Release integration review

The agent execution review records the causes of repeated repair rounds and a proposed Codex CLI workflow comparison.

Reviewed 2026-10-11 against main 225b165ea9b2fcc644fb1f3660d9e7ebd6e2d4a0. Console integration #29 and security specification #30 are merged. A specification does not establish runtime verification. The finite Option B release queue is tracked in issue 32, separately from the broader FO01–FO14 roadmap. No release tag is published by this review.

Historical qualification branch

PR 26 is closed as an archived historical study rather than merged over current state. Its six unique commits, protocol, harness, reports and compact evidence remain on the preserved milestone/target-qualification branch at c7d343846a3e3175b4dc4af1708071240e218489. No branch or history is deleted.

• Registered comparison and harness, harness implementation.
• Target-profile raw results belong to frozen binary source e68d6ce1364ad02f2dfaa86e27922d3b8627155b. The retained soak runner reports exit 1 after 5,498.678 seconds; its RSS-growth gate failed. The other recorded profile runs retain their own outcomes.
• Comparison report and compact summaries preserve both the initial commercial-adapter tie-order failure and the corrected rerun. Single-host defaults, client placement and unequal durability/loading limit comparisons.

These historical results were inspected, not rerun. They do not qualify the current console, access, dedicated-companion or package candidate. Merging the old ledger/CURRENT edits would conflate candidates; archiving avoids that churn without losing the research.

Security integration and concrete failures

The implementation bounds private-console work before body processing, uses RAII to release admission on errors and cancellations, imposes absolute OTLP read deadlines and bounded connection/queue limits, and refuses Linux log paths with symlinks in any component. Peer pacing applies to /v1/console/; Batch ingestion retains its separate authenticated 16-permit admission path. The console's eight-requests/s peer budget is not a Spindle ingestion-rate cap.

PR 31 is merged at 6a3b9c90fe904cc7b377477bee4257190360187e; no open PR remains at this checkpoint. Head 2c1ceb2 passed focused security tests and the fast registry, but its full browser workflow failed at scoped Spindle enrollment with actual HTTP 429. The fixture's 10 probes/s exceeded the new 8 requests/s private peer budget before UI work. The extended run interrupted both mutation audits at 30 minutes and failed delivery startup because it looked under repository target/release while Cargo built on the data drive. Missing completion receipts correctly failed the final completeness check.

Prospective protocol revision 5 spaces explicit benign fixture probes/actions by 550 ms without replaying writes or retrying responses. A separate sixteen-read concurrent burst must produce native 429/no-store/Retry-After and then recover after refill. Server limits and every existing authorization assertion remain. The delivery harness resolves CARGO_TARGET_DIR and owns disk-backed scratch; mutation subprocesses reuse incremental compiler work in isolated copies. Full audit completion must be measured; no timeout is relabeled as passed.

Local finite browser trial release-triage-browser-01 exited 0 with 144 assertions on the security implementation plus these fixture changes: real resident owner and additional keys, scoped workflows, explicit overload/refill, exact data, no-store and cleanup. Console build 09 was unchanged; native binaries were fresh Rust 1.99 debug builds. Runtime was 90.470 seconds; cgroup peak 551.9 MiB under 4,000,000,000 bytes with no swap. This is finite integration evidence, not exact package, physical-passkey, mobile or release qualification.

Completed local checks

The earlier frozen source eb5b0960c65777248fb6231e61ef1baf922ee260 completed local fast and semantic checks. Its hosted fast and focused workflows passed; extended verification finished all ten commands with exit zero but failed final receipt completeness. The dirty-input failure and successor are described below. Earlier failed and canceled revisions remain historical.

Hosted receipts identify GitHub's proposed merge e35fdf9d94bc54e23716596ce97fbe41e9331f91, whose parents are reviewed main 225b165 and the frozen PR head. Its tree c3be94437f21281073e610d5d73c5ad36345b92a matches the PR head exactly. Downloaded fast receipts passed independent log, command and completeness validation: all 20 checks. Focused receipts passed their log-digest and minimum-count checks: 26 security regressions. The workflow checks also include the real Chrome console and its API-cache negative control; this remains finite integration evidence rather than a deployment qualification.

