head after the owner's approval:

PR	Exact head	Merge commit	Post-merge `main` CI
novelKR/CodeSpace#83, U1 hardening (D-1 to D-5)	`4be00f6`	`3206865`, 2026-10-02 14:42Z	37021800560, success
novelKR/CodeSpace#86, macOS fork-abort mitigation (an independent fix, not CS-RG progress)	`3b1ed59`	`02cf905`, 2026-10-03 09:59Z	37114872355, failure in the macOS leg, in U1's gateway DevGuard tests. These were test-only defects older than #86, fixed in #84
novelKR/CodeSpace#84, CSRG-U2	`2239085`	`ebed574`, 2026-10-03 14:02Z	37128224856, success
#23, the owner's instructions and a handoff record	`8c2f59a`	`6599cd6`, 2026-10-03 17:48Z	37141865075, success
#22, the CS-RG ledger: `in-progress`, units U1–U6	`b651a74`	`334472a`, 2026-10-03 19:35Z	37148424857, success

Every scheduled run on both mains has passed since then: CodeSpace CI runs 207–210 and DevGuard runs 96–99, the latest on 2026-10-06.

U2 (novelKR/CodeSpace#84). The process that owns CodeSpace's executions registers itself with DevGuard. Nothing is admitted or launched.

Owner per mode.
- InProcess: the gateway.
- UDS with --runtime-bin: the worker the gateway starts, never the gateway.
- UDS with --runner-socket: unsupported_mode.
Identity. Each owner process mints one instance identity, and every bounded session registers it again. DevGuard derives the process identity from the session's peer.
Participation. A workspace whose resources.participation is required refuses every new execution with RESOURCE_POLICY_UNSUPPORTED, before any approval, lease or process exists. Nothing falls back to off, status-only or legacy execution.
Credential. The UDS worker gets the consumer secret through one CredentialHandoff descriptor and consumes it at start. The secret appears in no argument, environment, log or status.
Supported modes. InProcess and UDS with --runtime-bin, against an authority with native evidence (macOS). On Linux, registration is incompatible until DG-LINUX.
Pins. DevGuard f1f9084 and Codex 6b9826e are unchanged.

Found while validating U2, filed separately:

Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24. The client's credential reader rejects an already-buffered secret when its thread stalls for 250 ms. The UDS worker reads its secret once, so it then reports credential_unavailable until it is restarted. The launch helper reads its one-time permit the same way. A decision is wanted before U4.
process_status reports a signal death that CodeSpace did not cause as a normal exit CodeSpace#85. A signal death that CodeSpace did not cause is reported as a normal exit. It gets its own CodeSpace PR, merged before U4 at the latest.

Other changes:

Investigate descriptor inheritance between concurrent spawns on macOS CodeSpace#79 is closed as fixed by runner: keep only standard descriptors in spawned children (#79) CodeSpace#81. The macOS fork abort that this fix's fork path exposed was fixed by Mitigation: complete libnotify's initialization before CodeSpace forks on macOS CodeSpace#86.
CodeSpace's branch claude/magical-euler-nvqrxp holds #84's temporary macOS diagnostic workflows, in 10 commits not on main.
- They run only on a push to that branch or a manual dispatch, so they are inactive.
- The branch is kept because #84's evidence runs were made from it.

Open decisions from the U1 comment:

D-1 to D-5: closed by devguard: close U1's deviations D-1 to D-5 (U1 hardening) CodeSpace#83.
The U2 go-ahead: given, and U2 is done.
Decisions 3 and 4 (D6 for launch paths, and carriers): the 2026-10-02 order places both inside U4's implementation PR (its sections 4 and 9), not in a separate package. This is a reading of that order, not a new decision.
Decision 2 (the upstream proposal for B): still deferred.

Next: CSRG-U3, admission, attempt identity and the pre-spawn slot lifecycle, from the U3 section of the 2026-10-02 order.

It runs on macOS, because DevGuard admits only with native evidence.
Its bookkeeping change in this repository will mark U3 in-progress.
Nothing is merged without the owner's exact-head approval, and no pin changes.

State.

DevGuard main is 334472a. Its code and contracts are unchanged since f1f9084.
CodeSpace main is ebed574, with Codex gitlink 6b9826e and DevGuard client pin f1f9084.

2026-10-07 10:30 UTC. CSRG-U3 is merged in CodeSpace, and novelKR/CodeSpace#85 is fixed. U4 has not started; it waits for the owner's separate approval.

This is a delta since the 04:07 UTC comment. Cold start: read this comment first, then that one.

Merges, each at its exact head, by the owner:

PR	Exact head	Merge commit	Post-merge `main` CI
novelKR/CodeSpace#87, the fix for novelKR/CodeSpace#85 (not CS-RG progress)	`26f561e`	`579c075`, 2026-10-07 08:23Z	37593499774, success
#25, the ledger: CSRG-U3 `active`	`9911112`	`85337d1`, 2026-10-07 08:25Z	37593618493, success
novelKR/CodeSpace#88, CSRG-U3	`4af3feb`	`d543ea5`, 2026-10-07 10:02Z	37604674852, success

#85 (novelKR/CodeSpace#87). A managed pipe child that dies from a signal CodeSpace did not send is now reported as termination: signaled, with signal {number, name} and no exit code. A tty: true child still reports exit code 1, because the pinned Codex PTY reduces a signal death to that. Runner wire protocol 6 → 7. This meets the order's "resolve #85 before U4 at the latest".

U3 (novelKR/CodeSpace#88): admission, attempt identity and the pre-spawn slot lifecycle.

