[lukemaj]

What: Add one bare launch mode with native shell/file tools and receipts across supported providers.
Why: Narrow tasks currently inherit unrelated harness and Chromeria context, and the manual Codex wrapper denies PTY creation.
So what: Merged as f23fad2d94a8832c744fc679948fefb1d5f3b11b; deployment rides the planner’s next batch.

Closes #289. Implements the settled user decisions and accepted Opus design, including the Sol and Grok correction verdicts recorded on the Issue. Bare intent persists through public launch calls, delegation, Spectrum, schedules, remote routing and native recovery. Admitted permissions retain caller ceilings; additions are explicit, and a skill contributes only its body. Receipts distinguish planned controls, actual observations and retained harness content.

Codex, Claude, Grok and OpenCode v1 have stripping recipes supported by native evidence. Cursor supports the SDK controls with its unauthenticated custom-prompt gate disclosed. Antigravity and other adapters lacking a demonstrated stripping interface refuse with concrete reasons. Normal launches keep their existing path. No version bump, new credentials or deployment.

The original Codex Permission denied (os error 13) was caused by bubblewrap device binding denying PTY creation; production bare launch uses no bubblewrap. Integrated proof also caught shared Codex SQLite bootstrap state, repaired with a fresh-thread native home owner inherited by native forks, plus exact Claude builtin plugin identities.

Proof and limits: current-head authenticated native proof on 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0, rebased onto main 9f46c833b19223e38a1dfb654d2735e54d47c1f7. Bare Codex, Claude and Grok each ran actual shell commands and emitted receipts; two fresh Codex threads ran concurrently with distinct homes; native fork and persisted source/fork resume passed. The Grok launch used the maximum public request ID length. Native records corroborate outputs and receipt limits. Integrated ContextMD lifecycle hooks are bypassed in bare mode, with ordinary-launch control regressions.

Focused proof: 47 files / 1,275 tests before subsequent affected changes; refreshed ContextMD integration proof passed 17 files / 561 tests and five affected typechecks; final Grok profile correction passed 3 files / 52 tests, provider-grok typecheck, scoped lint/format and fork checks. CI owns complete-suite proof. Final worker handoff and ContextMD integration handoff retain commands and candidate identity. Sol and Grok fresh exact-head reviews passed; both required statuses are success from the authenticated repository account, and complete CI is green. Native proof and acceptance are satisfied within the declared provider limits. Managed Codex, OpenCode and Cursor were not live exercised by this integrated run; their adapter support and limits are stated above.

Upstream-first search found no bare/minimal launch candidate to port; the Issue records the searched upstream revision and results. Optional client controls, named integrations and other adjacent work remain linked follow-ups. Shared notice rendering carries receipts to web, desktop and mobile; no new UI control or browser verification is part of this PR.

Requirements and who asked: User #289 requests maximum harness-supported stripping, honest receipts, full native tools within admitted authority, explicit additions/body-only skills, six-provider decisions, native proof and gated merge.
Deleted: Separate reduced mode, dependency closure, shared fresh native bootstrap state, OS masking, normal fallback, auth copying/locks, version bump and deployment.
Bottleneck: None for merge; native proof, independent reviews and CI passed.
Checked myself: Accepted design/recheck comments, upstream search, actual rebased source and focused test/typecheck output, authenticated native launch/projection/receipt, native transcripts and concurrent startup stderr.

Implementation and integration: GPT-6.1 Sol through Codex; design: Claude Opus 5.5; roasts: GPT-6.1 Sol and Grok 4.7.

[lukemaj]

What: Current bare launch passed real Codex and Claude shell-and-receipt proof, concurrent fresh Codex starts, native fork and native resume.
Why: Public native execution validates permissions, stripping and native history ownership beyond replay tests.
So what: Exact-head Sol/Grok reviews and green CI remain before PR #335 merges; deployment stays with the planner.

Head fa828eea3c2a7fcfcec7f728454272e050e18fb6, base fbbe448316be1af24aeefb3ed124b152e8817253, conflict-free and merge-free rebase. Only docs/map.md PR reference changed after source head 77a5dd00c03d9e09c78fe9cc2cb82320520cd337. Final 47-file focused command from the repair handoff passed 1,275 tests; affected server, contracts and provider-core typechecks passed, other previously checked provider package inputs are unchanged. Logs /tmp/chromeria-289-final-tests.log and /tmp/chromeria-289-final-types.log.

Authenticated public current-protocol WebSocket launch, dispatch, subscription milestones and projection reads against an isolated source server on bestia used real subscription Codex 0.162.1 and Claude 2.1.299. Task state/project root /home/luke/scratch/chromeria-289-final-tzb_47lo, planted AGENTS.md, CLAUDE.md and unnamed skill sentinels. Scripts /tmp/chromeria-289-final-proof.mjs, /tmp/chromeria-289-final-fork-proof.mjs, /tmp/chromeria-289-final-resume-proof.mjs; retained observations proof-summary.json under that root. No live userdata was opened read-write.

Both concurrent fresh Codex threads ran actual native commands with exit 0, distinct homes and printed receipts: BARE_289_INTEGRATED_0_OK and BARE_289_INTEGRATED_2_OK. Claude’s actual native Bash result was BARE_289_INTEGRATED_1_OK, six tools and empty skills/MCP/slash inventory. Its exact three builtin plugin IDs are observed_retained and effective permissions bypassPermissions. Codex admitted/effective full-access. All three projections completed.

