orca/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md

SSH Relay GitHub Release Distribution — Living Implementation Checklist

Human-readable tracker: SSH Relay Runtime Distribution — Implementation Checklist

This file is the detailed evidence ledger. Use the tracker above for project status and remaining work; keep exact commands, runner identities, hashes, metrics, and residual gaps here.

Date created: 2026-07-14
Last updated: 2026-07-15
Current phase: Milestone 6 / Work Package 5 bounded runtime transfer — In progress — 2026-07-15, Codex implementation owner: disconnected Windows system-SSH tree-composition contract audit. Keep every capability disconnected from every production/default SSH path. Real Apple/SignPath rehearsals remain an explicit late gate and are not on this package's critical path.
Session checkpoint: WINDOWS STAGING CONTROL NATIVE PROOF CLOSED / TREE COMPOSITION AUDIT ACTIVE — 2026-07-15, Codex implementation owner — E-M6-WINDOWS-SYSTEM-SSH-CONTROL-CI-001 proves the real PowerShell staging-control contract on native Windows x64/arm64 and all adjacent exact-head gates, with only the declared hosted Windows arm64 floor gap. Audit the next disconnected tree owner before writing RED tests. Do not connect a product caller, change legacy upload/fallback/default behavior, enable a tuple, publish an artifact, or perform SignPath work. Merging to main remains prohibited, SignPath is deferred, and legacy remains the production default.
Primary design: SSH relay GitHub Release plan
Motivating issues: #8450, #1693

Mandatory Living-Document Protocol

This checklist is part of the implementation, not a planning artifact that may go stale. Every agent or engineer working on this project must read it before editing code and update it in the same change as the work it records.

• At the start of every implementation session, read this document and confirm the current phase, open decisions, accepted gaps, and existing evidence.
• Mark the active item with **In progress — YYYY-MM-DD, owner/agent** before changing code.
• Keep only one implementation item marked in progress unless independent PRs are deliberately running in parallel and each names its owner.
• Do not change - [ ] to - [x] until the implementation and its required verification are complete.
• Every completed item must cite an evidence-ledger ID such as E-ARTIFACT-001 or a merged PR.
• Record exact commands, runner OS/architecture, commit SHA, result, duration, and artifact link for executable evidence. “Tests passed” is not adequate evidence.
• Record what a test does not prove. Mock coverage must not be presented as live SSH, native-module, release-asset, or platform coverage.
• If implementation changes the design, update both this checklist and the HTML plan in the same PR before continuing.
• If a supported tuple lacks required real-environment proof, leave it on a proven legacy path or mark it unsupported. Do not check it off based on cross-compilation or emulation alone.
• Never use “100% verified” without naming the exact declared matrix and showing that every required cell passed.
• Preserve unrelated worktree changes. At checklist creation, the existing edits to ssh-remote-node-resolution.ts and its test are user-owned issue #8450 work.
• Before every PR handoff, update Current Status, PR/Work-Package Status, Verification Ledger, Accepted Gaps, and Next Required Action.

Status Legend

• - [ ] — not complete.
• - [x] — complete with linked evidence.
• **In progress — date, owner** — actively being implemented; the checkbox remains unchecked.
• BLOCKED: — cannot proceed without a named decision, authority, runner, credential, or external state. Include the exact unblock condition.
• ACCEPTED GAP: — deliberately not proved yet. Include scope, fallback behavior, owner, and promotion condition.

Current Status

• Implementation status: Work Package 0 is committed at c4259d94f on current main, with refreshed focused, static, full-lint, live #8450 SSH/PTY, and GitHub Actions proof (E-M0-UNIT-002, E-M0-STATIC-002, E-M0-LIVE-002, E-M0-CI-001). Draft PR #8724 is open and CI-green at current PR head 9a8f98fd9; the implementation evidence remains anchored at 94e58d83e.
• Completed package: Work Package 1's disconnected manifest, content-identity, signature, release-asset, and conservative selector contracts are locally and CI-green under E-M2-RED-001, E-M2-CONTRACT-001, and E-M2-CI-001. They remain isolated in stacked draft PR #8728, which is CI-green at current PR head 0c299fe18; implementation evidence remains anchored at b9d80a4cb. No deploy/resolver call site is connected and no tuple is enabled.
• Completed Work Package 3 gate: credential-free aggregate-input and authenticated draft read-back verification binds each input and returned byte to exact name, size, SHA-256, tuple, content identity, source draft, approved HTTPS asset origin, and exact HTTP 200 under E-M4-AGGREGATE-READBACK-LOCAL-001 and E-M4-AGGREGATE-READBACK-CI-001.
• Completed Work Package 3 gate: disconnected canonical assembly, bounded credential-free signing request, accepted-key/signature verification, deterministic final bytes, and all-six Node 24 workflow parity are green under E-M4-MANIFEST-HANDOFF-LOCAL-001, E-M4-MANIFEST-HANDOFF-LOCAL-002, and E-M4-MANIFEST-HANDOFF-CI-001.
• Completed Work Package 3 gate: the disconnected fail-closed aggregate boundary is green locally and on all six exact-head Node 24 native jobs under E-M4-MANIFEST-AGGREGATE-LOCAL-001, E-M4-MANIFEST-AGGREGATE-LOCAL-002, and E-M4-MANIFEST-AGGREGATE-CI-001.
• Completed Work Package 3 gate: credential-free post-sign tuple-descriptor producer and native-verification handoff. The descriptor must be derived only after returned-tree identity and native policy verification and must bind the exact archive, SBOM, provenance, native assessment, and content identity. E-M4-MANIFEST-TUPLE-SCHEMA-RED-001 requires an in-package release/desktop correction for tuple-specific native role counts before the producer can pass the real Windows closure. The correction and producer are green locally and on all six exact-head Node 24 native jobs under E-M4-MANIFEST-TUPLE-LOCAL-001, E-M4-MANIFEST-TUPLE-LOCAL-002, and E-M4-MANIFEST-TUPLE-CI-001.
• Completed Work Package 3 gate: semantic regeneration and verification of post-sign SBOM and provenance from the verified final runtime tree. E-M4-POST-SIGN-METADATA-LOCAL-RED-001 proves the purpose-named boundary was absent before implementation. The implementation is locally green under E-M4-POST-SIGN-METADATA-LOCAL-001 and E-M4-POST-SIGN-METADATA-LOCAL-002. Exact-head run 29408355188 exposes a Windows x64 test-fixture portability failure under E-M4-POST-SIGN-METADATA-CI-RED-001; production archive type/mode validation remains correct and must not be relaxed. The fixture now selects the exact platform/architecture tuple, archive family, release inputs, runner identity, and toolchain shape and is locally green under E-M4-POST-SIGN-METADATA-CORRECTION-LOCAL-001. Replacement exact-head Node 24 evidence passes all six native build jobs under E-M4-POST-SIGN-METADATA-CI-001. Production signing credentials, publication, desktop consumers, and tuple enablement remain outside this slice.
• Completed package: Work Package 3 reusable target-native build-prerequisite contract. The credential-free callable interface, both native test-family integrations, and exact-head all-six native CI pass under E-M4-BUILD-PREREQUISITE-LOCAL-RED-001, E-M4-BUILD-PREREQUISITE-LOCAL-001, and E-M4-BUILD-PREREQUISITE-CI-001. Release workflows remain disconnected.
• Completed Work Package 3 gate: callable, disconnected aggregate/manifest-signing workflow source contract. Exact aggregate input names, credential-free preparation/finalization, protected signer isolation, signature-only return, SHA-pinned actions, bounds, and complete consumer disconnection pass locally and on all six exact-head native jobs under E-M4-PROTECTED-MANIFEST-WORKFLOW-LOCAL-001 and E-M4-PROTECTED-MANIFEST-WORKFLOW-CI-001. The environment and seed remain unprovisioned; static and test-key proof do not count as live protected signing evidence.
• Completed Work Package 3 gate: disconnected draft-asset upload/recovery capability. Exact local bytes, authenticated tag/source binding, safe reuse, bounded retry reconciliation, cancellation, and partial-draft recovery pass locally and on all six exact-head native jobs under E-M4-DRAFT-UPLOAD-LOCAL-RED-001, E-M4-DRAFT-UPLOAD-LOCAL-001, and E-M4-DRAFT-UPLOAD-CI-001. There is no CLI entrypoint or workflow caller, and no real release write occurred.
• Completed Work Package 3 gate: disconnected relay required-asset capability. Exact manifest coverage, signature binding, name, size, upload state, managed-asset closure, stable/RC/perf identity, and consumer disconnection pass locally and on all six exact-head jobs under E-M4-RELEASE-ASSETS-LOCAL-RED-001, E-M4-RELEASE-ASSETS-LOCAL-001, and E-M4-RELEASE-ASSETS-CI-001. Release workflow composition remains open.
• Completed Work Package 3 gate: disconnected authenticated draft read-back materialization. The purpose-named RED, local GREEN, and exact-head all-six native Node 24 execution are recorded under E-M4-DRAFT-READBACK-MATERIALIZATION-LOCAL-RED-001, E-M4-DRAFT-READBACK-MATERIALIZATION-LOCAL-001, and E-M4-DRAFT-READBACK-MATERIALIZATION-CI-001.
• Completed package: Work Package 3 disconnected downloaded-archive execution. The purpose-named RED, local contracts, real full-size Darwin arm64 Actions-artifact execution, and exact-head all-six native execution are green under E-M4-READBACK-ARCHIVE-EXECUTION-LOCAL-RED-001, E-M4-READBACK-ARCHIVE-EXECUTION-LOCAL-001, and E-M4-READBACK-ARCHIVE-EXECUTION-CI-001.
• Completed package: Work Package 3 disconnected draft-release failure composition. The purpose- named RED, 10-test local implementation, and exact-head all-six Node 24 proof are green under E-M4-DRAFT-RELEASE-COMPOSITION-LOCAL-RED-001, E-M4-DRAFT-RELEASE-COMPOSITION-LOCAL-001, and E-M4-DRAFT-RELEASE-COMPOSITION-CI-001.
• Completed package: portable POSIX relay archive correction. E-M5-ARCHIVE-PORTABILITY-AUDIT-001, E-M5-PORTABLE-ARCHIVE-LOCAL-RED-001, E-M5-PORTABLE-ARCHIVE-LOCAL-001, E-M5-PORTABLE-ARCHIVE-CI-RED-001, E-M5-PORTABLE-ARCHIVE-PARENT-LOCAL-RED-001, E-M5-PORTABLE-ARCHIVE-PARENT-LOCAL-001, and E-M5-PORTABLE-ARCHIVE-CI-001 prove the selected bounded archive, correction, all-six primary jobs, and both Linux oldest-userland supplements. Windows ZIP and upstream Node .tar.xz remain unchanged.
• Completed Work Package 4 cache gate: content locking, immutable entry publication/lookup, corruption quarantine, cross-process in-use leases, persistent recency, exact logical-byte accounting, and bounded 2 GiB eviction pass locally and on all six native clients under E-M5-ARTIFACT-CACHE-LOCK-CI-001, E-M5-ARTIFACT-CACHE-ENTRY-CI-001, and E-M5-ARTIFACT-CACHE-EVICTION-CI-001. No production consumer exists.
• Completed package: pure app-owned relay artifact cache-root derivation. An absolute caller-supplied native user-data path, fixed versioned namespace, environment non-redirection, local gates, and all-six native Node 24 proof are green under E-M5-ARTIFACT-CACHE-ROOT-LOCAL-RED-001, E-M5-ARTIFACT-CACHE-ROOT-LOCAL-001, and E-M5-ARTIFACT-CACHE-ROOT-CI-001. No Electron or product caller exists.
• Completed package: disconnected full host-evidence composition is green locally and on every primary native client under E-M5-HOST-EVIDENCE-COMPOSITION-LOCAL-001 and E-M5-HOST-EVIDENCE-COMPOSITION-CI-001. It has no product caller.
• Completed package: the disconnected POSIX no-tar per-file command/destination boundary is green locally and on every primary native client under E-M6-POSIX-SYSTEM-SSH-FILE-LOCAL-001 and E-M6-POSIX-SYSTEM-SSH-FILE-CI-001. It has no real SSH or product caller.
• Completed package: the disconnected authenticated system-SSH command-channel adapter is green locally and on every primary native client under E-M6-POSIX-SYSTEM-SSH-CHANNEL-LOCAL-001 and E-M6-POSIX-SYSTEM-SSH-CHANNEL-CI-001. It has no tree/live/product caller.
• Completed package: the disconnected POSIX system-SSH tree/root composition is green locally and on all six primary Node 24 native clients under E-M6-POSIX-SYSTEM-SSH-TREE-LOCAL-001 and E-M6-POSIX-SYSTEM-SSH-TREE-CI-001. It has no live/full-size SSH or product caller.
• Active package: Audit in progress — 2026-07-15, Codex implementation owner — establish the smallest purpose-named live/full-size loopback OpenSSH proof for the exact disconnected POSIX system-SSH tree owner, initially on target-native Linux x64/arm64 runners. Do not add product, settings, fallback, tuple, publication, default behavior, a semantic probe, or a tar fast path.
• Completed Work Package 2 gate: target-native Windows source-signature reports from exact-head artifact jobs 87267322867 and 87267322870 were independently downloaded and matched to their identities and signing-stage reports under E-M3-WINDOWS-SOURCE-SIGNATURE-CI-001. PR Checks 29388734935 and Golden E2E 29388734914 are green. Exact floors and real native signing/trust remain open, so Work Package 2 as a whole is not complete and no tuple is enabled.
• Historical Work Package 2 progression: target-native runtime assembly, archive inspection, executable smoke, SBOM, and provenance only. The Windows x64/arm64 artifact candidate and portability corrections are implemented through b6903b220, with bounded smoke diagnostics in 3aab5aff8, explicit PTY smoke settlement in ddf28eb8d, and bounded active-resource diagnostics in 6bba90020, in stacked draft PR #8741. Exact-head run 29341643555 proves the bundled Node, patched PTY input/resize/exit, and watcher lifecycle complete on x64 in 3,357.413 ms with 56,905,728-byte RSS and arm64 in 6,593.663 ms with 54,505,472-byte RSS, but each child retains a Windows handle until the parent kills it at its 45-second bound. Exact-head run 29343816558 now classifies the resource on both native architectures: after all public PTY cleanup and a two-second observation window, one MessagePort remains alongside only the expected parent stdio PipeWrap resources (E-M3-WINDOWS-RESOURCE-DIAGNOSTIC-CI-RED-001). The active slice is an exact-source, fail-closed correction applied only to the copied node-pty Windows JavaScript inside runtime artifact staging; the repository-wide node-pty patch and legacy/default desktop path must remain unchanged. That local contract is green at c04b4f630 under E-M3-WINDOWS-CONPTY-WORKER-LOCAL-001. Exact-head run 29345126283 then passed all six native jobs; both Windows architectures shed the MessagePort within the two-second observation window, exited normally, and uploaded unpublished evidence (E-M3-WINDOWS-CI-001). This package may produce test artifacts but must not publish, resolve, transfer, install, launch, or enable them.
• Historical evidence progression: the immutable Node v24.18.0 contract, pinned release key, bounded verifier, and artifact-only CLI are locally green under E-M3-NODE-RED-001 and E-M3-NODE-PROVENANCE-001. E-M3-RUNTIME-LOCAL-001 additionally proves one unpublished Linux arm64 glibc assembly, exact-tree archive inspection, deterministic repack, bundled Node 24.18.0 execution, real patched PTY, and watcher events. E-M3-STATIC-001 records the current focused, type, lint, format, line-budget, and diff gates. The first exact-head native run exposed a macOS /var versus /private/var watcher oracle mismatch under E-M3-CI-RED-001. The corrected exact-head run passed target-native build, archive/tree verification, bundled Node, patched PTY, and watcher smoke for Linux x64/arm64 and macOS x64/arm64 under E-M3-CI-001. A bounded comparator now rejects incomplete outputs and any runtime-tree, archive, identity, SPDX, provenance, type, mode, size, or digest drift after two independently verified clean builds; its exact implementation-commit contract and static gates are locally green under E-M3-REPRODUCIBILITY-LOCAL-001. Exact-head run 29347236627 passed both Linux cells, exposed macOS x64/arm64 runtime identity drift, and failed Windows x64/arm64 while collecting the new comparator suite under E-M3-REPRODUCIBILITY-CI-RED-001. E-M3-REPRODUCIBILITY-DIAGNOSTIC-LOCAL-001 removes the comparator shebang, checks both new files with node --check on POSIX and Windows, and reports runtime-tree drift before derived metadata drift. E-M3-REPRODUCIBILITY-DIAGNOSTIC-CI-RED-001 proves those diagnostics on all six native runners: Linux x64/arm64 remain equal, both macOS builds first differ at pty.node, and both Windows builds first differ at conpty_console_list.node. The bounded correction in a09b02ec4 makes macOS retain a reproducible loadable UUID, applies /Brepro only to copied Windows artifact source, and requires exclusive caller-owned work paths; 3e433b343 makes the CI path canonical across runs. E-M3-REPRODUCIBILITY-LINKER-CI-RED-001 proves both Linux and macOS architectures now build, verify, smoke, compare exactly, and upload, but both Windows jobs fail closed in contract collection because ssh-relay-runtime-build.test.mjs imports a builder with an unused Unix shebang. E-M3-REPRODUCIBILITY-BUILDER-PARSER-LOCAL-001 proves the bounded correction at exact commit f864d3fa6. Exact-head run 29351557922 then parses and builds on all six native runners: Linux x64/arm64, macOS x64/arm64, and Windows x64 compare exactly and upload, while Windows arm64 fully builds, verifies, and smokes both outputs but fails closed before upload when conpty_console_list.node differs (E-M3-REPRODUCIBILITY-WINDOWS-ARM64-CI-RED-001). Documentation- only exact-head repeat run 29352510414 reproduces the same isolated arm64 drift while all five controls compare and upload under E-M3-REPRODUCIBILITY-WINDOWS-ARM64-REPEAT-CI-RED-001. Native Windows arm64 equality remains mandatory; oldest-baseline, native-trust, SSH, and musl cells remain open. E-M3-WINDOWS-PE-DIAGNOSTIC-LOCAL-001 proves the bounded diagnostic and fail-closed workflow ordering locally at exact implementation commit 39ee3451b; both native Windows cells remained required before interpreting or correcting the producer. Exact-head run 29353432240 keeps x64 and all POSIX controls green, then reports the real arm64 PE hashes/layout/ranges and fails without upload under E-M3-WINDOWS-PE-DIAGNOSTIC-CI-RED-001. Because the 128 detailed-range cap is exhausted by .text, the active diagnostic-only correction adds raw-section labels and a bounded summary across all 2,887 ranges before any producer change. Exact-head run 29357355064 keeps all five controls reproducible and proves both generated x64 option blocks, but the native arm64 build fails closed at the new Release-condition verifier before runtime staging under E-M3-WINDOWS-MSBUILD-PLATFORM-CASE-CI-RED-001. The runner exposes Platform=arm64; the active correction accepts only a case-insensitive exact match for the expected architecture and retains every option/cardinality check. Exact-head run 29358223742 proves that correction on the real arm64 runner, preserves five exact controls, and reaches paired disassembly under E-M3-WINDOWS-ARM64-THUNK-DISASSEMBLY-CI-RED-001. The arm64 outputs have 2,879 linker-emitted 16-byte function thunks whose three control-flow instructions match and whose unreachable fourth udf instruction differs, plus 68 derived identity bytes. Strict comparison and rejected-output no-upload remain intact. The active diagnostic must prove the generated incremental-link state before any producer change. No comparator, publication, or production behavior changes.
• Windows input correction: E-M3-WINDOWS-INPUT-GAP-001 proved the official Windows ZIP lacks headers and node.lib. Both artifacts now require the exact signed headers archive and tuple import library as explicit inputs. The schema, signed-checksum verifier, bounded ZIP/header extraction, and import-library staging are locally green under E-M3-WINDOWS-INPUT-001; native Windows build proof remains active and no implicit node-gyp download is allowed.
• Windows PTY-closure correction: E-M3-WINDOWS-CONPTY-GAP-001 proved the candidate omitted the conpty.dll and OpenConsole.exe files required by Orca's production useConptyDll: true path and therefore exercised a weaker system-ConPTY smoke. E-M3-WINDOWS-LOCAL-002 proves the corrected local tree-closure and smoke configuration contracts. E-M3-WINDOWS-CI-001 proves the corrected native x64/arm64 closure executes and settles; oldest-baseline and native-trust cells remain open.
• Windows native progression: E-M3-WINDOWS-CI-RED-002 captured and corrected NTFS fixture modes, Windows shebang parsing, authenticated-key checkout bytes, and POSIX-only mode assertions. At the corrected exact head, E-M3-WINDOWS-CI-RED-003 proves 20 passing and one intentionally skipped test on each native architecture, exact input download, and a common fail-closed Git-for-Windows gpgv drive-letter keyring incompatibility. E-M3-WINDOWS-CI-RED-004 proves that correction with 21 passing and one intentionally skipped test, signed input acceptance, native compilation, and runtime/ZIP assembly on each architecture; both 45-second bundled smoke commands then time out without propagating their already bounded child stderr. E-M3-WINDOWS-SMOKE-SETTLEMENT-CI-RED-001 and E-M3-WINDOWS-SMOKE-SETTLEMENT-CI-RED-002 then proved functional PTY/watcher smoke still did not settle after public listener and terminal cleanup. E-M3-WINDOWS-RESOURCE-DIAGNOSTIC-CI-RED-001 identifies the persistent native resource as one MessagePort on both x64 and arm64 after a two-second drain window. E-M3-WINDOWS-CI-001 proves the artifact-only correction removes that resource before normal exit on both architectures and retains the uploaded bytes. No oldest- baseline, native-trust, SSH, reproducibility, or enabled-tuple claim is made.
• Production behavior: unchanged; Orca embeds relay JavaScript and installs node-pty plus @parcel/watcher with remote npm.
• New runtime assets published: none.
• Bundled runtime enabled: no.
• Declared supported bundled tuples: none until the required target-native and two-layer live evidence cells are complete.
• Validation orchestration: GitHub Actions is the primary runner and evidence surface under E-M1-RUNNER-DECISION-001; exact native labels are recorded, while representative cross-family remote targets remain open.
• Rollout control: the Beta-tagged option lives on SSH target add/edit surfaces and is persisted per target through existing target configuration. It is off by default for existing, new, imported, missing, unknown, and malformed configurations, all of which resolve to legacy. Only an explicit per-target opt-in selects bundled-preferred behavior, and implementing the setting does not authorize default-on rollout or legacy removal (E-M1-ROLLOUT-DECISION-001).
• Legacy fallback removal: not authorized.
• Next required action: commit and push the locally green semantic post-sign metadata package, then collect exact-head Node 24 proof from all six native build jobs. Commit/push and PR-contained CI work are authorized; merging to main is not. Keep real native/manifest signing credentials, endpoint trust, missing exact-floor snapshots, production publication, desktop consumers, and every tuple's enabled state outside this slice.

Non-Negotiable Invariants

• The bundled primary path never requires outbound HTTP, npm, a compiler, Python, or a system Node installation on the SSH host.
• The desktop downloads the runtime, verifies it locally, and transfers it through the existing authenticated SSH connection.
• SSH authentication/connection and relay RPC transport remain unchanged; bootstrap artifact transfer is a separately designed, measured, and gated subsystem.
• Every desktop build embeds the exact signed manifest needed to resolve a remote tuple to a content identity while the desktop is offline.
• Relay artifacts are built and signed before desktop packaging; app builds and GitHub Release uploads consume the exact same immutable bytes.
• No downloaded byte is extracted, transferred, or executed until manifest authenticity, expected tuple, size bounds, and archive SHA-256 are verified at the appropriate boundary.
• A completed remote install is immutable and content-addressed. A running old relay is never mutated in place.
• Bundled and legacy installs use distinct identities, locks, partial directories, sentinels, and launch generations.
• Fallback cannot start until all bundled download, extraction, upload, verification, and launch work is aborted, awaited, and unable to mutate state.
• Signature, archive hash/safety, extracted-tree, or native-signature failure fails closed in auto: rejected bytes never execute and automatic legacy fallback never starts.
• Detected local or remote cache corruption is quarantined and may recover only from freshly verified bundled bytes; failed/unavailable recovery fails closed without automatic legacy.
• Local signed-manifest/archive/tree verification plus authenticated SSH transfer into exclusive staging is the pre-execution integrity boundary; bundled Node then hashes the entire staged tree before any completion sentinel is written.
• Remote install proof establishes initial transfer/finalization correctness. Warm launch trusts Orca's completed-directory immutability assumption; the sentinel is not ongoing proof against later mutation or a hostile authenticated account that can replace runtime and sentinel.
• Platform support is never inferred from an artifact existing. Each enabled tuple requires a real-environment runtime proof.
• Unknown or conflicting platform/libc evidence deterministically selects proven legacy behavior; it never guesses an artifact.
• Runtime transfer has explicit memory, file-count, concurrency, cancellation, and time budgets.
• Bundled mode depends only on the explicitly declared POSIX or Windows bootstrap primitives; it never silently requires remote Node, Python, tar, sha256sum, or shasum.
• Every Node/CVE/runtime/key refresh produces a new desktop tag/build and embedded signed manifest. Old clients remain frozen to their embedded manifest and accepted keys.
• Current PTY, watcher, Git, filesystem, streaming, agent-hook, preflight, reconnect, and GC contracts remain intact.
• macOS, Linux, and Windows behavior remains behind runtime checks and uses platform-native paths and commands.
• No implementation file adds a max-lines disable or vague helpers/utils module name.

Milestone 0 — Preserve and Prove the Legacy Safety Net

Goal: land the narrow #8450 correction independently because automatic fallback depends on a coherent Node/npm resolver.

Work Package 0 implementation evidence was completed on 2026-07-14 by the Codex implementation owner. No relay artifact-distribution behavior is included.

• Confirm the #8450 implementation selects Node and npm from the same bin directory on POSIX. (E-M0-UNIT-001, E-M0-UNIT-002, E-M0-LIVE-002)
• Confirm Windows selects node.exe and npm.cmd from one toolchain directory. (E-M0-UNIT-001; mocked Windows command construction, not live Windows)
• Reject an incomplete system Node and continue to the usable NVM candidate. (E-M0-UNIT-001, E-M0-UNIT-002, E-M0-LIVE-002)
• Preserve minimum supported Node-version enforcement. (E-M0-UNIT-001)
• Preserve login-shell, known-path, version-manager, noisy-startup, cancellation, and MaxSessions=1 behaviors. (E-M0-UNIT-001; live MaxSessions=1 remains outside this WP0 proof)
• Add the exact Ubuntu/system-Node-without-npm/NVM-below-.bashrc-guard regression fixture. (E-M0-UNIT-001, E-M0-LIVE-001)
• Add negative tests for Node present/npm missing, npm present/Node too old, mismatched bin directories, and an unusable npm shim. (E-M0-UNIT-001)
• Run focused resolver and deploy tests and record evidence. (E-M0-UNIT-001, E-M0-UNIT-002)
• Run a live SSH reproduction matching issue #8450 and record the selected paths and successful relay/PTY launch without recording usernames or home paths in committed evidence. (E-M0-LIVE-001, E-M0-LIVE-002)
• Keep this fix in a separate PR or commit from GitHub Release distribution. The reviewed plan is commit 2b67de870; WP0 code is the separate commit c4259d94f in draft PR #8724. (E-M0-PR-001)
• Document which tuples have a live passing legacy E2E. Fallback is only a support claim for those tuples. (E-M0-LIVE-001)

Legacy remote tuple	Client	Transport	Evidence	Scope limit
Ubuntu 24.04 arm64, glibc, system Node 18 without npm, guarded NVM Node 22/npm 10	macOS 26.2 arm64	Built-in SSH2 connection + SFTP relay upload	E-M0-LIVE-001, E-M0-LIVE-002	Does not prove x64, system SSH, Windows, musl, or MaxSessions=1

Completion evidence required: focused red/green tests, live #8450 SSH run, typecheck, lint, and PR link.

Milestone 1 — Close Blocking Product and Support Decisions

No production implementation begins until every blocking item has an owner and decision record.

Supported runtime baselines

• Define the oldest supported glibc version as 2.28 for initial Linux x64/arm64 candidates. (E-M1-BASELINE-001)
• Define the oldest supported libstdc++/C++ ABI level as libstdc++ 6.0.25 with GLIBCXX_3.4.25. (E-M1-BASELINE-001)
• Define the minimum supported Linux kernel as 4.18. (E-M1-BASELINE-001)
• Define no enabled musl baseline initially. Alpine/musl remains a selector and legacy-path test family until Orca produces and proves its own target-native Node/runtime build; no unofficial Node binary is accepted. (E-M1-BASELINE-001, E-M1-NODE-PROVENANCE-001)
• Define macOS 13.5 as the minimum for both x64 and arm64 candidates. (E-M1-BASELINE-001)
• Define the initial Windows candidates as Windows 10 22H2 build 19045 or Server 2022 build 20348 for x64, and Windows 11 24H2 build 26100 for arm64, with OpenSSH for Windows 8.1p1, Windows PowerShell 5.1, and .NET Framework 4.8 as minimum bootstrap primitives. Because the manifest has one monotonic minimumBuild per tuple, encode 19045 for x64 (which admits Server 2022 build 20348 and newer) and 26100 for arm64. (E-M1-BASELINE-001)
• Treat a Rosetta-translated shell as x64 process architecture, but keep it on legacy until an x64 artifact passes a live Rosetta SSH cell. A native arm64 shell selects arm64; detection never forces a native-architecture artifact across a translated process boundary. (E-M1-BASELINE-001)
• Document current legacy platform families separately from bundled candidates and distinguish a code-declared family from a live-evidenced fallback claim. (E-M1-LEGACY-INVENTORY-001)

Decision owner: Codex implementation owner for #8450. Decision authority: conservative implementation boundary under the user-approved legacy-default Beta rollout. These are minimum eligibility constraints, not support claims: every candidate remains disabled until its two-layer live evidence cells pass.

The initial candidate families are Linux glibc x64/arm64, macOS x64/arm64, and Windows x64/arm64. Linux musl, WSL, Rosetta-translated macOS, and any unlisted OS/architecture remain legacy-only. Version parsing is exact and fail-conservative; an unknown, missing, older, or conflicting baseline probe selects legacy rather than guessing a compatible artifact.

Remote family	Current legacy path	Proposed bundled candidate	Live fallback evidence in this project
Linux x64 glibc	Declared linux-x64; coherent remote Node/npm plus remote native npm install	linux-x64-glibc	None yet
Linux arm64 glibc	Declared linux-arm64; coherent remote Node/npm plus remote native npm install	linux-arm64-glibc	E-M0-LIVE-002 (Ubuntu 24.04 arm64)
Linux x64/arm64 musl	Shares current Linux platform key; compatibility depends on legacy npm/native build	None initially; selector returns legacy	None
macOS x64	Declared darwin-x64; coherent remote Node/npm plus remote native npm install	darwin-x64	None
macOS arm64	Declared darwin-arm64; coherent remote Node/npm plus remote native npm install	darwin-arm64	None
Windows x64	Declared win32-x64; coherent node.exe/npm.cmd plus remote native install	win32-x64	None
Windows arm64	Declared win32-arm64; coherent node.exe/npm.cmd plus remote native install	win32-arm64	None
WSL/Rosetta/other	No separate current platform identity; behavior follows detected process family	No candidate until a separately identified live cell	None

“Declared” above means the current source accepts the platform and has deterministic unit coverage; it is not a claim that this project has a passing live SSH fallback cell. Automatic legacy fallback for a bundled tuple is permitted only where the last column has current evidence for the relevant family/transport conditions.

Validation runner and network topology

Decision owner: Codex implementation owner for #8450. Decision authority: worktree owner direction on 2026-07-14. GitHub Actions is the primary orchestration and durable evidence surface because it can couple target-native build jobs, packaged-client jobs, logs, metrics, and immutable artifacts to the exact commit under test without introducing a second release-control plane.

• Use GitHub Actions for the PR, nightly, release, and promotion evidence workflows. (E-M1-RUNNER-DECISION-001)
• Permit a GitHub-hosted runner to fill a required evidence cell only when it provides real hardware or native virtualization for the declared OS/architecture and the job records the runner label, image/version, architecture, and native-versus-emulated status. (E-M1-RUNNER-DECISION-001)
• Require a real OpenSSH daemon, the full-size packaged runtime, and the production built-in SSH/SFTP or system-SSH path named by the cell. A mock server, reduced fixture, cross-build, QEMU-only run, or artifact existence cannot fill a live cell. Same-host or native-container targets qualify only when they preserve the declared remote OS/architecture, SSH daemon, primitive, egress, and isolation conditions. (E-M1-RUNNER-DECISION-001)
• For Layer B cross-family cells, have the GitHub Actions job provision or connect to an ephemeral native SSH target or an approved self-hosted target pool. The remote need not itself be GitHub-hosted, but its image/snapshot identity and teardown result are part of the evidence; do not assume networking between unrelated hosted jobs. (E-M1-RUNNER-DECISION-001)
• Keep any tuple without an available qualifying native runner or reachable representative remote disabled and on its proven legacy path. (E-M1-RUNNER-DECISION-001)
• Inventory the repository's available GitHub-hosted runner labels and record native architecture, image/version policy, and unreserved capacity. No approved self-hosted SSH target pool currently exists. (E-M1-RUNNER-INVENTORY-001)
• Name and pin the representative POSIX and Windows remote images/snapshots used for Layer B, including their OpenSSH and bootstrap-primitive baselines and network-egress controls.
• Use the explicit native GitHub runner labels below for paired legacy-versus-bundled regression measurements in the same job, with local network shaping and at least ten samples per path. If three qualifying reruns have over 15% coefficient of variation or disagree on the threshold, require an approved dedicated runner; do not weaken the threshold. (E-M1-BUDGET-DECISION-001)

BLOCKED for cross-family live evidence, not for contract-only work: the Codex implementation owner owns repo-local fixture/workflow definitions, but a repository release administrator must approve an ephemeral cloud credential/environment or a self-hosted target pool before immutable POSIX and Windows Layer B snapshots can be named as reachable infrastructure. The unblock record must include provider, snapshot IDs, credential owner, egress policy, teardown SLA, and cost/capacity owner. Safe default: no Layer B cell and no bundled tuple is enabled; continue schema/selector and local same-family test work without secrets.

Native runner inventory decision

Decision owner: Codex implementation owner for #8450. Image authority: GitHub-hosted runner image catalog; repository workflow inventory at this branch. Pin explicit OS labels in new relay workflows and record the resolved image version from every job because GitHub refreshes images weekly. *-latest is not permitted for qualifying tuple evidence.

Client/build architecture	Qualifying label	Native image family	Capacity/update rule
Linux x64	ubuntu-24.04	Ubuntu 24.04 x64	GitHub-hosted ephemeral, unreserved/queue-dependent; weekly image, log exact version
Linux arm64	ubuntu-24.04-arm	Ubuntu 24.04 arm64	GitHub-hosted ephemeral, unreserved/queue-dependent; weekly image, log exact version
macOS x64	macos-15-intel	macOS 15 x64	GitHub-hosted ephemeral, unreserved/queue-dependent; weekly image, log exact version
macOS arm64	macos-15	macOS 15 arm64	GitHub-hosted ephemeral, unreserved/queue-dependent; weekly image, log exact version
Windows x64	windows-2022	Server 2022 x64	GitHub-hosted ephemeral, unreserved/queue-dependent; weekly image, log exact version
Windows arm64	windows-11-arm	Windows 11 arm64	GitHub-hosted ephemeral, unreserved/queue-dependent; weekly image, log exact version

The repository already uses ubuntu-latest, ubuntu-24.04-arm, macos-15, windows-2022, and a third-party macOS release label. Existing latest and third-party labels may remain for their current workflows but do not qualify a relay tuple unless the relay job pins the explicit label and records its resolved image. No approved self-hosted SSH target pool, reserved hosted-runner capacity, or cross-family remote endpoint is inferred from this inventory; those unresolved Layer B cells keep the affected tuple disabled.

Remote bootstrap primitives

• Define the exact POSIX baseline as POSIX sh with builtin command/printf plus byte-preserving cat, mkdir, rm, mv, chmod, test, and nohup; no Node, Python, Perl, tar, base64, checksum tool, or compiler is permitted. (E-M1-BOOTSTRAP-DECISION-001)
• Define the exact Windows baseline as OpenSSH for Windows 8.1p1, Windows PowerShell 5.1, and .NET Framework 4.8 with FileStream, FileMode.CreateNew, 64 KiB binary reads/writes, same-volume Directory.Move, ACL-preserving filesystem operations, and the existing detached relay launch mechanism. (E-M1-BOOTSTRAP-DECISION-001)
• Capability-probe required semantics with a client-generated nonce and byte fixture, without Node or Python, once per authenticated SSH connection. Never persist or share the result across hosts or reconnect generations. (E-M1-BOOTSTRAP-DECISION-001)
• Treat missing or semantically incorrect bootstrap primitives as compatibility failure, eligible for legacy in auto only where that exact legacy family has current evidence. (E-M1-BOOTSTRAP-DECISION-001)
• Record no BusyBox-only variant as qualified initially. Ubuntu 24.04 arm64 BusyBox 1.36.1 lacks the required nohup applet and therefore selects legacy; any BusyBox host must pass the full semantic probe with external required commands before it can become a candidate. (E-M1-BUSYBOX-001)

Bootstrap primitive decision

POSIX system SSH and built-in SSH2 both open a dedicated stdin byte stream for each manifest file. The remote command creates that file with restrictive permissions and cat > file; the client sends exactly the declared size and closes stdin. The initial semantic probe round-trips a binary fixture containing NUL, CR, LF, high-bit bytes, and no trailing newline through the same path. Per-file channels are bounded and become sequential under MaxSessions=1. Full staged-tree integrity is still checked later by transferred bundled Node, not by trusting cat or a remote checksum command.

Windows transfer sends raw bytes to a purpose-built PowerShell script that reads Console.OpenStandardInput() into a 64 KiB buffer and writes with FileStream. A CreateNew lock file containing an unguessable client token establishes exclusive staging ownership before the directory is created; every later command verifies that token. The reader rejects early EOF and one extra byte beyond the declared safe-integer size. It never materializes the file as a string, JSON/base64 value, or whole-file buffer. Publish uses same-volume rename only after bundled-Node tree verification and native probes. Probe artifacts and locks are removed on success, failure, or cancellation; cleanup settlement is part of the timeout oracle.

Node runtime ownership

• Pin the first runtime contract to official Node v24.18.0 LTS (Krypton). Stay on Node 24 LTS until a separately reviewed major upgrade; never silently float a desktop build to a newer patch. (E-M1-NODE-PROVENANCE-001)
• Use unchanged official nodejs.org binaries for Linux glibc x64/arm64, macOS x64/arm64, and Windows x64/arm64. Build all relay code and native dependencies in target-native Orca jobs; do not substitute cross-built Node executables. (E-M1-NODE-PROVENANCE-001)
• Produce no musl Node binary in the initial release. A later musl candidate requires an Orca-owned target-native source build, reproducible provenance, signing, and the same live gates; unofficial community binaries are prohibited. (E-M1-NODE-PROVENANCE-001)
• Check Node security/release status at least weekly and at every desktop release cut. Triage a published Node/runtime CVE within one business day; ship an applicable critical fix within seven calendar days and high-severity fix within fourteen, or disable the affected bundled tuple while legacy remains available. (E-M1-NODE-PROVENANCE-001)
• Require every Node patch, CVE remediation, native-code change, dependency change, manifest-key change, or accepted-key change to create a new runtime content ID and a new desktop tag/build with a newly embedded signed manifest. Old clients remain pinned. (E-M1-NODE-PROVENANCE-001)
• Verify the detached Node SHASUMS256.txt.sig against a build-input-pinned Node release keyring before extraction, record the signer fingerprint and source archive digest in provenance, and preserve official executable bytes/signatures. Orca-built native executables and libraries still require the target-native signing policy decided below. (E-M1-NODE-PROVENANCE-001)
• For Windows native-module builds, authenticate the exact-version headers.tar.gz and architecture-specific win-*/node.lib through that same signed checksum document in addition to the tuple ZIP. The official Windows ZIP does not contain either build input; implicit node-gyp downloads are prohibited. (E-M3-WINDOWS-INPUT-GAP-001)

Trust and signing

• Use Ed25519 detached signatures through the existing direct tweetnacl@1.0.3 dependency; reject non-64-byte signatures, non-32-byte public keys, unknown algorithms, and unknown keys. (E-M1-TRUST-DECISION-001)
• Canonicalize only a fully validated unsigned manifest projection: fixed schema field order, tuples sorted by canonical tuple ID, files sorted by portable relative path, safe integers, portable ASCII identity/path fields, no optional undefined, and UTF-8 JSON.stringify bytes with no whitespace or trailing newline. Signatures are outside the signed projection. (E-M1-TRUST-DECISION-001)
• Generate Ed25519 keys offline, store only the base64-encoded 32-byte seed in a tag-restricted relay-runtime-manifest-signing GitHub Environment with required reviewers, expose it only to the fail-closed aggregate job, pin every action by commit SHA, grant no write permission except the separate draft-release upload job, and rely on environment deployment logs for audit. (E-M1-TRUST-DECISION-001)
• Define key ID as sha256:<lowercase hex SHA-256 of the 32-byte Ed25519 public key>. Embed the accepted key set in the desktop. Rotation dual-signs at least two consecutive desktop releases and 30 days; old-key removal/revocation and emergency replacement ship only in a new desktop build. Old clients and manifests remain pinned with no freshness lookup. (E-M1-TRUST-DECISION-001)
• Require embedded manifest tag/channel/version to equal the compiled desktop identity and use only that exact release URL. A newer desktop never accepts an older manifest. A user-initiated desktop downgrade may use its own embedded older manifest/cache namespace but cannot rewrite a newer content-addressed install. (E-M1-TRUST-DECISION-001)
• Use GitHub artifact attestations/keyless OIDC provenance as a supplement, never as a replacement for the offline-verifiable embedded Ed25519 manifest signature. (E-M1-TRUST-DECISION-001)
• Preserve valid official Node signatures. Sign every Orca-built macOS executable, .node, dylib, and spawn-helper with the existing Developer ID Application identity before final hashes; verify strict codesign and notarized containing-app provenance on a native runner. (E-M1-TRUST-DECISION-001)
• Preserve valid upstream Authenticode signatures and send every unsigned Orca-built Windows .exe, .dll, and .node through the existing SignPath inner-binary flow before final hashes; verify Get-AuthenticodeSignature and signer policy on returned bytes. (E-M1-TRUST-DECISION-001)
• Define target-native trust environments: clean macOS 13.5 x64/arm64 snapshots with quarantine plus Gatekeeper/codesign assessment; Windows Server 2022 x64 and Windows 11 24H2 arm64 snapshots with current Microsoft Defender signatures; and a disposable Windows 11 24H2 x64 VM with the release WDAC policy in audit then enforced mode. Record snapshot/policy/signature IDs in every run; third-party EDR observations may supplement but not replace these gates. (E-M1-ENDPOINT-DECISION-001)

Manifest-key operational gate

Decision owner: Codex implementation owner for #8450. Operational owners: repository release administrators for GitHub Environment/reviewer policy, existing Apple credential owners for macOS, and existing SignPath organization approvers for Windows. No key or secret is created by this decision. Runtime publication remains blocked until the protected environment, two test keys, dual-sign/unknown-key/revocation rehearsals, action-SHA allowlist, and access audit are executable.

The signing job receives canonical unsigned bytes and returns only key ID plus signature. The aggregate job reconstructs and verifies the signed projection before emitting the final manifest. The desktop repeats the same validation and rejects duplicates before cryptographic verification. At least one accepted signature is required, every signature entry must be unique, and a malformed or unknown extra signature fails closed rather than being ignored. Key compromise cannot alter an old client's embedded manifest or archive hashes; emergency response stops asset publication and ships a new desktop build with revised accepted keys.

The trust-environment decision does not imply those snapshots exist in an approved pool. Gatekeeper tests add a quarantine attribute to the downloaded runtime before assessment and execution. Windows tests update Defender intelligence, scan the unpacked tree, verify every PE signature, run native PTY/watcher smoke, then repeat under the enforced WDAC policy. Detection, quarantine, or policy denial is release-blocking and must retain logs without weakening the security product.

Operational budgets and rollout policy

• Record current legacy cold-install and warm-connect baselines on representative networks.
• Set the local verified-runtime cache to 2 GiB, with an atomic LRU that never evicts referenced, locked, staging, current-manifest, or running content; retain at least current plus previous content per used tuple when they fit. (E-M1-BUDGET-DECISION-001)
• Reject an archive over 100 MiB compressed, 350 MiB expanded, 5,000 entries, 250 MiB for one file, a path over 240 UTF-8 bytes, or aggregate metadata arithmetic outside safe integers. (E-M1-BUDGET-DECISION-001)
• Set stage ceilings: cache lookup 2 s, connect/DNS availability decision 15 s, download 5 min, extraction 2 min, transfer 20 min, remote full-tree verification 3 min, native/smoke probes 2 min, launch/handshake 30 s, cancellation-and-join 10 s, and total cold bootstrap 30 min. (E-M1-BUDGET-DECISION-001)
• Limit incremental transfer/extraction memory to 80 MiB on the desktop and 32 MiB on the remote, excluding the launched relay's measured steady-state runtime; no single buffer exceeds 1 MiB. (E-M1-BUDGET-DECISION-001; desktop extraction ceiling corrected by E-M5-ARTIFACT-EXTRACTION-BUDGET-CORRECTION-001.)
• Limit SFTP to four in-flight files and four bootstrap channels by default, reduce to one after the existing MaxSessions=1 capability result, and never exceed eight open file handles in either process. (E-M1-BUDGET-DECISION-001)
• Require warm-connect p95 to be no more than 100 ms or 10% slower than paired legacy, whichever allowance is larger. Cold p95 must not exceed the smaller of the 30-minute hard cap or 115% of the measured bytes/throughput lower bound plus five minutes at 1/10/100 Mbps and 50/100/200 ms RTT. Offline/connectivity classification completes within 20 s, and legacy starts within 10 s after any eligible failure is classified and bundled work is joined. (E-M1-BUDGET-DECISION-001)
• Keep automatic legacy fallback through at least two stable releases and 30 days after any separately authorized default-on change. Narrowing fallback or removing legacy requires a separate review plus complete matrix, soak, support, and rollback evidence. (E-M1-BUDGET-DECISION-001)
• Use existing per-SSH-target configuration for rollout control; do not add a rollout backend. This closes the control-mechanism decision, not its implementation. (E-M1-ROLLOUT-DECISION-001)
• Define offline/missing-asset behavior: use a verified client cache without GitHub or remote egress; otherwise classified offline/404/cache-unavailable errors may use proven legacy in Beta auto. If legacy prerequisites also fail, return both stage codes and actionable retry, update, or disable-Beta guidance without hiding the original error. Integrity failures never fallback. (E-M1-BUDGET-DECISION-001)

Per-target Beta rollout decision

Decision owner: Codex implementation owner for #8450. Decision authority: worktree owner direction on 2026-07-14. The purpose is to gather real-host evidence without changing behavior for existing SSH users or making all of a user's hosts depend on one experimental path.

• Keep legacy as the persisted and effective default for every existing and newly added SSH target. An absent or unknown configuration value must deserialize conservatively to legacy. (E-M1-ROLLOUT-DECISION-001)
• Expose the bundled-preferred path as an off-by-default option on SSH target add and edit surfaces, using the same Beta-tag treatment as existing Beta features and storing the choice per target rather than as a global experiment. (E-M1-ROLLOUT-DECISION-001)
• Represent the persisted choice as an extensible mode such as legacy | bundled-auto, not a boolean. Keep forced bundled as a separate engineering/support diagnostic and do not expose it as the normal Beta choice. Exact schema naming remains an implementation detail. (E-M1-ROLLOUT-DECISION-001)
• Apply a setting change only to the next connection or explicit reconnect. Never hot-swap the relay underneath a live PTY, watcher, RPC, reconnect, or reattach generation. (E-M1-ROLLOUT-DECISION-001)
• In Beta mode, allow only classified availability/compatibility failures to enter proven legacy automatically. Integrity/security failures remain fail-closed; recovery is an explicit local action that disables Beta for that target and reconnects through legacy. (E-M1-ROLLOUT-DECISION-001)
• Require a separate reviewed rollout decision and completed evidence gates before changing the default for any tuple. Shipping the Beta setting does not authorize default-on or legacy removal. (E-M1-ROLLOUT-DECISION-001)

Decision evidence required: reviewed decision record with owners, dates, rationale, and affected matrix cells.

Milestone 2 — Define the Artifact, Manifest, and Identity Contract

Suggested modules are provisional; update this file before choosing different names.

Work Package 1 complete — 2026-07-14, Codex implementation owner: implemented the pure manifest schema, canonical unsigned bytes/signature verification, content identity, and fail-conservative platform/libc selector with hostile-input tests only. No deploy/resolver call site or bundled tuple is enabled in this package. Local and exact-head draft PR evidence is recorded under E-M2-RED-001, E-M2-CONTRACT-001, and E-M2-CI-001.

Manifest schema

• Add a versioned relay artifact schema in src/main/ssh/ssh-relay-artifact-schema.ts. (E-M2-CONTRACT-001)
• Include schema version, exact Orca build tag, relay protocol version, runtime content ID, OS, architecture, libc family/version requirements, minimum OS/kernel requirements, Node version, dependency versions, archive name, archive size, expanded size, file count, and archive SHA-256. (E-M2-CONTRACT-001)
• Include every runtime file’s relative path, type, size, SHA-256, and required executable mode. (E-M2-CONTRACT-001)
• Include signing key ID, signature algorithm/version, creation timestamp, and provenance/SBOM references without making wall-clock time part of runtime identity. (E-M2-CONTRACT-001)
• Include target-native code-signing verification attestation, policy/tool identity, and the exact attested byte hashes inside the signed manifest. (E-M2-CONTRACT-001)
• Reject duplicate tuple entries, duplicate/case-colliding paths, unsafe Windows names, unsupported schema versions, missing required files, extra native platform packages, and inconsistent aggregate sizes. (E-M2-CONTRACT-001)
• Define exact archive naming for stable, RC, and perf builds. (E-M2-CONTRACT-001)
• Define exact direct release URL construction. Runtime code must not call the GitHub API or use a mutable latest URL. (E-M2-CONTRACT-001)

Content identity

• Compute the content identity from canonical full-runtime metadata and file digests, including Node, relay entries, native modules, helper executables, and runtime JavaScript. (E-M2-CONTRACT-001)
• Prove changing only Node changes the identity. (E-M2-CONTRACT-001)
• Prove changing only node-pty changes the identity. (E-M2-CONTRACT-001)
• Prove changing only @parcel/watcher changes the identity. (E-M2-CONTRACT-001)
• Prove changing only relay-watcher.js changes the identity. (E-M2-CONTRACT-001)
• Prove mode changes for executable files change the identity or are otherwise authenticated. (E-M2-CONTRACT-001)
• Prove metadata that should not affect execution does not create nondeterministic identities. (E-M2-CONTRACT-001)
• Update remote directory parsing and GC rules for the new mode-qualified identity without breaking legacy directory recognition.

Archive safety

• Permit only regular files and explicitly declared directories; reject devices, FIFOs, sockets, hard links, and symlinks unless a separately reviewed safe policy is adopted.
• Reject absolute paths, .., drive/UNC paths, path separators inappropriate for the local extraction platform, Windows alternate data streams, device names, trailing spaces/dots, and case-fold collisions.
• Enforce compressed size, expanded size, file count, nesting depth, and per-file limits before and during extraction.
• Verify the extracted tree exactly matches the manifest with no missing or extra files.
• Add deterministic schema, identity, canonicalization, URL, and hostile-archive tests.

Completion evidence required: schema and test files, red/green evidence, canonical test vectors, and reviewed compatibility contract.

Milestone 3 — Build Minimal Self-Contained Runtime Archives

In progress — 2026-07-14, Codex implementation owner: isolate target-native runtime assembly, archive inspection, bundled-Node/native-module/PTY/watcher smoke, SBOM, and provenance capabilities behind purpose-named scripts and CI artifacts. No release publication, desktop resolver, SSH transfer, install, fallback, rollout setting, or tuple enablement belongs in this package.

Current active gate — 2026-07-14, Codex implementation owner: exact-head run 29379227209 and direct inspection of all six downloaded payloads close the native Linux producer plus glibc 2.28/libstdc++ 6.0.25 userland gates under E-M3-LINUX-NATIVE-USERLAND-CI-001 and the Windows x64 Server 2022 build-20348 gate under E-M3-WINDOWS-X64-BASELINE-CI-001. Exact Linux kernel 4.18, macOS 13.5, Windows arm64 build 26100, and target-native signing/trust remain open. A newer hosted runner, static symbol scan, or container may add evidence but cannot silently stand in for an unavailable qualifying snapshot. Every tuple remains disabled and no production consumer is connected.

Active native-trust contract slice — 2026-07-14, Codex implementation owner: before any credentialed Apple or SignPath job, derive one exact signing plan from the builder-enforced runtime identity. The plan must keep the official Node executable immutable, enumerate every native file that requires platform verification, select no Linux signing targets, select every non-Node macOS native file for Developer ID signing, and select every non-Node Windows PE file as a SignPath candidate whose already-valid upstream signature may be preserved. Unknown roles/extensions, duplicates, missing expected files, or identity/closure drift fail before credentials or signing side effects. This package is contract/test-only and cannot sign, publish, aggregate, or enable a tuple. The local contract and all-six actual-identity proof pass under E-M3-NATIVE-SIGNING-PLAN-LOCAL-001. E-M3-NATIVE-SIGNING-PLAN-CI-RED-001 proves the first exact-head workflow omitted the new suite despite otherwise healthy builds; explicitly wiring it into both native job families is implemented at 9c0357235 and locally green under E-M3-NATIVE-SIGNING-PLAN-WORKFLOW-LOCAL-001. Replacement exact-head proof passes under E-M3-NATIVE-SIGNING-PLAN-CI-001; the next safe package is credential-free exact signing-stage and returned-byte verification, without credentials or publication.

Active signing-stage contract slice — 2026-07-14, Codex implementation owner: consume the proven plan to normalize one exact candidate selection before filesystem or signing side effects. macOS must select every Developer ID target. Windows may preserve an exact source file only when a native assessment classifies its existing Authenticode signature as valid upstream; it may stage only a truly unsigned candidate, while invalid, unknown, malformed, missing, duplicate, or extra assessment states fail closed. Verify every native source file against its identity size/hash before creating an exclusive payload tree, never stage official Node, preserve portable relative paths, and clean up a partial stage on failure. A returned tree must contain exactly the staged regular files, no links or special entries, remain within explicit size/growth bounds, and change every staged source hash. This slice does not invoke Apple/SignPath, mutate a runtime, accept native trust, publish, aggregate, or enable a tuple. Implementation commit c847c4a11 and local proof E-M3-NATIVE-SIGNING-STAGE-LOCAL-001 close the credential-free contract and workflow-source gates; exact-head run 29382772805 closes execution on all six native runner families under E-M3-NATIVE-SIGNING-STAGE-CI-001.

Active target-native assessment slice — 2026-07-14, Codex implementation owner: authenticate every real first-build candidate before and after bounded platform inspection. Linux must create no payload; macOS must stage exactly three non-Node candidates; Windows must invoke one noninteractive, 30-second/64-KiB-bounded PowerShell Authenticode probe per exact PE path, accept only NotSigned or Valid, preserve exact OpenConsole.exe and conpty.dll bytes only when valid, and stage exactly the three unsigned Orca-built .node files. Candidate paths stay out of PowerShell source, any hash/status/certificate drift fails closed, stage JSON is retained only as unpublished evidence, and the temporary payload is removed. Local implementation passes at 1a79e4921 under E-M3-NATIVE-ASSESSMENT-LOCAL-001; exact-head run 29384042509 closes all six real candidate cells under E-M3-NATIVE-ASSESSMENT-CI-001.

Baseline correction — 2026-07-14, Codex implementation owner: E-M3-LINUX-BASELINE-LOCAL-RED-001 proves the existing Linux x64 candidate cannot load its patched node-pty on Rocky 8.9/glibc 2.28 because the Ubuntu 24.04 producer emitted references to GLIBC_2.32 and GLIBC_2.34. This exposes a producer flaw, not permission to weaken the declared floor. The Linux jobs must compile and smoke native modules inside the digest-pinned oldest glibc/libstdc++ userland on native x64/arm64 runners, repeat exact clean-build equality and metadata gates for the new bytes, and retain the exact kernel 4.18 cell as an explicit residual gap. A newer host build followed by container execution is not qualifying evidence.

Active sub-gate — 2026-07-14, Codex implementation owner: exact-head run 29345126283 proves all six target-native artifact/executable jobs, including normal Windows x64/arm64 settlement and unpublished upload. E-M3-REPRODUCIBILITY-LOCAL-001 proves the bounded comparator requires two independently verified clean outputs and exact type/mode/size/SHA-256 equality for the runtime tree, archive, identity, SPDX, and provenance before uploading only the first output. Exact-head run 29347236627 first exposed native reproducibility and Windows parser failures. Diagnostic run 29348424235 then passed the parser/contracts on all six runners, kept both Linux tuples equal, and isolated the first native differences to macOS pty.node and Windows conpty_console_list.node under E-M3-REPRODUCIBILITY-DIAGNOSTIC-CI-RED-001. Artifact consumers, publication, the repository-wide node-pty patch, and the legacy/default path remain unchanged.

Active correction — 2026-07-14, Codex implementation owner: exact-head run 29351557922 proves the parser and /Brepro correction on both Windows architectures, with complete equality on x64. Windows arm64 builds, verifies, and smokes both complete outputs but first differs at copied-artifact conpty_console_list.node, so the comparator rejects the cell and uploads neither output under E-M3-REPRODUCIBILITY-WINDOWS-ARM64-CI-RED-001. The active bounded package adds a test-covered PE mismatch diagnostic before cleanup: hashes, sizes, coalesced differing byte ranges, and relevant PE headers only, with bounded reads/output and no failed-binary upload. Exact-head repeat run 29352510414 reproduces the same arm64-only drift while all five controls compare and upload under E-M3-REPRODUCIBILITY-WINDOWS-ARM64-REPEAT-CI-RED-001. No comparator weakening, post-build normalization, producer correction, repository-wide node-pty change, tuple enablement, or production consumer is authorized without the diagnostic evidence. Exact implementation commit 39ee3451b is locally green under E-M3-WINDOWS-PE-DIAGNOSTIC-LOCAL-001. Exact-head run 29353432240 proves the x64 control and real arm64 parser, but its 128 detailed ranges are exhausted by .text; the active diagnostic-only correction adds bounded full-scan section totals/samples before any producer change. Exact implementation commit cd7f94136 is locally green under E-M3-WINDOWS-PE-FULL-SCAN-LOCAL-001. Exact-head run 29354676731 then classifies the complete arm64 drift under E-M3-WINDOWS-PE-FULL-SCAN-CI-RED-001: 2,879 one-byte .text differences at 16-byte intervals plus 68 /Brepro-derived metadata bytes, with five controls reproducible and uploaded and no rejected arm64 upload. Exact implementation commit 6546f54d5 applies the native toolchain's reproducible compiler and linker settings only to the copied node-pty binding.gyp and is locally green under E-M3-WINDOWS-COMPILER-DETERMINISM-LOCAL-001. Exact-head run 29355973362 then kept five controls reproducible but reproduced the identical Windows arm64 PE drift under E-M3-WINDOWS-COMPILER-DETERMINISM-CI-RED-001. Exact implementation commit 0d3a0c9d3 now fail-closed verifies how those settings reach the generated conpty_console_list.vcxproj and adds bounded paired ARM64 disassembly after a mismatch under E-M3-WINDOWS-MSBUILD-DISASSEMBLY-LOCAL-001; no second producer correction is justified before the target-native evidence. Exact-head run 29357355064 proves both generated option blocks twice on Windows x64 but fails closed on native Windows arm64 before staging because the Release group lookup does not accept the runner's lowercase arm64 platform spelling (E-M3-WINDOWS-MSBUILD-PLATFORM-CASE-CI-RED-001).

Exact-head run 29358223742 then proves that correction on native Windows arm64 and retains all five reproducible controls. Both arm64 clean builds log the required compiler/linker options, assemble, verify, and execute, but strict comparison still rejects conpty_console_list.node and uploads no arm64 artifact. The complete PE scan reports 5,826 differing bytes: 5,758 bytes across 2,879 two-byte .text ranges exactly 16 bytes apart plus 68 derived COFF/debug/CodeView bytes. Paired disassembly proves each 16-byte function thunk has byte-identical adrp x16, add x16, and br x16 instructions; only the unreachable fourth instruction changes from udf #0x24d to udf #0x16d (E-M3-WINDOWS-ARM64-THUNK-DISASSEMBLY-CI-RED-001).

Exact-head run 29359948742 proves MSBuild.exe -getProperty:LinkIncremental returns an empty value after each native Windows build. The strict parser rejects that value before staging on x64 and arm64; all four POSIX controls compare exactly and upload, and neither Windows job uploads. This is valid negative evidence under E-M3-WINDOWS-LINK-INCREMENTAL-CI-RED-001, but an unset evaluated property does not classify the actual linker command or authorize a producer change.

In progress — 2026-07-14, Codex implementation owner: the disproved property oracle is replaced locally by a bounded, post-build parser for the target's actual MSBuild linker-command tracking record under E-M3-WINDOWS-LINK-COMMAND-TRACKING-LOCAL-001. The file read is capped at 256 KiB plus one rejection byte; logs contain only an allowlisted summary of /INCREMENTAL, /GUARD, /DEBUG, /OPT, /Brepro, and /experimental:deterministic switches; missing, duplicate, oversized, malformed, or ambiguous inputs fail before staging. The active gate is the exact-head six-cell native run. Retain the existing architecture, generated-option, strict comparison, and no-upload gates. Do not normalize bytes, change the producer, modify repository-wide node-pty, or connect a production consumer.

Exact-head run 29361673339 proves the assumed fixed tracking path is absent on both native Windows architectures after the target compiles successfully. The active correction must discover link.command.1.tlog candidates under a bounded build-tree entry/depth/cardinality budget, select exactly one whose bounded decoded record names conpty_console_list.node, and retain the existing strict parser and no-upload boundary. It must not log command contents or authorize a producer change (E-M3-WINDOWS-LINK-COMMAND-PATH-CI-RED-001).

The bounded discovery correction is locally green under E-M3-WINDOWS-LINK-COMMAND-DISCOVERY-LOCAL-001: it scans at most 10,000 entries and eight levels, rejects symbolic links and more than 32 tracking candidates, reads each candidate under the existing 256 KiB cap, and requires exactly one exact target-output match before strict parsing. The active gate is now a new exact-head native run; no producer change is authorized locally.

Exact-head run 29362672415 proves both native Windows builds reach the discovery gate after target compilation but reject because scanning from the entire generated build tree encounters unrelated dependency directories beyond depth eight. All four POSIX controls compare and upload. The active correction may narrow only the traversal root to build/Release, the output tree where both logs show MSBuild emitted conpty_console_list.node; every existing depth, entry, candidate, byte, encoding, target-cardinality, parser, comparator, and no-upload bound remains unchanged (E-M3-WINDOWS-LINK-COMMAND-DISCOVERY-CI-RED-001).

The correction now scopes the same bounded discovery to build/Release only and is locally green under E-M3-WINDOWS-LINK-COMMAND-RELEASE-ROOT-LOCAL-001. No budget, parser, producer, comparison, staging, upload, legacy, or production behavior changed. The active gate is another exact-head six-cell native run.

Exact-head run 29363423068 proves the scoped discovery on both native Windows runners. Both clean builds on both architectures select three tracking candidates under 82 Release-tree entries and report the same allowlisted command summary: /brepro, /debug, /experimental:deterministic, and /guard:cf, with no explicit /incremental switch. Windows x64 and all four POSIX controls compare and upload; Windows arm64 still fails strict comparison at the same 2,879 linker thunks and uploads nothing (E-M3-WINDOWS-LINK-COMMAND-RELEASE-ROOT-CI-RED-001). Because /DEBUG may imply incremental linking without an explicit command switch, the next bounded diagnostic records only the exact target .ilk file's presence and size from the already bounded clean Release tree before any copied-artifact producer change.

Exact-head run 29364581781 proves both Windows architectures create a stable target .ilk in each clean build: 4,238,838 bytes on x64 and 4,980,517 bytes on arm64. Microsoft documents that /DEBUG implies /INCREMENTAL, incremental linking creates the .ilk, and /INCREMENTAL:NO is the explicit override. Five controls compare and upload; arm64 retains the exact thunk drift and fails before upload (E-M3-WINDOWS-INCREMENTAL-DATABASE-CI-RED-001). This authorizes one narrow producer correction: add /INCREMENTAL:NO only to the copied node-pty Windows linker options, retain /guard:cf, and fail closed unless the generated project and actual command each contain exactly one disable switch and the clean output tree contains no target .ilk.

Exact-head run 29365815434 passes all six target-native jobs. Both Windows architectures propagate exactly one disable switch in both clean builds, retain /guard:cf, report no target .ilk, execute the full bundled runtime smoke, compare every runtime/archive/identity/SBOM/provenance byte exactly, and upload. Windows arm64 now has one stable content ID and archive digest, closing the native clean-build reproducibility gap without post-build normalization (E-M3-REPRODUCIBILITY-CI-001).

Exact implementation commit ec5461aff replaces workflow-only prohibited-file checks as the authoritative boundary with an exact builder-enforced per-tuple closure. It pins 34 Linux, 35 macOS, and 42 Windows files; exact package metadata and dependency versions; exactly one tuple-native watcher; file roles/modes; runtime metadata; and ordered, non-empty license sections. The local hostile suite and all six downloaded prior candidate archives pass under E-M3-RUNTIME-CLOSURE-LOCAL-001. Target-native execution of the new gate remains required before the related implementation claims are checked.

Each runtime must contain only the executable closure required by the relay.

• Replace or extend config/scripts/build-relay.mjs without weakening its existing relay and watcher content-hash guarantees. (E-M3-RUNTIME-CLOSURE-CI-001)
• Add a clearly named runtime assembly script, for example config/scripts/build-ssh-relay-runtime.mjs. (E-M3-RUNTIME-LOCAL-001)
• Pin Node and verify downloaded source/binary checksums and upstream signatures. (E-M3-NODE-PROVENANCE-001; real archive execution remains a separate per-tuple gate)
• Extend the immutable Node input contract for Windows to include the signed exact-version headers archive and tuple-specific node.lib; verify/copy them into an exclusive local build root and configure node-gyp to fail rather than fetch an unstaged input. (E-M3-WINDOWS-INPUT-001; successful target-native offline build remains a per-tuple gate)
• Build Orca’s patched node-pty@1.1.0 against the exact bundled Node runtime. (E-M3-RUNTIME-CLOSURE-CI-001)
• Assert Orca-required patched exports/diagnostics exist; do not silently use an upstream prebuild that omits the patch. (E-M3-RUNTIME-CLOSURE-CI-001)
• For Windows, copy the tuple-architecture conpty.dll and OpenConsole.exe from the pinned node-pty source into build/Release/conpty, hash them into the runtime identity as native runtime files, and prove PTY spawn/resize/exit with useConptyDll: true. Do not substitute a system-ConPTY smoke for the production path. (E-M3-WINDOWS-CONPTY-GAP-001, E-M3-WINDOWS-CI-001)
• Include exactly one compatible @parcel/watcher@2.5.6 native optional package. (E-M3-RUNTIME-CLOSURE-CI-001)
• Include relay JavaScript, watcher child, required runtime JavaScript closure, licenses, SBOM, provenance, and runtime metadata. (E-M3-RUNTIME-CLOSURE-CI-001, E-M3-METADATA-CI-001)
• Exclude package managers, development dependencies, compilers, sources, caches, build directories, and Orca-built debug symbols unless an approved diagnostics requirement needs them. Preserve verified official Node executable bytes without stripping or rewriting them, even when the upstream binary contains debug metadata. (E-M3-RUNTIME-CLOSURE-CI-001)
• In progress — 2026-07-15, Codex implementation owner: make POSIX .tar.br and Windows ZIP output deterministic for the same tree, epoch, and pinned compression contract. POSIX uses Node's built-in Brotli quality 9, lgwin=20, and 64 KiB chunks so every client architecture can extract within budget without a native/system decompressor. Historical .tar.xz evidence remains valid only for its exact unpublished bytes and must be replaced for the new POSIX archive family. (Decision evidence: E-M5-ARCHIVE-PORTABILITY-AUDIT-001.)
• Verify required executable modes before archiving. (E-M3-RUNTIME-LOCAL-001)
• Sign native code according to the platform decisions in Milestone 1.
• Verify platform-native signatures/policy on target-native runners after signing and before aggregation; attest the exact verified bytes for the signed manifest.
• Run target-native archive inspection and target-runtime smoke before upload for every current glibc/macOS/Windows candidate. (E-M3-RUNTIME-LOCAL-001, E-M3-CI-001, E-M3-WINDOWS-CI-001)

Per-tuple build and executable proof

Runtime tuple	Build/provenance	Bundled Node	node-pty load + real PTY	Watcher events	Oldest baseline	Native trust	Evidence
linux-x64-glibc	[x]	[x]	[x]	[x]	[ ]	[ ]	E-M3-LINUX-NATIVE-USERLAND-CI-001; kernel 4.18 open
linux-arm64-glibc	[x]	[x]	[x]	[x]	[ ]	[ ]	E-M3-LINUX-NATIVE-USERLAND-CI-001; kernel 4.18 open
linux-x64-musl	[ ]	[ ]	[ ]	[ ]	[ ]	[ ]	—
linux-arm64-musl	[ ]	[ ]	[ ]	[ ]	[ ]	[ ]	—
darwin-x64	[x]	[x]	[x]	[x]	[ ]	[ ]	E-M3-CI-001
darwin-arm64	[x]	[x]	[x]	[x]	[ ]	[ ]	E-M3-CI-001
win32-x64	[x]	[x]	[x]	[x]	[x]	[ ]	E-M3-WINDOWS-X64-BASELINE-CI-001
win32-arm64	[x]	[x]	[x]	[x]	[ ]	[ ]	E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001

Rules:

• Real hardware or native virtualized execution is required for release promotion. QEMU or cross-compilation may add coverage but cannot fill the evidence column alone.
• A tuple without a trustworthy runtime source or real runner stays disabled.
• Every current candidate archive executes the exact bundled Node, loads both native dependencies, spawns a real PTY, performs input/resize/exit, and observes create/modify/rename/delete watcher events. (E-M3-REPRODUCIBILITY-CI-001)
• Every build records compiler/toolchain/container image digests and runner architecture. Current jobs use no build container; each hosted runner records its requested label, resolved image/version, native architecture, exact tool versions, and executable/code SHA-256 values. (E-M3-METADATA-CI-001)

Milestone 4 — Make Relay Artifacts Prerequisites of Desktop Builds

• Add a reusable target-native runtime build prerequisite contract for every candidate tuple; do not treat a cross-build alone as native execution evidence. Keep release-cut and desktop builds disconnected until the remaining exact-floor, signing/trust, aggregate, publication/read-back, and embedding gates pass. (E-M4-BUILD-PREREQUISITE-LOCAL-RED-001, E-M4-BUILD-PREREQUISITE-LOCAL-001, E-M4-BUILD-PREREQUISITE-CI-001)
• In progress — 2026-07-15, Codex implementation owner: add platform-native signing jobs. Signed macOS and Windows runtime bytes must return as immutable outputs before final hashes are computed. Start with a disconnected purpose-named RED; real Apple/SignPath and native trust remain required before this box can close.
• Add one fail-closed aggregate job that waits for all required native build/signing outputs, validates them, computes final hashes, builds the canonical manifest, and signs it.
• Make Linux, Windows, and macOS desktop build jobs depend on the successful aggregate output.
• Download the immutable manifest artifact into every desktop build workspace.
• Embed the exact signed manifest and accepted public keys in the packaged desktop.
• Prove all desktop variants embed byte-identical manifest contents.
• Ensure development builds can use a deterministic local unsigned/development manifest without weakening official-build verification.
• Upload the exact prebuilt runtime bytes—not rebuilt equivalents—to the same draft GitHub Release as the app.
• Aggregate platform job outputs without clobbering or duplicating asset names.
• Extend config/scripts/verify-release-required-assets.mjs or add a narrowly named relay gate that verifies every enabled asset, manifest, signature, size, and upload state.
• Download every draft asset back through the authenticated release API, verify byte identity, and execute the archive before allowing publication.
• Confirm stable, RC, and perf tag identities remain exact and cannot cross channels.
• Confirm a partial or failed relay build leaves the release draft and blocks publication.
• Confirm artifact upload retries do not change signed bytes or silently replace the manifest.
• Define bounded retry/timeout behavior for every native build, signing, aggregate, upload, and read-back job; exhaustion must block downstream jobs.
• Make manual signing approval absence, denial, or timeout fail closed rather than allowing an unsigned or stale asset through the aggregate.
• Rehearse signing-service failure and recovery of the same draft without changing already signed bytes or accidentally publishing it.

Completion evidence required: release workflow tests, a draft rehearsal, read-back hashes, embedded manifest extraction from every packaged app, and blocked-publication failure rehearsal.

Milestone 5 — Implement Desktop Artifact Selection, Download, and Cache

Suggested concrete modules:

• src/main/ssh/ssh-relay-artifact-selector.ts
• src/main/ssh/ssh-relay-libc-detection.ts
• src/main/ssh/ssh-relay-artifact-download.ts
• src/main/ssh/ssh-relay-artifact-cache.ts
• src/main/ssh/ssh-relay-artifact-extraction.ts

Platform and libc selection

• Reuse current OS/architecture detection without changing supported relay-platform parsing.
• Add marked, noise-resistant, no-Node libc probes. (E-M5-LIBC-DETECTION-LOCAL-001)
• Prefer getconf GNU_LIBC_VERSION when present; parse only output following Orca’s marker. (E-M5-LIBC-DETECTION-LOCAL-001)
• Detect musl through marked ldd --version output and known loader paths without treating arbitrary startup text as evidence. (E-M5-LIBC-DETECTION-LOCAL-001)
• Validate required libc/libstdc++/kernel/OS versions against manifest constraints. E-M5-OFFLINE-SELECTION-LOCAL-001 validates Linux kernel/glibc/libstdc++/GLIBCXX, macOS, and Windows build/OpenSSH/PowerShell/.NET exact minima from a signature-verified manifest.
• Treat absent, ambiguous, conflicting, or unparseable results as unknown and choose proven legacy behavior in auto mode. E-M5-OFFLINE-SELECTION-LOCAL-001 pins classified unavailable results without connecting a consumer or changing the legacy default.
• Cover GNU coreutils, BusyBox, Alpine, containers, old glibc, Rosetta, Windows, macOS, startup noise, missing commands, localization, cancellation, and MaxSessions=1.

Manifest verification and exact URL resolution

• Load the embedded manifest for official builds and verify its signature before trusting fields.
• Verify the manifest-authenticated target-native attestation and exact byte hashes portably; do not assume a macOS client can run Authenticode tooling or a Windows client can run codesign.
• Resolve the expected tuple and content ID while fully offline. E-M5-OFFLINE-SELECTION-LOCAL-001 accepts only the branded immutable result of accepted-key signature verification and returns its exact tuple/content/archive identity.
• Construct the exact /releases/download/<tag>/<asset> URL without an API lookup. E-M5-OFFLINE-SELECTION-LOCAL-001 derives the tag-qualified direct URL from authenticated fields and proves that no latest lookup is present.
• Reject redirects that violate the approved GitHub release-asset origin policy. E-M5-ARTIFACT-DOWNLOAD-LOCAL-001 and E-M5-ARTIFACT-DOWNLOAD-CI-001 prove one exact approved asset host and fail-closed protocol/origin/credential/port/chain cases.
• Ensure authorization, cookies, proxy credentials, and custom headers do not leak across redirect origins. E-M5-ARTIFACT-DOWNLOAD-LOCAL-001 and E-M5-ARTIFACT-DOWNLOAD-CI-001 prove fresh fixed credential-free options on both requests.
• Use Electron networking that respects supported system proxy and certificate behavior.

Download and local cache

• Store archives and extracted trees under an app-owned cache, keyed by signed content identity. E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-001 and E-M5-ARTIFACT-CACHE-ENTRY-CI-001.
• Stream downloads into exclusive temporary files; never buffer a full runtime in memory. E-M5-ARTIFACT-DOWNLOAD-LOCAL-001 and E-M5-ARTIFACT-DOWNLOAD-CI-001.
• Apply download size and time budgets while streaming. E-M5-ARTIFACT-DOWNLOAD-LOCAL-001 and E-M5-ARTIFACT-DOWNLOAD-CI-001.
• Verify archive SHA-256 before extraction. E-M5-ARTIFACT-DOWNLOAD-LOCAL-001 and E-M5-ARTIFACT-DOWNLOAD-CI-001.
• Extract into an exclusive temporary directory with all archive-safety checks from Milestone 2. E-M5-ARTIFACT-EXTRACTION-LOCAL-001 and E-M5-ARTIFACT-EXTRACTION-CI-001 prove strict TAR/Brotli and ZIP inspection, exclusive owned staging, cancellation/failure cleanup, and exact full-size execution on all six native Node 24 clients.
• Verify the exact expanded tree before atomically publishing the cache entry. E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-001 and E-M5-ARTIFACT-CACHE-ENTRY-CI-001 prove complete staged archive/tree revalidation before same-filesystem atomic publication on all six native clients.
• Coordinate cache ownership across multiple Orca processes and windows. E-M5-ARTIFACT-CACHE-LOCK-LOCAL-001 and E-M5-ARTIFACT-CACHE-LOCK-CI-001 prove real second-process contention and ownership transfer on all six native client tuples. Cache-entry integration remains separately gated.
• Recover stale download/extraction locks without deleting an active writer. E-M5-ARTIFACT-CACHE-LOCK-LOCAL-001 and E-M5-ARTIFACT-CACHE-LOCK-CI-001 prove conservative same-host liveness, stale-dead-owner tombstoning, live/ambiguous-owner preservation, and displaced-owner successor safety. No downloader/extractor consumer is connected yet.
• Never select partial files, partial directories, or entries with a failed verification record. E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-001 and E-M5-ARTIFACT-CACHE-ENTRY-CI-001.
• Re-verify cached metadata and expected identity before use; define when full file rehashing is required. E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-001 and E-M5-ARTIFACT-CACHE-ENTRY-CI-001 require a strict proof/archive/full-tree rehash on every disconnected lookup; warm-launch proof trust is a later remote-install contract and is not inferred here.
• Implement bounded eviction that never removes an in-use entry. E-M5-ARTIFACT-CACHE-EVICTION-LOCAL-001 and E-M5-ARTIFACT-CACHE-EVICTION-CI-001 prove cross-process references, conservative ambiguous-owner retention, persistent recency, exact logical-byte accounting, deterministic LRU, and full-size active retention/release/eviction on all six native client tuples.
• Handle read-only cache, permission failures, disk full, quota, inode exhaustion, cancellation, crash, corruption, and concurrent download deterministically.
• Preserve ORCA_RELAY_PATH for explicit development/test use with an official-build safety boundary.
• Prefetch only last-known target tuples under an explicit size/network policy; prefetch must not block app startup or a normal connection.