Order. For a required workspace under --devguard register: authorization and the workspace lease, then a CodeSpace process slot taken before spawn, then DevGuard Register and Admit, then a one-shot prepared execution.
No launch yet. Managed launch is U4. Until it lands, a successful preparation cancels the unstarted attempt and returns MANAGED_LAUNCH_UNAVAILABLE. No governed payload is spawned, and nothing runs through a non-governed path.
Owner per mode. As in U2: the gateway in InProcess mode, and the worker the gateway started in UDS mode. --runner-socket is refused before any approval or lease.
Uncertainty. A timeout or lost reply is unknown, never a refusal: one Lookup, a Cancel if the attempt is found prepared, and never a second Admit. A test against DevGuard's real authority shows a timed-out Admit that DevGuard did record.
For every workspace. A request over the live-process limit is refused before any child exists. Before U3 it was spawned and then killed.
Default request. resources.request defaults to 250 m CPU, 256 MiB and 32 tasks. The 3-core macOS CI runner gives DevGuard about 480–500 m CPU of work capacity, so the first default, 1000 m, would be denied there.
Wire and pins. The prepare op is additive, behind a Hello.admission flag, so the runner wire protocol stays 7. DevGuard f1f9084 and Codex 6b9826e are unchanged, and no dependency changed.
The PR body records the contract, the tests and the eight local validation failures that were kept.

Bookkeeping. #26 records CSRG-U3 as merged-verified. Its CI passed, and it waits for the owner's merge.

Open decisions:

U4, managed launch (BeginLaunch, permits, launch helper, carriers): needs the owner's separate approval.
Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24, the 250 ms credential deadline: still open. U4's launch helper reads its one-time permit the same way, so a decision is wanted before U4.
Decisions 3 and 4 (D6 for launch paths, and carriers) fall inside U4's PR under the 2026-10-02 order. Decision 2 stays deferred.

State.

CodeSpace main is d543ea5, with Codex gitlink 6b9826e and DevGuard client pin f1f9084.
DevGuard main is 85337d1. Its code and contracts are unchanged since f1f9084.

Generated by Claude Code

2026-10-08 14:00 UTC. #24 is fixed and CodeSpace pins the fix. CSRG-U4 has started on the owner's approval.

This is a delta since the 10:30 UTC comment of 2026-10-07. Cold start: read this comment first, then that one.

Owner direction since 2026-10-07 10:30 UTC. It was given in chat and on decision cards; this comment, written through the shared account, is not independent proof of it.

2026-10-07 15:30. Fix Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24 first, in this repository, before U4. Moving CodeSpace's pin and starting U4 each need a separate approval.
2026-10-07 16:21. Merge fix(client): accept a secret that arrived before the read deadline #27 at its exact head.
2026-10-08 07:33. Prepare the CodeSpace pin change.
2026-10-08 11:24. Merge devguard: pin DevGuard at 6e7e065 for its credential read fix CodeSpace#89 at its exact head.
2026-10-08 13:38. Start U4 on the owner's Mac.
2026-10-08 13:58. Merge docs: record CSRG-U4 as the active unit #28 at its exact head and update these trackers.

Merges, each at its exact head:

PR	Exact head	Merge commit	Post-merge `main` CI
#26, the ledger: CSRG-U3 `merged-verified`	`5199d2c`	`035936d`, 2026-10-07 11:40Z	37615662322, success
#27, the fix for #24	`3ae5dc2`	`6e7e065`, 2026-10-07 16:22Z	37651491046, success
novelKR/CodeSpace#89, CodeSpace's DevGuard pin `f1f9084` → `6e7e065`	`6fe91e7`	`e0610c4`, 2026-10-08 11:25Z	37769948152, success
#28, the ledger: CSRG-U4 `active`	`f7d937c`	`df3c537`, 2026-10-08 13:58Z	37788694730, success

#24 (#27). The client's credential reader no longer fails just because 250 ms have passed.

Once the deadline has passed, it still takes a secret and EOF that are already readable. poll no longer waits, and a pass that makes no progress fails, so a writer that never writes or never closes still fails at 250 ms.
The 64-byte secret, the 65-byte read bound and close-on-exec are unchanged, and the descriptor is consumed and closed on every path. The 250 ms frame deadlines are unchanged by design.
Between f1f9084 and 6e7e065 the only code change is crates/client/src/credential.rs; the rest is documentation and the ledger.

Pin (novelKR/CodeSpace#89). CodeSpace links devguard-client, devguard-contract and the dev-only devguard-daemon at 6e7e065. Only the DevGuard source lines of its three lockfiles changed. Codex stays 6b9826e.

The gateway's sessions and the UDS worker now get a usable credential even when their thread is delayed past the deadline.
Not changed: the installed DevGuard. Release 0.1.0-5daee5d-b3fa569e, the DG-1 qualified release, keeps the old reader, including the launch helper's permit read. A new release, which would also need its own SLO qualification, is a separate owner decision.

CSRG-U4 has started: managed launch, with BeginLaunch, the one-time permit, the launch helper and carriers.

It runs on the owner's Mac, from the U4 section of the 2026-10-02 order and the standing rules of the handoff record (section 5).
Decisions 3 and 4 (D6 for launch paths, and carriers) are made inside U4's PR, as that order places them.
Nothing merges without the owner's exact-head approval, and no pin changes.

Open decisions:

A new DevGuard release with the fix: when. The recommendation is to decide while U4's PR is reviewed, once its code fixes where the helper comes from.
Decision 2 stays deferred.

State.

DevGuard main is df3c537. Its code is that of 6e7e065.
CodeSpace main is e0610c4, with Codex gitlink 6b9826e and DevGuard client pin 6e7e065.