Native fork inherited the source owner home, acquired a different native conversation/process, executed BARE_289_FORK_OK and retained the earlier conversation. Reopening only this task-owned source server against its own state then executed BARE_289_RESUME_0_OK and BARE_289_RESUME_1_OK on source and fork, exit 0. Both projections completed. Native protocol explicitly contains thread/fork and both thread/resume requests. No history copies/links or summary reconstruction. All task-native Codex rollouts have zero base text and developer messages, no unnamed sentinel and no receipt text in model history. Claude’s actual native transcript also has the shell marker and no unnamed sentinel. Skills/list discovery is honestly unobserved for prompt inclusion; partial inventories do not certify whole-launch removal.

Sessions and roots:

• thread:289:bare:0: codex 01a13c77-c319-73e2-b526-48895dda2cc7, owner thread:289:bare:0, records /home/luke/scratch/chromeria-289-final-tzb_47lo/home/userdata/bare/codex/codex/thread-d3027f6c789ed3ddfa4b7f3d975c0c225052385f52aa0bbe3bfe978825f63a8c/sessions.
• thread:289:bare:1: claudeAgent 97f7333f-f710-4d77-a598-b32cc0c4e801, owner thread:289:bare:1, records /home/luke/.claude/projects.
• thread:289:bare:2: codex 01a13c77-c313-7d30-9266-703683132707, owner thread:289:bare:2, records /home/luke/scratch/chromeria-289-final-tzb_47lo/home/userdata/bare/codex/codex/thread-a3ba30b79270a6011c2c4642439baf8aaba6005f320bb7d933f7e511cc61f8cc/sessions.
• thread:289:fork: codex 01a13c78-9ae0-7910-916e-20785a573131, owner thread:289:bare:0, records /home/luke/scratch/chromeria-289-final-tzb_47lo/home/userdata/bare/codex/codex/thread-d3027f6c789ed3ddfa4b7f3d975c0c225052385f52aa0bbe3bfe978825f63a8c/sessions.

Actual persisted and printed notice examples:

Bare launch. Admitted permissions: full-access; effective: Codex full-access.
Planned removal: Chromeria instructions, Prism kits, auto-discovered instructions, memory, skills, hooks, plugins, unnamed MCP/apps.
Kept by harness: native shell/file tool schemas.
Named additions: none.
Native evidence: mcp observed_clean: .
Unobserved: skills, tools, plugins, slash_commands, system_text, instructions, hooks, environment.
Native record: /home/luke/scratch/chromeria-289-final-tzb_47lo/home/userdata/bare/codex/codex/thread-d3027f6c789ed3ddfa4b7f3d975c0c225052385f52aa0bbe3bfe978825f63a8c/sessions.
Native session: 01a13c77-c319-73e2-b526-48895dda2cc7.

Bare launch. Admitted permissions: full-access; effective: bypassPermissions.
Planned removal: Chromeria instructions, Prism kits, auto-discovered instructions, memory, skills, hooks, plugins, unnamed MCP/apps.
Kept by harness: system text '.'; builtin plugins: cc-plugin-agents-md, cc-plugin-telemetry, cc-plugin-plugin-authoring; managed policy settings and hooks; environment/date/session metadata; native tool schemas.
Named additions: none.
Native evidence: tools observed_clean: Bash, Edit, Glob, Grep, Read, Write; skills observed_clean: ; plugins observed_retained: cc-plugin-agents-md, cc-plugin-telemetry, cc-plugin-plugin-authoring; mcp observed_clean: ; slash_commands observed_clean: .
Unobserved: system_text, instructions, hooks, environment.
Native record: /home/luke/.claude/projects.
Native session: 97f7333f-f710-4d77-a598-b32cc0c4e801.

Task-owned server PIDs 220497 and 240352 were stopped through captured process groups after proof. No live Chromeria restart, deployment, browser, memory write, credential publication or version bump. Reviews 289-sol-pr335-review-r1 and 289-grok-pr335-review-r1 are active on this head; no readiness or merge claim yet.

Requirements and who asked: User requires native Codex/Claude shell and receipts on bestia plus isolation and preserved supported paths before gated merge.
Deleted: Replay as live certification, shared fresh bootstrap state, whole-context claims from inventories and cross-home history reconstruction.
Bottleneck: Exact-head independent review and CI.
Checked myself: Public projections, actual native command outputs/exit codes and fork/resume requests, whole task-native transcript sentinel/receipt checks, persisted owners/roots/notices, focused/typecheck logs and exact candidate identity.

[lukemaj]

What: Independent review requests one correction: valid long MCP request IDs prevent a supported bare Grok launch from opening.
Why: Grok puts the entire encoded application thread ID in one filesystem component, which can exceed NAME_MAX before native startup.
So what: The implementation owner fixes B1 and adds focused boundary proof; this reviewer rechecks the changed exact head, while CI and delivery remain parent-owned.

Verdict: REQUEST CHANGES, one blocking finding under the supported-provider-breakage bar. Reviewed cumulative head fa828eea3c2a7fcfcec7f728454272e050e18fb6 against base fbbe448316be1af24aeefb3ed124b152e8817253. No source authorship, delegation, source/Git edits, service start, native CLI/model call, credentials, browser, memory, version bump, merge or deployment.

B1 [P2]: Bound the Grok home directory component independently of public thread-ID length

Location: provider-grok adapter.ts:463.