Required offline/cache cases

Remote runtime	Local verified cache	Client internet	Expected bundled behavior	Legacy/error behavior	Evidence
Present, matching	Any	Offline	Launch remote cache without GitHub	None	—
Missing	Present	Offline	Transfer local cache over SSH	None	—
Missing	Missing	Online	Download locally, verify, transfer	Fallback only on eligible failure	—
Missing	Missing	Offline	Bundled unavailable	Proven legacy or precise error	—
Partial/corrupt	Present	Offline	Quarantine remote entry; replace from verified local cache	Fail closed if verified reinstall fails; no automatic legacy	—
Missing	Corrupt	Online	Quarantine local entry; redownload and fully verify	Fail closed if recovery fails; no automatic legacy	—
Missing	Corrupt	Offline	Quarantine and reject corrupt cache	Fail closed; no automatic legacy	—
Corrupt	Missing	Any	Quarantine remote entry; recover only from newly verified bundled bytes	Fail closed if recovery is unavailable/fails	—

Milestone 6 — Add Bounded Runtime Transfer for Every SSH Transport

Current behavior must not be assumed adequate for a much larger runtime:

• POSIX system SSH currently streams a tar archive and requires remote tar.
• Windows system SSH currently collects the tree and sends one JSON/base64 package.
• SFTP currently walks files serially and does not preserve executable modes.

Shared transfer contract

• Define one transport-neutral source-tree contract based on the verified manifest. Completed by E-M6-SOURCE-TREE-CONTRACT-AUDIT-001, E-M6-SOURCE-TREE-CONTRACT-LOCAL-RED-001, E-M6-SOURCE-TREE-CONTRACT-LOCAL-001, and E-M6-SOURCE-TREE-CONTRACT-CI-001.
• Pre-scan and reject local source mutation, symlinks, special files, extra files, and path collisions before creating remote files. Completed by E-M6-SOURCE-PRESCAN-AUDIT-001, E-M6-SOURCE-PRESCAN-LOCAL-RED-001, E-M6-SOURCE-PRESCAN-LOCAL-001, E-M6-SOURCE-PRESCAN-CI-RED-001, E-M6-SOURCE-PRESCAN-COLLISION-FIX-LOCAL-001, and E-M6-SOURCE-PRESCAN-CI-001.
• Stream files with bounded buffers; prohibit whole-tree memory materialization. Completed by E-M6-SOURCE-STREAM-AUDIT-001, E-M6-SOURCE-STREAM-LOCAL-RED-001, E-M6-SOURCE-STREAM-LOCAL-001, E-M6-SOURCE-STREAM-CI-RED-001, E-M6-SOURCE-STREAM-WINDOWS-ORACLE-CORRECTION-LOCAL-001, and E-M6-SOURCE-STREAM-CI-001.
• Pass one AbortSignal through enumeration, channel creation, reads, writes, permission repair, and remote cleanup.
• Close and await every local stream, SSH channel, child process, SFTP session, and cleanup task on success, failure, cancellation, and timeout.
• Track transferred bytes/file counts for progress and bounded diagnostics without logging paths.
• Restore every executable mode declared by the manifest, including bundled Node and spawn-helper, before validation.
• Require exclusive per-file staging so no concurrent writer or launcher can observe a partial file as complete.

POSIX system SSH

• Capability-probe remote tar with a narrow cache scoped to the SSH host/connection.
• Keep streaming tar as an optional fast path when proven available and compatible.
• Add a no-tar bounded file-stream path: frame each manifest file locally, open an authenticated SSH exec channel, and stream raw bytes through stdin into its exclusive staged path using only the declared POSIX shell/file primitives.
• Prove the no-tar path does not invoke remote Node, Python, Perl, archive tools, sha256sum, or shasum.
• Preserve remote path quoting and avoid shell injection for spaces and non-ASCII homes.
• Verify local and remote tar failures, pipeline failures, and cancellation are all observed and joined.
• Fail with a compatibility classification when a required POSIX primitive is missing or has incompatible semantics; do not improvise a text/base64 transfer.

Windows system SSH

• Replace whole-tree JSON/base64 buffering with a framed or per-file bounded binary stream.
• Implement against the declared PowerShell/.NET baseline using binary stdin/file APIs and exclusive staged paths; do not depend on implicit console text encodings.
• Avoid command-line length, PowerShell string, and full-input buffering limits.
• Handle case-insensitive collisions, reserved names, long paths, endpoint-protection locks, and partial writes.
• Prove binary fidelity without relying on text encoding.
• Fail with a compatibility classification when the declared PowerShell/.NET primitives are missing or incompatible.

SFTP

• Add bounded concurrency without exceeding restrictive server session/channel limits.
• Preserve per-file abortability and close handles deterministically.
• Restore modes after upload and verify mode-repair failure is fatal before finalization.
• Compare serial and bounded-concurrency behavior on high-latency SSH.

Transfer validation

• Test zero-byte, large, many-small-file, and maximum-allowed trees.
• Test required-command absence one primitive at a time on POSIX and Windows.
• Test supported and unsupported BusyBox command variants, including byte fidelity and exit-code behavior.
• Test source mutation and local symlink replacement during upload.
• Test network interruption at beginning, middle, final file, permission repair, and sentinel write.
• Test local and remote disk full, quota, inode exhaustion, read-only target, noexec target, Windows antivirus lock, and SSH channel closure.
• Measure peak RSS, bytes buffered, open file handles, channels, duration, and cancellation settlement against Milestone 1 budgets.
• Prove cancelled transfer performs no later writes.

Milestone 7 — Install, Verify, Launch, Reconnect, and Garbage-Collect

Suggested concrete modules:

• src/main/ssh/ssh-relay-runtime-transfer.ts

• src/main/ssh/ssh-relay-runtime-validation.ts

• src/main/ssh/ssh-relay-bootstrap-mode.ts

• Refactor ssh-relay-deploy.ts without adding a max-lines disable; split by domain responsibility where necessary.

• Resolve expected bundled content identity before remote install-state probing.

• Verify embedded manifest signature, tuple, limits, archive SHA-256, and exact extracted tree on the client before transfer begins.

• Use mode-qualified, content-addressed remote directories and locks.

• Upload into a mode-qualified partial/staging directory that no launcher or GC can treat as complete.

• Treat local verification plus authenticated SSH transfer into exclusive staging as the pre-execution integrity boundary; document that a hostile authenticated account is out of scope.

• Do not require a remote hash utility. Run bundled Node from the transferred staging path as the first staged binary execution, verify its exact version, and use it to hash every manifest file.

• Compare the complete staged-tree sizes and SHA-256 values before any sentinel or publish step.

• Load node-pty and @parcel/watcher through bundled Node.

• Repeat target-native execution/policy probes before finalization; any native-trust failure is an integrity/security failure even though transfer may already have occurred.

• Run a minimal real PTY input/resize/exit smoke and watcher event smoke before finalization.

• Write structured .install-complete contents containing schema, mode, content ID, manifest digest, and validation version; do not use an empty sentinel.

• Assert the ordering: full-tree hash comparison, native loads, PTY/watcher smoke, then completion sentinel and atomic publication. No earlier stage may write a success sentinel.

• Atomically publish the completed install or otherwise prove no observer can see it as complete before validation finishes.

• On warm reconnect, require the expected structured sentinel identity plus required-file presence and signed-manifest size metadata before treating the directory as initially validated.

• Do not full-tree rehash every warm launch. Trust the structured initial-install proof under the completed-directory immutability assumption to protect latency; explicitly document that the sentinel is not ongoing proof against post-install filesystem mutation.

• Treat any detected warm-cache absence, size/hash mismatch, unexpected file, or changed sentinel as integrity failure: quarantine it, recover only from freshly verified bundled bytes, and fail closed without automatic legacy if recovery cannot complete.

• Launch relay.js with bundled Node and an environment that cannot accidentally resolve remote user packages ahead of bundled dependencies.

• Preserve protocol-handshake and version-mismatch behavior.

• Preserve MaxSessions=1 sequential fallback for probes.

• Preserve concurrent install locking, stale-lock recovery, cross-version isolation, reconnect, PTY reattach, watcher isolation, and best-effort GC.

• Ensure GC recognizes bundled, legacy, partial, locked, active, and malformed directories and never deletes a live version.

• Ensure a failed bundled install never mutates a completed legacy install or running relay.

• Confirm primary-path command capture contains no npm, curl, wget, registry, compiler, Python, system-Node, sha256sum, or shasum invocation.

Completion evidence required: deterministic install/failure tests, built-runtime harness, live SSH connect/reconnect/upgrade/downgrade, PTY/watcher proof, and command audit.

Milestone 8 — Implement a Safe, Explicit Fallback State Machine

Modes:

• auto: bundled primary; eligible availability/compatibility failures may use proven legacy.
• bundled: bundled only; fail with exact stage and recovery guidance.
• legacy: current embedded relay plus coherent remote Node/npm behavior.

The public per-target Beta choice maps bundled-auto configuration to internal auto behavior. Missing, unknown, or disabled configuration maps to legacy; forced bundled remains an engineering/support control.

• Add the versioned per-target runtime-mode field and prove existing, missing, malformed, imported, and newly created target configurations resolve to legacy unless explicitly opted in.
• Add the Beta-tagged option to SSH target add and edit surfaces using the existing design-system Beta treatment; persist it only for that target.
• Prove the add-target control is visibly off, the edit-target control reflects only that target's persisted mode, and saving or reconnecting one target cannot change another target.
• Prove an off, absent, unknown, malformed, existing, or imported setting routes directly through the current legacy bootstrap without entering bundled manifest, cache, download, transfer, or install work.
• Prove toggling the option does not mutate or restart a live relay and takes effect only on the next connection or explicit reconnect.
• For fail-closed Beta errors, provide an explicit local “disable Beta and reconnect” recovery action that updates the target before starting legacy; never disguise it as automatic fallback.
• Record privacy-safe tuple, transport, stage, duration, outcome, and fallback reason under existing telemetry consent without hostname, username, path, command, or target identity.

State and cancellation

• Model explicit states for manifest resolution, local-cache lookup, download, extraction, transfer, remote verification, launch, bundled cleanup, legacy bootstrap, and connected.
• Give every state a named timeout budget and child AbortSignal derived from one parent.
• Replace timeout-only Promise.race behavior where underlying deployment can continue after the caller fails.
• On eligible bundled failure, abort, close, and await all bundled work before legacy begins.
• Invalidate callbacks by generation so late completion cannot write a sentinel, launch a relay, report success, or mutate cache/install state.
• Use separate bundled/legacy identities, locks, partial dirs, completion records, and GC rules.
• Ensure two simultaneous clients choosing different modes cannot modify one another’s install.
• Preserve the original bundled failure and fallback outcome in bounded diagnostics.

Failure classification

• Classify GitHub unavailable, client offline, asset missing, approved redirect failure, proxy failure, local cache unavailable, unsupported tuple, and bundled runtime incompatibility.
• Classify signature mismatch, archive hash mismatch, unsafe archive, extracted/transferred-tree mismatch, bundled-Node corruption, and native-signature failure as integrity/security failures.
• Permit automatic legacy only for explicitly classified availability/compatibility failures and only for remote tuples with current legacy evidence.
• Make every integrity/security failure fail closed in auto; assert no legacy process, lock, partial directory, or diagnostic “fallback success” is created.
• Never execute rejected bytes. Delete/quarantine them according to an explicit policy.
• If legacy prerequisites are unproved or fail, return an error that includes bundled stage, fallback stage, actionable recovery, and no sensitive paths.
• Forced bundled never silently changes mode.
• Forced legacy never performs a GitHub runtime download.

Race and fallback proof

• Timeout during download, extraction, SFTP transfer, system-SSH transfer, chmod, hash, PTY smoke, watcher smoke, sentinel write, and launch.
• Cancellation while a sibling connection waits on the bundled lock.
• Bundled failure while an old bundled relay remains live.
• Bundled failure while legacy install is complete and live.
• Legacy failure after bundled cleanup.
• App shutdown during every state.
• Assert zero post-fallback bundled writes, processes, channels, locks, and callbacks.

Milestone 9 — Diagnostics, Progress, Support, and Privacy

• Define stable stage codes for selection, manifest, cache, download, extraction, transfer, permission repair, remote hash, native probe, smoke, launch, fallback, and connected.
• Define stable fallback reason codes without embedding remote output, usernames, hostnames, IPs, repository names, or paths.
• Preserve exact low-level errors in local diagnostic logs with existing redaction boundaries.
• Add aggregate duration/byte/count metrics only through existing authorized diagnostics or telemetry mechanisms; do not imply authorization for a new backend.
• Provide progress labels for operations exceeding the style-guide thresholds; avoid flashing progress for warm cache hits.
• Keep connection controls disabled immediately while maintaining stable focus.
• Document auto, bundled, and legacy support overrides and their intended support use.
• Add troubleshooting for client offline, remote offline, missing asset, unsupported tuple, signature failure, noexec home, disk full, proxy, and fallback failure.
• Make user-visible wording state facts only after the corresponding stage result exists.
• Add tests for diagnostic bounds, redaction, stage ordering, duplicate suppression, and cancellation/fallback reporting.

Milestone 10 — Deterministic Test and Fault-Injection Coverage

Schema, selector, and trust

• Canonical manifest serialization golden vectors.
• Valid/invalid signatures, unknown key IDs, rotated keys, revoked keys, wrong tag, rollback, and unsupported schema.
• Valid/tampered/missing target-native trust attestations and attested-byte hash mismatches, verified from clients running a different OS than the target tuple.
• Every OS/architecture/libc selection plus unknown/conflicting/noisy probes.
• Minimum-version boundaries for libc, libstdc++, kernel, macOS, and Windows.
• Exact stable/RC/perf URL and channel mapping.

Cache and download

• 200 and approved redirects, redirect loop, wrong origin, missing Location, 404, 429 with retry policy, 5xx, timeout, proxy auth, certificate failure, truncated body, oversized body, wrong content length, wrong hash, and deleted asset.
• Cold, warm, offline, corrupt, partial, concurrent, multi-process, stale-lock, eviction, read-only, permission, local disk full, quota, and inode cases.
• Archive traversal, absolute path, symlink/hardlink/device, Windows name/path, case collision, archive bomb, too many files, deep nesting, unexpected file, and source mutation cases.
• Assert bad manifest signature, archive hash, archive safety, extracted-tree hash, and native signature each fail closed in auto without entering legacy.

Install and fallback

• Full identity change and remote-directory change for every executable component.
• Lock first acquisition, waiter, concurrent probe, stale recovery, cancellation, and host isolation.
• Partial install is never complete; structured sentinel must match expected mode/content/schema.
• Transfer corruption is detected before finalization.
• Missing remote sha256sum/shasum still succeeds through bundled-Node full-tree hashing.
• Corrupt one uploaded file after transfer and before verification; prove no sentinel is written and no relay launches.
• Corrupt or prevent execution of the transferred bundled Node; prove verification fails before sentinel and does not automatically enter legacy as an integrity failure.
• Corrupt local and completed remote caches; prove quarantine plus recovery from freshly verified bytes, or fail-closed behavior with zero automatic legacy when recovery is unavailable/fails.
• Mutate a warm remote file/sentinel and prove every detected case fails closed. Separately prove an unchanged warm path trusts initial-install proof without a full-tree rehash and meets latency.
• Instrument stage ordering and prove tree hash → native loads → PTY/watcher smoke → sentinel → publish/launch with no alternative success path.
• Existing legacy and bundled installs never overlap or mutate.
• All fallback transition and stale-generation cases from Milestone 8.

Relay behavior

• Protocol handshake and frame compatibility.
• PTY spawn, attach, input, resize, signal, exit, reconnect, and error mapping.
• Filesystem read/write/stat/readdir/search and bulk streaming.
• Filesystem watch registration, overflow, cancellation, crash isolation, and recovery.
• Git status/diff/blob/worktree/submodule/ignore and response streaming using Git 2.25-compatible commands and existing capability rules.
• Agent hooks, managed hook installation, remote CLI, preflight, port scan, subprocess, and aborts.
• Grace-period detach/reattach, two clients, app restart, remote restart, upgrade, downgrade, and GC.

Milestone 11 — Live Platform and Environment Matrix

Use a risk-based two-layer matrix. This does not claim every client × remote tuple combination. Every required cell must contain one or more evidence IDs rather than a bare checkmark or prose.

Layer A — every enabled remote tuple across both transport families

Each cell’s evidence must cover a native real runner, no Node/npm/compiler, blocked remote egress, PTY, watcher, every relay RPC family, reconnect/upgrade, and eligible legacy fallback. POSIX system SSH evidence includes the no-tar path; Windows system SSH is a mandatory distinct path.

Remote tuple	Built-in SSH/SFTP evidence ID	System SSH evidence ID	MaxSessions=1 evidence ID	Baseline/native-policy evidence ID
linux-x64-glibc	—	—	—	—
linux-arm64-glibc	—	—	—	—
linux-x64-musl	—	—	—	—
linux-arm64-musl	—	—	—	—
darwin-x64	—	—	—	—
darwin-arm64	—	—	—	—
win32-x64	—	—	—	—
win32-arm64	—	—	—	—

Layer B — every supported client against representative remote families

Each supported client OS/architecture must prove resolver/cache behavior and both transfer families against representative POSIX and Windows remotes. This layer catches client-specific process, filesystem, proxy/certificate, executable-bit, quoting, and cache behavior without pretending to be a full Cartesian product.

Client	Resolver/cache evidence ID	Built-in → POSIX evidence ID	Built-in → Windows evidence ID	System SSH → POSIX evidence ID	System SSH → Windows evidence ID
macOS x64	—	—	—	—	—
macOS arm64	—	—	—	—	—
Linux x64	—	—	—	—	—
Linux arm64	—	—	—	—	—
Windows x64	—	—	—	—	—
Windows arm64	—	—	—	—	—

• Define and record the representative POSIX and Windows remotes used by Layer B.
• Require Windows remote/system-SSH and MaxSessions=1 evidence before any Windows remote tuple is enabled.
• Reject promotion if any required cell still contains —; do not roll up partial evidence into an unsupported “all combinations” claim.

Required environment variants

• Exact #8450: system Node without npm plus usable NVM below .bashrc non-interactive guard.
• No Node, npm, Python, make, compiler, registry, curl, or wget.
• No tar, sha256sum, or shasum; no-tar transfer and bundled-Node verification still succeed.
• Remove each required POSIX and Windows bootstrap primitive in turn and verify deterministic compatibility classification.
• Remote egress denied at the network layer and audited for attempted connections.
• ~/.npmrc with ignore-scripts=true, broken registry, and read-only npm cache.
• MaxSessions=1, noisy startup, slow SSH, packet interruption, proxy jump, and system SSH.
• Spaces, Unicode, long paths, case collisions, restrictive umask, read-only home, noexec home, disk quota, inode exhaustion, and endpoint-protection locks.
• Supported and unsupported BusyBox/Alpine primitive variants, old supported glibc boundary, containerized host, Rosetta, Windows OpenSSH, and enterprise native-code policy.
• Two Orca clients connecting/installing simultaneously.
• Existing live PTY during app/relay upgrade and downgrade.
• Remote reboot, app crash/restart, interrupted first install, stale lock, and GC with a live old relay.

Milestone 12 — Performance and Resource Regression Gates

Baseline measurements must be captured before product behavior changes.

• Record legacy cold install p50/p95, warm connect p50/p95, transferred bytes, remote CPU/RSS, desktop CPU/RSS, process/channel/file counts, and failure timeout on the same machines used for comparison.
• Measure bundled cold download + transfer, local-cache transfer, remote-cache launch, GitHub failure-to-fallback, and client-offline behavior.
• Test at 1, 10, and 100 Mbps with 50, 100, and 200 ms latency and defined loss/jitter.
• Prove remote-cache warm connect meets the numeric Milestone 1 budget.
• Prove local-cache transfer and cold download meet the numeric Milestone 1 budgets.
• Prove SFTP and system-SSH transfer peak memory remain bounded by the numeric budgets.
• Prove file count does not cause unbounded sequential round trips or channel fanout.
• Prove cache verification/eviction does not block Electron startup or the renderer main thread.
• Prove failed bundled attempts do not add an unacceptable delay before eligible legacy fallback.
• Record before/after results, machine identity, network shaping, commit SHA, command, raw artifact, and statistical interpretation.
• Add demotion thresholds for latency, memory, transfer flakes, cache corruption, and fallback delay.

Milestone 13 — Supply-Chain and Security Completion

• Write the explicit threat model and trust boundaries.
• Generate and publish an SBOM per runtime and aggregate release.
• Record build provenance, source revisions, toolchain/container digests, and native signatures.
• Verify official Node checksums/signatures before assembly and preserve native trust where possible.
• Verify Orca-built native code signatures on target macOS and Windows policies.
• Verify target-native attestation generation/read-back, signed-manifest authentication, portable client verification, and pre-finalization target policy probes on exact bytes.
• Exercise manifest key rotation and dual-key migration in a release rehearsal.
• Exercise compromised/revoked-key response by shipping a new desktop build with newly embedded keys/manifest; prove there is no mutable freshness or latest lookup.
• Exercise anti-rollback across stable, RC, perf, desktop upgrade, and desktop downgrade.
• Add dependency and Node CVE monitoring with a named owner and response SLA.
• Exercise an emergency runtime refresh through a new desktop tag/build, embedded manifest, identity, release, download, remote coexistence, and GC; prove an installed old client remains pinned to its original manifest.
• Review archive parsing, redirect handling, cache permissions, local TOCTOU, remote quoting, native loading search paths, and diagnostic redaction.
• Complete security review before auto becomes default for any stable tuple.

Milestone 14 — Release, Rollout, Rollback, and Fallback Retirement

Asset-only

• Publish complete runtime assets and signed manifest without production consumption.
• Run read-back, direct public URL, archive execution, and packaged-manifest comparison.
• Accumulate build/release flake and duration evidence.
• Rehearse native build/signing timeout, bounded retry success/exhaustion, manual approval absence/denial, signing failure, aggregate failure, and recovery of an unpublished draft.

Per-target Beta — legacy remains default

• Ship the Beta-tagged per-target option in RC and stable builds with every existing and new target defaulting to legacy.
• Enable forced bundled only for engineering and support diagnostics; normal testers use the per-target bundled-auto Beta choice.
• Verify diagnostics and support recovery for every failure class.
• Run the full enabled tuple matrix and security/performance gates.
• Exercise forced legacy rollback from the same build.
• Accumulate approved privacy-safe Beta usage, success, classified fallback, integrity failure, latency, PTY/watcher, reconnect, and support evidence per exact tuple.

Future default-on evaluation — separately authorized

• Obtain a separate reviewed decision before changing any target's default from legacy; this issue and the Beta implementation do not authorize that change.
• Consider default auto only for tuples whose artifact, live matrix, Beta usage, and support evidence are complete.
• Require three consecutive RC builds with no unexplained fallback, cache-corruption, PTY, watcher, reconnect, native-policy, or release failures.
• Test GitHub outage, client offline, remote offline, missing asset, unsupported tuple, and integrity failure from the packaged RC.
• Prove every integrity/security failure in that RC fails closed without automatic legacy.
• Confirm non-enabled tuples deterministically retain proven legacy behavior.

Stable Beta soak

• Publish the opt-in Beta to stable only after its release-blocking gates pass against exact uploaded bytes; stable publication still leaves every target on legacy unless opted in.
• Keep automatic legacy fallback for at least the decided number of stable cycles.
• Monitor approved privacy-safe success/fallback/error signals and support reports.
• Define immediate demotion/rollback signals and owner.
• Exercise rollback without deleting live bundled or legacy remote installs.
• Do not narrow fallback until every retirement criterion below is satisfied.

Fallback retirement criteria

• Every claimed supported tuple has stable real-environment bundled proof.
• Both layers of the risk-based client/transport/environment matrix are complete with an evidence ID in every required cell.
• Soak duration and release count meet the Milestone 1 policy.
• No unexplained fallback remains.
• GitHub outage and offline behavior remain acceptable without hidden remote requirements.
• Support has a tested downgrade/recovery path for old app versions and old remote installs.
• A separate reviewed decision explicitly authorizes removing or narrowing remote npm fallback.

Proposed PR / Work-Package Split

Update status and evidence as work begins. Do not combine these into one large behavior switch.

Work package	Scope	Default behavior change	Status	PR/evidence
0. #8450 legacy fix	Coherent Node/npm selection and live repro	Fixes legacy selection only	Complete and CI-green in draft PR #8724	E-M0-UNIT-002, E-M0-LIVE-002, E-M0-STATIC-002, E-M0-PR-001, E-M0-CI-001
1. Contract and selectors	Manifest schema, identity, platform/libc selection, hostile inputs	None	Complete and CI-green in draft PR #8728	b9d80a4cb; E-M2-RED-001, E-M2-CONTRACT-001, E-M2-CI-001
2. Runtime builds	Per-tuple assembly, native smoke, SBOM/provenance/signing	None	Draft PR #8741; native build/source trust green; real signing/trust pending	be32653a7; E-M3-METADATA-CI-001, E-M3-WINDOWS-SOURCE-SIGNATURE-CI-001
3. Release publication	Prerequisite DAG, embedded manifest, draft upload/read-back gates	Asset-only	Disconnected contracts green; protected signing/publication gates open	E-M4-RELEASE-DAG-CI-001; E-M4-AGGREGATE-READBACK-CI-001
4. Desktop resolver/cache	Verified download, extraction, cache, offline behavior	None/forced mode only	In progress — 2026-07-15, Codex implementation owner; bounded cache green	E-M5-ARTIFACT-CACHE-EVICTION-CI-001
5. Transfer/install	Bounded transports, structured sentinel, bundled launch behind per-target Beta/forced mode	Per-target opt-in only	Not started	—
6. Fallback/diagnostics	Abort-and-join state machine, mode isolation, reason codes, target-mode configuration/UI	Per-target Beta only	Not started	—
7. Live gates/rollout	Matrix, security, performance, release promotion	Per-tuple staged	Not started	—

Every PR must document:

• Named invariant and motivating issue.
• Exact product behavior changed and deliberately unchanged.
• Performance-risk inventory and numeric budgets.
• Correctness oracle and exact commands.
• Platform/provider/transport coverage: covered, unaffected, or accepted gap.
• Red/green evidence where a bug or failure contract is added.
• Residual gaps and fallback behavior.
• Rollback/demotion rule.
• Checklist and HTML plan updates.
• No unrelated worktree changes included.

Verification Command Inventory

Do not mark commands passed here until they have actually run on the implementation commit. Add new focused commands as their scripts/tests are introduced.

Existing focused commands

• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-node-resolution.test.ts (E-M0-UNIT-001)
• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-native-deps-install.test.ts (E-M0-UNIT-001)
• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-versioned-install.test.ts (E-M0-UNIT-001)
• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-deploy.test.ts (E-M0-UNIT-001)
• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-cross-version-isolation.test.ts (E-M0-UNIT-001)
• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-platform-detection.test.ts (E-M0-UNIT-001)
• pnpm exec vitest run --config config/vitest.config.ts src/relay/pty-handler.test.ts src/relay/fs-handler.test.ts src/relay/subprocess.test.ts
• pnpm run build:relay (E-M0-LIVE-001)
• node config/scripts/relay-watcher-fault-harness.mjs
• pnpm run test:e2e:ssh-docker-watcher-isolation
• pnpm run test:e2e:ssh-docker-perf
• pnpm run typecheck (E-M0-STATIC-001, E-M0-STATIC-002, E-M0-CI-001)
• pnpm run lint (E-M0-STATIC-002, E-M0-CI-001)
• pnpm run check:max-lines-ratchet (E-M0-STATIC-001, E-M0-STATIC-002, E-M0-CI-001)

Milestone 0 commands added

• pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-node-toolchain-resolution.test.ts (E-M0-UNIT-001)
• pnpm run test:e2e:ssh-node-toolchain-resolution (E-M0-LIVE-001)

Milestone 3 commands added

• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-node-release-verification.test.mjs (E-M3-NODE-RED-001, E-M3-NODE-PROVENANCE-001)
• node config/scripts/verify-ssh-relay-node-release-inputs.mjs --inputs-directory <verified-input-directory> --archive linux-x64-glibc (E-M3-NODE-PROVENANCE-001; metadata and archive verification only)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-node-zip-inspection.test.mjs config/scripts/ssh-relay-runtime-zip.test.mjs (E-M3-WINDOWS-ZIP-RED-001, E-M3-WINDOWS-INPUT-001; synthetic ZIP/input contracts only)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-windows-tree.test.mjs (E-M3-WINDOWS-LOCAL-002; structural Windows ConPTY closure only, no execution)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-pty-smoke.test.mjs (E-M3-WINDOWS-SMOKE-SETTLEMENT-LOCAL-RED-001, E-M3-WINDOWS-SMOKE-SETTLEMENT-LOCAL-001; native evidence remains pending)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs (E-M3-WINDOWS-RESOURCE-DIAGNOSTIC-LOCAL-001; native classification pending)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs (E-M3-WINDOWS-CONPTY-WORKER-LOCAL-RED-001, E-M3-WINDOWS-CONPTY-WORKER-LOCAL-001; native settlement pending)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-reproducibility.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M3-REPRODUCIBILITY-LOCAL-001; synthetic comparator/workflow contract only, native execution pending)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-node-pty-build.test.mjs config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs config/scripts/ssh-relay-runtime-build.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M3-REPRODUCIBILITY-LINKER-LOCAL-001; command/linker/work-path contracts plus local macOS native proof; Windows native equality pending)
• node --check config/scripts/build-ssh-relay-runtime.mjs && node --check config/scripts/ssh-relay-runtime-build.test.mjs (E-M3-REPRODUCIBILITY-BUILDER-PARSER-LOCAL-001; exact local parser proof; native Windows remains pending)
• node config/scripts/verify-ssh-relay-node-release-inputs.mjs --inputs-directory <verified-windows-input-directory> --archive win32-x64 (E-M3-WINDOWS-INPUT-001; signed real Node ZIP, headers, and import library; no Windows execution)
• node config/scripts/build-ssh-relay-runtime.mjs --tuple linux-arm64-glibc --inputs-directory <verified-input-directory> --output-directory <exclusive-output> --work-directory <exclusive-stable-work> --source-date-epoch <epoch> --git-commit <full-sha> (E-M3-RUNTIME-LOCAL-001, E-M3-REPRODUCIBILITY-LINKER-LOCAL-001; local native Linux arm64 history plus current stable-work contract)
• node config/scripts/verify-ssh-relay-runtime.mjs --runtime-directory <runtime-tree> --identity <identity.json> --archive <runtime.tar.xz> (E-M3-RUNTIME-LOCAL-001; local native Linux arm64 only)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs (E-M3-RUNTIME-CLOSURE-LOCAL-001; 68 local artifact-contract tests plus static reuse of six prior candidate archives; new target-native builder execution remains pending)
• pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs && pnpm run typecheck && pnpm run lint && pnpm run check:max-lines-ratchet (E-M3-METADATA-LOCAL-001; 76 local artifact-contract tests, typecheck, full lint, reliability gates, localization gates, and max-lines ratchet; native metadata/toolchain proof remains pending)

Milestone 4 commands added

• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs config/scripts/ssh-relay-runtime-draft-recovery.test.mjs (E-M4-RELEASE-DAG-LOCAL-RED-001, E-M4-RELEASE-DAG-LOCAL-001; disconnected credential-free stage/recovery contract only)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs config/scripts/ssh-relay-runtime-draft-recovery.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M4-RELEASE-DAG-LOCAL-001; static native-job wiring only, no real release/signing execution)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-aggregate-input.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs (E-M4-AGGREGATE-READBACK-LOCAL-RED-001, E-M4-AGGREGATE-READBACK-LOCAL-001; local filesystem plus mocked GitHub responses only)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-aggregate-input.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M4-AGGREGATE-READBACK-LOCAL-001; static native-job wiring only)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-compatibility.test.mjs (E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-RED-001, E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001; exact Windows compatibility discriminator and canonical vector)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-compatibility.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs src/main/ssh/ssh-relay-artifact-schema.test.ts (E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-RED-001, E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001; build/desktop contract parity and static native-job wiring)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-assembly.test.mjs config/scripts/ssh-relay-runtime-manifest-signing-handoff.test.mjs (E-M4-MANIFEST-HANDOFF-LOCAL-RED-001, E-M4-MANIFEST-HANDOFF-LOCAL-001)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs (E-M4-MANIFEST-AGGREGATE-LOCAL-RED-001, E-M4-MANIFEST-AGGREGATE-LOCAL-001)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs config/scripts/ssh-relay-runtime-aggregate-input.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M4-MANIFEST-AGGREGATE-LOCAL-001; exact-file boundary and all-six workflow-source wiring)
• Exact-head Node 24 native workflow execution of config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs on all six runner families (E-M4-MANIFEST-AGGREGATE-CI-001)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs (E-M4-MANIFEST-TUPLE-LOCAL-RED-001, E-M4-MANIFEST-TUPLE-SCHEMA-RED-001, E-M4-MANIFEST-TUPLE-LOCAL-001)
• Exact-head Node 24 native workflow execution of config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs on all six runner families (E-M4-MANIFEST-TUPLE-CI-001)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs config/scripts/ssh-relay-runtime-provenance.test.mjs config/scripts/ssh-relay-runtime-sbom.test.mjs config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M4-POST-SIGN-METADATA-LOCAL-001)
• Exact-head Node 24 native workflow execution of config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs on all six runner families (E-M4-POST-SIGN-METADATA-CI-001)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-build-prerequisite.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs (E-M4-BUILD-PREREQUISITE-LOCAL-RED-001, E-M4-BUILD-PREREQUISITE-LOCAL-001)
• Exact-head Node 24 native workflow execution of config/scripts/ssh-relay-runtime-build-prerequisite.test.mjs on all six runner families (E-M4-BUILD-PREREQUISITE-CI-001)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs (E-M4-MANIFEST-HANDOFF-LOCAL-002; all release-side SSH-relay contracts)
• pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts (E-M4-MANIFEST-HANDOFF-LOCAL-002; desktop schema/signature parity)

Commands/scripts that must be added or formally identified

• Manifest/schema/identity/signature/selector unit-test command. (E-M2-CONTRACT-001)
• Per-tuple POSIX runtime assembly command. (E-M3-RUNTIME-LOCAL-001; Windows command remains open)
• Per-tuple POSIX archive inspection and native smoke command. (E-M3-RUNTIME-LOCAL-001; Windows command remains open)
• Embedded-manifest extraction/comparison command for every packaged app.
• Draft release relay-asset completeness/read-back command.
• Live release-DAG failure rehearsal covering native signing, aggregate, timeout/retry/manual approval, and recovered draft behavior. The disconnected contract is implemented under E-M4-RELEASE-DAG-LOCAL-001; real workflow/service evidence remains open.
• Hostile-archive and cache fault suite.
• Full-size transfer memory/cancellation suite for SFTP, POSIX system SSH, and Windows system SSH.
• Remote primitive/binary-fidelity suite for missing commands, BusyBox variants, no-tar POSIX, and bounded PowerShell/.NET Windows transfer.
• Remote verification-order suite for absent hash tools, corrupt upload, broken bundled Node, and sentinel/publish ordering.
• No-Node/no-egress packaged Electron SSH E2E.
• Full relay RPC conformance E2E using the packaged runtime.
• Upgrade/downgrade/concurrent-client/live-PTY E2E.
• macOS Gatekeeper and Windows Authenticode/WDAC/AV rehearsal commands.
• Network-shaped cold/warm/fallback performance report.
• Manifest key rotation/revocation/anti-rollback rehearsal.

Verification Evidence Ledger

Append entries; do not rewrite history. If evidence becomes invalid after code or matrix changes, mark it superseded and link the replacement.

Required entry format:

### E-<AREA>-<NNN> — <short title>

- Date:
- Commit SHA / PR:
- Runner: <OS, version, architecture, native/emulated>
- Remote: <OS, version, architecture, libc, relevant restrictions>
- Transport/network:
- Exact command:
- Result: PASS | FAIL | FLAKE | SUPERSEDED
- Duration and resource metrics:
- Artifact/log/trace link:
- Oracle proved:
- Does not prove:
- Checklist items satisfied:
- Follow-up:

E-PLAN-001 — Initial checklist creation

• Date: 2026-07-14

• Commit SHA / PR: uncommitted working tree

• Runner: documentation-only local worktree

• Remote: not applicable

• Transport/network: not applicable

• Exact command:

  node --input-type=module -e 'import fs from "node:fs"; import path from "node:path"; import { marked } from "marked"; const file="docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md"; const source=fs.readFileSync(file,"utf8"); const html=marked.parse(source); const links=[...source.matchAll(/\[[^\]]+\]\(([^)]+)\)/g)].map(m=>m[1]).filter(h=>!(/^(https?:|#)/.test(h))); for(const href of links){if(!fs.existsSync(path.resolve(path.dirname(file),href))) throw new Error(`Missing link: ${href}`)} const fences=(source.match(/^```/gm)||[]).length; if(fences%2) throw new Error(`Unbalanced fences: ${fences}`); const open=(source.match(/^- \[ \]/gm)||[]).length; const done=(source.match(/^- \[[xX]\]/gm)||[]).length; if(done) throw new Error(`Unexpected completed boxes: ${done}`); if(!html.includes("type=\"checkbox\"")) throw new Error("Task lists did not render"); console.log(`PASS links=${links.length} fences=${fences} open=${open} complete=${done}`)'
  

• Result: SUPERSEDED after subsequent review-driven plan expansion; originally PASS for document creation only.

• Duration and resource metrics: 1.0 second; links=1 fences=2 open=349 complete=0.

• Artifact/log/trace link: this file and the linked HTML plan

• Oracle proved: the living checklist exists and covers implementation, validation, release, and rollback work.

• Does not prove: any product behavior, artifact build, SSH runtime, platform, security, release, or performance claim.

• Checklist items satisfied: none of the implementation milestones.

• Follow-up: replaced by E-PLAN-002; close Milestone 1 decisions before production implementation.

E-PLAN-002 — Post-round-3 plan validation

• Date: 2026-07-14

• Commit SHA / PR: uncommitted planning worktree; implementation not started

• Runner: macOS arm64 local documentation validation

• Remote: not applicable

• Transport/network: local file rendering only

• Exact command:

  git diff --check
  node --input-type=module - <<'NODE'
  import fs from 'node:fs'
  import path from 'node:path'
  import { marked } from 'marked'
  import { parse } from 'parse5'
  const mdFile = 'docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md'
  const source = fs.readFileSync(mdFile, 'utf8')
  const rendered = marked.parse(source)
  const links = [...source.matchAll(/\[[^\]]+\]\(([^)]+)\)/g)].map(m => m[1]).filter(h => !/^(https?:|#)/.test(h))
  for (const href of links) if (!fs.existsSync(path.resolve(path.dirname(mdFile), href))) throw new Error(`Missing link: ${href}`)
  const fences = (source.match(/^```/gm) || []).length
  const open = (source.match(/^- \[ \]/gm) || []).length
  const done = (source.match(/^- \[[xX]\]/gm) || []).length
  if (fences % 2 || done || !rendered.includes('type="checkbox"')) throw new Error('Invalid Markdown checklist')
  const html = fs.readFileSync('docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html', 'utf8')
  const errors = []
  parse(html, { onParseError: error => errors.push(error) })
  const ids = [...html.matchAll(/\bid="([^"]+)"/g)].map(m => m[1])
  const hrefs = [...html.matchAll(/href="#([^"]+)"/g)].map(m => m[1])
  if (errors.length || new Set(ids).size !== ids.length || hrefs.some(id => !ids.includes(id))) throw new Error('Invalid HTML plan')
  console.log({ links: links.length, fences, open, done, htmlIds: ids.length, fragmentLinks: hrefs.length })
  NODE
  

• Result: SUPERSEDED after the round-4 tuple-status correction; originally PASS for the working-tree artifacts after round-3 findings were resolved.

• Duration and resource metrics: 7.1 seconds; links=1 fences=2 open=402 complete=0 htmlIds=11 fragmentLinks=9.

• Artifact/log/trace link: this file, the linked HTML plan, and local screenshots /tmp/relay-plan-desktop-light.png and /tmp/relay-plan-mobile-dark.png.

• Oracle proved: Markdown rendered with balanced fences, valid local links, and no prematurely completed implementation boxes; HTML parsed without parse errors, duplicate IDs, or broken fragment links; git diff --check passed. HTML SHA-256 was 375659e4ed3c4ec06b8077cae5badf39761ea5d92267612081195d6a027e073f; the checklist prefix before this ledger was b599bf0c7ce6ca5ceb6188a153deb3437443f61d8a09069c8dc8dd6f21cdf9ad.

• Does not prove: any product behavior, artifact build, SSH runtime, platform, security, release, or performance claim. Visual mobile emulation must be repeated after the final review because the first CLI session relaunched at its default viewport.

• Checklist items satisfied: none of the implementation milestones.

• Follow-up: replaced by E-PLAN-003; complete final visual validation before implementation handoff.

E-PLAN-003 — Post-round-4 static validation

• Date: 2026-07-14
• Commit SHA / PR: uncommitted planning worktree; implementation not started
• Runner: macOS arm64 local documentation validation
• Remote: not applicable
• Transport/network: local file parsing only
• Exact command: the exact git diff --check and inline marked/parse5 command block recorded in E-PLAN-002, followed by shasum -a 256 for the HTML and the checklist prefix before this ledger.
• Result: PASS for current static planning artifacts.
• Duration and resource metrics: under 1 second; links=1 fences=2 open=402 complete=0 htmlIds=11 fragmentLinks=9.
• Artifact/log/trace link: this file and the linked HTML plan.
• Oracle proved: Markdown/HTML structure, links, task-state integrity, fragment IDs, whitespace, and current artifact identity. HTML SHA-256 is 728fa4edcf37e834f064a32308b2901a455402a61016bd7b047b151a75100bf1; the checklist prefix before this ledger is b599bf0c7ce6ca5ceb6188a153deb3437443f61d8a09069c8dc8dd6f21cdf9ad.
• Does not prove: any product behavior or final visual responsiveness.
• Checklist items satisfied: none of the implementation milestones.
• Follow-up: obtain an explicit clean independent review, then run final desktop/mobile visual validation and implementation handoff.

E-PLAN-004 — Clean review and final visual validation

• Date: 2026-07-14
• Commit SHA / PR: uncommitted planning worktree; implementation not started
• Runner: macOS arm64, agent-browser Chromium
• Remote: not applicable
• Transport/network: local file:// rendering
• Exact command: independent subagent round 5 reviewed both files completely and returned CLEAN; agent-browser opened the HTML at 1440×1000 light mode and 390×844 @3x dark/reduced-motion mode, captured screenshots, queried document/table widths and media state, and checked page errors.
• Result: PASS.
• Duration and resource metrics: desktop documentWidth=1440, no page overflow, both tables clientWidth=scrollWidth=966; mobile documentWidth=390, no page overflow, table regions scroll internally at 352→363 and 352→505; dark mode and reduced motion both active; no page errors.
• Artifact/log/trace link: /tmp/relay-plan-final-desktop.png and /tmp/relay-plan-final-mobile.png in the handoff machine, plus the round-5 CLEAN verdict.
• Oracle proved: current plan is visually usable at representative desktop/mobile widths, table overflow is contained, dark/reduced-motion media behavior activates, and an independent reviewer found no remaining actionable implementation, regression, security, cross-platform, release, evidence, HTML, or Markdown issue.
• Does not prove: product implementation or runtime behavior; all implementation checklist boxes remain open until backed by implementation evidence.
• Checklist items satisfied: planning review/validation only; none of Milestones 0–14.
• Follow-up: implementation agent must begin at Milestone 0/1, maintain this checklist, and attach evidence before marking any product item complete.

E-M0-UNIT-001 — Coherent Node/npm resolver and legacy deploy regression suite

• Date: 2026-07-14

• Commit SHA / PR: 1ef0551bc138724d736583eac788f4183bef07e2 plus uncommitted Work Package 0 changes; no PR created

• Runner: macOS 26.2 arm64, native; Node v26.0.0 and pnpm 10.24.0 (repository requests Node 24)

• Remote: local POSIX shell fixture for the guarded-NVM case; mocked Windows PowerShell command construction; no live SSH remote in this entry

• Transport/network: local Vitest only

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-node-resolution.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-node-toolchain-resolution.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-native-deps-install.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-versioned-install.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-deploy.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-cross-version-isolation.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-platform-detection.test.ts
  

• Result: PASS; respectively 32/32, 8/8, 16/16, 26/26, 21/21, 1/1, and 6/6 tests

• Duration and resource metrics: respectively 577 ms, 1.21 s, 634 ms, 538 ms, 642 ms, 546 ms, and 156 ms Vitest duration; resource usage not instrumented

• Artifact/log/trace link: local command output; source fixtures in ssh-remote-node-toolchain-resolution.test.ts

• Oracle proved: POSIX and Windows probes require colocated Node/npm, Node 18 minimum remains, missing/failing/no-op npm candidates are skipped, guarded NVM is found without sourcing it, startup noise is marker-bounded, non-POSIX login shells receive a /bin/sh-wrapped toolchain probe, strict session-limit errors/cancellation remain classified, and the selected NVM bin directory reaches legacy npm install.

• Does not prove: live SSH, live Windows, system SSH, MaxSessions=1 on a real server, release artifacts, or an executable red run against the pre-fix source. The original #8450 report is the field red observation; these green tests are discriminating but were not run after temporarily reverting user-owned code.

• Checklist items satisfied: Milestone 0 coherent pairing, negative cases, version enforcement, strategy/cancellation/session-limit preservation, and focused resolver/deploy verification.

• Follow-up: keep this work package separate; add live Windows or MaxSessions=1 evidence only if those claims are needed for a later support matrix.

E-M0-LIVE-001 — Ubuntu 24.04 guarded-NVM relay and PTY reproduction

• Date: 2026-07-14

• Commit SHA / PR: 1ef0551bc138724d736583eac788f4183bef07e2 plus uncommitted Work Package 0 changes; no PR created

• Runner: macOS 26.2 arm64 native client; Docker 29.2.1; Electron 43.1.0

• Remote: Ubuntu 24.04 Linux arm64/glibc container (sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90); system Node v18.19.1 with no sibling npm; NVM-layout Node v22.22.3/npm 10.9.8 below a non-interactive .bashrc return guard; build-essential and Python present for the legacy native dependency install

• Transport/network: authenticated built-in SSH2 over Docker loopback; SFTP relay upload; remote registry and Node header egress available for the legacy npm install

• Exact command:

  pnpm run test:e2e:ssh-node-toolchain-resolution
  SKIP_BUILD=1 pnpm run test:e2e:ssh-node-toolchain-resolution
  

• Result: PASS twice; one purpose-named Playwright test passed on each run

• Duration and resource metrics: fresh Electron/relay build plus E2E 1.8 minutes; repeated E2E 1.2 minutes with test evidence durationMs=62553; memory/channel/file counts not instrumented for this narrow legacy resolver proof

• Artifact/log/trace link: local Playwright stdout included systemNode=v18.19.1 nvmNode=v22.22.3 npm=10.9.8 selected=nvm relayPty=pass; fixture and runner are checked into this worktree

• Oracle proved: non-interactive and login-shell PATH both expose the incomplete system Node, the complete NVM directory remains discoverable below the guard, Orca connects, the detached relay's argv[0] is the NVM Node path, and a marker round-trips through a real remote PTY.

• Does not prove: Linux x64, musl, Windows, macOS remote, system SSH, MaxSessions=1, blocked remote egress, absence of build tools, fallback behavior, performance budgets, or bundled runtimes.

• Checklist items satisfied: Milestone 0 exact live #8450 reproduction and documented passing legacy tuple.

• Follow-up: keep this evidence scoped to the one declared legacy tuple; do not generalize it into a bundled or cross-platform support claim.

E-M0-STATIC-001 — Work Package 0 type, format, line-budget, and diff gates

• Date: 2026-07-14

• Commit SHA / PR: 1ef0551bc138724d736583eac788f4183bef07e2 plus uncommitted Work Package 0 changes

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable

• Transport/network: local only

• Exact command:

  pnpm run typecheck
  pnpm exec oxlint src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-toolchain-probe.ts src/main/ssh/ssh-remote-node-resolution.test.ts src/main/ssh/ssh-remote-node-toolchain-resolution.test.ts src/main/ssh/ssh-relay-native-deps-install.test.ts tests/e2e/helpers/docker-ssh-relay-target.ts tests/e2e/helpers/docker-ssh-relay-processes.ts tests/e2e/ssh-node-toolchain-resolution.spec.ts
  pnpm exec oxfmt --check src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-toolchain-probe.ts src/main/ssh/ssh-remote-node-resolution.test.ts src/main/ssh/ssh-remote-node-toolchain-resolution.test.ts src/main/ssh/ssh-relay-native-deps-install.test.ts tests/e2e/helpers/docker-ssh-relay-target.ts tests/e2e/helpers/docker-ssh-relay-processes.ts tests/e2e/ssh-node-toolchain-resolution.spec.ts config/scripts/run-ssh-node-toolchain-resolution-e2e.mjs package.json
  pnpm run check:max-lines-ratchet
  git diff --check
  

• Result: PASS

• Duration and resource metrics: typecheck 7.94 s; formatting check 144 ms; other gates under 1 s; resource usage not instrumented

• Artifact/log/trace link: local command output

• Oracle proved: Node/CLI/web TypeScript projects compile, touched TypeScript has no oxlint errors, all touched files are formatted, no new max-lines bypass exists, and the diff has no whitespace errors.

• Does not prove: repository-wide lint completion; see E-M0-LINT-001.

• Checklist items satisfied: Milestone 0 typecheck and max-lines/diff handoff gates.

• Follow-up: resolve or explicitly baseline E-M0-LINT-001 before calling the full lint gate green.

E-M0-LINT-001 — Repository-wide lint blocked outside Work Package 0

• Date: 2026-07-14
• Commit SHA / PR: 1ef0551bc138724d736583eac788f4183bef07e2 plus uncommitted Work Package 0 changes
• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable
• Transport/network: local only
• Exact command: pnpm run lint
• Result: SUPERSEDED for current PR by E-M0-STATIC-002 after rebasing onto origin/main; originally FAIL after 4.56 s
• Duration and resource metrics: 4.56 s; resource usage not instrumented
• Artifact/log/trace link: local lint output
• Oracle proved: repository-wide oxlint completed with warnings only, then the type-aware switch-exhaustiveness subgate failed at the untouched src/renderer/src/components/tab-bar/TerminalTabLeadingIcon.tsx:31 because active | inactive cases are unhandled.
• Does not prove: a WP0 lint regression. The failing renderer file is clean in git status and is outside this work package; touched-file oxlint passes in E-M0-STATIC-001.
• Checklist items satisfied: none; the full pnpm run lint checkbox remains open.
• Follow-up: none for WP0. Upstream main added the missing cases before this branch rebased; the full lint command now passes at c4259d94f without an authored renderer change in this PR.

E-M0-UNIT-002 — Rebased Work Package 0 focused regression suites

• Date: 2026-07-14

• Commit SHA / PR: c4259d94fccf8d1465280b8e69c22db328710f9e; draft PR #8724

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0 (repository requests Node 24)

• Remote: local POSIX fixture and mocked Windows PowerShell command construction; no live SSH remote

• Transport/network: local Vitest only

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-node-resolution.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-node-toolchain-resolution.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-native-deps-install.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-versioned-install.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-deploy.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-cross-version-isolation.test.ts
  pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-remote-platform-detection.test.ts
  

• Result: PASS; respectively 32/32, 8/8, 16/16, 26/26, 21/21, 1/1, and 6/6 tests (110 total)

• Duration and resource metrics: respectively 461 ms, 1.73 s, 324 ms, 339 ms, 284 ms, 245 ms, and 189 ms Vitest duration; 10.52 s aggregate wall time; resource usage not instrumented

• Artifact/log/trace link: local command output and the exact sources in PR #8724

• Oracle proved: the focused resolver/deploy contracts from E-M0-UNIT-001 remain green after rebasing onto 9d5173252, including colocated toolchains, guarded NVM, shell-noise markers, cancellation, session-limit classification, and propagation of the selected bin directory to npm install.

• Does not prove: live SSH, live Windows, system SSH, a real MaxSessions=1 server, or bundled runtime behavior.

• Checklist items satisfied: refreshed Milestone 0 focused regression gate on the exact PR commit.

• Follow-up: use E-M0-LIVE-002 for the one claimed live tuple and PR CI for additional runner signal.

E-M0-STATIC-002 — Rebased Work Package 0 full static and repository lint gates

• Date: 2026-07-14

• Commit SHA / PR: c4259d94fccf8d1465280b8e69c22db328710f9e; draft PR #8724

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0 (repository requests Node 24)

• Remote: not applicable

• Transport/network: local only

• Exact command:

  pnpm run typecheck
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-toolchain-probe.ts src/main/ssh/ssh-remote-node-resolution.test.ts src/main/ssh/ssh-remote-node-toolchain-resolution.test.ts src/main/ssh/ssh-relay-native-deps-install.test.ts tests/e2e/helpers/docker-ssh-relay-target.ts tests/e2e/helpers/docker-ssh-relay-processes.ts tests/e2e/ssh-node-toolchain-resolution.spec.ts config/scripts/run-ssh-node-toolchain-resolution-e2e.mjs package.json docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html
  git diff --check
  pnpm run lint
  

• Result: PASS; typecheck, 355-entry max-lines ratchet, 12-file formatting check, diff check, and the complete repository lint/reliability/localization chain all exited zero

• Duration and resource metrics: typecheck/max-lines/format/diff group 7.39 s; full lint 14.11 s; resource usage not instrumented

• Artifact/log/trace link: local command output; exact PR commits

• Oracle proved: the exact rebased PR commit compiles, adds no line-budget bypass, is formatted, has no tracked whitespace errors, and passes the full repository lint chain. E-M0-LINT-001 is no longer a current blocker; its renderer fix came from upstream main, not this PR's authored diff.

• Does not prove: packaged runtime behavior, live SSH, or GitHub-hosted runner behavior.

• Checklist items satisfied: Milestone 0 typecheck, full lint, max-lines, format, and diff gates.

• Follow-up: record the GitHub-hosted verify result separately when PR #8724 completes.

E-M0-LIVE-002 — Rebased Ubuntu 24.04 guarded-NVM relay and PTY reproduction

• Date: 2026-07-14
• Commit SHA / PR: c4259d94fccf8d1465280b8e69c22db328710f9e; draft PR #8724
• Runner: macOS 26.2 arm64 native client; Docker 29.2.1; Node v26.0.0; pnpm 10.24.0
• Remote: Ubuntu 24.04 Linux arm64/glibc container, ubuntu@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90; system Node v18.19.1 with no sibling npm; guarded NVM-layout Node v22.22.3/npm 10.9.8
• Transport/network: authenticated built-in SSH2 over Docker loopback; SFTP relay upload; remote registry and Node-header egress available for the legacy native dependency install
• Exact command: pnpm run test:e2e:ssh-node-toolchain-resolution
• Result: PASS; one purpose-named Playwright test passed
• Duration and resource metrics: test oracle durationMs=144224; full build plus E2E 3.2 minutes; memory/channel/file counts not instrumented for this narrow legacy resolver proof
• Artifact/log/trace link: local Playwright stdout recorded remote=ubuntu-24.04 architecture=arm64 systemNode=v18.19.1 nvmNode=v22.22.3 npm=10.9.8 selected=nvm relayPty=pass durationMs=144224
• Oracle proved: the exact rebased app/relay build selects the complete guarded NVM toolchain, launches the detached relay with that Node, and round-trips a marker through a real remote PTY.
• Does not prove: Linux x64, musl, Windows, macOS remote, system SSH, MaxSessions=1, blocked remote egress, fallback behavior, performance budgets, or bundled runtimes.
• Checklist items satisfied: refreshed Milestone 0 exact live #8450 reproduction on the PR commit.
• Follow-up: retain this narrow tuple claim and use later matrix work for all broader coverage.

E-M0-PR-001 — Independent draft PR boundary

• Date: 2026-07-14

• Commit SHA / PR: plan/checklist 2b67de870120b9a9230cb4464bff39665fa9bb44; WP0 code c4259d94fccf8d1465280b8e69c22db328710f9e; draft PR #8724

• Runner: GitHub PR metadata; execution checks still running when recorded

• Remote: not applicable

• Transport/network: authenticated Git push and GitHub API

• Exact command:

  git push -u origin Jinwoo-H/bug-8450-ssh-node-npm-toolchain
  gh pr create --repo stablyai/orca --draft --base main --head Jinwoo-H/bug-8450-ssh-node-npm-toolchain
  gh pr view 8724 --repo stablyai/orca --json number,url,isDraft,state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup
  

• Result: PASS for the independent review boundary; PR is open and draft with the expected head/base

• Duration and resource metrics: push and PR creation 7.1 s; metadata read 0.8 s

• Artifact/log/trace link: https://github.com/stablyai/orca/pull/8724

• Oracle proved: reviewed planning artifacts and the WP0 resolver correction are separate commits; no bundled-runtime distribution implementation is present; GitHub Actions checks were triggered.

• Does not prove: CI success, reviewer approval, mergeability after later base changes, or any bundled runtime behavior.

• Checklist items satisfied: Milestone 0 separate commit/PR boundary.

• Follow-up: GitHub-hosted runner/check details were appended as E-M0-CI-001 after completion.

E-M0-CI-001 — Draft PR full regression and packaged-app checks

• Date: 2026-07-14

• Commit SHA / PR: 94e58d83eabfba30b90e9714e91485ba5e3cf8d7; draft PR #8724

• Runner: GitHub-hosted native runners:

  • ubuntu-latest resolved to x64 ubuntu-24.04 image 20260705.232.1 for verify and Linux golden jobs; runner image provisioner 20260624.560
  • macos-15 resolved to arm64 macos-15-arm64 image 20260706.0213.1 for the macOS golden job; runner image provisioner 20260624.560

• Remote: not applicable; these workflows did not provision or connect to an SSH server

• Transport/network: GitHub Actions checkout/package-network traffic only; no built-in SFTP or system-SSH relay transport was exercised

• Exact command:

  gh run watch 29325885071 --repo stablyai/orca --exit-status
  gh pr view 8724 --repo stablyai/orca --json url,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup
  gh api repos/stablyai/orca/actions/jobs/87061960266
  gh api repos/stablyai/orca/actions/jobs/87061960006
  gh api repos/stablyai/orca/actions/jobs/87061960091
  gh run view 29325885071 --repo stablyai/orca --job 87061960266 --log
  gh run view 29325884997 --repo stablyai/orca --job 87061960006 --log
  gh run view 29325884997 --repo stablyai/orca --job 87061960091 --log
  

• Result: PASS; verify, golden e2e linux experiment, and golden e2e mac experiment all completed successfully on the expected PR head

• Duration and resource metrics: verify job 13m13s; Linux golden job 4m23s; macOS golden job 5m57s; verify configured a 4 GiB Node heap ceiling but the workflows did not report peak process memory, channels, or file counts

• Artifact/log/trace link:

  • verify run/job: https://github.com/stablyai/orca/actions/runs/29325885071/job/87061960266
  • golden Linux job: https://github.com/stablyai/orca/actions/runs/29325884997/job/87061960006
  • golden macOS job: https://github.com/stablyai/orca/actions/runs/29325884997/job/87061960091

• Oracle proved: the PR head passes repository lint, reliability and max-lines gates, typecheck, Git 2.25 compatibility, full tests, unpacked-app packaging, packaged CLI smoke, and the existing Linux and macOS golden Electron suites.

• Does not prove: live SSH, Windows, Linux arm64, musl, system SSH, SFTP bootstrap transfer, MaxSessions=1, no-egress remotes, full-size runtime transfer, cancellation/resource budgets, or any bundled-runtime behavior. E-M0-LIVE-002 remains the only live SSH claim for WP0.

• Checklist items satisfied: Work Package 0 required PR checks, full repository lint, and independent CI boundary.

• Follow-up: keep PR #8724 limited to WP0; use separate work-package branches and purpose-built SSH workflows for all later tuple claims.

E-M1-RUNNER-DECISION-001 — GitHub Actions validation topology decision

• Date: 2026-07-14
• Commit SHA / PR: 1ef0551bc138724d736583eac788f4183bef07e2 plus uncommitted planning and Work Package 0 changes
• Runner: documentation decision in the macOS 26.2 arm64 native worktree
• Remote: not applicable; exact native runner labels and representative remotes remain open
• Transport/network: not applicable
• Exact command: no executable runner command applies to the policy decision; both artifacts were structurally validated by the exact command recorded in E-M1-ROLLOUT-DECISION-001.
• Result: PASS for recording the user-authorized decision; no runner cell is claimed complete.
• Duration and resource metrics: not applicable to the decision; shared structural validation took 46 ms.
• Artifact/log/trace link: the Milestone 1 “Validation runner and network topology” section and the HTML “GitHub Actions runner policy” callout
• Oracle proved: both planning artifacts name GitHub Actions as the primary orchestrator and define when hosted, ephemeral, or self-hosted native execution may fill an evidence cell.
• Does not prove: availability, capacity, permissions, networking, signing access, native execution, or any live matrix cell for a concrete runner label.
• Checklist items satisfied: Milestone 1 runner-provider and qualification-policy decisions only.
• Follow-up: inventory exact labels/images and pin representative POSIX/Windows remotes before claiming any tuple.

E-M1-ROLLOUT-DECISION-001 — Per-SSH-target Beta with legacy default

• Date: 2026-07-14

• Commit SHA / PR: 1ef0551bc138724d736583eac788f4183bef07e2 plus uncommitted planning and Work Package 0 changes

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable; documentation/content validation only

• Transport/network: local files only

• Exact command:

  node --input-type=module - <<'NODE'
  import fs from 'node:fs'
  import path from 'node:path'
  import { marked } from 'marked'
  import { parse } from 'parse5'
  const started = performance.now()
  const mdFile = 'docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md'
  const htmlFile = 'docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html'
  const source = fs.readFileSync(mdFile, 'utf8')
  const rendered = marked.parse(source)
  const links = [...source.matchAll(/\[[^\]]+\]\(([^)]+)\)/g)].map(match => match[1]).filter(href => !/^(https?:|#)/.test(href))
  for (const href of links) if (!fs.existsSync(path.resolve(path.dirname(mdFile), href))) throw new Error(`Missing link: ${href}`)
  const fences = (source.match(/^```/gm) || []).length
  const open = (source.match(/^- \[ \]/gm) || []).length
  const done = (source.match(/^- \[[xX]\]/gm) || []).length
  if (fences % 2 || !rendered.includes('type="checkbox"')) throw new Error('Invalid Markdown checklist')
  const html = fs.readFileSync(htmlFile, 'utf8')
  const errors = []
  parse(html, { onParseError: error => errors.push(error) })
  const ids = [...html.matchAll(/\bid="([^"]+)"/g)].map(match => match[1])
  const hrefs = [...html.matchAll(/href="#([^"]+)"/g)].map(match => match[1])
  if (errors.length || new Set(ids).size !== ids.length || hrefs.some(id => !ids.includes(id))) throw new Error('Invalid HTML plan')
  const requiredMd = ['Per-target Beta rollout decision', 'E-M1-ROLLOUT-DECISION-001', 'missing, malformed,', 'separate reviewed rollout decision']
  const requiredHtml = ['Per-target Beta contract', 'bundled-auto', 'Future default review']
  for (const value of requiredMd) if (!source.includes(value)) throw new Error(`Missing checklist contract: ${value}`)
  for (const value of requiredHtml) if (!html.includes(value)) throw new Error(`Missing HTML contract: ${value}`)
  console.log(JSON.stringify({ result: 'PASS', links: links.length, fences, open, done, htmlIds: ids.length, fragmentLinks: hrefs.length, durationMs: Math.round(performance.now() - started) }))
  NODE
  pnpm exec oxfmt --check docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html
  git diff --check
  

• Result: PASS; links=1 fences=2 open=393 complete=33 htmlIds=11 fragmentLinks=9 and no git diff --check findings; both planning artifacts pass oxfmt --check.

• Duration and resource metrics: 46 ms for Markdown/HTML parsing; resource usage not instrumented.

• Artifact/log/trace link: this checklist and the linked HTML plan

• Oracle proved: both artifacts record a Beta-tagged per-target opt-in, conservative legacy deserialization, next-connection-only application, classified fallback, explicit fail-closed recovery, and separate authorization before any default change.

• Does not prove: configuration migration, add/edit UI, Beta badge rendering, live-session preservation, telemetry, fallback behavior, or any bundled runtime execution.

• Checklist items satisfied: Milestone 1 rollout-control mechanism and per-target Beta policy decisions only; implementation boxes in Milestones 8 and 14 remain open.

• Follow-up: implement and test the target configuration/UI in its reviewable work package after the Work Package 0 boundary and remaining Milestone 1 blockers are closed.

E-M1-BASELINE-001 — Conservative initial runtime eligibility baselines

• Date: 2026-07-14

• Commit SHA / PR: a84d52dc6; stacked draft PR #8728

• Runner: macOS 26.2 arm64 native; authoritative Node v24.18.0 release/build metadata fetched over HTTPS

• Remote: no SSH remote; local AlmaLinux 8 arm64 container reported glibc 2.28 and libstdc++-8.5.0

• Transport/network: HTTPS to nodejs.org and raw.githubusercontent.com; local Docker execution only

• Exact command:

  curl -fsSL https://nodejs.org/dist/index.json | jq -r '[.[] | select(.version | startswith("v24."))][0] | {version,date,lts,security,files}'
  curl -fsSL https://raw.githubusercontent.com/nodejs/node/v24.18.0/BUILDING.md | sed -n '65,190p'
  docker run --rm almalinux:8 sh -lc 'uname -m; getconf GNU_LIBC_VERSION; rpm -q libstdc++ glibc'
  

• Result: PASS for a decision record. Node v24.18.0 is LTS and publishes official Linux glibc, macOS, and Windows archives for x64/arm64. Its supported-platform contract states Linux kernel 4.18, glibc 2.28, libstdc++ 6.0.25/GLIBCXX_3.4.25, macOS 13.5, Windows 10/Server 2016 x64, and Windows 10 arm64 minimums. Orca adopts those Linux/macOS floors and stricter Windows floors aligned with the declared SSH bootstrap primitives.

• Duration and resource metrics: network reads under 1 s each; local AlmaLinux probe 0.6 s; no runtime load or memory metric applies to the policy decision

• Artifact/log/trace link:

  • https://nodejs.org/dist/v24.18.0/
  • https://github.com/nodejs/node/blob/v24.18.0/BUILDING.md#supported-platforms

• Oracle proved: the recorded minimums do not claim compatibility below the upstream official Node binary ABI/OS floors, and musl is excluded because Node publishes no official musl archive.

• Does not prove: any Orca runtime archive, native module, SSH primitive, Rosetta behavior, Windows host, minimum-kernel VM, or enabled tuple. Every candidate remains disabled pending live evidence.

• Checklist items satisfied: Milestone 1 glibc, libstdc++, kernel, musl, macOS, Windows, and Rosetta eligibility decisions.

• Follow-up: encode these floors in the manifest/selector contract and fill every target-native live cell before enabling a tuple.

E-M1-NODE-PROVENANCE-001 — Pinned official Node 24 LTS provenance policy

• Date: 2026-07-14

• Commit SHA / PR: a84d52dc6; stacked draft PR #8728

• Runner: macOS 26.2 arm64 native orchestrating an Ubuntu 24.04 arm64 Docker container for GPG verification

• Remote: not applicable; provenance inputs were verified locally before any extraction or transfer

• Transport/network: HTTPS to nodejs.org and the Node release-key repository; no SSH

• Exact command:

  curl -fsSL https://nodejs.org/dist/v24.18.0/SHASUMS256.txt | rg 'node-v24\.18\.0-(linux-(x64|arm64)|darwin-(x64|arm64)|win-(x64|arm64))\.(tar\.xz|zip)$'
  docker run --rm ubuntu:24.04 bash -lc 'apt-get update -qq && apt-get install -y -qq ca-certificates curl gpgv >/dev/null && curl -fsSL https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg-only-active-keys/pubring.kbx -o /tmp/nodejs-active.kbx && curl -fsSL https://nodejs.org/dist/v24.18.0/SHASUMS256.txt -o /tmp/SHASUMS256.txt && curl -fsSL https://nodejs.org/dist/v24.18.0/SHASUMS256.txt.sig -o /tmp/SHASUMS256.txt.sig && gpgv --keyring /tmp/nodejs-active.kbx /tmp/SHASUMS256.txt.sig /tmp/SHASUMS256.txt && sha256sum /tmp/SHASUMS256.txt'
  

• Result: PASS; detached signature timestamp 2026-06-23T23:07:59Z verified with active Node release key C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C (Richard Lau); verified checksum-file SHA-256 3927bab574a00ca0560c9583fe19655ba19603a1c5851414e4325d34ac50e469

• Duration and resource metrics: checksum fetch 0.3 s; clean-container key/signature verification 11.9 s including package installation; resource usage not instrumented

• Artifact/log/trace link:

  • https://nodejs.org/dist/v24.18.0/SHASUMS256.txt
  • https://nodejs.org/dist/v24.18.0/SHASUMS256.txt.sig
  • https://github.com/nodejs/release-keys

• Oracle proved: the selected six upstream archives exist and their checksum list has a valid signature from the active Node release keyring. The policy pins the exact patch and requires a new desktop identity for every refresh.

• Does not prove: that future CI pins rather than mutably fetches the keyring, verifies archives, preserves native signatures, builds native modules, meets the CVE SLA, or signs Orca artifacts. Those remain implementation/release gates.

• Checklist items satisfied: Milestone 1 Node version, provenance, musl-source, update/CVE, refresh identity, and upstream-signature decisions.

• Follow-up: vendor a reviewed keyring/input digest into the build contract, implement fail-closed verification, and add target-native signing/provenance jobs.

E-M1-RUNNER-INVENTORY-001 — Native GitHub-hosted runner catalog

• Date: 2026-07-14

• Commit SHA / PR: a84d52dc6; stacked draft PR #8728

• Runner: macOS 26.2 arm64 native; GitHub runner-image catalog plus repository workflow inventory

• Remote: not applicable; no SSH target is claimed

• Transport/network: HTTPS to the GitHub runner-image catalog and GitHub Actions logs

• Exact command:

  curl -fsSL https://raw.githubusercontent.com/actions/runner-images/main/README.md | sed -n '/Available Images/,/Beta Images/p'
  rg -n 'runs-on:' .github/workflows
  gh run view 29325885071 --repo stablyai/orca --job 87061960266 --log
  gh run view 29325884997 --repo stablyai/orca --job 87061960091 --log
  

• Result: PASS for inventory. The catalog exposes native x64/arm64 Linux, macOS, and Windows labels selected above and documents weekly image refresh. PR evidence independently resolved ubuntu-latest to x64 ubuntu-24.04 image 20260705.232.1 and macos-15 to arm64 macos-15-arm64 image 20260706.0213.1.

• Duration and resource metrics: catalog fetch 0.2 s; workflow scan 0.1 s; prior log reads under 3 s; hosted capacity is unreserved and queue-dependent rather than a fixed resource guarantee

• Artifact/log/trace link:

  • https://github.com/actions/runner-images#available-images
  • E-M0-CI-001 job links

• Oracle proved: explicit native labels exist for the six client/build architectures and new relay workflows can avoid mutable latest aliases while recording exact resolved images.

• Does not prove: repository access to paid capacity at a future run, runner availability, SSH server reachability, cross-family networking, image stability, or any runtime tuple. No approved self-hosted target pool was found or inferred.

• Checklist items satisfied: Milestone 1 runner-label/architecture/image-update/capacity inventory.

• Follow-up: pin representative remote images/snapshots, provision cross-family endpoints, and run a minimal native label smoke before assigning any evidence cell.

E-M1-DECISION-DOC-001 — Baseline/provenance plan-content validation

• Date: 2026-07-14
• Commit SHA / PR: a84d52dc6; stacked draft PR #8728
• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; documentation/content validation only
• Transport/network: local files only
• Exact command: purpose-built inline Node validation using marked and parse5, followed by pnpm exec oxfmt --check for both plan artifacts and git diff --check
• Result: PASS; links=1 fences=2 htmlIds=11 fragmentLinks=9, no parse/fragment/duplicate-ID, formatting, or whitespace findings
• Duration and resource metrics: structural validation 42 ms; formatter check 243 ms; resource usage not instrumented
• Artifact/log/trace link: this checklist and the linked HTML plan
• Oracle proved: both artifacts contain the baseline, Node provenance, musl legacy-only, and explicit native-runner inventory decisions and remain structurally valid.
• Does not prove: implementation, live compatibility, runner access, SSH transport, signing, or any enabled tuple.
• Checklist items satisfied: evidence-backed synchronization of the Milestone 1 decision content in both required plan artifacts.
• Follow-up: continue the remaining Milestone 1 gates and keep contract implementation in stacked draft PR #8728 with no default behavior change.

E-M1-LEGACY-INVENTORY-001 — Current legacy families versus bundled candidates

• Date: 2026-07-14
• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728
• Runner: macOS 26.2 arm64 native; Vitest Node environment
• Remote: none; source-declared platform identities and deterministic tests only
• Transport/network: local files only
• Exact command: pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/relay-protocol.test.ts src/main/ssh/ssh-remote-platform-detection.test.ts
• Result: PASS; 35/35 tests across two files, including Linux/macOS/Windows x64/arm64 parsing and conservative unsupported-platform rejection
• Duration and resource metrics: 253 ms; memory, channels, and files not instrumented
• Artifact/log/trace link: local Vitest stdout; current RelayPlatform source and the living table
• Oracle proved: current source has six deterministic legacy platform identities and rejects unknown OS/architectures; the plan now separates those identities from libc-aware bundled candidates and from live fallback claims.
• Does not prove: a live SSH connection, native npm install, PTY/watcher health, libc compatibility, or fallback on any family. E-M0-LIVE-002 remains the only live legacy evidence in this project.
• Checklist items satisfied: Milestone 1 legacy-versus-bundled family inventory.
• Follow-up: fill current legacy E2E cells before allowing automatic fallback for each corresponding bundled tuple.

E-M1-BOOTSTRAP-DECISION-001 — No-Node POSIX and bounded Windows primitive contract

• Date: 2026-07-14
• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728
• Runner: macOS 26.2 arm64 native; Docker Desktop native arm64 Linux containers
• Remote: local Ubuntu 24.04, Debian 12/bookworm-slim, and AlmaLinux 8 arm64 containers; no SSH daemon, Windows host, or BusyBox image
• Transport/network: Docker stdin/stdout only; the fixture exercised the proposed raw per-file stream but not an authenticated SSH channel
• Exact command: inline Node harness spawned each image with docker run --rm -i ... sh -c, sent a ten-byte fixture containing NUL/CR/LF/high-bit bytes, and required exact output after mkdir/cat/chmod/mv/test/nohup/rm
• Result: PASS; exact ten-byte round trip on Ubuntu 24.04, Debian bookworm-slim, and AlmaLinux 8
• Duration and resource metrics: Ubuntu 4,384 ms, Debian 569 ms, AlmaLinux 506 ms including container startup; one stdin/stdout stream; peak memory and open-file counts not instrumented
• Artifact/log/trace link: local harness stdout recorded in the implementation session
• Oracle proved: the declared POSIX command subset can preserve the binary fixture without Node, Python, Perl, tar, base64, or checksum tools on three glibc userlands.
• Does not prove: SSH framing, cancellation, short/extra input rejection, concurrency, MaxSessions=1, BusyBox, Windows PowerShell/.NET, exclusive lock races, full-size transfer, or complete-tree verification.
• Checklist items satisfied: Milestone 1 POSIX/Windows primitive, per-connection probe, and compatibility-failure decisions only. Windows is a specified contract, not executable evidence.
• Follow-up: turn this into purpose-named unit/live tests, add BusyBox and bounded Windows binary transfer, and do not enable any tuple from this local semantic probe.

E-M1-BUSYBOX-001 — BusyBox-only primitive baseline fails closed

• Date: 2026-07-14
• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728
• Runner: macOS 26.2 arm64 native; Ubuntu 24.04 arm64 Docker container
• Remote: BusyBox v1.36.1, Ubuntu package 1:1.36.1-6ubuntu3.1; no SSH daemon
• Transport/network: Docker stdin and Ubuntu package mirror; no SSH
• Exact command: install BusyBox, enumerate applets, install its applet symlinks into an isolated PATH, then run the declared sh/cat/mkdir/rm/mv/chmod/test/nohup semantic probe
• Result: PASS for fail-conservative classification; the probe exited 127 because this BusyBox build provides all declared applets except nohup, so it is ineligible and must select legacy
• Duration and resource metrics: 4.6 s including package installation; one container/process stream; peak memory not instrumented
• Artifact/log/trace link: local stdout recorded BusyBox v1.36.1 (Ubuntu 1:1.36.1-6ubuntu3.1) multi-call binary; applet inventory omitted nohup
• Oracle proved: the selector cannot infer compatibility from “BusyBox 1.36.1” alone and the exact declared primitive probe rejects this variant rather than attempting a partial bundled install.
• Does not prove: Alpine's BusyBox build, BusyBox plus an external nohup, SSH behavior, or any passing BusyBox tuple. No BusyBox bundled support is claimed.
• Checklist items satisfied: Milestone 1 initial BusyBox variant record and deterministic disable rule.
• Follow-up: add this missing-nohup case to the committed selector/primitive suite and retain legacy unless a complete BusyBox environment passes live SSH evidence.