Generated by Claude Code

2026-10-09 14:45 UTC. CSRG-U4 is merged in CodeSpace. U5 has not started; it waits for the owner's separate approval.

This is a delta since the 14:00 UTC comment of 2026-10-08. Cold start: read this comment first, then that one.

Owner direction since 2026-10-08 14:00 UTC. It was given in chat and on a decision card; this comment, written through the shared account, is not independent proof of it.

2026-10-09 14:25. Merge devguard, runner, server: launch governed executions once under DevGuard (CSRG-U4) CodeSpace#90 at its exact head, record it in this repository's ledger and update these trackers. Cut the next DevGuard release just before CSRG-U6, not now.

Merges, at the exact head:

PR	Exact head	Merge commit	Post-merge `main` CI
novelKR/CodeSpace#90, CSRG-U4	`c1c7859`	`3e5e3e8`, 2026-10-09 14:26Z	37944159990, success

U4 (novelKR/CodeSpace#90): managed launch.

Order. After U3's preparation and local checks, BeginLaunch is sent exactly once in a bounded owner session. Only a permit that arrives with this owner's committed record of the attempt is a grant. CodeSpace then starts this repository's devguard-launch through its own pipe or PTY spawner, as its direct child, and reads the helper's transcript to its end.
Outcome. exec_command on a governed workspace returns a process_id with dispatch_status: confirmed or unknown, or a refusal. A lost answer gets one Lookup and never a second BeginLaunch. A required workspace never runs a command outside DevGuard.
Carriers and D6. This repository's own carriers (the permit's socket pair and the transcript pipe) reach only the helper: CodeSpace's unrelated-descriptor exclusion on a pipe, and the pinned Codex PTY's inherited_fds on a PTY. Tests against the fixture authority and the real helper, including 6 rounds of concurrent launches beside ordinary children, show the payload and every other child hold nothing beyond stdio.
Configuration. --devguard-launch-helper PATH with --devguard register. The path is checked before every launch (owner and write permissions of the file and its directories). Without a helper, U3's admit-then-refuse stays.
Supported. macOS with native host evidence: InProcess, and UDS with --runtime-bin; pipe and PTY. Linux registers nobody until DG-LINUX.
Wire and pins. A launch op behind Hello.launch, so the runner wire protocol stays 7. DevGuard 6e7e065 and Codex 6b9826e are unchanged.

Seen while validating U4, for U5. This repository releases a launched attempt only once its reconciler has seen the scope end, 0.73–0.95 s after the processes ended on the owner's Mac. The 3-CPU macOS CI runner holds nine 50 m attempts (480 m of work capacity), so a burst of short governed commands can be refused with resource_unavailable although earlier ones have ended. U4's D6 test now waits for each round's release; faster release belongs to CSRG-U5's release paths.

Bookkeeping. #29 records CSRG-U4 as merged-verified. Its CI passed, and it waits for the owner's merge.

Open decisions:

U5, observation, reaping, release, approvals and the no-replay lifecycle: needs the owner's separate approval.
The next DevGuard release, which puts Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24's fix into the installed launch helper: the owner chose to cut it just before CSRG-U6, whose qualification candidate records the DevGuard helper artifact. Until then the installed release 0.1.0-5daee5d-b3fa569e keeps the old permit reader, so a governed launch through its helper can be refused under load; it never runs the command outside DevGuard.
Decision 2 stays deferred.

State.

CodeSpace main is 3e5e3e8, with Codex gitlink 6b9826e and DevGuard client pin 6e7e065.
DevGuard main is df3c537. Its code is that of 6e7e065.

Generated by Claude Code

2026-10-11 15:30 UTC. CodeSpace's test-timing cleanup is merged, and CSRG-U5 has started on the owner's approval. Updated 15:39 UTC: #30 is merged.

This is a delta since the 14:45 UTC comment of 2026-10-09. Cold start: read this comment first, then that one.

Owner direction since 2026-10-09 14:45 UTC. It was given on decision cards; this comment, written through the shared account, is not independent proof of it.

2026-10-09 14:47. Merge docs: record CSRG-U4 as merged #29 at its exact head, then a small CodeSpace cleanup PR on the owner's Mac before U5.
2026-10-09 15:03. The cleanup may change the gateway's wait for the worker it starts (product code).
2026-10-09 17:02. Merge server: wait up to 10 s for a started worker; steady three macOS timing tests CodeSpace#91 at its exact head and start CSRG-U5 on the owner's Mac, recorded by a ledger PR here and these trackers.
2026-10-11 15:03. Leave the removal of the Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24-era test session retries out of the cleanup.
2026-10-11 15:37. Merge docs: record CSRG-U5 as the active unit #30 at its exact head.

Merges, each at its exact head:

PR	Exact head	Merge commit	Post-merge `main` CI
#29, the ledger: CSRG-U4 `merged-verified`	`615186f`	`79cb66c`, 2026-10-09 14:49Z	37947048488, success
novelKR/CodeSpace#91, the test-timing cleanup (not CS-RG progress)	`f91380a`	`470069c`, 2026-10-11 15:14Z	38150456452, success
#30, the ledger: CSRG-U5 `active`	`b33994d`	`668750b`, 2026-10-11 15:37Z	38152048405, success

Cleanup (novelKR/CodeSpace#91). macOS checks a newly placed executable on its first exec: on the owner's Mac a worker binary that had never run took 1.9–2.8 s to accept on its socket, against 9 ms once it had run.

