Creatidy/creatidy-kernel
5
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

[Kernel][G01 G04 G10] Prove existing harness control and gateway compatibility #47

New issue
Closed
opened 2026-10-04 22:22:46 +00:00 by kilo · 7 comments
kilo commented 2026-10-04 22:22:46 +00:00
Member
Copy link

Goal

Owner: Kernel. Produce a bounded, version-pinned feasibility decision for controlling an existing harness and, independently, directing its model backend through the Router gateway. Source: shared architecture v1.0 (2026-10-04), Kernel sections 1-8, 9.2-9.4, 10-18; #46 owner brief is available, full-source subsection attribution is not verified.

Why

Users need a controlled session that survives predictable interruptions without duplicate work or invented execution identity. A CLI executable, PID, request acceptance, done text or interrupt is not this guarantee. Gateway Chat Completions compatibility is not implied by Codex App Server compatibility.

Current Evidence

Kernel develop eb4f4a2956: ports/execution.py Runtime exposes start/observe/candidate/cancel/reconcile; codex_runtime.py has a native version-pinned adapter with requested/resolved identity and unknown observed identity. codex_stdio.py owns a spawned process group. README/.kilo contexts are development facilities, not a completed product harness. #8/PR #26 proved only bounded native Codex; #11/PR #28 explicitly excluded the gateway. Router execution-surface and routing_core distinguish public recommendation from execution target/admission. These are source observations, not live integration proof.

Scope

Compare ACP first as a candidate, Kilo CLI/ACP/serve/attach/SDK, Codex App Server, Claude Agent SDK and ZCode against the existing Runtime obligations. Identify actual client-side file/terminal executor if ACP needs one, permission mediation, process/supervisor ownership, progress, candidate collection, cancel/descendants, cold review/native delegation, recovery/resume and IDE attach/UI-close behavior. Inspect actual installed generation and protocol source before any command example. Separately compare harness backend APIs against current public Router protocol/tool/stream/retry/pin semantics. Producer route contract remains Router-owned; absent producer counterpart is explicit, not designed here.

Acceptance Criteria

  1. Version/revision/file/license/service-access evidence matrix for each serious candidate; unavailable capability is unknown or unsupported, not universalized.
  2. Reproducible inference-free probes where possible, plus separately authorized live proof plan, cover lost start reply, lost handle, cancel while active, descendant still running, permission refusal, restart, native resume versus repeated prompt, same-owner active IDE session and UI closure.
  3. ACP file/terminal operations identify executor and enforceable trust boundary. No shared IDE server is killed for one Attempt; no unrelated session takeover.
  4. Produce feasible reuse / demonstrated gap and bounded adaptation / specific owner decision, with documented why each required guarantee survives. Control and gateway compatibility get distinct verdicts.
  5. No new protocol, plugin, payload, model ranking or harness selected solely from method names. Publish exact proof limits and downstream adapter/consumer acceptance prerequisites.

Reuse

ADOPT -> VENDOR/COPY -> PORT -> ADAPT -> BUILD; begin with local Runtime/state/effect seams, official ACP/native clients and Symphony SPEC tracker/workspace/runner/status patterns. For an actual recommendation verify exact revision/files, attribution, license separately from subscription/service terms, negative tests, security, dependency closure and maintenance. Do not copy private source. Candidates are not approved dependencies.

Constraints

Research/contract result only, no replacement harness/framework or new runtime behavior in this issue. Preserve immutable Attempts, exact-candidate acceptance, effect journal/claim/receipt/reconciliation, unknown-before-retry and adapters -> ports -> core. No fictitious reservation or response replay guarantee.

Dependencies And Priority

First: this proof bounds adapter and gateway integration, permission/isolation and lifetime decisions before product dispatch. Follow-on implementations must be separately selected. Router owns selection/admission/pin; MI may supply interface evidence but does not grant authority. No equivalent current producer alignment task found during initial audit; recheck before acceptance.

Compatibility, Diagnostics And Permissions

Record installed/current-supported versions and incompatible-version failures, migration implications and safe actionable diagnostics without transcripts/secrets. Local schema/version/help inspection needs no inference; session/gateway/UI-close proof requires separately authorized inference, service access and tool/effect scopes. Process handoff and security-level choice require owner approval when not covered by existing ADRs.

Links

Non-Goals

No live task/inference authorized by registration, Console implementation, forced ACP selection, own harness or VS Code plugin.

## Goal Owner: Kernel. Produce a bounded, version-pinned feasibility decision for controlling an existing harness and, independently, directing its model backend through the Router gateway. Source: shared architecture v1.0 (2026-10-04), Kernel sections 1-8, 9.2-9.4, 10-18; #46 owner brief is available, full-source subsection attribution is not verified. ## Why Users need a controlled session that survives predictable interruptions without duplicate work or invented execution identity. A CLI executable, PID, request acceptance, done text or interrupt is not this guarantee. Gateway Chat Completions compatibility is not implied by Codex App Server compatibility. ## Current Evidence Kernel develop eb4f4a2956712bfaf39a3271e1523e7f77a91e26: ports/execution.py Runtime exposes start/observe/candidate/cancel/reconcile; codex_runtime.py has a native version-pinned adapter with requested/resolved identity and unknown observed identity. codex_stdio.py owns a spawned process group. README/.kilo contexts are development facilities, not a completed product harness. #8/PR #26 proved only bounded native Codex; #11/PR #28 explicitly excluded the gateway. Router execution-surface and routing_core distinguish public recommendation from execution target/admission. These are source observations, not live integration proof. ## Scope Compare ACP first as a candidate, Kilo CLI/ACP/serve/attach/SDK, Codex App Server, Claude Agent SDK and ZCode against the existing Runtime obligations. Identify actual client-side file/terminal executor if ACP needs one, permission mediation, process/supervisor ownership, progress, candidate collection, cancel/descendants, cold review/native delegation, recovery/resume and IDE attach/UI-close behavior. Inspect actual installed generation and protocol source before any command example. Separately compare harness backend APIs against current public Router protocol/tool/stream/retry/pin semantics. Producer route contract remains Router-owned; absent producer counterpart is explicit, not designed here. ## Acceptance Criteria 1. Version/revision/file/license/service-access evidence matrix for each serious candidate; unavailable capability is unknown or unsupported, not universalized. 2. Reproducible inference-free probes where possible, plus separately authorized live proof plan, cover lost start reply, lost handle, cancel while active, descendant still running, permission refusal, restart, native resume versus repeated prompt, same-owner active IDE session and UI closure. 3. ACP file/terminal operations identify executor and enforceable trust boundary. No shared IDE server is killed for one Attempt; no unrelated session takeover. 4. Produce feasible reuse / demonstrated gap and bounded adaptation / specific owner decision, with documented why each required guarantee survives. Control and gateway compatibility get distinct verdicts. 5. No new protocol, plugin, payload, model ranking or harness selected solely from method names. Publish exact proof limits and downstream adapter/consumer acceptance prerequisites. ## Reuse ADOPT -> VENDOR/COPY -> PORT -> ADAPT -> BUILD; begin with local Runtime/state/effect seams, official ACP/native clients and Symphony SPEC tracker/workspace/runner/status patterns. For an actual recommendation verify exact revision/files, attribution, license separately from subscription/service terms, negative tests, security, dependency closure and maintenance. Do not copy private source. Candidates are not approved dependencies. ## Constraints Research/contract result only, no replacement harness/framework or new runtime behavior in this issue. Preserve immutable Attempts, exact-candidate acceptance, effect journal/claim/receipt/reconciliation, unknown-before-retry and adapters -> ports -> core. No fictitious reservation or response replay guarantee. ## Dependencies And Priority First: this proof bounds adapter and gateway integration, permission/isolation and lifetime decisions before product dispatch. Follow-on implementations must be separately selected. Router owns selection/admission/pin; MI may supply interface evidence but does not grant authority. No equivalent current producer alignment task found during initial audit; recheck before acceptance. ## Compatibility, Diagnostics And Permissions Record installed/current-supported versions and incompatible-version failures, migration implications and safe actionable diagnostics without transcripts/secrets. Local schema/version/help inspection needs no inference; session/gateway/UI-close proof requires separately authorized inference, service access and tool/effect scopes. Process handoff and security-level choice require owner approval when not covered by existing ADRs. ## Links - Parent: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/46 - Existing native proof: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/8 - Existing recommendation-only proof: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/11 - Router cancellation evidence: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/165 ## Non-Goals No live task/inference authorized by registration, Console implementation, forced ACP selection, own harness or VS Code plugin.
kilo commented 2026-10-04 22:42:11 +00:00
Author
Member
Copy link