E-M1-BUDGET-DECISION-001 — Fail-closed resource, timeout, and rollout budgets

• Date: 2026-07-14
• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728
• Runner: documentation decision in the macOS 26.2 arm64 native worktree
• Remote: not applicable; measured legacy and bundled baselines remain open
• Transport/network: not applicable; the decision defines later 1/10/100 Mbps and 50/100/200 ms shaped tests
• Exact command: plan/checklist content validation plus arithmetic review of every byte/count/time ceiling; no runtime benchmark is represented by this entry
• Result: PASS for recording release-blocking upper bounds and paired comparison rules; no performance gate is claimed passed
• Duration and resource metrics: decision/content validation only; runtime metrics intentionally absent until the baseline harness is implemented
• Artifact/log/trace link: “Operational budgets and rollout policy” in this checklist and “Hard resource and latency budgets” in the HTML plan
• Oracle proved: implementation now has explicit rejection, cache, memory, concurrency, timeout, cancellation, warm/cold latency, fallback-delay, and legacy-retention thresholds to test against.
• Does not prove: that the limits fit the final full-size archive, that either implementation stays below them, hosted-runner stability, or any baseline/regression result. Those boxes remain open.
• Checklist items satisfied: Milestone 1 cache/archive/time/memory/channel/latency/fallback-duration, paired-runner-method, and offline/missing-asset policy decisions.
• Follow-up: measure legacy first, instrument file/channel/memory/cancellation metrics, and revise both plan files before implementation only if evidence proves a limit infeasible.

E-M1-TRUST-DECISION-001 — Manifest and native-signing trust policy

• Date: 2026-07-14

• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728

• Runner: macOS 26.2 arm64 native for local Ed25519 probe; historical native Windows Server 2022 x64 GitHub-hosted signing rehearsal jobs

• Remote: not applicable; no SSH transfer or target-native execution of a relay artifact

• Transport/network: local tweetnacl sign/verify plus GitHub Actions/SignPath artifact round trips

• Exact command:

  rg -n 'tweetnacl|CSC_LINK|APPLE_ID|SIGNPATH|SignPath|Get-AuthenticodeSignature' package.json .github/workflows config
  node --input-type=module <inline-tweetnacl-sign-mutate-verify-harness>
  gh run view 28987534795 --repo stablyai/orca --json status,conclusion,createdAt,updatedAt,url,jobs
  gh run view 28988432001 --repo stablyai/orca --json status,conclusion,createdAt,updatedAt,url,jobs
  

• Result: PASS for technical feasibility and existing Windows signing evidence. The local probe made and verified a 64-byte Ed25519 signature with tweetnacl, derived the SHA-256 public-key ID, and rejected a changed payload. SignPath test-policy run 28987534795 and release-policy run 28988432001 both signed/restored inner PE files, rebuilt/signed the installer, and passed end-to-end signature verification.

• Duration and resource metrics: local Ed25519 probe under 0.1 s; test SignPath job 10m7s; production SignPath rehearsal 17m24s; signing memory not instrumented

• Artifact/log/trace link:

  • https://github.com/stablyai/orca/actions/runs/28987534795/job/86019904578
  • https://github.com/stablyai/orca/actions/runs/28988432001/job/86022677749

• Oracle proved: the chosen signature primitive works through an already packaged dependency, and the repository's existing Windows release machinery can return signed inner native bytes before final packaging/hashing.

• Does not prove: canonical serializer implementation, protected manifest environment/secret, dual-key rotation, revocation, action-SHA pinning, artifact attestations, macOS relay-native signing/notarization, key custody, WDAC/Gatekeeper/AV, or any signed relay runtime. Those remain release-blocking implementation/operational gates.

• Checklist items satisfied: Milestone 1 algorithm, canonical-byte, key-custody policy, rotation, anti-rollback, keyless-provenance, and native macOS/Windows signing decisions only.

• Follow-up: implement hostile-input/canonical/signature tests without real secrets, then provision and rehearse the protected environment before any release workflow can sign a manifest.

E-M1-ENDPOINT-DECISION-001 — Native trust validation environment contract

• Date: 2026-07-14
• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728
• Runner: documentation decision in the macOS 26.2 arm64 native worktree
• Remote: no approved macOS 13.5, Windows Server 2022/Windows 11 arm64, or WDAC-enforced snapshot was executed
• Transport/network: not applicable
• Exact command: repository signing-workflow inspection plus synchronized checklist/HTML content validation; no endpoint-protection command is represented by this decision entry
• Result: PASS for defining exact target-native environments and fail-closed outcomes; all execution gates remain open
• Duration and resource metrics: decision/content validation only
• Artifact/log/trace link: Milestone 1 trust section and HTML “OS-native trust controls” risk
• Oracle proved: future Gatekeeper/Defender/WDAC evidence has concrete OS/architecture, quarantine, policy mode, identity logging, and release-blocking requirements.
• Does not prove: snapshot/provider availability, policy ownership, actual signature acceptance, antivirus behavior, native loading, PTY/watcher smoke, or any endpoint-protection pass.
• Checklist items satisfied: Milestone 1 endpoint-protection environment decision only.
• Follow-up: provision or approve the snapshot pool and keep every affected tuple disabled until the target-native runs pass.

E-M1-DECISION-DOC-002 — Remaining Milestone 1 plan-content validation

• Date: 2026-07-14
• Commit SHA / PR: 5c37e8efe; stacked draft PR #8728
• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; documentation/content validation only
• Transport/network: local files only
• Exact command: purpose-built inline Node validation using marked and parse5, required-content assertions for all newly recorded Milestone 1 decisions, pnpm exec oxfmt --check on both artifacts, and git diff --check
• Result: PASS; links=1 fences=2 htmlIds=11 fragmentLinks=9, no parse/fragment/duplicate-ID/content/format/whitespace findings
• Duration and resource metrics: structural validation 42 ms; formatter check 253 ms; resource usage not instrumented
• Artifact/log/trace link: this checklist and the linked HTML plan
• Oracle proved: both artifacts contain synchronized legacy-family, bootstrap, BusyBox, offline/fallback, numeric-budget, manifest-trust, native-signing, and endpoint-environment decisions and remain structurally valid.
• Does not prove: implementation, measured budget compliance, key provisioning, native trust, live transfer, or any enabled tuple.
• Checklist items satisfied: evidence-backed synchronization of the remaining safely decidable Milestone 1 policy content.
• Follow-up: keep unresolved remote-pool and measured-baseline gates open while contract-only work proceeds without secrets or a runtime behavior switch.

E-M2-RED-001 — Missing contract modules and canonical-vector red baseline

• Date: 2026-07-14

• Commit SHA / PR: 959bc05caca7e5ccb4c69b47c1bf6f5b47671c57 plus uncommitted Work Package 1 tests; stacked draft PR #8728

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable; pure local contract tests

• Transport/network: local Vitest only; no SSH or GitHub request

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts \
    src/main/ssh/ssh-relay-artifact-schema.test.ts \
    src/main/ssh/ssh-relay-runtime-identity.test.ts \
    src/main/ssh/ssh-relay-manifest-signature.test.ts \
    src/main/ssh/ssh-relay-release-asset.test.ts \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  

• Result: FAIL as the intended executable red baseline: signature and selector suites failed to import because their production modules did not exist; the identity vector still contained its explicit replacement marker; and one native-package fixture reached the undeclared-parent guard before the intended native-package guard. Four files failed, one passed, with 35 tests executed (33 passed and 2 failed) plus two import-failed suites.

• Duration and resource metrics: 292 ms Vitest duration; no runtime-transfer resources apply.

• Artifact/log/trace link: local command output retained in the implementation session; test paths above are the durable repro.

• Oracle proved: the new tests were discriminating before the missing signature/selector modules and canonical vector were implemented, and the native-package fixture needed to preserve tree consistency to reach its intended oracle.

• Does not prove: behavior before all schema/identity files existed, live SSH, a real archive, cryptographic key custody, target-native execution, or any production-path failure.

• Checklist items satisfied: red half of the Work Package 1 contract-test gate only.

• Follow-up: implemented and superseded for green behavior by E-M2-CONTRACT-001; retained as red history.

E-M2-CONTRACT-001 — Manifest, identity, signature, URL, and selector contracts

• Date: 2026-07-14

• Commit SHA / PR: b9d80a4cbca43c344a3a5fbdc669fa97c7527da0; stacked draft PR #8728; PR CI evidence pending

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0 (repository requests Node 24)

• Remote: not applicable; pure local schema, cryptography, identity, release-name, and selection tests

• Transport/network: local Vitest/static tools only; no SSH, release download, or GitHub API call

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts \
    src/main/ssh/ssh-relay-artifact-schema.test.ts \
    src/main/ssh/ssh-relay-runtime-identity.test.ts \
    src/main/ssh/ssh-relay-manifest-signature.test.ts \
    src/main/ssh/ssh-relay-release-asset.test.ts \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    src/main/ssh/ssh-relay-artifact-consistency.ts \
    src/main/ssh/ssh-relay-artifact-path-policy.ts \
    src/main/ssh/ssh-relay-artifact-schema.ts \
    src/main/ssh/ssh-relay-artifact-selector.ts \
    src/main/ssh/ssh-relay-manifest-signature.ts \
    src/main/ssh/ssh-relay-release-asset.ts \
    src/main/ssh/ssh-relay-runtime-identity.ts \
    src/main/ssh/ssh-relay-artifact-schema.test.ts \
    src/main/ssh/ssh-relay-artifact-selector.test.ts \
    src/main/ssh/ssh-relay-manifest-signature.test.ts \
    src/main/ssh/ssh-relay-release-asset.test.ts \
    src/main/ssh/ssh-relay-runtime-identity.test.ts \
    src/main/ssh/ssh-relay-artifact-test-manifest.ts \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --cached --check
  

• Result: PASS locally. Five suites passed with 68/68 tests; Node/CLI/web typecheck passed; the full repository lint/reliability/localization chain exited zero with pre-existing warnings only; the 355-entry max-lines ratchet reported no new bypass; touched-file formatting and tracked diff checks passed.

• Duration and resource metrics: final Vitest duration 540 ms (1.33 s wall); typecheck 3.91 s; full lint 23.62 s; formatting check 874 ms; max-lines and diff checks under 1 s. Runtime memory, channels, handles, files, and cancellation do not apply to this disconnected pure contract layer and were not instrumented.

• Artifact/log/trace link: local command output; canonical runtime identity vector sha256:5afe9c8094ec61a5eec6f7be6d1035faacee7362871985c74cc6ee6aceea8677; canonical unsigned-manifest byte hash e78bf4416628a91055035dc7926035cbf633f29d3618be34e041c6dc5e0794fb; draft PR #8728

• Oracle proved: strict versioned parsing; bounded sizes/counts; portable path and special-entry rejection; required runtime closure and executable Node mode; tuple/archive/attestation cross-consistency; stable content identity; exact stable/RC/perf tag and direct-URL rules; initial and dual Ed25519 signing with canonical unsigned bytes; unknown/malformed/duplicate/mismatched key failure; conservative Linux glibc/musl, macOS, Windows-bootstrap, translated-process, unknown, old, unavailable, and ambiguous selection.

• Does not prove: Node 24 execution, real archive parsing/extraction, local cache/download, target probes, SSH/SFTP/system-SSH transfer, runtime build/native loading, signing environment custody, release publication, fallback state, UI rollout, performance, or any live matrix cell. No module is connected to a production call site and no tuple is enabled.

• Checklist items satisfied: Milestone 2 manifest-schema, signed-content, content-identity, release-name/URL, schema-level hostile path/type, and pure selector contract items explicitly marked above; verification command inventory entry.

• Follow-up: push and record the exact GitHub Actions result, then begin Work Package 2 target-native runtime assembly without production consumption.

E-M2-CI-001 — Work Package 1 full PR verification and packaging gate

• Date: 2026-07-14

• Commit SHA / PR: exact checked head 6732d911a8e81ad071925e68d3a60fec2e3e452a, containing implementation commit b9d80a4cbca43c344a3a5fbdc669fa97c7527da0; stacked draft PR #8728

• Runner: GitHub-hosted native x64 ubuntu-latest, resolved to Ubuntu 24.04 image 20260705.232.1; image provisioner 20260624.560; runner 2.335.1; Node v24.18.0

• Remote: not applicable; the workflow provisioned no SSH server and exercised no remote tuple

• Transport/network: GitHub Actions checkout/package traffic only; no SSH/SFTP/system-SSH runtime transfer

• Exact command:

  gh run watch 29329963564 --repo stablyai/orca --exit-status
  gh pr view 8728 --repo stablyai/orca \
    --json url,isDraft,state,headRefOid,baseRefOid,mergeStateStatus,statusCheckRollup
  gh api repos/stablyai/orca/actions/jobs/87075275741
  gh run view 29329963564 --repo stablyai/orca --job 87075275741 --log
  

• Result: PASS. The verify job completed successfully on the exact PR head; repository lint, reliability gates, max-lines, typecheck, Git 2.25 compatibility, 2,803 passing test files with 29,695 passing tests, unpacked Linux app packaging, packaged daemon load, and packaged CLI smoke all passed. Nine test files and 55 tests were intentionally skipped by the existing suite.

• Duration and resource metrics: 11m52s from 2026-07-14T11:44:44Z to 2026-07-14T11:56:36Z; the workflow did not report peak memory, channel, handle, or file counts.

• Artifact/log/trace link: https://github.com/stablyai/orca/actions/runs/29329963564/job/87075275741

• Oracle proved: Work Package 1 compiles and passes the repository's full PR regression/package gate under the pinned Node 24 runtime on a native Linux x64 runner; PR #8728 is draft, open, and reports a clean merge state at the checked head.

• Does not prove: live SSH, Linux arm64, macOS, Windows, musl, archive assembly/extraction, native runtime execution, signing, release assets, download/cache, transfer/install, fallback, UI, performance budgets, or any enabled tuple. The existing relay build exercised by packaging remains the legacy JavaScript build, not a self-contained runtime artifact.

• Checklist items satisfied: Work Package 1 exact-head PR CI gate only; no live matrix or runtime tuple cell.

• Follow-up: keep PR #8728 draft and isolated; begin Work Package 2 on a new stacked branch with no production consumer.

E-M3-NODE-RED-001 — Node release verifier red gate

• Date: 2026-07-14

• Commit SHA / PR: 0c299fe189310b6dbd539f0f0f506b240524ba6a plus uncommitted Work Package 2 test; no Work Package 2 PR yet

• Runner: macOS 26.2 arm64 native; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable; local test discovery only

• Transport/network: none

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs
  

• Result: expected FAIL before implementation. Vitest could not import the intentionally missing config/scripts/ssh-relay-node-release-verification.mjs; one suite failed before collecting tests.

• Duration and resource metrics: 136 ms Vitest duration; archive/runtime resources do not apply.

• Artifact/log/trace link: durable test path above; local command output retained in the implementation session.

• Oracle proved: the focused suite was discriminating before the verifier facade and domain modules existed.

• Does not prove: any validation behavior, cryptographic verification, downloaded byte, archive, extraction, runtime execution, SSH behavior, or platform tuple.

• Checklist items satisfied: red half of the Milestone 3 Node provenance implementation gate only.

• Follow-up: green implementation and real release-input proof are recorded in E-M3-NODE-PROVENANCE-001.

E-M3-NODE-PROVENANCE-001 — Pinned Node metadata and archive verification

• Date: 2026-07-14

• Commit SHA / PR: implementation commit f2b387b21bbe6a3863ff1a492a1a03b65e0a0477 in stacked draft PR #8741; native PR CI pending

• Runner: focused tests on macOS 26.2 arm64 with Node v26.0.0/pnpm 10.24.0; real proof in Docker Engine 29.2.1 on Linux/arm64 using node:24-bookworm resolved to node@sha256:032e78d7e54e352129831743737e3a83171d9cc5b5896f411649c597ce0b11ea, Node v24.17.0, and GnuPG/gpgv 2.2.40

• Remote: not applicable; local container build-input verification only

• Transport/network: HTTPS downloads from exact https://nodejs.org/dist/v24.18.0/ URLs; Debian package mirrors supplied ca-certificates, curl, gnupg, and gpgv; no SSH transport

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs
  
  docker run --rm -v "$PWD:/workspace:ro" -w /workspace node:24-bookworm \
    bash -lc 'set -euo pipefail
      apt-get update -qq
      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ca-certificates curl gnupg gpgv >/dev/null
      mkdir -p /tmp/node-inputs
      curl --fail --silent --show-error --location --proto "=https" --tlsv1.2 https://nodejs.org/dist/v24.18.0/SHASUMS256.txt --output /tmp/node-inputs/SHASUMS256.txt
      curl --fail --silent --show-error --location --proto "=https" --tlsv1.2 https://nodejs.org/dist/v24.18.0/SHASUMS256.txt.sig --output /tmp/node-inputs/SHASUMS256.txt.sig
      curl --fail --silent --show-error --location --proto "=https" --tlsv1.2 https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz --output /tmp/node-inputs/node-v24.18.0-linux-x64.tar.xz
      node config/scripts/verify-ssh-relay-node-release-inputs.mjs --inputs-directory /tmp/node-inputs --archive linux-x64-glibc'
  

• Result: PASS. Seven focused tests passed. The real verifier accepted the pinned release-key hash 84b1ca614406f341cb86e72920f5a64687a13ab67ab84038bcf2abba97898a84, exact signer C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C, authenticated checksum-document hash 3927bab574a00ca0560c9583fe19655ba19603a1c5851414e4325d34ac50e469, all six pinned checksum entries, and the 31,511,588-byte Linux x64 archive hash 55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742.

• Duration and resource metrics: final focused Vitest duration 160 ms; container provisioning, metadata download, archive download, and verification completed in approximately 11 seconds. Peak memory and network bytes were not instrumented; the accepted archive size was 31,511,588 bytes and hashing was streaming/bounded.

• Artifact/log/trace link: committed contract, pinned ASCII release key, purpose-named verifier modules/CLI, and local command output; no artifact was published or retained in the repository.

• Oracle proved: strict immutable six-tuple contract validation; bounded metadata/archive hashing; exact release-key bytes; detached-signature success through gpgv; exact signer fingerprint; authenticated checksum-to-archive cross-checking; duplicate/malformed/missing/mismatched input rejection in focused tests; and one real official Linux x64 archive byte hash.

• Does not prove: archive safety or extraction, Linux x64 execution (the container was arm64), any bundled Node/native dependency/PTY/watcher behavior, the other five archive downloads, target-native assembly/signing, SSH transfer, release publication, cache behavior, or any enabled tuple.

• Checklist items satisfied: Milestone 3 pinned Node/downloaded-binary checksum/upstream-signature implementation gate and the two Milestone 3 verification-command inventory entries only.

• Follow-up: assemble the first runtime on a target-native runner, inspect its archive, execute its bundled Node and native dependencies, then fill only the evidence cells actually proved.

E-M3-WINDOWS-CONPTY-GAP-001 — Candidate omitted the production ConPTY runtime closure

• Date: 2026-07-14

• Commit SHA / PR: source audit while preparing implementation commit 922edb6ff28199b394f508731fd18a635bec49a0; draft PR #8741

• Runner: macOS 26.2 arm64; source and installed-package inspection only

• Remote and transport: none

• Exact commands:

  rg -n "useConpty|nodePty\\.spawn|pty\\.spawn" src/main src/shared
  sed -n '470,515p' src/main/daemon/pty-subprocess.ts
  sed -n '1,130p' node_modules/node-pty/scripts/post-install.js
  find node_modules/node-pty/third_party/conpty -maxdepth 3 -type f -print | sort
  rg -n "conpty\\.dll|OpenConsole|useConptyDll" \
    config/scripts/ssh-relay-runtime-tree.mjs \
    config/scripts/ssh-relay-runtime-smoke-child.cjs
  

• Result: discriminating discovery. Orca's daemon PTY spawn passes useConptyDll: true on Windows. Pinned node-pty@1.1.0 supplies architecture-specific conpty.dll and OpenConsole.exe under third_party/conpty/1.23.251008001/win10-{x64,arm64} and its postinstall copies those files to build/Release/conpty. The candidate directly invoked node-gyp, copied only conpty.node and conpty_console_list.node, and smoked with useConpty: true but not useConptyDll: true.

• Oracle proved: the candidate artifact could pass its proposed smoke while omitting files required by the production relay PTY configuration. Both plan artifacts now require the exact ConPTY runtime closure and production-mode smoke before a Windows executable cell can pass.

• Does not prove: corrected staging, artifact-tree identity, ConPTY execution, Authenticode/native trust, Windows build, SSH, transfer, install, or any enabled tuple.

• Checklist items satisfied: none; this is a red gap record and its implementation item remains open.

• Follow-up: stage the tuple-specific files without running an implicit downloader, copy and hash them into the runtime, use useConptyDll: true in native smoke, and obtain Windows x64/arm64 CI evidence before checking the implementation item.

E-M3-WINDOWS-INPUT-GAP-001 — Windows ZIP lacks native build inputs

• Date: 2026-07-14

• Commit SHA / PR: investigation while implementing the Windows artifact-only slice in draft PR #8741; no Windows artifact was produced or enabled

• Runner: macOS 26.2 arm64; curl plus system unzip; inspection only

• Remote and transport: exact HTTPS download from https://nodejs.org/dist/v24.18.0/node-v24.18.0-win-x64.zip; no SSH or release upload

• Exact commands:

  curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
    --connect-timeout 20 --max-time 300 --retry 2 --retry-delay 2 --retry-all-errors \
    https://nodejs.org/dist/v24.18.0/node-v24.18.0-win-x64.zip \
    --output /tmp/orca-node-win-input-check/node-v24.18.0-win-x64.zip
  unzip -l /tmp/orca-node-win-input-check/node-v24.18.0-win-x64.zip | \
    rg 'node\\.exe$|include/node/node\\.h$|node\\.lib$|LICENSE$'
  curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 \
    https://nodejs.org/dist/v24.18.0/SHASUMS256.txt | \
    rg 'headers|win-(x64|arm64)/node\\.lib|win-(x64|arm64)\\.zip'
  

• Result: discriminating discovery. The authenticated x64 ZIP contains 2,449 files and 105,728,964 expanded bytes, including the 92,534,088-byte node.exe and root LICENSE, but no include/node/node.h and no node.lib. The same signed checksum document authenticates node-v24.18.0-headers.tar.gz as 6c7d41d83c3481d2301115b8ce4a44b7d4fbfa52859b1aac14f445d460137887, win-x64/node.lib as 589684168a73547ca47cd22d76a4e465ef561abe89fb1b2b23fe35bbe857d505, and win-arm64/node.lib as 7da03c5111815b69bbe63ffd2e51b28cd69eec9f545b7ccb8756efffdbb88dc2.

• Oracle proved: the original six-binary-archive contract is insufficient to build node-pty on Windows without an unrecorded node-gyp download. Both plan artifacts now require the signed headers archive and per-architecture import library as explicit immutable build inputs.

• Does not prove: headers/import-library download or extraction, Windows build, ZIP determinism, bundled Node/ConPTY/watcher execution, signing/trust, SSH, or any enabled tuple.

• Checklist items satisfied: Windows build-input policy correction only; implementation remains unchecked.

• Follow-up: extend the signed input schema/verifier and hostile-input tests, stage only the required headers and node.lib, then run the native Windows build with implicit downloads disabled.

E-M3-WINDOWS-ZIP-RED-001 — Windows ZIP/input contract red gate

• Date: 2026-07-14

• Commit SHA / PR: uncommitted Windows artifact-only tests on top of c308107a9; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0

• Remote and transport: none; synthetic local test discovery only

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs
  

• Result: expected FAIL before implementation. Both suites failed at import because the deliberately missing ssh-relay-runtime-zip.mjs and ssh-relay-node-zip-inspection.mjs modules did not exist; zero tests were collected.

• Duration and resource metrics: 196 ms Vitest duration; archive/runtime resources do not apply.

• Oracle proved: both Windows ZIP boundaries were discriminating before their implementations.

• Does not prove: any ZIP validation, real Node input, Windows build/execution, SSH, or tuple support.

• Checklist items satisfied: red half of the Windows ZIP/input contract gate only.

• Follow-up: E-M3-WINDOWS-INPUT-001 records the first green implementation and real signed inputs.

E-M3-WINDOWS-INPUT-001 — Signed Windows Node inputs and bounded selective extraction

• Date: 2026-07-14

• Commit SHA / PR: implementation commit 922edb6ff28199b394f508731fd18a635bec49a0; draft PR #8741; native Windows CI pending

• Runners: focused tests and real selective extraction on macOS 26.2 arm64 with Node v26.0.0/pnpm 10.24.0; signature/checksum/file verification in native Linux arm64 container node@sha256:032e78d7e54e352129831743737e3a83171d9cc5b5896f411649c597ce0b11ea with GnuPG/gpgv 2.2.40

• Remote and transport: exact HTTPS inputs from nodejs.org/dist/v24.18.0; no SSH, release upload, Windows execution, or remote-host egress

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  
  docker run --rm \
    -v "$PWD:/workspace:ro" -v /tmp/orca-node-win-input-check:/inputs:ro \
    -w /workspace \
    node@sha256:032e78d7e54e352129831743737e3a83171d9cc5b5896f411649c597ce0b11ea \
    bash -lc 'set -euo pipefail
      apt-get update -qq
      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq gnupg gpgv >/dev/null
      node config/scripts/verify-ssh-relay-node-release-inputs.mjs \
        --inputs-directory /inputs --archive win32-x64'
  
  node --input-type=module -e \
    "import {readFile} from 'node:fs/promises';
     import {extractVerifiedSshRelayNodeZipBuildInputs} from
       './config/scripts/ssh-relay-node-zip-inspection.mjs';
     const release=JSON.parse(await readFile(
       './config/ssh-relay-node-release-v24.18.0.json','utf8'));
     console.log(await extractVerifiedSshRelayNodeZipBuildInputs(
       release,'win32-x64','<node-zip>','<exclusive-destination>',
       {headersArchivePath:'<headers.tar.gz>',importLibraryPath:'<win-x64/node.lib>'}));"
  

• Result: PASS. Six focused suites passed 19/19 tests. The real verifier authenticated signer C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C, the exact signed checksum document, all nine pinned release inputs, the 37,176,245-byte x64 ZIP, 9,951,449-byte headers archive, and 2,986,260-byte x64 import library. Bounded ZIP inspection consumed 2,449 entries/1,984 files/105,728,964 expanded bytes and selectively staged only node.exe plus LICENSE. Bounded headers inspection consumed 3,326 entries/2,726 files/58,969,198 expanded bytes and staged only include; node.lib was rehashed before and after exclusive copy to Release/node.lib.

• Resource and integrity details: all input hashing and archive entry verification streamed; each file was bounded by 256 MiB, aggregate input expansion by 1 GiB, path depth by 32, path bytes by 512, and entries by 100,000. Synthetic runtime ZIP creation was byte-identical for the same tree and epoch and rejected extra entries and content mismatch. Peak RSS, open files, and cancellation settlement were not instrumented in this local slice.

• Oracle proved: exact schema and signed-checksum coverage for the Windows ZIP, common headers, and tuple import library; missing/malformed input rejection; safe portable ZIP paths, traversal and case-fold collision rejection; CRC-32 plus SHA-256 streaming; bounded selective extraction; exact post-copy hashes; and deterministic synthetic runtime ZIP packing/inspection.

• Does not prove: native Windows node-pty build, that node-gyp succeeds offline, bundled node.exe/ConPTY/watcher execution, full-runtime ZIP identity on Windows, Windows x64/arm64 signing/trust, oldest baseline, SSH/SFTP/system-SSH, release publication, cache/fallback/UI, or any enabled tuple. Local gpg/gpgv were unavailable on macOS, so the signature proof is the pinned Linux container command above; Windows jobs explicitly select Git for Windows' bundled tools.

• Checklist items satisfied: explicit signed Windows build-input contract and bounded local staging only; no Windows per-tuple build/executable cell is checked.

• Follow-up: run the exact builder on native windows-2022 and windows-11-arm, require the loopback-only node-gyp fallback URL to remain unused, and record only the cells actually passed.

E-M3-WINDOWS-LOCAL-002 — Corrected Windows artifact contracts and local static gates

• Date: 2026-07-14

• Commit SHA / PR: implementation commit 922edb6ff28199b394f508731fd18a635bec49a0; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. The repository requires Node 24, so exact-head draft-PR CI is the authoritative supported-Node result.

• Remote and transport: none; synthetic contracts and repository static checks only

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html
  git diff --check
  

• Result: PASS. Seven focused suites passed 21/21 tests in 290 ms. Typecheck, oxlint, max-lines, full lint/reliability/localization gates, plan formatting, and diff whitespace passed. Oxlint reported only pre-existing warnings outside this package. Full lint used GOMAXPROCS=2 because the external Go type-aware linter had previously segfaulted on an existing dependency declaration at unconstrained concurrency.

• Oracle proved: deterministic synthetic Windows ZIP packing and complete ZIP reinspection; signed-input schema and bounded ZIP/header staging contracts; Windows-unsafe header path rejection; the Windows runtime-tree identity contains conpty.dll and OpenConsole.exe as native runtime files; the smoke configuration selects useConptyDll: true; the workflow declares exact x64/arm64 native runners and has read-only, unpublished artifact authority.

• Resource metrics: focused Vitest duration 290 ms. Runtime RSS, open files/channels, cancellation settlement, artifact size, and native build/smoke duration do not apply to these synthetic checks and remain open for target-native evidence.

• Does not prove: Windows native compilation, offline node-gyp, staged ConPTY execution, bundled-Node/PTY/watcher smoke, full artifact bytes or reproducibility, native trust/signing, oldest baseline, SSH transfer/install, publication, resolver/cache/fallback/UI, or any enabled tuple.

• Checklist items satisfied: the added purpose-named local Windows-tree command only. Windows per-tuple build/executable and ConPTY implementation boxes remain unchecked pending native CI.

• Follow-up: push this exact implementation head and record exact Windows x64/arm64 jobs, images, artifact IDs/hashes/sizes, build/verify/smoke durations, RSS, and any discriminating failure.

E-M3-WINDOWS-CI-RED-002 — First Windows native jobs stopped at contract tests

• Date: 2026-07-14

• Commit SHA / PR: exact workflow head 539cd060e74386ba33bf1291c940b68fba9af13b containing implementation commit 922edb6ff28199b394f508731fd18a635bec49a0; draft PR #8741

• Run: SSH Relay Runtime Artifacts 29338911990

• Native jobs:

  • x64 job 87105197603: requested windows-2022; resolved win22 image 20260706.237.1, GitHub-hosted X64, Windows Server 2022 Datacenter build 20348, Node v24.18.0; failed after 1m17s.
  • arm64 job 87105197605: requested windows-11-arm; resolved win11-arm64 image 20260706.102.1, GitHub-hosted ARM64, Windows 10 Enterprise build 26200, Node v24.18.0; failed after 3m37s.

• Remote and transport: none. Both jobs stopped before Node input download, native build, runtime smoke, or artifact upload.

• Exact commands:

  gh api repos/stablyai/orca/actions/jobs/87105197603/logs > /tmp/orca-win-x64-red.log
  gh api repos/stablyai/orca/actions/jobs/87105197605/logs > /tmp/orca-win-arm64-red.log
  rg -n "requested_runner=|resolved_image_os=|resolved_image_version=|runner_arch=|WindowsProductName|WindowsVersion|OsBuildNumber|source_commit=|FAIL|SyntaxError|Node archive is missing" \
    /tmp/orca-win-x64-red.log /tmp/orca-win-arm64-red.log
  

• Result: FAIL as a discriminating pre-build gate on both architectures. Each run reported three failed and four passed suites, with one failed and ten passed collected tests. The x64 test phase took 1.26s; arm64 took 1.33s. ssh-relay-node-tar-inspection.test.mjs created its POSIX tar fixture from an NTFS file and therefore lost the declared bin/node execute bit; the production inspector correctly rejected it. ssh-relay-node-release-verification.test.mjs and ssh-relay-runtime-artifact.test.mjs separately failed at import with only SyntaxError: Invalid or unexpected token; the first logs did not identify a source location.

• Discriminating follow-up: exact head 55f7137c6e065481d2f58fed1353df9a75914fc8 reran in run 29339487426. X64 job 87107170544 proved the explicit tar-mode correction: five suites and all 11 collected tests passed in 1.24s. Only the same two import-time syntax errors remained. Both failing suites import a command-line .mjs file with a Unix shebang, while every supported call site already invokes those files through node; the next correction removes only those unused shebangs and preserves the CLI main guards.

• Second follow-up: exact head ef94c90663740c657d44e93f758c99016e66b61a reran in run 29339742904. X64 job 87108126824 collected all seven suites and 21 tests, proving the shebang correction. Eighteen tests passed, one POSIX archive test skipped as designed, and two Windows-specific assertions failed in 1.17s: Git checkout converted the pinned armored key from LF to CRLF, and a POSIX chmod(0o600) rejection assertion ran even though the Windows verifier intentionally takes modes from verified ZIP metadata. The received key hash 25cc2da386fe54cfc6a3d683f1df2a5f636014a31be8efadd73a9ecc2208dbec exactly matches sed 's/$/\r/' <pinned-key> | shasum -a 256; the committed LF bytes remain 84b1ca614406f341cb86e72920f5a64687a13ab67ab84038bcf2abba97898a84.

• Oracle proved: both requested hosted runner labels resolve to native Node 24 environments, MSVC setup succeeds, Git for Windows supplies both required GPG tools, frozen source installation succeeds, and the test command stops the artifact build before any download or upload. It also discriminated one cross-platform fixture assumption.

• Does not prove: that the explicit-mode fixture correction is green on Windows; the cause of the two import-time syntax errors; Node input download/signature verification; native compilation; offline node-gyp; bundled Node/ConPTY/watcher execution; ZIP output; native trust; SSH; or any enabled tuple.

• Checklist items satisfied: exact Windows runner-label resolution only. No Windows build, executable, archive, or artifact cell is checked.

• Follow-up: mark the pinned armored key -text so checkout preserves its authenticated bytes, keep the filesystem-mode mutation assertion POSIX-only, and rerun both native architectures. Continue to block input download/build until all seven suites pass.

E-M3-WINDOWS-CI-RED-003 — Native Windows input verification exposed GPG path incompatibility

• Date: 2026-07-14

• Commit SHA / PR: exact workflow head b387ac48cda70b60a5a148c03ce740f9afedf9cb; draft PR #8741

• Run: SSH Relay Runtime Artifacts 29339998273

• Native jobs:

  • x64 job 87109014067: requested windows-2022; resolved win22 image 20260706.237.1, GitHub-hosted X64, Windows Server 2022 Datacenter build 20348, Node v24.18.0; failed after 1m21s.
  • arm64 job 87109014073: requested windows-11-arm; resolved win11-arm64 image 20260706.102.1, GitHub-hosted ARM64, Windows 10 Enterprise build 26200, Node v24.18.0; failed after approximately 3m.

• Remote and transport: none. Each job downloaded exact HTTPS inputs from nodejs.org/dist/v24.18.0; neither reached archive extraction, native compilation, smoke, ZIP creation, or artifact upload.

• Exact commands:

  gh run view 29339998273 --repo stablyai/orca \
    --json databaseId,headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/87109014067/logs | \
    rg -n -C 12 "SSH relay runtime build failed|gpgv rejected|invalid key resource|Process completed with exit code"
  gh api repos/stablyai/orca/actions/jobs/87109014073/logs | \
    rg -n -C 12 "SSH relay runtime build failed|gpgv rejected|invalid key resource|Process completed with exit code"
  

• Result: FAIL as a discriminating signed-input gate on both architectures. All seven focused suites collected on each runner; 20 tests passed and one POSIX-only test skipped as designed in 1.17s on x64 and 1.47s on arm64. Exact Node inputs downloaded successfully. Git for Windows gpgv then rejected the exclusive verified-copy keyring path before signature acceptance: invalid key resource URL 'C:\\...\\release-key.gpg'. GnuPG interprets the drive-letter colon as a resource-URL scheme at this option boundary. Both runners failed closed with No public key; no unverified archive was extracted or executed.

• Oracle proved: the preceding fixture, shebang, checkout-byte, and filesystem-mode corrections are green on both native Windows architectures; exact release inputs are downloadable; the production signature gate executes and prevents unverified bytes from progressing. The identical x64/arm64 failure isolates command-path representation rather than architecture-specific cryptography.

• Does not prove: successful Windows signature verification, archive/header/import-library extraction, offline node-gyp, native compilation, bundled Node/ConPTY/watcher execution, ZIP output or determinism, native trust/signing, oldest baseline, SSH, or any enabled tuple.

• Checklist items satisfied: Windows contract-test portability and fail-closed signed-input behavior only. No Windows build, executable, archive, or artifact cell is checked.

• Follow-up: run both GPG commands in the exclusive verified-copy directory with cwd-relative paths, assert the command boundary never receives an absolute drive-letter path, and rerun both native architectures before any broader Windows correction.

E-M3-WINDOWS-GPG-PATH-RED-001 — Relative verified-copy command boundary red gate

• Date: 2026-07-14
• Commit SHA / PR: red test introduced before its implementation in correction commit b6903b220; exact base b387ac48cda70b60a5a148c03ce740f9afedf9cb; draft PR #8741
• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0
• Remote and transport: none; mocked child-process command boundary only
• Exact command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-node-release-verification.test.mjs
• Result: expected FAIL; one new test failed and seven existing tests passed in 163 ms. The failure diff showed absolute temporary paths passed to both gpg --output and gpgv --keyring, while the required oracle expected cwd-relative verified-copy names and a common exclusive working directory.
• Oracle proved: the regression test discriminates the exact command representation rejected by Git for Windows in E-M3-WINDOWS-CI-RED-003 without weakening signature/fingerprint validation.
• Does not prove: real GPG execution, Windows compatibility, successful signature verification, archive extraction/build/smoke, or any tuple support.
• Checklist items satisfied: red half of the Windows GPG path-portability correction only.
• Follow-up: add cwd support to the bounded command runner, pass only explicit relative verified-copy names, rerun this focused suite, and require native x64/arm64 CI before claiming the correction.

E-M3-WINDOWS-GPG-PATH-LOCAL-001 — Relative verified-copy command boundary correction

• Date: 2026-07-14

• Commit SHA / PR: implementation commit b6903b220 on exact base b387ac48cda70b60a5a148c03ce740f9afedf9cb; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. The repository requires Node 24, so exact-head draft-PR CI remains authoritative.

• Remote and transport: none; mocked GPG command-boundary regression plus local contract/static checks

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html
  git diff --check
  

• Result: PASS. The focused signature suite passed 8/8 tests in 151 ms; all seven artifact suites passed 22/22 tests in 313 ms. Typecheck, full oxlint, max-lines ratchet, full lint/reliability/localization gates, plan formatting, and diff whitespace passed. Oxlint reported only existing warnings outside this package; full lint used GOMAXPROCS=2 for the previously recorded external Go linter stability constraint.

• Oracle proved: both GPG invocations share the exclusive verified-copy directory as their cwd and receive only explicit ./ paths for the key, keyring, checksum, and signature; existing hash, command-failure, and exact-fingerprint tests remain green.

• Does not prove: real GPG execution, Git for Windows compatibility, Node 24 support, Windows native build/smoke, archive output, or any tuple support.

• Checklist items satisfied: local green half of the path-portability correction only. Native CI is still mandatory before the E-M3-WINDOWS-CI-RED-003 failure is considered corrected.

• Follow-up: run the exact correction on Windows x64/arm64 and all four POSIX artifact jobs, then record any next discriminating native boundary without broadening this work package.

E-M3-WINDOWS-CI-RED-004 — Native Windows assembly reached an opaque bounded smoke timeout

• Date: 2026-07-14

• Commit SHA / PR: exact workflow head 42aa02fa9eccf81e40d80f87461ddd232a1cda1f, containing implementation commit b6903b220; draft PR #8741

• Run: SSH Relay Runtime Artifacts 29340686444, conclusion failure; all four POSIX regression jobs passed and uploaded only unpublished seven-day Actions artifacts.

• Native Windows jobs:

  • x64 job 87111302431: windows-2022, resolved win22 image 20260706.237.1, GitHub-hosted X64, Windows Server 2022 Datacenter build 20348, Node v24.18.0; failed after 4m37s.
  • arm64 job 87111302486: windows-11-arm, resolved win11-arm64 image 20260706.102.1, GitHub-hosted ARM64, Windows 10 Enterprise build 26200, Node v24.18.0; failed after 7m9s.

• Remote and transport: no SSH remote. Exact inputs came from nodejs.org/dist/v24.18.0; no release publication or Windows artifact upload occurred.

• Exact commands:

  gh run view 29340686444 --repo stablyai/orca \
    --json databaseId,headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/87111302431/logs | \
    rg -n -C 25 "SSH relay runtime verification failed|durationMs|contentId|Process completed with exit code"
  gh api repos/stablyai/orca/actions/jobs/87111302486/logs | \
    rg -n -C 25 "SSH relay runtime verification failed|durationMs|contentId|Process completed with exit code"
  gh api --paginate repos/stablyai/orca/actions/runs/29340686444/artifacts
  

• Result: FAIL at the native bundled smoke on both architectures. Each runner passed all seven contract suites with 21 passing and one intentionally skipped test, authenticated the exact Node checksum/signature plus ZIP/headers/import library, compiled the patched native modules, assembled and reinspected a 60-entry/42-file deterministic-format ZIP, and entered verification's smoke only after archive/tree integrity checks. X64 produced a 37,212,065-byte ZIP expanding to 97,248,414 bytes, content ID 90823b2c6bf7dad748a4399fe74fdfa8be82ef4a00d727e3a6be173f274fd43f, archive SHA-256 ee7634dea179026b3ba8232294016d939e32edc34e1fd3697dd9e11722285d6a, and 146,511.617 ms build duration. Arm64 produced a 33,261,531-byte ZIP expanding to 86,189,740 bytes, content ID 09ec2772bb8c47ee240fd226963b7e251a8060e7f84321cb24d2668bf993e2ca, archive SHA-256 5cb50521ec88d491f1a4183fc13f0b0f688e242e290038c4d34e0125d8e8b2c2, and 176,108.728 ms build duration.

• Failure boundary: each bundled-Node smoke exceeded the parent command's 45-second timeout. The child already bounds PTY and watcher waits at 15 seconds and writes its classified failure to stderr, but verify-ssh-relay-runtime.mjs currently reports only the generic execFile stack. The logs therefore cannot distinguish PTY, watcher, cleanup-handle, or combined failure. Upload remained skipped. Smoke RSS, channel/file counts, and cancellation settlement were not emitted.

• Oracle proved: the GPG relative-path correction works through real Git-for-Windows GPG on native x64 and arm64; signed-input gating, offline native build inputs, patched native compilation, bundled Node v24.18.0 staging, ZIP construction/inspection, and pre-execution archive/tree gates all precede the failing smoke. The four POSIX jobs remain green on the exact same source head.

• Does not prove: successful Windows PTY/ConPTY/watcher execution, which smoke substage failed, prompt child-process settlement, ZIP clean-rebuild identity, durable Windows artifact bytes, native trust/signing, oldest baseline, SSH, or any enabled tuple.

• Checklist items satisfied: native GPG path portability and pre-smoke Windows assembly progression only. Windows per-tuple cells remain unchecked because executable smoke and artifact retention did not pass.

• Follow-up: preserve bounded child stdout, stderr, timeout, exit, and signal details in the parent diagnostic; add a failure-path unit test; rerun x64 first and change no PTY/watcher behavior until the classified child failure is visible.

E-M3-WINDOWS-SMOKE-DIAGNOSTIC-RED-001 — Bounded child-detail propagation red gate

• Date: 2026-07-14
• Commit SHA / PR: red test introduced before its implementation in 3aab5aff8; exact base 42aa02fa9eccf81e40d80f87461ddd232a1cda1f; draft PR #8741
• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0
• Remote and transport: none; synthetic child-process error object only
• Exact command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-artifact.test.mjs
• Result: expected FAIL; the new diagnostic test failed and three existing tests passed in 239 ms because formatSshRelayRuntimeSmokeFailure did not exist. The required oracle supplies timeout, exit/signal state, partial stdout, and a greater-than-limit stderr whose final classified failure must survive explicit truncation.
• Oracle proved: existing parent diagnostics cannot satisfy the bounded failure-detail contract and the new test discriminates both missing metadata and unbounded/error-tail-losing implementations.
• Does not prove: child execution, Windows behavior, the actual PTY/watcher failure, cleanup settlement, or any tuple support.
• Checklist items satisfied: red half of the smoke-diagnostic correction only.
• Follow-up: implement a 64-KiB tail-preserving formatter around the already 4-MiB-bounded child process, wrap execFile failure with it, and rerun focused/static gates before native x64 CI.

E-M3-WINDOWS-SMOKE-DIAGNOSTIC-LOCAL-001 — Bounded child-detail propagation correction

• Date: 2026-07-14

• Commit SHA / PR: implementation commit 3aab5aff8 on exact base 42aa02fa9eccf81e40d80f87461ddd232a1cda1f; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. Exact-head Node 24 CI remains authoritative.

• Remote and transport: none; synthetic child-process error plus local artifact contracts

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-artifact.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/verify-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs
  pnpm exec oxlint
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html
  git diff --check
  

• Result: PASS. The focused artifact suite passed 4/4 tests in 194 ms; all seven artifact suites passed 23/23 tests in 293 ms. Typecheck, focused and full oxlint, max-lines ratchet, full lint/reliability/localization gates, plan formatting, and diff whitespace passed. Full lint reported only existing warnings outside this package and used the recorded GOMAXPROCS=2 stability constraint.

• Oracle proved: any failed bundled-smoke child now propagates the declared 45-second parent timeout, exit code, kill state, signal, message, stdout, and stderr; each stream retains at most its final 64 KiB with an explicit omitted-byte count. The real command remains capped at 4 MiB and no success-path parsing or smoke behavior changed.

• Does not prove: real child failure propagation on Windows, which PTY/watcher stage fails, process-tree settlement after timeout, successful native smoke, or any tuple support.

• Checklist items satisfied: local green half of the bounded smoke-diagnostic correction only.

• Follow-up: rerun native Windows x64, capture the classified child tail, and make no execution-path change until that evidence identifies the actual failure.

E-M3-WINDOWS-SMOKE-SETTLEMENT-CI-RED-001 — Native Windows smoke succeeds but does not settle

• Date: 2026-07-14

• Commit SHA / PR: exact workflow head df661e370102b9b66c26f4c708e641abef0aa1ae; draft PR #8741

• Runners and jobs: GitHub Actions run 29341643555; Windows x64 job 87114639412, windows-2022 image 20260706.237.1, Windows Server 2022 10.0.20348, native x64, Node v24.18.0; Windows arm64 job 87114639449, windows-11-arm64 image 20260706.102.1, Windows 11 Enterprise 10.0.26200, native arm64, Node v24.18.0

• Remote and transport: no SSH remote; target-native artifact build and bundled-runtime execution on the hosted runner; exact signed inputs downloaded from pinned nodejs.org URLs

• Exact command:

  gh api repos/stablyai/orca/actions/jobs/87114639412/logs | \
    rg -n -C 16 'Bundled runtime smoke command failed|timeoutMs=|Image:|Version:'
  gh api repos/stablyai/orca/actions/jobs/87114639449/logs | \
    rg -n -C 16 'Bundled runtime smoke command failed|timeoutMs=|Image:|Version:'
  

• Result: expected discriminating FAIL. The exact signed inputs, offline native build, archive and complete-tree verification all passed. Bundled Node v24.18.0/ABI 137 then completed the patched ConPTY smoke with exit 23, 101×37 resize, input marker, and both native modules loaded from build/Release; watcher create, update, rename-as-delete/create, and delete also completed. The x64 child emitted valid JSON after 3,357.413 ms with 56,905,728-byte RSS; arm64 emitted the same functional result after 6,593.663 ms with 54,505,472-byte RSS. Both remained alive until the parent killed them at 45 seconds (code=null, killed=true, signal="SIGTERM", empty stderr).

• Artifact metrics: x64 content ID sha256:8cf9eb4e04459e25d710a28235a57e777d39f65168841c2408ab658243a21d94; ZIP 37,212,068 bytes with SHA-256 sha256:11f83971ed20cde7be41aa2f753cfd4350cd4a70a3fe46a27540ebc872c4ca56; build 151,226.208 ms. Arm64 content ID sha256:dda60b6237b320c74236f57bece072d0f847479eb322f43f22c829daf2ce9bf6; ZIP 33,261,533 bytes with SHA-256 sha256:f3fefed7b959fb6c3945170e8f0f7d2766cf26240aef9928b0e25770e5b19a26; 86,189,740 expanded bytes; build 248,307.259 ms. Uploads remained skipped because prompt process settlement is part of executable proof.

• Oracle proved: Windows x64 and arm64 PTY/ConPTY and watcher functionality succeeds through each exact bundled runtime, and the common remaining failure occurs after successful JSON emission in child-process handle settlement rather than in PTY, watcher, archive, or tree validation.

• Does not prove: prompt cleanup, durable artifact upload, clean-rebuild identity, native trust/signing, oldest baseline, SSH, or any enabled tuple. Both per-tuple rows remain unchecked until the child exits normally and exact-head CI retains each artifact.

• Follow-up: retain and dispose the PTY listener subscriptions, call the supported Windows terminal cleanup after a validated successful exit, and prove normal child settlement without process.exit() on both native architectures.

E-M3-WINDOWS-SMOKE-SETTLEMENT-LOCAL-RED-001 — PTY lifecycle cleanup contract red gate

• Date: 2026-07-14
• Commit SHA / PR: uncommitted contract test and behavior-preserving PTY-smoke module extraction on exact base df661e370102b9b66c26f4c708e641abef0aa1ae; draft PR #8741
• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0
• Remote and transport: none; injected terminal/listener lifecycle only
• Exact command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-pty-smoke.test.mjs
• Result: expected FAIL in 122 ms. The Windows success case returned a valid exit result but called terminal.kill() zero times; the POSIX success case and Windows case both disposed zero of their three onData/onExit subscriptions. Two tests failed, with no timeout or synthetic forced exit.
• Oracle proved: the current success path lacks the exact listener and ConPTY cleanup operations required by the native x64 diagnostic, and the purpose-named suite distinguishes Windows-only terminal cleanup from platform-neutral listener disposal.
• Does not prove: the green implementation, actual Windows handle release, timeout/error cleanup, full child-process settlement, arm64 behavior, or any tuple support.
• Checklist items satisfied: red half of the Windows PTY smoke-settlement correction only.
• Follow-up: add idempotent finally cleanup, preserve successful POSIX no-kill behavior, rerun this suite and all artifact/static gates, then require exact-head native Windows CI.

E-M3-WINDOWS-SMOKE-SETTLEMENT-LOCAL-001 — Explicit PTY resource settlement

• Date: 2026-07-14

• Commit SHA / PR: implementation commit ddf28eb8dba3ade4806082cfc5edd6526389cf94; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. Exact-head Node 24 native CI remains authoritative.

• Remote and transport: none; injected terminal lifecycle plus local source/static verification

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-runtime-smoke-child.cjs \
    config/scripts/ssh-relay-runtime-pty-smoke.cjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-smoke-child.cjs \
    config/scripts/ssh-relay-runtime-pty-smoke.cjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. The lifecycle suite passed 2/2 tests in 117 ms; the eight artifact suites passed 25/25 tests in 417 ms. Typecheck, focused oxlint, max-lines ratchet, full lint/reliability/localization checks, formatting, and diff whitespace passed. Full lint reported only pre-existing warnings outside this package.

• Oracle proved: the success path retains and disposes both data subscriptions and the exit subscription exactly once; a validated Windows exit additionally calls the supported node-pty terminal cleanup exactly once, while a successful POSIX exit does not kill its terminal. Cleanup is in finally, the existing timeout/error path still kills the terminal, and no process.exit() was introduced. Both native workflow families now run the lifecycle contract.

• Does not prove: actual Windows ConPTY handle release, prompt bundled child-process exit, exact-head Node 24 behavior, artifact retention, clean-rebuild identity, native trust, oldest baseline, SSH, or any enabled tuple. Both Windows per-tuple cells remain unchecked.

• Checklist items satisfied: local green half of the PTY smoke-settlement correction and its purpose-named verification-command inventory only.

• Follow-up: commit and push the isolated correction, run both target-native Windows jobs at the exact head, and require normal smoke completion plus artifact upload before advancing.

E-M3-WINDOWS-SMOKE-SETTLEMENT-CI-RED-002 — Explicit PTY cleanup is insufficient on native x64

• Date: 2026-07-14
• Commit SHA / PR: exact workflow head b6291e55b1781b4c4e6f46a4965152f4a0d2334f, containing PTY settlement implementation ddf28eb8dba3ade4806082cfc5edd6526389cf94; draft PR #8741
• Runners and jobs: GitHub Actions run 29342918504; Windows x64 job 87119092333, windows-2022 native x64 with Node v24.18.0; Windows arm64 job 87119092293, windows-11-arm64 native arm64 with Node v24.18.0
• Remote and transport: no SSH remote; target-native artifact build and bundled-runtime execution
• Exact commands: gh api repos/stablyai/orca/actions/jobs/87119092333/logs | rg -n -C 20 'SSH relay runtime verification failed|timeoutMs=|durationMs|rssBytes|contentId' and the same command for job 87119092293
• Result: expected discriminating FAIL. The new 25/25 contract suite passed, followed by signed inputs, offline native compilation, archive/tree inspection, and functional bundled smoke. The child emitted PTY exit 23, 101×37 resize, input, patched native paths, all watcher events, and valid JSON in 3,344.690 ms with 59,699,200-byte RSS, then again remained alive until the parent killed it at 45 seconds with empty stderr. ZIP size was 37,212,067 bytes, content ID sha256:68a49782761c411494e677be9c2dc5038fb4f85f066316edc7b92ee25a3c3fbd, archive SHA-256 sha256:11688158da540cdfa1e10e5f632dac7487adf61e600e46d3fb0303fa42fc15b6, and build duration 139,167.307 ms. Artifact upload remained skipped.
• Arm64 result: the same valid PTY/watcher JSON arrived in 3,772.018 ms with 54,095,872-byte RSS, followed by the identical 45-second timeout and empty stderr. ZIP size was 33,261,534 bytes, content ID sha256:cff683eba32500f95d4a1a87d8f8a8eaf06613753b75d8eff55ccce23a0160c6, archive SHA-256 sha256:12640e6003547cf94f6ab13c6fdecb6373254b724fb561aa38023a3d33b5fa17, and build duration 155,781.418 ms. Upload remained skipped.
• Oracle proved: disposing all public PTY subscriptions and calling public Windows terminal cleanup after validated exit does not by itself settle the bundled child. The failure remains post-smoke and is not a PTY/watcher functional failure, but the retained resource type is still unknown.
• Does not prove: which PTY worker/socket, watcher, stdio, timer, or other resource remains; safe dependency-level remediation; normal child exit; artifact retention; or any tuple.
• Checklist items satisfied: none beyond a new native red boundary; Windows rows remain unchecked.
• Follow-up: emit bounded process.getActiveResourcesInfo() data after all smoke cleanup, retain it through the existing parent diagnostic, and make no further cleanup change until the resource class is visible on native Windows.

E-M3-WINDOWS-RESOURCE-DIAGNOSTIC-LOCAL-001 — Bounded post-cleanup resource observation

• Date: 2026-07-14

• Commit SHA / PR: diagnostic implementation commit 6bba900209543a53b7673ca12173159d40d9fc87; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. Native Windows classification remains authoritative.

• Remote and transport: none; injected public active-resource lists plus local source/static gates

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-runtime-resource-diagnostics.cjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-smoke-child.cjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-resource-diagnostics.cjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-smoke-child.cjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. The resource/PTY/workflow slice passed 6/6 tests in 173 ms; all nine artifact suites passed 27/27 tests in 297 ms. Typecheck, focused oxlint, max-lines, full lint/reliability/localization, formatting, and whitespace gates passed with only existing out-of-package lint warnings.

• Oracle proved: Windows diagnostics use the public process.getActiveResourcesInfo() API, retain only at most 256 resource type strings capped at 128 characters, report omitted counts, and take snapshots immediately after all functional cleanup and after a two-second drain window. POSIX smoke receives neither the delay nor a resource probe. Both native workflow families run the contract.

• Does not prove: the actual retained native Windows resource types, whether the culprit is PTY or watcher state, safe cleanup, normal child exit, artifact retention, or any tuple.

• Checklist items satisfied: bounded local diagnostic contract and verification-command inventory only; no behavior, matrix, or tuple item.

• Follow-up: commit and push the diagnostic, capture both native Windows snapshots through the existing 45-second failure formatter, then change only the resource owner identified by evidence.

E-M3-WINDOWS-RESOURCE-DIAGNOSTIC-CI-RED-001 — Native Windows retains one MessagePort

• Date: 2026-07-14

• Commit SHA / PR: exact workflow head 2aaea70465dc80ced2ba4662b5bc1475a9c2f8c5, containing bounded diagnostic implementation 6bba900209543a53b7673ca12173159d40d9fc87; draft PR #8741

• Runners and jobs: GitHub Actions run 29343816558; Windows x64 job 87122172498, windows-2022 image 20260706.237.1, native x64, runner 2.335.1; Windows arm64 job 87122172553, windows-11-arm64 image 20260706.102.1, native arm64, runner 2.335.1

• Remote and transport: no SSH remote; target-native artifact build and bundled-runtime execution

• Exact commands:

  gh api 'repos/stablyai/orca/actions/runs/29343816558/jobs?per_page=100' \
    --jq '.jobs[] | [.id,.name,.status,.conclusion,.head_sha,.html_url] | @tsv'
  gh api repos/stablyai/orca/actions/jobs/87122172498/logs | \
    rg -n -C 10 'resourceSettlement|Bundled runtime smoke command failed|timeoutMs=|contentId|durationMs|rssBytes'
  gh api repos/stablyai/orca/actions/jobs/87122172553/logs | \
    rg -n -C 10 'resourceSettlement|Bundled runtime smoke command failed|timeoutMs=|contentId|durationMs|rssBytes'
  

• Result: expected discriminating FAIL on both Windows jobs after 27/27 contract tests, exact signed inputs, offline native compilation, archive/tree inspection, and valid functional smoke output. Immediately after smoke each child reported three PipeWrap resources plus one MessagePort; after the two-second observation window one PipeWrap settled but the MessagePort remained. Each child then remained alive until the unchanged 45-second parent timeout sent SIGTERM.

• X64 metrics: functional smoke completed in 5,368.1555 ms with 60,022,784-byte RSS. The ZIP was 37,212,066 bytes with content ID sha256:4ee246445ad65eec49b70fceab92fbd954de2f7fd8608a0646cc9a79ce53e69a, archive SHA-256 sha256:20c98e2db2aaa9245fb2c632d37c4963e70f65a0e5257aff4e196dc64fb984dd, and build duration 143,545.9941 ms.

• Arm64 metrics: functional smoke completed in 5,873.1038 ms with 54,059,008-byte RSS. The ZIP was 33,261,530 bytes with content ID sha256:9418590ffa09d21145dd1ff4d8492d1ff8b0328df496e300edec1969365df3a3, archive SHA-256 sha256:52477f9714e7ac38b9f40ce5642b7f1c9e838f98af48387c7a88ef53b1dcf385, and build duration 169,800.5025 ms.

• POSIX control: Linux x64/arm64 and macOS x64/arm64 jobs at the same exact head all completed successfully; the Windows-only observation did not add a POSIX delay or resource probe.

• Oracle proved: the retained native resource class is one persistent MessagePort on both Windows architectures after successful PTY/ConPTY/watcher behavior and public PTY cleanup. The remaining PipeWrap resources are the smoke child's parent stdio and are not sufficient to explain the Windows-only non-exit because the same child-process boundary exits on POSIX.

• Does not prove: which dependency object owns the MessagePort, a safe correction, normal Windows child exit, uploaded artifact retention, clean-rebuild identity, native trust, SSH, or any tuple. Both Windows executable cells remain unchecked.

• Checklist items satisfied: native resource classification only.

• Follow-up: inspect the copied node-pty ConPTY worker lifecycle, add an exact-source fail-closed transform contract scoped to Windows artifact staging, then require both native jobs to exit and upload unpublished evidence before advancing.

E-M3-WINDOWS-CONPTY-WORKER-LOCAL-RED-001 — Copied-source settlement contract red gate

• Date: 2026-07-14
• Commit SHA / PR: uncommitted red-test working tree based on 2aaea70465dc80ced2ba4662b5bc1475a9c2f8c5; draft PR #8741
• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. Node 24 and native Windows remain the authoritative artifact environments.
• Remote and transport: none; synthetic copied-source fixtures only
• Exact command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs
• Result: expected discriminating FAIL, 4/4 tests failed in 136 ms. The copied Windows source was unchanged, POSIX returned no explicit no-op result, and missing/duplicate source patterns did not fail closed.
• Oracle proved: the new contract failed for each missing behavior before the correction existed.
• Does not prove: the green transform, production wiring, native Windows execution, prompt worker settlement, or any tuple.
• Checklist items satisfied: red half of the copied ConPTY worker settlement correction only.
• Follow-up: implement the exact one-match transform against exclusive artifact staging and rerun focused, artifact, and repository gates.

E-M3-WINDOWS-CONPTY-WORKER-LOCAL-001 — Fail-closed artifact-only worker settlement

• Date: 2026-07-14

• Commit SHA / PR: implementation commit c04b4f630; draft PR #8741

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0. Node 24 and native Windows remain the authoritative artifact environments.

• Remote and transport: none; pinned installed node-pty source, synthetic source-drift fixtures, workflow contract, and repository static gates

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    .github/workflows/ssh-relay-runtime-artifacts.yml
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. The purpose-named suite passed 5/5 tests in 124 ms; the settlement/PTY/resource/tree/ workflow slice passed 12/12 tests across five suites in 201 ms; all ten artifact suites passed 32/32 tests in 378 ms. Typecheck, focused oxlint, max-lines, full lint/reliability/localization, formatting, and whitespace gates passed with only existing out-of-package lint warnings.

• Duration and resource metrics: the combined repository static command completed in approximately 12.4 seconds. Peak memory and open-file counts were not instrumented by these local static tests.

• Oracle proved: the transform accepts the exact pinned installed node-pty source, starts the ConPTY Worker drain even when no later output arrives, preserves later-data timer resets, modifies only the copied Windows artifact source after exclusive staging, and does not inspect a POSIX copy. Missing, drifted, duplicate, or already-transformed source rejects before a write. Both native workflow families run the purpose-named contract. The repository-wide config/patches/node-pty@1.1.0.patch and legacy/default desktop node-pty behavior are unchanged.

• Does not prove: native Windows worker termination, normal smoke child exit, absence of a persistent MessagePort, artifact upload, reproducibility, native trust, oldest baseline, SSH, or any tuple.

• Checklist items satisfied: purpose-named local copied-source settlement contract and verification command inventory only; Windows executable rows remain unchecked.

• Follow-up: push the exact head and require both target-native Windows jobs to exit normally, show no persistent MessagePort after the observation window, and upload unpublished evidence.

E-M3-WINDOWS-CI-001 — Native Windows artifacts execute, settle, and upload

• Date: 2026-07-14

• Commit SHA / PR: exact workflow head d9a556b9c8b3d3a639d4fc93a8ba25926089d20f, containing implementation commit c04b4f630; draft PR #8741

• Run: GitHub Actions 29345126283, completed success with all six target-native jobs green

• Windows runners and jobs: x64 job 87126693074, windows-2022 image 20260706.237.1, Windows Server 2022 build 20348, native X64, Node v24.18.0; arm64 job 87126693105, windows-11-arm64 image 20260706.102.1, Windows build 26200, native ARM64, Node v24.18.0

• Remote and transport: no SSH remote; target-native artifact build, bundled-runtime execution, and GitHub Actions unpublished artifact upload

• Exact commands:

  gh run watch 29345126283 --repo stablyai/orca --interval 10 --exit-status
  gh api 'repos/stablyai/orca/actions/runs/29345126283/jobs?per_page=100' \
    --jq '.jobs[] | [.id,.name,.status,.conclusion,.started_at,.completed_at,.head_sha,.html_url] | @tsv'
  gh api repos/stablyai/orca/actions/jobs/87126693074/logs | \
    rg -n -C 12 'resourceSettlement|contentId|archive|durationMs|rssBytes|Artifact .* has been successfully uploaded'
  gh api repos/stablyai/orca/actions/jobs/87126693105/logs | \
    rg -n -C 12 'resourceSettlement|contentId|archive|durationMs|rssBytes|Artifact .* has been successfully uploaded'
  gh api 'repos/stablyai/orca/actions/runs/29345126283/artifacts?per_page=100' \
    --jq '.artifacts[] | [.id,.name,.size_in_bytes,.expired,.created_at,.archive_download_url] | @tsv'
  gh api repos/stablyai/orca/actions/artifacts/8315822805/zip > <temporary-x64-actions.zip>
  gh api repos/stablyai/orca/actions/artifacts/8315904862/zip > <temporary-arm64-actions.zip>
  shasum -a 256 <temporary-x64-actions.zip> <temporary-arm64-actions.zip>
  unzip -l <temporary-x64-actions.zip>
  unzip -p <temporary-x64-actions.zip> '*identity.json' | jq
  unzip -l <temporary-arm64-actions.zip>
  unzip -p <temporary-arm64-actions.zip> '*identity.json' | jq
  

• Result: PASS. Both Windows jobs passed 32/32 artifact contract tests, exact signed Node input verification, offline target-native compilation, exact archive/tree inspection, bundled Node v24.18.0, production-DLL ConPTY input/101×37 resize/exit 23, watcher lifecycle, normal child exit, and unpublished upload. Immediately after smoke, each child reported three PipeWrap resources, one MessagePort, and the diagnostic's own Timeout; after the two-second observation only the two parent stdio PipeWrap resources remained. No MessagePort or timer survived, and neither 45-second parent timeout fired.

• X64 metrics and bytes: build 135,657.3557 ms; full verification 6,495.1387 ms; smoke 5,353.5073 ms with 54,075,392-byte RSS. The 42-file ZIP was 37,212,121 bytes, expanded to 97,248,569 bytes, had content ID sha256:32efa708b1fbefb05a11b0de6703551e5680d64c8015bb956095db3b50292c92, and archive SHA-256 sha256:2ec9db55b5c417ea7ed9ab6cf5a960be4b9c305e68c68f8123a11dab0e3119a4. Uploaded artifact 8315822805 was 37,075,355 bytes and downloaded with SHA-256 d98d1c935514667ea5c48a160ef54b9674a93f995ca24df2c19759735c62eefb; total job duration was 4m06s.

• Arm64 metrics and bytes: build 190,135.9561 ms; full verification 7,908.8115 ms; smoke 5,874.805 ms with 51,843,072-byte RSS. The 42-file ZIP was 33,261,582 bytes, expanded to 86,189,895 bytes, had content ID sha256:e1d5eab84a7b1eb38d55acb9f87d852569995e22c47c02d202f29eb293467944, and archive SHA-256 sha256:577285df23333a3de89489dec52027afd76aeb9ef23f74ffb6d5706e06a75ae8. Uploaded artifact 8315904862 was 33,137,908 bytes and downloaded with SHA-256 77b78cb33117c8c8b4f5d639dada063651f7d303a815a097bfa36d9e651a2419; total job duration was 7m09s.

• POSIX control: Linux x64/arm64 and macOS x64/arm64 passed the same exact-head contract, build, verification, smoke, and unpublished upload steps. All six run artifacts exist with seven-day retention; no release asset was published.

• Oracle proved: the copied-source correction terminates the node-pty ConPTY worker on both native Windows architectures without masking the process with process.exit(), while preserving full PTY/watcher behavior and the four POSIX controls. The exact uploaded evidence contains the runtime ZIP, identity, SPDX SBOM, and provenance files.

• Does not prove: same-runner clean-rebuild identity, oldest baselines, Authenticode/native trust, SSH/SFTP/system-SSH transfer, relay RPC behavior, cancellation, publication, or any enabled tuple.

• Checklist items satisfied: Milestone 3 Windows conpty.dll/OpenConsole.exe production-path item; Windows x64 and arm64 build/provenance, bundled Node, real PTY, and watcher cells; target-native pre-upload inspection/smoke command.

• Follow-up: add and execute the separately gated same-head/same-runner two-clean-build identity oracle before oldest-baseline or trust work.

E-M3-RUNTIME-LOCAL-001 — First target-native Linux arm64 runtime artifact

• Date: 2026-07-14

• Commit SHA / PR: implementation commit f2b387b21bbe6a3863ff1a492a1a03b65e0a0477 in stacked draft PR #8741; native PR CI pending

• Runner: macOS 26.2 arm64 host with Docker Engine 29.2.1; native Linux/arm64 container node@sha256:032e78d7e54e352129831743737e3a83171d9cc5b5896f411649c597ce0b11ea (Debian bookworm, build Node v24.17.0), bundled Node v24.18.0 ABI 137, Python 3.11.2, GNU C++ 12.2.0, GNU strip 2.40, XZ Utils 5.4.1, GnuPG/gpgv 2.2.40

• Remote: none; native container artifact build/execution only, not an SSH host or oldest-baseline VM

• Transport/network: exact HTTPS downloads from nodejs.org/dist/v24.18.0; Debian package mirrors for build/signature-verification tools; no SSH, SFTP, system SSH, release upload, or remote egress

• Exact command:

  docker run --rm \
    -v "$PWD:/workspace" \
    -v /tmp/orca-runtime-linux-arm64-v3:/evidence \
    -w /workspace \
    node@sha256:032e78d7e54e352129831743737e3a83171d9cc5b5896f411649c597ce0b11ea \
    bash -lc 'set -euo pipefail
      apt-get update -qq
      DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential ca-certificates curl gnupg gpgv python3 xz-utils >/dev/null
      mkdir -p /tmp/node-inputs
      base=https://nodejs.org/dist/v24.18.0
      for asset in SHASUMS256.txt SHASUMS256.txt.sig node-v24.18.0-linux-arm64.tar.xz; do
        curl --fail --silent --show-error --location --proto "=https" --tlsv1.2 \
          --connect-timeout 20 --max-time 300 --retry 2 --retry-delay 2 --retry-all-errors \
          "$base/$asset" --output "/tmp/node-inputs/$asset"
      done
      output=/evidence/new-parent/artifact
      node config/scripts/build-ssh-relay-runtime.mjs --tuple linux-arm64-glibc --inputs-directory /tmp/node-inputs --output-directory "$output" --source-date-epoch 1784030321 --git-commit 0c299fe189310b6dbd539f0f0f506b240524ba6a
      identity="$output/orca-ssh-relay-runtime-linux-arm64-glibc.identity.json"
      archive=$(find "$output" -maxdepth 1 -name "*.tar.xz" -print -quit)
      node config/scripts/verify-ssh-relay-runtime.mjs --runtime-directory "$output/runtime" --identity "$identity" --archive "$archive"'
  

  A second clean createSshRelayRuntimeArchive invocation used the same runtime tree, SOURCE_DATE_EPOCH, container digest, Node tar implementation, and XZ 5.4.1, followed by cmp and sha256sum against the first archive.

• Result: PASS. The target-native build authenticated the official Node metadata/archive, inspected 5,774 upstream tar entries before selective extraction, executed Node v24.18.0, source-built Orca-patched node-pty@1.1.0 against the exact Node 24 headers, stripped the resulting Linux addon, copied exactly one Linux arm64 glibc watcher native package, and preserved the existing relay/watcher content hash. Full archive and unpacked-tree verification agreed on content ID sha256:cf0acba7a8839d5ee422755562ce30ffa4433a663991054d0b5d9681ebc54832. The bundled runtime produced PTY input, 101×37 resize, and exit code 23 plus watcher create, update, rename-as-delete/create, and delete events. The same tree repacked byte-for-byte identically: both archives hashed to sha256:b1b9857a42d45a068f03f2484f98fcebe82b3d21ddd53eac7d0bdabf494a7f9e.

• Duration and resource metrics: exclusive artifact staging to finalized identity took 138.666 seconds based on output birth/finalization timestamps; deterministic repack compression took approximately 109 seconds; full archive/tree/native verification took 3,746.221 ms; bundled PTY/watcher smoke took 248.879 ms with 35,328,000-byte RSS. The archive is 28,192,132 bytes, expands to 122,865,156 bytes, and contains 34 files/49 total entries. Build peak memory, open-file count, and cancellation settlement were not instrumented and remain CI follow-ups. After adding bounded native-command/xz execution, compressed-size prechecks, exact mode verification, frozen installs, and automatic parent creation, a fresh build into the previously absent /evidence/new-parent/artifact completed in 89,580.560 ms and retained the exact content/archive hashes above; verification took 3,515.039 ms and smoke took 192.609 ms with 34,885,632-byte RSS.

• Artifact/log/trace link: unpublished local artifact directory /tmp/orca-runtime-linux-arm64-v3/new-parent/artifact; archive hash above; SBOM hash sha256:27f81b5650b088dc8e01563b0229c978f8ea05828e90a1a4fd0d11640d6cc54a; provenance hash sha256:dc1433c481b57de44929248ddb033f2a35bfdb40fc32d9f442b9d8f8ed7f816c; identity hash sha256:95b4ca6bcce846c65c6b15c35df548db0598d8156aee1c54c196b95f998824a6.

• Oracle proved: one native Linux arm64 glibc artifact-only build; exact official Node signature and archive input; bounded source-tar inspection; exclusive selective extraction; Node-ABI-matched patched node-pty; one correct watcher package; runtime-only JavaScript/license closure; SPDX SBOM/provenance/identity assets; executable modes; deterministic tar.xz; exact archive/tree hashes; and direct bundled Node/native PTY/watcher execution before any upload.

• Does not prove: GitHub runner reproducibility, Linux x64, macOS, Windows/zip, musl, oldest glibc or kernel, native code signing/trust, quarantine/Gatekeeper/WDAC/AV, SSH/SFTP/system-SSH transfer, relay RPC conformance, cancellation/file-handle/peak-memory budgets, release publication, cache, fallback, UI, or any enabled tuple. Docker Desktop architecture is native arm64 but this is not an approved oldest-baseline or cross-family remote cell. The verified official Node binary reports upstream debug metadata and was intentionally preserved byte-for-byte; only Orca-built pty.node was stripped. Both plan artifacts now state that precedence explicitly.

• Checklist items satisfied: named assembly script; POSIX deterministic archive; pre-archive mode verification; local POSIX archive/smoke commands; Linux arm64 build/provenance, bundled Node, patched real PTY, and watcher cells only.

• Follow-up: run .github/workflows/ssh-relay-runtime-artifacts.yml on the exact draft-PR head, record resolved runner image identities and artifacts, implement Windows zip/native assembly separately, and leave every tuple disabled until oldest-baseline, trust, and both live SSH layers are complete.

E-M3-STATIC-001 — Work Package 2 focused and repository static gates

• Date: 2026-07-14

• Commit SHA / PR: implementation commit f2b387b21bbe6a3863ff1a492a1a03b65e0a0477 in stacked draft PR #8741; native PR CI pending

• Runner: macOS 26.2 arm64; Node v26.0.0 and pnpm 10.24.0

• Remote and transport: not applicable; local source/static verification only

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/*ssh-relay* config/ssh-relay-node-release-v24.18.0.json
  pnpm run check:max-lines-ratchet
  git diff --check
  

• Result: PASS. Four focused suites passed 15/15 tests in 993 ms; typecheck passed; repository lint passed with only pre-existing warnings outside Work Package 2; formatting passed for 20 matched files; max-lines reported 355 grandfathered suppressions and no new bypass; diff check passed.

• Duration and resource metrics: full lint completed in 20.438 seconds. Peak memory, open files, and cancellation settlement were not instrumented by these static commands.

• Artifact/log/trace link: purpose-named tests and local command output; durable GitHub job links are pending the draft PR.

• Oracle proved: hostile release-input/archive cases, canonical identity parity, deterministic archive/exact-tree and permission rejection, workflow runner/action/no-publication/frozen-install contracts, compilation, repository lint policy, formatting, line budget, and whitespace safety.

• Does not prove: Node 24 source-tool execution, target-native runners beyond E-M3-RUNTIME-LOCAL-001, macOS/x64, signing/trust, oldest baselines, SSH transfer, relay RPCs, publication, cancellation settlement, or any enabled tuple. The exact workflow head and Node 24 gates require PR CI.

• Checklist items satisfied: current Work Package 2 local handoff/static gate only.

• Follow-up: create the isolated stacked draft PR, run the four target-native POSIX jobs, and replace uncommitted/local evidence with exact commit, run, job, image, artifact, and duration identifiers.

E-M3-CI-RED-001 — Native macOS watcher path-oracle failure

• Date: 2026-07-14

• Commit SHA / PR: exact draft-PR head f8a230ef301fc6f2bb76082f549e3b3ae725c142 in #8741

• Runner and jobs: GitHub Actions run 29335018198; macOS arm64 job 87092056703 used macos-15-arm64 image 20260706.0213.1, macOS 15.7.7, runner arm64, and Node v24.18.0; macOS x64 job 87092056769 used macos-15 image 20260629.0276.1, runner x64, and Node v24.18.0

• Remote and transport: no SSH remote; target-native artifact build and local execution on each hosted runner; Node inputs downloaded from the exact pinned nodejs.org URLs

• Exact workflow/log commands:

  gh run watch 29335018198 --repo stablyai/orca --exit-status --interval 10
  gh api -H 'Accept: application/vnd.github+json' \
    repos/stablyai/orca/actions/jobs/87092056703/logs
  gh api -H 'Accept: application/vnd.github+json' \
    repos/stablyai/orca/actions/jobs/87092056769/logs
  

• Result: expected discriminating FAIL. Both macOS jobs passed exact-head checkout, Node 24 setup, frozen dependency install, 15/15 contract tests, authenticated Node input download, target-native Node/node-pty/watcher assembly, deterministic archive inspection, and full tree hashing. Native smoke then timed out after 15 seconds waiting for watcher create; evidence upload correctly did not run. Both Linux jobs completed build, verification, smoke, and unpublished upload, but their cells remain provisional until the corrected exact-head matrix reruns.

• Duration and resource metrics: macOS arm64 job failed in 1m51s after a 54,699.324 ms artifact build; macOS x64 failed in 3m44s after a 105,665.482 ms artifact build. Each watcher wait settled at its declared 15-second bound. Peak memory and open-file counts were not recorded in the failed macOS smoke because no success payload was emitted.

• Artifact/log/trace link: run and job links above. The arm64 pre-smoke artifact had content ID sha256:cc205af32168718f9662e8513338ad844ba4c1210c247623d84f92778afa1610 and archive hash sha256:cd9cca6f56c9645a73b6b022515668ef7392c2eeb8f01d63b8a46b046cf337a3; the x64 pre-smoke artifact had content ID sha256:82a7017f6c1f703258a9d6b9f3d5ad4d5c57320f1b667fd87902cb1f4cd21cd3 and archive hash sha256:88670165fcdf55236fb2a81d70566b913b39824362b5cf5f0136e646bf9c9b2c.

• Oracle proved: the native matrix and exact-head provenance gates discriminate after successful builds; macOS FSEvents can report canonical /private/var/... paths while tmpdir() supplied the /var/... symlink spelling, so the equality oracle could reject the same filesystem object.

• Does not prove: a passing macOS watcher, upload, native trust/signing, oldest baseline, SSH, relay RPCs, Windows, or any enabled tuple. Successful Linux results from this failed aggregate do not satisfy the final corrected-head evidence requirement.