Concrete public trigger: from an active admitted MCP caller, call create_threads with a valid clientRequestId of 256 ASCII a characters and a thread entry with bare: {}, a prompt, and an enabled/authenticated Grok target. The request contract accepts 256 characters. stableThreadId includes that key and the caller namespace; createThreads uses it without truncation. A regular 36-character UUID namespace produces a 306-character thread ID and a 314-byte encoded home component. Bare Grok admission advertises support and accepts empty additions.

Actual result: openSession builds <bare-root>/grok/<encodeURIComponent(threadId)>; prepareGrokBare immediately tries to create it, before auth links, inventory inspection or ACP startup. The directory component exceeds this host's 255-byte NAME_MAX, so the accepted thread cannot start. delegate_task also derives its child ID from the request command and exposes the same failure mechanism. This is a supported launch-path failure, not the deferred Grok helper-prompt or named-MCP work.

Independent discriminating proof: in separate reviewer scratch workspace /tmp/chromeria-289-sol-review-x4dbuqvx, reproduced the exact stableThreadId and URI-encoding transformations with a regular UUID namespace and the admitted 256-character key. Creating that component failed with errno 36, File name too long; a short-component control succeeded. This is a filesystem-boundary reproduction plus exact-source reachability, not an executed Grok integration test or subscription claim. The frozen worktrees remained untouched.

Smallest correction: derive a bounded, stable directory name from the Grok thread ID, as the Codex repair already does for its home owner. Preserve Grok's per-thread separation and stable resume root. Add focused adapter/preparation coverage proving valid long public IDs reach the process boundary and reopen the same home, with the ordinary path unchanged. No auth, history-copy or retry machinery is needed. Searches for ENAMETOOLONG, Grok bare home length, and Grok bare found no separate existing owner for this mechanism; it belongs to #289/PR #335.

Inspected scope and cleared concerns

Read the complete cumulative diff, exact-SHA source and surrounding callers, current Issue body, settled user decision, accepted revision 2.1 and both corrections/rechecks, implementation/native-defect/home-owner/repair handoffs, and current PR body/proof comment. Traced public client/MCP launch, delegation, batch, Spectrum, admission/read grants, destination/worktree resolution, persisted schedules and checked sends, peer capability/retry guards, role/persona/context suppression, final addition delivery, resume refusal, rollback/native-fork carrier handling, provider controls and receipts, and omitted-bare compatibility.

The Codex owner is server-stamped for fresh creation and inherited by native forks; raw launch requests cannot provide it and client resolved-state dispatch is refused. Its hashed component addresses this long-ID mechanism. Managed Codex retains its credential route; no credential-copy, new OAuth or bare lock was introduced. OpenCode config covers both build and plan, and per-prompt session permissions preserve native plan edit restrictions. Claude records the exact three cc-plugin-* builtin IDs and explicitly disclaims pre-inference init timing. Grok disables discovered skills/plugins, denies conditional web_fetch, checks six tools plus seven commands before prompt, and reads native chat history for unexpected reminders. Cursor's account-gated replacement remains disclosed and unverified; unsupported adapters refuse with reasons. I established no second blocking finding.

Evidence and remaining proof limits

Inspected the actual parent focused-test log: 47 files / 1,275 tests passed. I did not rerun that suite or typechecks. Inspected task-owned raw native protocol and Codex rollouts, rather than accepting the summary file alone: fresh sessions have distinct roots/native IDs, source/fork share the intended home, actual thread/fork and both thread/resume requests clear base/developer instructions, and the native completed commands contain the integrated, fork and resume markers with exit 0. The three Codex rollouts have zero base text, no developer message, and no planted unnamed sentinels or receipt text. Claude's raw SDK events show the actual Bash result marker, six tools, empty skills/MCP/slash inventory and the exact retained plugin identities. This corroborates parent proof; it does not certify whole native context or prove every provider/runtime category.

Required gap from this review: B1 repair and focused long-ID boundary proof on the changed candidate, followed by the required exact-head review/status. CI and the other independent review remain separate merge gates. Native recipe/inventory observations are partial; I claim no new integrated Grok/OpenCode/Cursor/managed-Codex execution, refresh stress result or delivery readiness. PR remains draft.

Existing excluded follow-ups remain #315 native refresh, #316 exact integrations, #317 immutable bodies, #318 Cursor prompt, #319 client controls, #320 OpenCode 2, #321 Grok helpers, and Agent Observer #92. No duplicate follow-up or settled decision was reopened.

Requirements and who asked: User #289 and this review brief require one maximum-stripping bare mode, admitted native tools, explicit/body-only additions, honest receipts and working supported providers across callers; this serves Drafters and Spectrum in the Objective.
Deleted: Additional modes, optional UI/auth/blobstore/Cursor work, hypothetical blockers, whole-context certification from partial observations and redundant native calls.
Bottleneck: A concrete Grok filesystem boundary failure for valid public IDs; repair and exact-head review must precede delivery.
Checked myself: Canonical operations Verification/Code review and linked review/impact procedures, accepted records, complete exact-base/head diff and relevant source, raw task-native evidence and focused-test output, public ID derivation, independent NAME_MAX/mkdir failure with short control, duplicate searches, and frozen Git state.

