[Patrick-Erichsen]

The actual fixed Solaris diagnostic 41046695523 locates eight TypeErrors in LangChain response serialization, but exporting raw exception text would violate its privacy contract. Add one boolean that matches only the exact known Pydantic MockValSer/SchemaSerializer TypeError. This tests that hypothesis while exporting no message, substring, arbitrary label or hash.

The reader defaults older fieldless records to false and rejects malformed flags or incompatible exception classes. The existing security spec records the export limit. Classification, retries, workflow admission, source/model/budgets and publication/security behavior are unchanged. This is diagnostic enablement; it does not establish the actual error signature or recover Solaris.

Before/after proof: the privacy regression fails before, then all10 focused controls pass. In a paired actual installed CLI control with the same deliberately injected known TypeError, both cases exit2, make eight simulated calls, retain five TypeErrors and identical failed report facts, and preserve all1,335 original hashes. After adds eight true flags with no raw error literal or privacy canaries; network and actual models are disabled. The control uses a published3308 static image with matching hosted pivotal dependency versions and analyzer-base hash; it proves the observer contract only.

Validation: all8,378 full tests pass/five configured skips/four workers, coverage thresholds pass; static, full TypeScript/build and schema+CLI package types pass. Independent restricted Sol/high P0–P3 review: scoped-clean, zero findings. Existing400-call and native mocked-HTTP controls did not reproduce the real TypeError and remain explicitly non-recovery evidence. Follow-up is the actual fixed hosted workflow, then the causal repair.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 30, 2026 11:44am UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[Patrick-Erichsen]

Inspectable before/after output for head 5ea70d7a98646555dc5d30e408a848f709c801c1:

{
  "before": {
    "cliExitCode": 2,
    "simulatedModelCalls": 8,
    "executionSuccessful": false,
    "status": "failed",
    "TypeErrorCount": 5,
    "all1335OriginalHashesPreserved": true,
    "actualModelsInvoked": false,
    "networkEnabled": false,
    "publisherCodeExecuted": false
  },
  "after": {
    "cliExitCode": 2,
    "simulatedModelCalls": 8,
    "executionSuccessful": false,
    "status": "failed",
    "TypeErrorCount": 5,
    "all1335OriginalHashesPreserved": true,
    "actualModelsInvoked": false,
    "networkEnabled": false,
    "publisherCodeExecuted": false
  },
  "sameCliOutcomeAndReportFacts": true,
  "signatureFlags": 8,
  "onlyFixedBooleanExported": true,
  "rawErrorAndPrivacyCanariesAbsent": true,
  "observerLines": 10,
  "limit": "Exact known error deliberately injected into actual installed CLI; proves observer behavior, not actual production signature or recovery."
}

The same deliberately injected known TypeError runs through the installed CLI with and without the observer. Source, all original bytes, failed CLI result, call counts and report facts remain identical. After exports only the fixed boolean and existing bounded metadata. The local published3308 image has a matching hosted pivotal-dependency overlay and analyzer-base hash; these are simulated-error controls with network and real models disabled. They do not establish the actual hosted signature or publication recovery. The next step after normal current-head gates is the fixed hosted diagnostic.

The new privacy regression fails before the amendment, then10 focused/all8,378 full tests pass (five configured skips/four workers), coverage/static/types/build pass, and independent restricted P0–P3 review is clean with zero findings.