• Checklist items satisfied: red half of the macOS target-native watcher-smoke gate only; no tuple checkbox was changed.

• Follow-up: canonicalize the watched temporary directory before constructing expected event paths, retain bounded observed-event diagnostics, rerun all four jobs, and require every upload to pass.

E-M3-CI-001 — Corrected four-tuple POSIX native artifact run

• Date: 2026-07-14

• Commit SHA / PR: exact draft-PR head 151628992f8d05d11902604650b3ed884992da5c in #8741

• Workflow: GitHub Actions run 29335399279, conclusion success; no release asset was published

• Exact evidence commands:

  gh run view 29335399279 --repo stablyai/orca --json databaseId,headSha,status,conclusion,url,jobs
  gh run view 29335399279 --repo stablyai/orca --job <job-id> --log
  gh api --paginate repos/stablyai/orca/actions/runs/29335399279/artifacts
  gh api repos/stablyai/orca/actions/artifacts/<artifact-id>/zip
  unzip -p <downloaded-artifact.zip> '*.identity.json' | jq
  

• Native runner, artifact, identity, and resource results:

  Tuple	Job / requested runner / resolved image	Artifact ID / Actions ZIP bytes	Runtime archive bytes / expanded bytes / files	Content ID / archive SHA-256	Build / full verify / smoke / RSS
  darwin-arm64	87093265074; macos-15; macos15 20260706.0213.1; native ARM64	8311761833; 24,755,748	24,742,840 / 122,027,869 / 35	16a9814a2af4adfbcce55ead3ab53f3982d8043d4b18d85762586212a481bdca / a7e31f92c1a0793b656f79ceff5fe63b7a1cf56a70394336a92c2ab207d30ea7	52,648.921 ms / 2,090.791 ms / 556.324 ms / 51,068,928 bytes
  darwin-x64	87093265143; macos-15-intel; macos15 20260629.0276.1; native X64	8311834044; 26,420,360	26,405,780 / 124,316,655 / 35	ad3a4cdaf25cd8f2657e348fca5c68df69923f9f50295afa2227a8c195e2014b / 9b6c492b4fda250c6b6688e343499e79afc7ca53be355b1e687e61ed8430a759	108,328.464 ms / 1,956.297 ms / 325.008 ms / 40,546,304 bytes
  linux-x64-glibc	87093265139; ubuntu-24.04; ubuntu24 20260705.232.1; native X64	8311766570; 29,276,673	29,260,688 / 124,846,502 / 34	960546cd96c67fcf9bb0a61e96ecdbecbffd9104d3a495578f8bb19dd810649a / b28fc4837d17399246926ab4d565e30f21b6adc6c22401910627e820aca7c52b	61,805.875 ms / 2,288.790 ms / 159.950 ms / 56,315,904 bytes
  linux-arm64-glibc	87093265142; ubuntu-24.04-arm; ubuntu24 20260706.52.2; native ARM64	8311785832; 28,215,447	28,200,600 / 122,865,172 / 34	aa3aa8ae8b42334ba7b0dbe5c43fd1184e36b3f4f4a9bec0e990e9b78f090756 / d73d03c0507408e538b93549d449359e78c986c45f1bd5811c15197720fc5da8	69,030.100 ms / 1,618.140 ms / 159.037 ms / 52,219,904 bytes

• Result: PASS. All four jobs checked out the exact source head, used Node v24.18.0, authenticated the pinned Node release metadata and tuple archive, used a frozen source install, passed 15/15 focused contracts, assembled on the target-native architecture, verified the complete archive and unpacked tree before native execution, loaded the Orca-patched PTY addon, exercised a real PTY input/101×37 resize/exit-23 lifecycle, observed bounded create/update/rename/delete watcher events, and uploaded only an unpublished seven-day Actions artifact.

• Oracle proved: target-native build/provenance, bundled Node execution, patched native PTY load and lifecycle, watcher lifecycle, exact archive/tree equality, size bounds, and artifact-only workflow behavior for the four named POSIX tuples on the exact runner images above.

• Does not prove: deterministic native rebuilding. The local versus CI Linux arm64 runtime differed in the Orca-built pty.node, and the red versus corrected macOS runs produced different content identities despite no intended runtime-tree source change. The current jobs record image and toolchain versions but do not pin all apt/Homebrew/compiler inputs or compare two clean native builds on the same runner. This evidence also does not prove oldest OS/libc/kernel baselines, native signing/trust, Windows/ZIP, musl, SSH/SFTP/system-SSH transfer, relay RPC conformance, cancellation/file/channel peaks, release publication/read-back, cache, fallback, UI, or any enabled tuple.

• Checklist items satisfied: build/provenance, bundled Node, real patched PTY, and watcher cells for linux-x64-glibc, linux-arm64-glibc, darwin-x64, and darwin-arm64 only. Oldest-baseline and native-trust cells remain unchecked.

• Follow-up: add a same-head/same-runner two-clean-build identity comparison, implement bounded deterministic Windows ZIP assembly and native Windows jobs, and leave all tuples disabled until the remaining trust, baseline, and two-layer live SSH gates pass.

E-M3-REPRODUCIBILITY-LOCAL-001 — Bounded two-clean-build identity oracle

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit c70e96374cafb681c52b3d60e42322ba5a76791c in stacked draft PR #8741; native PR CI pending

• Runner: macOS 26.2 build 25C56 arm64, native; Node v26.0.0 and pnpm 10.24.0. Node v24.18.0 on each target-native GitHub runner remains the authoritative artifact environment.

• Remote and transport: none; synthetic output trees and parsed GitHub Actions workflow only

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-runtime-reproducibility.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-reproducibility.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff HEAD^ --check
  

• Result: PASS. The purpose-named comparator/workflow command passed 10/10 tests in 200 ms; the complete artifact set passed 40/40 tests across 11 suites in 1.09 seconds. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, and exact-commit diff checks all exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: purpose suite 0.87 seconds wall; full artifact suite 3.02 seconds; typecheck 8.47 seconds; focused oxlint 1.94 seconds; max-lines 4.95 seconds; full lint 26.34 seconds; formatting 5.56 seconds; diff check 90 ms. Comparator file reads are incremental, bounded to 250 MiB per file and 500 MiB per output, with 6,000 entries, 512-byte paths, depth 40, a five-minute AbortSignal, and sequential tree walks. Peak RSS/open files were not instrumented for synthetic fixtures; native CI remains responsible for real artifact duration and size evidence.

• Artifact/log/trace link: exact source and test files in commit c70e96374; durable target-native run and job links pending

• Oracle proved: distinct real output roots are required; symlinks and special files reject before hashing; complete runtime/archive/identity/SPDX/provenance output is mandatory; archive bytes must match their identity; any path type, mode, size, or SHA-256 drift fails closed. Both POSIX and Windows jobs build and independently verify/smoke two exclusive outputs, compare only afterward, and copy/upload only the first verified equal output. The workflow retains read-only permissions, exact-head checkout, SHA-pinned actions, explicit runner labels, and no release publication path.

• Does not prove: any real native build is reproducible, Node v24 execution, compiler/linker determinism, Linux/macOS/Windows output equality, oldest baselines, native trust/signing, SSH, publication, transfer, cache, fallback, UI, or an enabled tuple.

• Checklist items satisfied: purpose-named local reproducibility/workflow command and exact-commit static handoff only; no per-tuple or native-trust checkbox changes.

• Follow-up: push the exact head, run all six native jobs, and record the exact differing path/field for every red result before correcting producer nondeterminism without weakening this oracle.

E-M3-REPRODUCIBILITY-CI-RED-001 — First native clean-build comparison

• Date: 2026-07-14

• Commit SHA / PR: exact head 09b047f4eee224b45ca337b46b8402016290a1a9 in stacked draft PR #8741

• Run and jobs: run 29347236627; Linux x64 87134028593, Linux arm64 87134028669, macOS arm64 87134028547, macOS x64 87134028651, Windows x64 87134028652, Windows arm64 87134028632

• Runners: ubuntu-24.04 x64, ubuntu-24.04-arm arm64, macos-15-intel x64, macos-15 arm64, windows-2022 x64, and windows-11-arm arm64; Node v24.18.0. The macOS arm64 failure ran on macOS 15.7.7 image 20260706.0213.1; the x64 failure ran on macOS 15.7.7 image 20260629.0276.1. Both used Xcode 16.4 build 16F6.

• Remote and transport: none; GitHub-hosted target-native artifact jobs only

• Exact evidence commands:

  gh run view 29347236627 --repo stablyai/orca \
    --json databaseId,headSha,status,conclusion,url,jobs
  gh api -H 'Accept: application/vnd.github+json' \
    repos/stablyai/orca/actions/jobs/<completed-job-id>/logs
  

• Result: Linux x64 and arm64 independently built, verified, smoked, compared equal, and uploaded unpublished evidence. macOS arm64 independently verified and smoked both outputs but failed the equality gate: content IDs were sha256:f1bbc1de26d6e9aae3899754c4ac4aea694ad9f5197fcf1c773e29fc50401129 and sha256:c26eba0226e73542a0cd7aec0ca5fa7e3809051453e40095e47fe9d154ba944f; archive digests/sizes were sha256:9cd56317ff03eb4e89a811e46736dc7558e447b9f0cd2d7e20fdeb5e5c40114a / 24,714,656 bytes and sha256:cde8fa92470fdf73ec02e8e6ebbf23417e43d98b465fa9c6bdea4373be8c3e84 / 24,714,700 bytes. macOS x64 likewise failed with content IDs sha256:b71d7d50bba78b6cf9e6dc24b006d48c709a784c7eb77f500e86ab5fe692690b and sha256:ceae81924c97c917855af864239b87a7d2eecc28de7d00c21c32c47c5385354f; archive digests/sizes were sha256:01f7d4c6d54241e211c5063b89e92a3511433b18a50cb643bbfbe0384546a50e / 26,384,540 bytes and sha256:f98dfdead87f4884382fedc3e3bff0197a3b2aa6981c38107e198cb38e8bdf67 / 26,384,576 bytes. The committed comparator first reported identity SHA-256 drift on both macOS architectures. Windows x64 and arm64 stopped before downloading Node inputs or building artifacts because Vitest collected zero comparator tests with SyntaxError: Invalid or unexpected token; the other 10 suites passed with 31 tests passed and one skipped.

• Duration and resource metrics: Linux build/compare steps completed in 125 seconds (x64) and 131 seconds (arm64); macOS arm64 failed after 123 seconds in the build/compare step. Windows contract suites completed in 1.54 seconds on arm64 and before artifact assembly on both architectures. Peak RSS, file/channel counts, and cancellation settlement were not instrumented by this gate.

• Artifact/log/trace link: run and job links above. The two Linux evidence artifacts are unpublished; failed cells uploaded no runtime artifact.

• Oracle proved: the equality gate accepts both Linux glibc tuples and detects real macOS clean-build drift; Windows contract collection fails before unverified artifact work can start. No asset was published and no production or default path changed.

• Does not prove: Windows parser correction, macOS producer determinism, oldest baselines, native trust/signing, SSH, SFTP/system-SSH, release publication, resolver/cache, transfer/install, fallback, UI, or any enabled tuple.

• Checklist items satisfied: none newly complete; native reproducibility remains open.

• Follow-up: remove the comparator shebang, add explicit native node --check gates, report runtime-tree drift before derived metadata, rerun all six jobs, and correct the macOS producer only after the exact differing runtime file is identified. Never ignore or normalize unequal bytes in the comparator.

E-M3-REPRODUCIBILITY-DIAGNOSTIC-LOCAL-001 — Windows parser and runtime-first drift diagnostics

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit e58913d1a571f4c578a7fe1dc51ef5c93e9b3136 in stacked draft PR #8741

• Runner: macOS 26.2 build 25C56 arm64, native; Node v26.0.0 and pnpm 10.24.0. Node v24.18.0 target-native GitHub execution remains pending.

• Remote and transport: none; local synthetic comparator fixtures and workflow source contract only

• Exact commands:

  node --check config/scripts/ssh-relay-runtime-reproducibility.mjs
  node --check config/scripts/ssh-relay-runtime-reproducibility.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-runtime-reproducibility.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-reproducibility.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. Both new files passed node --check; the purpose suite passed 11/11 tests; the complete artifact set passed 41/41 tests across 11 suites. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: syntax checks 60 ms and 50 ms; purpose suite 850 ms wall; complete artifact suite 1.27 seconds wall; typecheck 2.00 seconds; focused oxlint 480 ms; max-lines 780 ms; full lint 11.96 seconds. Synthetic fixture peak RSS/open files were not instrumented.

• Artifact/log/trace link: exact sources in commit e58913d1a; target-native rerun pending

• Oracle proved: the comparator and its test import parse locally without the shebang; both POSIX and Windows workflow contract stages run explicit syntax checks before Vitest or artifact inputs; a simultaneous runtime/identity drift reports the runtime-tree path first. The comparator still compares every byte and does not normalize or ignore drift.

• Does not prove: Windows x64/arm64 parsing, any native build, the differing macOS runtime path, macOS determinism, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or an enabled tuple.

• Checklist items satisfied: no native or tuple box; this closes only the local diagnostic correction required after E-M3-REPRODUCIBILITY-CI-RED-001.

• Follow-up: push the exact commit, rerun all six native jobs, require both Windows syntax checks to pass, and use the macOS runtime-first failure path to correct producer nondeterminism.

E-M3-REPRODUCIBILITY-DIAGNOSTIC-CI-RED-001 — Native drift paths isolated on all six runners

• Date: 2026-07-14

• Commit SHA / PR: exact head c62b0d0a9580b132fec5f11c3234a983503a011c; stacked draft PR #8741

• Run and jobs: run 29348424235, conclusion failure; Linux x64 87138091964, Linux arm64 87138091995, macOS arm64 87138091994, macOS x64 87138092013, Windows x64 87138091948, and Windows arm64 87138091977

• Runners: ubuntu-24.04 x64 image 20260705.232.1, ubuntu-24.04-arm arm64 image 20260706.52.2, macos-15 arm64 image 20260706.0213.1, macos-15-intel x64 image 20260629.0276.1, windows-2022 x64 image 20260706.237.1, and windows-11-arm arm64 image 20260706.102.1; all native and using Node v24.18.0

• Remote and transport: none; target-native artifact assembly/execution and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29348424235 --repo stablyai/orca \
    --json databaseId,headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh api -H 'Accept: application/vnd.github+json' \
    repos/stablyai/orca/actions/jobs/<job-id>/logs
  

• Result: FAIL as an evidence-producing native gate. Every POSIX runner passed 41/41 contracts; Windows passed 38 and skipped three POSIX-only tests. Linux x64 and arm64 built, verified, smoked, compared exactly, and uploaded unpublished artifacts 8317161547 and 8317164595. macOS arm64 first differed at runtime/node_modules/node-pty/build/Release/pty.node, with content IDs sha256:206de506d0499ded3c16913e28f76c528f5bead5214e6675ee4a5ee6bb0a642c and sha256:68e23c3608b3d3bc95d591e6f99a5126ab6a6b0066c84c8340f4bc4195e64ac8; macOS x64 differed at the same path with sha256:eda4590b97d003f9a94fb59595a84273f3660fb920d85ff699c9d7925c52a7a2 and sha256:701b4310acbeb1f7340d50b554cfe65e2802c5346aca0036aae4ebb3f974becf. Windows x64 first differed at runtime/node_modules/node-pty/build/Release/conpty_console_list.node, with content IDs sha256:df55ffd5a5614a61e5fd2ae8cd990f28b84b9a0d557df861989c92b9e66652eb and sha256:1bbf496013af3d0172a275ba48dcb1a054aeb1b17261b606ecdd4c2dd3ce95fb; Windows arm64 differed at the same path with sha256:4d93459ffefb8f8b8250c6b0267e34f04a9ac5b5f99b60671f484fb34054519a and sha256:844c6f07a92ed3602af74bba92c8c98047313b97080b668aeb0b3a51ef7d2db8.

• Duration and resource metrics: build/compare steps were 138 seconds for Linux x64, 132 seconds for Linux arm64, 100 seconds for macOS arm64, 301 seconds for macOS x64, 296 seconds for Windows x64, and 285 seconds for Windows arm64. Both builds in every failing cell completed bundled Node/native PTY/watcher smoke before comparison. Smoke RSS ranged from 40,615,936 to 53,633,024 bytes in failing cells. Peak build RSS, open files/channels, and cancellation settlement were not instrumented by this gate.

• Artifact/log/trace link: run/job links above; Linux x64 upload 8317161547 and Linux arm64 upload 8317164595; failing cells correctly uploaded nothing

• Oracle proved: the parser and runtime-first diagnostic corrections execute on all native runner families; Linux reproducibility remains green; macOS and Windows drift is inside native node-pty outputs rather than archive/identity derivation; rejected cells cannot upload or publish bytes.

• Does not prove: either linker correction, macOS/Windows equality, cross-run identity, oldest baselines, native trust/signing, SSH, transfer, publication, resolver/cache, fallback, UI, or an enabled tuple.

• Checklist items satisfied: no new completion checkbox; this closes only the diagnostic run and identifies the bounded producer corrections required next.

• Follow-up: retain the complete-output comparator, correct native producers without post-build normalization, and require a new same-head six-runner pass before advancing.

E-M3-REPRODUCIBILITY-LINKER-LOCAL-001 — Canonical work path and native linker correction

• Date: 2026-07-14

• Commit SHA / PR: implementation a09b02ec4e623cc8cac8ece089e4ff734014dd5b; canonical-path follow-up 3e433b3438e8e1aa11d2728e3f2258996b3d37f2; stacked draft PR #8741, push/native CI pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; local test/static process Node v26.0.0 and pnpm 10.24.0; native harness used official bundled Node v24.18.0, node-gyp 12.3.0, Apple Clang/make, and Python 3.13.5

• Remote and transport: none; exact Node archive downloaded over HTTPS, then local native builds; no SSH, publication, or production consumer

• Exact commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/build-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/build-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  git diff HEAD --check
  

  The native oracle downloaded node-v24.18.0-darwin-arm64.tar.xz, twice extracted it under the fixed exclusive /tmp/orca-ssh-relay-runtime-build-work/node-inputs path, called buildPatchedSshRelayNodePty twice with the same clean node-pty path, compared both outputs, required one LC_UUID from otool -l, and then repeated the build in a separate process session against the prior hashes.

• Result: PASS locally. The focused command passed 8/8 tests; all 14 artifact suites passed 47/47. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, syntax, and diff gates exited zero. Full lint emitted only pre-existing out-of-package warnings. Two clean native passes and the separate repeat session produced byte-identical outputs: pty.node was 83,256 bytes with SHA-256 e73f80560b8ecc0ae19421fc82fb612e4f50e66f17dfd491cdf95599bc7b685a, and spawn-helper was 50,192 bytes with SHA-256 3396961b0f8f9cdb0fcd2155eb54035276ee7ee2813d84faa1dfae5ba84dc95d. Each retained exactly one LC_UUID, and every buildPatchedSshRelayNodePty call completed its bundled-Node native-load oracle. A separate -Wl,-no_uuid diagnostic made bytes equal but caused bundled Node/dlopen to reject pty.node with missing LC_UUID load command; that approach was discarded and is not present in the implementation.

• Duration and resource metrics: focused tests 229 ms; exact-head full artifact suite 1.35 seconds; parallel static gate 11.5 seconds; two-pass canonical native harness 11.126 seconds; separate repeat native build 2.511 seconds excluding archive download/extraction. Native harness peak RSS, file counts, and cancellation settlement were not instrumented.

• Artifact/log/trace link: exact source commits and local command output; no artifact was published

• Oracle proved: output/work overlap rejects; both paths are exclusive; a caller-provided canonical work path is reused cleanly and safely; macOS configures then links with -Wl,-reproducible without deleting LC_UUID; copied Windows binding.gyp receives exactly one /Brepro and source drift fails closed; Linux and legacy/repository-wide node-pty behavior are unchanged; both native workflow families use the same canonical runner-local path while retaining run-scoped outputs.

• Does not prove: native Windows /Brepro behavior, macOS x64, GitHub-hosted equality, different runner-image/toolchain revisions, oldest baselines, native signatures/trust, SSH, transfer, publication, resolver/cache, fallback, UI, or any enabled tuple.

• Checklist items satisfied: exact-head local linker/work-path contracts and macOS arm64 native correction only; native reproducibility remains open until all six jobs pass together.

• Follow-up: push 3e433b343, run all six target-native jobs, and require complete equality plus upload in each cell without weakening the comparator.

E-M3-REPRODUCIBILITY-LINKER-CI-RED-001 — POSIX equality and Windows builder parser boundary

• Date: 2026-07-14

• Commit SHA / PR: exact head 54df2cb998ae564c1a19cf32a8c93bf28770d07a; stacked draft PR #8741

• Run and jobs: run 29350639822, conclusion failure; Linux x64 87145674443, Linux arm64 87145674440, macOS arm64 87145674422, macOS x64 87145674490, Windows x64 87145674413, and Windows arm64 87145674455

• Runners: ubuntu-24.04 x64 image 20260705.232.1, ubuntu-24.04-arm arm64 image 20260706.52.2, macos-15 arm64 image 20260706.0213.1, macos-15-intel x64 image 20260629.0276.1, windows-2022 x64 image 20260706.237.1, and windows-11-arm arm64 image 20260706.102.1; all native, runner 2.335.1, provisioner 20260624.560, and Node v24.18.0. Windows x64 was Server 2022 build 20348; arm64 was Windows Enterprise build 26200.

• Remote and transport: none; target-native artifact assembly/execution and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29350639822 --repo stablyai/orca \
    --json databaseId,headSha,headBranch,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/<job-id>/logs
  gh api 'repos/stablyai/orca/actions/runs/29350639822/artifacts?per_page=100'
  

• Result: FAIL as an evidence-producing six-runner gate. Linux x64/arm64 and macOS x64/arm64 each passed 47/47 contracts, authenticated exact Node inputs, performed two exclusive native builds, fully inspected and smoked both outputs, compared the runtime tree/archive/identity/SPDX/ provenance byte-for-byte, and uploaded only the first equal output. Windows x64/arm64 each passed 42 tests and skipped three POSIX-only tests across 13 suites, then failed while collecting ssh-relay-runtime-build.test.mjs with SyntaxError: Invalid or unexpected token: that test imports build-ssh-relay-runtime.mjs, whose first line was an unused Unix shebang. Input download, native build, verification, comparison, and upload were all skipped on both Windows jobs.

• Equal-output and upload details:

  Tuple	Content ID / runtime archive SHA-256	Archive / expanded / files	Build 1 / build 2 / max smoke RSS	Actions artifact
  linux-x64-glibc	960546cd96c67fcf9bb0a61e96ecdbecbffd9104d3a495578f8bb19dd810649a / 1881a082b5c8ab1caf28801e42a8f62601b0275096ec67468498d1a370c4af3b	29,266,692 / 124,846,502 / 34	67,504 / 65,510 ms / 56,438,784 bytes	8318063540, 29,282,697 bytes
  linux-arm64-glibc	aa3aa8ae8b42334ba7b0dbe5c43fd1184e36b3f4f4a9bec0e990e9b78f090756 / 909a8f69acf9edb294e5d74b4323adc399821e049f0cba933206621f75c3effe	28,197,220 / 122,865,172 / 34	67,457 / 65,054 ms / 52,596,736 bytes	8318072302, 28,212,074 bytes
  darwin-arm64	40ff5d2036784b794e7b09f78596409f63f3145280c530bece5280d40897f6cb / 132b0b6b3ecd4386ecf72119a950334f54ec34fe46e51c4f871d8c7878247775	24,736,104 / 122,027,869 / 35	55,320 / 52,391 ms / 51,658,752 bytes	8318052438, 24,749,047 bytes
  darwin-x64	585ea6034cdd07487d8667059f975a877c795a45dc0d6eeee1617f2e3749faa2 / b47ed8b464989b1638a2024ac5980a45a494ff33f9a3dbe648c8f7974efb1e33	26,373,464 / 124,316,655 / 35	88,815 / 78,961 ms / 40,665,088 bytes	8318098409, 26,388,039 bytes

• Duration and resource metrics: total jobs were 3m12s Linux x64, 3m28s Linux arm64, 2m50s macOS arm64, 4m28s macOS x64, 1m19s Windows x64, and 3m42s Windows arm64. Windows contract collection took 1.97s and 2.76s. POSIX comparison scanned 54/55 entries and 146.8–154.1 MB in 285–895 ms. Build peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: run/job links and four unpublished seven-day artifacts above; Windows correctly produced no artifact

• Oracle proved: the canonical clean-work directory plus -Wl,-reproducible makes both native macOS architectures byte-identical while retaining successful bundled-Node/native PTY/watcher execution; both Linux controls remain equal; failed contract collection prevents Windows inputs, execution, and upload. The parser boundary is the imported builder shebang, not /Brepro output.

• Does not prove: Windows builder parsing after correction, native /Brepro equality, a six-job pass, cross-run identity, oldest baselines, native trust/signing, SSH, transfer, publication, resolver/cache, fallback, UI, or an enabled tuple.

• Checklist items satisfied: native macOS linker reproducibility evidence only; native reproducibility remains open until all six same-head jobs pass together.

• Follow-up: remove only the unused builder shebang, syntax-check the builder and its test on POSIX and Windows before Vitest, rerun local gates, then require a new six-runner exact-head pass.

E-M3-REPRODUCIBILITY-BUILDER-PARSER-LOCAL-001 — Imported builder parser correction

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit f864d3fa6df7a938e509c7622604e2fd2bd85493; stacked draft PR #8741, push/native CI pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. The repository requires Node 24, so the new target-native run remains authoritative for Windows.

• Remote and transport: none; local syntax, contract, and repository static gates only

• Exact commands:

  node --check config/scripts/build-ssh-relay-runtime.mjs
  node --check config/scripts/ssh-relay-runtime-build.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/build-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    .github/workflows/ssh-relay-runtime-artifacts.yml
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/build-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  git diff HEAD --check
  

• Result: PASS at the exact implementation commit. Both syntax checks exited zero; all 14 artifact suites passed 47/47 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, and exact-head diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: full artifact command 3.08s wall; typecheck 3.30s; focused oxlint 0.49s; max-lines 0.76s; full lint 12.79s. Synthetic test peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: exact commit and local command output; no runtime artifact was produced

• Oracle proved: the builder and importing test parse after removing only the unused shebang; every real builder invocation remains explicitly through node; both workflow families syntax-check the builder and test before Vitest or Node input download; workflow source contracts require both POSIX and Windows checks without changing permissions, artifact scope, or production behavior.

• Does not prove: native Windows parsing, Node 24 behavior, /Brepro output equality, any native build, oldest baselines, native trust, SSH, transfer, publication, resolver/cache, fallback, UI, or an enabled tuple.

• Checklist items satisfied: exact local builder parser/syntax-gate correction only; no native or tuple checkbox.

• Follow-up: push the exact commit and require all six target-native jobs to pass together before closing native reproducibility.

E-M3-REPRODUCIBILITY-WINDOWS-ARM64-CI-RED-001 — Native arm64 residual binary drift

• Date: 2026-07-14

• Commit SHA / PR: exact head de541efd11989d2e6dce0402307912afffae3510; stacked draft PR #8741

• Run and jobs: run 29351557922, conclusion failure; Linux arm64 87148758201, Linux x64 87148758213, Windows x64 87148758259, macOS arm64 87148758282, macOS x64 87148758287, and failing Windows arm64 87148758290

• Runners: ubuntu-24.04-arm image 20260706.52.2, ubuntu-24.04 image 20260705.232.1, windows-2022 image 20260706.237.1, macos-15-arm64 image 20260706.0213.1, macos-15 image 20260629.0276.1, and windows-11-arm64 image 20260706.102.1; all native, runner 2.335.1, provisioner 20260624.560, and Node v24.18.0

• Remote and transport: none; target-native artifact assembly/execution and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29351557922 --repo stablyai/orca \
    --json databaseId,headSha,headBranch,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/<job-id>/logs
  gh api 'repos/stablyai/orca/actions/runs/29351557922/artifacts?per_page=100'
  

• Result: FAIL as a six-runner reproducibility gate. All six jobs passed the builder/test syntax checks and artifact contracts, authenticated the exact Node inputs, and completed two native builds. Linux x64/arm64, macOS x64/arm64, and Windows x64 inspected and smoked both outputs, compared every runtime/archive/identity/SPDX/provenance entry exactly, and uploaded only after equality. Windows arm64 also inspected and smoked both complete 60-entry, 42-file, 86,189,895-byte outputs, including PTY input/resize/exit, watcher lifecycle, and resource settlement, but the comparator first found SHA-256 drift at runtime/node_modules/node-pty/build/Release/conpty_console_list.node; no arm64 artifact uploaded.

• Equal-output artifacts: Linux x64 8318426445 (29,283,624 bytes), Linux arm64 8318449064 (28,212,246 bytes), macOS arm64 8318457230 (24,710,997 bytes), Windows x64 8318478579 (37,075,312 bytes), and macOS x64 8318524353 (26,365,330 bytes), all unpublished seven-day Actions artifacts. Their runtime content IDs are respectively 960546cd96c6, aa3aa8ae8b42, 40ff5d203678, 2a6bfa06b445, and 585ea6034cdd (prefixes shown; full values remain in logs).

• Windows arm64 drift details: build one content ID 58afdfbe6b3e48ee1a46bcb09f20a9c7d4d6fe25bdf346e82038fa0a2211ea86, archive 33,261,552 bytes with SHA-256 0277fa35bb1ec644a509e3068bf120294c99484ac3638fdd352ae386f83bdd2f; build two content ID 6e64071c12f58b0f73a34339c6f1f1dac725d852224537c32d2c87f8e587bdb9, archive 33,261,545 bytes with SHA-256 234aa56026009c91abdfa37abae484723a39f027f8afa00760afc784a3ecfd05.

• Duration and resource metrics: jobs were 3m43s Linux arm64, 2m57s Linux x64, 4m54s Windows x64, 4m7s macOS arm64, 6m34s macOS x64, and 10m37s Windows arm64. Windows arm64 native builds took 152,711 ms and 132,480 ms; smoke took 5,845 ms and 5,408 ms at 53,018,624 and 51,732,480 bytes RSS. Build peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Oracle proved: the parser correction works natively on both Windows architectures; /Brepro yields complete equality on Windows x64; all four POSIX controls remain equal; a native arm64 residual is isolated to the copied node-pty conpty_console_list.node; mismatch prevents upload.

• Does not prove: the differing byte region or PE field, a Windows arm64 correction, all-six equality, cross-run identity, oldest baselines, native trust/signing, SSH, transfer, publication, resolver/cache, fallback, UI, or an enabled tuple.

• Checklist items satisfied: native parser boundary and five same-head reproducibility cells only; native reproducibility remains open.

• Follow-up: add a bounded PE-diff diagnostic for the two Windows arm64 binaries, record byte ranges and headers, then correct only the copied artifact build if evidence identifies a safe source. Do not weaken comparison, upload failed outputs, or change repository-wide/legacy node-pty.

E-M3-REPRODUCIBILITY-WINDOWS-ARM64-REPEAT-CI-RED-001 — Independent repeat of arm64-only drift

• Date: 2026-07-14

• Commit SHA / PR: documentation-only exact head a7151f9750fd9bfcdcff8c01c1fd6caff2e6116a; implementation bytes remain de541efd11989d2e6dce0402307912afffae3510; stacked draft PR #8741

• Run and jobs: run 29352510414, conclusion failure; Linux x64 87151980265, Linux arm64 87151980298, macOS arm64 87151980396, macOS x64 87151980327, Windows x64 87151980324, and failing Windows arm64 87151980264

• Runners: the same six native labels/toolchain family recorded in E-M3-REPRODUCIBILITY-WINDOWS-ARM64-CI-RED-001. The failing cell was Windows 11 Enterprise 10.0.26200 arm64, image windows-11-arm64 20260706.102.1, runner 2.335.1, provisioner 20260624.560, Node v24.18.0, MSVC 19.44.35228 / tools 14.44.35207, Windows SDK 10.0.26100.0, and Python 3.13.14.

• Remote and transport: none; independent target-native artifact assembly/execution and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29352510414 --repo stablyai/orca \
    --json databaseId,headSha,status,conclusion,url,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/87151980264/logs
  gh api 'repos/stablyai/orca/actions/runs/29352510414/artifacts?per_page=100'
  

• Result: FAIL as expected at the unchanged native boundary. All 14 contract suites passed on Windows arm64 with 44 tests passed and three POSIX-only skips. Linux x64/arm64, macOS x64/arm64, and Windows x64 independently built twice, inspected, smoked, compared exactly, and uploaded unpublished artifacts 8318818618, 8318833832, 8318812505, 8318846378, and 8318866333. Windows arm64 again built, inspected, and smoked two complete 60-entry, 42-file, 86,189,895-byte outputs, then first differed at runtime/node_modules/node-pty/build/Release/conpty_console_list.node; upload was skipped.

• Windows arm64 rejected outputs: first content ID e13f39ae96eba36c3ed41054da7429533e2eebbdd7d845a712d802d002906bc8, ZIP 33,261,548 bytes with SHA-256 ca1be18b572e353ac2eb3a390d91e5d0acb93100735f387ce74300cb48ba39d1; second content ID 4989a282c6529df6066aefbb5667ca96777907d54f1d9a48041f8ff98555b9c0, ZIP 33,261,548 bytes with SHA-256 e91664074aa2f434ea0e2603596410c119b89b2a4a4d7eab453bfb7407ff91d0.

• Duration and resource metrics: jobs completed in 3m9s Linux x64, 3m39s Linux arm64, 2m56s macOS arm64, 4m9s macOS x64, 4m53s Windows x64, and 8m48s Windows arm64. Arm64 native builds took 145,700 ms and 124,010 ms; smoke took 6,042 ms and 5,564 ms at 53,075,968 and 52,977,664 bytes RSS. Build peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: run/job above and the five unpublished seven-day artifacts; no failed arm64 bytes were uploaded

• Oracle proved: the Windows arm64 difference repeats across an independent run while the same-head Windows x64 and four POSIX controls remain reproducible; the strict gate consistently prevents a rejected output from upload. The drift is not a transient failure from run 29351557922.

• Does not prove: differing PE byte ranges/headers, a producer correction, arm64 equality, cross-run equality, oldest baselines, native trust/signing, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: no new completion checkbox; this repeat evidence justifies the bounded PE diagnostic before any producer change.

• Follow-up: run the bounded diagnostic on both native Windows runners, require x64 to remain equal, and use only the rejected arm64 headers/ranges to choose or reject a copied-artifact correction.

E-M3-WINDOWS-PE-DIAGNOSTIC-LOCAL-001 — Bounded rejected-binary diagnostics

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 39ee3451b8cc38b5311a0cb1085ad48a1f302185; stacked draft PR #8741, push/native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. The repository requires Node 24, so target-native Windows jobs remain authoritative.

• Remote and transport: none; synthetic PE32+ arm64 fixtures and workflow source contracts only

• Exact commands:

  node --check config/scripts/ssh-relay-runtime-windows-pe-diagnostic.mjs
  node --check config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-runtime-windows-pe-diagnostic.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS at the exact implementation commit. Both syntax checks exited zero; the purpose command passed 5/5 tests across two suites; all 15 artifact suites passed 50/50 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, staged hooks, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: syntax checks 50 ms and 40 ms; purpose suite 142 ms Vitest / 0.76s wall; complete artifact suite 470 ms Vitest / 1.15s wall; typecheck 2.68s; focused oxlint 0.69s; max-lines 1.58s; full lint 11.92s; formatting check 1.82s. The implementation rejects inputs over 64 MiB, reads in 64 KiB chunks, caps the header at 1 MiB, the section/debug tables at 96/32 entries, byte/header differences at 128 each, and the whole diagnostic at 60 seconds. Synthetic peak RSS/open files were not instrumented.

• Artifact/log/trace link: exact source commit; no binary artifact was created or uploaded

• Oracle proved: valid PE32+ fixtures report whole-file sizes/SHA-256, coalesced file-offset ranges, COFF/optional/data-directory/section/debug headers, and hashed—not printed—CodeView paths; oversized, malformed, same-file, unknown-argument, and pre-aborted inputs fail boundedly. Workflow contracts require diagnostic syntax/tests on Windows, invoke it only after the strict comparator rejects the two retained conpty_console_list.node files, throw afterward, and leave evidence copying unreachable, so rejected binaries are not uploaded. No max-lines bypass was added.

• Does not prove: parsing the real x64/arm64 linker outputs, native Node 24 behavior, the actual differing ranges/headers, x64 equality after the workflow change, a producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or an enabled tuple.

• Checklist items satisfied: local bounded diagnostic and fail-closed workflow ordering only; no native, tuple, or production checkbox.

• Follow-up: push the exact implementation, require native x64 equality and arm64 diagnostic output with no upload, then record the exact PE evidence before changing the producer.

E-M3-WINDOWS-PE-DIAGNOSTIC-CI-RED-001 — Real arm64 PE drift with x64 control

• Date: 2026-07-14

• Commit SHA / PR: exact documentation head 27c6a5718c544cd3f559d6adc24cc0beca2ed59e, containing diagnostic implementation 39ee3451b8cc38b5311a0cb1085ad48a1f302185; stacked draft PR #8741

• Run and jobs: run 29353432240, conclusion failure; Windows arm64 87155072734, macOS x64 87155072752, Linux x64 87155072794, macOS arm64 87155072820, Linux arm64 87155072837, and Windows x64 87155072849

• Runners: the six target-native labels recorded in prior reproducibility evidence. The diagnostic cell was Windows 11 Enterprise 10.0.26200 arm64, image windows-11-arm64 20260706.102.1, runner 2.335.1, provisioner 20260624.560, Node v24.18.0, MSVC 19.44.35228 / tools 14.44.35207, Windows SDK 10.0.26100.0, and Python 3.13.14.

• Remote and transport: none; target-native artifact assembly/execution, rejected-file diagnostics, and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29353432240 --repo stablyai/orca \
    --json headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/87155072734/logs
  gh api 'repos/stablyai/orca/actions/runs/29353432240/artifacts?per_page=100'
  

• Result: FAIL as the intended evidence-producing gate. Both Windows jobs passed 15 suites with 47 tests passed and three POSIX-only skips, including native Node 24 execution of the new diagnostic contracts. Linux x64/arm64, macOS x64/arm64, and Windows x64 built twice, inspected, smoked, compared exactly, and uploaded unpublished artifacts 8319201464, 8319207054, 8319191783, 8319227039, and 8319248077. Windows x64 therefore proves the diagnostic package does not disturb the successful comparator/upload path. Windows arm64 again built, inspected, and smoked both complete outputs, then failed at conpty_console_list.node; the diagnostic ran before the fatal throw and artifact upload was skipped.

• Rejected arm64 runtime outputs: first content ID bb05f852159277dea617679f84304d2bc3b01d446ceffd07fb58c9469038bcf6, ZIP 33,261,545 bytes with SHA-256 248a4962141e5b1b1c5b24433993923171c5c1d342b8db4de624b92a1019823c; second content ID 9d937233f63b142f03e504af2ffeeeb05b2de2b979047a369a79dd1d793b1786, ZIP 33,261,544 bytes with SHA-256 24f752754890704e991f5cc85663a6bb7a6934fc5d64f81ea2414ea12778c249.

• PE diagnostic result: both native modules are exactly 956,928 bytes with identical machine 0xaa64, 12-section layout, PE32+ image/section/file alignment, 840,192-byte code section, data directories, load config, imports, relocations, and linker version 14.44. Their SHA-256 values are 7ef783c59d73cd6101fbed4ef634ef3d075448726c118b36cca4d17145e35afa and 196dc3373e52350abdf33c30f80a00e0b9b71c96b53b47ba337b1abe428ac8fc. Exactly 2,946 bytes differ across 2,887 coalesced ranges. The first code difference is at file offset 0x41c, followed by one-byte ranges at 16-byte intervals in the retained sample. Header differences are confined to COFF/debug timestamps dd34d0b3 versus 0211cbf1 and CodeView IDs 383b9420683f05ced18d65c8e95b4a72 versus 459643a06a5ac306094361fd1788cbe5; CodeView age and the SHA-256 of the unprinted 92-byte PDB path are identical. The detailed-range list correctly reports truncation after 128 of 2,887 ranges.

• Duration and resource metrics: jobs were 8m48s Windows arm64, 4m12s macOS x64, 3m15s Linux x64, 2m57s macOS arm64, 3m24s Linux arm64, and 5m0s Windows x64. Arm64 native builds took 148,290 ms and 120,068 ms; smoke took 5,871 ms and 5,421 ms at 51,417,088 and 52,633,600 bytes RSS. The PE diagnostic completed between log timestamps 17:30:23.088 and 17:30:23.272 UTC. Build peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: run/job above and five unpublished seven-day artifacts; no rejected arm64 bytes were uploaded

• Oracle proved: native Windows parses and bounds the real PE files, x64 remains fully reproducible, arm64 output layout and PDB path are stable, and drift affects thousands of mostly single-byte code ranges plus /Brepro-derived identity fields rather than only a timestamp. The comparator and no-upload boundary remain strict.

• Does not prove: the full per-section distribution because the first diagnostic version labels raw section data as unmapped and caps detailed ranges at 128; the responsible compiler/linker input, a safe producer correction, arm64 equality, cross-run equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native PE diagnostic and Windows x64 control only; no tuple or production checkbox.

• Follow-up: add raw-section attribution plus bounded per-section totals/samples across the complete scan, rerun both Windows cells, and do not change the producer until that evidence is recorded.

E-M3-WINDOWS-PE-FULL-SCAN-LOCAL-001 — Bounded complete-region PE summary

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit cd7f941365bf6e631cf0f9947f517ecef02afc8e; stacked draft PR #8741, native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. The repository requires Node 24, so the target-native jobs remain authoritative.

• Remote and transport: none; synthetic PE32+ fixtures and workflow-source contracts only

• Exact commands:

  node --check config/scripts/ssh-relay-runtime-windows-pe-diagnostic.mjs
  node --check config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-runtime-windows-pe-diagnostic.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. Both syntax checks exited zero; the purpose command passed 6/6 tests across two suites; all 15 artifact suites passed 51/51 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, staged hooks, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: purpose suite 246 ms Vitest; complete artifact suite 963 ms Vitest / 2.24s wall; typecheck 2.52s; focused oxlint 0.68s; max-lines 1.54s; full lint 11.09s; formatting and diff check 1.06s. The full scan still reads in 64 KiB chunks; detailed ranges remain capped at 128, each byte excerpt at 32 bytes, each region at eight samples, and the entire diagnostic at 60 seconds. Synthetic peak RSS/open files were not instrumented.

• Artifact/log/trace link: exact source commit; no binary artifact was created or uploaded

• Oracle proved: every coalesced range contributes to bounded per-region differing-byte and range totals even after the detailed-range cap is exhausted; raw PE section data is attributed by the most specific overlapping region, preserving CodeView/debug labels; excerpts and region samples remain bounded. The comparator, fatal failure, and no-upload ordering are unchanged.

• Does not prove: the real arm64 section distribution, Windows x64 control, arm64 reproducibility, a producer correction, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: diagnostic observability only; no artifact, tuple, or production box.

• Follow-up: push the exact implementation and ledger head, run all six target-native cells, require five reproducible uploads plus a rejected Windows arm64 full-scan summary, and record that evidence before changing any copied-artifact producer input.

E-M3-WINDOWS-PE-FULL-SCAN-CI-RED-001 — Complete native arm64 region classification

• Date: 2026-07-14

• Commit SHA / PR: exact head a51093f009a03a1105e9f0b86be14797a8046414, containing exact diagnostic implementation cd7f941365bf6e631cf0f9947f517ecef02afc8e; stacked draft PR #8741

• Run and jobs: run 29354676731, conclusion failure; Windows arm64 87159223395, Linux arm64 87159223407, macOS x64 87159223419, macOS arm64 87159223455, Windows x64 87159223488, and Linux x64 87159223544

• Runners: the six target-native labels recorded in prior reproducibility evidence. The diagnostic cell was Windows 11 Enterprise 10.0.26200 arm64, image windows-11-arm64 20260706.102.1, runner 2.335.1, provisioner 20260624.560, Node v24.18.0, MSVC 19.44.35228 / tools 14.44.35207, Windows SDK 10.0.26100.0, and Python 3.13.14.

• Remote and transport: none; target-native artifact assembly/execution, rejected-file diagnostics, and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29354676731 --repo stablyai/orca \
    --json headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/87159223395/logs
  gh api 'repos/stablyai/orca/actions/runs/29354676731/artifacts?per_page=100'
  

• Result: FAIL as the intended evidence-producing gate. All Windows contract suites passed before execution; Linux x64/arm64, macOS x64/arm64, and Windows x64 built twice, inspected, smoked, compared exactly, and uploaded. Windows arm64 built, inspected, and smoked both outputs, then the strict comparator rejected conpty_console_list.node; the full-scan diagnostic completed before the fatal throw and the upload step was skipped.

• Uploaded controls: ssh-relay-runtime-linux-x64-glibc artifact 8319697674 (29,282,973 bytes), Linux arm64 8319710845 (28,211,514), macOS x64 8319759300 (26,374,729), macOS arm64 8319686475 (24,756,958), and Windows x64 8319797990 (37,075,313). All are unpublished and expire 2026-07-21; the run contains exactly five artifacts and no Windows arm64 artifact.

• Rejected arm64 outputs: content IDs 75f048e2216c5a88b5dec886d7ce43f8c54768c42184835cfd0d9a22ea3f1e53 and dddc49d84bdafd5bef136be5050352555e99943b21f49781f1604bd9e37051bc; ZIP sizes 33,261,549 and 33,261,550 bytes with SHA-256 4c21eaba04e514dee246ee23ea6b4559369fc37eaf90dc0634f11146427bb45a and aecde9c9982d972d194417cc2d076353fb808f39ba4f018b8d9e64cfdf5c3411.

• PE diagnostic result: both modules are 956,928-byte machine 0xaa64 PE32+ files with identical 12-section layout, data directories, imports, relocations, 840,192-byte code section, and linker version 14.44. Their SHA-256 values are 52d4909f106a4e8f85e7fc4c8cc0ccae93eaa74a83342b569d71f67619f15a1e and 6926210ec6208caa2a79655e2af544b74d8a0d6d1b8c7637d4ece017c89046de. Exactly 2,947 bytes differ across 2,886 ranges:

  • .text: 2,879 one-byte ranges from file offsets 1,052 through 47,100, exactly 16 bytes apart; all eight retained samples change 85 to 0e.
  • COFF header: one four-byte /Brepro timestamp range.
  • Debug directory: three four-byte ranges carrying that timestamp.
  • CodeView data: one 16-byte identifier range.
  • .rdata: two ranges totaling 36 bytes, containing the derived CodeView/build identities and timestamp.

  The CodeView path remains 92 bytes with identical SHA-256 401080e65f10d7483583537fc7394ddf416fa36febfd76e6d1c17c64bb36f3ea; no other section differs. The detailed list remains capped while every range contributes to the five bounded region summaries.

• Duration and resource metrics: jobs were 9m50s Windows arm64, 6m56s Windows x64, 5m33s macOS x64, 3m44s Linux arm64, 3m18s Linux x64, and 2m55s macOS arm64. Arm64 builds took 152,517 ms and 130,926 ms; smoke took 5,963 ms and 5,414 ms at 51,884,032 and 51,789,824 bytes RSS. The complete smoke stages took 7,978 ms and 7,203 ms. Build peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: run/jobs and five unpublished seven-day artifacts above; rejected arm64 bytes remained runner-local

• Oracle proved: the arm64 failure is copied-source producer nondeterminism concentrated in a regular .text pattern, with only derived /Brepro identities elsewhere. It is not ZIP order, tree metadata, comparator normalization, a changing PDB path, or a cross-platform regression. The strict no-upload boundary remains effective.

• Does not prove: which compiler input causes the repeating .text byte, a safe producer correction, arm64 equality, cross-run equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: complete native PE region classification and five control cells only; no tuple or production checkbox.

• Follow-up: evaluate a test-covered reproducible compiler input only in the copied node-pty source, rerun all local gates and all six target-native cells, and require exact arm64 equality without normalizing binaries or weakening the comparator.

E-M3-WINDOWS-COMPILER-DETERMINISM-LOCAL-001 — Copied-source MSVC reproducibility inputs

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 6546f54d53446015f10681fffff9fe895e460232; stacked draft PR #8741, native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot execute MSVC, so target-native Windows jobs remain authoritative.

• Remote and transport: none; copied binding.gyp source-shape contracts only

• Exact red command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  

• Red result: FAIL as intended, one failed and one passed test. The copied compiler block lacked /Brepro; no implementation change had yet been made.

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Green result: PASS. Both syntax checks exited zero; the purpose command passed 6/6 tests across three suites; all 15 artifact suites passed 51/51 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, staged hooks, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: purpose suite 183 ms Vitest; complete artifact suite 1.27s Vitest / 2.65s wall; typecheck 2.85s; focused oxlint 0.76s; max-lines 1.81s; full lint 10.91s; formatting and diff check 1.10s. Synthetic peak RSS/open files were not instrumented.

• Artifact/log/trace link: exact source commit; no binary artifact was created or uploaded

• Oracle proved: Windows builds receive /Brepro and /experimental:deterministic in both the compiler and linker option blocks after an exact reviewed-source match. POSIX tuples are untouched, unexpected or already-modified source fails closed, and the installed repository node_modules/node-pty/binding.gyp remains byte-identical because only the exclusive copied source is rewritten.

• Does not prove: that MSVC 19.44 accepts the flags on both architectures, Windows arm64 equality, native execution, cross-run equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: copied-source compiler/linker input contract only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, run all six target-native cells, and require exact equality and successful unpublished upload on both Windows architectures.

E-M3-WINDOWS-COMPILER-DETERMINISM-CI-RED-001 — Compiler-setting correction does not remove arm64 drift

• Date: 2026-07-14

• Commit SHA / PR: exact head a6b423f33f0f0f7b4e7975ed80d901f168563e61, containing exact implementation commit 6546f54d53446015f10681fffff9fe895e460232; stacked draft PR #8741

• Run and jobs: run 29355973362, conclusion failure; Linux arm64 87163591039, Windows x64 87163591059, macOS x64 87163591076, Windows arm64 87163591141, macOS arm64 87163591145, and Linux x64 87163591207

• Runners: the six target-native labels recorded in prior reproducibility evidence. The failing cell was GitHub-hosted windows-11-arm, resolved image win11-arm64 20260706.102.1, native ARM64, Node v24.18.0, MSVC 19.44.35228 / tools 14.44.35207, Windows SDK 10.0.26100.0, and Python 3.13.14.

• Remote and transport: none; target-native artifact assembly/execution, rejected-file diagnostics, and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29355973362 --repo stablyai/orca \
    --json headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh run view 29355973362 --repo stablyai/orca --job 87163591141 --log-failed
  gh api repos/stablyai/orca/actions/runs/29355973362/artifacts --paginate
  

• Result: FAIL as the intended strict evidence gate. All 15 Windows contract suites passed with 48 passing and three intentionally skipped tests. Linux x64/arm64, macOS x64/arm64, and Windows x64 built twice, inspected, executed, compared exactly, and uploaded. Windows arm64 built and executed both complete outputs, then the comparator rejected runtime/node_modules/node-pty/build/Release/conpty_console_list.node; the diagnostic ran, the job failed, and no Windows arm64 artifact was uploaded.

• Uploaded controls: Linux x64 artifact 8320207112 (29,282,626 bytes), Linux arm64 8320217472 (28,211,075), macOS x64 8320277866 (26,390,709), macOS arm64 8320191810 (24,741,051), and Windows x64 8320261436 (37,075,310). All are unpublished seven-day artifacts; the run contains exactly five artifacts.

• Rejected arm64 outputs: content IDs 5523ec111f63a53edb3da090cf90bedb0421c2c9862dc0356e106fdf5a6519f2 and faadd0f5285a449fd0aad0960918edc72d565dc150171e8e292c160931340235; ZIP sizes 33,261,550 and 33,261,546 bytes with SHA-256 769fc2b8a4761b8d19b9d4b02adc2add6b4232ed73a1ee154e6e073760f52eda and 217e9f8b500837130e0978a7aa03dba2790a926b42410752c7d804e6d5a38143.

• PE diagnostic result: both rejected modules remain 956,928-byte machine 0xaa64 PE32+ files with the identical 12-section layout. Their SHA-256 values are 548ff529facca76eb3a30c79f96e2170336b7cf01a3e55aabc2a5cd615cd1111 and e0039271e09a898d3edf9eb4506f3d895cd3282a893a1e15acb4abec2f9cb69c. Exactly the same 2,947 bytes differ across 2,886 ranges: 2,879 one-byte .text ranges every 16 bytes from offsets 1,052 through 47,100, plus 68 bytes of derived COFF/debug/CodeView identity. The retained .text samples all change 45 to 2d; the 92-byte PDB path hash remains identical.

• Duration and resource metrics: jobs were 8m25s Windows arm64, 5m50s macOS x64, 5m15s Windows x64, 3m37s Linux arm64, 3m16s Linux x64, and 2m41s macOS arm64. Arm64 builds took 141,484 ms and 116,582 ms; smoke took 5,784 ms and 5,439 ms at 53,014,528 and 53,047,296 bytes RSS. The complete smoke stages took 7,448 ms and 7,383 ms. Build peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: run/jobs and the five unpublished artifacts above; rejected arm64 bytes remained runner-local

• Oracle proved: adding the reviewed compiler/linker settings did not alter the arm64 failure signature, while all five controls and both arm64 runtime executions remain healthy. The strict comparator and no-upload boundary still work. This falsifies the hypothesis that the copied settings alone are sufficient.

• Does not prove: whether the generated MSBuild project actually propagates both settings to every conpty_console_list compile/link invocation, what the repeated ARM64 instruction represents, a safe producer correction, arm64 or cross-run equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native negative evidence and five reproducible control cells only; no tuple or production checkbox.

• Follow-up: inspect the generated conpty_console_list.vcxproj fail-closed for the expected compiler/linker inputs and emit bounded paired ARM64 instruction/disassembly context around the first differing ranges. Do not change the producer, normalize binaries, weaken comparison, or upload rejected bytes before that evidence.

E-M3-WINDOWS-MSBUILD-DISASSEMBLY-LOCAL-001 — Generated-project and bounded disassembly contracts

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 0d3a0c9d3f0eee78d3106a646369cc3fc5db96b1; stacked draft PR #8741, native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot generate or execute native MSBuild/ARM64 PE inputs, so the target-native Windows jobs remain authoritative.

• Remote and transport: none; synthetic generated-project fixtures and workflow-source contracts only

• Exact red command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  

• Red result: FAIL as intended, two failed and two passed tests because no generated-project verifier existed.

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  node --check config/scripts/ssh-relay-node-pty-build.mjs
  node --check config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  pnpm exec lint-staged
  git diff --check
  

• Green result: PASS. All syntax checks exited zero; the purpose command passed 8/8 tests across three suites; all 15 artifact suites passed 53/53 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, staged hooks, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: purpose suite 156 ms Vitest; complete artifact suite 1.11s Vitest. Static-gate wall time, synthetic peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: exact source commit and local command output; no binary artifact was created or uploaded

• Oracle proved: Windows artifact builds now reject a missing, duplicate, non-inherited, or wrong-architecture Release ClCompile/Link option in the generated conpty_console_list.vcxproj before runtime staging, and log the exact accepted setting summary. On an arm64 mismatch the workflow retains the existing structured PE diagnostic, then requests only absolute image addresses 0x180001000 through 0x180001200 from native llvm-objdump.exe before the fatal throw. Rejected bytes still cannot reach artifact staging.

• Does not prove: the real generated XML shape, native llvm-objdump availability/output, which repeated ARM64 instruction differs, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local generated-project and bounded-disassembly contracts only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, run all six target-native cells, and require both Windows jobs to prove generated settings. If arm64 still differs, record the two bounded disassemblies and retain strict failure/no-upload before any producer correction.

E-M3-WINDOWS-MSBUILD-PLATFORM-CASE-CI-RED-001 — Native arm64 Release-group lookup fails closed

• Date: 2026-07-14

• Commit SHA / PR: exact head 65d44d72f7a5da382ffddc194f302b4386b2391c, containing exact diagnostic implementation commit 0d3a0c9d3f0eee78d3106a646369cc3fc5db96b1; stacked draft PR #8741

• Run and jobs: run 29357355064, conclusion failure; Linux x64 87168238852, Windows x64 87168238867, macOS x64 87168238889, Windows arm64 87168238935, macOS arm64 87168238945, and Linux arm64 87168238954

• Runners: the six target-native labels recorded in prior reproducibility evidence. The failing cell was GitHub-hosted windows-11-arm, image win11-arm64 release 20260706.102, native ARM64, runner 2.335.1, Node v24.18.0, MSVC tools 14.44.35207, Windows SDK 10.0.26100.0, and an arm64 developer environment exposing Platform=arm64.

• Remote and transport: none; target-native artifact assembly, generated-project verification, and unpublished Actions artifact upload only

• Exact evidence commands:

  gh run view 29357355064 --repo stablyai/orca \
    --json headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh run view 29357355064 --repo stablyai/orca --job 87168238867 --log
  gh run view 29357355064 --repo stablyai/orca --job 87168238935 --log-failed
  gh api repos/stablyai/orca/actions/runs/29357355064/artifacts --paginate
  

• Result: FAIL as the intended strict evidence gate. Linux x64/arm64, macOS x64/arm64, and Windows x64 built twice, inspected, executed, compared exactly, and uploaded. Windows x64 logged the required /Brepro and /experimental:deterministic compiler and linker settings for both clean builds. Native Windows arm64 completed compilation of the first copied node-pty tree, then the generated-project verifier rejected it with generated MSBuild settings lack one exact Release configuration before runtime staging, verification, smoke, comparison, or diagnostics. Its artifact upload was skipped.

• Uploaded controls: Linux x64 artifact 8320756625 (29,278,781 bytes, sha256:50bab609edc8e4eb776f462622c5e1310e926049e5ec0e759692ea4ae74142a4), Linux arm64 8320758083 (28,215,186, sha256:0b2770363a95717b0193c58ee066242ab08a9fa80eb0060049e912f6314776a8), macOS x64 8320845963 (26,407,443, sha256:70b4217dc54ff2015638e7407714208f7e399acadf0cbcd0d8d5340025235d34), macOS arm64 8320753136 (24,774,283, sha256:8f5c1a65e88d79b036cabf24d80656e6b987335c5d0a908d4fff241026d74467), and Windows x64 8320806874 (37,075,312, sha256:a325d8e09c0391ee971328da397ac23412024ce2e4bf0dc633f897f8b923add2). The run contains exactly five unpublished seven-day artifacts and no Windows arm64 artifact.

• Duration and resource metrics: jobs were 6m43s macOS x64, 6m24s Windows arm64, 5m15s Windows x64, 3m24s Linux x64, 3m23s Linux arm64, and 3m16s macOS arm64. The arm64 verifier failure occurred 2m24s into the build/inspect step before runtime smoke, so no new arm64 smoke RSS, channel/file count, cancellation, or fallback metric exists for this run.

• Artifact/log/trace link: run/jobs and the five unpublished artifacts above; no rejected arm64 runtime or binary was staged or uploaded

• Oracle proved: the generated-setting verifier executes after native compilation and fails closed before staging when its Release-group architecture spelling does not match. Windows x64 proves both required settings in both generated projects. The native arm64 developer environment uses a lowercase platform spelling, while all five architecture controls and the no-upload boundary remain intact.

• Does not prove: the exact native arm64 generated XML condition, that a case-insensitive exact architecture match reaches its option blocks, a complete arm64 runtime, paired disassembly, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native negative verifier evidence and five reproducible control cells only; no tuple or production checkbox.

• Follow-up: cover lowercase arm64 with a purpose fixture and compare only the expected Release architecture case-insensitively, retaining exact group and option cardinality. Rerun both Windows cells and all four POSIX controls before interpreting the underlying PE drift.

E-M3-WINDOWS-MSBUILD-PLATFORM-CASE-LOCAL-001 — Lowercase native platform contract

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 4207c207ab932ef67522b4f73b98d63fa32d0924; stacked draft PR #8741, native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot generate or execute native MSBuild/ARM64 PE inputs, so the target-native Windows jobs remain authoritative.

• Remote and transport: none; synthetic generated-project fixtures and workflow/source contracts only

• Exact red command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  

• Red result: FAIL as intended, one failed and three passed tests because a generated Release|arm64 condition was rejected for the win32-arm64 tuple.

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  pnpm exec lint-staged
  git diff --check
  

• Green result: PASS. Both syntax checks exited zero; the purpose command passed 8/8 tests across three suites; all 15 artifact suites passed 53/53 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, staged hooks, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package.

• Duration and resource metrics: red suite 382 ms Vitest; purpose suite 181 ms Vitest; complete artifact suite 1.51 s Vitest; typecheck 3.41 s; focused lint/line ratchet 3.28 s; full lint 13.30 s. Synthetic peak RSS, open files/channels, and cancellation settlement were not instrumented.

• Artifact/log/trace link: exact source commit and local command output; no binary artifact was created or uploaded

• Oracle proved: Release|arm64 is accepted for only the expected win32-arm64 architecture while the quoted Release condition remains exact apart from case. Wrong architecture, missing or duplicate group/option blocks, missing inheritance, and missing or duplicated required flags still fail closed. No source rewrite, producer, comparator, staging, or production path changed.

• Does not prove: the exact native generated XML, native flag propagation, complete arm64 build, paired disassembly, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local generated-project platform-casing contract only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, then run all six target-native cells and require both Windows architectures to log the accepted generated settings before interpreting any later comparator mismatch.

E-M3-WINDOWS-ARM64-THUNK-DISASSEMBLY-CI-RED-001 — Native linker-thunk drift isolated

• Date: 2026-07-14

• Commit SHA / PR: exact head e1a63930b4d350e8677e2be3a35b0bdec95f268c, containing exact lowercase-platform implementation commit 4207c207ab932ef67522b4f73b98d63fa32d0924; stacked draft PR #8741

• Run and jobs: run 29358223742, conclusion failure; Linux arm64 87171219009 success, Windows arm64 87171219067 expected strict failure, Linux x64 87171219080 success, Windows x64 87171219167 success, macOS arm64 87171219192 success, and macOS x64 87171219210 success

• Runners: GitHub-hosted ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2 native ARM64; windows-11-arm / win11-arm64 20260706.102.1 native ARM64; ubuntu-24.04 / ubuntu24 20260705.232.1 native X64; windows-2022 / win22 20260706.237.1 native X64; macos-15 / macos15 20260706.0213.1 native ARM64; and macos-15-intel / macos15 20260629.0276.1 native X64. Every job recorded Node v24.18.0 and the exact source commit.

• Remote and transport: none; target-native artifact assembly, generated-project verification, bundled-Node/native-module execution, strict comparison, and unpublished Actions artifacts only

• Exact evidence commands:

  gh pr view 8741 --repo stablyai/orca \
    --json number,state,isDraft,headRefName,headRefOid,url,statusCheckRollup,updatedAt
  gh api repos/stablyai/orca/actions/runs/29358223742
  gh api 'repos/stablyai/orca/actions/runs/29358223742/jobs?per_page=100'
  gh api 'repos/stablyai/orca/actions/runs/29358223742/artifacts?per_page=100'
  gh run view 29358223742 --repo stablyai/orca --job 87171219167 --log
  gh run view 29358223742 --repo stablyai/orca --job 87171219067 --log-failed
  gh api repos/stablyai/orca/actions/jobs/87171219067/logs | \
    sed -n '/windows_arm64_disassembly=first/,$p'
  gh run download 29358223742 --repo stablyai/orca --dir <temporary-directory>
  jq -c '{tupleId,contentId,nodeVersion,archive,fileCount}' \
    <temporary-directory>/*/*.identity.json
  

• Result: FAIL as the intended strict reproducibility gate. The lowercase arm64 correction reaches the one expected Release group on both native arm64 clean builds. Both log exactly one inherited compiler and linker option block containing /Brepro and /experimental:deterministic, then assemble, inspect, verify, and execute the complete runtime. Each bundled Node v24.18.0 smoke proves ABI 137, patched PTY input/resize/exit code 23, watcher create/update/delete, and settled Windows resources. Strict comparison then rejects only runtime/node_modules/node-pty/build/Release/conpty_console_list.node; no arm64 output is staged for upload.

• Windows arm64 outputs: both PE files are 956,928 bytes. The first content identity is sha256:a6adc716ec39503f68f4e322624ed9193b9343ca4b5f74d22843c47635e81519, with 33,261,547-byte ZIP sha256:5aebde73ef6cad605d13c5c27977f1229729aa28a6959649989d8ecd4a6d2a9e; the second is sha256:2aef13722dd084941069d260591c529d1ca5ebf0b1e2defa34da4c43f44c2d24, with the same ZIP size and digest sha256:974612580fa7a008bcf3377ddd13ce5f99b78cc31c99c7b9b720066b3f9dc91c. Both archives contain 42 files and expand to 86,189,895 bytes.

• PE oracle: the complete scan reports 5,826 differing bytes across 2,886 coalesced ranges. The .text contribution is 5,758 bytes across 2,879 two-byte ranges from file offsets 1,052 through 47,102, exactly 16 bytes apart. The remaining 68 bytes are one four-byte COFF timestamp, three four-byte debug timestamps, one 16-byte CodeView identifier, and 36 derived .rdata bytes. Section layout, file size, executable control-flow bytes, and all other bytes match.

• Paired disassembly oracle: the first 512 .text bytes contain repeated 16-byte function thunks. For every displayed thunk, adrp x16, target, add x16, x16, offset, and br x16 are byte-identical. Only the unreachable fourth instruction differs: first build 0000024d (udf #0x24d), second build 0000016d (udf #0x16d). This classifies the changing bytes as linker-emitted thunk padding; it does not yet prove the generated linker setting responsible.

• Uploaded controls: exactly five unpublished seven-day artifacts and no Windows arm64 artifact: Linux x64 8321096098, 29,281,909 bytes, sha256:cbe4d1be7664227fa34fb977f568ba0fc9409d5b5f5139fd4937013e46501074, content ID sha256:960546cd96c67fcf9bb0a61e96ecdbecbffd9104d3a495578f8bb19dd810649a, archive sha256:c87306e069af8c849b7679ccdf0504cc48c51b0ac0586edcdbf698972156bab5; Linux arm64 8321099340, 28,212,775 bytes, sha256:0502a9710a9612c44fc2aa4792ee1f30859158fcac40668b59c35ca670eb83f2, content ID sha256:aa3aa8ae8b42334ba7b0dbe5c43fd1184e36b3f4f4a9bec0e990e9b78f090756, archive sha256:f017fcd7808cd8ba86175b2fad63103e880d57ccbec70412938e0cc145310eda; macOS x64 8321127611, 26,376,349 bytes, sha256:9297b99e9605c065cbf04d3431edadf8312ee19dd1b60d8790cba95f090bd68e, content ID sha256:585ea6034cdd07487d8667059f975a877c795a45dc0d6eeee1617f2e3749faa2, archive sha256:5669d69085d268e01fe5ece6e4372832c3f61c89bcefa9acaf732c81eb460775; macOS arm64 8321085541, 24,740,934 bytes, sha256:8ab194c0d0c08ab40aa8f7821738fd5c2e3b1821fb83df6d59992b6106ba46f2, content ID sha256:40ff5d2036784b794e7b09f78596409f63f3145280c530bece5280d40897f6cb, archive sha256:b51e5a6a53aeff2ae47e4156900981395516c9b246ab1ae3fff5c4c34500ee0a; and Windows x64 8321159937, 37,075,308 bytes, sha256:dcadebbcbb7d3c6f308badeefa7940350022b22bb76fd31baed15bb304af56c1, content ID sha256:2a6bfa06b445fb78d6e4a5abba6ec379cbed6f7830c805e82c7145d18a1c3d8b, archive sha256:ee1a0cc8bdf55d783ed1c1232dedd788710a1d88edd7e89a2ddfa84e0986d7ca.

• Duration and resource metrics: jobs ran 3m07s Linux arm64, 9m15s Windows arm64, 3m02s Linux x64, 5m22s Windows x64, 2m41s macOS arm64, and 4m11s macOS x64. Windows arm64 clean builds took 149,415.066 ms and 130,574.341 ms; verification took 7,688.862 ms and 8,012.846 ms, with smoke taking 5,865.144 ms at 53,235,712-byte RSS and 5,553.779 ms at 53,133,312-byte RSS. Cancellation, SSH channel/file counts, and fallback delay are outside this artifact-only run.

• Artifact/log/trace link: run/jobs and the five unpublished artifacts above; rejected arm64 bytes exist only in the bounded job workspace and log diagnostics and were not uploaded

• Oracle proved: real native lowercase platform acceptance, exact generated compiler/linker option propagation, two complete executable arm64 candidates, strict rejection, exact five-control reproducibility, bounded linker-thunk classification, and rejected-output no-upload.

• Does not prove: whether MSBuild enabled incremental linking, that disabling it is the safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple. No executable byte may be normalized from this evidence.

• Checklist items satisfied: target-native platform-case gate and bounded ARM64 instruction diagnostic only; no tuple or production checkbox.

• Follow-up: add a purpose-tested bounded parser for the exact generated Release LinkIncremental state, require both Windows clean builds to report it, and rerun all six native controls before considering one copied-artifact producer correction.

E-M3-WINDOWS-LINK-INCREMENTAL-DIAGNOSTIC-LOCAL-001 — Effective MSBuild link-state gate

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 36a19f525cc63e488f49daa5c3a6aafc590acc08; stacked draft PR #8741, target-native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot evaluate a native MSBuild project, so the two Windows jobs remain authoritative.

• Remote and transport: none; strict command/output contracts and builder ordering only

• Exact red command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  

• Red result: FAIL as intended, one failed and four passed tests because windowsNodePtyLinkIncrementalCommand was not implemented.

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  node --check config/scripts/ssh-relay-node-pty-build.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  pnpm exec lint-staged
  git diff --check
  

• Green result: PASS. All syntax checks exited zero; the purpose command passed 9/9 tests across three suites; all 15 artifact suites passed 54/54 tests. Typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, staged hooks, and diff checks exited zero. Full lint emitted only pre-existing warnings outside this package; lint-staged reported no staged files in its standalone run and the commit hook subsequently ran oxlint, React Doctor, and oxfmt successfully over all four staged files.

• Duration and resource metrics: purpose gate 1.93 s wall / 459 ms Vitest; complete artifact gate 2.87 s wall / 1.35 s Vitest; typecheck 3.10 s; focused lint and line ratchet 3.09 s; full lint 12.91 s. Synthetic peak RSS, open files/channels, cancellation settlement, and fallback delay were not instrumented.

• Artifact/log/trace link: exact implementation commit and local command output; no binary artifact was created or uploaded

• Oracle proved: Windows builds form a bounded MSBuild.exe query for the exact generated conpty_console_list.vcxproj, Release configuration, and tuple architecture; request only the evaluated LinkIncremental property; accept exactly one case-insensitive boolean result; and fail before staging on missing, noisy, or non-boolean output. x64 and arm64 commands are covered, POSIX creates no query, and the result is appended to the existing generated-setting record.

• Does not prove: MSBuild.exe -getProperty availability or result on either native Windows image, the actual effective incremental-link state, the thunk owner, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local bounded effective-link-state diagnostic only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, run all six target-native cells, and require both Windows clean builds to report linkIncremental before changing the producer.

E-M3-WINDOWS-LINK-INCREMENTAL-CI-RED-001 — Native property oracle is empty and fails closed

• Date: 2026-07-14

• Commit SHA / PR: exact head 2d4433bbd0d2481d3f91c56d10155989cd6e7e44, containing exact diagnostic implementation commit 36a19f525cc63e488f49daa5c3a6aafc590acc08; stacked draft PR #8741

• Run and jobs: run 29359948742, conclusion failure; macOS x64 87177167723 success, Linux x64 87177167732 success, Windows x64 87177167740 expected diagnostic failure, Windows arm64 87177167757 expected diagnostic failure, macOS arm64 87177167776 success, and Linux arm64 87177167801 success

• Runners: GitHub-hosted Windows x64 used windows-2022 / win22 20260706.237.1, native X64; Windows arm64 used windows-11-arm / win11-arm64 20260706.102.1, native ARM64. Both recorded Node v24.18.0 and exact source head 2d4433bbd. The four POSIX cells used the same target-native labels as E-M3-WINDOWS-ARM64-THUNK-DISASSEMBLY-CI-RED-001.

• Remote and transport: none; target-native artifact assembly, strict pre-staging diagnostic, and unpublished Actions artifacts only

• Exact evidence commands:

  gh run view 29359948742 --repo stablyai/orca \
    --json headSha,status,conclusion,url,createdAt,updatedAt,jobs
  gh api repos/stablyai/orca/actions/jobs/87177167740/logs
  gh api repos/stablyai/orca/actions/jobs/87177167757/logs
  gh api 'repos/stablyai/orca/actions/runs/29359948742/artifacts?per_page=100'
  

• Result: FAIL as the intended diagnostic boundary. Each native Windows job completes the first copied node-pty build and validates the generated Release compiler/linker option blocks. The subsequent MSBuild.exe -getProperty:LinkIncremental query exits zero but writes only an empty value. The strict parser rejects it with unexpected LinkIncremental evaluation from MSBuild before runtime staging, archive creation, verification, smoke, comparison, or upload. This proves the property oracle is not usable and does not prove that incremental linking is enabled or disabled.

• Uploaded controls: exactly four unpublished seven-day POSIX artifacts and no Windows artifacts: Linux x64 8321792649, 29,280,250 bytes, sha256:81b21c5f0670cd0337a9b8c666a154c474f52780d19d745497e25bbe69adcfe3; Linux arm64 8321797660, 28,211,154 bytes, sha256:deca7d86e20442287878c6d17f6d533ba6be626dd7ff765f7cd841986272ffc8; macOS x64 8321944562, 26,386,865 bytes, sha256:045573de326e8f9532ac31d5449f4aed4a201bbf152c98d971aa761c76e5ec37; and macOS arm64 8321811571, 24,727,700 bytes, sha256:8fc66890341f548671ec15d0875186ca5ea128cb1ea959a2a69cacc14b9c0864.

• Duration and resource metrics: jobs ran 9m08s macOS x64, 3m13s Linux x64, 2m50s Windows x64, 6m31s Windows arm64, 3m56s macOS arm64, and 3m21s Linux arm64. Both Windows failures occur after one native build but before runtime smoke, so no new Windows RSS, channel/file count, cancellation, or fallback metric exists.

• Artifact/log/trace link: run/jobs and the four unpublished POSIX artifacts above; no Windows runtime or binary was staged or uploaded

• Oracle proved: both native Windows architectures return an empty evaluated Release LinkIncremental property and the bounded diagnostic rejects it before staging. All four POSIX controls remain reproducible and upload.

• Does not prove: the actual linker command, whether /INCREMENTAL was passed, the thunk owner, a safe producer correction, Windows runtime equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native negative property-oracle evidence only; no tuple or production checkbox.

• Follow-up: inspect the actual post-build link.command.1.tlog under a byte cap, emit only an allowlisted switch summary, and retain all existing strict comparison/no-upload controls.

E-M3-WINDOWS-LINK-COMMAND-TRACKING-LOCAL-001 — Bounded native linker-command gate

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 4a66435b71b158624645c614543d139a9ea45d51; stacked draft PR #8741, target-native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot generate the native MSBuild tracking file, so Windows x64/arm64 jobs remain authoritative.

• Remote and transport: none; bounded local file/parser and builder-ordering contracts only

• Exact red commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  

• Red result: the pre-implementation purpose suite failed two and passed four tests because the tracking-path/parser contracts did not exist. The later bounded-reader audit deliberately added malformed UTF-16 input and failed one of eleven tests because Buffer.toString('utf16le') preserved a lone surrogate instead of rejecting it. Fatal TextDecoder decoding closed that gap; the audit red run took 0.99 s wall with 131,973,120-byte maximum RSS and 96,196,032-byte peak memory footprint.

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  node --check config/scripts/ssh-relay-node-pty-build.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Green result: PASS. The purpose suites pass 11/11 tests and all 15 artifact suites pass 56/56. Syntax checks, typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, and diff checks exit zero. Full lint emits only pre-existing warnings outside this artifact package.

• Duration and resource metrics: purpose gate 0.89 s wall / 166 ms Vitest with 132,513,792-byte maximum RSS and 96,720,296-byte peak footprint; complete artifact gate 1.35 s wall / 550 ms Vitest with 137,068,544-byte maximum RSS and 95,819,104-byte peak footprint; typecheck 3.10 s, focused lint 0.34 s, max-lines 2.01 s, full lint 10.89 s, and format 2.24 s. No SSH channels/files, cancellation, fallback, or runtime latency is exercised by this diagnostic-only package.

• Artifact/log/trace link: current exact source/tests and local command output; no runtime artifact was created, staged, published, or uploaded

• Oracle proved: the builder locates the target-specific post-build conpty_console_list.tlog/link.command.1.tlog, reads at most 256 KiB plus one rejection byte, accepts fatal UTF-16LE-BOM or UTF-8 decoding, requires exactly one command record and one each of /Brepro, /guard:cf, and /experimental:deterministic, classifies incremental linking as enabled/disabled/unspecified, and emits only the allowlisted switch summary. Oversize, malformed encoding/switches, duplicate records/switches, ambiguous incremental states, and missing required switches fail before runtime staging. POSIX paths create no tracking-file lookup.

• Does not prove: the file path/encoding/record shape on either native Windows runner, the emitted switch summary, the incremental-link state, thunk ownership, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local bounded post-build tracking diagnostic only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, run all six target-native cells, and require both Windows clean builds to emit the same accepted summary before changing the producer.

E-M3-WINDOWS-LINK-COMMAND-PATH-CI-RED-001 — Native fixed tracking path is absent

• Date: 2026-07-14

• Commit SHA / PR: exact head dafca2060f2daf4ba27b54a0eb18bb9700136f5b, containing exact tracking implementation commit 4a66435b71b158624645c614543d139a9ea45d51; stacked draft PR #8741

• Run and jobs: run 29361673339, conclusion failure; macOS arm64 87183054190 success, Linux arm64 87183054293 success, Windows arm64 87183054295 expected diagnostic failure, macOS x64 87183054306 success, Linux x64 87183054310 success, and Windows x64 87183054318 expected diagnostic failure

• Runners: GitHub-hosted Windows x64 used windows-2022 / win22 20260706.237.1, native X64; Windows arm64 used windows-11-arm64 / win11-arm64 20260706.102.1, native ARM64. Both used runner 2.335.1, Node v24.18.0, MSVC 14.44.35207, and exact source head dafca2060. The four POSIX controls used their previously recorded target-native labels.