Reviewer: GPT-6.1 Sol through Codex, actual configured reasoning effort medium. This running harness exposes no in-turn effort control, so high effort is not claimed.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	4.9 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.8 KiB	20.8 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 9f46c83 · PR result: 2b8baee · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

What: Sol found one Grok path-length blocker, and CI found a missing BareLaunch fixture dependency.
Why: A valid 256-character public request key makes Grok’s encoded home component exceed NAME_MAX; the direct memory-test layer predates the new service dependency.
So what: The same implementation writer repairs both, preserves the memory assertions and runs focused checks before the parent pushes a new candidate for fresh Sol/Grok review and CI.

Current published head remains fa828eea3c2a7fcfcec7f728454272e050e18fb6. Sol findings and its failure status are accepted: the public-ID reachability and 314-byte native directory component establish a supported-provider failure. The correction uses bounded stable Grok per-thread home names, retaining isolation and native reopen behavior.

CI Test Server 6 failed four cases in ProviderTurnStartService.memory.test.ts, all with Service not found: t3/orchestration-v2/BareLaunch, from the direct ProviderTurnStartMemory.fixture.mjs construction. Failed job; retained log /tmp/chromeria-289-ci-server6.log. The fixture needs the new dependency; its actual lifetime assertions and timeouts stay unchanged. Other CI jobs passed, but the overall gate remains failed.

Repair continuation 289-bare-implementation-v1 ordinal 4 is the sole writer. Grok review round 1 is still active on the old exact SHA, so any findings apply to that candidate. The user’s later main-rebase instruction requires both fresh exact-head reviews on every pushed candidate; neither old status is transferred to the new head. No server restart, deployment or native model call is needed for these repairs. The completed Codex/Claude/fork/resume proof remains recorded with its exact source identity and unchanged-path limit.

Requirements and who asked: User requires working supported providers, current exact-head Sol/Grok success and green CI before merge.
Deleted: Old-head review reuse and treating focused tests as full CI coverage.
Bottleneck: One native filesystem boundary and one test-layer dependency before fresh review.
Checked myself: Complete Sol finding, exact CI failed-test/error output and live check state, current head and sole-writer continuation acceptance.

[lukemaj]

What: The Grok path and CI fixture repairs are complete; bare launch is now integrating main’s new native ContextMD hooks.
Why: Merged PR #327 adds instruction staging, installation, attachment, fork and rollback effects that bare launches must bypass.
So what: The same writer rebases onto current main, preserves ordinary ContextMD behavior and proves bare bypass before a fresh pushed candidate receives both exact-head reviews and CI.

Repair handoff at local 2763fed81202dc0d765b66f3c3befdbd284a4674 passes 54 focused tests, both affected typechecks and scoped/fork checks. Parent inspected the complete five-file repair diff: bounded stable Grok homes and the missing BareLaunch fixture dependency, no Codex/Claude behavior changes. Published PR head remains fa828eea3c2a7fcfcec7f728454272e050e18fb6.

Main is now 01d7066bb72e195af8c51a6e38aea3aada805d2d. I inspected its new core/native provider diffs: ProviderTurnStartService stages Grok instructions and records/attaches installations, native fork records ContextMD state, and CheckpointRollbackService requests/adopts Grok instructions. These new normal effects require an explicit bare bypass at their owners and a session-open effect-boundary guard. Native context must not be activated and then stripped. Required service/fixture integration retains both new dependencies and substantive memory assertions.

Implementation continuation ordinal 5 owns the sole workspace/branch writer. It will publish exact base/head and focused normal/bare lifecycle evidence. Parent then refreshes public native artifact proof, pushes, requests fresh Sol/Grok comments/statuses and verifies CI before merge. Prior exact-head review remains historical; the active Grok round 1 is still pinned to that old head. No native service or live-state mutation accompanies this source integration.

Requirements and who asked: User’s current-main rebase instruction and settled bare exclusion of ContextMD serving/context.
Deleted: Reuse of native proof across a new lifecycle hook without inspection, and activating ContextMD on bare before stripping its output.
Bottleneck: Native lifecycle integration at one current main base before final review.
Checked myself: Complete repair handoff/diff and current main’s exact ProviderTurnStartService, SessionManager, Rollback, core/ACP adapter changes; accepted same-writer continuation. Integration completion is not yet claimed.

[lukemaj]

What: Independent review of fa828eea3c2a7fcfcec7f728454272e050e18fb6 fails because a schema-valid MCP create_threads key makes a bare Grok launch fail before the native process starts.

Why: The Grok home directory uses the whole encoded application thread id as one filesystem component, and a UUID MCP namespace plus a long accepted clientRequestId pushes that component past NAME_MAX.

So what: The implementation owner bounds that home name on a new exact head. This review does not certify native resume, whole-context stripping, or CI, and the PR stays draft.

Requirements and who asked: The user, in #289, asked for one bare mode, maximum harness-supported stripping, honest receipts, and full native shell and file tools only inside admitted authority. The parent asked for this independent Grok review of exact head fa828eea3c2a7fcfcec7f728454272e050e18fb6 against base fbbe448316be1af24aeefb3ed124b152e8817253.

Deleted: A second reduced mode, bwrap, normal fallback, auth copies, version bump, deployment, follow-ups #315-#321 and agent-observer#92, optional UI, the Cursor account gate, and any live native or subscription call by this review.

Bottleneck: packages/provider-grok/src/server/adapter.ts:463 sets the bare home to encodeURIComponent(threadId). prepareGrokBare (adapter.ts:530, GrokBareRuntime.ts:113) creates that directory before startup.