Actual producer counterparts now registered and full bodies compared: Router BioMedical-IT/scarcity-router#174 executable handoff/admission/pin, #179 explicit effort/identity, #181 exact protocol/Responses compatibility and #180 backend-native workspace authority. These supersede initial 'counterpart not found' discovery note. Control versus model-backend proof remains independent; current gateway Chat Completions and deferred Responses cannot prove all native clients. Router #178 owns exact route_request pin-narrowing defect (not evidence of gateway exact-pin substitution). #180 must receive explicit authority/migration decision for affected ZCode editing lane before Kernel enables it. No duplicate producer task or approval of a harness/protocol is created here.

Actual producer counterparts now registered and full bodies compared: Router https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/174 executable handoff/admission/pin, #179 explicit effort/identity, #181 exact protocol/Responses compatibility and #180 backend-native workspace authority. These supersede initial 'counterpart not found' discovery note. Control versus model-backend proof remains independent; current gateway Chat Completions and deferred Responses cannot prove all native clients. Router #178 owns exact route_request pin-narrowing defect (not evidence of gateway exact-pin substitution). #180 must receive explicit authority/migration decision for affected ZCode editing lane before Kernel enables it. No duplicate producer task or approval of a harness/protocol is created here.
kilo commented 2026-10-04 22:50:47 +00:00
Author
Member
Copy link

Bounded Evidence
Official-source research for #47, conducted 2026-10-04 UTC. This is a candidate inventory, not adoption approval or tested lifecycle/backend compatibility. Links contain full upstream commit SHAs: observed HEAD snapshots, not installed/released-artifact attestations. Live documentation/service pages have no verified source revision. Only targeted source sections were inspected; no private/parent repository was accessed.

Source Inventory

Candidate Official revision/files inspected License and service-access evidence
ACP cae7aca7f07cefd59da2a3cb374933cb623a2959: v1 prompt-turn/session-setup/file-system/terminals; announcements/acp-v2-draft.mdx; LICENSE Root Apache-2.0. Selected SDK licenses and agent model-service access require separate review.
Kilo 76bcfd40be616a72f4697b3041565f322245b462: ACP agent/service/event/permission; CLI cmd/acp.ts/serve.ts/attach.ts; LICENSE Root MIT; component/dependency closure unreviewed. Service terms and provider agreements separately apply.
Codex App Server 4ad985e2caaf877b96dafd8138dae2def467e01e: thread/turn/resume/interrupt/status/approval/start-response schemas; README/LICENSE/NOTICE; App Server docs Apache-2.0; NOTICE includes MIT-derived Ratatui attribution. README distinguishes ChatGPT-plan/API-key access. Service/redistribution entitlement review remains incomplete.
Claude Agent SDK Python 9c69ce7aced5cdf2aa1ac86fe62e877b4962de8b: client.py/subprocess_cli.py/README/LICENSE. TS 16cf0a783143406b1ad5c4a2b0dbf0af2be04b04: LICENSE.md; SDK overview, permissions/sessions docs Python wrapper MIT; bundled Claude Code binary separate. TS license and Python README invoke Commercial Terms, with component exceptions. Overview restricts third-party offerings of claude.ai login/rate limits without prior approval. Subscription is not blanket downstream service entitlement.
ZCode 29628c9acdb81b703bbd4080c207a0e7ce5e276e: server-types/server-operations/runtime-cleanup, protocol entrypoint; CLI run/main/protocol-lifecycle/shutdown/resume; README/LICENSE/NOTICE.md Root MIT; bundled-component attribution requires review. Z.AI terms inspected, but exact ZCode/backend/access-mode applicability unverified.
Symphony be10a1b79df723d6d7612b5651c8522704dafb2e: SPEC.md/LICENSE Apache-2.0; specification, not conformance/service-access evidence.
Sandbox tools sandbox-runtime e025055f221021582934e666cac1eeb08310e7b1: README/LICENSE. bubblewrap 0f8073dd9b547e15e8ec9451371f9729830b083d: README/COPYING/bubblewrap.c. Docker rootless docs sandbox-runtime MIT, experimental/platform-dependent. bubblewrap.c: LGPL-2.0-or-later; COPYING contains LGPL-2.1 text, so artifact scope needs resolution. Docker implementation revision/license closure: candidate/unverified.
Rich / OTel Python Rich 9d8f9a372cc5916fd4781fec207ced7ddac2f08f: live.rst/LICENSE. OTel 5e8083e845dc0b0225d8674240c556c879ce852f: batch processor/LICENSE; sensitive-data guidance MIT / Apache-2.0. Exporter/collector/dependency closure and deployment data rights separate. Neither supplies authoritative persistence.