• Remote and transport: none; target-native artifact assembly, strict pre-staging diagnostic, and unpublished Actions artifacts only

• Exact evidence commands:

  gh run view 29361673339 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/jobs/87183054318/logs
  gh api repos/stablyai/orca/actions/jobs/87183054295/logs
  gh api 'repos/stablyai/orca/actions/runs/29361673339/artifacts?per_page=100'
  

• Result: FAIL as the intended diagnostic boundary. Each Windows job successfully compiles conpty_console_list.node for its native architecture, then the bounded reader receives ENOENT for the locally assumed fixed build/Release/obj/conpty_console_list/conpty_console_list.tlog/ link.command.1.tlog location. Both jobs fail before runtime staging, verification, smoke, comparison, or upload. This proves only that the fixed path is wrong; it does not show whether a target-matching tracking file exists elsewhere.

• Uploaded controls: exactly four unpublished seven-day POSIX artifacts and no Windows artifacts: Linux x64 8322467354, 29,282,467 bytes, sha256:75a29015224b0dd96e479f94d362be7023af0263373192332488ca4cc30647ae; Linux arm64 8322477826, 28,215,101 bytes, sha256:07e9be64b1ab7fd2a9ebf9a30672bd275c670d5f0c95bd624b933d3bc870515e; macOS x64 8322529916, 26,372,643 bytes, sha256:a0c3fdd314b19b0f371b5ea88eb862dfe335a785506b8011f8fde915f1323b1c; and macOS arm64 8322474835, 24,749,773 bytes, sha256:11ddd1291e7b104edae6e54d18ab44a20a90aa28a29ed3d2bd92e2f3202d215c.

• Duration and resource metrics: jobs ran 3m25s macOS arm64, 3m27s Linux arm64, 6m40s Windows arm64, 5m37s macOS x64, 3m06s Linux x64, and 3m00s Windows x64. Both Windows failures occur after one native compile but before runtime smoke; no new Windows RSS, channel/file count, cancellation, or fallback metric exists.

• Artifact/log/trace link: run/jobs and the four unpublished POSIX artifacts above; no Windows runtime or rejected binary was staged or uploaded

• Oracle proved: both native Windows architectures share the same absent fixed tracking path while the target native build itself completes; all four POSIX controls remain reproducible and upload; rejected Windows output remains unavailable to consumers.

• Does not prove: the actual tracking-file path, candidate cardinality, command record shape, allowlisted switch summary, incremental-link state, thunk ownership, a safe producer correction, Windows runtime equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native negative path-shape evidence only; no tuple or production checkbox.

• Follow-up: replace the false fixed-path assumption with bounded build-tree discovery that requires exactly one target-matching link.command.1.tlog, then rerun all six native cells without weakening parsing, comparison, or no-upload controls.

E-M3-WINDOWS-LINK-COMMAND-DISCOVERY-LOCAL-001 — Bounded target-matching discovery

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 6198f0ddd5b31704ab72902e9a21e78412da870d; stacked draft PR #8741, target-native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot generate the native MSBuild tree, so Windows x64/arm64 jobs remain authoritative.

• Remote and transport: none; bounded build-tree discovery, target selection, and builder-ordering contracts only

• Red evidence: E-M3-WINDOWS-LINK-COMMAND-PATH-CI-RED-001 on both native Windows architectures; no synthetic local failure is substituted for that real path-shape evidence

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  node --check config/scripts/ssh-relay-node-pty-build.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Green result: PASS. The purpose suites pass 13/13 tests and all 15 artifact suites pass 58/58. Syntax checks, typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, and diff checks exit zero. Full lint emits only pre-existing warnings outside this artifact package.

• Duration and resource metrics: focused purpose gate 1.03 s wall / 227 ms Vitest with 131,825,664-byte maximum RSS and 95,999,352-byte peak footprint; complete artifact gate 2.96 s wall / 1.36 s Vitest; typecheck 3.08 s, focused lint 0.66 s, max-lines 1.47 s, and full lint 13.87 s. The final full artifact run was parallel with static gates, so its process RSS was not isolated. No SSH channels/files, cancellation, fallback, or runtime latency is exercised.

• Artifact/log/trace link: current exact source/tests and local command output; no runtime artifact was created, staged, published, or uploaded

• Oracle proved: discovery is deterministic and bounded to 10,000 build-tree entries, depth eight, and 32 exact-name candidates; symbolic links fail closed; each candidate read remains bounded; target selection requires exactly one token-bounded conpty_console_list.node output rather than a lookalike or path assumption. Missing/duplicate targets, excessive depth/cardinality, oversized bytes, malformed contents, and all existing strict-parser failures settle before staging. POSIX performs no discovery.

• Does not prove: that either native Windows tree contains a candidate, candidate cardinality on the runners, the actual record shape, allowlisted switch summary, incremental-link state, thunk ownership, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local bounded tracking discovery only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, rerun all six target-native cells, and require both Windows clean builds to select one target record and emit the same accepted summary before changing the producer.

E-M3-WINDOWS-LINK-COMMAND-DISCOVERY-CI-RED-001 — Whole build tree exceeds depth bound

• Date: 2026-07-14

• Commit SHA / PR: exact head f9a49d53123b27b19713eadef927de1102ec08de, containing exact discovery implementation commit 6198f0ddd5b31704ab72902e9a21e78412da870d; stacked draft PR #8741

• Run and jobs: run 29362672415, conclusion failure; Windows x64 87186432938 expected diagnostic failure, Windows arm64 87186432948 expected diagnostic failure, macOS arm64 87186432965 success, Linux arm64 87186432979 success, Linux x64 87186432980 success, and macOS x64 87186433013 success

• Runners: GitHub-hosted Windows x64 and arm64 used the same native labels, images, runner, Node, and MSVC versions recorded by E-M3-WINDOWS-LINK-COMMAND-PATH-CI-RED-001; exact source head was f9a49d531. The four POSIX controls used their previously recorded target-native labels.

• Remote and transport: none; target-native artifact assembly, bounded build-tree discovery, and unpublished Actions artifacts only

• Exact evidence commands:

  gh run view 29362672415 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/jobs/87186432938/logs
  gh api repos/stablyai/orca/actions/jobs/87186432948/logs
  gh api 'repos/stablyai/orca/actions/runs/29362672415/artifacts?per_page=100'
  

• Result: FAIL as the intended discovery boundary. Each Windows job successfully compiles the target and enters bounded discovery, then rejects with MSBuild linker tracking discovery exceeds the bounded depth before opening or parsing a candidate. Starting at the complete generated build tree includes unrelated dependency/project subtrees; the evidence does not justify raising the eight-level limit. Both logs show the target binary is emitted under build/Release, which is the narrow output-tree root for the next correction.

• Uploaded controls: exactly four unpublished seven-day POSIX artifacts and no Windows artifacts: Linux x64 8322871131, 29,278,807 bytes, sha256:b11ceb6bd42d28d379d32b3627a242f60cf62f78e9a7267589220ce7737b9c63; Linux arm64 8322874205, 28,209,038 bytes, sha256:f2195e1f4c03d1fb6507e32b5d5328a65f351c2c22b56a8144aa1c9449c3f733; macOS x64 8322934998, 26,370,804 bytes, sha256:6fea712fd57b06cc93a7e8f0f3ebda4526307258be66ba901cd3fc190f7a03ed; and macOS arm64 8322879006, 24,728,020 bytes, sha256:2407308e60002c5e735cd301f1f30e9754d5c383a18f36009d14f08085f1f577.

• Duration and resource metrics: jobs ran 2m58s Windows x64, 6m25s Windows arm64, 3m45s macOS arm64, 3m25s Linux arm64, 3m22s Linux x64, and 5m56s macOS x64. Windows fails after one native compile but before runtime smoke; no new Windows RSS, channel/file count, cancellation, or fallback metric exists.

• Artifact/log/trace link: run/jobs and four unpublished POSIX artifacts above; no Windows runtime or rejected binary was staged or uploaded

• Oracle proved: both native Windows architectures reach and enforce the same traversal-depth bound; whole-build-tree discovery is too broad; the target output tree is build/Release; all four POSIX controls remain reproducible and upload.

• Does not prove: whether build/Release contains tracking candidates, candidate/target cardinality, record shape, allowlisted switch summary, incremental-link state, thunk ownership, a safe producer correction, Windows equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native negative discovery-root evidence only; no tuple or production checkbox.

• Follow-up: narrow the discovery root to build/Release without raising or removing any bound, then rerun all six native cells and require exactly one target record on both Windows runners.

E-M3-WINDOWS-LINK-COMMAND-RELEASE-ROOT-LOCAL-001 — Release output-tree discovery scope

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 6f28a8cbf53d1cfe889ce259476eb4aaaead2d87; stacked draft PR #8741, target-native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot generate the native MSBuild tree, so Windows x64/arm64 jobs remain authoritative.

• Remote and transport: none; bounded discovery-root and builder-ordering contracts only

• Red evidence: E-M3-WINDOWS-LINK-COMMAND-DISCOVERY-CI-RED-001 on both native Windows architectures; no synthetic local failure substitutes for that real traversal-shape evidence

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  node --check config/scripts/ssh-relay-node-pty-build.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Green result: PASS. The purpose suites pass 13/13 tests and all 15 artifact suites pass 58/58. Syntax checks, typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, and diff checks exit zero. Full lint emits only pre-existing warnings outside this package.

• Duration and resource metrics: focused purpose gate 1.26 s wall / 263 ms Vitest with 131,710,976-byte maximum RSS and 95,868,256-byte peak footprint; complete artifact gate 4.01 s wall / 1.92 s Vitest; typecheck 4.21 s, focused lint 0.90 s, max-lines 2.37 s, and full lint 13.78 s. The final artifact run was parallel with static gates, so its process RSS was not isolated. No SSH channels/files, cancellation, fallback, or runtime latency is exercised.

• Artifact/log/trace link: current exact source/tests and local command output; no runtime artifact was created, staged, published, or uploaded

• Oracle proved: target discovery begins at build/Release, matching the exact native output tree evidenced by both Windows logs; tests place valid, irrelevant, duplicate, oversized, deep, and over-cardinality fixtures below that root. The existing entry/depth/candidate/byte, symbolic-link, encoding, target-cardinality, strict-parser, and POSIX no-op contracts remain unchanged.

• Does not prove: that either native Release tree contains a candidate, candidate/target cardinality, record shape, allowlisted switch summary, incremental-link state, thunk ownership, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local Release-tree discovery scope only; no tuple or production checkbox.

• Follow-up: push the exact implementation and ledger head, rerun all six target-native cells, and require both Windows clean builds to select one target record and emit the same accepted summary before changing the producer.

E-M3-WINDOWS-LINK-COMMAND-RELEASE-ROOT-CI-RED-001 — Native command classified; arm64 drift retained

• Date: 2026-07-14

• Commit SHA / PR: exact head 2db46d91b17789ce70eed5e5e496dec2ff56442a, containing exact Release-root implementation commit 6f28a8cbf53d1cfe889ce259476eb4aaaead2d87; stacked draft PR #8741

• Run and jobs: run 29363423068, conclusion failure; Windows x64 87188953411 success, Windows arm64 87188953416 expected strict-comparison failure, Linux arm64 87188953471 success, Linux x64 87188953495 success, macOS x64 87188953507 success, and macOS arm64 87188953532 success

• Runners: Windows x64 used windows-2022 / win22 20260706.237.1, native X64, Windows Server 2022 build 20348; Windows arm64 used windows-11-arm / win11-arm64 20260706.102.1, native ARM64, Windows build 26200. Both used Node v24.18.0 and MSVC 14.44.35207 / compiler 19.44.35228. Linux x64 used ubuntu-24.04 / ubuntu24 20260705.232.1; Linux arm64 used ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2; macOS x64 used macos-15-intel / macos15 20260629.0276.1; macOS arm64 used macos-15 / macos15 20260706.0213.1. Every runner checked out the exact head above.

• Remote and transport: none; target-native artifact assembly, strict comparison, and unpublished seven-day Actions artifacts only

• Exact evidence commands:

  gh run view 29363423068 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/jobs/87188953411/logs
  gh api repos/stablyai/orca/actions/jobs/87188953416/logs
  gh api 'repos/stablyai/orca/actions/runs/29363423068/artifacts?per_page=100'
  

• Result: FAIL as the intended strict reproducibility boundary. Each clean build on both Windows architectures discovers three link.command.1.tlog candidates under 82 build/Release entries, selects exactly one record naming conpty_console_list.node, and accepts fatal UTF-16LE input. The two x64 records are 2,114 bytes and the two arm64 records are 2,092 bytes. All four report incremental: unspecified and the identical allowlisted switches /brepro, /debug, /experimental:deterministic, and /guard:cf; no explicit /incremental or /opt switch is present. Windows x64 and all four POSIX jobs compare exactly. Windows arm64 builds, verifies, and executes both candidates, then strict comparison rejects only runtime/node_modules/node-pty/build/Release/conpty_console_list.node and skips upload.

• Arm64 diagnostic: the two 956,928-byte modules differ at 5,826 bytes across 2,886 ranges: 5,758 bytes in 2,879 two-byte .text ranges spaced 16 bytes apart, plus 68 derived COFF/debug/CodeView bytes. Their content IDs are sha256:4c4cc3b9ee0bac3a391a49ebfce230fef1d94984ef0f66eeba59fd2833b2a0d2 and sha256:26afc17c33337f6f1b8e767504a58207f4fc68cb26e807aca68a9d5e8040aba5.

• Uploaded controls: exactly five unpublished artifacts and no Windows arm64 artifact: Windows x64 8323220212, 37,075,312 bytes, sha256:10a07ff4863e4a0b4aef3325540660952f03f88cc7b2c2a4013f3081b5c9310c; Linux x64 8323166437, 29,285,377 bytes, sha256:21ee42d19e6a9f15e7afda18f9e27ff5ae280a19da61ef4042ca5b0a3ce608fe; Linux arm64 8323165493, 28,220,691 bytes, sha256:19cb887221810cd9e9df160d6ba6a185fd6282adee90d2dde6c66ad9a83e4fe1; macOS x64 8323238492, 26,405,918 bytes, sha256:af41bae838a26b1e127bc1bd20c3d1f2a6d0d5de1f6aeb9372d2b19561a2351a; and macOS arm64 8323152771, 24,729,554 bytes, sha256:aff001434f0d00db32d92a13ffbb40ed4f0cc0199cf29925109fc7f7bbf84977.

• Duration and resource metrics: jobs ran 5m33s Windows x64, 8m15s Windows arm64, 3m25s Linux arm64, 3m30s Linux x64, 6m18s macOS x64, and 2m55s macOS arm64. Windows arm64 clean builds took 135,371.797 ms and 118,713.734 ms; smoke took 5,767.417 ms at 53,186,560-byte RSS and 5,443.331 ms at 51,802,112-byte RSS. SSH channels/files, cancellation, and fallback delay remain outside this artifact-only run.

• Artifact/log/trace link: run/jobs and the five unpublished artifacts above; rejected arm64 bytes existed only in the bounded job workspace and logs and were not uploaded

• Oracle proved: the native Release-tree shape, candidate and target cardinality, record encoding, and allowlisted linker summary on both Windows architectures; no explicit incremental-link switch; five exact clean-build controls; unchanged arm64 thunk drift; strict rejection and no-upload.

• Does not prove: effective incremental linking when /DEBUG supplies a default, the target .ilk state, a safe producer correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native Release-root/command diagnostic only; no tuple or production checkbox.

• Follow-up: inspect only the exact target .ilk file's presence and size within the already bounded clean Release tree on both architectures. If it is present, require target-native evidence before considering copied-artifact /INCREMENTAL:NO; if absent, investigate the next bounded linker feature. Preserve /guard:cf, strict comparison, rejected-output no-upload, and all repository-wide/default behavior.

E-M3-WINDOWS-INCREMENTAL-DATABASE-LOCAL-001 — Bounded target .ilk diagnostic

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit e7d9a1c8d3222ff5923679ad69b76b57d963c4f3; stacked draft PR #8741, target-native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot produce a native MSVC .ilk, so Windows x64/arm64 jobs remain authoritative.

• Remote and transport: none; bounded local discovery/result-shape contracts only

• Red evidence: E-M3-WINDOWS-LINK-COMMAND-RELEASE-ROOT-CI-RED-001 proves both native commands carry /DEBUG but no explicit /INCREMENTAL; no synthetic local result substitutes for the pending target-native file-state evidence

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. The purpose suites pass 13/13 tests and all 15 artifact suites pass 58/58. Syntax, typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, diff, and staged pre-commit hooks exit zero. Full lint emits only pre-existing warnings outside this artifact package.

• Duration and resource metrics: purpose gate 0.94 s wall / 204 ms Vitest with 131,940,352-byte maximum RSS and 96,081,224-byte peak footprint; complete artifact gate 3.50 s wall / 1.59 s Vitest with 132,235,264-byte maximum RSS and 96,392,544-byte peak footprint. The parallel typecheck/focused-lint/max-lines group completed in 3.8 s; full lint completed in 17.3 s and formatting/diff checks in 0.8 s. No runtime archive, SSH channel/file, cancellation, fallback, or launch-latency metric is exercised by this diagnostic-only package.

• Artifact/log/trace link: exact implementation commit and local command output; no runtime artifact was created, staged, published, or uploaded

• Oracle proved: the already bounded and deterministic build/Release traversal detects at most one exact case-insensitive conpty_console_list.ilk; duplicate target databases fail closed; a present file reports only a safe numeric byte size, absence reports no guessed link state, symbolic links retain the existing rejection, and POSIX remains a no-op. The diagnostic result is appended to the existing allowlisted MSBuild summary before staging.

• Does not prove: whether either native Windows build emits the target .ilk, that .ilk presence alone owns the arm64 thunk drift, that /INCREMENTAL:NO is a safe correction, arm64 equality, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local bounded target incremental-database diagnostic only; no tuple or production checkbox.

• Follow-up: push the exact implementation plus ledger head, rerun all six native cells, and require both clean builds on both Windows architectures to report the target .ilk state before any producer change. Preserve /guard:cf, strict comparison, no rejected upload, and every default/legacy boundary.

E-M3-WINDOWS-INCREMENTAL-DATABASE-CI-RED-001 — Native .ilk proves implicit incremental link

• Date: 2026-07-14

• Commit SHA / PR: exact ledger head d1eca8a55dec3e96f9ecf1600e8e6e169cdfd3fe, containing exact diagnostic implementation commit e7d9a1c8d3222ff5923679ad69b76b57d963c4f3; stacked draft PR #8741

• Run and jobs: run 29364581781, conclusion failure; Windows x64 87192850326 success, Windows arm64 87192850417 expected strict-comparison failure, Linux arm64 87192850309 success, Linux x64 87192850444 success, macOS x64 87192850303 success, and macOS arm64 87192850364 success

• Runners: Windows x64 used windows-2022 / win22 20260706.237.1, native X64; Windows arm64 used windows-11-arm / win11-arm64 20260706.102.1, native ARM64. Linux x64 used ubuntu-24.04 / ubuntu24 20260705.232.1; Linux arm64 used ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2; macOS x64 used macos-15-intel / macos15 20260629.0276.1; macOS arm64 used macos-15 / macos15 20260706.0213.1. Every runner checked out the exact head above; both Windows jobs used Node v24.18.0 and MSVC 14.44.35207 / compiler 19.44.35228.

• Remote and transport: none; target-native artifact assembly, strict comparison, and unpublished seven-day Actions artifacts only

• Exact evidence commands:

  gh run view 29364581781 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/jobs/87192850326/logs
  gh api repos/stablyai/orca/actions/jobs/87192850417/logs
  gh api 'repos/stablyai/orca/actions/runs/29364581781/artifacts?per_page=100'
  curl -fsSL --proto '=https' --tlsv1.2 \
    'https://learn.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170' \
    | rg -i -C 2 'DEBUG|incremental.*default|\.ilk|INCREMENTAL:NO'
  

• Result: FAIL as the intended strict evidence boundary. Both clean x64 builds report the same 4,238,838-byte conpty_console_list.ilk; both clean arm64 builds report the same 4,980,517-byte target database. All four still report /debug with incremental: unspecified and no explicit /incremental or /opt switch in the command record. Microsoft documents that /DEBUG implies /INCREMENTAL, incremental links create/update an .ilk, and /INCREMENTAL:NO overrides the default. Windows x64 and all four POSIX controls compare exactly. Windows arm64 builds, verifies, and executes both candidates, then rejects only conpty_console_list.node and skips upload.

• Arm64 diagnostic: the two 956,928-byte modules again differ at 5,826 bytes across 2,886 ranges: 5,758 bytes in 2,879 two-byte .text ranges spaced 16 bytes apart, plus the same 68 derived COFF/debug/CodeView bytes. Their content IDs are sha256:b38d3343e96f339eb7197a4fb379b5f636d5f6752d42434b508bb7c67803f57c and sha256:9d937233f63b142f03e504af2ffeeeb05b2de2b979047a369a79dd1d793b1786.

• Uploaded controls: exactly five unpublished artifacts and no Windows arm64 artifact: Windows x64 8323660213, 37,075,309 bytes, sha256:788c43c94db25e995e6d36ab437d841e01a24846f3b8ec519f62fd7bebeb4fbd; Linux x64 8323618920, 29,280,401 bytes, sha256:0b19a0b1dd78793ae0d55f7077eb871a7a8f98d3f7e4c3b8fd5f457f8f008fd6; Linux arm64 8323624757, 28,207,487 bytes, sha256:cf4bb8255b260fc9109b9180b05d561a3b3cb0c3eeb791d111aff649368a5c86; macOS x64 8323808296, 26,420,419 bytes, sha256:4117ae641972cad3936b9733b8461148ab2e4e3280cb3d27d31b479d966e412a; and macOS arm64 8323599375, 24,749,802 bytes, sha256:b29cba1d66f7fedfa89bd4994d0186b5f2e0f89a17b95d709727808e0ccf3590.

• Duration and resource metrics: jobs ran 4m56s Windows x64, 10m25s Windows arm64, 3m32s Linux arm64, 3m22s Linux x64, 10m47s macOS x64, and 2m38s macOS arm64. Windows arm64 clean builds took 156,490.445 ms and 135,338.371 ms; smoke took 5,949.372 ms at 53,084,160-byte RSS and 5,425.281 ms at 52,871,168-byte RSS. SSH channels/files, cancellation, and fallback delay remain outside this artifact-only run.

• Artifact/log/trace link: run/jobs, Microsoft linker reference above, and the five unpublished artifacts; rejected arm64 bytes existed only in the bounded job workspace and logs and were not uploaded

• Oracle proved: a fresh target incremental-link database on both clean builds and both native architectures; the documented /DEBUG-implied incremental state; stable target database sizes; five exact controls; unchanged arm64 thunk drift; strict rejection and no rejected upload.

• Does not prove: that /INCREMENTAL:NO removes the thunk drift, that all six outputs compare, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: native implicit-incremental-link classification only; no tuple or production checkbox.

• Follow-up: add exactly one /INCREMENTAL:NO to only the copied node-pty Windows linker options. Fail closed unless the generated project and actual command each contain it exactly once and the clean tree contains no target .ilk; rerun all six native cells with /guard:cf, strict comparison, and rejected-output no-upload unchanged.

E-M3-WINDOWS-INCREMENTAL-DISABLE-LOCAL-001 — Copied-artifact full-link correction

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 6dfdfa0bd0d812c20981ffb728ddd18273097e6a; stacked draft PR #8741, target-native execution pending

• Runner: macOS 26.2 build 25C56, native Apple M4 arm64; Node v26.0.0 and pnpm 10.24.0. This runner cannot execute MSVC, so Windows x64/arm64 jobs remain authoritative.

• Remote and transport: none; copied-source, generated-project, actual-command/result-shape, and ordering contracts only

• Red evidence: E-M3-WINDOWS-INCREMENTAL-DATABASE-CI-RED-001 proves both native architectures use /DEBUG-implied incremental linking, create stable target .ilk files, and retain the arm64 thunk drift; no synthetic local failure substitutes for that target-native evidence

• Exact green commands:

  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs
  node --check config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  /usr/bin/time -lp pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-node-release-verification.test.mjs \
    config/scripts/ssh-relay-node-tar-inspection.test.mjs \
    config/scripts/ssh-relay-node-pty-build.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-windows-settlement.test.mjs \
    config/scripts/ssh-relay-node-zip-inspection.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-build.test.mjs \
    config/scripts/ssh-relay-runtime-pty-smoke.test.mjs \
    config/scripts/ssh-relay-runtime-reproducibility.test.mjs \
    config/scripts/ssh-relay-runtime-resource-diagnostics.test.mjs \
    config/scripts/ssh-relay-runtime-windows-pe-diagnostic.test.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs
  pnpm run typecheck
  pnpm exec oxlint \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs
  pnpm run check:max-lines-ratchet
  GOMAXPROCS=2 pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.mjs \
    config/scripts/ssh-relay-node-pty-windows-build-determinism.test.mjs \
    config/scripts/ssh-relay-node-pty-build.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. The purpose suites pass 13/13 tests and all 15 artifact suites pass 58/58. Syntax, typecheck, focused oxlint, the 355-entry max-lines ratchet, full repository lint/reliability/localization, formatting, diff, and staged pre-commit hooks exit zero. Full lint emits only pre-existing warnings outside this artifact package.

• Duration and resource metrics: purpose gate 1.00 s wall / 202 ms Vitest with 132,235,264-byte maximum RSS and 96,408,952-byte peak footprint; complete artifact gate 2.63 s wall / 1.13 s Vitest with 132,251,648-byte maximum RSS and 96,490,944-byte peak footprint. The parallel typecheck/focused-lint/max-lines group completed in 3.1 s; full lint and format/diff gates settled within 10.1 s. No runtime archive, SSH channel/file, cancellation, fallback, or launch-latency metric is exercised by this local package.

• Artifact/log/trace link: exact implementation commit and local command output; no runtime artifact was created, staged, published, or uploaded

• Oracle proved: only the copied Windows node-pty linker options gain exactly one /INCREMENTAL:NO; compiler options remain separate and /guard:cf remains present; source drift or repeat transformation fails closed; generated Release projects must inherit exactly one disable switch; actual target commands must classify it as disabled; any target .ilk fails before staging; POSIX and the installed repository source remain unchanged. Both source and test modules remain below 300 lines without a max-lines bypass.

• Does not prove: MSVC accepts/propagates the option on either native architecture, that target .ilk is absent, that the arm64 thunks become stable, that all six outputs compare and upload, oldest baselines, native trust, SSH, publication, transfer, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local copied-artifact incremental-disable contract only; no tuple or production checkbox.

• Follow-up: push the exact implementation plus ledger head and rerun all six target-native cells. Require both Windows clean builds to report /incremental:no, no target .ilk, complete runtime smoke, exact output equality, and upload before accepting the correction.

E-M3-REPRODUCIBILITY-CI-001 — All six target-native clean builds compare and upload

• Date: 2026-07-14

• Commit SHA / PR: exact ledger head 3ec1a48afde95618fb7e3f6be71303410e6701dd, containing exact incremental-disable implementation commit 6dfdfa0bd0d812c20981ffb728ddd18273097e6a; stacked draft PR #8741

• Run and jobs: run 29365815434, conclusion success; Windows arm64 87196982746, Windows x64 87196982776, Linux arm64 87196982798, Linux x64 87196982795, macOS x64 87196982820, and macOS arm64 87196982760 all passed

• Runners: Windows x64 used windows-2022 / win22 20260706.237.1, native X64; Windows arm64 used windows-11-arm / win11-arm64 20260706.102.1, native ARM64. Linux x64 used ubuntu-24.04 / ubuntu24 20260705.232.1; Linux arm64 used ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2; macOS x64 used macos-15-intel / macos15 20260629.0276.1; macOS arm64 used macos-15 / macos15 20260706.0213.1. Every runner checked out the exact head above; both Windows jobs used Node v24.18.0 and MSVC 14.44.35207 / compiler 19.44.35228.

• Remote and transport: none; target-native runtime assembly, exact clean-build comparison, and unpublished seven-day Actions artifacts only

• Exact evidence commands:

  gh run view 29365815434 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/jobs/87196982776/logs
  gh api repos/stablyai/orca/actions/jobs/87196982746/logs
  gh api 'repos/stablyai/orca/actions/runs/29365815434/artifacts?per_page=100'
  

• Result: PASS. Both clean x64 builds report one generated and actual /INCREMENTAL:NO, retain /guard:cf, parse a 2,146-byte UTF-16LE command record, search 79 bounded Release-tree entries, and find no target .ilk. Both clean arm64 builds report the same contract with a 2,124-byte command record and no target .ilk. Each architecture then executes bundled Node v24.18.0, loads the exact ABI-137 native modules, proves PTY input/resize/exit and watcher create/update/delete, settles Windows native resources, verifies the archive, and compares the complete runtime tree, archive, identity, SPDX, and provenance exactly before upload. No PE mismatch diagnostic runs.

• Stable Windows identities: x64 content ID sha256:6f7cbeb120e67766037649f6079099346220973e6158e1429b6ebf42729f1564 and archive sha256:d24ca7ee8734e948c845d792ba0974a2590df7c8b60068a46f3eb1dc24af5f36; arm64 content ID sha256:741765a10ddc824cd305b9a50c8efd91477517c05d9cfe1ca46342c002652186 and archive sha256:3e1e89234cd0d139a2a1376e7cd5e17ab47e31a6c3c2f9dcb8e73317ead5c6aa.

• Uploaded evidence: exactly six unpublished artifacts: Windows arm64 8324239473, 33,083,333 bytes, sha256:51d590835597969b1261f81487eea433f23e1c04818c96f2f1e5d48b16688b42; Windows x64 8324177555, 37,033,210 bytes, sha256:3bde38ab4159bea7b420118862db3725ce845084ab515cc3e08de439aceb308a; Linux arm64 8324115839, 28,209,475 bytes, sha256:4f7272d896616326a5231170054a71134122c0263200361cf46431951fe01307; Linux x64 8324100611, 29,286,004 bytes, sha256:346afca964edbe932f868a8ff00e13adba7d3d0c489ef0bdce8ca275134dc27e; macOS x64 8324167852, 26,427,328 bytes, sha256:0d265ebc18798680de250955daf9038fded4a45c596cb6609f847eef328d9668; and macOS arm64 8324088333, 24,713,338 bytes, sha256:aed95365e3cf309f723142eb6638caad2faf46cacde60661c95cffb1703734cf.

• Duration and resource metrics: jobs ran 8m39s Windows arm64, 6m07s Windows x64, 3m42s Linux arm64, 3m10s Linux x64, 5m45s macOS x64, and 2m43s macOS arm64. Windows x64 clean builds took 127,019.748 ms and 80,495.086 ms; smoke took 5,383.956 ms at 53,903,360-byte RSS and 5,343.569 ms at 53,874,688-byte RSS. Windows arm64 clean builds took 139,406.185 ms and 123,440.275 ms; smoke took 5,782.042 ms at 51,310,592-byte RSS and 5,463.552 ms at 51,372,032-byte RSS. SSH channels/files, cancellation, fallback delay, and connection latency remain outside this artifact-only run.

• Artifact/log/trace link: run/jobs and six unpublished artifacts above; no release asset was published and no production consumer exists

• Oracle proved: target-native generated/actual full-link settings, absence of incremental-link databases, all-six clean-build reproducibility, exact archive/identity/SBOM/provenance equality, complete candidate runtime smoke, strict comparison, and successful evidence upload. The prior Windows arm64 thunk drift is closed at the copied producer without byte normalization.

• Does not prove: oldest supported OS/kernel/libc execution, native code-signing trust, packaged desktop embedding, SSH/SFTP/system-SSH transfer, remote install/launch, fallback, UI, performance, publication, or any enabled tuple.

• Checklist items satisfied: current-candidate native clean-build reproducibility and the exact bundled Node/native PTY/watcher archive-execution rule. No tuple or production path is enabled.

• Follow-up: audit the remaining runtime closure/SBOM/provenance claims against the exact staged allowlist and purpose tests, then address oldest-baseline and native-trust gates. Preserve the artifact-only boundary and all legacy/default behavior.

E-M3-RUNTIME-CLOSURE-LOCAL-001 — Exact per-tuple closure fails before archiving

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit ec5461aff61d6868c18d4db1ce27f409a43ecf47; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for the pure contract suite. Candidate inputs came from all six target-native jobs in prior run 29365815434; the new builder gate has not yet executed on those native runners.

• Remote and transport: none; artifact-only local validation of downloaded unpublished evidence

• Exact evidence commands:

  gh run download 29365815434 --repo stablyai/orca \
    --dir /tmp/orca-ssh-relay-runtime-29365815434
  for archive in /tmp/orca-ssh-relay-runtime-29365815434/*/*.tar.xz; do
    tar -tf "$archive"
  done
  for archive in /tmp/orca-ssh-relay-runtime-29365815434/*/*.zip; do
    unzip -Z1 "$archive"
  done
  rm -rf /tmp/orca-ssh-relay-runtime-29365815434/extracted
  mkdir -p /tmp/orca-ssh-relay-runtime-29365815434/extracted
  for directory in /tmp/orca-ssh-relay-runtime-29365815434/ssh-relay-runtime-*; do
    tuple=${directory##*/ssh-relay-runtime-}
    destination=/tmp/orca-ssh-relay-runtime-29365815434/extracted/$tuple
    mkdir -p "$destination"
    archive=$(find "$directory" -maxdepth 1 -type f \
      \( -name '*.tar.xz' -o -name '*.zip' \) -print -quit)
    case "$archive" in
      *.tar.xz) tar -xf "$archive" -C "$destination" ;;
      *.zip) unzip -q "$archive" -d "$destination" ;;
    esac
  done
  node --input-type=module -e 'import {readdir,readFile} from "node:fs/promises"; import {join} from "node:path"; import {verifySshRelayRuntimeClosure} from "./config/scripts/ssh-relay-runtime-closure.mjs"; const root="/tmp/orca-ssh-relay-runtime-29365815434"; for (const dir of (await readdir(root)).filter((name)=>name.startsWith("ssh-relay-runtime-")).sort()) { const tuple=dir.slice("ssh-relay-runtime-".length); const names=await readdir(join(root,dir)); const identity=JSON.parse(await readFile(join(root,dir,names.find((name)=>name.endsWith(".identity.json"))),"utf8")); const result=await verifySshRelayRuntimeClosure(join(root,"extracted",tuple),identity); console.log(JSON.stringify({tuple,...result,contentId:identity.contentId})); }'
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm exec oxlint config/scripts/ssh-relay-runtime-closure.mjs \
    config/scripts/ssh-relay-runtime-closure.test.mjs \
    config/scripts/ssh-relay-runtime-tree.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-closure.mjs \
    config/scripts/ssh-relay-runtime-closure.test.mjs \
    config/scripts/ssh-relay-runtime-tree.mjs
  pnpm run check:max-lines-ratchet
  git diff --check
  

• Result: PASS. Sixteen artifact test files passed 68 tests. The new closure suite fixes the exact candidate file counts at 34 for Linux, 35 for macOS, and 42 for Windows; admits exactly one tuple-native @parcel/watcher@2.5.6 package; pins node-pty@1.1.0 and all runtime JavaScript dependency metadata; requires canonical roles/modes, runtime metadata, and eight ordered, non-empty license sections; and rejects an undeclared package manager, source map, PDB, missing native dependency, wrong role, version refresh, omitted license, or empty license before archive creation. Focused syntax, lint, formatting, max-lines ratchet, and diff checks passed.

• Downloaded-candidate audit: all six prior candidate identities and extracted metadata satisfy the new contract without changing their content IDs: Linux x64 sha256:960546cd96c67fcf9bb0a61e96ecdbecbffd9104d3a495578f8bb19dd810649a, Linux arm64 sha256:aa3aa8ae8b42334ba7b0dbe5c43fd1184e36b3f4f4a9bec0e990e9b78f090756, macOS x64 sha256:585ea6034cdd07487d8667059f975a877c795a45dc0d6eeee1617f2e3749faa2, macOS arm64 sha256:40ff5d2036784b794e7b09f78596409f63f3145280c530bece5280d40897f6cb, Windows x64 sha256:6f7cbeb120e67766037649f6079099346220973e6158e1429b6ebf42729f1564, and Windows arm64 sha256:741765a10ddc824cd305b9a50c8efd91477517c05d9cfe1ca46342c002652186.

• Oracle proved: the artifact builder now has one cross-platform, fail-closed, exact closure boundary rather than depending on incomplete POSIX/PowerShell workflow blocklists; dependency refreshes and new runtime files require an explicit reviewed contract change; the prior six candidate trees conform to that contract.

• Does not prove: execution of this new gate on any target-native runner, that the current SBOM has complete package/file relationships, complete compiler/toolchain/image provenance, oldest- baseline execution, native trust, SSH transfer/install, publication, fallback, UI, or any enabled tuple.

• Checklist items satisfied: local exact-closure/prohibited-content implementation and purpose tests only. The broader Milestone 3 closure/SBOM/provenance items remain unchecked until the new gate passes all six native cells and the metadata audit closes its residual gaps.

• Follow-up: push the implementation plus this exact evidence ledger, rerun all six native jobs, and require unchanged runtime content IDs, builder-enforced closure, complete smoke, clean-build equality, and upload. Then fix and prove SBOM/provenance completeness separately.

E-M3-RUNTIME-CLOSURE-CI-001 — Exact closure passes all six target-native builds

• Date: 2026-07-14

• Commit SHA / PR: exact ledger head ace3d4f416b1c710d601aa72c4b45824266b5cad, containing exact closure implementation commit ec5461aff61d6868c18d4db1ce27f409a43ecf47; stacked draft PR #8741

• Run and jobs: run 29367559831, conclusion success; Windows arm64 87202773590, Windows x64 87202773643, macOS arm64 87202773645, macOS x64 87202773658, Linux x64 87202773669, and Linux arm64 87202773674 all passed

• Runners: windows-11-arm / win11-arm64 20260706.102.1 native ARM64; windows-2022 / win22 20260706.237.1 native X64; macos-15 / macos15 20260706.0213.1 native ARM64; macos-15-intel / macos15 20260629.0276.1 native X64; ubuntu-24.04 / ubuntu24 20260705.232.1 native X64; and ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2 native ARM64. Every job checked out the exact head above in a GitHub-hosted environment.

• Remote and transport: none; target-native artifact build/inspection/smoke and unpublished seven-day Actions artifacts only

• Exact evidence commands:

  gh run view 29367559831 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29367559831 --repo stablyai/orca --log | \
    rg 'requested_runner=|resolved_image_os=|resolved_image_version=|runner_arch=|runner_environment=|source_commit='
  gh run view 29367559831 --repo stablyai/orca --log | \
    rg 'Test Files|"contentId"|windows_node_pty_msbuild_settings|clean_build_output=|runtime-evidence/'
  gh api 'repos/stablyai/orca/actions/runs/29367559831/artifacts?per_page=100'
  

• Result: PASS. All four POSIX jobs passed 15 artifact-contract files and both Windows jobs passed 16. Each clean build then executed the builder-enforced exact closure before archiving, archive inspection, bundled Node/native PTY/watcher smoke, strict clean-output comparison, and upload. Both Windows builds retained exactly one /INCREMENTAL:NO, /guard:cf, no target .ilk, and identical native output. No tuple changed content identity: Linux x64 sha256:960546cd96c67fcf9bb0a61e96ecdbecbffd9104d3a495578f8bb19dd810649a, Linux arm64 sha256:aa3aa8ae8b42334ba7b0dbe5c43fd1184e36b3f4f4a9bec0e990e9b78f090756, macOS x64 sha256:585ea6034cdd07487d8667059f975a877c795a45dc0d6eeee1617f2e3749faa2, macOS arm64 sha256:40ff5d2036784b794e7b09f78596409f63f3145280c530bece5280d40897f6cb, Windows x64 sha256:6f7cbeb120e67766037649f6079099346220973e6158e1429b6ebf42729f1564, and Windows arm64 sha256:741765a10ddc824cd305b9a50c8efd91477517c05d9cfe1ca46342c002652186.

• Uploaded evidence: exactly six unpublished artifacts: Windows arm64 8324892474, 33,083,332 bytes, sha256:1b90d23c5573116cf855926db294dff906407a5703260099d0d0f58bb500eb6a; Windows x64 8324831155, 37,033,206 bytes, sha256:013fa42e0bf29a36f378dffe6d327090a042be9e5947e55e6e097d3382418c5d; macOS arm64 8324786647, 24,734,978 bytes, sha256:87e2632c542964df47ab4f981da0909532c51be6b2131692e539aaa1c77d409c; macOS x64 8324870620, 26,400,500 bytes, sha256:d9ddf9b00d77aa05785e0813e3a61fcb07cd8f5f06b270e9703d5f2e28c03370; Linux arm64 8324781748, 28,205,869 bytes, sha256:47d40a3eacf149270efabe7688f700dcfca7c1e155bbc2188298c7e78948469b; and Linux x64 8324772777, 29,281,599 bytes, sha256:5b1552f4e2d28db1f552068e3bad6eb174e83ad88800101120a92cf2f0e44121.

• Duration and resource metrics: job wall times were 7m51s Windows arm64, 5m26s Windows x64, 3m38s macOS arm64, 6m58s macOS x64, 3m06s Linux x64, and 3m23s Linux arm64. SSH channels/files, cancellation, fallback delay, and connection latency remain outside this artifact-only run.

• Oracle proved: the exact closure is enforced inside the artifact builder on all six native runner families; the reviewed Node, patched native PTY, one tuple-native watcher, relay/watcher JavaScript, runtime metadata, and license bundle are present; package managers, development/build/source/map/ PDB/ILK content and any unreviewed path are absent; complete smoke, reproducibility, and no-upload- before-success ordering remain intact.

• Does not prove: the subsequent SPDX/toolchain correction at 26bbd7b67, oldest-baseline execution, native signing/trust, SSH transfer/install, publication, fallback, UI, performance, or any enabled tuple.

• Checklist items satisfied: build the exact patched node-pty; assert patch markers; include one compatible watcher and the complete declared runtime/license/metadata closure; exclude all undeclared content. No tuple or production path is enabled.

• Follow-up: prove the separately committed metadata correction on all six native cells before checking SBOM/toolchain completeness, then proceed to oldest-baseline and native-trust gates.

E-M3-METADATA-LOCAL-001 — SPDX ownership and bounded toolchain provenance

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 26bbd7b67a035cdf309ccdbbaab5985f4cc797fe; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure metadata/tool-discovery tests

• Remote and transport: none; artifact-only local contract tests

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/build-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-runtime-provenance.mjs \
    config/scripts/ssh-relay-runtime-provenance.test.mjs \
    config/scripts/ssh-relay-runtime-sbom.mjs \
    config/scripts/ssh-relay-runtime-sbom.test.mjs \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  git diff --check
  

• Result: PASS. Nineteen artifact test files passed 76 tests; typecheck, full lint and its reliability/localization/line-budget sub-gates, focused formatting, and diff checks passed. The SPDX builder assigns every runtime file to exactly one package with CONTAINS, records relay DEPENDS_ON relationships, uses the immutable content ID as relay package version, uses the exact archive SHA-256 in the unique document namespace, and rejects unowned paths, identifier collisions, or a missing archive digest. The provenance collector pins the builder URL to the exact Git commit, requires the requested/resolved runner label, OS, architecture, hosted environment, and image version, selects the real Windows compiler/linker version from stderr rather than the usage line, and records bounded SHA-256 plus version for bundled/build Node, compiler, linker where applicable, build system, Python, archive tool, strip tool where applicable, and complete bounded trees for node-gyp, node-addon-api, and yazl where applicable.

• Oracle proved: the prior placeholder relay SBOM version, unowned file inventory, content-ID-only document namespace, merge-ref builder identity, missing runner identity, un-hashed tool strings, and Windows compiler usage-string record are corrected by one fail-closed metadata boundary; local native discovery produces only bounded version/digest records without absolute host paths.

• Does not prove: Windows tool discovery/version parsing, all six runner-image records, clean-build equality of the new SBOM/provenance bytes, uploaded metadata, an external SPDX consumer, native signing/trust, oldest baselines, SSH, publication, or any enabled tuple.

• Checklist items satisfied: local SBOM/provenance/toolchain implementation and purpose tests only; native metadata/toolchain boxes remain unchecked.

• Follow-up: push the exact implementation plus this ledger head, rerun all six native cells, inspect each uploaded SPDX/provenance document, and require complete bounded records and clean-build equality before closing the remaining Milestone 3 metadata/toolchain claims.

E-M3-METADATA-CI-RED-001 — Native metadata probes fail closed on Windows

• Date: 2026-07-14

• Commit SHA / PR: exact tested head 27e932c8cbc44f09d9b410d3aca519e7d1b8e9fe; stacked draft PR #8741

• Runner: GitHub Actions run 29368482959, final conclusion failure after 7m56s. Native job IDs: Linux x64 87205814073, Linux arm64 87205814134, macOS x64 87205814075, macOS arm64 87205814110, Windows x64 87205814074, and Windows arm64 87205814066.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29368482959 --repo stablyai/orca --json status,conclusion,headSha,url,jobs
  gh api repos/stablyai/orca/actions/jobs/87205814074/logs
  gh api repos/stablyai/orca/actions/jobs/87205814066/logs
  gh api repos/stablyai/orca/actions/runs/29368482959/artifacts
  gh run download 29368482959 --repo stablyai/orca --dir /tmp/orca-8450-metadata-red-29368482959
  # Parse every downloaded identity/SPDX/provenance document and hash every archive locally.
  

• Result: EXPECTED RED. Linux x64 completed in 2m58s, Linux arm64 in 3m24s, macOS arm64 in 4m08s, and macOS x64 in 7m56s; each passed the 19-file/76-test native contract suite, built twice, smoked, compared every runtime/archive/identity/SPDX/provenance byte exactly, and uploaded. Windows x64 failed in 1m32s and Windows arm64 in 4m09s at ssh-relay-runtime-toolchain.test.mjs before input download, build, smoke, comparison, or upload: line 217 could not select a linker version because direct no-argument link.exe invocation was silent on both hosted MSVC environments. The four POSIX artifact IDs are Linux x64 8325127644, Linux arm64 8325138929, macOS arm64 8325153830, and macOS x64 8325244087; no Windows artifact exists for this run.

• Downloaded-artifact audit: all four archive hashes match identity and provenance; every SPDX namespace is scoped to the exact archive SHA-256; all 34 Linux and 35 macOS files have exactly one package CONTAINS owner; each document has eight relay dependency relationships; builder URLs pin exact commit 27e932c8c; and runner labels, OS, architecture, hosted environment, image OS, and image version are present and correct. POSIX content IDs remain 960546cd… Linux x64, aa3aa8ae… Linux arm64, 585ea603… macOS x64, and 40ff5d20… macOS arm64.

• Additional defect exposed by direct payload inspection: both Linux provenance documents record the first no-argument GNU strip usage line instead of a version. macOS records Xcode 16.4 and has no equivalent defect. A green job alone would not have caught this semantic provenance gap.

• Oracle proved: native metadata generation, equality, archive-scoped SPDX identity, package/file ownership, dependency relationships, commit-pinned builder identity, and runner identity work on all four POSIX cells; both Windows cells reject incomplete linker provenance before producing or uploading bytes; direct artifact audit detects semantically wrong tool-version records.

• Does not prove: any Windows metadata/build output, valid GNU strip version records, complete all-six toolchain provenance, regenerated Windows compatibility identities, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the compiler/toolchain item remains in progress.

• Follow-up: explicitly request bounded linker help, request GNU strip --version, correct the reviewed Windows 19045/26100 compatibility floors, and rerun every native cell from one exact head.

E-M3-METADATA-CORRECTION-LOCAL-001 — Native version probes and Windows build floors

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit e3f76d3ba70c860242b5300aa765fbf75ef21317; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure contract tests

• Remote and transport: none; artifact/selector-only local contract tests

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs \
    config/scripts/ssh-relay-runtime-tree.mjs \
    config/scripts/ssh-relay-runtime-windows-tree.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  

• Result: PASS. Twenty test files passed 96 tests; typecheck, full lint and its reliability/localization/line-budget sub-gates, max-lines ratchet, focused formatting, and diff checks passed. The only full-lint diagnostics are pre-existing unrelated warnings. link.exe is now invoked with /?, GNU strip with --version, and Apple strip remains tied to the selected Xcode version. Generated Windows runtime identities now encode the reviewed monotonic build floors: x64 19045 and arm64 26100. Purpose-named selector tests reject x64 19044 and arm64 26099 while accepting x64 19045 and arm64 26100; both runtime-tree variants carry the same floors.

• Oracle proved: the two native probe regressions have bounded explicit invocation contracts; the artifact producer, ZIP fixture, and desktop selector tests agree with the reviewed Windows compatibility decision; unknown/older Windows evidence still takes the classified legacy path.

• Does not prove: either corrected probe on a native Windows/Linux runner, actual compiler/linker/ strip values in uploaded provenance, clean-build equality after Windows identity changes, oldest Windows execution, native trust/signing, SSH, publication, or an enabled tuple. The Windows compatibility change intentionally changes both Windows content IDs and requires fresh native evidence.

• Checklist items satisfied: local correction only; the compiler/toolchain, oldest-baseline, and native-trust boxes remain unchecked.

• Follow-up: push the exact implementation and ledger head, then require all six native jobs plus direct inspection of every uploaded metadata document before closing the metadata/toolchain gate.

• Subsequent native evidence: E-M3-METADATA-CI-RED-002 disproves the locally inferred link.exe /? behavior; both hosted Windows architectures remain silent when the help output is piped by Node.

E-M3-METADATA-CI-RED-002 — Linker help remains silent on native Windows

• Date: 2026-07-14

• Commit SHA / PR: exact tested head c906c21ce117021885ec4db68c62ef28c141d7ba; stacked draft PR #8741

• Runner: GitHub Actions run 29369350259, final conclusion failure after 6m15s. Native job IDs: Linux x64 87208675566, Linux arm64 87208675357, macOS x64 87208675363, macOS arm64 87208675377, Windows x64 87208675364, and Windows arm64 87208675391.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29369350259 --repo stablyai/orca --json status,conclusion,headSha,jobs
  gh api repos/stablyai/orca/actions/jobs/87208675364/logs
  gh api repos/stablyai/orca/actions/jobs/87208675391/logs
  gh api repos/stablyai/orca/actions/runs/29369350259/artifacts
  gh run download 29369350259 --repo stablyai/orca --dir /tmp/orca-8450-metadata-red-29369350259
  # Parse every downloaded identity/SPDX/provenance document and hash every archive locally.
  

• Result: EXPECTED RED. Linux x64 completed in 2m53s, Linux arm64 in 3m30s, macOS arm64 in 2m52s, and macOS x64 in 6m14s; each passed native contracts, built twice, smoked, compared every runtime/archive/identity/SPDX/provenance byte exactly, and uploaded. Windows x64 failed in 1m24s and Windows arm64 in 3m51s at the same linker-version selector before input download, build, smoke, comparison, or upload. Explicit link.exe /? is still silent when invoked through the bounded Node child-process pipe on both hosted MSVC environments. The four POSIX artifact IDs are Linux x64 8325461679, Linux arm64 8325476952, macOS arm64 8325460610, and macOS x64 8325542377; no Windows artifact exists for this run.

• Downloaded-artifact audit: all four archive hashes match identity and provenance; every SPDX namespace is scoped to the exact archive SHA-256; all 34 Linux and 35 macOS files have exactly one package owner and eight dependency relationships; builder URLs pin exact commit c906c21ce; runner identities are complete; Linux x64/arm64 now record GNU strip (GNU Binutils for Ubuntu) 2.42; and no tool record contains a usage line. POSIX content IDs remain unchanged.

• Oracle proved: the corrected GNU version probe works and stays reproducible on both Linux architectures; all four POSIX metadata contracts are complete for this head; direct linker banner parsing is not a portable Windows provenance source and fails closed on both native architectures.

• Does not prove: Windows metadata/build output, regenerated Windows content identities, native linker file versions, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the compiler/toolchain item remains in progress.

• Follow-up: retain SHA-256 of the resolved linker but obtain its actual PE file version without relying on linker stdout/stderr, then rerun every native cell from one exact head.

E-M3-WINDOWS-LINKER-FILE-VERSION-LOCAL-001 — Authenticated linker PE version

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit e85f0c700c1bd40e76e08ef5063f9b3128acb600; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure invocation/metadata tests

• Remote and transport: none; artifact-only local contract tests

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs
  git diff --check
  

• Result: PASS. Twenty test files passed 97 tests; typecheck, full lint and its reliability/localization/line-budget sub-gates, focused formatting, and diff checks passed. The linker record still hashes the resolved link.exe bytes. Its version now comes from System.Diagnostics.FileVersionInfo through pwsh.exe -NoLogo -NoProfile -NonInteractive; the resolved path is a separate positional argument and is never interpolated into executable script text. Only a bounded numeric three- or four-component file version is accepted.

• Oracle proved: the native-silent banner is no longer a provenance dependency; exact linker bytes remain authenticated; paths containing spaces cannot alter the PowerShell expression; malformed, missing, or nonnumeric file versions still fail closed.

• Does not prove: the PE file-version call on either native Windows architecture, the exact returned linker versions, Windows build/equality/upload, regenerated Windows content IDs, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: local correction only; the compiler/toolchain item remains unchecked.

• Follow-up: push this exact implementation plus the ledger head and require all six native jobs and direct inspection of every uploaded metadata document before closing the metadata/toolchain gate.

E-M3-METADATA-CI-RED-003 — Positional PE-version lookup remains empty on Windows

• Date: 2026-07-14

• Commit SHA / PR: exact tested head 01acba8608e3446bb921cfb812a7026817a53032; stacked draft PR #8741

• Runner: GitHub Actions run 29369925932, final conclusion failure after 7m05s. Native job IDs and wall durations: Linux x64 87210560419 / 3m03s, Linux arm64 87210560395 / 3m21s, macOS x64 87210560388 / 6m59s, macOS arm64 87210560695 / 3m18s, Windows x64 87210560429 / 1m24s, and Windows arm64 87210560403 / 4m49s.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29369925932 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/runs/29369925932/artifacts
  gh api repos/stablyai/orca/actions/jobs/87210560429/logs
  gh api repos/stablyai/orca/actions/jobs/87210560403/logs
  gh run download 29369925932 --repo stablyai/orca \
    --dir /tmp/orca-8450-metadata-red-29369925932
  find /tmp/orca-8450-metadata-red-29369925932 -maxdepth 3 -type f -print
  bash -eu -o pipefail <<'SH'
  evidence=/tmp/orca-8450-metadata-red-29369925932
  commit=01acba8608e3446bb921cfb812a7026817a53032
  run_id=29369925932
  find "$evidence" -type f \( -name '*.tar.xz' -o -name '*.zip' \) \
    -exec shasum -a 256 {} +
  for directory in "$evidence"/*; do
    identity=$(find "$directory" -type f -name '*.identity.json')
    provenance=$(find "$directory" -type f -name '*.provenance.json')
    spdx=$(find "$directory" -type f -name '*.spdx.json')
    archive=$(find "$directory" -type f \( -name '*.tar.xz' -o -name '*.zip' \))
    archive_sha=$(shasum -a 256 "$archive" | cut -d ' ' -f 1)
    jq -e --arg sha "$archive_sha" --arg commit "$commit" --arg run "$run_id" \
      --slurpfile provenance "$provenance" --slurpfile spdx "$spdx" '
        ($spdx[0].relationships | map(select(.relationshipType == "CONTAINS")) |
          group_by(.relatedSpdxElement) |
          map({key: .[0].relatedSpdxElement, value: length}) | from_entries) as $owners |
        .archive.sha256 == ("sha256:" + $sha) and
        .fileCount == ($spdx[0].files | length) and
        ([.entries[] | select(.type == "file")] | length) == ($spdx[0].files | length) and
        all($spdx[0].files[]; $owners[.SPDXID] == 1) and
        ($spdx[0].relationships | map(select(.relationshipType == "DEPENDS_ON")) | length) == 8 and
        $spdx[0].documentNamespace ==
          ("https://github.com/stablyai/orca/ssh-relay-runtime/spdx/" + $sha) and
        $provenance[0].subject[0].digest.sha256 == $sha and
        $provenance[0].predicate.runDetails.metadata.invocationId == $run and
        $provenance[0].predicate.runDetails.builder.id ==
          ("https://github.com/stablyai/orca/blob/" + $commit +
            "/.github/workflows/ssh-relay-runtime-artifacts.yml") and
        ($provenance[0].predicate.buildDefinition.resolvedDependencies |
          any(.digest.gitCommit == $commit and (.uri | endswith("@" + $commit)))) and
        ($provenance[0].predicate.runDetails.metadata.runner |
          .os != "" and .architecture != "" and .environment == "github-hosted" and
          .requestedLabel != "" and .image.os != "" and .image.version != "") and
        ($provenance[0].predicate.buildDefinition.internalParameters.toolchain | to_entries |
          all(.[]; (.value.version | length) > 0 and
            (.value.version | test("usage:"; "i") | not) and
            (.value.sha256 | test("^sha256:[0-9a-f]{64}$")))) and
        all(.entries[];
          (.path | test(
            "(^|/)(npm|npx|corepack)([.](cmd|exe))?$|[.](map|cc|cpp|h|hpp|o|obj|pdb|lib)$";
            "i"
          ) | not))
      ' "$identity" >/dev/null
    jq -c '{tupleId, contentId, fileCount, archive}' "$identity"
  done
  SH
  

• Result: EXPECTED RED. All four POSIX cells passed native contracts, built twice, inspected and smoked both outputs, compared runtime/archive/identity/SPDX/provenance bytes exactly, and uploaded. Windows x64 and arm64 each failed in ssh-relay-runtime-toolchain.test.mjs with Runtime build tool did not report a bounded version line; input download, build, smoke, comparison, and upload were skipped. The two Windows failures occurred after target-native MSVC setup and dependency install, so the x64 windows-2022 and arm64 windows-11-arm environments independently disprove the positional PowerShell path transport. No Windows artifact exists for this run.

• Downloaded-artifact audit:

  Tuple	Artifact ID	Archive SHA-256	Content ID prefix	Files	Runner image
  linux-x64-glibc	8325687973	c71778c6ea716eb694b8d961b6bcf0c2a379761a535fa069434a7e755903b06a	960546cd…	34	ubuntu24 20260705.232.1
  linux-arm64-glibc	8325696189	6dc95917b828675a4700444378b96c89ff5b538e1848b3a167cc10c4702794d7	aa3aa8ae…	34	ubuntu24-arm64 20260706.52.2
  darwin-x64	8325779710	332510ffba04959fbc16fdce54334fc9cca55f7b87fb19d78f1e4ce570c5b388	585ea603…	35	macos15 20260629.0276.1
  darwin-arm64	8325693875	1474f808f8d1e5668060468284236ba4c81e395931fa1bf5d3dcbfed4b45a994	40ff5d20…	35	macos15 20260706.0213.1

  Every archive hash matches its identity and provenance subject. Every SPDX namespace ends in the exact archive hash; every file has exactly one package owner; each document has nine packages and eight dependency relationships. Builder and source identities pin exact commit 01acba860; the invocation is 29369925932; requested runner labels, native architectures, environment, and image versions are present. Linux records GCC 13.3.0, GNU Make 4.3, Python 3.12.3, XZ 5.4.5, and GNU strip 2.42. macOS records Apple clang 17.0.0, GNU Make 3.81, Python 3.14.6, XZ 5.8.3, and Xcode 16.4. Every tool record carries a SHA-256 and no version contains a usage line.

• Oracle proved: all four POSIX metadata payloads remain semantically complete after the PE-version change; direct audit agrees with workflow equality; both target-native Windows architectures reject an empty PE-version result before unverified/incompletely described bytes can be built or uploaded.

• Does not prove: a working native Windows PE-version lookup, Windows build/metadata/equality/upload, regenerated Windows content IDs for the 19045/26100 floors, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the all-six SBOM/provenance/toolchain item remains in progress.

• Follow-up: transport the resolved linker path outside PowerShell argument parsing, retain exact linker-byte hashing and bounded output validation, then rerun and directly audit all six cells.

E-M3-WINDOWS-LINKER-ENV-LOCAL-001 — Environment-isolated linker path transport

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 714308114dee85a6f241a43b75c6ac9122769c3e; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure invocation/metadata tests

• Remote and transport: none; artifact-only local contracts

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  

• Result: PASS. Twenty focused test files passed 98 tests in 5.90s. Typecheck passed all three TypeScript projects. Full lint passed oxlint, switch exhaustiveness, styled-scrollbar, reliability-gate, max-lines, bundled-skill, localization-catalog, and localization-coverage gates; its diagnostics remain pre-existing unrelated warnings. The independent max-lines ratchet, focused formatting, and diff checks passed.

• Oracle proved: the PowerShell expression no longer relies on $args parsing and never interpolates the linker path into executable script text; the exact resolved path is supplied in a dedicated child-only environment value; the child inherits the required native build environment; three- and four-component PE file versions with bounded release suffixes are accepted; missing, malformed, oversized, or unrelated output remains rejected with at most 512 diagnostic bytes; and the resolved linker executable remains SHA-256 authenticated.

• Does not prove: the environment-value lookup on either native Windows architecture, the actual linker version, regenerated Windows metadata/content IDs, build/smoke/equality/upload, oldest Windows execution, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: local correction only; the all-six compiler/toolchain item remains unchecked.

• Follow-up: push this exact implementation and ledger head, then require all six native jobs and direct inspection of every uploaded artifact before closing any metadata/provenance claim.

E-M3-METADATA-CI-RED-004 — Native PE FileVersion strings are empty

• Date: 2026-07-14

• Commit SHA / PR: exact tested head 756165552d31ee962c99a3a454bce2bebb29092b; stacked draft PR #8741

• Runner: GitHub Actions run 29370926985, final conclusion failure after 7m09s. Native job IDs and wall durations: Linux x64 87213791478 / 3m13s, Linux arm64 87213791425 / 3m34s, macOS x64 87213791432 / 7m04s, macOS arm64 87213791418 / 4m32s, Windows x64 87213791403 / 2m28s, and Windows arm64 87213791472 / 3m52s.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29370926985 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/runs/29370926985/artifacts
  gh api repos/stablyai/orca/actions/jobs/87213791403/logs
  gh api repos/stablyai/orca/actions/jobs/87213791472/logs
  gh run download 29370926985 --repo stablyai/orca \
    --dir /tmp/orca-8450-metadata-red-29370926985
  # Repeat the exact fail-closed jq/shasum audit in E-M3-METADATA-CI-RED-003 with:
  # evidence=/tmp/orca-8450-metadata-red-29370926985
  # commit=756165552d31ee962c99a3a454bce2bebb29092b
  # run_id=29370926985
  

• Result: EXPECTED RED. All four POSIX cells passed contracts, two clean native builds, archive/tree inspection, bundled runtime smoke, byte-for-byte comparison, and upload. Both Windows cells passed MSVC setup, runner-identity collection, dependency install, and 77 contract tests, then the live toolchain contract failed with the now-bounded diagnostic Runtime build tool did not report a bounded version line: <empty>. The PE lookup returned successfully but the FileVersion string emitted no stdout on either architecture. Input download, build, smoke, comparison, and upload remained skipped; no Windows artifact exists.

• Downloaded-artifact audit:

  Tuple	Artifact ID	Archive SHA-256	Content ID prefix	Files
  linux-x64-glibc	8326078824	3fbd5895c66a81cef6e97c0fcc1efd210377fee6fdbb5bc56548a36377d373e5	960546cd…	34
  linux-arm64-glibc	8326088493	2f1ae08f794d9a8154b0e0714d394e8da447cff7958febc904d3f68cae493a68	aa3aa8ae…	34
  darwin-x64	8326164493	b84c3d8a7c8e0c195d82185d0476f77685d171dde13ea5b5652b1ce12917564a	585ea603…	35
  darwin-arm64	8326107962	d940054bb24d79fe31b5eaad6269fcc6bbaef6ca2c1e4703b398b631dbe85081	40ff5d20…	35

  All archive/subject hashes, archive-scoped SPDX namespaces, one-owner-per-file counts, eight dependency relationships, prohibited-content assertions, exact commit/run identities, runner labels/images/architectures, and bounded tool version/hash records passed. Content IDs and native tool versions remain identical to E-M3-METADATA-CI-RED-003; builder/source identities now pin exact head 756165552 and invocation 29370926985.

• Oracle proved: environment-isolated path transport does not fix the semantic defect because the string FileVersion property itself is empty on both native hosted Windows environments; the bounded diagnostic distinguishes that from command failure or unexpected output; all four POSIX controls remain complete and reproducible at the exact tested head.

• Does not prove: that numeric PE version fields are populated, any Windows artifact or metadata, regenerated Windows content IDs, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the all-six SBOM/provenance/toolchain item remains in progress.

• Follow-up: format the four integer PE version fields, reject 0.0.0.0, retain exact linker-byte hashing and environment-isolated path transport, then rerun and directly audit all six cells.

E-M3-WINDOWS-LINKER-NUMERIC-LOCAL-001 — Bounded numeric PE file version

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 1b775e6afe730c237f49b2d203591e07db11bfd8; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure invocation/metadata tests

• Remote and transport: none; artifact-only local contracts

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs
  git diff --check
  

• Result: PASS. Twenty focused test files passed 99 tests in 1.85s. Typecheck passed all three TypeScript projects. Full lint passed oxlint, switch exhaustiveness, styled-scrollbar, reliability-gate, max-lines, bundled-skill, localization-catalog, and localization-coverage gates; its diagnostics remain pre-existing unrelated warnings. The independent max-lines ratchet, focused formatting, and diff checks passed.

• Oracle proved: the PowerShell expression formats FileMajorPart, FileMinorPart, FileBuildPart, and FilePrivatePart as one exact four-component value; the selector rejects malformed versions, suffixes, missing output, and the version-resource-absent 0.0.0.0 form; the resolved linker path remains a child-only environment value and never enters executable script text; the exact resolved link.exe bytes remain SHA-256 authenticated.

• Does not prove: that either native Windows linker exposes nonzero numeric fields, the actual native version, Windows build/smoke/equality/upload, regenerated Windows content IDs, oldest Windows execution, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: local correction only; the all-six compiler/toolchain item remains unchecked.

• Follow-up: push this exact implementation and ledger head, then require all six native jobs and direct inspection of every uploaded artifact before closing any metadata/provenance claim.

E-M3-METADATA-CI-RED-005 — Native linkers have no PE version resource

• Date: 2026-07-14

• Commit SHA / PR: exact tested head 3c3d47fc4bf06610d43dcdb267eadfed46627b0f; stacked draft PR #8741

• Runner: GitHub Actions run 29371551072, final conclusion failure after 7m31s. Native job IDs and wall durations: Linux x64 87215769010 / 3m09s, Linux arm64 87215769039 / 3m16s, macOS x64 87215769046 / 7m20s, macOS arm64 87215769029 / 2m37s, Windows x64 87215768998 / 1m29s, and Windows arm64 87215769056 / 3m55s.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29371551072 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/runs/29371551072/artifacts
  gh api repos/stablyai/orca/actions/jobs/87215768998/logs
  gh api repos/stablyai/orca/actions/jobs/87215769056/logs
  gh run download 29371551072 --repo stablyai/orca \
    --dir /tmp/orca-8450-metadata-red-29371551072
  # Repeat the exact fail-closed jq/shasum audit in E-M3-METADATA-CI-RED-003 with:
  # evidence=/tmp/orca-8450-metadata-red-29371551072
  # commit=3c3d47fc4bf06610d43dcdb267eadfed46627b0f
  # run_id=29371551072
  

• Result: EXPECTED RED. All four POSIX cells again passed contracts, two clean native builds, archive/tree inspection, bundled runtime smoke, byte-for-byte comparison, and upload. Windows x64 and arm64 each passed 78 contract tests after native MSVC setup, then rejected the exact diagnostic Runtime build tool did not report a bounded version line: 0.0.0.0. This proves both resolved link.exe binaries lack a usable PE version resource rather than merely an empty formatted string. Input download, build, smoke, comparison, and upload remained skipped; no Windows artifact exists.

• Downloaded-artifact audit:

  Tuple	Artifact ID	Archive SHA-256	Content ID prefix	Files
  linux-x64-glibc	8326313178	fb30c981c7d8ef32a57485cad75850058b6bb38988c5fe34a269d6e0bd33eb06	960546cd…	34
  linux-arm64-glibc	8326316547	0d70e0646540461676fe4eeb8db38c13d13e4bd747db5609dec90a957c4db79d	aa3aa8ae…	34
  darwin-x64	8326400647	fe4a79d356baf0523822e4524989df4c3b3153e36e777fc44a09b96d2926df68	585ea603…	35
  darwin-arm64	8326301297	891489f352ae978aff91c227af908514df827ee7f4aba0513f5f0891a2b99ccd	40ff5d20…	35

  All archive/subject hashes, archive-scoped SPDX namespaces, one-owner-per-file counts, eight dependency relationships, prohibited-content assertions, exact commit/run identities, runner labels/images/architectures, and bounded tool version/hash records passed. POSIX content IDs and native tool versions remain unchanged; builder/source identities pin exact head 3c3d47fc4 and invocation 29371551072.

• Oracle proved: neither string nor integer PE version metadata can identify the hosted MSVC linker; both architectures fail closed before producing incomplete provenance; four independent POSIX controls remain complete and reproducible at the exact head.

• Does not prove: a bounded alternative linker identity on Windows, any Windows artifact/metadata, regenerated Windows content IDs, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the all-six SBOM/provenance/toolchain item remains in progress.

• Follow-up: derive the vendor toolset version from the canonical resolved MSVC linker directory, reject malformed/ambiguous/non-MSVC layouts, retain the exact linker SHA-256, and rerun all cells.

E-M3-WINDOWS-LINKER-TOOLSET-LOCAL-001 — Resolved MSVC toolset identity

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 18d10da2750af66ae3486b61382ab90d5c410f8a; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure path/provenance tests

• Remote and transport: none; artifact-only local contracts

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs
  git diff --check
  

• Result: PASS. Twenty focused test files passed 98 tests in 1.47s. Typecheck passed all three TypeScript projects. Full lint passed oxlint, switch exhaustiveness, styled-scrollbar, reliability-gate, max-lines, bundled-skill, localization-catalog, and localization-coverage gates; its diagnostics remain pre-existing unrelated warnings. The independent max-lines ratchet, focused formatting, and diff checks passed.

• Oracle proved: x64 and arm64 canonical Visual Studio paths produce the bounded identity MSVC 14.44.35207; path parsing uses Windows semantics on every client OS; it requires one exact case-insensitive MSVC segment, a three-component numeric version, the immediate bin segment, an absolute path, and terminal link.exe; non-MSVC and ambiguous paths fail closed. The resolved linker executable remains SHA-256 authenticated, so the path version is provenance metadata rather than the byte-identity boundary. No PowerShell, PE metadata, stdout, or mutable version lookup is required.

• Does not prove: the exact native hosted paths, a Windows toolchain record/build/smoke/equality/ upload, regenerated Windows content IDs, oldest Windows execution, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: local correction only; the all-six compiler/toolchain item remains unchecked.

• Follow-up: push this exact implementation and ledger head, then require all six native jobs and direct inspection of every uploaded artifact before closing any metadata/provenance claim.

E-M3-METADATA-CI-RED-006 — Hosted linker paths reject the assumed MSVC layout

• Date: 2026-07-14

• Commit SHA / PR: exact tested head 2ed6c8e3b3609a9cb4785011996988de915e807a; stacked draft PR #8741

• Runner: GitHub Actions run 29372156145, final conclusion failure after 6m15s. Native job IDs and wall durations: Linux x64 87217674004 / 3m06s, Linux arm64 87217674003 / 3m34s, macOS x64 87217674012 / 6m09s, macOS arm64 87217674005 / 3m44s, Windows x64 87217674050 / 1m29s, and Windows arm64 87217674002 / 3m52s.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29372156145 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/runs/29372156145/artifacts
  gh api repos/stablyai/orca/actions/jobs/87217674050/logs
  gh api repos/stablyai/orca/actions/jobs/87217674002/logs
  gh run download 29372156145 --repo stablyai/orca \
    --dir /tmp/orca-8450-metadata-red-29372156145
  # Repeat the exact fail-closed jq/shasum audit in E-M3-METADATA-CI-RED-003 with:
  # evidence=/tmp/orca-8450-metadata-red-29372156145
  # commit=2ed6c8e3b3609a9cb4785011996988de915e807a
  # run_id=29372156145
  

• Result: EXPECTED RED. All four POSIX cells passed contracts, two clean native builds, archive/tree inspection, bundled runtime smoke, byte-for-byte comparison, and upload. Windows x64 and arm64 each rejected Resolved Windows linker is not in a bounded MSVC toolset path during contract tests after native MSVC setup. Both stopped before input download, build, smoke, comparison, or upload, so no Windows artifact exists.

• Downloaded-artifact audit:

  Tuple	Artifact ID	Archive SHA-256	Content ID prefix	Files
  linux-x64-glibc	8326530355	ec09bf6a0068b3a5954af0fa17e538c9972a8389ccf420a525546fc7c63dfeb4	960546cd…	34
  linux-arm64-glibc	8326541076	c13d1454e3e2592bf667a7c5925d147fd06e0f68eec7fb875dbc3750628f88b7	aa3aa8ae…	34
  darwin-x64	8326590799	5de3e4ae940a47839f8a7a2ec24bc7b63d54954357beccf7916ff7c72fab7ff3	585ea603…	35
  darwin-arm64	8326543567	8ee92c0d45d25b0fa05360c2dada50c21b2ac4ac837089a5c40c64d22ac2b9f5	40ff5d20…	35

  All archive/subject hashes, archive-scoped SPDX namespaces, one-owner-per-file counts, eight dependency relationships, prohibited-content assertions, exact commit/run identities, runner labels/images/architectures, and bounded tool version/hash records passed.

• Oracle proved: the assumed strict MSVC directory layout does not match either hosted Windows architecture; both jobs fail closed before consuming inputs; four independent POSIX controls remain complete at the exact head.

• Does not prove: either actual resolved Windows path shape, a corrected bounded parser, any Windows artifact/metadata, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the all-six SBOM/provenance/toolchain item remains in progress.

• Follow-up: expose only a bounded path-tail diagnostic, rerun both native Windows architectures, and correct the parser only after inspecting those exact paths.

E-M3-WINDOWS-LINKER-PATH-DIAGNOSTIC-LOCAL-001 — Bounded native path evidence

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit d1eb45d613f504d7363230420f14a0c8126fe125; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure path/provenance tests

• Remote and transport: none; artifact-only local contracts

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs
  git diff --check
  

• Result: PASS. Twenty focused test files passed 99 tests. Typecheck passed all three TypeScript projects. Full lint passed with only existing unrelated warnings; the independent max-lines, focused formatting, and diff checks passed.

• Oracle proved: linker-path rejection includes at most the final 12 path segments and at most 512 characters; truncation and suffix retention are purpose-tested. The strict identity parser and exact linker SHA-256 requirement remain unchanged.

• Does not prove: either native path shape, that 12 segments are sufficient to identify the correct bounded grammar, a Windows build/smoke/equality/upload, oldest Windows execution, native trust, SSH, publication, or an enabled tuple.

• Checklist items satisfied: local diagnostic only; the all-six compiler/toolchain item remains unchecked.

• Follow-up: push this exact commit and ledger head, inspect both bounded native path tails, and make only the parser correction supported by that evidence.

E-M3-METADATA-CI-RED-007 — Git for Windows shadows the configured MSVC linker

• Date: 2026-07-14

• Commit SHA / PR: exact tested head 92f9b76101d4214c07291f6d9befa647fbc0dd86; stacked draft PR #8741

• Runner: GitHub Actions run 29372816457, final conclusion failure after 8m11s. Native job IDs and wall durations: Linux x64 87219773628 / 2m44s, Linux arm64 87219773618 / 3m33s, macOS x64 87219773620 / 8m06s, macOS arm64 87219773629 / 2m59s, Windows x64 87219773636 / 1m18s, and Windows arm64 87219773684 / 5m10s.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29372816457 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/runs/29372816457/artifacts
  gh api repos/stablyai/orca/actions/jobs/87219773636/logs
  gh api repos/stablyai/orca/actions/jobs/87219773684/logs
  gh run download 29372816457 --repo stablyai/orca \
    --dir /tmp/orca-8450-metadata-red-29372816457
  # Repeat the exact fail-closed jq/shasum audit in E-M3-METADATA-CI-RED-003 with:
  # evidence=/tmp/orca-8450-metadata-red-29372816457
  # commit=92f9b76101d4214c07291f6d9befa647fbc0dd86
  # run_id=29372816457
  

• Result: EXPECTED RED. All four POSIX cells passed contracts, two clean native builds, archive/tree inspection, bundled runtime smoke, byte-for-byte comparison, and upload. Windows x64 and arm64 each passed 18 contract files before the live toolchain test rejected C:\Program Files\Git\usr\bin\link.exe as non-MSVC. Both stopped before input download, build, smoke, comparison, or upload, so no Windows artifact exists.

• Downloaded-artifact audit:

  Tuple	Artifact ID	Archive SHA-256	Content ID prefix	Files
  linux-x64-glibc	8326768093	c312a404515db43b7219ec7c0f5ff8c33a1424a32b3cf42754820a1599afcec0	960546cd…	34
  linux-arm64-glibc	8326787062	5e31f1377be855fdddba08dab19af92360236fc9c4a08a3c6320162aa4dca4a0	aa3aa8ae…	34
  darwin-x64	8326884270	a3cacc1aaf16c659218987972a39ff367584da456d167906b13e293874297777	585ea603…	35
  darwin-arm64	8326773209	612e7328700bef7886df5caaef92c22cbbc38ad872ca40b17f0758b28e75bd92	40ff5d20…	35

  All archive/subject hashes, archive-scoped SPDX namespaces, one-owner-per-file counts, eight dependency relationships, prohibited-content assertions, exact commit/run identities, runner labels/images/architectures, and bounded tool version/hash records passed.

• Oracle proved: appending Git's signature-tool directory through GITHUB_PATH shadows link.exe identically on x64 and arm64; the first PATH match is not the configured compiler toolchain; both jobs fail closed before consuming release inputs; four independent POSIX controls remain complete.

• Does not prove: that where.exe exposes exactly one later canonical MSVC candidate, a Windows artifact/metadata record, oldest baselines, native trust/signing, SSH, publication, or an enabled tuple.

• Checklist items satisfied: no new completion box; the all-six SBOM/provenance/toolchain item remains in progress.

• Follow-up: select exactly one canonical MSVC linker from all resolved candidates, retain its exact SHA-256, reject zero/ambiguous matches, and rerun all six native cells.