Checked myself: git show fa828eea3c2a7fcfcec7f728454272e050e18fb6 for the home, stableThreadId (OrchestratorMcpService.ts:593 and the create_threads call at :2689), OrchestratorMcpClientRequestId max 256, and requestNamespace: providerSessionId from randomUUIDv4 (McpSessionRegistry.ts:131 and :137). A UUID namespace plus an alphanumeric key of 198 characters encodes to 256 bytes. A 256-character key encodes to 314 bytes. mkdir of a 314-byte component on this machine returns ENAMETOOLONG (errno 36). A 255-byte component succeeds.

This is the same reachable break Sol reported. I did not treat later unpushed commits or the moving worktree as the candidate. The live PR head at comment time is still fa828ee.

No second behavior blocker under the stated bar. I found no reachable launch that grants access the user did not ask for, and no harness-removable content left off the receipt, on the callers and provider edges below. The missing BareLaunch memory-fixture dependency is already owned by the parent CI note. It is a test-layer break, not a second provider-behavior finding here.

Checked on this head, without re-running the suite:

• Client thread.create and delegated_task.request still refuse a caller-supplied bare payload. nativeHomeOwnerThreadId is server-stamped. Codex homes stay thread- plus the SHA-256 of that owner.
• Prism kitText is empty when bare. Promachos refuses bare. Spectrum omits kit text. A bare schedule and a peer forward carry the unresolved request and resolve or refuse at the destination.
• Claude's known plugin ids are cc-plugin-agents-md, cc-plugin-telemetry, and cc-plugin-plugin-authoring.
• Grok denies web_fetch, refuses named t3-code MCP, and gates the before-prompt tool and command lists. Its static capabilities do not advertise native fork.
• OpenCode build and plan keep the admitted permission filter. Installed OpenCode 1.19.0 contains permission:"edit" and no permission:"write", so the enabled write tool stays on the admitted edit rule. OpenCode 2 and unsupported agents fail closed.
• Managed Codex still keeps its credential owner and does not write auth.json.
• A persisted bare receipt is a system_notice, which the history adapter drops, so the receipt itself does not trip the missed-text refusal.

Required proof gaps, not certified by this review: parent-owned native resume and whole-context evidence, Cursor's account-gated prompt, and CI. Partial native observations do not certify the whole context. ContextMD rebase work after this head was not part of this review.

[lukemaj]

What: The pushed ContextMD integration passes required Codex/Claude native proof, but an additional integrated Grok check found a profile-default mismatch before inference.
Why: The design removed agentProfile.tools as “ignored”; native Grok uses its presence to select foreground shell defaults and suppress background/scheduler helpers.
So what: The same writer restores the proven six-tool field, then the parent reruns native proof and starts both fresh exact-head reviews.

Published head 8dd683b60388ef06c4d9ca16f0a6c2f2a68ebe37, base 9f46c833b19223e38a1dfb654d2735e54d47c1f7. The writer’s final integration handoff passes 561 focused tests and five targeted typechecks. The parent inspected the lifecycle guards and pushed with an exact lease against the prior PR head. On this artifact, public authenticated bestia bare Codex/Claude launches again execute shell markers and print receipts; both fresh Codex homes run concurrently. Root /home/luke/scratch/chromeria-289-final-z44t5nua, log /tmp/chromeria-289-current-native-proof.log.

The added long-ID Grok public launch reaches its bounded native home and session, proving the path repair. Its exact pre-inference gate then reports unexpected kill_command_or_subagent, get_command_or_subagent_output, wait_commands_or_subagents, scheduler_create, scheduler_delete, scheduler_list and loop. It refuses before session/prompt, so no unexpected model tools were used. The task-native record contains only initial system text, not a submitted task.

I corrected the earlier inference with a controlled native metadata comparison on installed Grok 1.0.52. Using the exact production profile (name/description plus deny14, no tools/allowedTools) reproduces 12 tools and loop, without a model prompt: /tmp/chromeria-289-grok-exact-metadata-probe.py, session 01a13cb2-8d56-7141-acbc-c7060514d701, root /tmp/chromeria-289-grok-sub-xil5gaya. Adding only agentProfile.tools with run_terminal_command, read_file, search_replace, list_dir, grep, write restores exactly six tools and the seven expected commands: /tmp/chromeria-289-grok-tools-foreground-probe.py, session 01a13cb3-3eaf-7a91-9912-cb475baa91d8, root /tmp/chromeria-289-grok-sub-h8u9b14g. Skills/plugins remain disabled by identity. No inference was run in these comparisons.

Simply denying the six extra tools fails native session initialization because background shell defaults require output/kill helpers. A scheduler=false experiment was unnecessary on reversal and is discarded. The smallest correction retains deny14 and the inventory gate, and restores the single positive native-tool field. Earlier claims that this field is entirely inert are superseded; no allowedTools field, retry, extra permission or new mode is needed. Runtime proof still decides the complete integrated recipe.

Repair continuation ordinal 6 owns the only source writer. Parent stopped task-only proof server captured PID 543052 before handing back source. No live Chromeria restart/database, deployment, browser, memory write or credential publication. New independent review is postponed until this known native defect is repaired; no prior status is carried forward.

Requirements and who asked: User requests native shell/file defaults, stripped unnamed extras and working supported providers; current native proof exposed a real recipe gap.
Deleted: The unsupported “tools entirely ignored” inference, deny20 (breaks native requirements), unnecessary scheduler config and allowedTools duplication.
Bottleneck: Correct native foreground tool selection before final exact-head review.
Checked myself: Current public native launch/projection/error, no-prompt task-native record, exact metadata comparisons and rejected-control error, unchanged installed version, current head/base and stopped task server.