Product change, one function. The gateway waits up to 10 s, not about 2 s, for the socket of the worker it starts with --runtime-bin, so its first start after the worker is built or installed no longer fails with worker socket not ready. A worker that exits first still fails the start at once.
Tests. Three tests that failed intermittently under load on macOS are steady: the sandbox's output-flood test, the worker binary's socket wait, and U4's launch stand-ins, which now run once on macOS before they are timed.
Unchanged: the pins (Codex 6b9826e, DevGuard 6e7e065), the runner wire protocol 7 and every contract. The Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24-era past_the_credential session retries in CodeSpace's tests stay, by the owner's choice.

Seen while validating #91, not fixed. A CodeSpace adapter test failed in 2 of 8 local macOS runs, each right after a full run, with "another authority owns this state directory" from this repository's TestAuthority bootstrap. It was not reproduced in 30 loaded runs or in CI. If U5's runs show it, it gets root-caused there.

CSRG-U5 has started: observation, reaping, release, approvals and the no-replay lifecycle, on the owner's Mac, from the U5 section of the 2026-10-02 order.

Reaping today (order §2). CodeSpace's own pipe children can be reaped by four paths (the normal wait, the timeout, termination requests including workspace termination, and drop). They share one lock, so there is no double waitpid, but whichever runs first reaps, so this repository cannot be sure to observe the exited root first. U5 is to leave one reaper per child and have this repository Observe the exited root before it is reaped, with the pinned client's observe and terminate: no DevGuard pin change.
PTY gap (order §3). The pinned Codex PTY reaps its child in its own task right after spawn, with no hook before the reap. When a PTY command's descendant appears and its root exits before an observation has seen that descendant, this repository's macOS scope records tracking loss: the attempt stays Suspect and charged until a reboot, and is never falsely released. Descendants already seen stay tracked. The owner is choosing between keeping this as a documented limitation (recommended), a CodeSpace-owned PTY through Codex's public spawn_from_driver, and a pre-reap hook in Codex with a pin change.
Draft PR devguard, runner, server, store: lifecycle of governed executions after launch (CSRG-U5) CodeSpace#92 is open. Its first commit (024e477) leaves one reaper per pipe child: the timeout and termination record their intent and signal only a child that has not exited, which they check with waitid(WNOWAIT) without reaping it.
U4's carry-over is in scope: this repository releases a launched attempt 0.73–0.95 s after its processes end.
Nothing merges without the owner's exact-head approval, and no pin changes without a separate approval. P1-RECOVERY does not start in this unit, and CS-RG is not claimed qualified.

Bookkeeping. #30 records CSRG-U5 as active and is merged (above).

Open decisions:

PTY observation before reaping in U5, as above.
The next DevGuard release: just before CSRG-U6, as chosen on 2026-10-09.
Decision 2 stays deferred.

State.

CodeSpace main is 470069c, with Codex gitlink 6b9826e and DevGuard client pin 6e7e065.
DevGuard main is 668750b. Its code is that of 6e7e065.

Generated by Claude Code

2026-10-11 17:50 UTC, edited 18:05 and 23:35 UTC and 2026-10-12 05:10, 05:40, 07:30, 10:16 and 12:05 UTC. CSRG-U5 is merged and recorded here, and governed PTY executions are now observed before the reap, through the Codex PTY pre-reap observer carried in CodeSpace as a recorded patch file.

This is a delta since the 15:30 UTC comment. Cold start: read this comment first, then that one.

Owner direction since 15:39 UTC. It was given on decision cards and in the project thread; this comment, written through the shared account, is not independent proof of it.

16:05. PTY observation before reaping: option 3, "in parallel". U5 keeps observing PTY executions after Codex's reap, and a Codex PTY pre-reap hook is prepared as a separate change. A fork, a pin merge and an upstream issue are each asked separately.
17:22. Merge devguard, runner, server, store: lifecycle of governed executions after launch (CSRG-U5) CodeSpace#92 at its exact head and record it here.
17:29. Carry the Codex patch as a patch file in CodeSpace: the submodule stays on openai/codex at the official rust-v0.154.0, CodeSpace applies the recorded patch and checks the resulting tree, and no fork is made.
17:32. Write this down as CodeSpace's policy for fixes that a Codex pin makes unavoidable, with a case study of earlier Codex adapter conflicts, so that later choices stay consistent.
18:01. Merge docs: record CSRG-U5 as merged #31 at its exact head.
23:14. Merge codex, scripts, docs: carry the PTY pre-reap observer as a recorded patch on the pinned release CodeSpace#93 at its exact head.
2026-10-12 04:43. Merge server: keep a child's environment out of the descriptor tests' failure messages CodeSpace#94 and pty, runner, server: observe governed PTY executions before the reap (CSRG-U5) CodeSpace#95 at their exact heads.
2026-10-12 05:33. Merge docs: record governed PTY observation before the reap #32 at its exact head.
2026-10-12 06:24. Submit the upstream feature request from the owner's Mac, unchanged, and record its link; the owner confirmed it in the project thread at 07:20.
2026-10-12 09:55. Merge docs: record the filed Codex feature request in the patch record CodeSpace#96 at its exact head.