Check	Observed result	Boundary
Complete fast registry	Exit 0; all 20 checks and independent receipt completeness validation passed on eb5b096; 443.011 s, 624.094 CPU s, 3 GiB cgroup peak under a 4 GiB cap	Local workspace/validators; no installation or deployment qualification
Semantic controls	Exit 0; all 31 registered defects rejected by their named checkers on eb5b096; 1,246.943 s, 1,390.619 CPU s, 2.9 GiB cgroup peak under 8 GiB	Finite/property/symbolic controls; unchanged invariants and independent Python oracles
Compiler-generated mutations	Exit 0 on 3305f0a: 286 mutations, 235 caught, 8 detected by timeout, 36 unviable, 7 reasoned equivalents; 470.999 s, 1,794.984 CPU s, 4.5 GiB cgroup peak under 6 GiB	Historical local input; final-head hosted audit is recorded below
Delivery/recovery	Exit 0 on 851d50b: all four scenarios × two seeds × 20 s passed the delivery oracle and TLC; 588 observed ACKs, 588 recovered records, companion included; 452.773 s, 506.783 CPU s, 1.3 GiB cgroup peak under 4 GiB	Explicit legacy administration adapter; production console access is the separate native gate
Loss control	Injected child exit 1, 35 ACKs / 34 recovered, only ACKED-DURABLE; strict grader exit 0	An unrelated startup/process/oracle failure cannot satisfy this control
Manual documentation	Exit 0 on eb5b096; documentation, checker probes and hook tests passed; 35.653 s, 40.440 CPU s, 237.1 MiB cgroup peak under 2 GiB	Authenticated historical Bun payload; temporary runtime removed; CI/hooks remain disabled

Fuzz input freeze repair

The eb5b096 hosted extended commands all exited zero, but dependency-policy and coverage-report recorded worktree_dirty=true after fuzzing. Receipt completeness exited 1 at the dependency receipt. This is a failed run. Local cargo metadata --manifest-path fuzz/Cargo.toml --locked --offline reproduced exit 101: the separate fuzz lock lacked the current server dependency graph. Unlocked offline resolution showed the missing graph and preserved the diff. A successful command on changed inputs does not establish candidate verification.

The successor refreshes that lock and checks it before and after fuzzing. Cargo-fuzz 0.13.2 exposes no --locked flag; locked metadata resolution precedes its build, then a digest guard rejects any trial-time rewrite. No lock is reset to conceal a failure. Four targets, committed seeds, 60-second windows and 2,048 MiB per-target RSS limits remain unchanged.

Final receipt validation now checks the live worktree as well as recorded flags. Real Git fixtures reject tracked and untracked changes after the frozen identity; fuzz controls reject stale locks before target execution and in-trial rewrites. The 17 CI contract checks, locked offline resolution, counterexample registry and formatting exited 0. Manual documentation checks on 1777e66 exited 0 in 22.260 s, 30.884 CPU s, with 237.6 MiB cgroup peak under 2 GiB; temporary Bun was removed and hooks/CI stayed disabled. Both defects have deterministic fixtures and separately committed counterexample registrations.

The previous source was frozen at 1777e66c23ba72d716bf066f8c30cc1181edd1e1. Hosted proposed merge 4685c7ea29f04630a48ab86caab77aa529e322b3 has reviewed main 225b165 and that head as parents; its tree is c4c74f238f9862734a759e82ff280e666106b65b. Fast, focused and extended workflows were the matching merge requirement. Fast and focused workflows succeeded; extended mutation testing exceeded its 30-minute deadline. The workflow was canceled after that recorded failure to avoid further work on an already failed candidate. Its proof step completed; fuzzing was interrupted and downstream coverage/completeness did not establish success. No merge is claimed.

Full local fast verification on 1777e66 subsequently exited 0: all 20 checks and final live-state/log/completeness validation passed. Runtime was 411.238 s, CPU time 544.008 s, and cgroup peak 389.6 MiB under 4 GiB with no swap. This reused local build caches; it is not a benchmark speedup claim.

The real four-target fuzz successor on 1777e66 exited 0, kept the lock unchanged and left a clean worktree: 265.915 s, 226.620 CPU s, 1.1 GiB cgroup peak under 8 GiB with no swap. Each unchanged 60-second setting reported 61 s in libFuzzer's coarse timer. Batch/query/frame/observation targets completed 5,903,531 / 2,044,651 / 73,044 / 1,568,233 executions (9,589,459 total) with seeds 1464711936 / 3216923162 / 505096747 / 1943307332. This is bounded search, not proof that no malformed input can fail. Stable 1.99 ran xtask; fuzzing used the installed nightly and previously validated data-drive GCC 16.2.1 C++ toolchain.

Two earlier local launch attempts remain unsuccessful: the first could not select nightly through its direct-Cargo PATH and did not run a trial; the next failed C++ compilation because c++ was absent from PATH (318.670 s, 618.032 CPU s, 5.7 GiB peak under 8 GiB). Compiler logs were preserved before the successor; the installed data-drive toolchain resolved this without host installation.

Earlier mutation and fixture failures

Bounded verifier successor

The final hosted mutation attempt above exited 2 after 1,807.227 seconds; systemd reported 16 min 33.550 s CPU, 11.2G cgroup peak and zero swap. Its active audit transcript was lost: the registry buffered stdout/stderr until exit, and the artifact did not include raw mutation outcomes. That limits attribution of the hosted timeout.