[lukemaj]

What: Current candidate passes authenticated bestia native bare shell launches, receipts, concurrent Codex startup, native fork and persisted resume.
Why: The earlier wrapper denied PTYs, fresh shared Codex homes raced during native bootstrap, and Grok required its positive foreground tool profile.
So what: Independent Sol/Grok reviews and CI decide merge; the live Chromeria server remains untouched.

Candidate 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0, base 9f46c833b19223e38a1dfb654d2735e54d47c1f7. Source CLI server ran only against an isolated task-owned home on bestia, through authenticated public WebSocket launch/message/fork calls and installed native harnesses. No browser, live database, copied credentials, wrapper or deployment was involved. The task server was stopped by its captured PID after proof.

Actual native command outputs: BARE_289_INTEGRATED_0_OK and BARE_289_INTEGRATED_2_OK from concurrent fresh Codex threads; BARE_289_INTEGRATED_1_OK from Claude; BARE_289_INTEGRATED_3_OK from Grok with a maximum-length public request ID; BARE_289_FORK_OK from native Codex fork; BARE_289_RESUME_0_OK and BARE_289_RESUME_1_OK after restarting only the isolated test server. All runs completed, command records succeeded, and native tool results contained those outputs.

Codex native sessions: 01a13cba-f56a-7983-98bd-f898f73c42ae, 01a13cba-f573-7251-a2ed-154588115cc8; fork 01a13cbc-8883-71d3-b961-2f492983d6b1. Fresh sessions used distinct owned homes; fork and persisted resume retained their native IDs and source home owner. Inspected native rollouts had empty base instructions, zero developer messages and no unnamed project sentinels. Claude native session 5bdcd582-7160-4c33-9cb5-6dce1275e03b contained the actual successful Bash result and no unnamed sentinels. Grok session 01a13cba-f657-7b80-bad7-992b94c36712 exposed exactly six foreground tool definitions; native history contained the successful command result with no skill/plugin reminder or project sentinels. Its native user-info/rules block remains disclosed retained context.

Representative emitted receipts:

Bare launch. Admitted permissions: full-access; effective: Codex full-access.
Planned removal: Chromeria instructions, Prism kits, auto-discovered instructions, memory, skills, hooks, plugins, unnamed MCP/apps.
Kept by harness: native shell/file tool schemas.
Named additions: none.
Native evidence: mcp observed_clean: .
Unobserved: skills, tools, plugins, slash_commands, system_text, instructions, hooks, environment.
Native record: /home/luke/scratch/chromeria-289-final-33_8geyf/home/userdata/bare/codex/codex/thread-d3027f6c789ed3ddfa4b7f3d975c0c225052385f52aa0bbe3bfe978825f63a8c/sessions.
Native session: 01a13cba-f56a-7983-98bd-f898f73c42ae.

Bare launch. Admitted permissions: full-access; effective: bypassPermissions.
Planned removal: Chromeria instructions, Prism kits, auto-discovered instructions, memory, skills, hooks, plugins, unnamed MCP/apps.
Kept by harness: system text '.'; builtin plugins: cc-plugin-agents-md, cc-plugin-telemetry, cc-plugin-plugin-authoring; managed policy settings and hooks; environment/date/session metadata; native tool schemas.
Named additions: none.
Native evidence: tools observed_clean: Bash, Edit, Glob, Grep, Read, Write; skills observed_clean: ; plugins observed_retained: cc-plugin-agents-md, cc-plugin-telemetry, cc-plugin-plugin-authoring; mcp observed_clean: ; slash_commands observed_clean: .
Unobserved: system_text, instructions, hooks, environment.
Native record: /home/luke/.claude/projects.
Native session: 5bdcd582-7160-4c33-9cb5-6dce1275e03b.

Evidence retained outside tracked source in task root /home/luke/scratch/chromeria-289-final-33_8geyf: projections, native provider records and sanitized-proof-summary.json. Receipt categories explicitly distinguish planned removal, retained content, observed evidence and unobserved categories. This proves the required installed Codex/Claude path and additional Grok, concurrent startup, fork and resume paths; managed Codex, OpenCode, Cursor account gate and every possible named addition were not live exercised by this run. Focused regressions and adapter controls cover those declared boundaries; no blanket claim of complete native stripping is made.

The proof collector initially treated preparing as terminal; corrected observation waited for explicit terminal statuses and inspected the same launches without retrying them.

Requirements and who asked: User #289 requires real Codex/Claude shell commands and receipts on bestia plus honest harness limits.
Deleted: Live-state test server, browser ceremony, auth copying, wrapper masking and deployment.
Bottleneck: Current-head independent reviews and CI.
Checked myself: Actual public RPC projections, native tool results, six Grok tool definitions, Codex base/developer context, Claude retained plugin receipt, native fork/resume IDs and task process ownership.

[lukemaj]

What: Fresh independent Sol round 2 passes cumulative PR #335 at 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0, with no blocking findings under the agreed bar.
Why: The prior Grok filesystem failure is repaired with a bounded stable home, and the current provider controls and ContextMD integration preserve the settled launch contract without a concrete reachable violation found in this review.
So what: This exact head receives review/independent-sol=success; the parent still owns the separate fresh Grok verdict, green CI and delivery gates.

Verdict: PASS, reviewed exact head 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0 against base 9f46c833b19223e38a1dfb654d2735e54d47c1f7. This is a fresh independent review, not a continuation or transfer of either old-head verdict. The live PR head/base matched those identities immediately before publication. The frozen worktree remained clean and read-only.