Concrete Limits

  • ACP v1 streams updates and brokers permissions; load/client file/terminal services are capability-gated. The client executes those services and needs enforceable policy. Terminal release requires killing a running command; cancellation only SHOULD stop ongoing operations promptly. No complete descendant/exactly-once recovery guarantee follows. Published v2 draft changes turn completion to asynchronous messages.
  • Kilo ACP cancel catches backing abort failures; its event layer suppresses some stream/notification failures. Acknowledgment or quiet stream is not confirmed termination. UI attach does not establish ownership of a shared server.
  • Codex distinguishes thread/turn IDs, waiting states and terminal turn statuses. Resume restores conversation state, not necessarily a running process. Docs distinguish subscription/unload/background-terminal cleanup; experimental lineage is not complete descendant containment. WebSocket is documented experimental/unsupported. Model/provider fields are not physical execution attestation.
  • Claude receive_response stops at ResultMessage, not all-background-work idle. Python transport bounds EOF/terminate/kill/wait, but explicitly documents raw-asyncio cancellation interrupting escalation. Direct-child tracking is not descendant proof; permissions/interrupt/stop_task need end-to-end validation.
  • ZCode has native session/control/event/resume/subagent families and interaction brokerage. app-server/agent-server aliases mean its own NDJSON server, not Codex compatibility. Deadline-raced cleanup catches failures: bounded waiting is not proof resources died. Ordinary headless prompt defaults to yolo at this revision. Legacy/v4 replay and cancellation remain unverified.
  • Symphony specifies tracker/workspace/runner/retry/reconciliation/status patterns, not universal authority, isolation or duplicate-effect guarantees. Rich is presentation; inspected OTel batching can drop records, catches exporter failures and does not enforce some supplied timeout parameters.
  • Kernel codex_runtime.py:160-165 rejects hostile-worker isolation/unsupported mount-network grants; fake_execution.py:27-44 is policy simulation. Upstream sandboxes depend on platform/policy; rootless Docker resource controls depend on host support. No installed isolation was attested.
  • Control verdict: candidate surfaces with incomplete lifecycle proof. Backend verdict: UNVERIFIED. ACP/native control JSON-RPC is not a model-provider API. No Router request or producer/backend integration was inspected/tested here; generic provider claims cannot prove gateway tool/stream/retry/auth/pin compatibility.

Executed Probes
Read-only git ls-remote https://github.com/<official-repository>.git HEAD succeeded for all eleven pinned repositories above, plus official source/document GETs and bounded Kernel source reads. No kilo --version or codex --version was run: installed generations unknown. No installed help/schema probe, serve/session/auth/inference/tool-task, gateway/UI-close test, install, build or test was executed. Source evidence is not runtime conformance.