Merges, each at its exact head:

PR	Exact head	Merge commit	Post-merge `main` CI
novelKR/CodeSpace#92, CSRG-U5	`7b65c76`	`0c21a7f`, 2026-10-11 17:23Z	38159467078, success; documentation 38159467733, success
#31, ledger: CSRG-U5 `merged-verified`	`6bc7654`	`cd0681c`, 2026-10-11 18:01Z	38162067983, success
novelKR/CodeSpace#93, the Codex PTY observer as a recorded patch, and the policy for such fixes	`a75d030`	`3d051fa`, 2026-10-11 23:17Z	38183706559, success; documentation 38183707043, success
novelKR/CodeSpace#94, descriptor tests keep a child's environment out of failure messages	`6481e77`	`d4ea680`, 2026-10-12 04:44Z	38205004076, success; documentation 38205004507, success
novelKR/CodeSpace#95, governed PTY executions observed before the reap	`634a19f`	`181a020`, 2026-10-12 04:44Z	38205025558, success, all 17 jobs; documentation 38205025983, success
#32, ledger: governed PTY observation before the reap	`0c43653`	`152a2cf`, 2026-10-12 05:34Z	38208501126, success
novelKR/CodeSpace#96, the filed Codex feature request in the patch record	`7727d24`	`7024f74`, 2026-10-12 09:56Z	38233097644, success, all 17 jobs; documentation 38233098609, success

CSRG-U5 (novelKR/CodeSpace#92).

Each pipe child has one reaper. The timeout and termination signal only a child that has not exited, which they check with waitid(WNOWAIT).
For governed pipe executions, this repository observes the exited root before the reap (Observe, 2 s bound) and again after it.
Killing a governed process also asks this repository to terminate its scope. This is best effort and never awaited; process control keeps working with the authority stalled or gone.
A resumed approval whose governed execution is refused with this repository's proof that the command never started returns to granted. Any other outcome consumes it, and nothing is replayed.
Tests cover the order's §7–9 no-replay, release and race cases.
PTY: as merged in devguard, runner, server, store: lifecycle of governed executions after launch (CSRG-U5) CodeSpace#92, observed only after Codex's reap, the interim state of option 3: tracking was lost only for a descendant that appears, with its root exiting, before any observation sees it, and the attempt then stayed Suspect and charged, never falsely released. Since pty, runner, server: observe governed PTY executions before the reap (CSRG-U5) CodeSpace#95, governed PTY executions are observed before the reap too (below).
No pin change: Codex 6b9826e, DevGuard 6e7e065.

Codex PTY pre-reap observer (option 3).

One commit on rust-v0.154.0, ported from W3 experiment B to both Unix PTY paths. The child's single waiter sees the exit with waitid(WNOWAIT), gives a registered observer one bounded opportunity, then reaps as before and reports Completed, TimedOut, Failed or Unavailable. Without an observer nothing changes.
Verified on the patched tree: Linux, the crate's 36 tests in each of 30 runs; macOS, 38 tests in each of 30 runs and W3 experiment B's cases B1–B13 against 6e7e065.
It is carried as a patch file, merged as codex, scripts, docs: carry the PTY pre-reap observer as a recorded patch on the pinned release CodeSpace#93, with an apply-and-check step that CI and the pin check run. CodeSpace's policy for such fixes and the case study are in the same PR (docs/upstream-patches.md). The upstream feature request was filed on 2026-10-12 as openai/codex#53298, unchanged from the reviewed draft. This settles Decision 2 of the W3 decision packet, the upstream proposal for B.

Governed PTY observation (novelKR/CodeSpace#95).

A governed PTY execution is spawned through the patch's observed spawn. When its root exits, Codex's single waiter offers one window, bounded at 2 s like the pipe path, in which this repository observes the scope (Observe); then it reaps, and the root is observed again after the reap. Ungoverned PTY executions spawn as before.
A termination request or the timeout that arrives in the window leaves the exited root to its reaper and does not change how it ended, as for a pipe root.
Tests cover W3 experiment B's cases on the PTY path against this repository's fixture authority at 6e7e065, whose reconciler is paused (pause_reconciler) or whose lock is held (hold_authority) around the exit: a surviving descendant keeps the attempt charged until it ends, and a stalled observation leaves it Suspect. Verified on the owner's Mac in a minimal environment, and by CI on Linux and macOS.
No pin change.

Bookkeeping. #31 records CSRG-U5 as merged-verified and is merged. #32 updates the CS-RG plan's dated note for PTY observation and is merged. novelKR/CodeSpace#94, merged, keeps the gateway's descriptor tests from printing a child's environment when they fail; it is test code only. novelKR/CodeSpace#96, merged, links the filed feature request from CodeSpace's patch record; it is documentation only.

Open decisions:

CSRG-U6: starts on the owner's direction.
The next DevGuard release: just before CSRG-U6, as chosen on 2026-10-09.

State.

CodeSpace main is 7024f74, with Codex gitlink 6b9826e plus the recorded patch, and DevGuard client pin 6e7e065.
DevGuard main is 152a2cf. Its code is that of 6e7e065.

Generated by Claude Code

2026-10-12 14:45 UTC, edited 15:07, 15:30 and 17:10 UTC, 2026-10-13 09:51, 11:36, 16:23, 17:03 and 18:02 UTC, and 2026-10-14 07:37 UTC. CS-RG is qualified on macOS for one exact combination, and the ledger records it (#35). A new DevGuard release built from 6e7e065 is installed on the qualification host under a policy with a codespace consumer, and since 2026-10-13 it is SLO-qualified and promoted; CSRG-U6 qualified CodeSpace ca306ee against it. The work stops here: P1-RECOVERY needs the owner's separate authorization.

This is a delta since the 2026-10-11 17:50 UTC comment. Cold start: read this comment first, then that one.

Owner direction since 2026-10-12 09:55 UTC. It was given in the project chat and on a decision card; this comment, written through the shared account, is not independent proof of it.

