[unlockdigital]

This checkpoint carries the approved upstream credential, usability, approval, and scheduling improvements into the fork while preserving its security patches, private routing, account behavior, and migration bridge.

Changes

• Reconcile the November 5 Codex account-lock and full model-label fixes.
• Add R6 source-control and usage credential references with capability negotiation, legacy-client masking, schema-aware validation, destination binding, consistent credential snapshots, and cancellation-safe migration writes.
• Add R7 account labels, model and effort history, usage filtering, bounded recovery reads, reduced thread-family loading, and sidebar and side-chat render improvements.
• Add R9 child approvals with child-environment permission checks and environment-scoped request identity.
• Add R10 one-time schedules and fork-aware thread links. Enabled schedules missed while offline catch up once, and re-enabling a past schedule requires a future time.
• Pin Electron 44.10.2 and backport the embedded Cursor URI and Claude qs fixes while retaining the existing Zod backport and dependency security floors.

Validation

• vp run check:changed origin/unlock-digital/main --concurrency 2 passes on 47d75e40544b163e56e90b2b7c2966e919650614.
• 1,249 tests pass across 86 files, along with 48 React Compiler checks and all 39 affected-package typechecks.
• Format, lint, Knip, generated GraphQL checks, and unused dependency-patch validation pass.
• A frozen install, 11 focused security tests, installed SDK bundle hashes, and all 22 resolved dependency security floors pass.
• A fresh build:desktop completed all five web/server/desktop bundle tasks on November 6. The emitted Claude SDK source map matches the approved patched bundle hash. Cursor remains a runtime external, with its three installed bundle hashes verified by the offline guard. Packaging and runtime execution remain separate qualification steps.
• The bundle build emitted large-chunk, optional dbus-next/x11, and Effect CommonJS import.meta warnings for package-level review.
• The November 6 offline dependency guard passed all 22 scoped resolved package floors and approved SDK hashes. With maintainer authorization to send dependency metadata to npm, the November 6 audit completed with zero critical, one high, four moderate, and one low finding. The six advisory IDs, severities, affected resolved versions, and fix ranges match the November 5 audit. Dependency-path listings differ between reports. The six findings and the separately tracked embedded-dependency questions remain open.
• The side-chat regression fails before the optimization with 11 renders and passes with the optimized implementation.
• Independent Terra reviews found no new actionable defect in the credential snapshot/cancellation corrections or the provider-instance snapshot fix. The latter passed 86 focused registry, hydration, and refresh tests, after eight of nine new regressions failed before the fix. Validation used CLI tools and isolated headless fixtures.
• Actual checkpoint A and B settings services passed a synthetic B-to-A-to-B roundtrip. Credential references, usage filtering, and private routing survived an A save with zero protected stale-secret reads. Both client contract versions decoded their compatible settings payloads. A retained message text while ignoring the optional model-switch badge, and its focused schedule test retained an unsupported once row without executing it.

Checkpoint B qualification

Source integration merged into unlock-digital/main as 165192e94713c944c27a84a47f4f2de8f930b601 after required CI passed on the reviewed head. Release qualification is the next stage of the approved sequence.

• Obtain maintainer acceptance of the measured agent-context increase through the repository's agent-context-increase label gate. The maintainer approved the 74-byte instruction increase per provider and the 81-byte MCP tool-definition increase on November 6.
• Correct and assess cross-account snapshot consistency through provider-instance hydration, reconciliation, and manual refresh. Commit 47d75e4054 pins config and vault settings together and preserves nonblocking startup and legacy map-only callers. Independent review accepted the correction.
• Resolve or qualify the six workspace audit findings, currently one high, four moderate, and one low, with package compatibility and runtime applicability evidence.
• Resolve embedded legacy Zod v3 and Claude URI parser exposure questions.
• Verify synthetic checkpoint-A/B settings roundtrips and client codecs, optional model-history decoding, and unsupported schedule-row handling with the exact published A checkout.
• Complete historical-database replay and end-to-end rollback qualification beyond the synthetic settings/codec fixtures.
• Verify mixed client/server versions and local, remote, relay, and tunnel connection modes.
• Complete integrated client verification and before/after UI evidence.
• Verify packaged artifacts, embedded patches, signing metadata, migration fixtures, backups, and rollback before release and activation.

Implemented and reviewed with GPT-6.1 Sol and Terra through the Codex harness in T3 Code, with Luna supporting advisory research.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	−6 B (−0.1%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.2 KiB	−6 B (−0.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.1 KiB	5.1 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: d9a8a1e · PR result: 47d75e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.