Remaining Proof

  1. Freeze installed/released binary+SDK+schema+platform revisions/checksums; verify capabilities and incompatible-version refusal. Preserve immutable Attempt/effect/native mappings and honest requested/resolved/observed/unknown identity.
  2. Separately authorize lost start reply/handle, duplicate delivery, active cancel, permission refusal/late answer, detached descendants, restart and native-resume-versus-resubmission tests. Require unknown-before-retry, bounded teardown/reaping and independent outcome confirmation.
  3. Establish supervisor ownership for IDE servers/sessions, client executors, plugins/MCP and descendants. Test same-owner active IDE sessions/UI closure without takeover or killing unrelated work; distinguish detach/unsubscribe, cancel and server shutdown.
  4. Obtain producer-owned gateway counterpart and test actual wire/auth/tool/stream/effort/pin/retry semantics, hidden/auxiliary calls, identity uncertainty and aggregate accounting. Separate control/backend verdicts; invent no Router payload or reservation/replay guarantee.
  5. Resolve package/bundled-binary/dependency licenses/notices, LGPL distribution scope, subscription/API/tenancy rights, training/retention/deletion and third-party source/output/transcript redistribution rights. Unresolved revision/license/access stays candidate/unverified.
  6. Audit reproducible dependency closure/SBOM, security and maintenance ownership. Negative tests: path/symlink/FD/environment/IPC and egress bypass, missing sandbox prerequisites, exhaustion, stale/corrupt replay, telemetry overflow/export outage and secret-bearing diagnostics. No candidate is approved by this note.
**Bounded Evidence** Official-source research for #47, conducted 2026-10-04 UTC. This is a candidate inventory, not adoption approval or tested lifecycle/backend compatibility. Links contain full upstream commit SHAs: observed HEAD snapshots, not installed/released-artifact attestations. Live documentation/service pages have no verified source revision. Only targeted source sections were inspected; no private/parent repository was accessed. **Source Inventory** | Candidate | Official revision/files inspected | License and service-access evidence | |---|---|---| | ACP | [cae7aca7f07cefd59da2a3cb374933cb623a2959](https://github.com/agentclientprotocol/agent-client-protocol/blob/cae7aca7f07cefd59da2a3cb374933cb623a2959/docs/protocol/v1/prompt-turn.mdx): v1 prompt-turn/session-setup/file-system/terminals; announcements/acp-v2-draft.mdx; LICENSE | Root Apache-2.0. Selected SDK licenses and agent model-service access require separate review. | | Kilo | [76bcfd40be616a72f4697b3041565f322245b462](https://github.com/Kilo-Org/kilocode/blob/76bcfd40be616a72f4697b3041565f322245b462/packages/opencode/src/acp/service.ts): ACP agent/service/event/permission; CLI cmd/acp.ts/serve.ts/attach.ts; LICENSE | Root MIT; component/dependency closure unreviewed. [Service terms](https://kilo.ai/terms) and provider agreements separately apply. | | Codex App Server | [4ad985e2caaf877b96dafd8138dae2def467e01e](https://github.com/openai/codex/tree/4ad985e2caaf877b96dafd8138dae2def467e01e/codex-rs/app-server-protocol/schema/typescript/v2): thread/turn/resume/interrupt/status/approval/start-response schemas; README/LICENSE/NOTICE; [App Server docs](https://developers.openai.com/codex/app-server/) | Apache-2.0; NOTICE includes MIT-derived Ratatui attribution. README distinguishes ChatGPT-plan/API-key access. Service/redistribution entitlement review remains incomplete. | | Claude Agent SDK | Python [9c69ce7aced5cdf2aa1ac86fe62e877b4962de8b](https://github.com/anthropics/claude-agent-sdk-python/blob/9c69ce7aced5cdf2aa1ac86fe62e877b4962de8b/src/claude_agent_sdk/client.py): client.py/subprocess_cli.py/README/LICENSE. TS [16cf0a783143406b1ad5c4a2b0dbf0af2be04b04](https://github.com/anthropics/claude-agent-sdk-typescript/blob/16cf0a783143406b1ad5c4a2b0dbf0af2be04b04/LICENSE.md): LICENSE.md; [SDK overview](https://platform.claude.com/docs/en/agent-sdk/overview), permissions/sessions docs | Python wrapper MIT; bundled Claude Code binary separate. TS license and Python README invoke [Commercial Terms](https://www.anthropic.com/legal/commercial-terms), with component exceptions. Overview restricts third-party offerings of claude.ai login/rate limits without prior approval. Subscription is not blanket downstream service entitlement. | | ZCode | [29628c9acdb81b703bbd4080c207a0e7ce5e276e](https://github.com/zai-org/ZCode/tree/29628c9acdb81b703bbd4080c207a0e7ce5e276e/apps/zcode-cli/packages/bootstrap/src/zcode-protocol): server-types/server-operations/runtime-cleanup, protocol entrypoint; CLI run/main/protocol-lifecycle/shutdown/resume; README/LICENSE/NOTICE.md | Root MIT; bundled-component attribution requires review. [Z.AI terms](https://docs.z.ai/legal-agreement/terms-of-use) inspected, but exact ZCode/backend/access-mode applicability unverified. | | Symphony | [be10a1b79df723d6d7612b5651c8522704dafb2e](https://github.com/openai/symphony/blob/be10a1b79df723d6d7612b5651c8522704dafb2e/SPEC.md): SPEC.md/LICENSE | Apache-2.0; specification, not conformance/service-access evidence. | | Sandbox tools | sandbox-runtime [e025055f221021582934e666cac1eeb08310e7b1](https://github.com/anthropic-experimental/sandbox-runtime/blob/e025055f221021582934e666cac1eeb08310e7b1/README.md): README/LICENSE. bubblewrap [0f8073dd9b547e15e8ec9451371f9729830b083d](https://github.com/containers/bubblewrap/blob/0f8073dd9b547e15e8ec9451371f9729830b083d/README.md): README/COPYING/bubblewrap.c. [Docker rootless docs](https://docs.docker.com/engine/security/rootless/) | sandbox-runtime MIT, experimental/platform-dependent. bubblewrap.c: LGPL-2.0-or-later; COPYING contains LGPL-2.1 text, so artifact scope needs resolution. Docker implementation revision/license closure: candidate/unverified. | | Rich / OTel Python | Rich [9d8f9a372cc5916fd4781fec207ced7ddac2f08f](https://github.com/Textualize/rich/blob/9d8f9a372cc5916fd4781fec207ced7ddac2f08f/docs/source/live.rst): live.rst/LICENSE. OTel [5e8083e845dc0b0225d8674240c556c879ce852f](https://github.com/open-telemetry/opentelemetry-python/blob/5e8083e845dc0b0225d8674240c556c879ce852f/opentelemetry-sdk/src/opentelemetry/sdk/_shared_internal/__init__.py): batch processor/LICENSE; [sensitive-data guidance](https://opentelemetry.io/docs/security/handling-sensitive-data/) | MIT / Apache-2.0. Exporter/collector/dependency closure and deployment data rights separate. Neither supplies authoritative persistence. | **Concrete Limits** - ACP v1 streams updates and brokers permissions; load/client file/terminal services are capability-gated. The client executes those services and needs enforceable policy. Terminal release requires killing a running command; cancellation only SHOULD stop ongoing operations promptly. No complete descendant/exactly-once recovery guarantee follows. Published v2 draft changes turn completion to asynchronous messages. - Kilo ACP cancel catches backing abort failures; its event layer suppresses some stream/notification failures. Acknowledgment or quiet stream is not confirmed termination. UI attach does not establish ownership of a shared server. - Codex distinguishes thread/turn IDs, waiting states and terminal turn statuses. Resume restores conversation state, not necessarily a running process. Docs distinguish subscription/unload/background-terminal cleanup; experimental lineage is not complete descendant containment. WebSocket is documented experimental/unsupported. Model/provider fields are not physical execution attestation. - Claude receive_response stops at ResultMessage, not all-background-work idle. Python transport bounds EOF/terminate/kill/wait, but explicitly documents raw-asyncio cancellation interrupting escalation. Direct-child tracking is not descendant proof; permissions/interrupt/stop_task need end-to-end validation. - ZCode has native session/control/event/resume/subagent families and interaction brokerage. app-server/agent-server aliases mean its own NDJSON server, not Codex compatibility. Deadline-raced cleanup catches failures: bounded waiting is not proof resources died. Ordinary headless prompt defaults to yolo at this revision. Legacy/v4 replay and cancellation remain unverified. - Symphony specifies tracker/workspace/runner/retry/reconciliation/status patterns, not universal authority, isolation or duplicate-effect guarantees. Rich is presentation; inspected OTel batching can drop records, catches exporter failures and does not enforce some supplied timeout parameters. - Kernel codex_runtime.py:160-165 rejects hostile-worker isolation/unsupported mount-network grants; fake_execution.py:27-44 is policy simulation. Upstream sandboxes depend on platform/policy; rootless Docker resource controls depend on host support. No installed isolation was attested. - Control verdict: candidate surfaces with incomplete lifecycle proof. Backend verdict: UNVERIFIED. ACP/native control JSON-RPC is not a model-provider API. No Router request or producer/backend integration was inspected/tested here; generic provider claims cannot prove gateway tool/stream/retry/auth/pin compatibility. **Executed Probes** Read-only `git ls-remote https://github.com/<official-repository>.git HEAD` succeeded for all eleven pinned repositories above, plus official source/document GETs and bounded Kernel source reads. No `kilo --version` or `codex --version` was run: installed generations unknown. No installed help/schema probe, serve/session/auth/inference/tool-task, gateway/UI-close test, install, build or test was executed. Source evidence is not runtime conformance. **Remaining Proof** 1. Freeze installed/released binary+SDK+schema+platform revisions/checksums; verify capabilities and incompatible-version refusal. Preserve immutable Attempt/effect/native mappings and honest requested/resolved/observed/unknown identity. 2. Separately authorize lost start reply/handle, duplicate delivery, active cancel, permission refusal/late answer, detached descendants, restart and native-resume-versus-resubmission tests. Require unknown-before-retry, bounded teardown/reaping and independent outcome confirmation. 3. Establish supervisor ownership for IDE servers/sessions, client executors, plugins/MCP and descendants. Test same-owner active IDE sessions/UI closure without takeover or killing unrelated work; distinguish detach/unsubscribe, cancel and server shutdown. 4. Obtain producer-owned gateway counterpart and test actual wire/auth/tool/stream/effort/pin/retry semantics, hidden/auxiliary calls, identity uncertainty and aggregate accounting. Separate control/backend verdicts; invent no Router payload or reservation/replay guarantee. 5. Resolve package/bundled-binary/dependency licenses/notices, LGPL distribution scope, subscription/API/tenancy rights, training/retention/deletion and third-party source/output/transcript redistribution rights. Unresolved revision/license/access stays candidate/unverified. 6. Audit reproducible dependency closure/SBOM, security and maintenance ownership. Negative tests: path/symlink/FD/environment/IPC and egress bypass, missing sandbox prerequisites, exhaustion, stale/corrupt replay, telemetry overflow/export outage and secret-bearing diagnostics. No candidate is approved by this note.
kilo commented 2026-10-05 10:40:35 +00:00
Author
Member
Copy link

Bounded /loop Research And Owner Decision

Invocation kernel-loop-20261005T102040Z; selected after exhausting canonical open issues and excluding exact wontfix issues #15/#30/#37/#44. #47 declares First, is an unblocked contract-proof prerequisite and the oldest eligible issue (timestamp ties break by number). All remaining issue comments/dependency endpoints were read. No implementation PR for #47 was found in the complete current PR list. Kernel checkout remains clean develop at e5f30c9cef89e9991c12cae924093cf95d87d75b.