Prior blocker and current repairs

B1 is cleared. Grok's adapter hashes the complete application thread ID into thread-<64 hex SHA-256>, a stable 71-byte component used by preparation, startup and the receipt. The focused regression decodes a maximum-length public MCP request, confirms the old 314-byte component, exercises actual temporary filesystem preparation and native process-boundary inputs for distinct sibling homes, and reopens the retained home through a freshly constructed adapter. The ordinary control avoids bare inspection and keeps its prior native argv/home. No auth-copy, lock, history-copy or retry mechanism accompanies this repair.

The final Grok metadata correction retains the original deny14 and adds exactly the six native foreground tools. I inspected both the production metadata path and the regression's serialized session/new request at a real fake-CLI process boundary. The exact tools/commands gate still precedes session/prompt; discovery disables every identified skill and plugin, and unsupported enabled hooks or unstable discovery refuse before inference. The current native record corroborates the six-tool recipe. The earlier claim that agentProfile.tools was inert is superseded by the correction and observed native evidence.

Main's ContextMD lifecycle is bypassed at its owners before staging, installation accounting, attachment, native-fork accounting, rollback lookup/accounting and reservation cleanup for bare threads. ProviderSessionManager and the ACP runtime-input builder also discard accidental native creation instructions for bare. Normal Grok retains its lifecycle, and ACP session/new merges normal creation rules and native metadata into one object. The memory fixture supplies the new BareLaunch dependency alongside ContextmdServing while retaining its substantive lifetime/GC assertions.

Cumulative inspected scope

Read the full cumulative Git diff and matching gh pr diff, exact-SHA source and relevant surrounding consumers, full current #289 body, accepted revision 2.1 and settled decisions, both parent design corrections and design rechecks, both original PR findings, repair/inherited-owner records, all later Issue handoffs and PR comments, including the current native proof record.

Traced client RPC, MCP top-level launch/delegation/batch, Spectrum, ordinary and checked schedules/replay, remote persisted intent and every-attempt destination capability guard; caller ceilings and realpath read grants; server-owned native-home identity and client-forging refusal; role/persona/ContextMD/handoff/restart/app-context suppression; final adapter-facing named-body delivery; accepted-native carrier, rollback/native-fork inheritance and resume failure; supported-provider controls, concrete unsupported refusals, and receipt evidence.

No concrete source-reachable launch was found that grants unrequested access, leaves harness-removable content without receipt disclosure, or breaks a supported provider. Native file and managed Codex credential routes remain distinct. Native forks retain the source's initialized home while fresh owners have separate homes/processes. Claude retains its exact three builtin plugin identities and discloses uncertain init timing. OpenCode covers both effective build and plan, reconciles session permissions before prompts and preserves native plan restrictions; external servers and 2.x refuse. Cursor's SDK controls remain supported with the unauthenticated prompt-replacement gate disclosed. Antigravity and adapters lacking a demonstrated stripping interface refuse concretely. Omitted bare intent retains the normal path.

Existing notice rendering covers web/desktop/mobile receipts; no new UI control is in scope. No source, Git, service, browser, native CLI/model, credential, memory, version, merge or deployment mutation was performed by this review. I did not run tests or create a reviewer worktree.

Evidence inspected and proof limits

Inspected actual focused logs, rather than handoff counts alone: /tmp/chromeria-289-renewal-focused.log reports 17 files / 561 tests passed, and /tmp/chromeria-289-grok-tools-focused-final.log reports 3 files / 52 tests passed. Inspected affected typecheck logs with no TypeScript errors. These are parent/implementation-owned executions, not reviewer reruns or a complete CI gate.

Inspected current task root /home/luke/scratch/chromeria-289-final-33_8geyf, persisted projections/receipts, raw provider protocol records and native Codex/Grok histories. The four fresh projections completed; Codex fresh homes differ; actual native results contain BARE_289_INTEGRATED_0_OK, BARE_289_INTEGRATED_1_OK, BARE_289_INTEGRATED_2_OK and BARE_289_INTEGRATED_3_OK. Codex native protocol contains thread/fork and source/fork thread/resume with empty base/developer instructions and tools.update_plan.enabled=false; actual exit-0 tool outputs include BARE_289_FORK_OK, BARE_289_RESUME_0_OK and BARE_289_RESUME_1_OK. Source/fork projections retain their owner and native IDs. Native Codex rollouts have empty base text and zero developer messages. Claude's raw init has six tools, empty skills/MCP/slash commands and the exact three retained plugin IDs, followed by the successful Bash result. Grok's native tool definitions contain exactly the six names; its history contains system ., the exit-0 shell marker, and no system_reminder. Planted project sentinels are absent from the inspected task-native records.

The corrected collector waits for positive terminal statuses on the same launches. Its earlier preparing assertion is an observer error, not a demonstrated production defect. I corroborated its result against persisted and native records.

This review does not certify whole-context stripping from partial inventories, every possible addition, managed-Codex/OpenCode/Cursor live execution, credential-refresh stress, CI, merge readiness or deployment. Receipts keep planned controls, known retained native content and unobserved categories distinct. Earlier native records remain evidence only for their own heads.

No new follow-up was established. Existing excluded owners remain #315 native refresh, #316 exact integrations, #317 immutable bodies, #318 Cursor prompt, #319 client controls, #320 OpenCode 2, #321 Grok helpers and toolboxmd/agent-observer#92; no duplicate or settled decision was reopened.