14:24. Start CSRG-U6. The new DevGuard release comes right before it, as chosen on 2026-10-09, and the next Codex pin move (0.159.x) is a separate PR.
14:28. Build the new release from 6e7e065 and install it on the owner's Mac now. The measurement of about five hours starts separately, when the Mac can be set aside.
14:44. Merge docs: record CSRG-U6 as the active unit #33 at its exact head.
15:55. Add the codespace consumer as proposed (below). At 16:15 the owner chose to run the step that creates the secret and edits host.toml themselves, and ran it at 16:22. At 16:31 they chose to let the Mac's session restart and verify through narrow permission rules for one reviewed script, and added them at 16:52.
17:25. Start the measurement now. The Mac's session prepared it, but its safety check refused even the read-only checks before the rehearsal (17:30), so nothing ran.
2026-10-13 02:11. Run it from one terminal command that the owner pastes, prepared on the Mac and reviewed. 09:45. Merge docs: record release 0.1.0-6e7e065-94d85365 as DG-1's qualified release #34 at its exact head. 11:30. Merge scripts, docs: CS-RG qualification harness and protocol (CSRG-U6) CodeSpace#97 at its exact head. 16:20. Merge server: end the uds worker's processes at gateway shutdown (CSRG-U6) CodeSpace#98 at its exact head. 17:36. Finish the regression stages today, and run the CS-RG control-path measurement the next day, at a time the owner picks. 23:15. Run the control-path measurement now, about four to five hours; the reviewed command ran from 23:20.
2026-10-14 06:55. Merge docs: CS-RG qualification report, supported modes, adoption and rollback (CSRG-U6) CodeSpace#99 at its exact head. 07:33. Merge docs: record CS-RG as implemented and qualified on macOS #35 at its exact head.

The new DevGuard release.

Why. The installed 0.1.0-5daee5d-b3fa569e was built from 5daee5d (DG1-C11), which still has Credential reader rejects an already-buffered secret when its thread stalls for 250 ms #24: the credential reader can reject an already-buffered secret when its thread stalls for 250 ms, and devguard-launch reads its one-time launch permit through it. fix(client): accept a secret that arrived before the read deadline #27 fixed it as 6e7e065, which is CodeSpace's DevGuard pin. Between 5daee5d and 6e7e065 the packaged binaries' source changes only in crates/client/src/credential.rs; everything else is the C12 qualification crate, scripts and tests.
Steps on the Mac. scripts/package.py --offline in a clean worktree at 6e7e065, devguardd stage, then devguard upgrade, which closes admission, drains charged work for up to 60 s, backs up the journal, verifies the new release and reopens admission. Then devguardd status, devguard doctor and a governed Cargo build. If the new release cannot be verified, the upgrade starts the previous one again, and repair --use last-known-good returns to it if nothing serves.
Qualification. scripts/measure.py macos measured it on 2026-10-13 and promote recorded it (below); docs: record release 0.1.0-6e7e065-94d85365 as DG-1's qualified release #34 records it here as DG-1's qualified release.

Installed, 14:42 UTC.

Release 0.1.0-6e7e065-94d85365, MANIFEST.json SHA-256 4535b52cc6466e892ebee2a2ad52f396e6b7520d7560e7e25c20ffa3647ed0df, built by scripts/package.py --offline from a clean worktree at 6e7e065 (tree 2a10127). Wire version 1, protocol 1, journal and configuration schema 1, the same capabilities as the previous release. The installed binaries match the manifest.
upgrade replaced 0.1.0-5daee5d-b3fa569e: the drain took 50 ms with nothing charged, the journal was backed up under backups/, and the previous release is the last known good. devguardd status and devguard doctor --require admission,registration,macos-cooperative pass.
Finding. The host's memory pressure was at warning before and after the upgrade. A starting service is Critical until memory has been normal for 30 seconds (docs/operations.md, "Startup state"), so after the restart every governed execution on the host was refused; the old service had started with normal memory and was Constrained under the same warning. The governed smoke (a Cargo build of devguard-qualify) was refused 66 times in 10 minutes and did not start. doctor does not check current pressure. A rollback would restart a service too and would not help. Service restarts and the measurement need normal memory.
Recovered, 15:25 UTC. After memory had been normal for 30 seconds the service became Constrained, about 43 minutes after the restart, and admits again. The rerun smoke (the same command) was admitted at once and passed: devguard-qualify built in 7 s with exit 0, and the attempt was released (scope_terminated, no tracking loss). Memory went back to warning right after; the service stays Constrained, which admits up to half the work capacity. One doctor run in that state reported registration false because its client missed a reply deadline while the service had served the request; the next run passed.

The codespace consumer, 16:54 UTC.

Policy. host.toml gained one table: consumer codespace, generation codespace-g1, role control_service, one instance, a static reservation of 150 mCPU, 512 MiB and 40 tasks, and the digest of a new 64-character secret in a private file. The rest of the file is byte-for-byte the backup, and DevGuard's own parser accepted it before the restart.
Restart. One launchctl kickstart -k at 16:54:26 while nothing was charged and memory was normal: the same release, healthy within 3 s. With normal memory at start the service left Critical at its first valid sample, so nothing was refused this time.
Effect. Work capacity went from 5,500 mCPU, 12,616,466,432 B and 144 tasks to 5,350 mCPU, 12,079,595,520 B and 104 tasks, exactly the reservation. The configuration fingerprint changed from 6c0e182b… to 8cbb019b…, the value DevGuard's parser computed from the new file, so the service serves it. doctor is satisfied with the same capabilities.
Probes. A CodeSpace gateway from 7024f74 with --features devguard connected twice and ran nothing: under --devguard status it reported the authority available without governing executions; under --devguard register it registered in process with its own PID. Afterwards nothing was charged and the instance was retired.
Evidence is sealed on the Mac, with a scan showing no credential digest or token in it.

The measurement, 2026-10-13.