E-M3-WINDOWS-LINKER-SELECTION-LOCAL-001 — Unique canonical MSVC candidate

• Date: 2026-07-14

• Commit SHA / PR: exact implementation commit 5f0c1417d5e28a0c01f1914c41d129814237e28e; stacked draft PR #8741

• Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and pnpm 10.24.0 for pure path/provenance tests

• Remote and transport: none; artifact-only local contracts

• Exact evidence commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-*.test.mjs \
    src/main/ssh/ssh-relay-artifact-selector.test.ts
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs
  git diff --check
  

• Result: PASS. Twenty focused test files passed 100 tests. Typecheck passed all three TypeScript projects. Full lint passed with only existing unrelated warnings; the independent max-lines, focused formatting, and diff checks passed.

• Oracle proved: a non-MSVC Git link.exe may precede either canonical x64 or arm64 MSVC path; selection accepts exactly one case-insensitively deduplicated strict MSVC match, rejects zero or multiple matches, and bounds rejection diagnostics. The strict absolute MSVC/<version>/bin/... grammar and exact SHA-256 of the selected linker remain required. The corrected test also proves the long-path fixtures actually interpolate and exercise the 512-byte bounds.

• Does not prove: the exact native candidate list, a Windows build/smoke/equality/upload, regenerated Windows content IDs, oldest Windows execution, native trust, SSH, publication, or an enabled tuple.

• Checklist items satisfied: local correction only; the all-six compiler/toolchain item remains unchecked.

• Follow-up: push this exact commit and ledger head, then require all six native jobs and direct inspection of every uploaded artifact before closing any metadata/provenance claim.

E-M3-METADATA-CI-001 — All-six native metadata and provenance closure

• Date: 2026-07-14

• Commit SHA / PR: exact tested head ff3ebf37e32e9dad5834e669438efd46a974a708; stacked draft PR #8741

• Runner: GitHub Actions run 29373507297, final conclusion success after 9m13s. Native job IDs and wall durations: Linux x64 87221923438 / 2m55s, Linux arm64 87221923415 / 3m06s, macOS x64 87221923414 / 7m02s, macOS arm64 87221923432 / 3m29s, Windows x64 87221923434 / 4m50s, and Windows arm64 87221923449 / 9m08s.

• Remote and transport: none; target-native artifact-only build workflow

• Exact evidence commands:

  gh run view 29373507297 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh api repos/stablyai/orca/actions/runs/29373507297/artifacts
  gh run download 29373507297 --repo stablyai/orca \
    --dir /tmp/orca-8450-metadata-green-29373507297
  # Repeat the exact fail-closed jq/shasum audit in E-M3-METADATA-CI-RED-003 with:
  # evidence=/tmp/orca-8450-metadata-green-29373507297
  # commit=ff3ebf37e32e9dad5834e669438efd46a974a708
  # run_id=29373507297
  

• Result: PASS. All six native cells passed contract tests, authenticated exact Node inputs, two independent clean builds, archive/tree inspection, bundled Node/native PTY/watcher smoke, byte-for-byte runtime/archive/identity/SPDX/provenance comparison, and unpublished upload. Direct inspection of all six downloaded payloads passed every archive/subject hash, archive-scoped SPDX namespace, one-owner-per-file count, eight-dependency relationship, prohibited-content, exact commit/run/builder/source identity, runner identity, and bounded tool version/hash assertion.

• Downloaded-artifact audit:

  Tuple	Artifact ID	Archive SHA-256	Content ID prefix	Files	Runner image
  linux-x64-glibc	8327034796	177ad16222b08beb972bf66910bbafd32bf1e820deb007fef3304057cb6a01b8	960546cd…	34	ubuntu24 20260705.232.1
  linux-arm64-glibc	8327039534	9042214412ce73cd1febf94ff48a17de7bd979808e2226485fbbbf4b73fc093a	aa3aa8ae…	34	ubuntu24-arm64 20260706.52.2
  darwin-x64	8327118454	449d96e0230f9f07437df571ccf4ab64bc124f9b398013e59c0d2ca1c4be0db8	585ea603…	35	macos15 20260629.0276.1
  darwin-arm64	8327045964	cb593b9a30a82c743e4fffb201b57192c55af927bfce71a0cf9f6dc643dd20cb	40ff5d20…	35	macos15 20260706.0213.1
  win32-x64	8327073419	b59aa25e59fb148b24dcc56d3c5ef6f1545a42673ba4e4f99a4b27fa1d0fb253	7ddad668…	42	win22 20260706.237.1
  win32-arm64	8327157772	6b2fa8471a85c4d6872df34caf32acfdb7e9bf6c94cf83af06d5f19cecc1f33e	2955cec7…	42	win11-arm64 20260706.102.1

  Windows x64 records MSVC 14.44.35207 with exact linker SHA-256 ca11e6c45debd34bf652dfe984c5360a531a005ed78bf72852330c9c2590cf0d; Windows arm64 records the same bounded toolset identity with distinct exact linker SHA-256 f167f4e80fe6c38ba7099c22d83ef189e906b97b03d316b3cbfbac1eadc9fa6a. No build job uses a container; every job records the requested native runner label, resolved image/version, architecture, environment, and exact tool executable or package-tree digests.

• Oracle proved: the current six candidates have complete target-native build metadata, exact clean-build identity, SPDX file/package ownership, license/closure contracts, runner identity, bounded compiler/toolchain records, and direct payload consistency at the tested exact head. The Git-for-Windows link.exe collision does not change the selected MSVC binary or its recorded hash.

• Does not prove: execution on declared oldest OS/libc/kernel floors, native signing/trust, cross-family SSH transfer/install, release aggregation/publication, packaged desktop consumption, fallback, rollout UI, performance, or an enabled tuple.

• Checklist items satisfied: the Milestone 3 compiler/toolchain/runner record item and the short tracker's all-six SBOM/license/provenance/toolchain/prohibited-content item.

• Follow-up: implement and run purpose-named oldest-supported-baseline checks, then prove native signing/trust before connecting any artifact consumer or enabling any tuple.

E-M3-LINUX-BASELINE-LOCAL-RED-001 — Ubuntu-built Linux candidate fails the glibc 2.28 floor

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source artifact: exact-head Actions run 29373507297, unpublished linux-x64-glibc artifact 8327034796, archive SHA-256 177ad16222b08beb972bf66910bbafd32bf1e820deb007fef3304057cb6a01b8, content ID 960546cd96c67fcf9bb0a61e96ecdbecbffd9104d3a495578f8bb19dd810649a.

• Runner/environment: local macOS arm64 controller, Docker 29.2.1, native artifact architecture executed through Docker Desktop's bounded linux/amd64 VM; container docker.io/library/rockylinux@sha256:2d05a9266523bbf24f33ebc3a9832e4d5fd74b973c220f2204ca802286aa275d (Rocky Linux 8.9, glibc 2.28, libstdc++.so.6.0.25). This is local red evidence only; native GitHub x64/arm64 repetition remains required.

• Remote and transport: no SSH remote; read-only bind-mounted unpublished runtime, container networking disabled, all capabilities dropped, no-new-privileges, 128 PIDs, 1 GiB memory, two CPUs, and a 64 MiB /tmp tmpfs.

• Commands:

  tar -xJf orca-ssh-relay-runtime-v1-linux-x64-glibc-960546cd….tar.xz -C "$runtime"
  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 2 \
    --tmpfs /tmp:rw,nosuid,size=64m \
    --mount "type=bind,src=$PWD,dst=/workspace,readonly" \
    --mount "type=bind,src=$runtime,dst=/runtime,readonly" \
    --workdir /workspace "$image" \
    /runtime/bin/node config/scripts/ssh-relay-runtime-smoke-child.cjs /runtime
  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 2 \
    --tmpfs /tmp:rw,nosuid,size=64m \
    --mount "type=bind,src=$runtime,dst=/runtime,readonly" "$image" \
    /runtime/bin/node -e "require('/runtime/node_modules/node-pty/build/Release/pty.node')"
  

• Result: expected RED. The complete smoke stops before PTY/watcher evidence because patched node-pty cannot load. Direct loading reports /lib64/libc.so.6: version 'GLIBC_2.34' not found; ldd additionally reports GLIBC_2.32 missing. The file exists and is the identity-authenticated x64 ELF, so this is an ABI-floor mismatch rather than a missing archive entry.

• Verifier defect exposed: the first baseline CLI run also rejected with Runtime baseline did not resolve one bounded libstdc++ ABI library; inspection found its filename parser accidentally removed the SONAME 6 from libstdc++.so.6.0.25. This is E-M3-BASELINE-VERIFIER-LOCAL-RED-001 and requires a focused parser test/correction before CI.

• Oracle proved: Ubuntu 24.04 producer smoke and target-native architecture alone do not prove the declared Linux ABI floor; current Linux candidate bytes are ineligible.

• Does not prove: native x64 timing, Linux arm64 behavior, kernel 4.18, SSH transfer/install, native trust, or any enabled tuple.

• Follow-up: build both Linux tuples in the digest-pinned Rocky 8.9 userland on native runners, correct the bounded libstdc++ filename parser, repeat smoke/baseline/equality/metadata gates, and keep kernel 4.18 explicitly open.

E-M3-LINUX-BUILDER-PYTHON-LOCAL-RED-001 — Rocky 8 default Python is too old for node-gyp 12

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: uncommitted local WP2 correction at Git HEAD 775f2cbcc7f66f6e728fa06ae2d6822edd50f7b0; no artifact was emitted or published.

• Runner/environment: local macOS arm64 controller, Docker 29.2.1, linux/amd64 Docker Desktop emulation; builder base docker.io/library/rockylinux@sha256:2d05a9266523bbf24f33ebc3a9832e4d5fd74b973c220f2204ca802286aa275d (Rocky Linux 8.9, glibc 2.28, libstdc++.so.6.0.25), derived local builder image ID sha256:1f06eda13b33be5d30aa1b256895516b322d329753f9743614a5c8ebf1286291.

• Remote and transport: no SSH remote; workflow-equivalent local container with networking disabled, read-only root, all capabilities dropped, no-new-privileges, 512 PIDs, 6 GiB memory, four CPUs, and a 1 GiB /tmp tmpfs.

• Command:

  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 512 --memory 6g --cpus 4 \
    --tmpfs /tmp:rw,nosuid,size=1g <builder> \
    /usr/bin/node config/scripts/ssh-relay-runtime-linux-build-evidence.mjs \
      --tuple linux-x64-glibc --inputs-directory /evidence/inputs \
      --output-root /evidence/native-output --work-directory /evidence/native-work \
      --evidence-directory /evidence/verified-output \
      --source-date-epoch 1784069324 \
      --git-commit 775f2cbcc7f66f6e728fa06ae2d6822edd50f7b0
  

• Result: expected RED. The evidence driver stopped during the first node-pty native build before creating or copying any candidate. node-gyp 12.3.0 selected /usr/bin/python3 version 3.6.8 and failed parsing its own if flags := ... syntax. The container capability probe then proved distro package python39-3.9.25-2.module+el8.10.0+40046+11e46e10 installs as /usr/bin/python3.9 without changing the glibc/libstdc++ floor.

• Correction: the digest-pinned prepared builder installs python39, asserts Python 3.9, and sets NODE_GYP_FORCE_PYTHON=/usr/bin/python3.9; the focused workflow contract passes 4/4. Package installation remains in the networked preparation phase, while both native builds remain network-disabled.

• Oracle proved: the earlier builder definition could not build the artifact and failed before output; a modern build controller is compatible with the old runtime ABI userland when installed before the isolated compilation phase.

• Does not prove: a complete x64 build, x64 reproducibility/smoke/baseline, native arm64, kernel 4.18, SSH transfer/install, signing/trust, or any enabled tuple.

• Follow-up: repeat the full two-build x64 evidence command with the corrected builder, run the purpose-named Linux userland verifier over its verified output, then repeat on native GitHub x64 and arm64 runners.

E-M3-LINUX-BUILDER-GCC-LOCAL-RED-001 — Rocky GCC 8 rejects Node v24's final C++20 spelling

• Date: 2026-07-14
• Owner: Codex implementation owner
• Source: uncommitted local WP2 correction at Git HEAD 775f2cbcc7f66f6e728fa06ae2d6822edd50f7b0; no artifact was emitted or published.
• Runner/environment: the same local macOS arm64/Docker linux/amd64 emulation and digest-pinned Rocky 8.9 base as E-M3-LINUX-BUILDER-PYTHON-LOCAL-RED-001; corrected builder selected Python 3.9.25 and retained glibc 2.28/libstdc++.so.6.0.25.
• Command: the E-M3-LINUX-BUILDER-PYTHON-LOCAL-RED-001 two-build evidence command, repeated with NODE_GYP_FORCE_PYTHON=/usr/bin/python3.9 in the corrected builder.
• Result: expected RED after 36.42 seconds, 148,564 KiB peak RSS. node-gyp 12.3.0 successfully selected Python 3.9.25, then GCC 8.5.0 rejected Node v24's generated -std=gnu++20 argument and suggested its supported draft spelling, -std=gnu++2a. The evidence driver removed the failed first output and copied no candidate.
• Correction: the Linux-only build now replaces exactly one '-std=gnu++20', entry with '-std=gnu++2a', in the already signature/hash-verified extracted Node common.gypi; zero or multiple matches fail closed and non-Linux inputs are unchanged. The extracted headers are build inputs only, so bundled official Node bytes remain unchanged. Four focused compatibility tests cover replace, non-Linux preservation, and both rejected counts.
• Oracle proved: the oldest declared GCC/libstdc++ toolchain cannot consume the unmodified Node v24 header spelling; silently selecting a newer compiler could narrow the libstdc++ floor.
• Does not prove: successful native compilation with the corrected flag, runtime smoke, exact equality, x64/arm64 native runners, kernel 4.18, SSH transfer/install, signing/trust, or an enabled tuple.

E-M3-LINUX-BUILDER-TOOLCHAIN-LOCAL-RED-001 — Minimal builder cannot record its compiler

• Date: 2026-07-14
• Owner: Codex implementation owner
• Source and environment: the same uncommitted source, base digest, local controller, and bounded offline container as E-M3-LINUX-BUILDER-GCC-LOCAL-RED-001.
• Command: the same two-build evidence command after the exact Linux C++ flag correction.
• Result: expected RED after 1 minute 40.14 seconds, 694,188 KiB peak RSS. The first native module compiled and the runtime reached metadata collection, but the minimal Rocky image lacked the which locator used by the fail-closed toolchain collector. It therefore refused to claim a compiler identity and removed the incomplete output. The collector would also have probed generic python3 instead of the exact forced node-gyp interpreter.
• Correction: the prepared builder explicitly installs distro-signed which, and Linux provenance resolves and hashes NODE_GYP_FORCE_PYTHON (/usr/bin/python3.9) rather than a generic alias. The focused toolchain/workflow suite passes 15/15 and asserts both contracts.
• Oracle proved: artifact compilation alone is insufficient; missing or inaccurate toolchain identity fails the build before any candidate is copied.
• Does not prove: a complete first build, a second equal build, runtime smoke, baseline execution, native runner behavior, kernel 4.18, or any enabled tuple.

E-M3-LINUX-BASELINE-LOCAL-GREEN-001 — Corrected x64 bytes pass the oldest Linux userland

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: uncommitted local WP2 correction at Git HEAD 775f2cbcc7f66f6e728fa06ae2d6822edd50f7b0; the artifact-affecting correction was subsequently committed as 0cb3f7510, while later fail-closed artifact-selection, ldd stderr, and test-cleanup hardening did not change built bytes. This remains unpublished local evidence only.

• Runner/environment: local macOS arm64 controller, Docker 29.2.1, Docker Desktop bounded linux/amd64 emulation. Build base and separate baseline image: docker.io/library/rockylinux@sha256:2d05a9266523bbf24f33ebc3a9832e4d5fd74b973c220f2204ca802286aa275d; corrected builder image sha256:9c32993d7a91557657593ae8258568a71f9832b0ce7c8824a1229b939ef49968. Compilation used glibc 2.28, libstdc++.so.6.0.25, GCC 8.5.0, Python 3.9.25, GNU Make 4.2.1, GNU strip 2.30, distro Node 20.20.2 as controller, and verified bundled Node v24.18.0.

• Build command:

  repo=$PWD
  root=/private/tmp/orca-8450-linux-floor-build-v6
  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 512 --memory 6g --cpus 4 \
    --tmpfs /tmp:rw,nosuid,size=1g \
    --mount type=bind,src=/private/tmp/orca-8450-linux-floor-build/workspace,dst=/workspace \
    --mount type=bind,src=$repo/node_modules,dst=/workspace/node_modules,readonly \
    --mount type=bind,src=$repo/config/scripts,dst=/workspace/config/scripts,readonly \
    --mount type=bind,src=/private/tmp/orca-8450-linux-floor-build/inputs,dst=/inputs,readonly \
    --mount type=bind,src=$root,dst=/evidence \
    --workdir /workspace orca-ssh-relay-linux-builder:local-x64-python39 \
    /usr/bin/time -v /usr/bin/node \
      config/scripts/ssh-relay-runtime-linux-build-evidence.mjs \
      --tuple linux-x64-glibc --inputs-directory /inputs \
      --output-root /evidence/output --work-directory /evidence/work \
      --evidence-directory /evidence/verified --source-date-epoch 1784069324 \
      --git-commit 775f2cbcc7f66f6e728fa06ae2d6822edd50f7b0
  

• Build result: PASS in 6 minutes 48.16 seconds with 694,196 KiB peak RSS. Both complete builds produced content ID fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d and byte-identical 29,268,776-byte archive SHA-256 8f9095d1017fda387d66762ca6ccdd10a05d0138ff1b4ca6835d4b2a6eb7be83. Reproducibility compared 54 entries, 38 files, and 154,157,598 bytes. First/second build durations were 256,687.12/127,672.46 ms; verifier durations were 9,541.30/5,525.82 ms. Both smokes reported Node v24.18.0, modules ABI 137, PTY exit 23 after resize to 101x37, the required five watcher events, 377.22/378.81 ms smoke duration, and 58,380,288/58,052,608 RSS bytes.

• Verified metadata SHA-256 values: identity edc57658e5d245b4652f4418a70f0b8a519d287ab570ceac582ba6ead0221715, SPDX a7b58dc14ea671c60d5111eb9ade8141e502a4562161ed540b4de75f9703346b, and provenance c19086b3fb511cca04a31311d6677df58f47d0f10d91e30b180b88b6775b839d.

• Separate boundary/baseline commands:

  repo=$PWD
  root=/private/tmp/orca-8450-linux-floor-build-v6
  runtime=$root/baseline-runtime
  archive=orca-ssh-relay-runtime-v1-linux-x64-glibc-fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d.tar.xz
  identity=orca-ssh-relay-runtime-linux-x64-glibc.identity.json
  mkdir $runtime
  tar -xJf $root/verified/$archive -C $runtime
  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 2 \
    --tmpfs /tmp:rw,nosuid,size=64m \
    --mount type=bind,src=$repo/config/scripts,dst=/workspace/config/scripts,readonly \
    --mount type=bind,src=$repo/node_modules,dst=/workspace/node_modules,readonly \
    --mount type=bind,src=$root/verified,dst=/evidence,readonly \
    --mount type=bind,src=$runtime,dst=/runtime,readonly \
    --workdir /workspace orca-ssh-relay-linux-builder:local-x64-python39 \
    /runtime/bin/node config/scripts/verify-ssh-relay-runtime.mjs \
      --runtime-directory /runtime --identity /evidence/$identity --archive /evidence/$archive
  image=docker.io/library/rockylinux@sha256:2d05a9266523bbf24f33ebc3a9832e4d5fd74b973c220f2204ca802286aa275d
  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 2 \
    --tmpfs /tmp:rw,nosuid,size=64m \
    --mount type=bind,src=$repo/config/scripts,dst=/workspace/config/scripts,readonly \
    --mount type=bind,src=$runtime,dst=/runtime,readonly --workdir /workspace $image \
    /runtime/bin/node config/scripts/ssh-relay-runtime-smoke-child.cjs /runtime
  docker run --rm --platform linux/amd64 --network none --read-only --cap-drop all \
    --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 2 \
    --tmpfs /tmp:rw,nosuid,size=64m \
    --mount type=bind,src=$repo/config/scripts,dst=/workspace/config/scripts,readonly \
    --mount type=bind,src=$runtime,dst=/runtime,readonly --workdir /workspace $image \
    /runtime/bin/node config/scripts/ssh-relay-runtime-baseline.mjs \
      --tuple linux-x64-glibc --scope linux-userland --runtime-directory /runtime
  

• Boundary/baseline result: PASS. Fresh archive/tree verification matched 49 entries, 34 files, 124,846,430 expanded bytes, and the exact content ID; smoke took 280.64 ms at 58,208,256 RSS bytes. The separate unmodified Rocky base smoke took 438.55 ms at 58,908,672 RSS bytes. The baseline evaluator returned qualified: true for platform x64, glibc 2.28, and libstdc++ 6.0.25, with explicit residual gap kernel: observed shared Docker kernel 6.12.72-linuxkit versus required 4.18.

• Oracle proved: corrected x64 artifacts can be built twice without egress in the oldest declared Linux userland, remain byte-identical, pass archive/tree/Node/PTY/watcher checks, and execute in an unmodified glibc 2.28/libstdc++ 6.0.25 userland.

• Does not prove: a target-native x64 runner, native arm64, exact kernel 4.18, SSH transfer/install, native trust, release aggregation, packaged desktop use, fallback, performance against legacy, or an enabled tuple.

• Follow-up: push the exact correction to draft PR #8741, require the native x64 and arm64 build and supplemental userland cells to pass, audit the downloaded artifacts, and retain the kernel 4.18 and native-trust blockers.

E-M3-LINUX-BUILDER-LOCAL-VALIDATION-001 — Corrected WP2 source gates pass locally

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: the same uncommitted WP2 source and Git HEAD as E-M3-LINUX-BASELINE-LOCAL-GREEN-001.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/ssh-relay-runtime-linux-builder.Containerfile \
    config/scripts/build-ssh-relay-runtime.mjs \
    config/scripts/ssh-relay-linux-node-gyp-compiler.mjs \
    config/scripts/ssh-relay-linux-node-gyp-compiler.test.mjs \
    config/scripts/ssh-relay-runtime-baseline.mjs \
    config/scripts/ssh-relay-runtime-baseline.test.mjs \
    config/scripts/ssh-relay-runtime-compatibility.mjs \
    config/scripts/ssh-relay-runtime-linux-build-evidence.mjs \
    config/scripts/ssh-relay-runtime-linux-build-evidence.test.mjs \
    config/scripts/ssh-relay-runtime-toolchain.mjs \
    config/scripts/ssh-relay-runtime-toolchain.test.mjs \
    config/scripts/ssh-relay-runtime-tree.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-plan.html
  git diff --check
  

• Result: PASS. The expanded focused suite passed 22 files/100 tests. Typecheck passed. Lint passed with only existing unrelated repository warnings; its reliability, max-lines, bundled-skill, localization-catalog, and localization-coverage sub-gates all passed. The direct max-lines ratchet passed with 355 grandfathered suppressions and no new bypass. Focused formatting and git diff --check passed.

• Runner detail: local macOS arm64 shell used Node v26.0.0 and pnpm 10.24.0, which emitted the expected package-engine warning because repository CI requires Node 24. Draft-PR jobs install exact Node 24.18.0 and remain the qualifying contract cells.

• Does not prove: GitHub workflow parsing/execution, native x64/arm64 builds, oldest kernel 4.18, native signing/trust, SSH transfer/install, or any enabled tuple.

• Follow-up: commit this evidence update, push both reviewable commits, and audit every draft-PR job and downloaded artifact before closing any runner-backed cell.

E-M3-WORKFLOW-WINDOWS-CRLF-CI-RED-001 — Containerfile contract was newline-sensitive

• Date: 2026-07-14
• Owner: Codex implementation owner
• Source/run: exact draft-PR head 3973e68d772008a20c2664ad90708f6d0e00b403, Actions run 29377854121, Windows x64 job 87234935616.
• Runner/environment: GitHub-hosted windows-2022 x64; exact image/tool identities remain in the job log. The failure occurred in the purpose-named runtime artifact contract-test step before Node inputs, native compilation, verification, or upload.
• Command: the workflow's exact Node 24.18.0 PowerShell contract suite, including config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected RED. Git's Windows checkout supplied the Containerfile with CRLF line endings; the test compared ARG BASE_IMAGE=scratch\nFROM ${BASE_IMAGE} literally and failed at line 164. No Windows x64 candidate was built or uploaded. Linux contract cells passed the same assertion with LF, proving the implementation text was present but the oracle was not checkout-portable.
• Correction: normalize CRLF to LF only within the test's in-memory Containerfile text before asserting exact content. Commit 53082dd1f adds the explicit CRLF fixture; the purpose-named workflow suite passes 5/5 and the expanded artifact suite passes 22 files/101 tests. Production workflow/Containerfile bytes and runtime behavior remain unchanged.
• Does not prove: the corrected Windows contract, any candidate from this job, the complete run, baseline execution, signing/trust, SSH behavior, or an enabled tuple.
• Follow-up: commit this evidence, push both commits, and audit the replacement exact-head run from the beginning.

E-M3-LINUX-RUNNER-MOUNT-PERMISSION-CI-RED-001 — Root container cannot stage into runner temp

• Date: 2026-07-14 (job timestamps 2026-07-15 UTC)
• Owner: Codex implementation owner
• Source/run: exact draft-PR head 24153775b2327001e581c341301dfc41bb9cb61f, Actions run 29378160419, Linux arm64 job 87235847644. Linux x64 job 87235847575 fails with the same exception in the first second of the same build step.
• Runner/environment: GitHub-hosted native ubuntu-24.04 x64 and ubuntu-24.04-arm; requested runner and architecture were recorded by the workflow. Digest-pinned Rocky arm64 base sha256:3c2d0ce12bf79fc5ff05e43b1000e30ff062dc89405525f3307cbff71661f1a0; produced builder image sha256:6384da2f38157d93856beb31f6ba45dffeec8e7cc139cd4468cdf5df2fa5619c. Digest-pinned Rocky x64 base sha256:2d05a9266523bbf24f33ebc3a9832e4d5fd74b973c220f2204ca802286aa275d; produced builder image sha256:4adbb55dff700b55b8cf1c20e4be6099869e3bd43236688bf462116b92da40dc.
• Command: the workflow's offline docker run --rm --network none --read-only --cap-drop all ... invocation of ssh-relay-runtime-linux-build-evidence.mjs, with the workspace and /home/runner/work/_temp bind-mounted at identical container paths.
• Result: expected RED. Builder preparation passed after 3 minutes 25 seconds. The evidence driver then failed immediately with EACCES: permission denied, mkdir '/home/runner/work/_temp/ssh-relay-runtime'; no build, archive, smoke, comparison, upload, or dependent baseline job ran. The container defaulted to root while the hosted runner bind mount did not grant root write access under this isolation configuration.
• Plan correction: run the offline build container as $(id -u):$(id -g) and make /tmp an explicit mode-1777 tmpfs. Retain read-only root, no network, dropped capabilities, no-new-privileges, and the existing process/memory/CPU bounds. Do not broaden permissions on RUNNER_TEMP or leave root-owned host output.
• Does not prove: the correction, any Linux runtime bytes from this run, Linux userland/kernel baselines, native trust, SSH behavior, or an enabled tuple.
• Follow-up: add a workflow contract for UID/GID and tmpfs mode, validate the exact invocation locally, then repeat both native Linux cells and audit their downloaded artifacts.

E-M3-LINUX-RUNNER-MOUNT-PERMISSION-LOCAL-GREEN-001 — Non-root build preserves the full gate

• Date: 2026-07-14
• Owner: Codex implementation owner
• Source: implementation commit 05b3a4b18 (build(ssh): preserve Linux runner ownership), based on 24153775b2327001e581c341301dfc41bb9cb61f; runtime-building scripts are unchanged from the base.
• Runner/environment: local macOS arm64 Docker Desktop running the existing amd64 Rocky 8 builder sha256:9c32993d7a91557657593ae8258568a71f9832b0ce7c8824a1229b939ef49968 under emulation. This is supplemental permission/functional evidence, not a qualifying native architecture cell.
• Commands: the purpose-named workflow suite, plus a clean disposable workspace invocation of ssh-relay-runtime-linux-build-evidence.mjs using --network none --read-only --cap-drop all, --user "$(id -u):$(id -g)", --security-opt no-new-privileges, the existing process/memory/CPU bounds, and --tmpfs /tmp:rw,nosuid,size=1g,mode=1777. A separate bounded mount probe recorded the runtime UID/GID, tmpfs mode, and host ownership of created output.
• Static commands: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs; pnpm run typecheck; pnpm run lint; pnpm run check:max-lines-ratchet; focused pnpm exec oxfmt --check over the five changed files; and git diff --check.
• Result: PASS. Workflow contract 5/5. The probe observed UID 501, GID 20, /tmp mode 1777, and output owned by local user jinwoohong:wheel. The complete driver passed in 4 minutes 47.48 seconds with 694,172 KiB peak RSS. Both builds produced content ID fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d, identical 29,270,716-byte archive SHA-256 94b2d5c1e28835aab05fc84578298199c300d7d5d0cd4e76057a3f44451356c3, 49 archive entries, 34 files, and 124,846,430 expanded bytes.
• Runtime result: both bundled-Node checks reported v24.18.0/modules ABI 137; both PTY checks resized to 101x37 and exited 23; both watcher checks observed the required five create/update/delete events. First/second build durations were 138,118.53/130,370.80 ms; verification durations were 6,235.84/5,041.08 ms; smoke durations were 431.46/348.38 ms at 58,347,520/58,040,320 RSS bytes.
• Static result: PASS. The expanded artifact suite passed 22 files/101 tests. Typecheck, full lint, reliability metadata, max-lines (355 grandfathered suppressions and no new bypass), bundled-skill, localization catalog/coverage, focused formatting, and git diff --check passed. Lint emitted only the existing unrelated repository warnings. Local Node v26.0.0 emitted the expected engine warning; draft-PR jobs install exact Node 24.18.0.
• Does not prove: native x64 or arm64 hosted-runner behavior, exact Linux kernel 4.18, SSH transfer/install, native trust, release aggregation, or an enabled tuple.
• Follow-up: run the exact correction on both native GitHub labels and audit every resulting artifact and supplemental userland job before closing either cell.

E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 — Hosted build 26200 cannot prove build 26100

• Date: 2026-07-14 (job timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head 24153775b2327001e581c341301dfc41bb9cb61f, Actions run 29378160419, Windows arm64 artifact job 87235847556, and baseline job 87237242684. Windows x64 baseline control 87237242686 passed.

• Runner/environment: GitHub-hosted native windows-11-arm. The baseline evaluator observed native arm64 Windows 10.0.26200; the declared oldest arm64 contract is exactly Windows 11 24H2 build 26100. Downloaded artifact ID 8328797474, 33,084,426 bytes, Actions transport digest 2453ddd8eefd9b371be296bebe0bcec15fdbaa245dca3a89b1eb2c668450cd23.

• Result: expected RED for oldest-floor qualification. The native artifact built twice, verified, compared, uploaded, downloaded, re-verified, and completed bundled Node/PTY/watcher smoke; smoke settled to only the parent stdio pipes after the two-second observation window and used 48,525,312 RSS bytes. The baseline evaluator returned platform and architecture true, osBuild: false, and qualified: false, so the job correctly failed closed rather than presenting a newer hosted image as proof of build 26100. Windows x64 passed the analogous declared-floor job.

• Does not prove: Windows arm64 build 26100 compatibility, native signature/trust, SSH behavior, or an enabled tuple. A successful artifact/smoke run on build 26200 is deliberately insufficient.

• Follow-up: provision or select a native arm64 build-26100 snapshot/runner before closing this cell; keep the tuple disabled and do not weaken the exact oldest-floor oracle.

• Repeat evidence: exact-head run 29379227209, artifact job 87239051368, and baseline job 87240257136 reproduce the same bounded result at cc4c45c8981fd87b5681e8c0be7b3b06f2cfab22: native build, equality, upload, download, verification, PTY/watcher smoke, and 48,361,472-byte RSS pass; observed build 26200 returns osBuild: false and the job fails closed. Artifact ID 8329167066, 33,084,426 bytes, Actions digest 4956ad608ede84372a393248dc90c03b13bd5e28345d8c3940df0419b9fdb192; archive SHA-256 87a9c749f6aced6d2c63a3f2b80033dfa3ecc7524c2f232baaa199340c562cf1.

E-M3-LINUX-NATIVE-USERLAND-CI-001 — Native Linux producers pass the oldest userland

• Date: 2026-07-14 (job timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head cc4c45c8981fd87b5681e8c0be7b3b06f2cfab22, containing implementation commit 05b3a4b18; Actions run 29379227209. Linux x64 artifact job 87239051400, Linux arm64 artifact job 87239051434, x64 userland job 87240706426, and arm64 userland job 87240706430 all pass.

• Aggregate status: the artifact workflow concludes failure only because the separately required Windows arm64 build-26100 floor fails closed on hosted build 26200. Exact-head PR Checks 29379227222 and Golden E2E Experiment 29379227283 both pass with no failed jobs.

• Runners/builders: GitHub-hosted native ubuntu-24.04 / ubuntu24 20260705.232.1 x64 and ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2 arm64. Digest-pinned Rocky bases are 2d05a926...aa275d x64 and 3c2d0ce1...61f1a0 arm64; produced builder IDs are sha256:4e260f8acb74ac4800e31af90160aac0c9eed00c5fc4e8cb1aa83d0f1b1a8f4b and sha256:a2f683970a2fcef419610f77bdc0af332d991dc0cf19fa4f239771dfe5b06a94.

• Exact evidence commands:

  gh run view 29379227209 --repo stablyai/orca \
    --json headSha,status,conclusion,createdAt,updatedAt,url,jobs
  gh run view 29379227209 --repo stablyai/orca --log | \
    rg 'requested_runner=|resolved_image_|runner_arch=|linux_floor_|"contentId"|"qualified"|"residualGaps"'
  gh api repos/stablyai/orca/actions/runs/29379227209/artifacts --paginate
  gh run download 29379227209 --repo stablyai/orca \
    --dir /private/tmp/orca-8450-run-29379227209-artifacts
  # Repeat the fail-closed jq/shasum audit from E-M3-METADATA-CI-RED-003 with:
  # evidence=/private/tmp/orca-8450-run-29379227209-artifacts
  # commit=cc4c45c8981fd87b5681e8c0be7b3b06f2cfab22
  # run_id=29379227209
  # Extract each exact archive, then repeat the closure verifier command from
  # E-M3-RUNTIME-CLOSURE-LOCAL-001 against all six extracted directories.
  

• Result: PASS. Both offline, non-root builders preserve the read-only/no-network/capability/resource envelope; build twice; inspect archive/tree; execute bundled Node v24.18.0, native PTY input/resize/exit, and five watcher events twice; compare runtime/archive/identity/SPDX/provenance exactly; and upload. Artifact job wall times were 6m49s x64 and 11m57s arm64, including builder preparation. Clean x64 builds took 67,398.98/64,050.97 ms with 55,918,592/55,955,456-byte smoke RSS; clean arm64 builds took 75,230.87/74,661.31 ms with 52,195,328/52,207,616-byte smoke RSS.

• Supplemental userland result: PASS after download and fresh byte/tree verification. Both execute in glibc 2.28/libstdc++ 6.0.25 Rocky userland and report qualified: true; x64 PTY/watcher smoke takes 161.43 ms at 55,611,392 RSS bytes and arm64 takes 161.85 ms at 51,658,752 RSS bytes. Both retain the explicit kernel residual: observed shared runner kernel 6.17.0-1018-azure, not required 4.18.

• Downloaded artifacts/direct audit: exact cardinality, archive/identity/provenance/SPDX hashes, archive-scoped namespace, one owner per file, eight dependency relationships, exact commit/run/builder/runner/toolchain identities, prohibited-content rules, and extracted-tree closure all pass for all six run artifacts. Linux x64 artifact 8329137098, 29,290,715 bytes, Actions digest 4859448ad465600836700884449b56b65cc65b13e71588813a5341c7eee2ef3b, content ID fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d, archive SHA-256 c771c13d23fb7384ad0b018cb4a91e04066d53d07b021fa2ff4e0ae55f701467. Linux arm64 artifact 8329223012, 28,216,772 bytes, Actions digest f3a834de03714c4bd702d933261cc8c3c8f3ea6472b97d74737904d5b7461a06, content ID 96f07f62af9b35304bb8ca0870ca4d8095e059bfa61dd1bc57e81b20f3fbca67, archive SHA-256 ea52c7fadbc100e055e489d14ddf01daca5f90b1f83cdff93c1f3d728cfcaa34.

• Six-artifact audit controls:

  Tuple	Artifact ID	Actions digest	Archive SHA-256	Content ID prefix	Files
  linux-x64-glibc	8329137098	4859448ad465600836700884449b56b65cc65b13e71588813a5341c7eee2ef3b	c771c13d23fb7384ad0b018cb4a91e04066d53d07b021fa2ff4e0ae55f701467	fc63ca34…	34
  linux-arm64-glibc	8329223012	f3a834de03714c4bd702d933261cc8c3c8f3ea6472b97d74737904d5b7461a06	ea52c7fadbc100e055e489d14ddf01daca5f90b1f83cdff93c1f3d728cfcaa34	96f07f62…	34
  darwin-x64	8329119914	d86a6deac1c5f6b38a1824197b19de69c5f5df6bc7081266a636e86cfae34a87	470b69a5317d212cab99cf1dc12841b09e0984c70cfbc90c3f46be040a263374	585ea603…	35
  darwin-arm64	8329097437	d2200b01c983afbc2b7ca0d08d36f9e7962932113c67ab604c1072488b6ebb26	54a2fb49a0bc63c04622525bada57ccfa4cf7884e09bfb88c4c87f30a363616d	40ff5d20…	35
  win32-x64	8329104979	3168b4b29c635502ceb5320fc1e96a19a394b2a36ea5f8083c8502a81a385063	e8c1165df331602027f548228f8b09791d27aa353d829c575b9b6dbf86833670	7ddad668…	42
  win32-arm64	8329167066	4956ad608ede84372a393248dc90c03b13bd5e28345d8c3940df0419b9fdb192	87a9c749f6aced6d2c63a3f2b80033dfa3ecc7524c2f232baaa199340c562cf1	2955cec7…	42

• Oracle proved: the exact native Linux producer bytes are compatible with the declared oldest glibc/libstdc++ userland on both architectures; the original Ubuntu-linked ABI defect and the runner bind-mount defect are closed without weakening isolation.

• Does not prove: exact kernel 4.18, SSH transfer/install, native trust, release aggregation, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: retain both tuples disabled until kernel 4.18, native trust, and the remaining required live SSH evidence pass.

E-M3-WINDOWS-X64-BASELINE-CI-001 — Windows x64 passes the declared Server floor

• Date: 2026-07-14 (job timestamps 2026-07-15 UTC)
• Owner: Codex implementation owner
• Source/run: exact head cc4c45c8981fd87b5681e8c0be7b3b06f2cfab22, Actions run 29379227209, artifact job 87239051373, and baseline job 87240257128.
• Runner/result: GitHub-hosted native windows-2022 / win22 20260706.237.1 x64 observed exact build 10.0.20348; archive/tree verification and bundled Node/PTY/watcher smoke pass, then the full baseline evaluator returns qualified: true with no residual gaps. Smoke took 5,382.17 ms at 50,561,024 RSS bytes; the baseline job wall time was 1m29s.
• Artifact/audit: artifact 8329104979, 37,034,298 bytes, Actions digest 3168b4b29c635502ceb5320fc1e96a19a394b2a36ea5f8083c8502a81a385063; content ID 7ddad668780ce5b2592d86afcebf9d897172bdf07c618ae238b5d51eebfe1596; archive SHA-256 e8c1165df331602027f548228f8b09791d27aa353d829c575b9b6dbf86833670. The independent all-six metadata and extracted-closure audit passes.
• Does not prove: native signature/trust, Windows arm64 build 26100, SSH transfer/install, release aggregation, fallback/performance, or an enabled tuple.
• Follow-up: keep the tuple disabled until native trust and the remaining required live SSH evidence pass.

E-M3-NATIVE-SIGNING-PLAN-SORT-LOCAL-RED-001 — Locale collation changes Windows signing order

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: local macOS arm64 shell at Git HEAD c6a7277cc6f56d453662ebd373e9e8e4e278f4ac; no runtime or signing credentials were used.

• Command:

  node - <<'NODE'
  const paths = [
    'node_modules/node-pty/build/Release/conpty.node',
    'node_modules/node-pty/build/Release/conpty/OpenConsole.exe',
    'node_modules/node-pty/build/Release/conpty/conpty.dll',
    'node_modules/node-pty/build/Release/conpty_console_list.node'
  ]
  console.log(JSON.stringify({
    locale: [...paths].sort((left, right) => left.localeCompare(right)),
    portable: [...paths].sort((left, right) => left < right ? -1 : left > right ? 1 : 0)
  }, null, 2))
  NODE
  

• Result: expected RED control. Locale collation ordered conpty_console_list.node, conpty.node, conpty/conpty.dll, then conpty/OpenConsole.exe; portable byte ordering produced conpty.node, conpty/OpenConsole.exe, conpty/conpty.dll, then conpty_console_list.node, matching canonicalSshRelayRuntimeIdentityBytes.

• Correction/oracle: the signing plan uses explicit </> path comparison, and the Windows x64 and arm64 expected-path assertions lock that order. Locale-sensitive localeCompare is not used.

• Does not prove: target-native execution, any signature, native trust, release aggregation, SSH behavior, or an enabled tuple.

E-M3-NATIVE-SIGNING-PLAN-LOCAL-001 — Exact credential-free signing plans pass for all six identities

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit 9bdae7f5bd7d5df838ab8c59af9346fc2282443c, based on c6a7277cc6f56d453662ebd373e9e8e4e278f4ac; downloaded identities are from exact-head Actions run 29379227209 and were already audited under E-M3-LINUX-NATIVE-USERLAND-CI-001.

• Runner/remote/network: local macOS arm64 shell, Node v26.0.0 and pnpm 10.24.0; no remote, signing service, credential, publication, or network access was used by the plan command. The source artifacts were produced on the six native GitHub runner families recorded by the prior evidence.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-plan.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    config/scripts/ssh-relay-runtime-native-signing-plan.mjs \
    config/scripts/ssh-relay-runtime-native-signing-plan.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  for identity in /private/tmp/orca-8450-run-29379227209-artifacts/ssh-relay-runtime-*/*.identity.json; do
    node config/scripts/ssh-relay-runtime-native-signing-plan.mjs --identity "$identity"
  done
  

• Static result: PASS. The purpose-named contract passed 1 file/6 tests in 944 ms; the aggregate SSH relay artifact suite passed 23 files/107 tests in 6.91 seconds. Typecheck, full lint, reliability gates, max-lines (355 grandfathered suppressions and no new bypass), bundled-skill verification, localization catalog/coverage, focused formatting, and git diff --check passed. Lint emitted only existing unrelated warnings; the local Node 26 shell emitted the expected Node-24 engine warning.

• Actual-identity result: PASS. Every plan retained one official Node executable as preserve-exact-bytes, copied the exact identity digest into sourceSha256, and produced this closed cardinality:

  Tuple	Policy	Immutable vendor files	Signing candidates	Verification files
  linux-x64-glibc	linux-hash-only-v1	1	0	3
  linux-arm64-glibc	linux-hash-only-v1	1	0	3
  darwin-x64	apple-developer-id-v1	1	3	4
  darwin-arm64	apple-developer-id-v1	1	3	4
  win32-x64	signpath-authenticode-v1	1	5	6
  win32-arm64	signpath-authenticode-v1	1	5	6

• Fail-closed coverage: wrong tuple/OS, role/path/count/extension drift, duplicates, missing exact Node, non-executable native entries, malformed invocation, malformed JSON, directories, and input larger than 4 MiB reject. Every native file is present in verificationFiles; Linux selects no signing target, macOS requires Developer ID for all three non-Node native files, and Windows sends all five non-Node PE files through the preserve-valid-upstream-signature SignPath policy.

• Oracle proved: one bounded, deterministic, credential-free contract derives the complete platform signing/verification plan from the builder-enforced closure before signing side effects, while keeping official Node outside Orca signing.

• Does not prove: Apple or SignPath credential wiring, returned signed-byte hashes, Gatekeeper, quarantine, notarized containing-app provenance, Authenticode signer policy, Defender, WDAC, exact oldest-OS snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback, performance, or an enabled tuple.

• Follow-up: commit this evidence separately, require exact-head CI, then make native signing staging consume this plan without weakening any remaining credential/snapshot gate.

E-M3-NATIVE-SIGNING-PLAN-CI-RED-001 — First exact-head workflow omitted the new suite

• Date: 2026-07-14 (run timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head 8ac54159c6f9d95858358f11746117c5480440cf, containing implementation commit 9bdae7f5bd7d5df838ab8c59af9346fc2282443c; Actions run 29380684866.

• Commands:

  gh run view 29380684866 --repo stablyai/orca \
    --json headSha,status,conclusion,createdAt,updatedAt,url,jobs
  gh run view 29380684866 --repo stablyai/orca --job 87243480614 --log | \
    rg 'Run runtime artifact contract tests|Test Files|Tests|Duration|24.18.0'
  gh run view 29380684866 --repo stablyai/orca --job 87243480598 --log | \
    rg 'Run runtime artifact contract tests|Test Files|Tests|Duration'
  

• Result: expected RED evidence for the new contract's CI gate. All six native build jobs and their existing contract steps passed; both Linux userland supplements, Windows x64 build-20348 floor, exact-head PR Checks 29380684876, and Golden E2E 29380684872 also passed. The artifact workflow concluded failure only because Windows arm64 correctly rejected hosted build 26200 against required build 26100.

• Missing oracle: inspection of the exact command/log showed the POSIX job ran 21 files/97 tests and the Windows job ran 22 files/98 passed plus 3 skipped; neither explicit list named ssh-relay-runtime-native-signing-plan.test.mjs, and neither syntax-checked its source. Healthy builds cannot substitute for a test that did not run, so this exact head does not qualify the new package.

• Native build job controls: Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64 jobs all passed at 3m43s/9m57s, 7m30s/2m41s, and 5m27s/8m7s respectively. PR Checks passed in 14m57s; Golden Linux and macOS passed in 4m37s/5m25s. These are regression controls only, not the omitted contract proof.

• Does not prove: the new suite on Node 24/native runners, signing credentials, returned signed bytes, native trust, release aggregation, SSH behavior, or an enabled tuple.

• Correction: explicitly syntax-check the source/test and name the suite in both POSIX and Windows native workflow commands; lock all four test references and both source syntax checks in the workflow contract before repeating the exact head.

E-M3-NATIVE-SIGNING-PLAN-WORKFLOW-LOCAL-001 — Both native job families now execute the suite

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: correction commit 9c0357235867cb2ff1ab8cbeed4901e6f013cf1d, based on 8ac54159c6f9d95858358f11746117c5480440cf.

• Runner: local macOS arm64 shell, Node v26.0.0 and pnpm 10.24.0; no remote, network, credential, artifact, or signing service was used.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-plan.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-plan.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-plan.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  

• Result: PASS. The workflow plus signing-plan suites passed 2 files/11 tests in 1.53 seconds; the aggregate SSH relay artifact suite passed 23 files/107 tests in 4.64 seconds. Both files passed direct syntax checks. Typecheck, full lint, reliability gates, max-lines (355 grandfathered suppressions and no new bypass), bundled-skill verification, localization catalog/coverage, focused formatting, and git diff --check passed with only existing unrelated lint warnings and the expected local Node-24 engine warning.

• Workflow oracle: POSIX and Windows each syntax-check the plan source and test, and each exact Vitest command names the purpose-built suite. The workflow test requires four test-path occurrences and two source syntax-check occurrences, preventing one native family from silently dropping it.

• Does not prove: GitHub workflow parsing/execution, Node 24, any native runner, native signing/trust, returned signed bytes, release aggregation, SSH behavior, or an enabled tuple.

• Follow-up: push the correction plus this evidence separately and require the replacement exact-head POSIX and Windows logs to contain the 6-test suite before accepting CI proof.

E-M3-NATIVE-SIGNING-PLAN-CI-001 — Replacement exact head executes the suite on all six native jobs

• Date: 2026-07-14 (run timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head 0f589ea299e9363a3988a9bc92b721f23c1ce1f4, containing plan implementation 9bdae7f5bd7d5df838ab8c59af9346fc2282443c and CI correction 9c0357235867cb2ff1ab8cbeed4901e6f013cf1d; Actions run 29381495240.

• Commands:

  gh run view 29381495240 --repo stablyai/orca \
    --json headSha,status,conclusion,createdAt,updatedAt,url,jobs
  gh run view 29381495240 --repo stablyai/orca --job 87245905347 --log | \
    rg 'native-signing-plan|Test Files|Tests|Duration'
  gh run view 29381495240 --repo stablyai/orca --job 87245905412 --log | \
    rg 'native-signing-plan|Test Files|Tests|Duration'
  gh run view 29381494930 --repo stablyai/orca \
    --json headSha,status,conclusion,createdAt,updatedAt,url,jobs
  gh run view 29381494940 --repo stablyai/orca \
    --json headSha,status,conclusion,createdAt,updatedAt,url,jobs
  

• Contract result: PASS on all six native jobs. Job-step metadata reports the purpose-named contract step successful for Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64. The macOS arm64 log directly records both syntax checks, the named suite passing 6/6 in 29 ms, and the aggregate 22 files/103 tests in 6.11 seconds. The Windows x64 log records both syntax checks, the suite passing 6/6 in 37 ms, and 23 files/104 passed plus 3 platform skips out of 107 in 5.63 seconds.

• Build/regression controls: all six native artifact jobs passed. Linux x64/arm64 took 3m50s/8m53s; macOS x64/arm64 took 7m26s/3m36s; Windows x64/arm64 took 4m49s/8m33s. Both Linux oldest-userland supplements passed in 43s/54s, and Windows x64 passed exact build 20348 in 1m25s.

• Expected aggregate status: the artifact workflow concludes failure only because the Windows arm64 floor job again rejects hosted build 26200 against required build 26100 in 3m23s. This preserves E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 and is not a signing-plan regression.

• Other exact-head controls: PR Checks 29381494930 passed in 14m16s. Golden E2E 29381494940 passed Linux/macOS in 4m35s/5m56s.

• Oracle proved: the credential-free plan contract parses and executes under exact Node 24.18.0 in both shell families on every native runner, while all existing artifact, smoke, equality, userland, packaging, and E2E controls retain their prior outcomes.

• Does not prove: Apple/SignPath credentials, signing requests, approval behavior, returned signed bytes, final post-signing hashes, Gatekeeper/quarantine/notarized-app provenance, Authenticode/Defender/WDAC policy, exact missing oldest snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: keep every tuple disabled; implement a credential-free exact signing-stage/returned-byte contract that consumes the proven plan before any protected Apple or SignPath job is connected.

E-M3-NATIVE-SIGNING-STAGE-LOCAL-RED-001 — Missing signing-stage modules fail the focused contract

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: pre-implementation head 30496bacf11a7e727ca6bf97c23ececd89c351ad.

• Command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs
  

• Result: expected RED. Both purpose-named test files failed to load because ssh-relay-runtime-native-signing-selection.mjs and ssh-relay-runtime-native-signing-payload.mjs did not exist. No production or artifact behavior changed. The exact RED duration was not retained and is deliberately not reconstructed.

• Oracle proved: the new selection, staging, and returned-tree requirements were not already satisfied by the signing-plan module or an unrelated artifact test.

• Does not prove: any implementation behavior, native runner execution, signing, native trust, release aggregation, SSH behavior, or an enabled tuple.

• Correction: implement the two purpose-named modules, keep official Node out of signing payloads, and require both native workflow families to execute their contracts explicitly.

E-M3-NATIVE-SIGNING-STAGE-LOCAL-001 — Exact selection, exclusive staging, and returned-tree contracts pass

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit c847c4a11d60ee37d161564ca3685955ce3c2d6d, based on 30496bacf11a7e727ca6bf97c23ececd89c351ad.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no remote, network, credential, signing service, native-trust environment, or publication path was used.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-selection.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-payload.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-selection.mjs \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
  git diff --check
  

• Result: PASS. The focused selection/payload command passed 2 files/18 tests in 247 ms. The two suites plus workflow contract passed 3 files/23 tests in 264 ms. The complete purpose-named SSH relay script suite passed 25 files/125 tests in 2.55 seconds. Four direct syntax checks, typecheck, full lint and reliability gates, max-lines (355 grandfathered suppressions with no new bypass), bundled-skill verification, localization catalog/coverage, focused formatting, and git diff --check passed. Lint emitted only existing unrelated warnings; local Node 26 emitted the expected repository Node-24 engine warning. An intermediate lint run rejected an ASCII-control regular expression and formatting check rejected all four new files; the implementation was corrected without a disable and the complete gate was rerun green.

• Selection oracle: Linux accepts no assessments and creates no signing payload. macOS selects all three non-Node Developer ID candidates. Windows requires exactly one hash-bound assessment per PE candidate, stages only unsigned, preserves only valid-upstream with a bounded non-control signer subject and exact 40-hex thumbprint, and rejects invalid/unknown status, missing, duplicate, extra, hash-mismatched, malformed, or status-incompatible fields.

• Payload oracle: every native source file is authenticated by safe-integer size and SHA-256 before an exclusive stage is created; official Node is never copied. The physical stage must be outside the runtime, source/staged files must be regular, portable relative paths are preserved, and a partial stage is removed on copy/authentication failure. Linux verifies without creating a stage.

• Returned-tree oracle: the root and every entry must be real directories or regular files; links, special entries, unexpected/missing files or directories, unchanged hashes, per-file growth over 4 MiB, or aggregate size over 64 MiB reject. Every accepted returned file records its exact new size and SHA-256 without mutating the runtime.

• Workflow oracle: POSIX and Windows native job families each syntax-check both sources and tests and explicitly name both suites. The workflow contract locks four occurrences per test and two source syntax-check occurrences so one shell family cannot silently omit the package.

• Does not prove: Node 24 behavior or parsing on GitHub Actions, native filesystem behavior on all six runners, Apple/SignPath credentials or calls, native trust, final signed-byte identity, Gatekeeper/quarantine/notarized-app provenance, Authenticode/Defender/WDAC policy, oldest missing snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: push the implementation and evidence separately, then inspect an exact-head run to prove both suites executed under Node 24.18.0 in all six native jobs while existing build/smoke/equality controls retain their outcomes.

E-M3-NATIVE-SIGNING-STAGE-CI-001 — Both staging suites execute on all six native jobs

• Date: 2026-07-14 (run timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head 9e08ac123039b827ebacbe1918ef8d3c3b989ae9, containing implementation c847c4a11d60ee37d161564ca3685955ce3c2d6d and local evidence 9e08ac123039b827ebacbe1918ef8d3c3b989ae9; Actions run 29382772805.

• Commands:

  gh run view 29382772805 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29382772805 --repo stablyai/orca --job 87249764747 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'native-signing-(selection|payload)|Test Files|Tests|Duration'
  gh run view 29382772805 --repo stablyai/orca --job 87249764693 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'native-signing-(selection|payload)|Test Files|Tests|Duration'
  gh run view 29382772805 --repo stablyai/orca --job 87251086934 --log | \
    rg 'Operating System|OsBuildNumber|26100|26200'
  gh run view 29382772825 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29382772821 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  

• Contract result: PASS on Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64. Every native build job reports Run runtime artifact contract tests successful under exact Node 24.18.0. The shared POSIX log on macOS arm64 records four new syntax checks, selection 7/7 in 9 ms, payload 11/11 in 204 ms, and aggregate 24 files/121 tests in 3.94 seconds. The shared PowerShell log on Windows x64 records the same four syntax checks, selection 7/7 in 27 ms, payload 8 passed plus the three declared POSIX-only symlink skips in 1.736 seconds, and aggregate 25 files/119 passed plus six total platform skips out of 125 in 6.04 seconds.

• Native build/regression controls: all six two-build, smoke, exact-equality, metadata, and unpublished-upload jobs passed. Durations were Linux x64 4m16s, Linux arm64 4m26s, macOS x64 5m16s, macOS arm64 2m58s, Windows x64 4m58s, and Windows arm64 10m40s. Linux x64/arm64 digest-pinned glibc 2.28/libstdc++ 6.0.25 supplemental jobs passed in 37s/54s. Windows x64 exact build-20348 floor passed in 1m23s.

• Expected aggregate status: the artifact workflow concluded failure only because Windows arm64 hosted image 10.0.26200 again failed the exact declared 10.0.26100 floor in 4m9s. This preserves E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 and is not a signing-stage regression.

• Other exact-head controls: PR Checks 29382772825 passed in 14m8s after lint, typecheck, Git 2.25 compatibility, full tests, unpacked-app build, and packaged-CLI smoke. Golden E2E 29382772821 passed macOS/Linux in 3m00s/4m29s.

• Oracle proved: both shell families parse and execute the exact credential-free selection and payload contracts on every target-native runner while the artifact build, executable smoke, clean-build equality, oldest-userland, packaging, and E2E regression controls retain their prior outcomes.

• Does not prove: real candidate assessment or staging, Apple/SignPath credentials or calls, returned signed bytes, native trust, final post-signing hashes, Gatekeeper/quarantine/notarized-app provenance, Authenticode/Defender/WDAC policy, exact missing oldest snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: keep every tuple disabled; execute pre-sign assessment and staging against the actual target-native candidate tree without credentials before connecting any protected signing job.

E-M3-NATIVE-ASSESSMENT-LOCAL-RED-001 — Missing native assessment and orchestration modules fail focused contracts

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: pre-implementation head e478ae458fa634845e9d9a7fd1d5a01cb41ed6ed.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-windows-authenticode-assessment.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-stage.test.mjs
  

• Result: expected RED. The Authenticode suite failed 1 file/0 tests in 396 ms because ssh-relay-runtime-windows-authenticode-assessment.mjs did not exist. The target-native stage suite independently failed 1 file/0 tests in 159 ms because ssh-relay-runtime-native-signing-stage.mjs did not exist. No production or artifact behavior changed.

• Oracle proved: neither actual Windows signature classification nor target-native first-build orchestration was already provided by the credential-free selection/payload modules.

• Does not prove: any implementation, real native candidate inspection, credentials, signing, native trust, release aggregation, SSH behavior, or an enabled tuple.

• Correction: add purpose-named bounded Authenticode assessment and target-native stage modules, then wire real first-build candidate execution into all native artifact jobs.

E-M3-NATIVE-ASSESSMENT-LOCAL-001 — Bounded target-native assessment and first-build staging pass locally

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit 1a79e492145a1297949a10ab6870d2118c5f5cd3, based on exact staging-CI evidence commit e478ae458fa634845e9d9a7fd1d5a01cb41ed6ed.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0, pnpm 10.24.0, and PowerShell 7 at /opt/homebrew/bin/pwsh; no remote, network, credential, signing service, native-trust environment, or publication path was used. Windows execution was dependency-injected locally and remains an explicit CI requirement.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-windows-authenticode-assessment.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-stage.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  node --check config/scripts/ssh-relay-runtime-windows-authenticode-assessment.mjs
  node --check config/scripts/ssh-relay-runtime-windows-authenticode-assessment.test.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-stage.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-stage.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-windows-authenticode-assessment.mjs \
    config/scripts/ssh-relay-runtime-windows-authenticode-assessment.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-stage.mjs \
    config/scripts/ssh-relay-runtime-native-signing-stage.test.mjs
  node --input-type=module -e \
    'import {readFile} from "node:fs/promises"; import {parse} from "yaml"; const workflow=parse(await readFile(".github/workflows/ssh-relay-runtime-artifacts.yml","utf8")); process.stdout.write(workflow.jobs["build-windows-runtime"].steps.find((step)=>step.name==="Build twice, inspect, smoke, and compare exact runtime").run)' | \
    pwsh -NoLogo -NoProfile -NonInteractive -Command \
    '$source=[Console]::In.ReadToEnd(); $tokens=$null; $errors=$null; [System.Management.Automation.Language.Parser]::ParseInput($source,[ref]$tokens,[ref]$errors)|Out-Null; if($errors.Count){exit 1}'
  git diff --check
  

• Result: PASS. The assessment, stage, and workflow suites passed 3 files/19 tests in 1.31 seconds; the complete SSH relay script suite passed 27 files/139 tests in 5.82 seconds. Four direct syntax checks, typecheck, full lint/reliability gates, max-lines (355 grandfathered suppressions and no new bypass), bundled-skill verification, localization catalog/coverage, focused formatting, direct PowerShell parsing of the modified Windows step, and git diff --check passed. Lint emitted only existing unrelated warnings; local Node 26 emitted the expected repository Node-24 engine warning.

• Assessment oracle: the Windows module derives exactly five candidates from the authenticated identity, validates every size/hash before the first probe, passes the local path only through a dedicated environment variable, and uses pwsh -NoLogo -NoProfile -NonInteractive with a 30-second timeout, 64-KiB output bound, and hidden window. It accepts only exact three-field JSON: NotSigned without certificate metadata or Valid with a bounded non-control subject and exact 40-hex thumbprint. Hash mismatch, invalid/unknown status, malformed fields/JSON, stderr, nonzero exit, timeout/error, links, host mismatch, or mutation during the probe reject.

• Orchestration oracle: host platform must equal the identity OS before assessment. Linux authenticates three native files without creating a stage; macOS stages exactly its three non-Node candidates; Windows runs assessment once, preserves valid-upstream candidates, and stages only unsigned candidates. Official Node remains verification-only.

• Workflow oracle: both native shell families syntax-check and execute both new suites. The actual first clean-build tree is assessed only after archive/tree verification and clean-build equality. Linux requires no stage, macOS requires three staged files, and Windows requires five assessments, three unsigned staged .node files, and the exact preserved upstream OpenConsole.exe and conpty.dll paths. Every temporary stage excludes official Node, is removed after inspection, and emits one unpublished .signing-stage.json evidence file. No signing secret, credential, service, permission, or publication authority was introduced.

• Does not prove: real Windows PowerShell status/signer output, actual macOS/Linux candidate staging, Node 24 behavior, target-native filesystem behavior, Apple/SignPath calls, returned signed bytes, native trust, final post-signing hashes, missing oldest snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: push the implementation and evidence separately; require exact-head logs and downloaded stage reports from all six jobs before accepting real candidate behavior.

E-M3-NATIVE-ASSESSMENT-CI-001 — All six real candidates pass native assessment and exclusive staging

• Date: 2026-07-14 (run timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head 82f6c0cefa9d7ac031d56bcfd0b85a2ab71a7d8b, containing implementation 1a79e492145a1297949a10ab6870d2118c5f5cd3 and local evidence 82f6c0cefa9d7ac031d56bcfd0b85a2ab71a7d8b; Actions run 29384042509.

• Commands:

  gh run view 29384042509 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29384042509 --repo stablyai/orca --job 87253495614 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'native-signing-stage|windows-authenticode-assessment|Test Files|Tests|Duration'
  gh run view 29384042509 --repo stablyai/orca --job 87253495617 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'native-signing-stage|windows-authenticode-assessment|Test Files|Tests|Duration'
  gh run download 29384042509 --repo stablyai/orca \
    --dir /private/tmp/orca-8450-run-29384042509-artifacts \
    --pattern 'ssh-relay-runtime-*'
  node --input-type=module  # inline six-report identity/cardinality/hash audit recorded below
  gh run view 29384042507 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29384042498 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  

• Contract result: PASS on Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64. Every native build job syntax-checked and ran both new suites under exact Node 24.18.0. The POSIX log records Authenticode contract 8/8, target-native stage 5/5, and aggregate 26 files/135 tests in 6.78 seconds. The PowerShell log records Authenticode contract 7 passed plus one POSIX-only symlink skip, target-native stage 5/5, and aggregate 27 files/132 passed plus seven total platform skips out of 139 in 7.33 seconds.

• Real first-build result: PASS. Both Linux reports authenticate the exact three native identity entries, select/stage zero files, and create no payload. Both macOS reports select and stage exactly three non-Node files, with no assessment or preserved-upstream entry. Both Windows reports contain exactly five hash-bound PowerShell assessments, preserve exactly OpenConsole.exe and conpty.dll as Valid, and stage exactly the three NotSigned Orca-built .node files. All six builds confirm official Node is verification-only, delete the temporary stage, and upload only the JSON report plus the prior unpublished evidence set.

• Downloaded-report audit: PASS. Six artifacts contained exactly one identity and signing-stage report each. An inline Node audit required tuple/platform equality; matched every immutable, assessment, signing, preserved, and staged path/size/SHA-256 back to the identity; required staged paths and size totals to equal the signing selection; enforced the platform cardinalities; and rechecked official-Node exclusion and the exact Windows preserved set. Exact report evidence:

  Tuple	Report SHA-256	Assess	Sign	Preserve	Stage	Staged bytes
  linux-x64-glibc	9376647f4ac66060a82bab660752b961fedfc374d1b3fbc76fe60b6f35590a3b	0	0	0	0	0
  linux-arm64-glibc	453fe413e81aa475149f92180f54713293de0562fe86b049746d8ec77c449f1e	0	0	0	0	0
  darwin-x64	ae9ac0afb40bd5a07ff2dba78d9a4c62bb7662f4f21a9483bd0c7f5469ef0162	0	3	0	3	393,744
  darwin-arm64	dbfae0d923d3a18cd042939d8fa174e1e0420aad548bb5caf6256aed2b37a22e	0	3	0	3	459,592
  win32-x64	69d6685d8c8dc54682a3af25402a1e489d11fc4a1771fd9ca599ea2c7864ddff	5	3	2	3	2,114,048
  win32-arm64	50f85ebb09695bdc4443add6f267add66f099ee2b4b0fe9108a35f1f7db644f3	5	3	2	3	2,224,128

• Windows signer evidence: all four preserved entries report exact subject CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. x64 OpenConsole.exe and conpty.dll use thumbprint 3F56A45111684D454E231CFDC4DA5C8D370F9816. arm64 conpty.dll uses that thumbprint and arm64 OpenConsole.exe uses F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79. These observations bind the unchanged source bytes but do not establish final Orca native trust.

• Native build/regression controls: all six double-build, smoke, exact-equality, metadata, stage, cleanup, and unpublished-upload jobs passed in Linux x64 3m58s, Linux arm64 4m48s, macOS x64 6m08s, macOS arm64 3m32s, Windows x64 5m35s, and Windows arm64 9m02s. Linux x64/arm64 oldest- userland supplements passed in 37s/53s; Windows x64 exact build-20348 floor passed in 1m24s.

• Expected aggregate status: the artifact workflow concluded failure only because Windows arm64 hosted image 10.0.26200 again rejected the exact declared 10.0.26100 floor in 3m46s. The failure preserves E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 and is not an assessment/staging regression.

• Other exact-head controls: PR Checks 29384042507 passed in 13m59s. Golden E2E 29384042498 passed macOS/Linux in 4m02s/4m31s.

• Oracle proved: real first-build native candidate bytes on all six runner families obey the exact credential-free pre-sign assessment, preservation, exclusive staging, evidence, and cleanup contract without changing prior build/runtime outcomes.

• Does not prove: Apple Developer ID or SignPath invocation/approval, returned signed bytes, final post-signing hashes, Gatekeeper/quarantine/notarized-app provenance, final SignPath signer policy, Defender/WDAC, exact missing oldest snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: keep every tuple disabled; implement exact returned-file application and final runtime identity/closure contracts before any credentialed signing job is allowed to feed aggregation.

E-M3-NATIVE-SIGNING-APPLY-LOCAL-RED-001 — Missing return-application module fails the focused contract

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: pre-implementation head 6b93976909f9df6373414ecc65daf6e3eaff29b9.

• Command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs
  

• Result: expected RED. The purpose-named test file failed to load because ssh-relay-runtime-native-signing-apply.mjs did not exist: 1 failed file/0 tests in 525 ms. No runtime, workflow, signing, publication, or production behavior changed.

• Oracle proved: the existing payload verifier authenticated the returned file closure but did not yet construct and re-authenticate a complete post-sign runtime or derive its final content ID.

• Does not prove: any implementation behavior, native runner execution, signed bytes, native trust, release aggregation, SSH behavior, or an enabled tuple.

• Correction: add a purpose-named apply module that keeps all roots physically disjoint, copies into an exclusive candidate, substitutes only the exact verified returned files, derives the new full identity, and deletes any candidate that fails final-tree verification.

E-M3-NATIVE-SIGNING-APPLY-LOCAL-001 — Exact returned-file application and final identity contracts pass locally

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit 3eeea7bdb8b10825416d7f9bac03d5a820a997f5, based on exact native-assessment evidence head 6b93976909f9df6373414ecc65daf6e3eaff29b9.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no remote, network, credential, signing service, native-trust environment, artifact publication, or production path was used.

• Commands:

  node --check config/scripts/ssh-relay-runtime-native-signing-apply.mjs
  node --check config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-plan.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs \
    config/scripts/ssh-relay-runtime-windows-authenticode-assessment.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-stage.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  

• Result: PASS. The complete signing-contract family passed 7 files/48 tests in 721 ms; the final apply-plus-workflow check passed 2 files/12 tests in 319 ms; and the complete purpose-named SSH relay script suite passed 28 files/145 tests in 3.79 seconds. Both direct syntax checks, typecheck, full lint/reliability gates, max-lines (355 grandfathered suppressions and no new bypass), bundled-skill verification, localization catalog/coverage, focused formatting, and git diff --check passed. Lint emitted only existing unrelated warnings; local Node 26 emitted the expected repository Node-24 engine warning. An intermediate focused run exposed a macOS /var versus /private/var test-oracle alias and an intermediate lint run rejected three missing braces; both were corrected without weakening assertions or adding a disable, and the complete gates were rerun green.

• Apply oracle: source, returned, and exclusive output roots must be physically disjoint real locations. The complete unsigned source tree is authenticated first; the selection is independently reconstructed from and deeply matched to that identity; and the exact bounded returned closure is reverified. The implementation creates a fresh full-runtime candidate, substitutes only the returned signer files, preserves official Node and valid upstream Windows bytes exactly, drops stale unsigned-archive metadata, recalculates file sizes, hashes, expanded size, file count, and content ID, then re-verifies the complete final tree before returning it. It never mutates the unsigned source and removes the whole output on partial copy, source race, returned-file race, mode failure, or final integrity failure.

• Root/race oracle: existing, nested, overlapping, or physically redirected roots reject before an output is owned. The output is cleaned only after this invocation wins its exclusive creation, so a racing pre-existing path is never removed. Tests force returned and unsigned-source mutation after initial verification and require final-tree failure plus complete output cleanup.

• Workflow oracle: POSIX and Windows native contract jobs each syntax-check the source and test and explicitly execute the suite. The workflow lock requires four test-path occurrences and two source syntax-check occurrences. No fake signer output is produced and no post-sign artifact is built until a real protected signing job returns bytes.

• Does not prove: parsing or execution under Node 24/GitHub Actions, real Apple or SignPath returned bytes, native signature/trust policy, Gatekeeper/quarantine/notarized-app provenance, Authenticode/Defender/WDAC policy, exact missing oldest snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: commit this evidence separately, push both commits, and require exact-head POSIX and Windows logs to show the apply suite executing under Node 24.18.0 on all six native jobs while all prior artifact, smoke, equality, baseline, PR-check, and Golden controls retain their outcomes.

E-M3-NATIVE-SIGNING-APPLY-CI-001 — Return application executes on all six native jobs

• Date: 2026-07-14 (run timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head a0e9ea91773287bd3779f6fb3c800aa0f5f1be01, containing apply implementation 3eeea7bdb8b10825416d7f9bac03d5a820a997f5 and local evidence a0e9ea91773287bd3779f6fb3c800aa0f5f1be01; Actions run 29385274738.

• Commands:

  gh run view 29385274738 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29385274738 --repo stablyai/orca --job 87257092104 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'native-signing-apply|Test Files|Tests|Duration'
  gh run view 29385274738 --repo stablyai/orca --job 87257092096 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'native-signing-apply|Test Files|Tests|Duration'
  gh run view 29385274738 --repo stablyai/orca --job 87258165496 --log | \
    rg 'Operating System|OsBuildNumber|26100|26200|declared Windows floor'
  gh run view 29385274716 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29385274721 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  

• Contract result: PASS on Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64. Every native build job reports its purpose-named contract step successful under exact Node 24.18.0. The macOS arm64 POSIX log records both apply syntax checks, the apply suite passing 6/6 in 245 ms, and the aggregate 27 files/141 tests in 3.58 seconds. The Windows x64 PowerShell log records both syntax checks, the apply suite passing 6/6 in 1.638 seconds, and the aggregate 28 files/138 passed plus seven declared platform skips out of 145 in 7.13 seconds.

• Native build/regression controls: all six double-build, smoke, exact-equality, metadata, assessment/stage, cleanup, and unpublished-upload jobs passed. Durations were Linux x64 3m51s, Linux arm64 4m54s, macOS x64 5m58s, macOS arm64 2m31s, Windows x64 5m22s, and Windows arm64 8m37s. Digest-pinned Linux x64/arm64 glibc 2.28/libstdc++ 6.0.25 supplements passed in 49s/58s. Windows x64 passed exact build 20348 in 1m39s.

• Expected aggregate status: the artifact workflow concluded failure only because the Windows arm64 hosted image identified itself as Windows 11 build 10.0.26200 and rejected the exact declared build-26100 floor after 3m47s. The report records platform and architecture checks true with osBuild: false, preserving E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 without weakening its oracle.

• Other exact-head controls: PR Checks 29385274716 passed in 13m50s after lint, typecheck, Git 2.25 compatibility, full tests, unpacked-app build, and packaged-CLI smoke. Golden E2E 29385274721 passed Linux/macOS in 4m42s/6m54s.

• Oracle proved: both native shell families parse and execute the exact post-sign application contract on every target-native runner while all existing artifact, bundled-Node, PTY/watcher, clean-build equality, oldest-userland, packaging, and E2E controls retain their prior outcomes.

• Does not prove: real Apple/SignPath returned bytes, final native trust, Gatekeeper/quarantine or notarized-app provenance, Authenticode/Defender/WDAC policy, exact missing oldest snapshots, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: keep every tuple disabled and all signing credentials disconnected. Continue with credential-free native-trust and release-DAG failure contracts; require separately provisioned protected signing services and exact-floor runners before any native-signing/trust checkbox or aggregate output can pass.

E-M3-MACOS-SIGNATURE-LOCAL-RED-001 — Missing macOS signature verifier fails the focused contract

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: pre-implementation head 2d4eab2c592adb0fd6396d6312394dddc6be6bc2.

• Command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-macos-signature-verification.test.mjs
  

• Result: expected RED. The purpose-named test file failed to load because ssh-relay-runtime-macos-signature-verification.mjs did not exist: 1 failed file/0 tests in 385 ms. No runtime, workflow, credential, signing, publication, or production behavior changed.

• Oracle proved: final-tree application did not yet enforce strict native macOS signature validity or exact upstream Node/Orca signer policy after returned bytes were substituted.

• Does not prove: any implementation, signed Orca bytes, native trust, Gatekeeper/notarization, release aggregation, SSH behavior, or an enabled tuple.

• Correction: authenticate the complete final runtime before native probes, bind the selection and unsigned/final identities, run bounded argument-array codesign probes on every native file, pin official Node policy, require the configured Orca team, and hash each file again after probing.

E-M3-MACOS-SIGNATURE-LOCAL-001 — Final-tree-first macOS Developer ID policy passes locally

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit debb13f3011dc750e54826a4820f109e7d80f959, based on exact apply-CI evidence commit 2d4eab2c592adb0fd6396d6312394dddc6be6bc2.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no remote, network, credential, signing service, artifact publication, Gatekeeper/notarization, or production path was used. Synthetic Developer ID output was dependency-injected; the two real official Node checks used previously downloaded unpublished artifacts from run 29384042509.

• Commands:

  node --check config/scripts/ssh-relay-runtime-macos-signature-verification.mjs
  node --check config/scripts/ssh-relay-runtime-macos-signature-verification.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs \
    config/scripts/ssh-relay-runtime-macos-signature-verification.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-payload.mjs \
    config/scripts/ssh-relay-runtime-native-signing-selection.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.mjs \
    config/scripts/ssh-relay-runtime-macos-signature-verification.mjs \
    config/scripts/ssh-relay-runtime-macos-signature-verification.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  for archive in <downloaded-darwin-arm64.tar.xz> <downloaded-darwin-x64.tar.xz>; do
    tar -xJf "$archive" -C <exclusive-temp-directory>
    /usr/bin/codesign --verify --strict --verbose=4 <exclusive-temp-directory>/bin/node
    /usr/bin/codesign --display --verbose=4 <exclusive-temp-directory>/bin/node
  done
  git diff --check
  

• Result: PASS. The signing payload/selection/application/macOS/workflow command passed 5 files/36 tests in 1.08 seconds; the final macOS-plus-workflow check passed 2 files/13 tests in 2.32 seconds; and the complete purpose-named SSH relay script suite passed 29 files/152 tests in 8.81 seconds. Both direct syntax checks, typecheck, full lint/reliability gates, max-lines (355 grandfathered suppressions and no new bypass), bundled-skill verification, localization catalog/coverage, focused formatting, and git diff --check passed. Lint emitted only existing unrelated warnings; local Node 26 emitted the expected repository Node-24 engine warning.

• Real official-Node result: PASS for both previously audited Node v24.18.0 candidates. Strict codesign reports each file valid on disk and satisfying its designated requirement. The arm64 and x86_64 display output both record signature size 8,986, exact first authority Developer ID Application: Node.js Foundation (HX7739G8FX), the Developer ID Certification Authority and Apple Root CA chain, and team identifier HX7739G8FX. This authenticates the pinned vendor policy only; the three Orca-built files in those unsigned candidates remain ad-hoc signed.

• Verification oracle: the verifier runs only on macOS, requires an exact ten-character configured Orca team ID, reconstructs the selection from the authenticated unsigned identity, rejects stale unsigned archive metadata, and permits changes only to the exact three selected files within the established 4-MiB/file and 64-MiB/return bounds. It verifies final totals/content identity and the complete physical tree before any native command. Every target is a regular file whose SHA-256 matches before and after two /usr/bin/codesign argument-array probes bounded to 30 seconds and 64 KiB. Node requires the exact pinned authority/team; every Orca-built target requires the Apple Developer ID chain and configured Orca team. Ad-hoc, malformed/duplicate output, wrong authority, wrong team, command error/nonzero/oversized output, source/final/selection drift, and probe-time mutation fail closed.