Actual Inference-Free Probes

  • command -v codex: /home/adrian/.local/bin/codex; Kilo/Claude/ZCode executables not found on this context's PATH. This does not establish that their IDE installations are absent.
  • codex --version: codex-cli 0.159.3; executable SHA-256 8bf204b36a2f6dd0dab73aa2f639892e67ef9ac8befccb4a05b1496ebf25c479. Host: Linux 6.18.33.2-microsoft-standard-WSL2.
  • codex --help, codex app-server --help, and both schema-generation help commands succeeded. Help advertises shared-daemon/remote surfaces, not safe takeover or survival proof.
  • codex app-server generate-json-schema --out /tmp/kilo/kernel-47-schema-20261005 succeeded without starting a session. Generated ClientRequest contains thread/start, thread/read, thread/resume, turn/start, turn/interrupt and review/start. Method presence is not conformance. Generated review description deprecates detached delivery in favor of a separate thread with inline review; neither proves cold exact-candidate review.
  • uv run --locked pytest tests/test_codex_runtime.py tests/test_codex_stdio.py: 47 passed. These use synthetic connections/processes, not installed Codex inference. They cover unknown lost start replies/no duplicate turn, missing restored handle, cancel/terminal race, version/method refusal, candidate identity and closed child environment. They do not prove daemon recovery, native descendant settlement, IDE attachment or gateway compatibility.

Direct Pinned Source Evidence

Read-only official source research, no adopted dependency or copied implementation:

  • ACP cae7aca7f07cefd59da2a3cb374933cb623a2959: protocol v1 session-setup/prompt-turn/file-system/terminals/session-list and schema Cargo.toml (1.10.2), Apache-2.0 LICENSE. fs/terminal capabilities execute in the client environment; other tools may be agent-side. A capability bit/cwd is not sandbox enforcement. Load/resume history is not an Operation receipt or safe retry of an unknown dispatch.
  • Kilo 76bcfd40be616a72f4697b3041565f322245b462: packages/opencode package.json (7.8.3, ACP SDK 0.21.0), src/acp/service.ts/event.ts/permission.ts, native session handlers, tool/write.ts/task.ts, CLI attach.ts; packages/kilo-vscode/src/services/cli-backend/server-manager.ts; MIT LICENSE. ACP abort errors can be caught; permission bridge includes an unawaited client write while native tooling also writes. Registered session-tree cancellation is not escaped OS/remote descendant proof. Extension server manager owns its server/watchdog/process-group disposal; attach does not establish a safe mutator handoff or UI-close survival.
  • Claude Python SDK 9c69ce7aced5cdf2aa1ac86fe62e877b4962de8b: client.py, _internal/transport/subprocess_cli.py, _internal/sessions.py, types.py, _version.py (0.2.163), _cli_version.py (2.1.289), README/LICENSE. MIT wrapper licensing is distinct from bundled Claude Code and README-linked Commercial Terms. Query transport write is not durable task acceptance; direct-child close is not descendant settlement. Session readers/history are not complete Operation absence proof.
  • ZCode 29628c9acdb81b703bbd4080c207a0e7ce5e276e: package.json (3.14.3), zcode-protocol-v4 session-flow/session-mgmt/command-inbox/v4-gateway/cold-session-resume, node-execution-adapter-lifecycle, permission/service and subagent/context-builder; LICENSE/NOTICE.md. Correction to the historical inventory: the inspected root LICENSE at this exact revision is Apache-2.0, not MIT. Separate third-party/bundled licensing remains unverified. Exact command-key lookup has potentially useful persistent hooks but no universal Kernel receipt proof. Background Bash detaches from parent abort; foreground stop is not all-work settlement. yolo permission ordering cannot be generalized to isolation.
  • Codex source 4ad985e2caaf877b96dafd8138dae2def467e01e: app-server README records native policy/cancellation/history limits; source snapshot is not attestation that installed 0.159.3 was built from it. Local generated schema is the actual installed method evidence. A guessed core model_provider_info.rs source path returned 404 and is not evidence.

Source-file URLs are reproducible as official raw GitHub URLs using the revisions and paths above. Complete dependency/SBOM/bundled-binary attribution, exact service/account eligibility, retained-data/output rights and maintenance closure remain unverified. No candidate has been approved or installed by this research.

Separate Gateway Verdict

Public Router develop was resolved twice via read-only MCP to 6c337a400b4cdc28ded543d2ae8ccf3749d79cb7. Targeted gateway_server.py, gateway_openai.py, gateway_coordinator.py, routing_core.py, worker_bridged_adapter.py/worker_protocol.py and docs/execution-surface.md were inspected at that SHA. No Router operation was invoked.

  • Authenticated models and text Chat Completions ingress exist; direct Responses and Anthropic Messages ingress do not. Codex App Server control and Router's outbound Codex source adapter do not prove Codex-as-harness backend compatibility.
  • Model recommendation is not executable-resource admission. Pin provenance is neither owner authority, quota reservation nor physical-model attestation. Variant/effort separation remains #179 producer work.
  • Codex client-tool continuation is a qualified PARTIAL bridge with in-memory state and lossy tool-result success mapping, not durable gateway replay.
  • #174/#179/#180/#181 remain producer obligations. #165 is currently open with wontfix; cancellation gaps are not a promised future repair. Cancelled audit/stream disconnect cannot establish backend descendant settlement.

STOP_AND_ASK

ADR 0007 lines 66-71 and 111-115 reserve session/process/supervisor handoff and UI-close guarantees for bounded proof and an owner decision. Current Kernel CodexStdio _stop owns process-group termination; inspected IDE/shared server mechanisms have different owners. Existing requirements prohibit killing a shared server or taking over unrelated sessions but do not select the lifetime contract. This is an architecture decision, not an unknown method treated as a routine blocker.

Owner alternatives: (1) first prove dedicated Kernel-owned sessions/processes with an explicit controller-exit limitation and read-only UI attachment; (2) require UI/controller-client-close survival through an explicitly owned supervision/handoff design before integration; (3) require existing IDE-session integration, with explicit single-mutator arbitration and server-owner handshake before acceptance. Recommend (1) for the first bounded proof, without claiming it satisfies (2)/(3). No live test, installation, new runtime behavior, supervisor or security profile is authorized by this recommendation.

The entire loop invocation stops for that owner choice; an answer does not automatically restart it. Issue remains open; no PR, implementation commit, review ordinal, merge or closure. Full make check/package-check were not run because no tracked change or delivery was prepared.