How. The owner pasted one reviewed command into a terminal on the Mac: scripts/measure.py macos from a clean worktree at ea98d7f (protocol-2's measure.py and fixture) in a minimal environment with Rust 1.95.0. It ran a rehearsal first, the full protocol only if the rehearsal's sole reason was its short durations, and promote only if the run qualified.
Result. The rehearsal (04:18–04:23 UTC) was inconclusive only for its durations. The full run (04:23–08:31 UTC) qualified: cold and warm passed all three repetitions each, with no reason in any interval. Input to next paint had p99 at most 56 ms, status p99 at most 46.2 ms and termination acknowledgement p99 at most 167.9 ms in one idle interval and at most 77.1 ms elsewhere. No frame stalled, and all 1,370 load runs succeeded without connection loss, uncertain execution or duplicate launch. The service kept pid 23023 throughout, and every host pressure sample was normal.
Promotion. promote verified that the service runs the release and wrote its qualification record (SHA-256 fd4fed31…17a4). Both evidence directories are sealed on the Mac, with no credential digest or token in them.

CodeSpace harness. novelKR/CodeSpace#97 adds the qualification harness, the protocol it implements and the decision record that keeps participation off as the compatibility path; nothing is qualified by it. It merged at 8ed8b08 as 2117800. The Mac's check on 2026-10-13 found three faults in the harness, fixed before the merge: it expected exit code 1 for a governed PTY process's signal death, which is reported as 128 plus the signal; it read DevGuard's instances before DevGuard had seen their owner gone and retired them; and it started work while DevGuard still kept admission closed after a host sample that went stale while the authority was held. It also found one fault in CodeSpace: in uds mode, gateway shutdown killed the worker outright, so a governed pipe execution outlived the gateway until it ended by itself, about 30 seconds later, and only then was its attempt released. novelKR/CodeSpace#98 fixes it: the gateway closes the worker's connection and waits for the worker, which ends its processes as it exits. On the Mac the uds shutdown case then passed in 3.3 s, where it had taken 33.2 s, and the fault, matrix and authority suites passed in both runner modes. It merged at b74e5c2 as ca306ee.

Ledger. #33 records CSRG-U6 as active, as of 2026-10-12, in the same eight files as #30. It merged at 8fca59c as ea98d7f, and its post-merge CI passed (38265196143). #34 records 0.1.0-6e7e065-94d85365 as DG-1's qualified release, with the re-measurement's result beside protocol-2's. It merged at 4a1d6b3 as c077c74, and its post-merge CI passed (38378641277). #35 records CS-RG as implemented, qualification macos-qualified, with its qualified combination, and CSRG-U6 as merged-verified, as of 2026-10-14: the ledger, AGENTS.md, docs/milestones.md and, in English and Korean, the planning index, the CS-RG plan, the verification matrix and the consumer-readiness gates. It merged at 7653c14 as 970acf5, and its post-merge CI passed (38529213032).

CSRG-U6 scope, from the 2026-10-02 order:

Freeze the qualification candidate: CodeSpace commit, DevGuard client pin, daemon and helper artifact, Codex gitlink with its recorded patch, toolchain, wire version, configuration, host and modes.
Qualify each claimed mode separately (InProcess/UDS, pipe/PTY, off/required, shortage, authority unavailable and the rest of the order's list), and decide the legacy off path.
Run the bounded fault cases, control-path latency, resource accounting and regression suites, and preserve the evidence.
Update the ledger only for a qualified candidate, on exact-head approval. Linux required governance is reported as unsupported until DG-LINUX. After CS-RG the work stops; P1-RECOVERY needs separate authorization.

Why the consumer came first. The service reads host.toml only at start, and promotion refuses a policy (the host.toml hash, the configuration fingerprint and the capabilities) other than the measured one, so the consumer had to be in place before the measurement. The reservation leaves the measurement's load (about 2,600 mCPU, 4 GiB and 48 tasks) inside the Constrained capacity. Changing it later means retiring the instance and measuring again.

Qualification runs, 2026-10-13.

Candidate. The Mac recorded it at 16:23 UTC with the harness's candidate suite, on CodeSpace main at ca306ee: the commit and the SHA-256 of its code tree, the DevGuard client pin 6e7e065, the Codex gitlink with the recorded patch checked, the release 0.1.0-6e7e065-94d85365 with every installed binary matching its manifest, the policy (configuration fingerprint 8cbb019b…, doctor satisfied, the codespace consumer), DG-1's qualification record of the release under the same policy, and Rust 1.95.0. The cloud checked the record and recomputed the code tree hash from the commit; they match.
Short suites, 16:40–16:54 UTC. In both runner modes the functional matrix passed all 45 checks, the fault cases all 27 (13 in each mode, and a killed worker in uds only), and the authority-failure suite all five phases. A control rehearsal was inconclusive only because its durations are below the protocol, as designed. Each run is sealed on the Mac and verify recomputed its verdicts from the raw files.
Regression stages, 17:00–18:01 UTC. validate-upstream.py all passed every stage it runs on macOS: 782 tests passed, none failed and 9 were ignored. Linux isolation does not run on macOS and is left to CodeSpace's Linux CI. The macOS-only macos-core and macos-fork-race passed in a second run: 189 tests passed, and all 400 fork-race trials passed, 72,946 children each with an exit code and no crash report. The protocol names both stages together with all in one command, but all replaces the other stage names, so they ran separately; the protocol's text is corrected with the final report, a documentation change that keeps the candidate. Both runs are sealed on the Mac.

Control-path measurement, 2026-10-13 to 10-14.