• Workflow oracle: POSIX and Windows native contract jobs each syntax-check the source/test and explicitly execute the suite. Four test-path and two source-check occurrences are locked by the workflow contract. No job invokes codesign on fake returned bytes, connects credentials, signs, publishes, aggregates, or enables a tuple.

• Does not prove: real Developer ID signatures on the three returned Orca files, the actual Orca team/authority, target-native post-sign execution, macOS 13.5, quarantine/Gatekeeper, notarized containing-app provenance, Apple credential/timeout behavior, Windows final trust, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: commit this evidence separately, push both commits, and require exact-head POSIX and Windows logs to show the macOS policy suite under Node 24.18.0 on all six native jobs while every prior build/smoke/equality/baseline, PR-check, and Golden control retains its outcome. Keep native signing/trust unchecked until real returned bytes pass target-native policy and endpoint gates.

E-M3-MACOS-SIGNATURE-CI-001 — macOS signature-policy contracts pass on all six native jobs

• Date: 2026-07-14
• Owner: Codex implementation owner
• Source: exact head 6d47ef1458a9c57cc96fa26e1745eba8d73a7987.
• Runner/remote/network: GitHub-hosted target-native Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64 artifact jobs under Node v24.18.0. This used no SSH remote, signing credential/service, artifact publication, production path, or enabled tuple.
• Runs:
  • Artifact: 29386372366
  • PR Checks: 29386372337
  • Golden E2E: 29386372362
• Result: PASS. All six native artifact jobs passed their macOS signature contract step. The macOS arm64 job ran the focused suite 7/7 in 345 ms and the aggregate 28 files/148 tests in 3.95 seconds. The Windows x64 job ran the suite 7/7 in 2.944 seconds and the aggregate 29 files/152 tests (145 pass, 7 platform skips) in 8.69 seconds. Native job durations were Linux x64 4m09s, Linux arm64 4m37s, macOS x64 10m27s, macOS arm64 2m47s, Windows x64 5m37s, and Windows arm64 10m29s.
• Regression controls: both digest-pinned oldest-Linux-userland supplements passed (x64 35s, arm64 53s); Windows x64 build-20348 passed in 1m10s. Windows arm64 retained the expected floor failure: hosted build 10.0.26200 does not prove required build 26100 (osBuild: false). PR Checks passed in about 14m05s; Golden Linux/macOS passed in about 4m37s/3m01s.
• Oracle proved: the credential-free policy suite parses and executes under the pinned release Node on every target-native shell family while prior artifact and repository controls retain their expected outcomes.
• Does not prove: real Orca Developer ID signatures, actual Apple signing or returned production bytes, Gatekeeper/notarization, macOS 13.5, Windows Authenticode/Defender/WDAC, Windows arm64 build 26100, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.
• Follow-up: keep native signing/trust and every tuple unchecked. Implement the independent credential-free Windows final-signature policy contract, and require real returned bytes plus target-native endpoint gates before recording native-trust evidence.

E-M3-WINDOWS-SIGNATURE-LOCAL-RED-001 — Missing final Windows signature verifier fails focused contract

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: pre-implementation head 0efd19c9c3e82979554804d4e72b6fb5a3cbff7e plus the new uncommitted purpose-named test.

• Command:

  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-windows-signature-verification.test.mjs
  

• Result: expected RED. The focused suite failed 1 file/0 tests in 463 ms because ssh-relay-runtime-windows-signature-verification.mjs did not exist. No credential, signing service, workflow, publication, tuple, SSH, or production behavior changed.

• Oracle proved: the existing pre-sign assessment and return-application modules did not already authenticate the complete final Windows tree and enforce final official-Node, Orca SignPath, and preserved-upstream signer policy.

• Does not prove: the implementation, real SignPath returned bytes, Windows trust, Defender/WDAC, target-native behavior, SSH transfer/install, fallback/performance, or an enabled tuple.

• Correction: authenticate the complete final tree before native probes; require Valid on every native file; pin the exact official Node and SignPath subjects; require preserved files to retain their assessed subject and thumbprint; bound PowerShell; and hash every target before and after probing.

E-M3-WINDOWS-SIGNATURE-LOCAL-001 — Final-tree-first Windows signer policy passes locally

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit 072c0d434e91013fc29ce16059da82c1ac7bfc12, based on local evidence commit 0efd19c9c3e82979554804d4e72b6fb5a3cbff7e.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0. No SSH remote, credential, signing service, PowerShell trust execution, publication, or production path was used. Synthetic Get-AuthenticodeSignature output was dependency-injected. Exact unpublished win32 x64/arm64 artifacts were downloaded from run 29386372366 solely for authenticated embedded certificate inspection.

• Commands:

  node --check config/scripts/ssh-relay-runtime-windows-signature-verification.mjs
  node --check config/scripts/ssh-relay-runtime-windows-signature-verification.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts \
    config/scripts/ssh-relay-runtime-native-signing-selection.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs \
    config/scripts/ssh-relay-runtime-windows-authenticode-assessment.test.mjs \
    config/scripts/ssh-relay-runtime-windows-signature-verification.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-windows-signature-verification.mjs \
    config/scripts/ssh-relay-runtime-windows-signature-verification.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  gh run download 29386372366 --repo stablyai/orca --pattern 'ssh-relay-runtime-win32-*'
  unzip -p <authenticated-runtime.zip> bin/node.exe | shasum -a 256
  unzip -p <authenticated-runtime.zip> bin/node.exe | node -e <bounded-PE-certificate-table-slice> | \
    openssl pkcs7 -inform DER -print_certs -noout
  git diff --check
  

• Result: PASS. The focused five-suite command passed 5 files/32 tests in 3.89 seconds. The complete purpose-named SSH relay suite passed 30 files/158 tests in 5.39 seconds; the final post-format verifier/workflow rerun passed 2 files/12 tests in 368 ms. Both syntax checks, typecheck, full lint and reliability/localization/bundled-skill gates, max-lines (355 grandfathered suppressions and no new bypass), focused formatting, and git diff --check passed. Lint emitted only existing unrelated warnings; local Node 26 emitted the expected repository Node-24 engine warning.

• Verification oracle: the verifier accepts only Windows, reconstructs and authenticates the signing selection, enforces the bounded source-to-final identity transition and final content ID, and verifies the complete physical final tree before any native command. It probes all six native files through the existing argument-array PowerShell contract bounded to 30 seconds and 64 KiB, requires Valid, and hashes each file before and after probing. Official Node requires exact subject CN=OpenJS Foundation, O=OpenJS Foundation, L=San Francisco, S=California, C=US; every returned Orca file requires exact SignPath Foundation subject; preserved Microsoft files must retain both their source-assessed subject and 40-hex thumbprint. Wrong/malformed status or signer, stale selection/identity/archive metadata, unbounded growth, tree mutation, and probe-time mutation fail closed.

• Exact official-Node certificate evidence: the arm64/x64 bin/node.exe bytes match their identities at SHA-256 c7225670c3f477778e18c43a55867f7a0d76468221245e5981ab80eb953c8102 (81,067,848 bytes) and 9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de (92,534,088 bytes). Both PE certificate tables contain the OpenJS Foundation subject in San Francisco, California, issued by Microsoft ID Verified CS AOC CA 04. This establishes the signer subject encoded in the exact authenticated inputs; local OpenSSL inspection does not establish Windows Authenticode Valid status or endpoint trust.

• Workflow oracle: both POSIX and Windows artifact job families syntax-check the verifier source and test and run the suite. Four test-path and two source-check occurrences are locked. No job invokes SignPath, fabricates final bytes, accepts native trust, publishes, or enables a tuple.

• Does not prove: real SignPath signatures on the three returned Orca files, target-native final-tree execution, Windows Server 2022/Windows 11 trust, Defender/WDAC, the arm64 build-26100 floor, signing approval/timeout behavior, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: commit and push the implementation/evidence separately, then require exact-head POSIX and PowerShell logs to show the new suite under Node 24.18.0 on all six native jobs while every prior artifact, baseline, PR-check, and Golden control retains its expected outcome. Keep native signing/trust unchecked until real returned bytes pass target-native policy and endpoint gates.

E-M3-WINDOWS-SIGNATURE-CI-001 — Windows signer-policy contracts pass on all six native jobs

• Date: 2026-07-14 (run timestamps 2026-07-15 UTC)

• Owner: Codex implementation owner

• Source/run: exact draft-PR head cce37cd415600e9bd77093d250b5cb8e3ad9f3ce, containing implementation 072c0d434e91013fc29ce16059da82c1ac7bfc12; Actions run 29387668264.

• Commands:

  gh run view 29387668264 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29387668264 --repo stablyai/orca --job 87264193814 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'windows-signature-verification|Test Files|Tests|Duration'
  gh run view 29387668264 --repo stablyai/orca --job 87264193803 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'windows-signature-verification|Test Files|Tests|Duration'
  gh run view 29387668264 --repo stablyai/orca --job 87264193809 --log | \
    awk -F '\t' '$2 == "Run runtime artifact contract tests"' | \
    rg 'windows-signature-verification|Test Files|Tests|Duration'
  gh run view 29387668264 --repo stablyai/orca --job 87265321571 --log | \
    rg 'OsBuildNumber|26100|26200|osBuild'
  gh run view 29387668227 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  gh run view 29387668205 --repo stablyai/orca \
    --json status,conclusion,headSha,createdAt,updatedAt,url,jobs
  

• Contract result: PASS on Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64. Every native build job syntax-checked the source/test and executed the new suite under exact Node 24.18.0. The macOS arm64 log records 6/6 in 372 ms and aggregate 29 files/154 tests in 4.86 seconds. Windows x64 records 6/6 in 2.643 seconds and aggregate 30 files/158 tests (151 pass, 7 platform skips) in 8.13 seconds; Windows arm64 records 6/6 in 3.722 seconds and the same aggregate in 11.35 seconds.

• Native build/regression controls: all six double-build, smoke, exact-equality, metadata, stage, cleanup, and unpublished-upload jobs passed. Durations were Linux x64 4m08s, Linux arm64 4m20s, macOS x64 9m42s, macOS arm64 2m58s, Windows x64 5m14s, and Windows arm64 9m13s. Linux x64/arm64 digest-pinned glibc 2.28/libstdc++ 6.0.25 supplements passed in 52s/52s. Windows x64 exact build-20348 passed in 1m17s.

• Expected aggregate status: the artifact workflow concluded failure only because the Windows arm64 hosted image is build 10.0.26200 rather than the declared 10.0.26100 floor (osBuild: false) in 4m41s. This retains E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 and is not a verifier regression.

• Other exact-head controls: PR Checks 29387668227 passed in about 13m27s, including lint, reliability/max-lines, typecheck, Git 2.25 compatibility, full tests, unpacked app, and packaged-CLI smoke. Golden E2E 29387668205 passed Linux/macOS in about 4m49s/5m18s.

• Oracle proved: both native shell families parse and execute the exact final-tree/signer-policy contract on every target-native runner while all prior artifact, bundled-Node, PTY/watcher, clean-build equality, oldest-userland, packaging, and E2E controls retain their expected outcome.

• Does not prove: a real final signed Windows runtime, SignPath invocation or returned Orca bytes, target-native Valid status for those returned bytes, Defender/WDAC, exact Windows arm64 build 26100, Apple signing/trust, release aggregation, SSH transfer/install, packaged desktop use, fallback/performance, or an enabled tuple.

• Follow-up: keep native signing/trust and every tuple unchecked. Prove exact official-Node and preserved-upstream source signatures target-natively without credentials, then keep real returned SignPath bytes plus Defender/WDAC and exact-floor execution as separate required gates.

E-M3-WINDOWS-SOURCE-SIGNATURE-LOCAL-RED-001 — Missing Windows source-signature gate fails import contract

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: pre-implementation head bd3e40dc52ede75e44ded2f5e84f5092be5b2d87 plus the new uncommitted purpose-named test.

• Command:

  node --input-type=module -e \
    "import('./config/scripts/ssh-relay-runtime-windows-source-signature-verification.test.mjs')"
  

• Result: expected RED with ERR_MODULE_NOT_FOUND for ssh-relay-runtime-windows-source-signature-verification.mjs. A concurrent focused Vitest launch was stopped after unrelated workspace CPU contention prevented a bounded result; it is not used as evidence. No workflow, credential, signing, publication, tuple, SSH, or production behavior changed.

• Oracle proved: neither the pre-sign assessment nor final-runtime verifier already exposed a reusable gate that authenticated the complete source tree and target-natively verified official Node plus preserved upstream signer policy.

• Does not prove: implementation, Windows execution, a Valid signature, SignPath returns, Defender/WDAC, SSH behavior, or an enabled tuple.

• Correction: consume the exact signing-stage assessment and selection, authenticate the complete source tree, run three bounded native probes, require exact Node/preserved identity, re-hash each target, and retain a separate report from each Windows runner.

E-M3-WINDOWS-SOURCE-SIGNATURE-LOCAL-001 — Immutable and preserved Windows source policy passes locally

• Date: 2026-07-14

• Owner: Codex implementation owner

• Source: implementation commit 6ef2943dedd0165ae4b84d8295763aa06682d6cc, based on CI evidence commit bd3e40dc52ede75e44ded2f5e84f5092be5b2d87.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0. No SSH remote, Windows trust execution, credential, signing service, publication, or production path was used. Native output was dependency-injected; exact target-native execution remains the next gate.

• Commands:

  node --check config/scripts/ssh-relay-runtime-windows-source-signature-verification.mjs
  node --check config/scripts/ssh-relay-runtime-windows-source-signature-verification.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-windows-source-signature-verification.test.mjs \
    config/scripts/ssh-relay-runtime-windows-signature-verification.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    config/scripts/ssh-relay-runtime-windows-signature-verification.mjs \
    config/scripts/ssh-relay-runtime-windows-source-signature-verification.mjs \
    config/scripts/ssh-relay-runtime-windows-source-signature-verification.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  

• Result: PASS. The final focused command passed 3 files/17 tests in 4.98 seconds; the complete purpose-named SSH relay suite passed 31 files/163 tests in 5.16 seconds. Both syntax checks, typecheck, full lint and reliability/localization/bundled-skill gates, max-lines (355 grandfathered suppressions and no new bypass), focused formatting, and git diff --check passed. Lint emitted only existing unrelated warnings; local Node 26 emitted the expected repository Node-24 engine warning.

• Verification oracle: a bounded regular signing-stage report must exactly reproduce the hash-authenticated tuple/platform/policy, assessments, immutable file, signing set, and preserved set. On Windows, the verifier authenticates the complete source runtime before any probe, then reuses the final verifier's exact signer policy and 30-second/64-KiB PowerShell boundary for the one official Node file and two source-preserved Microsoft files. Every file is hashed before and after probing. Cross-platform execution, report/selection drift, wrong signer/status/thumbprint, prior tree mutation, and probe-time mutation fail closed.

• Workflow oracle: both native shell families syntax-check and run the source contract. After the real Windows first-build assessment, each native Windows job invokes the source verifier before removing signing staging, requires exactly one official-node and two preserved-upstream results, and retains a distinct .source-signatures.json evidence file. It has no credentials and does not invoke SignPath or change runtime bytes.

• Does not prove: target-native x64/arm64 execution, actual Valid status or signer outputs, real SignPath returned Orca files, final Windows trust, Defender/WDAC, build 26100, release aggregation, SSH transfer/install, fallback/performance, or an enabled tuple.

• Follow-up: push the implementation and evidence, inspect both exact source-signature reports and runner logs, and keep returned-byte/native-trust boxes unchecked until the separately gated real SignPath and endpoint checks pass.

E-M3-WINDOWS-SOURCE-SIGNATURE-CI-001 — Native Windows source signatures match retained identity

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact head be32653a7b77eeaed168d91b790fc2e006b438db; artifact run 29388734922, PR Checks 29388734935, and Golden E2E 29388734914.

• Native jobs:

  • win32-x64: job 87267322870, GitHub-hosted windows-2022, resolved win22 image 20260706.237.1, native X64, runner GitHub Actions 1000055156; PASS in 5 minutes 23 seconds. Its combined two-build, verify, smoke, compare, signing-stage, and source-signature step ran for 3 minutes 45 seconds.
  • win32-arm64: job 87267322867, GitHub-hosted windows-11-arm, resolved win11-arm64 image 20260706.102.1, native ARM64, runner GitHub Actions 1000055154; PASS in 11 minutes 7 seconds. Its combined two-build, verify, smoke, compare, signing-stage, and source-signature step ran for 5 minutes 30 seconds.
  • The workflow does not time the three source-signature probes separately. Each probe retains the implemented 30-second process timeout and 64-KiB output bound; the combined step timings above are the narrowest exact native timing available from this run.

• Artifact retrieval and identity command:

  gh run download 29388734922 --repo stablyai/orca \
    --name ssh-relay-runtime-win32-x64 --dir <exclusive-x64-directory>
  gh run download 29388734922 --repo stablyai/orca \
    --name ssh-relay-runtime-win32-arm64 --dir <exclusive-arm64-directory>
  node --input-type=module -e '<bounded identity/signing-report comparison>' <artifact-directory>
  shasum -a 256 <artifact-directory>/*.source-signatures.json
  wc -c <artifact-directory>/*.source-signatures.json
  

• Result: PASS. Each artifact contains exactly one identity, archive, SPDX statement, provenance statement, signing-stage report, and source-signature report. The bounded comparison requires one report, exact tuple/content identity, exactly three verified files, one official-node, two preserved-upstream, identity-entry hash equality for every verified file, and exact preserved subject/thumbprint equality with the authenticated signing-stage report.

• Retained report identities:

  • x64 report: 1,401 bytes, SHA-256 9ceb6b3dadf85ea7d338dbd11e1397e58b83455842378f3465ccb945b5ec0805, source content ID sha256:7ddad668780ce5b2592d86afcebf9d897172bdf07c618ae238b5d51eebfe1596.
  • arm64 report: 1,403 bytes, SHA-256 5a63a7f31d64cc6a8b825461e9729f59f0176d8d03293fa0ce2c05df39734d22, source content ID sha256:2955cec7f22447a1303dad548df6c2fa2470b62ba1d70924b8b169e718a7701e.

• Exact native signer evidence:

  • Both official Node files report Valid with subject CN=OpenJS Foundation, O=OpenJS Foundation, L=San Francisco, S=California, C=US and thumbprint CECD9673E955CA766047DD43706D31E48A6BD3B5. The x64 Node hash is sha256:9a4eb5f1c29c6a2e93852ead46b999e284a6a5ca8bab4d4e241d587d025a52de; arm64 is sha256:c7225670c3f477778e18c43a55867f7a0d76468221245e5981ab80eb953c8102.
  • Every preserved file reports Valid with subject CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US. x64 OpenConsole.exe and conpty.dll use thumbprint 3F56A45111684D454E231CFDC4DA5C8D370F9816. Arm64 OpenConsole.exe uses F5877012FBD62FABCBDC8D8CEE9C9585BA30DF79; arm64 conpty.dll uses 3F56A45111684D454E231CFDC4DA5C8D370F9816.

• Concurrent regression result: PR Checks and both Golden E2E jobs completed successfully at the exact head. The artifact run concluded failure solely because its separate Windows arm64 oldest-baseline job observed 10.0.26200 rather than the exact required build 26100, after the runtime itself passed bundled Node, PTY, watcher, and settlement smoke in 8,275.5554 ms with a 49,852,416-byte RSS measurement. This is the retained E-M3-WINDOWS-ARM64-BASELINE-CI-RED-001 gap, not a source-signature failure.

• Does not prove: real SignPath returned Orca signatures, final-tree Authenticode trust, Defender or WDAC policy, Windows arm64 build 26100, macOS trust, draft release aggregation/read-back, SSH transfer/install, fallback/performance, or an enabled tuple. Nothing was published or connected to production behavior.

E-M4-RELEASE-DAG-LOCAL-RED-001 — Missing release-stage and draft-recovery gates fail imports

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact implementation base be32653a7b77eeaed168d91b790fc2e006b438db plus the two new uncommitted purpose-named test files.

• Command:

  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs \
    config/scripts/ssh-relay-runtime-draft-recovery.test.mjs
  

• Result: expected RED in 346 ms. Both suites fail before collecting tests with ERR_MODULE_NOT_FOUND for ssh-relay-runtime-release-stage-gate.mjs and ssh-relay-runtime-draft-recovery.mjs.

• Oracle proved: the current worktree has no reusable contract that requires a complete immutable build → native-signing approval/return → aggregate/manifest-signature → upload → authenticated read-back chain, and no contract that permits same-draft recovery only for exact already-uploaded runtime bytes.

• Does not prove: implementation, workflow wiring, GitHub release behavior, signing-service behavior, a real draft recovery, publication, desktop embedding, SSH behavior, or an enabled tuple.

• Correction: implement bounded exact-stage validation and hash/size-bound same-draft reuse as disconnected credential-free modules; retain every production/default and tuple state unchanged.

E-M4-RELEASE-DAG-LOCAL-001 — Fail-closed release stages and same-draft recovery pass locally

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact implementation commit 6f13e94f8a7a315ac3da6bb2067b99da8e02a803, based on be32653a7b77eeaed168d91b790fc2e006b438db.

• Runner/remote/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0. No GitHub release, signing service, credential, approval environment, SSH remote, publication, or production consumer was used. The repository emits its expected Node-24 engine warning.

• Commands:

  node --check config/scripts/ssh-relay-runtime-release-stage-gate.mjs
  node --check config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs
  node --check config/scripts/ssh-relay-runtime-draft-recovery.mjs
  node --check config/scripts/ssh-relay-runtime-draft-recovery.test.mjs
  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs \
    config/scripts/ssh-relay-runtime-draft-recovery.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs \
    config/scripts/ssh-relay-runtime-draft-recovery.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check \
    .github/workflows/ssh-relay-runtime-artifacts.yml \
    config/scripts/ssh-relay-runtime-release-stage-gate.mjs \
    config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs \
    config/scripts/ssh-relay-runtime-draft-recovery.mjs \
    config/scripts/ssh-relay-runtime-draft-recovery.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \
    docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
  git diff --check
  

• Result: PASS. The two purpose-named suites pass 2 files/21 tests in 245 ms; /usr/bin/time -l records 0.91 seconds wall time, 131,825,664-byte maximum RSS, zero swaps, and 95,933,720-byte peak memory footprint for the Vitest process tree. The workflow-inclusive focus passes 3 files/27 tests; the final complete SSH-relay suite passes 33 files/184 tests in 8.52 seconds. All four syntax checks, typecheck, full lint/reliability/localization/bundled-skill gates, max-lines (355 grandfathered suppressions and no new bypass), focused formatting, and git diff --check pass. Lint emits only existing unrelated warnings.

• Stage oracle: candidate tuples must use exact supported identities; every candidate requires one bounded successful build, every macOS/Windows candidate requires one single-attempt approved native-signing return that changes immutable identity, and Linux cannot invent a signing stage. Aggregate inputs must exactly equal final per-tuple outputs and produce bounded manifest/signature assets. Upload and authenticated read-back must reproduce the complete ordered hash/size chain. Missing, duplicate, unexpected, failed, cancelled, timed-out, retry-exhausted, over-budget, approval-absent, approval-denied, approval-timed-out, input-drifted, incomplete, or byte-drifted results fail closed.

• Bound policy: build is at most 30 minutes and three attempts; native signing is one attempt and at most four hours; aggregate is one attempt and 15 minutes; upload and read-back are each at most three attempts and 15 minutes. Signing is deliberately single-attempt so one approval cannot silently authorize a second set of bytes after timeout or service failure.

• Recovery oracle: only the same draft tag and exact 40-hex source commit may be resumed. Existing managed assets are reusable only when name, SHA-256, and non-zero size exactly match expected immutable output. Changed, empty, duplicate, unexpected managed, published, cross-tag, and cross-commit states fail closed; unrelated desktop assets are ignored rather than overwritten.

• Workflow oracle: both POSIX and Windows artifact jobs syntax-check and execute the new suites under the same Node 24 native job families. The workflow retains read-only contents permission and has no release, signing credential, or publication authority.

• Does not prove: a real native-signing approval/timeout, signing-service retry behavior, a real aggregate or signed manifest, upload/read-back through GitHub's draft release API, recovered-draft execution, desktop prerequisites/embedding, native trust, SSH transfer/install, fallback, performance, or an enabled tuple. Production release workflow wiring remains absent.

• Follow-up: run the contract on all six native jobs at the exact implementation head, then add the credential-free aggregate-input/read-back implementation without connecting publication or a desktop consumer.

E-M4-RELEASE-DAG-CI-001 — Release-DAG contracts pass all six native build jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact PR head 97164470cb9abad670634b9d4f04424bcc8662b5; implementation commit 6f13e94f8a7a315ac3da6bb2067b99da8e02a803; draft PR #8741.
• Runner/network: GitHub-hosted native runners with normal artifact-build egress and no SSH remote, signing service, release credential, approval environment, draft upload, publication, or desktop consumer. Exact jobs and resolved images:
  • linux-x64-glibc job 87271365779: ubuntu-24.04, ubuntu24 image 20260705.232.1, X64, 04:53:59Z–04:58:13Z.
  • linux-arm64-glibc job 87271365815: ubuntu-24.04-arm, ubuntu24-arm64 image 20260714.61.1, ARM64, 04:54:03Z–04:59:11Z.
  • darwin-x64 job 87271365782: macos-15-intel, macos15 image 20260629.0276.1, X64, 04:53:59Z–04:59:21Z.
  • darwin-arm64 job 87271365773: macos-15, macos15 image 20260706.0213.1, ARM64, 04:53:59Z–04:57:05Z.
  • win32-x64 job 87271365831: windows-2022, win22 image 20260706.237.1, X64, 04:53:59Z–04:59:34Z.
  • win32-arm64 job 87271365776: windows-11-arm, win11-arm64 image 20260706.102.1, ARM64, 04:53:59Z–05:03:25Z.
• Command: the workflow's Run runtime artifact contract tests step syntax-checks both new modules and tests, then includes ssh-relay-runtime-release-stage-gate.test.mjs and ssh-relay-runtime-draft-recovery.test.mjs in the purpose-named native Vitest command. Inspection used gh run view 29390079639 --repo stablyai/orca --job <job-id> --log for every job.
• Result: PASS for all six target-native build jobs. Each runner passes the release-stage suite's 15 tests and draft-recovery suite's 6 tests under Node v24.18.0. The four POSIX jobs report 32 passing contract files; the two Windows jobs report 33, including the Windows-only PE diagnostic suite. Both Linux oldest-userland jobs and Windows x64 floor job also pass. Overall workflow conclusion is the expected failure only because downstream Windows arm64 floor job 87272581856 observes build 26200 instead of required 26100 after the exact runtime passes archive/tree verification, bundled Node, PTY, watcher, and resource settlement in 7,721.7682 ms with 48,504,832-byte RSS.
• Concurrent regression: Golden E2E run 29390079632 passes both macOS job 87271365717 and Linux job 87271365749. PR Checks run 29390079665 attempt 1 job 87271365846 passes lint, typecheck, Git compatibility, and tests, then flakes during Build unpacked app when a 125-MB Electron GitHub asset download receives read: connection reset by peer. Authorized attempt 2 job 87272898091 runs from 05:05:54Z to 05:21:00Z and passes the complete verify job, including unpacked packaging and packaged CLI smoke.
• Oracle proved: the disconnected build → signing → aggregate → upload → read-back failure contract and same-draft immutable recovery contract parse and execute identically on all six native runner families, including Windows PowerShell workflow wiring. No platform can omit its required signing stage, invent a Linux signing stage, exceed the bounded retry/time policy, or accept missing, duplicate, drifted, failed, cancelled, approval-rejected, or recovered cross-release state.
• Does not prove: real Apple/SignPath signing or approval, target-native trust of returned Orca bytes, aggregate/manifest generation, manifest signing, GitHub draft upload/read-back, packaged manifest embedding, SSH transfer/install, fallback, performance, or an enabled tuple.
• Follow-up: implement disconnected aggregate-input and authenticated draft read-back verification, then execute it on all six native job families. Retain every production/default and tuple state.

E-M4-AGGREGATE-READBACK-LOCAL-RED-001 — Aggregate and draft byte verifiers are absent

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact implementation base 97164470cb9abad670634b9d4f04424bcc8662b5 plus the two new uncommitted purpose-named test files.

• Command:

  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-aggregate-input.test.mjs \
    config/scripts/ssh-relay-runtime-draft-readback.test.mjs
  

• Result: expected RED in 284 ms. Both suites fail before collecting tests with ERR_MODULE_NOT_FOUND for ssh-relay-runtime-aggregate-input.mjs and ssh-relay-runtime-draft-readback.mjs.

• Oracle proved: the exact head had only declarative stage/recovery contracts; it had no filesystem implementation binding aggregate input declarations to stable archive bytes and no authenticated, bounded draft asset read-back implementation.

• Does not prove: implementation, GitHub API behavior, actual release assets, native runners, manifest generation/signing, publication, desktop embedding, SSH behavior, or an enabled tuple.

• Correction: implement both byte boundaries as disconnected modules with bounded streaming, cancellation, exact identity/asset checks, and credential-safe redirect handling.

E-M4-AGGREGATE-READBACK-LOCAL-001 — Immutable aggregate and draft read-back bytes pass locally

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: implementation commit e995186545d4b584840cb7ec8cd1403fbd045a7b, based on exact prior head 97164470cb9abad670634b9d4f04424bcc8662b5; draft PR #8741.

• Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0. Aggregate tests use exclusive local temporary directories. Draft tests use injected WHATWG Response objects and make no network, GitHub API, release, credential, signing-service, SSH, publication, or production call. The repository emits its expected Node-24 engine warning.

• Commands:

  node --check config/scripts/ssh-relay-runtime-aggregate-input.mjs
  node --check config/scripts/ssh-relay-runtime-aggregate-input.test.mjs
  node --check config/scripts/ssh-relay-runtime-draft-readback.mjs
  node --check config/scripts/ssh-relay-runtime-draft-readback.test.mjs
  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-aggregate-input.test.mjs \
    config/scripts/ssh-relay-runtime-draft-readback.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-aggregate-input.test.mjs \
    config/scripts/ssh-relay-runtime-draft-readback.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check <eight touched implementation/workflow/checklist files>
  git diff --check
  

• Result: PASS. Four syntax checks pass. After exact-HTTP-200 hardening, the two purpose-named suites pass 2 files/17 tests in 295 ms; /usr/bin/time -l records 0.89 seconds wall time, 132,104,192-byte maximum RSS, zero swaps, and 96,277,880-byte peak memory footprint. Workflow-inclusive focus passes 3 files/23 tests in 410 ms. The complete SSH-relay suite passes 35 files/201 tests in 6.63 seconds. Typecheck, full lint/reliability/localization/bundled-skill gates, max-lines (355 grandfathered suppressions and no new bypass), focused formatting, and git diff --check all pass; lint emits only existing unrelated warnings.

• Aggregate oracle: accepts at most eight declared supported tuples and derives each immutable archive name from its tuple/content identity. The exclusive input directory must contain exactly those regular files, with no extras or links; each file is streamed under a 100-MiB/file and 15-minute bound, and exact size, SHA-256, and stable pre/post file metadata must match before the declared asset chain is returned. Duplicate tuple/name, unsupported tuple, malformed identity, cancellation, missing/extra input, or byte drift fails closed.

• Draft read-back oracle: requires one exact draft ID and stable/RC/perf tag, exact managed asset names, uploaded state, nonzero declared size, at most 100 MiB per asset/1 GiB total, and a 15-minute bound. It manually handles the authenticated GitHub asset API redirect, accepts only HTTPS release-assets.githubusercontent.com, never forwards authorization to the CDN, requires exact HTTP 200 from either direct or redirected downloads, streams every body, and requires exact size and SHA-256. Published/cross-tag/incomplete/unexpected drafts, unsafe redirects, unexpected 2xx statuses, changed/truncated/oversized bytes, and cancellation fail closed.

• Workflow oracle: both POSIX and Windows artifact jobs syntax-check and execute the two new suites under the same Node 24 native job families. The workflow retains read-only contents permission and has no release, signing credential, or publication authority.

• Does not prove: a real GitHub API/CDN redirect, a real draft or full-size asset, aggregate manifest generation, Ed25519 signing, native signing/trust, upload/recovery execution, desktop prerequisites/embedding, SSH transfer/install, fallback, performance, or an enabled tuple. The local symlink fixture is skipped on Windows, although the shared implementation rejects all non-regular directory entries and exact-head Windows execution remains required.

• Follow-up: exact-head native execution is closed by E-M4-AGGREGATE-READBACK-CI-001. Add credential-free canonical manifest assembly/signature handoff without production credentials, publication, or a desktop consumer.

E-M4-AGGREGATE-READBACK-CI-001 — Aggregate and draft byte verifiers pass all six native jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact PR head 87a8e4dc3461ee1c118c223918f36c672749a60b; implementation commit e995186545d4b584840cb7ec8cd1403fbd045a7b; draft PR #8741.
• Runner/network: GitHub-hosted native runners with normal artifact-build egress. The aggregate tests use runner-local exclusive temporary directories. Draft read-back tests inject WHATWG Response objects and make no GitHub API, CDN, release, signing-service, SSH, publication, or production call. Exact jobs, resolved images, and full contract-suite durations:
  • linux-x64-glibc job 87276316322: ubuntu-24.04, ubuntu24 image 20260705.232.1, X64, Node v24.18.0; 34 files/197 tests in 3.64 s; job 05:31:27Z–05:35:54Z.
  • linux-arm64-glibc job 87276316371: ubuntu-24.04-arm, ubuntu24-arm64 image 20260706.52.2, ARM64, Node v24.18.0; 34 files/197 tests in 3.67 s; job 05:31:30Z–05:43:37Z. The digest-pinned builder-image pull took 8m20s; the subsequent two-build runtime step passed in 2m33s.
  • darwin-x64 job 87276316387: macos-15-intel, macos15 image 20260629.0276.1, X64, Node v24.18.0; 34 files/197 tests in 17.99 s; job 05:31:28Z–05:37:13Z.
  • darwin-arm64 job 87276316336: macos-15, macos15 image 20260706.0213.1, ARM64, Node v24.18.0; 34 files/197 tests in 5.08 s; job 05:31:27Z–05:34:29Z.
  • win32-x64 job 87276316353: windows-2022, win22 image 20260706.237.1, X64, Node v24.18.0; 35 files/193 passing and 8 skipped tests in 9.35 s; job 05:31:27Z–05:36:57Z.
  • win32-arm64 job 87276316340: windows-11-arm, win11-arm64 image 20260706.102.1, ARM64, Node v24.18.0; 35 files/193 passing and 8 skipped tests in 10.03 s; job 05:31:27Z–05:39:57Z.
• Commands: the workflow syntax-checks both modules and tests, then includes ssh-relay-runtime-aggregate-input.test.mjs and ssh-relay-runtime-draft-readback.test.mjs in Run runtime artifact contract tests. Evidence inspection used gh run view 29391666358 --repo stablyai/orca --log, purpose-named rg filters, and gh run view 29391666358 --repo stablyai/orca --job <job-id> --log.
• Result: PASS on all six target-native build jobs. Draft read-back passes 10 tests on each runner; aggregate input passes 7 on each POSIX runner and 6 with the one POSIX-symlink fixture skipped on each Windows runner. Purpose-suite timings were draft/aggregate: linux x64 66/36 ms, Linux arm64 52/37 ms, macOS x64 258/54 ms, macOS arm64 46/22 ms, Windows x64 70/62 ms, and Windows arm64 86/49 ms. Shared implementation still rejects non-regular entries on Windows.
• Concurrent regression: both Linux oldest-userland jobs 87277915889 and 87277915838 pass. Windows x64 oldest-floor job 87277415457 passes. Overall artifact run conclusion is the expected failure only because Windows arm64 oldest-floor job 87277415503 observes build 26200 instead of the exact required build 26100; before that gate, archive/tree/Node/PTY/watcher smoke settles in 8,032.7284 ms with 49,922,048-byte RSS. PR Checks run 29391666360 job 87276316191 passes the complete verify/package/CLI-smoke job from 05:31:28Z to 05:46:00Z. Golden E2E run 29391666362 passes Linux job 87276316058 and macOS job 87276316073.
• Oracle proved: exact immutable archive declarations are bound to stable runner-local bytes on all six native families; draft metadata, authenticated redirect handling, exact HTTP 200, bounded streaming, cancellation, size, and SHA-256 policies execute consistently under Node 24. The workflow remains read-only and cannot publish, access a signing environment, or connect a desktop consumer.
• Does not prove: real GitHub API/CDN behavior, a real/full-size draft asset, canonical manifest generation, Ed25519 signing, native signing/trust, upload/recovery execution, desktop prerequisites/embedding, SSH transfer/install, fallback, performance, or an enabled tuple.
• Follow-up: implement credential-free canonical unsigned-manifest assembly plus bounded signing request and returned-signature verification. Do not connect production credentials, publication, desktop consumers, or tuple enablement.

E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-RED-001 — Windows artifact/manifest identity mismatch

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact base 90da7e14b plus uncommitted purpose-named tests; draft PR #8741.

• Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no network, runner, signing, release, SSH, publication, desktop consumer, or production call.

• Commands:

  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-compatibility.test.mjs
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    src/main/ssh/ssh-relay-artifact-schema.test.ts
  

• Result: expected RED. The compatibility suite fails 2/2 tests in 144 ms: both Windows tuple contracts return kind: "win32" rather than manifest-compatible kind: "windows", and the actual canonical content ID sha256:704e9381bc99c97dfbdc4cfc902101879ab6990aa202114120855a5eb02aa6f5 disagrees with the fixed windows vector sha256:b3eb5c89f079ed735cb83cf2595102fe010b8dd78d3096ddf592109b2ac222b0. After correcting only that discriminator locally, the schema suite's new Windows fixture fails 1/30 tests in 196 ms because the desktop consistency verifier expects root node.exe; every target-native Windows artifact and the detailed plan use bin/node.exe.

• Oracle proved: the artifact builder's Windows identities could not be consumed by the reviewed signed-manifest schema even though both sides were individually tested. The failure was caught before canonical assembly, publication, desktop embedding, or tuple enablement.

• Does not prove: the correction, target-native regeneration, archive equality after the intentional content-ID change, native signing/trust, manifest assembly/signing, SSH behavior, or an enabled tuple.

• Correction: use windows only as the compatibility-union discriminator while retaining win32 as the tuple OS, and make the desktop verifier accept the already-reviewed bin/node.exe archive layout. Add both contracts to every native artifact job.

E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001 — Windows artifact and manifest identities align locally

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: implementation commit 707a9da23e3955bed6ed00ad3afc24b5ab808243, based on exact prior head 90da7e14b; draft PR #8741.

• Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no network, native runner, signing, release, SSH, publication, desktop consumer, or production call. The repository emits its expected Node-24 engine warning.

• Commands:

  node --check config/scripts/ssh-relay-runtime-compatibility.mjs
  node --check config/scripts/ssh-relay-runtime-compatibility.test.mjs
  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-compatibility.test.mjs \
    config/scripts/ssh-relay-runtime-workflow.test.mjs \
    src/main/ssh/ssh-relay-artifact-schema.test.ts
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-compatibility.test.mjs \
    config/scripts/ssh-relay-runtime-zip.test.mjs \
    config/scripts/ssh-relay-runtime-artifact.test.mjs \
    config/scripts/ssh-relay-runtime-native-signing-apply.test.mjs \
    config/scripts/ssh-relay-runtime-windows-signature-verification.test.mjs \
    config/scripts/ssh-relay-runtime-windows-source-signature-verification.test.mjs \
    src/main/ssh/ssh-relay-artifact-schema.test.ts \
    src/main/ssh/ssh-relay-runtime-identity.test.ts
  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-*.test.mjs
  pnpm run typecheck
  pnpm run lint
  pnpm run check:max-lines-ratchet
  pnpm exec oxfmt --check <nine touched implementation/workflow/checklist files>
  git diff --check
  

• Result: PASS. Both syntax checks pass. The compatibility/schema/workflow focus passes 3 files/38 tests in 1.59 s; /usr/bin/time -l records 3.41 seconds wall time, 133,152,768-byte maximum RSS, zero swaps, and 96,572,816-byte peak memory footprint. The eight affected contract files pass 62 tests in 5.46 s. The complete SSH-relay suite passes 36 files/203 tests in 14.88 s. Typecheck, full lint/reliability/localization/bundled-skill gates, max-lines (355 grandfathered suppressions and no new bypass), focused formatting, and git diff --check pass; lint emits only existing unrelated warnings.

• Oracle proved: both target-native Windows tuple definitions now use the manifest schema's windows compatibility discriminator while preserving win32 tuple IDs/OS values. The MJS canonical identity matches the fixed Windows vector, the TypeScript schema accepts the exact bin/node.exe archive layout, and both POSIX and Windows workflow families syntax-check and run the parity suite. The intentional content-ID/archive-name change occurs before publication or enablement.

• Does not prove: target-native Windows rebuild/reproducibility with the new content IDs, macOS/Linux non-regression on native runners, native signing/trust, canonical manifest assembly/signing, publication, desktop embedding, SSH transfer/install, fallback, performance, or an enabled tuple.

• Follow-up: run the parity suite and regenerate all six native artifacts at the exact implementation head. If green, record the new Windows content IDs and resume credential-free canonical manifest assembly/signature handoff.

E-M4-WINDOWS-MANIFEST-PARITY-CI-001 — Corrected parity passes all six native artifact jobs

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact head c68a99039e4633d41e21fb30afdfeaa06f776369, containing implementation commit 707a9da23e3955bed6ed00ad3afc24b5ab808243; draft PR #8741.

• Runner/network: GitHub-hosted target-native jobs under Node 24.18.0 in artifact run 29393022768:

  • Windows arm64 job 87280402068, windows-11-arm64 image 20260706.102.1;
  • Linux x64 job 87280402087, ubuntu-24.04 image 20260705.232.1;
  • macOS arm64 job 87280402091, macos-15-arm64 image 20260706.0213.1;
  • macOS x64 job 87280402092, macos-15 image 20260629.0276.1;
  • Windows x64 job 87280402093, windows-2022 image 20260706.237.1;
  • Linux arm64 job 87280402113, ubuntu-24.04-arm image 20260714.61.1.

• Commands/evidence inspection:

  gh run watch 29393022768 --repo stablyai/orca --interval 15 --exit-status
  gh run view 29393022768 --repo stablyai/orca --json status,conclusion,headSha,url,jobs
  gh run view 29393022768 --repo stablyai/orca --job <native-job-id> --log
  gh run download 29393022768 --repo stablyai/orca \
    -n ssh-relay-runtime-win32-x64 -D <temporary-directory>
  gh run download 29393022768 --repo stablyai/orca \
    -n ssh-relay-runtime-win32-arm64 -D <temporary-directory>
  gh run view 29393022761 --repo stablyai/orca --json status,conclusion,headSha,url,jobs
  gh run view 29393022784 --repo stablyai/orca --json status,conclusion,headSha,url,jobs
  

• Result: PASS on all six target-native build jobs. The complete contract suite passes 35 files/199 tests on each POSIX runner and 36 files/195 passed plus 8 platform-skipped tests on each Windows runner. Total Vitest durations are Linux x64 4.41 s, Linux arm64 3.37 s, macOS arm64 6.96 s, macOS x64 29.25 s, Windows x64 8.16 s, and Windows arm64 11.13 s. The purpose-named compatibility suite passes 2/2 tests in 3–8 ms on every runner; the workflow suite passes 6/6 in 77–499 ms. Every job then builds twice, verifies archive/tree/Node/native modules, smokes PTY and watcher behavior, compares exact outputs, and uploads unpublished evidence.

• Downloaded Windows read-back identities:

  • win32-x64: compatibility kind: "windows", content ID sha256:4224aee6de820a94263f05ebfc58edd421921431e8cbdf1d5ec6ddcf783afc26, archive orca-ssh-relay-runtime-v1-win32-x64-4224aee6de820a94263f05ebfc58edd421921431e8cbdf1d5ec6ddcf783afc26.zip, 37,168,778 bytes, archive SHA-256 sha256:473aff5d97d08b0a1deaa5a74940975eb44ab303f88fc2a94d8b9b2f3d594e7b;
  • win32-arm64: compatibility kind: "windows", content ID sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, archive orca-ssh-relay-runtime-v1-win32-arm64-02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db.zip, 33,204,738 bytes, archive SHA-256 sha256:5f5ffc89d3a1a4fee50ad641c0c9abd063a113269851936eb30b01ab1527fdcd.

• Concurrent regression: Linux supplemental userland jobs 87281853967 and 87281853918 pass, as does Windows x64 oldest-floor job 87281706480. Artifact-run conclusion is the expected failure only because Windows arm64 floor job 87281706438 observes build 26200 rather than required build 26100; before failing that exact-floor gate, complete runtime execution settles in 8,382.8952 ms, its smoke stage reports 6,055.8004 ms and 49,811,456-byte RSS, and post-observation resources contain only the expected parent PipeWraps. PR Checks run 29393022761 job 87280377607 and both Golden E2E jobs 87280377578/87280377611 in run 29393022784 are green at the same head.

• Oracle proved: the corrected Windows compatibility discriminator and bin/node.exe layout are accepted consistently by the build and desktop contracts; both Windows architectures regenerate stable, internally consistent identities/archive names; and no POSIX or Windows native artifact regression appears in the all-six build/equality/smoke gates.

• Does not prove: Windows arm64 build 26100, macOS 13.5, Linux kernel 4.18, real native signing/trust, canonical manifest assembly/signing, publication, desktop embedding, SSH transfer/install, fallback, performance, or an enabled tuple.

• Worktree visibility residual: orca status --json reports app not running and runtime state stale_bootstrap; the required best-effort orca worktree set --worktree active --comment ... --json retry fails with runtime_unavailable. This does not affect repository or CI evidence.

• Follow-up: begin RED tests for credential-free canonical unsigned-manifest assembly, bounded signing request, and returned-signature verification. Keep final detached-signature asset encoding, production credentials, publication, desktop consumers, and tuple enablement disconnected.

E-M4-MANIFEST-HANDOFF-LOCAL-RED-001 — Release-side assembly and signing handoff are absent

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact base 63899c182f3a831d61fb1f6566a0d0318bca4192 plus uncommitted purpose-named tests; draft PR #8741.

• Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no network, runner, signing credential, release, publication, desktop consumer, SSH host, or production call.

• Command:

  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-manifest-assembly.test.mjs \
    config/scripts/ssh-relay-runtime-manifest-signing-handoff.test.mjs
  

• Result: expected RED. Both suites fail before collecting tests because ssh-relay-runtime-manifest-assembly.mjs is absent; the signing-handoff suite also depends on that boundary. Vitest reports 2 failed files in 264 ms; /usr/bin/time -l records 1.12 seconds wall, 131,710,976-byte maximum RSS, zero swaps, and 95,835,440-byte peak memory footprint.

• Oracle proved: the existing desktop canonical/signature contract has no release-side module that assembles and re-parses the exact canonical unsigned bytes, bounds the credential-free signing request, or verifies the returned key ID/signature before final-manifest emission.

• Does not prove: implementation correctness, byte parity, Ed25519 return verification, native runner behavior, production credentials, publication, desktop embedding, SSH behavior, or an enabled tuple.

• Follow-up: implement only the two disconnected release-side boundaries and retain every production/default behavior and final detached-signature asset-encoding decision unchanged.

E-M4-MANIFEST-HANDOFF-LOCAL-001 — Disconnected canonical assembly and signature return verify locally

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact base 63899c182f3a831d61fb1f6566a0d0318bca4192 plus the uncommitted manifest validation, assembly, signing-handoff, test, and static workflow wiring changes; draft PR #8741.

• Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no network, runner, signing credential, release, publication, desktop consumer, SSH host, or production call.

• Command:

  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 \
    config/scripts/ssh-relay-runtime-manifest-assembly.test.mjs \
    config/scripts/ssh-relay-runtime-manifest-signing-handoff.test.mjs
  

• Result: GREEN. Vitest reports 2 files / 11 tests passed in 1.35 seconds; /usr/bin/time -l records 15.14 seconds wall, 188,792,832-byte maximum RSS, zero swaps, and 96,490,920-byte peak memory footprint.

• Oracle proved: validated tuple projections produce byte-identical canonical unsigned bytes to the desktop contract; signing requests bind exact bytes, size, SHA-256, and ed25519-v1; returned key IDs and signatures are allowlisted, deduplicated, cryptographically verified, deterministically ordered, and revalidated through the desktop signed-manifest verifier before final emission.

• Does not prove: the broader SSH-relay suite, typecheck/lint/formatting gates, native runner parity, production credentials, final detached-signature asset encoding, publication, desktop embedding, SSH behavior, or an enabled tuple.

• Follow-up: run broader local gates, then exact-head all-six native CI; keep every production and rollout boundary disconnected.

E-M4-MANIFEST-HANDOFF-LOCAL-002 — Broad local manifest-handoff regressions and static gates

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact base 63899c182f3a831d61fb1f6566a0d0318bca4192 plus the uncommitted manifest validation, assembly, signing-handoff, test, workflow, and checklist changes; draft PR #8741.
• Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no network, signing credential, release, publication, desktop consumer, SSH host, or production call. The repository's Node 24 requirement is intentionally deferred to the exact native CI jobs rather than inferred from this Node 26 run.
• Commands and results:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — GREEN, 38 files / 214 tests in 8.97 seconds; 10.13 seconds wall, 188,219,392-byte maximum RSS, zero swaps, and 95,589,680-byte peak memory footprint.
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — GREEN, 3 files / 47 tests in 1.34 seconds; 2.40 seconds wall, 131,973,120-byte maximum RSS, zero swaps, and 96,081,200-byte peak memory footprint.
  • node --check for the validation, assembly, assembly-test, signing-handoff, and signing-handoff-test modules — GREEN with no output.
  • Focused pnpm exec oxlint for all six touched script/test files — GREEN with no findings.
  • Focused pnpm exec oxfmt --check for all nine touched code/workflow/checklist files — GREEN in 1,023 ms.
  • /usr/bin/time -l pnpm run typecheck — GREEN in 9.44 seconds wall with 1,182,597,120-byte maximum RSS and zero swaps.
  • pnpm run lint — GREEN in 26.12 seconds wall. Full oxlint, switch exhaustiveness, styled scrollbars, 41 reliability gates, 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass. The 26 printed warnings are in untouched existing files; none is introduced by this package.
  • pnpm run check:max-lines-ratchet — GREEN, 355 grandfathered suppressions and no new bypasses.
  • git diff --check — GREEN with no output.
  • Structural bound audit — a maximum 240-byte file projection is 407 bytes and native attestation projection is 334 bytes; 8 * 5,000 * (407 + 334) = 29,640,000, leaving 3,914,432 bytes beneath the 32 MiB canonical/signing ceiling for tuple and build envelopes.
• Oracle proved: the disconnected handoff preserves all existing release-side SSH-relay contracts, emits bytes accepted by the desktop schema/signature implementation, stays syntactically and statically valid, introduces no formatting/max-lines regression, and has a bounded ceiling consistent with the declared eight-tuple/5,000-entry schema.
• Does not prove: Node 24/native-runner behavior, target-native build non-regression, production credentials, final detached-signature asset encoding, publication, desktop embedding, SSH transfer/install behavior, or an enabled tuple.
• Follow-up: commit and push the exact locally verified package, then record the all-six native jobs, PR Checks, and Golden E2E at that exact head.

E-M4-MANIFEST-HANDOFF-CI-001 — Canonical handoff passes all six Node 24 native jobs

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact commit 14355dfe0583f634a6e86ada9e1afcf7abe7a8fb; draft PR #8741.

• Runs:

  • SSH Relay Runtime Artifacts 29395319239 — overall expected RED only for the separately declared Windows arm64 build-floor mismatch.
  • PR Checks 29395319119 — GREEN in 14 minutes 22 seconds, including lint, reliability/max-lines, typecheck, Git 2.25 matrix, full tests, unpacked app build, and packaged CLI smoke.
  • Golden E2E 29395319242 — GREEN on macOS and Linux.

• Native build/test cells, all GitHub-hosted at the exact source commit with Node v24.18.0:

  Tuple	Requested / resolved image	Arch	Contract suite	Build job / duration
  linux-x64-glibc	ubuntu-24.04 / ubuntu24 20260705.232.1	X64	37 files / 210 tests, 4.18 s	87287406149 / 3m50s
  linux-arm64-glibc	ubuntu-24.04-arm / ubuntu24-arm64 20260706.52.2	ARM64	37 files / 210 tests, 3.80 s	87287406182 / 5m03s
  darwin-x64	macos-15-intel / macos15 20260629.0276.1	X64	37 files / 210 tests, 16.01 s	87287406168 / 5m20s
  darwin-arm64	macos-15 / macos15 20260706.0213.1	ARM64	37 files / 210 tests, 4.65 s	87287406210 / 2m31s
  win32-x64	windows-2022 / win22 20260706.237.1	X64	38 files / 206 passed + 8 platform-skipped, 9.07 s	87287406172 / 5m23s
  win32-arm64	windows-11-arm / win11-arm64 20260706.102.1	ARM64	38 files / 206 passed + 8 platform-skipped, 8.78 s	87287406175 / 8m48s

• Direct new-suite oracle: every native job syntax-checks both new test modules and passes manifest assembly 5/5 plus signing handoff 6/6. Per-job combined new-suite test times are Linux x64 136/254 ms, Linux arm64 91/193 ms, macOS x64 262/523 ms, macOS arm64 43/90 ms, Windows x64 148/295 ms, and Windows arm64 96/179 ms.

• Supplemental/result details:

  • Linux x64 and arm64 digest-pinned Rocky 8 userland jobs pass exact downloaded-byte verification, runtime smoke, glibc 2.28, libstdc++ 6.0.25, and GLIBCXX 3.4.25; kernel 4.18 remains open because the container shares the hosted kernel.
  • Windows Server 2022 x64 build 20348 passes its declared floor and full runtime execution.
  • Windows arm64 verifies 60 archive entries / 42 files / 85,213,511 expanded bytes and content ID sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, then completes Node, ConPTY, watcher, and resource-settlement smoke in 5,818.68 ms with 49,385,472-byte RSS and 7,741.5065 ms total verification. Its floor job then fails exactly because observed Windows build 26200 does not equal required build 26100; platform and ARM64 checks pass.

• Oracle proved: the release-side validator, canonical byte projection, bounded request, signer-return verification, deterministic final manifest, and workflow wiring execute under the repository's exact Node version on Linux, macOS, and Windows x64/arm64 without regressing target-native build, smoke, equality, artifact upload, PR, or Golden E2E behavior.

• Does not prove: the missing Windows arm64 26100 snapshot, kernel 4.18, macOS 13.5, real Apple or SignPath returns, protected manifest credentials/approval, final aggregate publication, desktop embedding, SSH transfer/install, or an enabled tuple.

• Follow-up: begin RED tests for the credential-free fail-closed aggregate boundary; retain all production/default and credential gates.

E-M4-MANIFEST-AGGREGATE-LOCAL-RED-001 — Fail-closed manifest aggregate is absent

• Date: 2026-07-15

• Commit SHA / PR: uncommitted purpose-named RED test atop 127ddbcc154fbdf2641bc80d67a3d68d862ab1ca; draft PR #8741

• Runner: macOS 26.2 arm64, native local worktree; repository Node/pnpm toolchain

• Remote: not applicable; disconnected credential-free release boundary

• Transport/network: local filesystem only; no network, GitHub release, signer, or credential

• Exact command:

  pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs
  

• Result: FAIL as required; one suite failed before collection because ssh-relay-runtime-manifest-aggregate.mjs does not exist, with zero tests collected.

• Duration and resource metrics: Vitest duration 210 ms; memory and file-descriptor deltas not measured for this expected import failure.

• Artifact/log/trace link: local terminal output; no external artifact.

• Oracle proved: the purpose-named contract cannot pass through an existing permissive or accidental aggregate implementation; the credential-free boundary is genuinely absent before this package.

• Does not prove: input-byte validation, descriptor binding, deterministic assembly, signing-return verification, publication, credentials, desktop embedding, native trust, or any enabled tuple.

• Checklist items satisfied: RED prerequisite for the active Work Package 3 aggregate boundary.

• Follow-up: implement the disconnected boundary, turn this exact suite green, then run broad local and all-six native regression gates without connecting publication or consumers.

E-M4-MANIFEST-AGGREGATE-LOCAL-001 — Exact-file aggregate and signing boundary pass locally

• Date: 2026-07-15

• Commit SHA / PR: 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741

• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable; disconnected credential-free release boundary

• Transport/network: local filesystem only; no network, GitHub release, signer service, credential, SSH connection, or publication

• Exact command:

  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs config/scripts/ssh-relay-runtime-aggregate-input.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs
  

• Result: PASS; 3 files / 20 tests, including 6 purpose-named aggregate tests, 8 aggregate-input tests, and 6 workflow-source tests.

• Duration and resource metrics: Vitest 482 ms; 1.04 seconds wall; 132,956,160-byte maximum RSS; 96,146,832-byte peak memory footprint; zero swaps.

• Artifact/log/trace link: local terminal output; no external artifact.

• Oracle proved: at most eight tuple declarations select one exact regular-file set containing a bounded descriptor, archive, SBOM, and provenance per tuple; missing, extra, linked, mutated, oversized, duplicate, unsupported, or cancelled inputs fail before assembly. Only the hashed descriptor supplies the complete post-sign tuple/native-attestation projection. Descriptor and declared asset drift fail, tuple order is deterministic, the 15-minute boundary is cancellable, finalization reassembles the canonical request, invalid signer returns fail, and the resulting manifest passes the desktop verifier. POSIX and Windows workflow source includes syntax and test execution for the new module.

• Does not prove: repository Node 24 behavior, a descriptor emitted by a real post-sign native job, Apple/SignPath trust, protected signing credentials, final detached-signature asset encoding, release publication/read-back, desktop embedding, SSH transfer/install, or an enabled tuple.

• Checklist items satisfied: local implementation gate for the active Work Package 3 credential-free aggregate boundary.

• Follow-up: run broad local gates, then commit/push and collect all-six exact-head Node 24 CI.

E-M4-MANIFEST-AGGREGATE-LOCAL-002 — Broad aggregate regressions and static gates pass

• Date: 2026-07-15
• Commit SHA / PR: 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable
• Transport/network: local filesystem only; no network, credential, release, SSH host, publication, desktop consumer, or production/default call
• Commands and results:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 39 files / 221 tests in 5.70 seconds; 6.49 seconds wall; 187,924,480-byte maximum RSS; 96,081,176-byte peak memory footprint; zero swaps.
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 47 tests in 485 ms; 1.19 seconds wall; 172,572,672-byte maximum RSS; 95,819,128-byte peak memory footprint; zero swaps.
  • node --check for the aggregate-input, manifest-aggregate, their tests, and workflow-source test — PASS with no output.
  • Focused pnpm exec oxlint for all five touched script/test files — PASS with no findings.
  • Focused pnpm exec oxfmt --check for the touched code, workflow, and both checklist files — PASS in 1,451 ms.
  • /usr/bin/time -l pnpm run typecheck — PASS in 2.62 seconds wall with 1,266,810,880-byte maximum RSS and zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS in 8.64 seconds wall with 2,023,014,400-byte maximum RSS and zero swaps. All 41 reliability gates, 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass; all 26 warnings are in untouched existing files.
  • pnpm run check:max-lines-ratchet — PASS, 355 grandfathered suppressions and no new bypasses.
  • git diff --check — PASS with no output.
• Supplemental command correction: an initial quoted-glob invocation treated config/scripts/ssh-relay*.test.mjs as a literal filter and correctly returned “No test files found”; the exact unquoted checklist command above immediately replaced it and is the recorded executable result.
• Oracle proved: the new boundary preserves every release-side SSH-relay contract, desktop schema and signature parity, repository type/static/reliability/localization gates, formatting, and file line budgets without adding a bypass. No existing Node/npm resolver file was touched.
• Does not prove: Node 24/native-runner execution, real post-sign tuple outputs, production signing, publication, desktop embedding, SSH behavior, native trust, exact oldest baselines, or any enabled tuple.
• Checklist items satisfied: broad local regression/static gate for the active Work Package 3 package.
• Follow-up: collect and record all-six native CI at that exact head.

E-M4-MANIFEST-AGGREGATE-CI-001 — Exact-file aggregate passes all six native Node 24 jobs

• Date: 2026-07-15
• Commit SHA / PR: 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741
• Workflow and source: exact-head SSH Relay Runtime Artifacts run 29397871159, checked out from the PR head rather than GitHub's synthetic merge; Node v24.18.0
• Native runners and results:
  • macOS arm64: macos15 image 20260706.0213.1, job 87295382518, PASS in 2m55s; aggregate suite 6/6 in 119 ms.
  • Windows x64: win22 image 20260706.237.1, job 87295382522, PASS in 5m00s; aggregate suite 6/6 in 342 ms.
  • macOS x64: macos15 image 20260629.0276.1, job 87295382539, PASS in 5m17s; aggregate suite 6/6 in 675 ms.
  • Linux x64: ubuntu24 image 20260705.232.1, job 87295382567, PASS in 4m22s; aggregate suite 6/6 in 257 ms.
  • Windows arm64: win11-arm64 image 20260706.102.1, job 87295382578, PASS in 9m46s; aggregate suite 6/6 in 553 ms.
  • Linux arm64: ubuntu24-arm64 image 20260714.61.1, job 87295382626, PASS in 5m21s; aggregate suite 6/6 in 188 ms.
• Exact workflow command: the POSIX and Windows native jobs run node --check for the aggregate module and suite, then include config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs in the purpose-named Vitest artifact contract command. POSIX jobs report 38 files / 217 passed; Windows jobs report 39 files / 213 passed plus 8 explicitly platform-skipped tests.
• Supplemental exact-head results:
  • Rocky 8 oldest-userland jobs pass on Linux x64 87296348785 in 35s and Linux arm64 87296348786 in 58s.
  • Windows x64 oldest-floor job 87297136187 passes. Content ID is sha256:4224aee6de820a94263f05ebfc58edd421921431e8cbdf1d5ec6ddcf783afc26; smoke is 8,788.4616 ms, RSS is 49,508,352 bytes, and total verification is 9,909.3156 ms.
  • Windows arm64 oldest-floor job 87297136099 fails only the declared OS-build oracle because the hosted image is build 26200 rather than required build 26100. Before that rejection, the runtime passes platform/architecture and full smoke with 60 entries, 42 files, 85,213,511 expanded bytes, content ID sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, 5,835.1398 ms smoke, 49,713,152-byte RSS, and 7,680.2139 ms total verification.
• Broad exact-head regressions: PR Checks 29397871156 job 87295381961 passes; Golden E2E 29397871176 passes on macOS job 87295382080 and Linux job 87295382148.
• Oracle proved: syntax and the complete exact-file aggregate contract execute under repository Node 24 on every native target family without regressing native runtime construction, smoke, artifact upload, PR verification, or Golden E2E. The expected overall artifact-workflow failure is solely the pre-existing Windows arm64 exact-floor gap and occurs after the native arm64 aggregate and runtime jobs succeed.
• Does not prove: a descriptor produced from real signed returned bytes, Apple/SignPath signing, native trust, protected manifest signing, detached-signature encoding, publication/read-back, desktop embedding, SSH transfer/install, or any enabled tuple.
• Checklist items satisfied: all-six exact-head CI gate for the disconnected credential-free aggregate boundary. Broader Work Package 3 and Milestone 4 boxes remain open.
• Follow-up: add the credential-free post-sign tuple-descriptor producer/native-verification handoff under a purpose-named RED before wiring any signing credential, publication, or desktop consumer.

E-M4-MANIFEST-TUPLE-LOCAL-RED-001 — Post-sign tuple producer is absent

• Date: 2026-07-15

• Commit SHA / PR: uncommitted purpose-named test atop 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741

• Runner: macOS 26.2 arm64, native local worktree; repository Node/pnpm toolchain

• Remote: not applicable; disconnected credential-free release boundary

• Transport/network: local filesystem only; no network, signer, credential, release, SSH host, publication, desktop consumer, or production/default call

• Exact command:

  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs
  

• Result: FAIL as required; one suite failed before collection because ssh-relay-runtime-manifest-tuple.mjs does not exist, with zero tests collected.

• Duration and resource metrics: Vitest 179 ms; 1.27 seconds wall; 132,268,032-byte maximum RSS; 96,425,312-byte peak memory footprint; zero swaps.

• Artifact/log/trace link: local terminal output; no external artifact.

• Oracle proved: the complete post-sign tree/archive/native-report to aggregate-descriptor contract cannot pass through an existing permissive or accidental implementation; the producer is genuinely absent before this package.

• Does not prove: any producer behavior, metadata semantics, real signed bytes, native trust, publication, desktop embedding, SSH transfer/install, or an enabled tuple.

• Checklist items satisfied: RED prerequisite for the active Work Package 3 post-sign tuple package.

• Follow-up: implement the disconnected credential-free producer, turn the exact six-case suite green, then run focused aggregate and broad release/static regressions before requesting native CI.

E-M4-MANIFEST-TUPLE-SCHEMA-RED-001 — Real Windows closure exposes stale manifest cardinality

• Date: 2026-07-15

• Commit SHA / PR: uncommitted implementation atop 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741

• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable; disconnected credential-free release boundary

• Transport/network: local filesystem and generated Windows ZIP only; no network, signer, credential, release, SSH host, publication, desktop consumer, or production/default call

• Exact command:

  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs
  

• Result: expected evidence-gate failure; 5 tests pass and the complete real-closure case fails with SSH relay runtime manifest requires one valid node-pty-native entry. The fixture contains the exact proven Windows x64 closure, including both conpty.node and conpty_console_list.node plus the two ConPTY runtime files.

• Duration and resource metrics: Vitest 504 ms total with 265 ms test time; 1.24 seconds wall; 137,576,448-byte maximum RSS; 95,933,816-byte peak memory footprint; zero swaps.

• Root cause: release-side assertTupleEntries and desktop-side assertRequiredRuntimeEntries use a platform-agnostic exactly-one rule for node-pty-native. That rule accepts the simplified Windows test conversion but cannot accept the target-native artifact closure already proven in Work Package 2. Neither validator also enforces exact tuple-specific native-runtime counts.

• Plan correction: the HTML plan now states the exact cardinality contract: Linux has one node-pty-native and zero native-runtime files; macOS has one and one; Windows has two and two. Both release and desktop validators must enforce the same role counts, and tests must use the real Windows closure rather than a path-renamed Linux fixture.

• Does not prove: the correction, producer GREEN, native runner behavior, real signed bytes, native trust, publication, desktop embedding, SSH transfer/install, or any enabled tuple.

• Checklist items satisfied: evidence-backed design correction prerequisite for the active package.

• Follow-up: add paired release/desktop RED-to-GREEN tests for exact role counts, make the narrow validator correction, rerun the post-sign producer suite, and preserve all non-production gates.

E-M4-MANIFEST-TUPLE-LOCAL-001 — Post-sign descriptor and exact role parity pass locally

• Date: 2026-07-15

• Commit SHA / PR: uncommitted package atop 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741

• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0

• Remote: not applicable; disconnected credential-free release boundary

• Transport/network: local filesystem and generated Windows ZIP only; no network, signer, credential, release, SSH host, publication, desktop consumer, or production/default call

• Exact command:

  /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs config/scripts/ssh-relay-runtime-manifest-aggregate.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs src/main/ssh/ssh-relay-artifact-schema.test.ts
  

• Result: PASS; 4 files / 50 tests: 7 post-sign tuple cases, 6 aggregate cases, 6 workflow-source cases, and 31 desktop manifest-schema cases.

• Duration and resource metrics: Vitest 989 ms with 377 ms test time; 1.68 seconds wall; 132,825,088-byte maximum RSS; 96,048,576-byte peak memory footprint; zero swaps.

• Oracle proved:

  • the final runtime and aggregate-input roots must be real, physically disjoint directories;
  • the complete final tree is content-ID verified before and after bounded archive inspection;
  • Windows reports cover exact authenticated Node, both node-pty native modules, and both ConPTY runtime files with required signer evidence; Linux and macOS reports derive their own exact policies and three/four-file native closures;
  • stale content IDs, source identity drift, missing/duplicate/mismatched native reports, malformed tool/time data, runtime/archive mutation, extra/existing/linked inputs, oversized metadata, and cancellation fail before a usable descriptor remains;
  • stable bounded archive/SBOM/provenance bytes are hashed, the manifest tuple passes the same release schema used by aggregation, one exclusive descriptor is written, and the exact closed four-file set is rehashed before return;
  • release and desktop validators accept the exact target-native Windows closure and reject missing or extra node-pty/native-runtime members with matching tuple-specific rules;
  • POSIX and Windows workflow source syntax-check and execute the new suite under the existing credential-free native jobs.

• Does not prove: Node 24/native-runner execution, semantic regeneration or validation of post-sign SBOM/provenance content, a report from real Apple/SignPath returned bytes, native trust, protected signing, publication/read-back, desktop embedding, SSH transfer/install, or any enabled tuple.

• Checklist items satisfied: local functional/schema/workflow gate for the active Work Package 3 post-sign tuple package.

• Follow-up: run broad release, desktop parity, and repository static gates, then require all-six exact-head Node 24 CI before closing the package.

E-M4-MANIFEST-TUPLE-LOCAL-002 — Broad post-sign tuple regressions and static gates pass

• Date: 2026-07-15
• Commit SHA / PR: same uncommitted package atop 5e0c776d017b3cf4d57011cb1f4cdc919bbc8782; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable
• Transport/network: local filesystem only; no signer, credential, release, SSH host, publication, desktop consumer, or production/default call
• Commands and results:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 40 files / 228 tests in 8.25 seconds; 9.15 seconds wall; 188,055,552-byte maximum RSS; 96,474,536-byte peak memory footprint; zero swaps.
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 528 ms; 1.19 seconds wall; 172,195,840-byte maximum RSS; 96,245,160-byte peak memory footprint; zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS in 8.46 seconds wall with 1,181,024,256-byte maximum RSS and zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS in 18.95 seconds wall with 2,071,773,184-byte maximum RSS and zero swaps. All 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass; all 26 warnings are in untouched existing files.
  • Focused node --check for manifest validation, tuple source/test, and workflow test — PASS.
  • Focused pnpm exec oxfmt --check for all ten touched code/workflow/plan files — PASS.
  • pnpm run check:max-lines-ratchet — PASS, 355 grandfathered suppressions and no new bypasses.
  • git diff --check — PASS with no output.
• Oracle proved: the post-sign producer and evidence-backed schema correction preserve every release-side SSH-relay contract, desktop signature/asset parity, repository type/static/reliability gates, localization, formatting, and file line budgets without a bypass. The user-owned Node/npm resolver files are untouched.
• Does not prove: repository Node 24 or native-runner execution, real post-sign metadata/signatures, oldest baselines, native trust, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: broad local regression/static gate for the active package.
• Follow-up: commit and push the authorized PR-contained package, then require all six exact-head Node 24 native jobs before marking this package complete. Keep every production/default gate unchanged and do not merge to main.

E-M4-MANIFEST-TUPLE-CI-001 — Post-sign tuple producer passes all six native Node 24 jobs

• Date: 2026-07-15
• Commit SHA / PR: cfea521c7c5f63a22c9895ac58931bc75577bb00; draft PR #8741
• Workflow and source: exact-head SSH Relay Runtime Artifacts run 29405619251, checked out from the PR head rather than GitHub's synthetic merge; Node v24.18.0
• Native runners and results:
  • Linux x64: ubuntu24 image 20260705.232.1, job 87320220032, PASS in 3m55s; tuple suite 7/7 in 983 ms; artifact contracts 39 files / 224 tests in 5.53s.
  • Linux arm64: ubuntu24-arm64 image 20260714.61.1, job 87320220059, PASS in 5m12s; tuple suite 7/7 in 790 ms; artifact contracts 39 files / 224 tests in 4.18s.
  • macOS x64: macos15 image 20260629.0276.1, job 87320220060, PASS in 7m33s; tuple suite 7/7 in 4,779 ms; artifact contracts 39 files / 224 tests in 28.49s.
  • macOS arm64: macos15 image 20260706.0213.1, job 87320220121, PASS in 4m28s; tuple suite 7/7 in 611 ms; artifact contracts 39 files / 224 tests in 6.44s.
  • Windows x64: win22 image 20260706.237.1, job 87320220042, PASS in 5m21s; tuple suite 6 passed / 1 POSIX-only symlink case skipped in 2,789 ms; artifact contracts 40 files / 219 passed / 9 platform-skipped in 10.24s.
  • Windows arm64: win11-arm64 image 20260706.102.1, job 87320220035, PASS in 10m08s; tuple suite 6 passed / 1 POSIX-only symlink case skipped in 3,664 ms; artifact contracts 40 files / 219 passed / 9 platform-skipped in 11.38s.
• Exact workflow command: both POSIX and Windows native paths syntax-check the tuple producer and suite, then include config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs in the purpose-named Vitest artifact-contract command before building, inspecting, smoking, exact-comparing, and uploading unpublished runtime evidence.
• Supplemental exact-head results:
  • Linux x64 oldest-userland job 87321748114 and Linux arm64 job 87321748173 pass.
  • Windows x64 oldest-floor job 87322254816 passes on build 20348; smoke is 5,368.9343 ms, RSS is 49,872,896 bytes, and total verification is 6,606.8635 ms.
  • Windows arm64 oldest-floor job 87322254810 fails only the declared OS-build oracle because hosted image win11-arm64 is build 26200 instead of the required 26100. Before that rejection, content ID sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db passes full smoke in 6,054.4899 ms with 49,721,344-byte RSS and 8,402.627 ms total verification.
• Broad exact-head regressions: PR Checks 29405619196 job 87320219351 passes; Golden E2E 29405619242 passes on Linux job 87320219767 and macOS job 87320219784.
• Oracle proved: syntax and the complete credential-free descriptor/native-verification contract run under repository Node 24 on all six native target families without regressing runtime construction, exact clean-build equality, bundled Node, PTY/watcher smoke, unpublished artifact upload, PR verification, or Golden E2E. The expected workflow failure is solely the pre-existing Windows arm64 exact-floor gap after its native build and tuple suite pass.
• Does not prove: semantic regeneration or validation of post-sign SBOM/provenance, a report from real Apple/SignPath returned bytes, native trust, protected signing, publication/read-back, desktop embedding, SSH transfer/install, or any enabled tuple.
• Checklist items satisfied: all-six exact-head CI gate for the credential-free post-sign tuple producer and release/desktop exact-role parity. Broader Work Package 3 and Milestone 4 remain open.
• Follow-up: regenerate and semantically verify SBOM/provenance from the verified final runtime tree before connecting signing credentials, publication, or a desktop consumer.

E-M4-POST-SIGN-METADATA-LOCAL-RED-001 — Post-sign metadata boundary is absent

• Date: 2026-07-15
• Commit SHA / PR: uncommitted purpose-named test atop cfea521c7c5f63a22c9895ac58931bc75577bb00; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; repository Node/pnpm toolchain
• Remote: not applicable; disconnected credential-free release boundary
• Transport/network: local filesystem only; no signer, credential, release, SSH host, publication, desktop consumer, or production/default call
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs
• Result: expected FAIL in 728 ms; one suite fails before collection because ./ssh-relay-runtime-post-sign-metadata.mjs does not exist.
• Oracle proved: the purpose-named writer/verifier for regenerating SBOM/provenance from the verified final runtime tree and rejecting stale semantic bindings is absent; the test cannot pass through the existing pre-sign metadata writer or tuple producer.
• Does not prove: implementation behavior, metadata semantics, Node 24/native-runner execution, native trust, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: RED prerequisite for the active semantic post-sign metadata package.
• Follow-up: implement the disconnected boundary, integrate its semantic verifier before tuple descriptor assembly, then run focused and broad regressions before exact-head native CI.

E-M4-POST-SIGN-METADATA-LOCAL-001 — Final-tree metadata regeneration and semantic gate pass

• Date: 2026-07-15
• Commit SHA / PR: uncommitted package atop cfea521c7c5f63a22c9895ac58931bc75577bb00; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; disconnected credential-free release boundary
• Transport/network: local filesystem and generated runtime archives only; no signer, credential, release, SSH host, publication, desktop consumer, or production/default call
• Commands and results:
  • Purpose-named post-sign metadata, provenance, SBOM, tuple-consumer, and workflow suite: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs config/scripts/ssh-relay-runtime-provenance.test.mjs config/scripts/ssh-relay-runtime-sbom.test.mjs config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 5 files / 22 tests. Repeated focused confirmation after strict provenance validation passes 3 files / 18 tests in 10.11 seconds test duration.
  • node --check for the post-sign metadata module and suite — PASS.
• Oracle proved:
  • one exclusive archive input and physically disjoint verified final tree produce only bounded, exclusive SBOM and provenance assets; cancellation, extra input, tree mutation, and archive mutation fail without leaving partial metadata;
  • the SBOM is exactly reconstructed from the final identity and archive, including every file, package owner, checksum, final content ID, and immutable archive-derived namespace;
  • SLSA provenance binds the exact archive, tuple, Node version, final content ID, source epoch, complete final native-file hashes, builder, runner, resolved dependencies, and exact validated toolchain shape;
  • stale SBOM content/file/archive data and stale provenance archive/content/native data fail before tuple descriptor creation; the final tree and archive are reverified after metadata emission.
• Does not prove: Node 24/native-runner execution, a real Apple/SignPath returned tree, native trust, protected signing, publication/read-back, desktop embedding, SSH transfer/install, or an enabled tuple.
• Checklist items satisfied: local functional/semantic/workflow gate for the active post-sign metadata package.
• Follow-up: run broad release, desktop parity, and repository static gates, then require all-six exact-head Node 24 CI.

E-M4-POST-SIGN-METADATA-LOCAL-002 — Broad post-sign metadata regressions and static gates pass

• Date: 2026-07-15
• Commit SHA / PR: same uncommitted package atop cfea521c7c5f63a22c9895ac58931bc75577bb00; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Commands and results:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 41 files / 233 tests; final observed 80.39-second Vitest duration / 86.12-second wall, 188,612,608-byte maximum RSS, 96,228,800-byte peak memory footprint, and zero swaps. An earlier identical pass completed in 16.57 seconds / 19.66 seconds wall; the final run and lint were heavily CPU-starved locally, so exact-head native CI is the timing oracle for this artifact-only suite.
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests; 131,694,592-byte maximum RSS and zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS with 1,259,520,000-byte maximum RSS and zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS; 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass. All 26 warnings are in untouched existing files. The final run took 293.54 seconds wall with only 70.17 seconds user CPU and 701,821 involuntary context switches, confirming severe local scheduling contention rather than a product-path latency measurement.
  • Focused pnpm exec oxfmt --check for all eight code/workflow files — PASS.
  • git diff --check — PASS with no output; both user-owned Node/npm resolver files have zero diff.
• Oracle proved: the post-sign metadata boundary and tuple semantic gate preserve all release-side SSH-relay contracts, desktop schema/signature parity, repository type/static/reliability gates, localization, formatting, and file line budgets without a bypass.
• Does not prove: repository Node 24/native-runner execution, real post-sign signatures/native trust, publication, desktop embedding, SSH behavior, or an enabled tuple. Local wall time is not a production latency baseline.
• Checklist items satisfied: broad local regression/static gate for the active package.
• Follow-up: commit and push, then require all six exact-head Node 24 native jobs before marking this package complete. Keep every production/default gate unchanged and do not merge to main.