A selected after_page -> true diagnostic on 1777e66 reproduced a separate allocation mechanism: test clients drained nonadvancing pages indefinitely. With a five-second test window, the mutant timed out (exit 3; 7.768 s service, 18.503 CPU s, 1.9G cgroup peak under 4 GiB). The test-only successor validates strict key progress within rows.len() + 1 pages, then runs the original complete-drain assertions. The same selected mutant was caught without timeout (exit 0; 4.515 s service, 15.115 CPU s, 844M peak). These include compilation and cache differences; they are diagnostics, not an isolated heap or speedup claim. Product query and Python oracle semantics remain unchanged.

A forced-stop output regression exited 101 before repair and 0 after it. The registry now writes separate partial streams before waiting; completed log ordering and its exact existing hash assertions remain. Interrupted streams never count as completion. Hosted artifacts also retain raw mutation outcomes.

The registered protocol and separately committed counterexamples preserve both defects. Source ed4b95ce885e8c152d9dd658ef31c8a478ca5b6d is the clean successor and was pushed only after complete local checks. Targeted core/xtask tests, Clippy and all 17 CI contract tests exited 0. Clean-source manual documentation checks exited 0 in 41.337 s, 48.088 CPU s, with 236.2M peak under 2 GiB. The first manual invocation omitted required --out and exited 2; that failed invocation remains preserved. Its complete fast registry exited 0: all 20 checks and independent final receipt/log/live-input validation passed; 500.432 s service, 732.932 CPU s, 3G cgroup peak under 4 GiB. The complete compiler audit exited 0: the same 286 mutations, 242 caught, seven reasoned equivalents, 36 unviable and one timeout; 383.493 s service, 1,611.628 CPU s, 2.1G peak under 6 GiB. Seven former paging timeouts now fail assertions. Both ran concurrently with other contained validation, so timings are observations rather than a controlled speed comparison. Locked offline fuzz resolution also exited 0.

Matching hosted checks are fast, focused, and extended. All three succeeded. Downloaded artifacts passed independent receipt/log/input validation with exit 0: all 20 fast checks, all ten extended checks and 26 focused security regressions. Hosted compiler outcomes contain 286 mutations: 242 caught, seven reasoned equivalents, 36 unviable and one timeout. Its recorded check duration was 334.097 seconds. This is observational rather than a controlled speed comparison with the failed predecessor.

The tested proposed merge was e4056b098c1d2c7d7b1d382d817c9839ed102b95. The actual merge 6a3b9c90fe904cc7b377477bee4257190360187e has the same parents, reviewed main 225b165 and source ed4b95c, and the same tree 61f2d7a059633e145f011b1c62c1871811b5730d. Merge-commit integration preserves the separate specification and implementation commits. Issue 32 B9 is complete; the remaining exact-package/deployment acceptance cells remain distinct.

The first complete mutation audit used a shared absolute Cargo target and was contaminated: per-worker logs showed that known tested defects ran another tree's executable. Worker-local targets repaired that evidence boundary. The isolated audit then exposed missing cases: exact mixed integer/double lower bounds, forward bindings added after promotion, inclusive source bounds, query filters, equal-time keys, overlapping sources and budget cuts. Literal expected outcomes and a bounded relational reference cover them. A source whose maximum timestamp equals a cursor timestamp can still hold larger full identity keys; pruning it is not an equivalent optimization.

The first complete semantic successor exited 1 after 1,772.091 s. Two controls still edited the frozen legacy reference instead of the production binding lookup; the remote-config mutation targeted a moved validation line. These failures were retained. The repaired controls perturb production, add a deterministic unbound third-credential witness, and preserve the named expected failures. Kani negatives run those same named proofs, while the separate core proof gate retains all eleven positive harnesses. This removes repeated unrelated proof work rather than reducing the symbolic domain or sampling fewer cases.

The earlier local fast run exited 1 on a redundant borrow introduced in the launcher refactor; Clippy rejected it. The borrow was corrected without disabling the lint. The final unchanged-source run above passed. Locally overlapping earlier runs remain diagnostics and are not combined into final-candidate qualification.

Completed semantic source/build scratch and disposable TLS/control fixtures were removed after preserving logs, mutation diffs/outcomes, heap-control receipts and sanitized delivery transcripts with archive hashes. Fixture secrets were discarded. Persistent owned build caches and compact evidence remain on the data drive. Final local cleanup exited 0 and removed owned mutation scratch and temporary documentation dependencies after archive validation. The full project directory used 79,763,619,840 allocated bytes (79.76 decimal GB, 74.29 GiB) at 18:57:30 UTC, including persistent caches and evidence; it remained below the 100 GB experiment cap. The original checkout's unrelated tracked edit was preserved.

Raw CI logs/artifacts, local logs and containment receipts are retained under /run/media/kmosoti/data/FabricO11y/evidence/release-triage-2026-10-11 and its linked data-drive results. Current-candidate package, service, recovery and device cells remain in issue 32. No release tag or new deployment qualification is claimed by this integration result.