How. The owner pasted one reviewed command into a terminal on the Mac: the harness's control suite on the candidate's binaries in a minimal environment with Rust 1.95.0, against the installed release under DG-1's cold load. It ran a rehearsal first, and the full protocol only if the rehearsal's sole reason was its short durations.
Result. The rehearsal (23:20–23:24 UTC) was inconclusive only for its durations, and its four intervals passed. The full run (23:24–03:33 UTC) qualified: both runner modes, three repetitions each, all twelve intervals passed, idle and under load (load intervals of 1,829 to 1,865 s). Status p99 was at most 4.922 ms (target 500 ms) and termination acknowledgement p99 at most 0.804 ms (target 1,000 ms); the process group was gone with p99 at most 92.9 ms, and this service's release p99 was at most 208.3 ms. No slot was missed, no I/O line or MCP connection was lost, nothing stayed charged, nothing was launched twice and no uncertain attempt was admitted again. The load made 1,199 runs, all successful. Every host sample was at memory pressure level 1, CodeSpace's execution owner stayed within the codespace reservation (at most 19.3 MiB, 16 threads and a mean of 2.5 mCPU), and the service kept pid 23023 throughout.
Evidence. Both directories are sealed on the Mac, and verify recomputed their verdicts from the raw files (MANIFEST.json ac79024e…039f and 7706aac7…e9be). A scan of their 1,479 files found no credential digest, token or environment dump. Afterwards nothing was charged, no lease was open and every CodeSpace instance was retired.
Linux. CodeSpace's scheduled full-profile CI run on ca306ee (23:25–23:42 UTC) passed every job, Linux isolation included.

Report. novelKR/CodeSpace#99 adds the qualification report (English and Korean), the supported modes, adoption and rollback steps, and the protocol's corrected regression command. It changes documentation only, so the candidate stays. It merged on the owner's approval at 68e274d as 241cf6c; its post-merge CI passed and the documentation site deployed.

Next. None: CS-RG is complete, and the work stops here. P1-RECOVERY starts only with the owner's separate authorization; DG-LINUX, DG-CACHE and DG-ADAPTERS stay not started.

Open decision: none for CS-RG.

State.

CodeSpace main is 241cf6c, whose code tree is the candidate ca306ee's, with Codex gitlink 6b9826e plus the recorded patch, and DevGuard client pin 6e7e065.
DevGuard main is 970acf5. Its code is that of 6e7e065.
The owner's Mac runs 0.1.0-6e7e065-94d85365, DG-1's qualified release since 2026-10-13, under a policy with the codespace consumer; its last known good release is 0.1.0-5daee5d-b3fa569e.

Generated by Claude Code

2026-10-14, P1-RECOVERY started. On 2026-10-14 the owner directed P1-RECOVERY's implementation in CodeSpace as one pull request per unit, P1R-C01 to P1R-C06, merged in order. It is tracked in novelKR/CodeSpace#101, not here; whether to close this issue and novelKR/CodeSpace#76 is decided separately.

Ledger start and plan re-baseline: docs: start P1-RECOVERY and re-baseline its plan #36, merged on the owner's approval at head 9b19078 as main 165cb84; post-merge CI green.
CS-RG stays as recorded by docs: record CS-RG as implemented and qualified on macOS #35 (970acf5).

Generated by Claude Code

Navigation Menu

Repository navigation

Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) #14

What this issue is

State when written (re-queried 2026-09-27 15:05 UTC; PR heads rechecked 15:50 UTC)

Start here

Boundaries

Merge track

Architecture track (open owner decisions)

Other open items

12. Staged Codex pin strategy after the current A/B/C work

12.1 Transitional strategy

12.2 Same-executable versus separate-executable rule

12.3 What a DevGuard-first `0.159.x` move would and would not prove

12.4 Future work package D: DevGuard-only stable candidate refresh

12.5 Transitional compatibility gate

12.6 Preserve the `0.154` CodeSpace baseline as comparison evidence

12.7 Later CodeSpace convergence is a separate owner gate

12.8 Interpretation rule for future agents

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Handoff: CS-RG hold, boundary revalidation and pending owner approvals (2026-09-27) #14

Description

What this issue is

State when written (re-queried 2026-09-27 15:05 UTC; PR heads rechecked 15:50 UTC)

Start here

Boundaries

Merge track

Architecture track (open owner decisions)

Other open items

Activity

novelKR commented on Sep 27, 2026

novelKR commented on Sep 27, 2026

novelKR commented on Sep 27, 2026

novelKR commented on Sep 27, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 28, 2026

novelKR commented on Sep 30, 2026

novelKR commented on Sep 30, 2026

12. Staged Codex pin strategy after the current A/B/C work

12.1 Transitional strategy

12.2 Same-executable versus separate-executable rule

12.3 What a DevGuard-first 0.159.x move would and would not prove

12.4 Future work package D: DevGuard-only stable candidate refresh

12.5 Transitional compatibility gate

12.6 Preserve the 0.154 CodeSpace baseline as comparison evidence

12.7 Later CodeSpace convergence is a separate owner gate

12.8 Interpretation rule for future agents

novelKR commented on Sep 30, 2026

novelKR commented on Oct 1, 2026

novelKR commented on Oct 2, 2026

novelKR commented on Oct 2, 2026

novelKR commented on Oct 7, 2026

novelKR commented on Oct 7, 2026

novelKR commented on Oct 8, 2026

novelKR commented on Oct 9, 2026

novelKR commented on Oct 11, 2026

novelKR commented on Oct 11, 2026

novelKR commented on Oct 12, 2026

novelKR commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

12.3 What a DevGuard-first `0.159.x` move would and would not prove

12.6 Preserve the `0.154` CodeSpace baseline as comparison evidence