Requirements and who asked: User #289 and this review brief require one maximum-stripping bare mode, full native shell/file defaults within admitted authority, named/body-only additions, honest receipts, supported-provider correctness, and a fresh independent Sol exact-head review; this supports Drafters and Spectrum in the Objective.
Deleted: Additional modes, optional UI/auth/blob/Cursor scope, unsupported whole-context certification, redundant native/model calls and reuse of old-head review verdicts.
Bottleneck: Separate current-head Grok review and CI before the parent's delivery decision; no Sol blocker remains.
Checked myself: Canonical operations Verification/Code review and full review/impact references, accepted records and later handoffs, complete exact cumulative diff and source reachability, actual focused/typecheck logs, serialized metadata regression, raw current task-native results/protocol/history and persisted receipts/owners, and live candidate/frozen worktree identity.

Reviewer: GPT-6.1 Sol through Codex, actual configured reasoning effort medium. High effort was requested if available; this running harness exposes no in-turn effort control, so high effort is not claimed. No other agents.

[lukemaj]

What: Independent review of 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0 finds no blocking defect under the round-2 bar.

Why: A maximum-length public request id now gets a 71-byte thread-<SHA-256> Grok home, bare threads skip ContextMD before any staging, and bare Grok session metadata sends the six foreground tools plus the original 14-name denylist.

So what: This exact head can take review/independent-grok success. CI, the Sol review, and merge stay with the parent. This comment does not approve the draft PR for merge.

Verdict: PASS, no blocking finding. Reviewed cumulative head 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0 against base 9f46c833b19223e38a1dfb654d2735e54d47c1f7. No source authorship, delegation, Git mutation, service start, native CLI or model call, credentials, browser, memory, version bump, or deployment.

Checked repairs

• B1: packages/provider-grok/src/server/adapter.ts hashes the application thread id with SHA-256 and uses one thread- plus 64 hex characters. The regression decodes a real 256-character create_threads key, shows the old encoded component is 314 bytes, prepares real temporary homes, stops at process spawn, and reopens the same home. The parent collector on this isolated root shows that long id completed, with home thread-7eb89dd484036ede3b6c479880ad780912a1e74161e5038b408717e9e0d5c355.
• ContextMD: ProviderTurnStartService drops the serving dependency before stageSessionInstructions when thread.bare is set. Installation, attachment, native-fork accounting, and rollback use that same absent value. The release callback runs only after a reservation is recorded. ProviderSessionManager and the ACP runtime-input builder omit creation instructions for bare. session/new merges creation rules and native session metadata once. Load and resume do not receive creation rules.
• Grok tools: grokBareSessionMeta sets agentProfile.tools to the six native names and disallowedTools to the original 14. The process-boundary test requires that exact session/new body. The collector receipt for the long-id Grok run lists those six tools as observed_clean and the seven commands as observed_retained.

Cleared on this head

No source-reachable launch grants shell, file, or MCP access beyond the admitted runtime mode and named additions. Client BareLaunchRequest drops a forged nativeHomeOwnerThreadId. Fresh create stamps the server thread id, and a native fork copies the source owner. Bare and normal sessions do not share a provider process. Prism kit text is empty, Promachos refuses bare, and unsupported adapters fail with a concrete reason. Cursor still discloses the account-gated prompt. Receipts keep unobserved categories, including Codex tools and Grok hooks, plugins, system text, instructions, and environment.

Proof limits

I did not rerun tests or native providers. I read /tmp/chromeria-289-renewal-focused.log (17 files, 561 passed, on the integration head before the tools commit), the five renewal typecheck logs (no error TS lines), /tmp/chromeria-289-grok-tools-focused-final.log (3 files, 52 passed), and /tmp/chromeria-289-current-collect-proof.log (four completed runs: Codex 0 and 2, Claude 1, long-id Grok). /tmp/chromeria-289-final-repaired-native-proof.log stops on thread 2 while that run was still running; the later collector waits for a terminal status. I also read the parent fork and resume collector logs: completed Codex runs share the source home and the fork has a different native session. I did not read raw native fork or resume protocol on this head, and those logs do not certify whole-context removal. Earlier fa828ee reviews and native proof stay on that head. OpenCode, the Cursor live prompt, managed Codex, and CI are not certified here.

No new follow-up. Existing exclusions remain #315, #316, #317, #318, #319, #320, #321, and toolboxmd/agent-observer#92.

Requirements and who asked: The user, in #289, asked for one maximum-stripping bare mode, honest receipts, and full native shell and file tools inside admitted authority. This round asks for a fresh Grok review of exact head 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0.

Deleted: A second mode, bwrap, normal fallback, auth copies, transferring the fa828ee verdict, and treating partial native receipts as whole-context proof.

Bottleneck: The three source-reachable breaks named for this head: Grok home length, ContextMD lifecycle, and foreground tool selection.

Checked myself: Canonical operations Verification and code-review method, issue #289, the settled decision, the revision 2.1 corrections, both prior PR findings, and the repair handoffs. Exact source for the home hash, ContextMD guards, session metadata, caller intent, home-owner stamp, and receipts. The logs named above. Live head matched 2b8baee7bd65dec9e4f7720c6f4049ef2ac57ae0 immediately before this comment.

Reviewer: Grok 4.7. This harness exposes no separate effort control, so high effort is not a configured setting I can claim.