## Bounded /loop Research And Owner Decision Invocation `kernel-loop-20261005T102040Z`; selected after exhausting canonical open issues and excluding exact wontfix issues #15/#30/#37/#44. #47 declares First, is an unblocked contract-proof prerequisite and the oldest eligible issue (timestamp ties break by number). All remaining issue comments/dependency endpoints were read. No implementation PR for #47 was found in the complete current PR list. Kernel checkout remains clean develop at `e5f30c9cef89e9991c12cae924093cf95d87d75b`. ### Actual Inference-Free Probes - `command -v codex`: `/home/adrian/.local/bin/codex`; Kilo/Claude/ZCode executables not found on this context's PATH. This does not establish that their IDE installations are absent. - `codex --version`: `codex-cli 0.159.3`; executable SHA-256 `8bf204b36a2f6dd0dab73aa2f639892e67ef9ac8befccb4a05b1496ebf25c479`. Host: Linux `6.18.33.2-microsoft-standard-WSL2`. - `codex --help`, `codex app-server --help`, and both schema-generation help commands succeeded. Help advertises shared-daemon/remote surfaces, not safe takeover or survival proof. - `codex app-server generate-json-schema --out /tmp/kilo/kernel-47-schema-20261005` succeeded without starting a session. Generated ClientRequest contains thread/start, thread/read, thread/resume, turn/start, turn/interrupt and review/start. Method presence is not conformance. Generated review description deprecates detached delivery in favor of a separate thread with inline review; neither proves cold exact-candidate review. - `uv run --locked pytest tests/test_codex_runtime.py tests/test_codex_stdio.py`: **47 passed**. These use synthetic connections/processes, not installed Codex inference. They cover unknown lost start replies/no duplicate turn, missing restored handle, cancel/terminal race, version/method refusal, candidate identity and closed child environment. They do not prove daemon recovery, native descendant settlement, IDE attachment or gateway compatibility. ### Direct Pinned Source Evidence Read-only official source research, no adopted dependency or copied implementation: - ACP `cae7aca7f07cefd59da2a3cb374933cb623a2959`: protocol v1 session-setup/prompt-turn/file-system/terminals/session-list and schema Cargo.toml (1.10.2), Apache-2.0 LICENSE. fs/terminal capabilities execute in the client environment; other tools may be agent-side. A capability bit/cwd is not sandbox enforcement. Load/resume history is not an Operation receipt or safe retry of an unknown dispatch. - Kilo `76bcfd40be616a72f4697b3041565f322245b462`: packages/opencode package.json (7.8.3, ACP SDK 0.21.0), src/acp/service.ts/event.ts/permission.ts, native session handlers, tool/write.ts/task.ts, CLI attach.ts; packages/kilo-vscode/src/services/cli-backend/server-manager.ts; MIT LICENSE. ACP abort errors can be caught; permission bridge includes an unawaited client write while native tooling also writes. Registered session-tree cancellation is not escaped OS/remote descendant proof. Extension server manager owns its server/watchdog/process-group disposal; attach does not establish a safe mutator handoff or UI-close survival. - Claude Python SDK `9c69ce7aced5cdf2aa1ac86fe62e877b4962de8b`: client.py, _internal/transport/subprocess_cli.py, _internal/sessions.py, types.py, _version.py (0.2.163), _cli_version.py (2.1.289), README/LICENSE. MIT wrapper licensing is distinct from bundled Claude Code and README-linked Commercial Terms. Query transport write is not durable task acceptance; direct-child close is not descendant settlement. Session readers/history are not complete Operation absence proof. - ZCode `29628c9acdb81b703bbd4080c207a0e7ce5e276e`: package.json (3.14.3), zcode-protocol-v4 session-flow/session-mgmt/command-inbox/v4-gateway/cold-session-resume, node-execution-adapter-lifecycle, permission/service and subagent/context-builder; LICENSE/NOTICE.md. **Correction to the historical inventory: the inspected root LICENSE at this exact revision is Apache-2.0, not MIT.** Separate third-party/bundled licensing remains unverified. Exact command-key lookup has potentially useful persistent hooks but no universal Kernel receipt proof. Background Bash detaches from parent abort; foreground stop is not all-work settlement. yolo permission ordering cannot be generalized to isolation. - Codex source `4ad985e2caaf877b96dafd8138dae2def467e01e`: app-server README records native policy/cancellation/history limits; source snapshot is not attestation that installed 0.159.3 was built from it. Local generated schema is the actual installed method evidence. A guessed core model_provider_info.rs source path returned 404 and is not evidence. Source-file URLs are reproducible as official raw GitHub URLs using the revisions and paths above. Complete dependency/SBOM/bundled-binary attribution, exact service/account eligibility, retained-data/output rights and maintenance closure remain **unverified**. No candidate has been approved or installed by this research. ### Separate Gateway Verdict Public Router develop was resolved twice via read-only MCP to `6c337a400b4cdc28ded543d2ae8ccf3749d79cb7`. Targeted gateway_server.py, gateway_openai.py, gateway_coordinator.py, routing_core.py, worker_bridged_adapter.py/worker_protocol.py and docs/execution-surface.md were inspected at that SHA. No Router operation was invoked. - Authenticated models and text Chat Completions ingress exist; direct Responses and Anthropic Messages ingress do not. Codex App Server control and Router's outbound Codex source adapter do not prove Codex-as-harness backend compatibility. - Model recommendation is not executable-resource admission. Pin provenance is neither owner authority, quota reservation nor physical-model attestation. Variant/effort separation remains #179 producer work. - Codex client-tool continuation is a qualified PARTIAL bridge with in-memory state and lossy tool-result success mapping, not durable gateway replay. - #174/#179/#180/#181 remain producer obligations. #165 is currently open with wontfix; cancellation gaps are not a promised future repair. Cancelled audit/stream disconnect cannot establish backend descendant settlement. ### STOP_AND_ASK ADR 0007 lines 66-71 and 111-115 reserve session/process/supervisor handoff and UI-close guarantees for bounded proof and an owner decision. Current Kernel CodexStdio `_stop` owns process-group termination; inspected IDE/shared server mechanisms have different owners. Existing requirements prohibit killing a shared server or taking over unrelated sessions but do not select the lifetime contract. This is an architecture decision, not an unknown method treated as a routine blocker. Owner alternatives: (1) first prove dedicated Kernel-owned sessions/processes with an explicit controller-exit limitation and read-only UI attachment; (2) require UI/controller-client-close survival through an explicitly owned supervision/handoff design before integration; (3) require existing IDE-session integration, with explicit single-mutator arbitration and server-owner handshake before acceptance. Recommend (1) for the first bounded proof, without claiming it satisfies (2)/(3). No live test, installation, new runtime behavior, supervisor or security profile is authorized by this recommendation. The entire loop invocation stops for that owner choice; an answer does not automatically restart it. Issue remains open; no PR, implementation commit, review ordinal, merge or closure. Full make check/package-check were not run because no tracked change or delivery was prepared.
kilo commented 2026-10-05 11:00:32 +00:00
Author
Member
Copy link

Owner chose Owned Sessions (Recommended) in the explicit question response and issued resume at 2026-10-05T10:49:19Z. This resolves the specific prior STOP_AND_ASK for the first bounded proof only: dedicated Kernel-owned sessions/processes, read-only UI observation and controller-exit limitations. No live inference/security upgrade/harness selection or independent supervision/IDE handoff is authorized by that choice.

Research result delivered as PR #66. Base e5f30c9cef; HEAD f59f021ea4. New feasibility matrix/proof plan with distinct control/backend verdicts; minimal links and bounded owner direction in reuse/ADR 0007. No runtime changes or new dependencies.

make check PASS (977 tests + 32 subtests, all tooling/secrets/whitespace gates); make package-check PASS (rebuild/install/CLI replay/export); focused synthetic native suite previously PASS (47 tests). Fresh whole-PR native independent review pending, counter 0/10 before reservation. Issue remains open; no merge/closure yet.

Owner chose **Owned Sessions (Recommended)** in the explicit question response and issued **resume** at 2026-10-05T10:49:19Z. This resolves the specific prior STOP_AND_ASK for the first bounded proof only: dedicated Kernel-owned sessions/processes, read-only UI observation and controller-exit limitations. No live inference/security upgrade/harness selection or independent supervision/IDE handoff is authorized by that choice. Research result delivered as PR https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/66. Base e5f30c9cef89e9991c12cae924093cf95d87d75b; HEAD f59f021ea457510d72d2429ce5795b9e0d07a63f. New feasibility matrix/proof plan with distinct control/backend verdicts; minimal links and bounded owner direction in reuse/ADR 0007. No runtime changes or new dependencies. `make check` PASS (977 tests + 32 subtests, all tooling/secrets/whitespace gates); `make package-check` PASS (rebuild/install/CLI replay/export); focused synthetic native suite previously PASS (47 tests). Fresh whole-PR native independent review pending, counter 0/10 before reservation. Issue remains open; no merge/closure yet.
kilo commented 2026-10-05 11:07:43 +00:00
Author
Member
Copy link

BLOCKED: Independent Review Evidence Access

Invocation kernel-loop-20261005T102040Z, resumed under the owner's Owned Sessions choice. PR #66 #66 remains open/unmerged.

Review ordinal 1/10 completed via fresh foreground native pr-reviewer task ses_ef446207effe9Y1t7VvhIBGocc: COMMENT, findings [], reviewed HEAD f59f021ea457510d72d2429ce5795b9e0d07a63f, base e5f30c9cef89e9991c12cae924093cf95d87d75b. No approval is established by empty findings.

The reviewer inspected the complete diff, relevant source/rules/acceptance and independently corroborated Router ingress/cancellation limits. Reviewer-executed Git currentness/cleanliness/whitespace, Ruff format/lint, basedpyright and import-boundary checks passed. However, its unchanged permissions expose no permitted GitHub content reader for independent verification of material pinned candidate version/license/lifecycle claims. Installed Codex help/schema/checksum probes also could not be rerun. Author research/issue comments are not substitutes for independent source evidence.

It declined full pytest/package checks because the existing test_codex_stdio.py ENV_FAKE fixture serializes the complete inherited environment, and sanitized execution is unavailable through the unchanged allowlist. Parent make check and make package-check results remain PASS as recorded; they are not claimed as reviewer-executed validation. No credentials or test-generated environment artifacts were read as part of review.

Fresh canonical MCP/Git verifies unchanged exact HEAD/base and clean checkout. No review retry without changed diagnosed evidence/access, no reviewer-contract modification, no self-approval, merge, issue closure or next queue selection. Preserve 1 consumed review invocation; any future fresh review starts at ordinal 2, never zero. The loop terminates BLOCKED on finite review-tool/evidence incompleteness, not on an unresolved ownership choice.

## BLOCKED: Independent Review Evidence Access Invocation kernel-loop-20261005T102040Z, resumed under the owner's Owned Sessions choice. PR #66 https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/66 remains open/unmerged. Review **ordinal 1/10** completed via fresh foreground native pr-reviewer task `ses_ef446207effe9Y1t7VvhIBGocc`: **COMMENT**, findings `[]`, reviewed HEAD `f59f021ea457510d72d2429ce5795b9e0d07a63f`, base `e5f30c9cef89e9991c12cae924093cf95d87d75b`. No approval is established by empty findings. The reviewer inspected the complete diff, relevant source/rules/acceptance and independently corroborated Router ingress/cancellation limits. Reviewer-executed Git currentness/cleanliness/whitespace, Ruff format/lint, basedpyright and import-boundary checks passed. However, its unchanged permissions expose no permitted GitHub content reader for independent verification of material pinned candidate version/license/lifecycle claims. Installed Codex help/schema/checksum probes also could not be rerun. Author research/issue comments are not substitutes for independent source evidence. It declined full pytest/package checks because the existing test_codex_stdio.py ENV_FAKE fixture serializes the complete inherited environment, and sanitized execution is unavailable through the unchanged allowlist. Parent `make check` and `make package-check` results remain PASS as recorded; they are not claimed as reviewer-executed validation. No credentials or test-generated environment artifacts were read as part of review. Fresh canonical MCP/Git verifies unchanged exact HEAD/base and clean checkout. No review retry without changed diagnosed evidence/access, no reviewer-contract modification, no self-approval, merge, issue closure or next queue selection. Preserve 1 consumed review invocation; any future fresh review starts at ordinal 2, never zero. The loop terminates BLOCKED on finite review-tool/evidence incompleteness, not on an unresolved ownership choice.
kilo commented 2026-10-05 13:23:01 +00:00
Author
Member
Copy link

Review Environment Resolved: READY_FOR_OWNER_MERGE

Resumed the same invocation kernel-loop-20261005T102040Z under the explicit owner continuation. PR #66 is now independently approved for the bounded #47 research result: #66 (comment) contains review and validation evidence.

Review history preserved: ordinal 1/10 COMMENT; fresh ordinal 2/10 APPROVE with findings []. Exact approved HEAD f59f021ea457510d72d2429ce5795b9e0d07a63f; base e5f30c9cef89e9991c12cae924093cf95d87d75b. No new commit or product/config/test change was needed.

Independent reviewer fetched the pinned public candidate/Router source itself, reproduced Codex schema/version/checksum probes with a clean synthetic environment, and reran unchanged make check (977 tests + 32 subtests), make package-check and 47 focused synthetic tests in an ephemeral nonroot, network-disabled, locked Docker environment with no owner mounts/secrets. Exact container tracked tree matched PR HEAD. Final canonical checks are current/clean; exact-head CI #2216 SUCCESS.

This resolves the previous technical BLOCKED status without weakening tests or reviewer evidence requirements. Latest owner instruction prohibits merge, so PR/issue remain open and no integration/closure is claimed. Bounded documentation approval does not establish live harness/backend conformance, dependency adoption, product GO or complete G01/G04/G10. Ledger remains append-only with 2 consumed reviews.

## Review Environment Resolved: READY_FOR_OWNER_MERGE Resumed the same invocation `kernel-loop-20261005T102040Z` under the explicit owner continuation. PR #66 is now independently approved for the bounded #47 research result: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/66#issuecomment-14750 contains review and validation evidence. Review history preserved: ordinal 1/10 COMMENT; fresh ordinal 2/10 APPROVE with findings `[]`. Exact approved HEAD `f59f021ea457510d72d2429ce5795b9e0d07a63f`; base `e5f30c9cef89e9991c12cae924093cf95d87d75b`. No new commit or product/config/test change was needed. Independent reviewer fetched the pinned public candidate/Router source itself, reproduced Codex schema/version/checksum probes with a clean synthetic environment, and reran unchanged `make check` (977 tests + 32 subtests), `make package-check` and 47 focused synthetic tests in an ephemeral nonroot, network-disabled, locked Docker environment with no owner mounts/secrets. Exact container tracked tree matched PR HEAD. Final canonical checks are current/clean; exact-head CI #2216 SUCCESS. This resolves the previous technical BLOCKED status without weakening tests or reviewer evidence requirements. Latest owner instruction prohibits merge, so PR/issue remain open and no integration/closure is claimed. Bounded documentation approval does not establish live harness/backend conformance, dependency adoption, product GO or complete G01/G04/G10. Ledger remains append-only with 2 consumed reviews.
kilo commented 2026-10-05 14:41:21 +00:00
Author
Member
Copy link

COMPLETE: Bounded Research Result Integrated

Same invocation kernel-loop-20261005T102040Z, resumed under current canonical /loop merge/closure authority. PR #66 merged using supported MCP style=merge, no force/auto-merge/deletion.

Fresh review ordinal 3/10 returned APPROVE/findings [] on current HEAD f9976c1af94e24b590dc33bf25e8d31843db16aa, base/merge base 64c432957e19bd3bba7693ed0ad1002a764fcf39. Earlier #1 COMMENT and #2 APPROVE remain consumed; #2 became stale after base/HEAD changed. Existing normal merge commit f9976c1 refreshed the issue branch before this resume; no history rewrite was performed.

MCP confirms actual merge commit 5048c5cef95e546377d5e20baeae16b99b1bd088. Fresh canonical develop equals that commit, whose parents are exactly the approved base and head. Both are ancestors, and all three research documents match the independently reviewed HEAD byte-for-byte. No unrelated develop changes were introduced by this merge.

Integrated acceptance:

  1. docs/architecture/harness-feasibility.md contains exact version/revision/file/license/service-access candidate matrix with explicit unavailable/unknown qualifications; independently checked pinned official upstream and Router sources.
  2. Reproducible installed inference-free probes and synthetic recovery/refusal tests are separated from the separately authorized failure-oriented live proof plan covering all named scenarios.
  3. ACP client file/terminal executor and trust limits are explicit; no shared-server kill, unrelated takeover or sandbox claim.
  4. Control and backend verdicts are distinct; bounded demonstrated gaps and owner-approved Owned Sessions direction are retained without adopting a harness.
  5. Reuse ladder, compatibility/migration/proof limits and downstream issue reception boundaries are published; no new runtime/protocol/plugin/dependency/model ranking.

Current-head sanitized make check PASS (978 tests + 50 subtests); make package-check PASS; reviewer focused synthetic suite 47 tests PASS. Required canonical CI #2228 SUCCESS: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/90. Fresh premerge MCP issue/PR/Git state matched the approved frozen objects, and issue was not excluded. Branch-protection listing required admin read access; no access broadened, and ordinary server-enforced nonforce merge succeeded.

Closing #47 means acceptance of its bounded research/contract deliverable ONLY. It does not establish G01/G04/G10 implementation, live readiness, product GO, or authorize inference/security expansion/deployment. Functional work remains separately selected. Full ledger/history preserved.

## COMPLETE: Bounded Research Result Integrated Same invocation `kernel-loop-20261005T102040Z`, resumed under current canonical /loop merge/closure authority. PR #66 merged using supported MCP `style=merge`, no force/auto-merge/deletion. Fresh review ordinal **3/10** returned APPROVE/findings `[]` on current HEAD `f9976c1af94e24b590dc33bf25e8d31843db16aa`, base/merge base `64c432957e19bd3bba7693ed0ad1002a764fcf39`. Earlier #1 COMMENT and #2 APPROVE remain consumed; #2 became stale after base/HEAD changed. Existing normal merge commit f9976c1 refreshed the issue branch before this resume; no history rewrite was performed. MCP confirms actual merge commit `5048c5cef95e546377d5e20baeae16b99b1bd088`. Fresh canonical develop equals that commit, whose parents are exactly the approved base and head. Both are ancestors, and all three research documents match the independently reviewed HEAD byte-for-byte. No unrelated develop changes were introduced by this merge. Integrated acceptance: 1. `docs/architecture/harness-feasibility.md` contains exact version/revision/file/license/service-access candidate matrix with explicit unavailable/unknown qualifications; independently checked pinned official upstream and Router sources. 2. Reproducible installed inference-free probes and synthetic recovery/refusal tests are separated from the separately authorized failure-oriented live proof plan covering all named scenarios. 3. ACP client file/terminal executor and trust limits are explicit; no shared-server kill, unrelated takeover or sandbox claim. 4. Control and backend verdicts are distinct; bounded demonstrated gaps and owner-approved Owned Sessions direction are retained without adopting a harness. 5. Reuse ladder, compatibility/migration/proof limits and downstream issue reception boundaries are published; no new runtime/protocol/plugin/dependency/model ranking. Current-head sanitized `make check` PASS (978 tests + 50 subtests); `make package-check` PASS; reviewer focused synthetic suite 47 tests PASS. Required canonical CI #2228 SUCCESS: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/90. Fresh premerge MCP issue/PR/Git state matched the approved frozen objects, and issue was not excluded. Branch-protection listing required admin read access; no access broadened, and ordinary server-enforced nonforce merge succeeded. Closing #47 means acceptance of its bounded research/contract deliverable ONLY. It does not establish G01/G04/G10 implementation, live readiness, product GO, or authorize inference/security expansion/deployment. Functional work remains separately selected. Full ledger/history preserved.
kilo closed this issue 2026-10-05 14:41:31 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-62-installed-compatibility
issue-58-private-outcome-export
issue-57-recovery-preparation-alerts
issue-57-owner-served-state
issue-106-final-authority-dag
issue-106-forgejo-ordinary-execution
issue-105-independent-provider-drivers
issue-59-work-resource-ownership
issue-56-atomic-approval-recovery
issue-56-work-budget-enforcement
issue-103-publish-architecture-backlog
issue-62-platform-reception
issue-55-mi-utilized-reference
issue-52-kilo-offline-proof
docs/conversational-review-policy
issue-60-reception-fixture-plan
issue-62-compatibility-matrix-spec
issue-58-export-rights-spec
issue-57-owner-state-spec
issue-56-task-cost-shapes
issue-90-owned-cancellation
issue-54-product-review
issue-53-runtime-integration
No results found.
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#52 [Kernel][G04 G10] Consume Router execution decisions and preserve Attempt-bound route identity
Creatidy/creatidy-kernel
Reference
Creatidy/creatidy-kernel#47
No description provided.