E-M4-POST-SIGN-METADATA-CI-RED-001 — Windows rejects host-incompatible Linux tar fixture

• Date: 2026-07-15
• Commit SHA / PR: 1989e801af4a922a646d62ffd13e235615462975; draft PR #8741
• Workflow/run: SSH relay runtime artifacts run 29408355188, Windows x64 job 87329210635
• Runner: GitHub-hosted windows-2022 x64 image 20260706.237.1, runner GitHub Actions 1000055651; Node 24 workflow toolchain
• Remote: not applicable; disconnected credential-free artifact construction and tests
• Transport/network: GitHub dependency/source downloads used by the artifact workflow; no signer, SSH host, publication, desktop consumer, production/default call, or enabled tuple
• Command: native job's release-side contract suite, pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs
• Result: expected evidence-gating FAIL; 40 files passed and 1 failed, 222 tests passed, 2 failed, and 9 skipped in 11.23 seconds. Both failures are in the post-sign metadata suite: “regenerates exact SBOM and provenance from the verified final tree” and “makes tuple consumers reject stale SBOM and provenance bindings.” Strict archive inspection reports Runtime archive type or mode mismatch: bin/node.
• Oracle proved: the new test fixture hardcodes a linux-x64-glibc tar identity but creates its executable through the Windows filesystem, where writeFile(..., { mode: 0o755 }) cannot supply POSIX executable mode bits. The production archive inspector fails closed on the mismatch as designed; this is not evidence to weaken archive type/mode validation.
• Does not prove: corrected cross-platform fixture behavior, all-six exact-head pass, real post-sign signatures/native trust, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: required exact-head CI RED and root-cause evidence for the active correction; the semantic post-sign metadata package remains open.
• Follow-up: make the fixture select a platform-native tuple/archive/closure, rerun focused and broad local gates, push the correction, and replace the exact-head all-six native evidence.

E-M4-POST-SIGN-METADATA-CORRECTION-LOCAL-001 — Platform-native metadata fixture passes locally

• Date: 2026-07-15
• Commit SHA / PR: uncommitted correction atop 1989e801af4a922a646d62ffd13e235615462975; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; disconnected credential-free artifact contract tests
• Transport/network: local filesystem and generated Darwin tar archives only; no signer, SSH host, publication, desktop consumer, production/default call, or enabled tuple
• Commands and results:
  • Purpose-named correction: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs — PASS, 1 file / 4 tests in 2.67 seconds test duration / 5.84 seconds wall; 132,399,104-byte maximum RSS, 96,589,128-byte peak memory footprint, and zero swaps.
  • Semantic post-sign focused suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-post-sign-metadata.test.mjs config/scripts/ssh-relay-runtime-provenance.test.mjs config/scripts/ssh-relay-runtime-sbom.test.mjs config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 5 files / 22 tests in 12.70 seconds test duration / 18.96 seconds wall; 134,725,632-byte maximum RSS, 96,310,600-byte peak memory footprint, and zero swaps.
  • Broad release suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 41 files / 233 tests in 35.93 seconds test duration / 39.61 seconds wall; 189,087,744-byte maximum RSS, 96,998,824-byte peak memory footprint, and zero swaps.
  • Desktop schema/signature parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 2.02 seconds test duration / 3.70 seconds wall; 132,562,944-byte maximum RSS, 96,343,440-byte peak memory footprint, and zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS in 6.53 seconds wall with 1,215,283,200-byte maximum RSS and zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS in 63.09 seconds wall with the 41 reliability gates, 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage green. All 26 warnings are in untouched existing files.
  • Focused pnpm exec oxfmt --check, node --check, git diff --check, and zero diff in both user-owned Node/npm resolver files — PASS.
• Oracle proved: the fixture now selects the exact native tuple, runtime closure, archive family, immutable Node release inputs, runner identity, and toolchain shape for all six supported platform/architecture combinations. POSIX runners retain strict tar mode proof; Windows runners use the ZIP writer that records declared Unix modes independently of Windows filesystem modes. Production archive inspection is unchanged.
• Does not prove: Windows execution or any other replacement native-runner cell, real post-sign signatures/native trust, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: local correction gate for E-M4-POST-SIGN-METADATA-CI-RED-001; the semantic post-sign metadata package remains open pending all-six replacement CI.
• Follow-up: commit and push the correction, then require all six exact-head Node 24 native jobs.

E-M4-POST-SIGN-METADATA-CI-001 — Platform-native post-sign metadata passes all six build jobs

• Date: 2026-07-15
• Commit SHA / PR: 9e81229274a3aa9a0fdb4db537e853e1cc9699ca; draft PR #8741
• Workflow/run: SSH Relay Runtime Artifacts run 29409257513
• Exact native build jobs and release-side suite results:
  • Darwin arm64 job 87332153920: macos-15 label, macos-15-arm64 image 20260706.0213.1, native ARM64; post-sign metadata 4/4 in 623 ms; 40 files / 229 tests in 8.34 seconds; full build job PASS in 3m35s.
  • Darwin x64 job 87332153864: macos-15-intel label, macos-15 image 20260629.0276.1, native X64; post-sign metadata 4/4 in 1,673 ms; 40 files / 229 tests in 19.98 seconds; full build job PASS in 6m15s.
  • Linux arm64 job 87332153919: ubuntu-24.04-arm image 20260714.61.1, native ARM64; post-sign metadata 4/4 in 614 ms; 40 files / 229 tests in 4.90 seconds; full build job PASS in 4m33s.
  • Linux x64 job 87332153898: ubuntu-24.04 image 20260705.232.1, native X64; post-sign metadata 4/4 in 880 ms; 40 files / 229 tests in 6.31 seconds; full build job PASS in 4m2s.
  • Windows arm64 job 87332153840: windows-11-arm label, windows-11-arm64 image 20260706.102.1, native ARM64; post-sign metadata 4/4 in 2,235 ms; 41 files / 224 passed / 9 skipped in 10.92 seconds; full build job PASS in 8m37s.
  • Windows x64 job 87332153931: windows-2022 image 20260706.237.1, native X64; post-sign metadata 4/4 in 1,773 ms; 41 files / 224 passed / 9 skipped in 9.93 seconds; full build job PASS in 5m16s.
• Every build job also completed exact Node input verification, two clean native builds, archive inspection, byte-for-byte reproducibility, bundled Node execution, real PTY input/resize/exit, watcher lifecycle smoke, and unpublished Actions artifact evidence upload.
• Adjacent exact-head regressions: PR Checks 29409257568 PASS in 14m51s; Golden E2E 29409257636 PASS.
• Overall artifact-run result: expected FAIL only in Windows arm64 oldest-floor job 87333789968: hosted build 26200 does not equal required build 26100. Windows x64 oldest-floor and both Linux oldest-userland supplemental jobs pass. This declared floor gap is independent of the six green metadata/build jobs and still prevents tuple enablement.
• Oracle proved: each platform/architecture pair creates and semantically verifies post-sign SBOM and provenance using its native runtime closure, archive family, immutable Node inputs, runner identity, and exact platform toolchain. Both Windows ZIP fixtures pass strict declared type/mode inspection without weakening production validation, replacing E-M4-POST-SIGN-METADATA-CI-RED-001.
• Does not prove: real Apple/SignPath returned bytes, native trust, exact macOS 13.5 or Windows arm64 build-26100 execution, Linux kernel 4.18, protected manifest signing, publication/read-back, desktop embedding, SSH transfer/install, or an enabled tuple.
• Checklist items satisfied: all-six exact-head native CI gate for semantic post-sign metadata. The metadata package is closed; broader Work Package 3 and Milestone 4 remain open.
• Follow-up: add a credential-free reusable target-native build-prerequisite contract while keeping release-cut, desktop builds, signing credentials, publication, and every tuple disconnected.

E-M4-BUILD-PREREQUISITE-LOCAL-RED-001 — Reusable native build interface is absent

• Date: 2026-07-15
• Commit SHA / PR: uncommitted purpose-named test atop e7f447490; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; static credential-free workflow contract
• Transport/network: local workflow files only; no Actions invocation, release-cut call, signer, SSH host, publication, desktop consumer, production/default call, or enabled tuple
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-build-prerequisite.test.mjs
• Result: expected FAIL, 1 file / 1 test in 4.52 seconds. The exact assertion receives undefined instead of an empty workflow_call contract.
• Oracle proved: the purpose-named reusable interface is absent, while the test source also defines the required exact four-job native/baseline graph, read-only permissions, secret-free boundary, exact source checkout, and release-cut/macOS-release disconnection contract.
• Does not prove: implementation, Actions schema acceptance, native-runner execution, production release prerequisite behavior, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: RED prerequisite for the active reusable build-prerequisite package.
• Follow-up: expose the existing workflow through a credential-free workflow_call, wire this test into both native contract-test families, and run focused/broad local gates before exact-head CI.

E-M4-BUILD-PREREQUISITE-LOCAL-001 — Reusable native build interface is locally green

• Date: 2026-07-15
• Commit SHA / PR: uncommitted implementation atop e7f4474908af895cd9fbaccfc575d89f7ed6a6b2; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; static credential-free workflow contract and local regression suites
• Transport/network: local workflow/source files only; no Actions invocation, release-cut call, signer, SSH host, publication, desktop consumer, production/default call, or enabled tuple
• Commands and results:
  • Focused prerequisite/workflow contract: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-build-prerequisite.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 2 files / 7 tests in 12.55 seconds test duration / 24.25 seconds wall; 131,104,768-byte maximum RSS, 96,540,048-byte peak memory footprint, and zero swaps.
  • Broad release suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 42 files / 234 tests in 245.04 seconds test duration / 278.86 seconds wall; 185,352,192-byte maximum RSS and zero swaps. The unusually long local duration coincided with severe host CPU contention; the exact-head native jobs remain the authoritative timing cells.
  • Desktop schema/signature parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 7.69 seconds test duration / 28.07 seconds wall; 124,895,232-byte maximum RSS, 95,950,248-byte peak memory footprint, and zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS in 20.82 seconds wall with 1,253,785,600-byte maximum RSS.
  • /usr/bin/time -l pnpm run lint — PASS in 401.52 seconds wall with 1,685,323,776-byte maximum RSS and zero swaps; all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass. All 26 warnings are in untouched existing files.
  • Focused pnpm exec oxfmt --check, node --check, git diff --check, and zero diff in both user-owned Node/npm resolver files — PASS.
• Oracle proved: the existing exact four-job native/baseline graph is callable with an empty, credential-free workflow_call interface; workflow permissions remain read-only, no job consumes a secret, every job checks out the exact triggering SHA, and the test executes from both POSIX and Windows native contract-test lists. release-cut.yml and release-mac-build.yml remain disconnected, so this package cannot alter desktop release or product behavior.
• Does not prove: GitHub Actions schema acceptance, execution on any native runner, production release prerequisite behavior, signing, exact oldest-floor execution, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: local implementation/static/regression gate for the active reusable build-prerequisite package. The package remains open pending all-six exact-head native CI.
• Follow-up: commit and push, then require the new prerequisite contract to pass in every native build job; retain the known Windows arm64 build-26100 floor failure as a separate enablement gap.

E-M4-BUILD-PREREQUISITE-CI-001 — Reusable prerequisite passes all six native build jobs

• Date: 2026-07-15
• Commit SHA / PR: 994daefabcf9fba8d8d614bb6246d189c34c6b3f; draft PR #8741
• Workflow/run: SSH Relay Runtime Artifacts run 29412010582
• Exact native build jobs and prerequisite/release-suite results:
  • Darwin arm64 job 87341066776: macos-15 label, macos-15-arm64 image 20260706.0213.1, native ARM64; prerequisite 1/1 in 24 ms; 41 files / 230 tests in 7.96 seconds; full build job PASS in 3m7s.
  • Darwin x64 job 87341066764: macos-15-intel label, macos-15 image 20260629.0276.1, native X64; prerequisite 1/1 in 46 ms; 41 files / 230 tests in 24.02 seconds; full build job PASS in 6m56s.
  • Linux arm64 job 87341066762: ubuntu-24.04-arm label, image 20260714.61.1, native ARM64; prerequisite 1/1 in 25 ms; 41 files / 230 tests in 4.57 seconds; full build job PASS in 4m31s.
  • Linux x64 job 87341066775: ubuntu-24.04 label, image 20260705.232.1, native X64; prerequisite 1/1 in 58 ms; 41 files / 230 tests in 6.11 seconds; full build job PASS in 3m39s.
  • Windows arm64 job 87341066730: windows-11-arm label, windows-11-arm64 image 20260706.102.1, native ARM64; prerequisite 1/1 in 31 ms; 42 files / 225 passed / 9 skipped in 13.29 seconds; full build job PASS in 8m51s.
  • Windows x64 job 87341066835: windows-2022 image 20260706.237.1, native X64; prerequisite 1/1 in 48 ms; 42 files / 225 passed / 9 skipped in 11.55 seconds; full build job PASS in 5m32s.
• Every build job checked out the exact source SHA and completed exact Node input verification, two clean native builds, archive inspection, byte-for-byte reproducibility, bundled Node execution, real PTY input/resize/exit, watcher lifecycle smoke, and unpublished evidence upload. The two Linux oldest-userland supplemental jobs also pass: arm64 job 87342399226 in 58 seconds and x64 job 87342399251 in 1m2s. Windows x64 oldest-floor job 87342761575 passes in 1m35s.
• Adjacent exact-head regressions: PR Checks 29412010603 PASS in 13m49s. Golden E2E 29412010624 PASS after one failed-job retry: macOS job 87341066363 passed first-attempt in 3m55s; Linux first-attempt job 87341066356 failed during dependency installation while compiling node-pty, before app build or tests, while the immediately preceding exact head was green. The unchanged retry job 87343161455 passed dependency installation, app build, and Linux Golden tests in 4m29s.
• Overall artifact-run result: expected FAIL only in Windows arm64 oldest-floor job 87342761223: the contract requires build 26100 while the hosted runner reports 10.0.26200. Platform and architecture checks pass; the OS-build check fails closed. This declared floor gap remains a tuple-enablement blocker independent of the six green build/prerequisite jobs.
• Oracle proved: GitHub accepts the credential-free callable interface and all six native jobs execute its purpose-named contract. The exact four-job graph, read-only permissions, secret-free boundary, exact source checkout, and release-workflow disconnection invariants hold on macOS, Linux, and Windows x64/arm64. The callable graph still has no release or desktop consumer.
• Does not prove: a production release caller, real Apple/SignPath returned bytes, native trust, exact macOS 13.5/Linux kernel 4.18/Windows arm64 build-26100 execution, protected manifest signing, publication/read-back, desktop embedding, SSH transfer/install, or an enabled tuple.
• Checklist items satisfied: reusable target-native runtime build-prerequisite contract. Broader Work Package 3 and Milestone 4 remain open.
• Follow-up: add a disconnected purpose-named platform-native signing-job workflow RED while preserving every real-signing/native-trust, release-consumer, publication, and tuple gate.

E-M4-NATIVE-SIGNING-WORKFLOW-LOCAL-RED-001 — Native signing workflow is absent

• Date: 2026-07-15
• Commit SHA / PR: uncommitted purpose-named test atop 48ee5f5bb; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; disconnected workflow contract test only
• Transport/network: local workflow/source files only; no GitHub Actions invocation, credential, signer, SSH host, publication, desktop consumer, production/default call, or enabled tuple
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-native-signing-workflow.test.mjs
• Result: expected FAIL, 1 file / 1 test in 163 ms test duration / 0.98 seconds wall; 131,710,976-byte maximum RSS, 95,917,480-byte peak memory footprint, and zero swaps. The failure is ENOENT for .github/workflows/ssh-relay-runtime-native-signing.yml.
• Oracle proved: no callable signing workflow exists. The RED defines a callable-only, read-only, action-SHA-pinned two-job boundary over native Darwin/Windows x64/arm64 runners with bounded timeouts and exact existing credential names, while asserting build/release consumers remain disconnected.
• Does not prove: workflow implementation or schema acceptance, signing-payload finalization, credential availability, Apple/SignPath invocation/approval, returned signed bytes, native trust, aggregate/publication behavior, SSH behavior, or an enabled tuple.
• Checklist items satisfied: RED prerequisite for the active platform-native signing-job package.
• Follow-up: implement the exact post-return finalization capability and disconnected callable workflow without connecting any release consumer; then run focused/broad local and credential-free exact-head schema tests. Real signing/native-trust evidence remains separately required.

E-M4-NATIVE-SIGNING-WORKFLOW-LOCAL-001 — Disconnected signing and finalization are locally green

• Date: 2026-07-15
• Commit SHA / PR: capability commit d8d74d21442778e9bac672112528067542d19817 and disconnected workflow commit 2a7083d278e7a14b5b159555df90b1e84a2a41e7; draft PR #8741
• Runner: macOS 26.2 arm64, native local worktree; Node v26.0.0 and pnpm 10.24.0
• Remote: not applicable; credential-free local workflow, archive, signing-boundary, finalization, metadata, and desktop-parity tests
• Transport/network: local files only. No GitHub Actions invocation, production signing credential, Apple timestamp service, SignPath request, SSH host, publication, desktop consumer, production/default call, or enabled tuple
• Commands and results:
  • Focused signing/finalization/workflow suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-archive-extraction.test.mjs config/scripts/ssh-relay-runtime-macos-signing.test.mjs config/scripts/ssh-relay-runtime-native-signing-finalization.test.mjs config/scripts/ssh-relay-runtime-native-signing-workflow.test.mjs config/scripts/ssh-relay-runtime-native-signing-payload.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 6 files / 24 tests in 1.37 seconds test duration / 2.11 seconds wall; 167,133,184-byte maximum RSS, 96,064,912-byte peak memory footprint, and zero swaps.
  • Broad release suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 46 files / 241 tests in 24.51 seconds test duration / 25.71 seconds wall; 189,956,096-byte maximum RSS, 96,359,896-byte peak memory footprint, and zero swaps.
  • Desktop schema/signature parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 564 ms test duration / 1.27 seconds wall; 131,874,816-byte maximum RSS, 95,966,464-byte peak memory footprint, and zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS in 2.57 seconds wall with 1,225,637,888-byte maximum RSS, 96,114,016-byte peak memory footprint, and zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS in 27.02 seconds wall with 2,008,678,400-byte maximum RSS, 96,097,584-byte peak memory footprint, and zero swaps; all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass. All 26 warnings are in untouched existing files.
  • Focused pnpm exec oxfmt --check, pnpm exec oxlint, node --check, git diff --check, and zero diff in both user-owned Node/npm resolver files — PASS.
• Oracle proved: a caller-only, read-only, SHA-pinned workflow defines exact Darwin and Windows x64/arm64 signing jobs without a release or desktop consumer. The unsigned build archive is size- and SHA-256-bound, strictly inspected, extracted into an exclusive directory, verified as a full tree, and rechecked for mutation. The stage report is reconstructed from the authenticated source identity; official Node never enters the signing payload. macOS invokes bounded argument-array codesign over every exact non-Node native target from an ephemeral Developer ID keychain. Windows uploads only the exact unsigned payload to the existing fixed SignPath project, release-signing policy, and windows-inner-binaries-zip configuration, requires approver notification, and bounds returned-artifact wait to four hours. Finalization accepts only the exact changed returned tree, applies it into a new complete runtime, hashes the full tree, runs native signature policy before bundled Node/PTY/watcher smoke, and only then creates final-content-ID archive/SBOM/provenance/tuple assets. Any failure removes the complete candidate output. Both native build test families execute the new credential-free contracts.
• Does not prove: GitHub Actions schema acceptance, Node 24 execution on any hosted runner, access to Apple or SignPath secrets, a real Developer ID timestamp/signature, SignPath submission or manual approval behavior, returned production bytes, notarization/Gatekeeper, Defender/WDAC, oldest baselines, protected aggregate/manifest signing, publication/read-back, desktop embedding, SSH transfer/install, or an enabled tuple. Synthetic codesign mutation and injected native reports in local tests do not count as real signing or native-trust evidence.
• Checklist items satisfied: local implementation and credential-free regression prerequisite for the active platform-native signing-job package. The Milestone 4 signing box remains open.
• Follow-up: commit and push this coherent package, require the purpose-named contracts on every exact-head native build job, and record Actions schema/job evidence. Keep real protected Apple/SignPath/native-trust rehearsals and every release/default consumer separately gated.

E-M4-NATIVE-SIGNING-WORKFLOW-CI-RED-001 — Windows rejects non-native POSIX test fixtures

• Date: 2026-07-15
• Commit SHA / PR: 0c43b83e8260a252def164fe62d135177e79f56b; draft PR #8741
• Workflow/run: SSH Relay Runtime Artifacts run 29415080004
• Runners and failed jobs:
  • Windows x64 job 87351075144: GitHub-hosted windows-2022, runner GitHub Actions 1000055729; contract-test step fails from 12:26:12Z through 12:26:39Z.
  • Windows arm64 job 87351075167: GitHub-hosted windows-11-arm, runner GitHub Actions 1000055732; contract-test step fails from 12:28:14Z through 12:28:37Z.
• Remote/transport/network: GitHub-hosted native test runners only. Both failures occur before Node release-input download, native runtime construction, artifact upload, signing credentials, SignPath/Apple calls, SSH, publication, desktop consumption, or an enabled tuple.
• Result: expected CI RED in both Windows jobs. GitHub annotations identify the same two failures: ssh-relay-runtime-archive-extraction.test.mjs and ssh-relay-runtime-native-signing-finalization.test.mjs each construct a hardcoded Darwin tar fixture, and strict archive inspection rejects bin/node with Runtime archive type or mode mismatch. NTFS cannot materialize the fixture's declared POSIX executable mode. Darwin arm64, Darwin x64, Linux arm64, and Linux x64 native build jobs all pass the new credential-free contracts and complete build/inspection/smoke/upload on the same exact head. Golden E2E run 29415079993 passes.
• Oracle proved: GitHub accepts the new callable workflow schema and action pins; the failure is a test-fixture portability defect rather than a production archive relaxation. The production inspector retains exact mode enforcement and blocks both Windows jobs before any candidate output can be built or uploaded.
• Correction commit: 85c70c5e902e6ff5725fa11de054d83f2b821850.
• Correction and local proof: the archive reconstruction test now selects native win32-${process.arch} ZIP fixtures on Windows and retains both tar and ZIP coverage on POSIX. The finalization test does the same while preserving the real Windows policy shape: official Node, three returned SignPath candidates, and two exact preserved upstream ConPTY files. Focused 3 files / 10 tests pass locally. The exact broad command /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs passes 46 files / 241 tests in 20.07 seconds test duration / 22.43 seconds wall with 190,513,152-byte maximum RSS, 96,048,528-byte peak memory footprint, and zero swaps. Focused oxfmt, oxlint, syntax, and git diff --check gates pass.
• Does not prove: corrected execution on either native Windows runner, a production signing job, Apple/SignPath credentials or returned bytes, native trust, oldest baselines, protected aggregate, publication/read-back, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: required CI RED and locally green test-fixture-only correction for the active signing workflow package. The package remains open pending replacement all-six exact-head execution.
• Follow-up: commit and push the fixture-only correction, then require both Windows architectures and all four POSIX jobs to pass on the replacement exact head. Do not weaken archive mode checks.

E-M4-NATIVE-SIGNING-WORKFLOW-CI-001 — Corrected signing contracts pass all six native builds

• Date: 2026-07-15
• Owner: Codex implementation owner
• Commit SHA / PR: exact head 70b3892aefc31423ad30467ad5251c090842526a; correction commit 85c70c5e902e6ff5725fa11de054d83f2b821850; draft PR #8741.
• Workflow/run: SSH Relay Runtime Artifacts 29415642475, 12:33:09Z–12:45:41Z. This is a credential-free exact-head replacement for the required Windows RED. It does not call the signing workflow or use repository secrets.
• Target-native build jobs and resolved images:
  • Linux x64 job 87352975773: ubuntu-24.04, ubuntu24 image 20260705.232.1, X64, 12:33:13Z–12:38:05Z.
  • Linux arm64 job 87352975853: ubuntu-24.04-arm, ubuntu24-arm64 image 20260706.52.2, ARM64, 12:33:16Z–12:37:57Z.
  • macOS x64 job 87352975950: macos-15-intel, macos15 image 20260629.0276.1, X64, 12:33:14Z–12:39:14Z.
  • macOS arm64 job 87352975799: macos-15, macos15 image 20260706.0213.1, ARM64, 12:33:14Z–12:37:31Z.
  • Windows x64 job 87352975877: windows-2022, win22 image 20260706.237.1, X64, 12:33:13Z–12:38:30Z.
  • Windows arm64 job 87352975797: windows-11-arm, win11-arm64 image 20260706.102.1, ARM64, 12:33:13Z–12:41:51Z.
• Contract results: every job checks out the exact 40-hex source and passes the new archive reconstruction, signing-stage, returned-tree finalization, and callable-workflow contracts before downloading Node inputs or constructing an artifact. Each POSIX job passes 45 files / 237 tests; durations are 5.64 seconds on Linux x64, 5.45 seconds on Linux arm64, 10.95 seconds on macOS arm64, and 24.06 seconds on macOS x64. Each Windows job passes 46 files / 232 tests with nine declared non-Windows-applicable skips out of 241; durations are 11.63 seconds on x64 and 11.30 seconds on arm64. Both corrected Windows fixtures exercise the native ZIP/runtime policy while POSIX retains exact tar-mode coverage; production archive mode validation is unchanged.
• Artifact oracle: all six jobs then complete two clean target-native builds, exact equality, archive/tree inspection, bundled Node v24.18.0, PTY, watcher, source-signature/native-plan checks, and unpublished artifact upload. Both supplemental Linux userland jobs pass: 87354301778 for x64 and 87354301762 for arm64. Windows x64 oldest-baseline job 87354877657 also passes.
• Expected retained failure: Windows arm64 baseline job 87354877689 fails closed only because the contract requires OS build 26100 while the hosted runner reports 10.0.26200. Before refusing qualification it authenticates the 60-entry / 42-file / 85,213,511-expanded-byte tree with content ID sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, runs bundled Node, PTY resize/exit, and watcher create/update/delete/rename smoke, settles to two pipe handles after a 2,000 ms observation, and reports 5,877.1343 ms smoke time, 48,570,368-byte RSS, and 7,671.6441 ms total verification. Platform and architecture checks pass; only the exact floor check is false.
• Adjacent exact-head regressions: Golden E2E 29415642509 passes both macOS and Linux jobs. PR Checks 29415642512 pass the verify job from 12:33:13Z through 12:47:00Z. Both use the same exact head.
• Does not prove: real Apple/SignPath credentials, approval, returned signed bytes, native trust, Gatekeeper/notarization, Defender/WDAC, macOS 13.5, Linux kernel 4.18, Windows arm64 build 26100, protected manifest signing, release publication/read-back, desktop embedding, SSH transfer/install, or an enabled tuple. No production/default consumer is connected and no artifact is published.
• Checklist items satisfied: credential-free exact-head native execution prerequisite for the active signing-job package. The Work Package 3 signing item remains open pending real protected signing and native-trust evidence.
• Follow-up: add a purpose-named RED and manual-only rehearsal caller for the existing build and signing workflows. Keep baseline qualification, release-cut, desktop consumers, publication, and every tuple disconnected; a rehearsal must not convert the hosted Windows arm64 floor gap into a pass.

E-M4-NATIVE-SIGNING-REHEARSAL-LOCAL-RED-001 — Manual signing rehearsal caller is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named contract test atop exact pushed head 5b1a994a3; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Local workflow files only; no GitHub Actions dispatch, repository secret, Apple timestamp service, SignPath request, manual approval, SSH host, publication, desktop consumer, or enabled tuple.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-native-signing-rehearsal-workflow.test.mjs.
• Result: expected FAIL, 1 file / 1 test in 152 ms test duration / 1.00 second wall; 131,629,056-byte maximum RSS, 95,769,952-byte peak memory footprint, and zero swaps. The only failure is ENOENT for .github/workflows/ssh-relay-runtime-native-signing-rehearsal.yml.
• Oracle proved: no manual-only caller currently binds an explicit confirmation and exact selected source to the existing credential-free native build outputs and callable signing workflow. The RED also defines that oldest-baseline qualification remains default-on for ordinary artifact runs but may be separately skipped by this signing rehearsal so the known hosted Windows-arm64 floor mismatch cannot prevent collection of signed-byte evidence or be misreported as qualified.
• Does not prove: implementation, Actions schema acceptance, secret availability, real Apple or SignPath signing, returned bytes, native trust, approval/timeout behavior, exact floors, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the exact manual caller and default-preserving qualification input, integrate the contract into both native test families, and run focused plus broad credential-free local proof before any dispatch.

E-M4-NATIVE-SIGNING-REHEARSAL-LOCAL-001 — Manual rehearsal caller passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local implementation atop exact pushed head 5b1a994a3; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Local workflow files and tests only; no Actions dispatch, repository secret, Apple timestamp service, SignPath request, approval, SSH host, publication, desktop consumer, or enabled tuple.
• Intermediate contract RED: the first three-file implementation run passes the new rehearsal and existing signing-workflow contracts but fails the older build-prerequisite contract because it still requires an empty workflow_call interface. Result: 2 passed / 1 failed in 404 ms test / 1.16 seconds wall, 131,563,520-byte maximum RSS, 95,638,760-byte peak footprint, and zero swaps. The correction makes that older contract require the exact Boolean input, safe true default, and both default-preserving qualification conditions.
• Commands and final results:
  • Focused caller/signing/build-prerequisite suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-native-signing-rehearsal-workflow.test.mjs config/scripts/ssh-relay-runtime-native-signing-workflow.test.mjs config/scripts/ssh-relay-runtime-build-prerequisite.test.mjs — PASS, 3 files / 3 tests in 397 ms test / 1.12 seconds wall, 131,956,736-byte maximum RSS, 96,114,016-byte peak footprint, zero swaps.
  • Broad runtime-release suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 47 files / 242 tests in 8.98 seconds test / 9.95 seconds wall, 188,628,992-byte maximum RSS, 95,900,928-byte peak footprint, zero swaps.
  • Desktop manifest/signature parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 570 ms test / 1.27 seconds wall, 131,792,896-byte maximum RSS, 95,950,176-byte peak footprint, zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS in 2.15 seconds wall, 1,279,410,176-byte maximum RSS, 96,523,760-byte peak footprint, zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS in 9.90 seconds wall, 2,006,204,416-byte maximum RSS, 95,606,040-byte peak footprint, zero swaps. All 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass; all 26 warnings are in untouched existing files.
  • Focused oxfmt --check, oxlint, both node --check commands, git diff --check, and zero diff in both user-owned Node/npm resolver files — PASS.
• Oracle proved: only workflow_dispatch can enter the caller. The dispatch must supply the exact lowercase 40-hex commit selected by GitHub plus the exact typed confirmation. Rehearsals serialize and cannot auto-cancel after approval starts. Repository permissions remain read-only. The caller invokes the existing credential-free native build, explicitly separates qualification supplements, then invokes only the existing callable native-signing workflow with inherited secrets. Ordinary pull-request, direct-dispatch, and reusable artifact calls retain baseline gates by default. Release-cut and macOS desktop build remain disconnected, and the caller contains no release, publication, desktop, or tuple path.
• Operational blocker and safe default: GitHub emits workflow_dispatch only for workflow files present on the default branch. This new caller is unmerged by design, so it cannot be credential- dispatched from the PR. Do not temporarily route repository secrets through the existing routine artifact workflow. Keep credentials unused and record real signing/native trust only after a separately authorized merge makes this reviewed caller dispatchable.
• Does not prove: GitHub schema acceptance at an exact pushed head, a live dispatch, secret availability, Apple/SignPath request or approval, returned signed bytes, native trust, Gatekeeper/notarization, Defender/WDAC, exact oldest floors, protected manifest signing, publication/read-back, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: commit/push and require both native contract families plus ordinary PR checks to pass at the exact head. Attempting the caller by file after push may record GitHub's default-branch refusal but must not use an alternate secret-bearing path. Continue the next independent disconnected artifact-only package while the real signing gate remains open.

E-M4-NATIVE-SIGNING-REHEARSAL-DISPATCH-BLOCKED-001 — Default branch blocks dispatch

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head c2db2b62e544139176d0993b1340f9d0c706e017; draft PR #8741.
• Command: gh workflow run ssh-relay-runtime-native-signing-rehearsal.yml --repo stablyai/orca --ref Jinwoo-H/bug-8450-ssh-relay-runtime-builds -f expected-source-sha=c2db2b62e544139176d0993b1340f9d0c706e017 -f 'confirmation=SIGN SSH RELAY RUNTIME ARTIFACTS'.
• Result: expected refusal before run creation: HTTP 404: workflow ssh-relay-runtime-native-signing-rehearsal.yml not found on the default branch. No Actions run, job, artifact, secret read, Apple/SignPath request, approver notification, publication, or enabled tuple was created.
• Oracle proved: the reviewed caller cannot be live-rehearsed while it exists only in this PR. The user's no-merge boundary and GitHub's default-branch dispatch rule jointly gate real signing.
• Safe default: do not add a temporary secret-bearing path to an existing routine workflow. Keep the caller reviewable in the PR, leave real signing/native trust open, and continue only independent disconnected work until a separately authorized merge makes the workflow dispatchable.
• Does not prove: Actions schema execution, credential availability, signing, approval/timeout, returned-byte identity, native trust, exact floors, publication, desktop embedding, SSH behavior, or an enabled tuple.

E-M4-NATIVE-SIGNING-REHEARSAL-CI-001 — Rehearsal contracts pass all six native builds

• Date: 2026-07-15
• Owner: Codex implementation owner
• Commit SHA / PR: exact head c2db2b62e544139176d0993b1340f9d0c706e017; capability commit c2db2b62e; draft PR #8741.
• Workflow/run: SSH Relay Runtime Artifacts 29417449971, 13:00:47Z–13:15:32Z. Credential-free PR execution only; it does not invoke the manual rehearsal caller or any signing credential.
• Target-native jobs and resolved images:
  • Windows arm64 87359106832: windows-11-arm, win11-arm64 image 20260714.109.1, ARM64, 13:01:01Z–13:11:17Z.
  • Windows x64 87359106887: windows-2022, win22 image 20260714.244.1, X64, 13:01:01Z–13:07:22Z.
  • Linux x64 87359106853: ubuntu-24.04, ubuntu24 image 20260705.232.1, X64, 13:01:01Z–13:05:10Z.
  • Linux arm64 87359106916: ubuntu-24.04-arm, ubuntu24-arm64 image 20260714.61.1, ARM64, 13:01:04Z–13:06:06Z.
  • macOS x64 87359106864: macos-15-intel, macos15 image 20260629.0276.1, X64, 13:01:02Z–13:07:29Z.
  • macOS arm64 87359106894: macos-15, macos15 image 20260706.0213.1, ARM64, 13:01:02Z–13:05:38Z.
• Contract results: each POSIX job passes 46 files / 238 tests, including the new caller contract; durations are 6.42 seconds Linux x64, 6.18 seconds Linux arm64, 28.42 seconds macOS x64, and 11.49 seconds macOS arm64. Each Windows job passes 47 files / 233 tests with nine declared skips out of 242; durations are 15.23 seconds x64 and 14.23 seconds arm64. Every job then completes two exact native builds, equality, inspection, Node/PTY/watcher smoke, and unpublished upload.
• Default-preservation oracle: both Linux supplements pass in jobs 87360607215 and 87360607155, and Windows x64 baseline job 87361449973 passes. The ordinary PR call therefore retains qualification jobs by default.
• Expected retained failure: Windows arm64 baseline job 87361450070 authenticates the unchanged 85,213,511-byte tree/content ID, passes Node/PTY/watcher/resource smoke in 6,177.5851 ms with 48,345,088-byte RSS and 7,942.833 ms total verification, then fails only because 10.0.26200 is not required build 26100. Platform and architecture pass; exact OS build fails closed.
• Adjacent exact-head regressions: PR Checks 29417449960 pass from 13:00:51Z–13:13:15Z. Golden E2E 29417449936 passes macOS and Linux.
• Does not prove: a dispatch of the new caller, any secret access, Apple/SignPath signing or approval, returned signed bytes, native trust, exact oldest floors, protected manifest signing, publication/read-back, desktop embedding, SSH behavior, or an enabled tuple.
• Checklist items satisfied: exact-head schema/contract and default-preservation CI prerequisite for the manual rehearsal capability. The broader native-signing item remains open because real signing/native trust is blocked.
• Follow-up: checkpoint this evidence, keep the dispatch blocker open, and begin the next disconnected aggregate/manifest-signing job contract without credentials or production consumers.

E-M4-LINUX-FINALIZATION-LOCAL-RED-001 — Linux aggregate-ready finalization is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named test atop pushed head 0be32c5cc; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Local test import only; no Actions runner, credential, signer, SSH host, publication, desktop consumer, or enabled tuple.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-linux-finalization.test.mjs.
• Result: expected FAIL before collection because config/scripts/ssh-relay-runtime-linux-finalization.mjs is absent; 157 ms Vitest / 0.89 seconds wall, 131,891,200-byte maximum RSS, 96,048,480-byte peak footprint, zero swaps.
• Oracle proved: existing Linux build output has no capability that converts its already verified hash-only runtime into the same exact four-file aggregate boundary emitted after macOS/Windows signing. The RED defines Linux-only validation, verify-before-descriptor ordering, complete native hash projection, exclusive output, failure cleanup, receipt binding, and strict CLI arguments.
• Does not prove: implementation, real runtime/archive execution, native CI, aggregate workflow, manifest signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the Linux-only finalizer, wire it into both Linux native build jobs, and run focused/broad local gates before exact-head runner execution.

E-M4-LINUX-FINALIZATION-LOCAL-001 — Linux aggregate-ready finalization passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local implementation atop pushed head 0be32c5cc; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Local generated fixtures and workflow-source contracts only; no Linux runtime execution, Actions credential, signer, SSH host, publication, desktop consumer, or enabled tuple.
• Implementation-iteration evidence: the first implementation run rejects the old abbreviated test manifest through the production closure validator and rejects the non-Linux spoof before output; the test is corrected to inject only the already-proven signing-plan dependency. Subsequent REDs expose macOS /var → /private/var physical-path assumptions in the test; production comparison is corrected to real paths before GREEN. No production closure, identity, or path validation is weakened.
• Commands and final results:
  • Focused finalizer/tuple/workflow suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-linux-finalization.test.mjs config/scripts/ssh-relay-runtime-manifest-tuple.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 3 files / 18 tests in 896 ms test / 1.59 seconds wall, 140,427,264-byte maximum RSS, 96,261,496-byte peak footprint, zero swaps. The final post-format rerun also passes 3/18 in 833 ms.
  • Broad release suite: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay*.test.mjs — PASS, 48 files / 246 tests in 8.61 seconds test / 9.56 seconds wall, 189,005,824-byte maximum RSS, 96,097,680-byte peak footprint, zero swaps.
  • Desktop manifest/signature parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 504 ms test / 1.19 seconds wall, 131,973,120-byte maximum RSS, 96,097,584-byte peak footprint, zero swaps.
  • /usr/bin/time -l pnpm run typecheck — PASS in 1.99 seconds wall, 1,254,457,344-byte maximum RSS, 95,835,440-byte peak footprint, zero swaps.
  • /usr/bin/time -l pnpm run lint — PASS in 9.42 seconds wall, 2,000,797,696-byte maximum RSS, 95,720,656-byte peak footprint, zero swaps. All 41 reliability gates, 355-entry max-lines ratchet, bundled-skill guides, localization catalog/parity, and localization coverage pass; all 26 warnings are in untouched existing files.
  • Focused node --check, oxlint, oxfmt --check, git diff --check, and zero diff in the two user-owned Node/npm resolver files — PASS.
• Oracle proved: only exact Linux identities from the named physical source output are accepted. Source and exclusive output are physically disjoint; symlinked/empty/mutating input assets fail. The existing archive/tree/bundled smoke runs before descriptor generation. The complete native file report is derived from the validated hash-only plan, and the existing tuple producer rechecks tree/archive/metadata before the descriptor. A receipt binds tuple/content identity, verification, and exact aggregate input. Any failure removes all candidate output. Linux build jobs copy only the descriptor/receipt into their existing unpublished evidence after success; ordinary baseline jobs remain unchanged.
• Does not prove: execution on Linux x64/arm64, a real archive/tree/smoke through the new call, aggregate workflow, manifest credential/signature, publication/read-back, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: commit/push and require both Linux native jobs plus all-six contract families to pass at the exact head. Inspect the emitted descriptor/receipt before starting aggregate job wiring.

E-M4-LINUX-FINALIZATION-CI-001 — Native Linux finalization emits inspected aggregate inputs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29419759256, 13:34:30Z–13:50:21Z. The workflow conclusion is the expected failure solely because the separately declared Windows arm64 oldest-build gate rejects hosted 26200 versus required 26100 after runtime verification. It is not reported as an all-green aggregate.
• Native build jobs: all six succeed — Linux arm64 87366900226 on ubuntu-24.04-arm in 4m50s; Windows x64 87366900246 in 6m14s; macOS x64 87366900262 in 6m55s; macOS arm64 87366900276 in 4m59s; Windows arm64 87366900296 in 11m59s; and Linux x64 87366900347 on ubuntu-24.04 in 4m10s. Each exact native family runs the purpose suite including Linux-finalization syntax and tests; both Linux jobs report 47 files / 242 tests passed under Node 24.18.0.
• Supplemental gates: Linux x64 job 87368626081 and Linux arm64 job 87368626106 pass the digest-pinned Rocky Linux glibc 2.28/libstdc++ 6.0.25 userland proof; the explicit kernel 4.18 gap remains because hosted kernels are newer. Windows x64 baseline job 87369854311 passes. Windows arm64 job 87369854133 authenticates and executes the runtime, records 6,242.0644 ms smoke, 48,771,072-byte RSS, and 10,149.9713 ms total verification, then fails only the exact OS-build check (10.0.26200 versus required 26100).
• Downloaded proof: gh run download 29419759256 --repo stablyai/orca -n ssh-relay-runtime-linux-x64-glibc -n ssh-relay-runtime-linux-arm64-glibc. Artifact 8344803641 is 29,292,240 bytes and artifact 8344824674 is 28,222,689 bytes. Each contains exactly the runtime archive, identity, SBOM, provenance, signing-stage evidence, .manifest-tuple.json, and .linux-finalization.json receipt expected by the unpublished evidence contract.
• x64 receipt: tuple linux-x64-glibc, content sha256:fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d, archive sha256:8b9e77fe5f33acbee4a2d532f0be564d8eceb36acaf22deec08cccdd14834d78, descriptor sha256:855d83a9f0b0bb5878de335703c4398dc72420b220b31efb5786af59da0587ec, 49 tree entries / 34 files / 124,846,430 expanded bytes, 159.336194 ms smoke, 56,758,272-byte RSS, and 1,749.137209 ms final verification.
• arm64 receipt: tuple linux-arm64-glibc, content sha256:96f07f62af9b35304bb8ca0870ca4d8095e059bfa61dd1bc57e81b20f3fbca67, archive sha256:f2bfe798097a24a113abd37d32008d542c1ed0772ed8ccce53fb51c807d84c3f, descriptor sha256:253dac72cb97e32c6fa68f886ac7c73cf00b7a03b1e87d189c490559bf1c071e, 49 tree entries / 34 files / 122,865,324 expanded bytes, 188.430108 ms smoke, 52,727,808-byte RSS, and 1,700.548606 ms final verification.
• Adjacent regressions: Golden E2E 29419759379 passes its macOS and Linux jobs at the exact head. PR Checks attempt 1 has the separately recorded unrelated suite-order RED E-M4-LINUX-FINALIZATION-PR-CHECKS-RED-001; attempt 2 passes under E-M4-LINUX-FINALIZATION-PR-CHECKS-001.
• Oracle proved: both real native Linux architectures execute the new verify-before-descriptor path, preserve exact archive/tree/native hashes, run bundled Node/PTY/watcher smoke, emit the complete hash-only native report, and upload receipts that bind exact aggregate inputs. The inspected receipts agree with their descriptors, assets, tuple IDs, and content IDs.
• Does not prove: Linux kernel 4.18, native Apple/SignPath signing or trust, protected manifest signing, aggregate workflow execution, publication/read-back, desktop embedding, SSH behavior, performance parity, or any enabled tuple.
• Checklist items satisfied: Linux aggregate-ready prerequisite for the Work Package 3 aggregate workflow. The broader aggregate/manifest-signing item remains open.
• Follow-up: implement the purpose-named callable/disconnected aggregate and protected signing workflow contract. Do not connect release, desktop, publication, or tuple consumers.

E-M4-LINUX-FINALIZATION-PR-CHECKS-RED-001 — Adjacent full suite exposes unrelated routing flake

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf; draft PR #8741.
• Workflow: PR Checks run 29419759287 attempt 1, job 87366900240. Lint, typecheck, Git compatibility, and every pre-test gate pass. The test step reports 2,850 files / 29,944 tests passed, nine files / 55 tests skipped, and one failure after 421.95 seconds.
• Failure: untouched src/renderer/src/components/terminal-pane/pty-connection.test.ts case keeps Droid routing visible through command-finished foreground confirmation receives csi-u instead of alt-enter at line 5284. Neither the Linux finalizer nor its workflow edits touch that production/test domain.
• Focused command: pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts -t 'keeps Droid routing visible through command-finished foreground confirmation' — PASS locally, 1 file / 1 test with 423 skipped in 1.22 seconds.
• Oracle proved: the exact failure is identified and is not hidden by a blind retry; it is not a Linux finalizer assertion. Exact-head attempt 2 was explicitly requested only after log inspection.
• Does not prove: that the unrelated test has no latent ordering defect.
• Follow-up: replacement attempt 2 passes under E-M4-LINUX-FINALIZATION-PR-CHECKS-001. Retain this RED rather than erasing the observed suite-order failure.

E-M4-LINUX-FINALIZATION-PR-CHECKS-001 — Exact-head full-suite replacement passes

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf; draft PR #8741.
• Workflow: PR Checks run 29419759287 attempt 2, job 87369995158, 13:47:10Z–14:01:35Z — PASS.
• Result: lint, reliability, max-lines, localization, typecheck, Git 2.25 compatibility, and all other pre-test gates pass. The full suite passes 2,851 files / 29,945 tests with nine files / 55 tests skipped in 537.22 seconds. The unpacked Linux app builds, packaged daemon entry loads under plain Node, and the packaged CLI --help smoke succeeds outside the repository.
• Oracle proved: the exact-head replacement is green, including the assertion that failed in attempt 1, without any code or test change and without weakening the Linux finalizer contract.
• Does not prove: real Linux kernel 4.18, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: checkpoint the Linux finalization evidence and start the disconnected aggregate and protected manifest-signing workflow RED.

E-M4-PROTECTED-MANIFEST-WORKFLOW-LOCAL-RED-001 — Callable protected signing workflow is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named test atop pushed head e5dfffaaa2df55b221c5ee30699ff8fe814b91aa; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Static repository workflow-source read only; no Actions runner, environment approval, secret, signer, artifact download, release, desktop consumer, SSH host, or enabled tuple.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-signing-workflow.test.mjs.
• Result: expected FAIL, 1 file / 1 test in 182 ms Vitest / 0.89 seconds wall, 131,743,744-byte maximum RSS, 95,966,656-byte peak footprint, zero swaps. The only failure is ENOENT for .github/workflows/ssh-relay-runtime-manifest-signing.yml.
• Seed-signer prerequisite RED: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-seed-signing.test.mjs — expected FAIL before collection because config/scripts/ssh-relay-runtime-manifest-seed-signing.mjs is absent; 196 ms Vitest / 0.90 seconds wall, 132,022,272-byte maximum RSS, 96,228,776-byte peak footprint, zero swaps. The test defines canonical request serialization, exact 32-byte base64 seed handling, signature-only output, request/seed drift rejection, exclusive output cleanup, and symlink rejection.
• Oracle proved: no callable workflow currently enforces the required three-stage boundary: exact six-artifact credential-free preparation; one protected relay-runtime-manifest-signing job with the sole seed reference and signature-only output; then credential-free reconstruction and final verification. The RED also requires SHA-pinned actions, strict timeouts, no wildcard artifact merge, read-only permissions, and complete release/desktop/rehearsal disconnection.
• Does not prove: implementation, signer seed validation, file-based prepare/finalize behavior, Actions execution, environment protection, real signatures, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the seed signer and exclusive filesystem prepare/finalize commands with hostile-input tests, then add the callable workflow and make this contract green without connecting any consumer.

E-M4-PROTECTED-MANIFEST-SEED-LOCAL-001 — Protected seed signer passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local implementation atop pushed head e5dfffaaa2df55b221c5ee30699ff8fe814b91aa; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Test-only in-memory Ed25519 seeds and local temporary files; no GitHub Environment, Actions secret, release, desktop consumer, publication, SSH host, or enabled tuple.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-seed-signing.test.mjs config/scripts/ssh-relay-runtime-manifest-signing-handoff.test.mjs config/scripts/ssh-relay-runtime-manifest-assembly.test.mjs — PASS, 3 files / 20 tests in 638 ms Vitest / 1.30 seconds wall, 188,612,608-byte maximum RSS, 96,163,336-byte peak footprint, zero swaps.
• Broad release command excluding the deliberately still-red workflow-source test: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 $(rg --files config/scripts | rg '/ssh-relay.*\\.test\\.mjs$' | rg -v 'ssh-relay-runtime-manifest-signing-workflow\\.test\\.mjs$') — PASS, 49 files / 255 tests in 8.54 seconds Vitest / 9.46 seconds wall, 188,858,368-byte maximum RSS, 96,523,568-byte peak footprint, zero swaps. The unfiltered 50-file run passes the same 49 files / 255 tests and fails only the recorded missing-workflow RED.
• Desktop parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 493 ms Vitest / 1.12 seconds wall, 131,858,432-byte maximum RSS, 96,032,120-byte peak footprint, zero swaps.
• Static results: node --check, focused oxlint, and focused oxfmt --check pass. pnpm run typecheck passes in 1.88 seconds wall. Full pnpm run lint passes in 9.26 seconds wall with all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill, localization catalog/parity, and localization coverage gates; all 26 warnings are in untouched existing files.
• Oracle proved: request artifacts contain only the exact canonical payload plus algorithm/hash/size bindings; malformed fields, noncanonical base64, payload drift, and noncanonical manifest bytes fail. Only a canonical base64 32-byte seed is accepted. Output contains exactly key ID plus the detached 64-byte signature, is created in an exclusive directory, and is removed on failure. Symlinked request files are rejected. Both POSIX and Windows native artifact contract families now syntax-check and run the purpose suite without exposing a secret.
• Does not prove: a real GitHub Environment or seed, reviewer approval, the filesystem aggregate prepare/finalize boundary, the callable workflow, Actions execution, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the exclusive six-artifact filesystem prepare/finalize command, including receipt/path/mutation/accepted-key/signature/partial-output failures, before adding the callable workflow.

E-M4-MANIFEST-AGGREGATE-COMMAND-LOCAL-RED-001 — Six-artifact filesystem command is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named test atop pushed head 4180e04ac4e732f082dc576af69364325a678d2b; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Generated local fixtures only; no Actions runner, GitHub Environment, seed, release, desktop consumer, SSH host, publication, or enabled tuple.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-aggregate-command.test.mjs.
• Result: expected FAIL, 1 suite / 0 tests collected in 225 ms. The only failure is module resolution for absent config/scripts/ssh-relay-runtime-manifest-aggregate-command.mjs.
• Oracle proved: there is no file-based boundary that collects only the exact two flattened Linux and four signed native artifacts, binds finalization receipts and accepted public keys, exposes canonical bytes without credentials, independently recollects after signature return, verifies the signature, and removes partial output on failure. The test defines missing/extra directory, symlink, mutation, receipt drift, invalid-key, invalid-signature, and cleanup failures.
• Does not prove: implementation, real downloaded artifact inputs, Actions execution, protected signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the command and make this suite green before adding the callable workflow.

E-M4-PROTECTED-MANIFEST-SEED-CI-001 — Seed signer passes all six native contract families

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 4180e04ac4e732f082dc576af69364325a678d2b; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29422587380, 14:13:18Z–14:27:59Z. The workflow conclusion is the expected failure solely because Windows arm64 hosted build 26200 does not equal the separately required build 26100 after successful runtime execution.
• Native jobs: Linux arm64 87376626186, Linux x64 87376626194, macOS x64 87376626222, Windows arm64 87376626264, macOS arm64 87376626297, and Windows x64 87376626317 all pass. Linux/macOS report 48 files / 251 tests; Windows reports 49 files / 246 passed and nine skipped of 255. The delta from the prior package is the protected seed-signing purpose suite under Node 24.18.0 on every family.
• Supplemental gates: Linux x64 87378044229, Linux arm64 87378044358, and Windows x64 87379238862 pass. Windows arm64 87379238661 fails only the retained 26200-versus-26100 floor assertion.
• Adjacent regressions: PR Checks 29422587487 job 87376597444 passes from 14:13:22Z–14:26:30Z. Golden E2E 29422587419 passes macOS job 87376596910 and Linux job 87376596912.
• Oracle proved: canonical request serialization and seed-signing failure contracts execute under repository Node 24 on all target-native runner families without regressing builds, packaged smoke, full PR checks, or Golden E2E.
• Does not prove: a real protected environment/seed, approval, filesystem aggregate command CI, callable aggregate workflow, native signing/trust, oldest Windows arm64/macOS/Linux kernel floors, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: checkpoint the locally green filesystem aggregate command and require it on the same six native families before implementing the callable workflow.

E-M4-MANIFEST-AGGREGATE-COMMAND-LOCAL-001 — Six-artifact prepare/finalize boundary passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local implementation atop pushed head 4180e04ac4e732f082dc576af69364325a678d2b; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Six generated aggregate-ready fixture directories and an in-memory Ed25519 test seed only; no Actions runner, GitHub Environment, production key, release, desktop consumer, SSH host, publication, or enabled tuple.
• Focused command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-aggregate-command.test.mjs — PASS, 1 file / 4 tests in 409 ms Vitest. A final cross-platform split rerun passes 1 file / 5 tests in 504 ms, preserving the symlink case on POSIX while leaving all other hostile cases active on Windows. The suite covers exact six-directory enumeration, flattened Linux versus signed assets/ + evidence/ layouts, stable exclusive copies, finalization receipts, content and descriptor bindings, duplicate names/tuples, missing/extra directories, symlinks, mutation, invalid accepted keys, prepared drift, cancellation, invalid signatures, and failure cleanup.
• Broad release command: rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | rg -v 'ssh-relay-runtime-manifest-signing-workflow[.]test[.]mjs$' | xargs /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 — PASS, 50 files / 260 tests in 8.68 seconds Vitest / 9.56 seconds wall, 189,104,128-byte maximum RSS, 96,130,448-byte peak footprint, zero swaps. The preceding unfiltered 51-file run passes all implemented suites and fails only the recorded absent-workflow RED; its pre-split count was 50 files / 259 tests.
• Desktop parity and static gates: manifest schema/signature/release-asset parity passes 3 files / 48 tests; pnpm run typecheck, node --check, focused oxlint/formatting, and full pnpm run lint pass. Full lint reports all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill, localization catalog/parity, and localization coverage green; 26 warnings remain only in untouched existing files.
• Oracle proved: accepted public keys are validated and hash-bound before a request is exposed. The preparation phase copies and verifies only the four declared files from each exact finalization receipt into exclusive staging. Finalization independently recollects all six inputs, compares the complete prepared receipt/request, verifies the returned key/signature, emits the manifest and evidence exclusively, and removes staging/partial output on every tested failure.
• Does not prove: actual downloaded native artifact directories, Node 24/native CI, a real protected signer/environment/approval, the callable workflow, native signing/trust, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: checkpoint and push this command, require it on all six exact-head native jobs, then implement the still-red callable workflow without connecting release or product consumers.

E-M4-MANIFEST-AGGREGATE-COMMAND-CI-001 — Filesystem aggregation passes all native families

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 8cf80a0228ffa095beceec018a0de2e237b89e2d; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29424084956, 14:33:33Z–14:53:05Z. The expected workflow failure is solely Windows arm64 baseline job 87385641582: runtime verification passes in 8,318.1202 ms with 6,107.7828 ms smoke and 49,930,240-byte RSS, then the exact floor gate rejects observed build 26200 versus required 26100.
• Native jobs: macOS x64 87381843694, Linux arm64 87381843705, macOS arm64 87381843796, Linux x64 87381843825, Windows x64 87381843853, and Windows arm64 87381844294 all pass complete artifact construction. POSIX reports 49 files / 256 tests. Windows reports 50 files / 250 passed and ten skipped of 260; only the POSIX-only symlink case is skipped by the new command suite on Windows.
• Supplemental jobs: Linux arm64 87383766220, Linux x64 87383766265, and Windows x64 87385641378 pass. The sole Windows arm64 failure is the retained exact-build mismatch described above.
• Adjacent regressions: PR Checks 29424084938 job 87381832092 passes 14:33:36Z–14:48:09Z. Golden E2E 29424085004 passes macOS job 87381832460 and Linux job 87381832629.
• Oracle proved: every target-native Node 24 family executes the exact six-artifact collection, accepted-key, canonical request, independent reconstruction, signature verification, hostile input, cancellation, and cleanup suite without regressing runtime construction or adjacent CI.
• Does not prove: real downloaded signed macOS/Windows outputs, a provisioned accepted production key, protected environment/seed/reviewer approval, live workflow execution, native trust, exact oldest floors, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the callable three-job workflow contract. Keep it disconnected and fail closed while accepted production keys, the environment, and seed remain unprovisioned.

E-M4-PROTECTED-MANIFEST-WORKFLOW-LOCAL-001 — Disconnected protected workflow contract passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local implementation atop pushed head 8cf80a0228ffa095beceec018a0de2e237b89e2d; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Static workflow parsing only; no Actions runner, artifact download, accepted production key, GitHub Environment, seed, approval, release, desktop consumer, SSH host, publication, or enabled tuple.
• Focused command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-manifest-signing-workflow.test.mjs — PASS, 1 file / 1 test in 159 ms on the final contract/static-gate rerun (the first green implementation run passed in 169 ms).
• Broad release command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 51 files / 261 tests in 10.23 seconds Vitest / 11.41 seconds wall, 188,825,600-byte maximum RSS, zero swaps.
• Desktop parity/static results: manifest schema/signature/release-asset parity passes 3 files / 48 tests; typecheck, node --check, and workflow/source formatting pass. Full lint passes all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill, and localization gates; all 26 warnings remain in untouched existing files.
• Oracle proved: the reusable interface has only the exact source SHA, tag, timestamp, and protocol inputs plus one required seed secret. Preparation and finalization are credential-free, download six exact artifacts separately, and use 15-minute bounds. The sole five-minute protected job sees no runtime artifacts, references the seed exactly once, and returns only key ID/signature. Final reconstruction independently recollects all six inputs. Actions are SHA-pinned, permissions are read-only, no wildcard merge/continue-on-error/write publication exists, and no release, desktop, or rehearsal workflow calls it.
• Fail-closed provisioning gate: both credential-free stages reference the absent config/ssh-relay-runtime-manifest-accepted-keys.json; the purpose test requires that absence so no placeholder trust root can look provisioned. Consequently the workflow cannot expose a signing request or reach the protected environment until a separately reviewed accepted key is committed. The environment/seed/reviewer restrictions remain external and unprovisioned.
• Does not prove: GitHub accepts/executes the YAML, actual artifact downloads, accepted-key provisioning, environment/tag policy, secret isolation at runtime, approval denial/timeout, signature generation, final output, native trust, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: checkpoint and push the workflow contract, require exact-head PR/native CI, and keep live signing BLOCKED until accepted keys and the protected environment receive separate review.

E-M4-PROTECTED-MANIFEST-WORKFLOW-CI-RED-001 — Ubuntu ARM dependency mirror is unreachable

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 4979bc26c900b83b0f55bab6ebc2b540cde860fc; draft PR #8741.
• Workflow/job: SSH Relay Runtime Artifacts run 29426142423, first Linux arm64 job 87388934005, 15:00:30Z–15:02:29Z.
• Runner/remote/network: GitHub-hosted ubuntu-24.04-arm image 20260706.52.2, runner 2.335.1, image provisioner 20260624.560. This is a native arm64 artifact-build runner with public package egress; no SSH remote, protected environment, signing seed, release, desktop consumer, publication, or enabled tuple.
• Evidence command: gh api repos/stablyai/orca/actions/jobs/87388934005/logs | rg -n -C 2 "Runner Image|Image:|Architecture|System:|ports\\.ubuntu\\.com|Failed to fetch|Unable to fetch|exit code|Process completed".
• Result: expected infrastructure RED. apt-get update could not reach IPv6 or IPv4 endpoints for ports.ubuntu.com; the later build-essential_12.10ubuntu1_arm64.deb fetch timed out and package installation exited 100. Checkout, pnpm setup, Node 24.18.0 setup, and runner identity passed. Source dependency installation and the runtime artifact contract tests were never reached, so no implementation assertion failed and no test count or runtime metric exists for this attempt.
• Oracle proved: the job fails before producing evidence when its package mirror is unavailable; this attempt cannot satisfy the Linux arm64 exact-head cell and must not be treated as a product regression or erased by a replacement run.
• Does not prove: the protected-workflow contract on Linux arm64, artifact construction, baseline smoke, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: rerun only failed job 87388934005, retain this RED alongside the replacement job ID and result, then collect exact purpose-suite counts for every native family plus PR Checks and Golden E2E before closing E-M4-PROTECTED-MANIFEST-WORKFLOW-CI-001.

E-M4-PROTECTED-MANIFEST-WORKFLOW-CI-RED-002 — Isolated Ubuntu ARM rerun reproduces port-80 failure

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: unchanged exact pushed head 4979bc26c900b83b0f55bab6ebc2b540cde860fc; draft PR #8741.
• Workflow/job: isolated attempt 2 of SSH Relay Runtime Artifacts run 29426142423, Linux arm64 replacement job 87392977597, 15:16:05Z–15:20:13Z. Command: gh run rerun --repo stablyai/orca --job 87388934005.
• Runner/remote/network: GitHub-hosted ubuntu-24.04-arm image 20260706.52.2, runner 2.335.1, image provisioner 20260624.560; the same image revision as the first attempt. Public package egress only; no SSH remote, protected environment, signing seed, release, desktop consumer, publication, or enabled tuple.
• Log command: gh api repos/stablyai/orca/actions/jobs/87392977597/logs | rg -n -C 2 "Runner Image|Image:|Version:|ports\\.ubuntu\\.com|Failed to fetch|Unable to fetch|exit code|Process completed".
• Result: infrastructure FAIL after 4 minutes 8 seconds. Ubuntu index acquisition spent about 150 seconds failing http://ports.ubuntu.com:80; the subsequent build-essential fetch also timed out and apt-get exited 100. As in attempt 1, checkout, pnpm, Node 24.18.0, and runner identity passed, while source dependencies and every implementation test were never reached.
• Oracle proved: a same-source isolated rerun does not recover the hosted ARM port-80 path. The workflow currently lacks an authenticated mirror transport plus explicit per-request retry and connection-time bounds; relying only on the 20-minute job timeout wastes runner time and leaves the native proof cell empty.
• Does not prove: that HTTPS is reachable from the hosted runner, the bounded correction, runtime contracts on Linux arm64, native build output, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: add a purpose assertion that fails against the current workflow, then use HTTPS, bounded APT retries/connect timeouts, IPv4 selection, and bounded command settlement for hosted Linux prerequisite acquisition. Require local focused/broad proof and a fresh exact-head native run; keep both infrastructure RED attempts in the ledger.

E-M4-LINUX-PREREQUISITE-TRANSPORT-LOCAL-RED-001 — Hosted Linux package acquisition is unbounded HTTP

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose assertion atop exact pushed head 4979bc26c900b83b0f55bab6ebc2b540cde860fc; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Static workflow YAML parsing only; no APT request, Actions runner, SSH remote, protected environment, release, publication, desktop consumer, or enabled tuple.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected FAIL, 1 file / 1 failed and 6 passed of 7 tests in 180 ms Vitest / 0.86 seconds wall, 131,989,504-byte maximum RSS, 96,196,008-byte peak footprint, zero swaps. The purpose assertion receives only raw sudo apt-get update and install commands: no HTTPS mirror rewrite, retry, per-request connection timeout, IPv4 selection, lock bound, or command settlement bound.
• Oracle proved: the workflow contract permits the exact unbounded port-80 behavior reproduced by both native ARM attempts; the 20-minute job timeout is the only surrounding bound.
• Does not prove: a correction, runner HTTPS reachability, APT execution, runtime contracts, native build output, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the narrowly planned HTTPS and bounded APT acquisition without changing any runtime bytes or product/default behavior.

E-M4-LINUX-PREREQUISITE-TRANSPORT-LOCAL-001 — HTTPS and bounded APT contract passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local correction atop exact pushed head 4979bc26c900b83b0f55bab6ebc2b540cde860fc; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Static YAML and shell syntax validation only; no APT request or Actions runner. No SSH remote, signing credential, protected environment, release, publication, desktop consumer, or enabled tuple.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 1 file / 7 tests in 165 ms Vitest / 0.82 seconds wall, 131,923,968-byte maximum RSS, 96,114,064-byte peak footprint, zero swaps. The first post-implementation run failed only because the new test expected a literal /ubuntu-ports suffix and prohibited the HTTP source string needed by the sed rewrite; the corrected oracle asserts the exact HTTP-to-HTTPS transformation instead.
• Broad release command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 51 files / 262 tests in 11.73 seconds Vitest / 13.70 seconds wall, 189,661,184-byte maximum RSS, zero swaps.
• Desktop parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 1.87 seconds Vitest / 3.49 seconds wall, 132,857,856-byte maximum RSS, 96,998,704-byte peak footprint, zero swaps.
• Static gates: pnpm run typecheck passes. Full pnpm run lint passes all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill, localization catalog/parity, and localization coverage gates; all 26 warnings remain in untouched existing files. Parsed install-step shell source passes bash -n; focused five-file oxfmt --check and git diff --check pass.
• Oracle proved: Ubuntu ports, archive, security, and Azure archive domains are rewritten from HTTP to HTTPS before APT. Both update and install use three retries, 15-second HTTP/HTTPS connection timeouts, forced IPv4, a 60-second package-lock wait, a 180-second TERM bound, and a 15-second KILL settlement. Nonzero exit or exhaustion still aborts the native job under set -euo pipefail. Runtime construction, signing, release, desktop, SSH, and product/default paths are unchanged.
• Does not prove: HTTPS reachability or package installation on GitHub Linux x64/arm64, exact-head Node 24 execution, artifact construction, native smoke, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: checkpoint and push, then require fresh exact-head Linux x64/arm64 plus all other native contracts, PR Checks, and Golden E2E. Retain both port-80 RED attempts in the final evidence.

E-M4-LINUX-PREREQUISITE-HTTPS-CI-RED-001 — ARM runner cannot reach bounded HTTPS mirror

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head c9ffa26a90751fb0941e44066c36722d9c6ee49d; draft PR #8741.
• Workflow/job: SSH Relay Runtime Artifacts run 29428082375, Linux arm64 job 87395626746, 15:26:30Z–15:30:10Z.
• Runner/remote/network: GitHub-hosted ubuntu-24.04-arm image 20260706.52.2, runner 2.335.1, image provisioner 20260624.560; the same image revision as both port-80 REDs. Public package egress only; no SSH remote, protected environment, signing seed, release, desktop consumer, publication, or enabled tuple.
• Log command: gh api repos/stablyai/orca/actions/jobs/87395626746/logs | rg -n -C 3 "Runner Image|Image:|Version:|https://ports\\.ubuntu\\.com|Ign:|Err:|Failed to fetch|exit code 124|Process completed|Terminated".
• Result: expected CI RED. The HTTP-to-HTTPS source rewrite executes, then bounded APT update reaches its 180-second TERM limit and 15-second KILL settlement; the job exits 124 after 3 minutes 40 seconds. Source dependencies and every implementation test are never reached. In the same run, Linux x64 job 87395626849 crosses the identical prerequisite step and proceeds to runtime build.
• Oracle proved: the command-level settlement correction works and materially reduces the previous unbounded wait, but HTTPS is not a sufficient availability assumption for this hosted ARM image. Always contacting the mirror is unnecessary when the runner already contains the required compiler and verification primitives.
• Does not prove: which required commands are preinstalled, compiler/linker execution, the capability-first refinement, implementation tests on Linux arm64, artifact construction, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: require exact command presence, CA roots, and executable C/C++ compile/link/run probes before skipping APT; keep the bounded HTTPS path only for genuinely missing prerequisites. Add a purpose RED first and require a fresh exact-head native run after local proof.

E-M4-LINUX-PREREQUISITE-CAPABILITY-LOCAL-RED-001 — Capability-first gate is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose assertion atop exact pushed head c9ffa26a90751fb0941e44066c36722d9c6ee49d; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Static workflow YAML parsing only; no Linux compiler, APT request, Actions runner, SSH remote, protected environment, release, publication, desktop consumer, or enabled tuple.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected FAIL, 1 file / 1 failed and 6 passed of 7 tests in 185 ms Vitest / 0.85 seconds wall, 131,629,056-byte maximum RSS, 95,851,968-byte peak footprint, zero swaps. The sole failure shows no required-command list, CA-root gate, missing-requirements branch, or C/C++ probe; APT is always invoked.
• Oracle proved: the workflow cannot use a complete preinstalled runner toolchain while package mirrors are unavailable and therefore repeats a network dependency that is not inherently needed for every build.
• Does not prove: implementation, actual preinstalled capabilities, native compile/link/execute, APT fallback, artifact construction, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement the exact capability gate and preserve fail-closed bounded fallback for any missing or broken prerequisite.

E-M4-LINUX-PREREQUISITE-CAPABILITY-LOCAL-001 — Capability probes and conditional fallback pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local correction atop exact pushed head c9ffa26a90751fb0941e44066c36722d9c6ee49d; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Static YAML and shell syntax only; native Linux probe execution remains CI evidence. No APT request, SSH remote, protected environment, signing seed, release, publication, desktop consumer, or enabled tuple.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs plus parsed install-step bash -n — PASS, 1 file / 7 tests in 196 ms Vitest / 0.83 seconds wall, 131,923,968-byte maximum RSS, 96,130,472-byte peak footprint, zero swaps. The subsequent stronger order assertions also pass inside the broad suite.
• Broad release command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 51 files / 262 tests in 11.17 seconds Vitest / 13.03 seconds wall, 188,973,056-byte maximum RSS, zero swaps.
• Desktop parity: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-schema.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts src/main/ssh/ssh-relay-release-asset.test.ts — PASS, 3 files / 48 tests in 1.47 seconds Vitest / 2.97 seconds wall, 131,809,280-byte maximum RSS, 95,917,312-byte peak footprint, zero swaps.
• Static gates: pnpm run typecheck passes. Full pnpm run lint passes all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill, localization catalog/parity, and localization coverage gates; all 26 warnings remain in untouched existing files.
• Oracle proved: command presence covers cc, c++, make, ar, ld, strip, curl, gpg, gpgv, python3, and xz, plus the system CA root. Native C and C++ source is compiled, linked, and executed before APT may be skipped. Any absent command, CA root, or failed toolchain probe enters the bounded HTTPS branch; final command, CA, and both executable probes run again after any fallback. Temporary probe files are removed on every exit. Nonzero probe/install status aborts the job under set -euo pipefail.
• Does not prove: actual command availability or probe execution on GitHub Linux x64/arm64, conditional APT avoidance, exact-head Node 24 tests, artifact construction, signing, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: checkpoint and push, then require fresh exact-head Linux x64/arm64 proof plus all other native contracts, PR Checks, and Golden E2E. Retain all three mirror REDs and the bounded-settlement result.

E-M4-LINUX-PREREQUISITE-CAPABILITY-CI-001 — Native Linux capability gates avoid unavailable mirrors

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head bb4b527e4ea030cbd94f11ca9b6e284900ab8c8a; draft PR #8741.
• Workflow/jobs: SSH Relay Runtime Artifacts run 29428772206, 15:35:38Z–15:49:34Z. Linux x64 job 87398040874 passes in 4m39s; Linux arm64 job 87398040969 passes in 4m14s.
• Runner/remote/network: GitHub-hosted Ubuntu 24.04.4, runner 2.335.1. X64 uses ubuntu-24.04 image 20260714.240.1, provisioner 20260707.563, Azure westus; arm64 uses ubuntu-24.04-arm image 20260706.52.2, provisioner 20260624.560, Azure northcentralus. There is no SSH remote, protected environment, signing seed, release, desktop consumer, publication, or enabled tuple.
• Log command: gh run view 29428772206 --repo stablyai/orca --log followed by job-scoped rg for runner identity, prerequisite-step boundaries, missing Linux prerequisites, test counts, and durations.
• Result: PASS. The x64 gate runs from 15:36:34.048Z until the next step at 15:36:38.449Z; arm64 runs from 15:36:22.134Z until the next step at 15:36:26.177Z. In each complete job log, the exact text missing Linux prerequisites appears only once in the echoed shell source and never as runtime output, so neither runner enters APT. Native C and C++ compile/link/execute probes, final revalidation, dependency installation, both clean runtime builds, exact equality, bundled Node, PTY/watcher smoke, metadata, aggregate-ready finalization, and artifact upload all pass.
• Contract counts: each Linux job passes 50 files / 258 tests. Vitest duration is 8.12s on x64 and 6.42s on arm64. Both Linux oldest-userland supplements pass: arm64 job 87399667498 in 1m05s and x64 job 87399667523 in 52s.
• Adjacent exact-head evidence: macOS x64 job 87398040917 passes in 6m21s (50 files / 258 tests, 28.75s Vitest), macOS arm64 job 87398040906 passes in 3m30s (50 / 258, 7.71s), Windows x64 job 87398040936 passes in 5m10s (51 files / 252 passed plus 10 skipped of 262, 11.49s), and Windows arm64 job 87398041157 passes in 9m17s (51 / 252 plus 10 skipped, 13.70s). Windows x64 floor job 87400400656 passes in 2m11s. Windows arm64 floor job 87400400701 executes the runtime successfully and then fails exactly because hosted build 26200 is not the required build 26100.
• Oracle proved: both GitHub Linux architectures possess and can execute the declared compiler, linker, archive, strip, crypto, download, Python, XZ, and CA capabilities without package egress; unavailable mirrors no longer block a complete native artifact job. A genuinely absent or broken capability still enters the bounded HTTPS fallback and fails closed if installation cannot settle.
• Does not prove: the missing-capability APT success branch, Linux kernel 4.18, native signing/trust, protected manifest signing, release publication/read-back, desktop embedding, SSH transfer/install, packaged RPC behavior, performance against legacy, or any enabled tuple.

E-M4-PROTECTED-MANIFEST-WORKFLOW-CI-001 — Protected workflow source contract passes all six native jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source and jobs: exact pushed head bb4b527e4ea030cbd94f11ca9b6e284900ab8c8a in artifact run 29428772206; build jobs 87398040874, 87398040969, 87398040917, 87398040906, 87398040936, and 87398041157.
• Native runners: Linux x64 ubuntu-24.04 image 20260714.240.1; Linux arm64 ubuntu-24.04-arm 20260706.52.2; macOS x64 macos-15 20260629.0276.1 on macOS 15.7.7; macOS arm64 macos-15-arm64 20260706.0213.1 on macOS 15.7.7; Windows x64 windows-2022 20260706.237.1 on Windows Server 2022 build 20348; Windows arm64 windows-11-arm64 20260706.102.1 on Windows 11 build 26200. Every job uses runner 2.335.1 and Node 24.18.0.
• Result: PASS. config/scripts/ssh-relay-runtime-manifest-signing-workflow.test.mjs passes 1/1 on Linux x64 in 44ms, Linux arm64 in 27ms, macOS x64 in 67ms, macOS arm64 in 15ms, Windows x64 in 45ms, and Windows arm64 in 30ms. The all-six broad counts and durations are recorded in E-M4-LINUX-PREREQUISITE-CAPABILITY-CI-001.
• Adjacent exact-head workflows: PR Checks run 29428772127, job 87398002184, passes 15:35:42Z–15:49:26Z. Golden E2E run 29428772389 passes Linux job 87398002948 and macOS job 87398003007.
• Oracle proved: the callable workflow YAML parses identically on every target-native runner family; accepts only the four exact inputs and one required seed; downloads six explicit artifacts in both credential-free stages; exposes no runtime artifacts to the signer; exposes the seed only to the environment-gated signer; accepts only the signature result; uses SHA-pinned actions and strict job bounds; omits write permissions and publication commands; has no accepted-key placeholder; and remains disconnected from release-cut, macOS release, and native-signing rehearsal consumers.
• Does not prove: workflow-call execution, environment/tag/reviewer policy, seed availability or secrecy at runtime, approval denial/timeout, a real signature, accepted production keys, native signing/trust, aggregate artifact passage, publication/read-back, desktop embedding, SSH behavior, or any enabled tuple. Those gates remain open and fail closed.

E-M4-DRAFT-UPLOAD-LOCAL-RED-001 — Bounded immutable draft uploader is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose suite atop exact pushed head 9b83971866cd5f7fc71de20a3e09ab2a120e01bd; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Local temporary files and injected responses only; no GitHub request, release write, credential, signing service, SSH remote, desktop consumer, publication, or enabled tuple.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-upload.test.mjs.
• Result: expected RED. The one suite fails before collecting tests because ssh-relay-runtime-draft-upload.mjs does not exist. Vitest reports 143ms; wall time is 0.90s, maximum RSS 131,727,360 bytes, peak footprint 95,819,008 bytes, and zero swaps.
• Oracle proved: the worktree has immutable stage, recovery-planning, and read-back contracts but no executable boundary that hashes local files, authenticates exact-draft metadata, safely uploads missing bytes, or reconciles an uncertain POST before retry.
• Does not prove: implementation, real GitHub behavior, a release write, retry settlement, partial draft recovery, read-back, archive execution, publication, desktop embedding, SSH behavior, or an enabled tuple.

E-M4-DRAFT-UPLOAD-LOCAL-001 — Exact-byte upload and partial-draft recovery pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: implementation commits 8d9013cd106734ecd979f785b515dd9640841330 and b37cacecf8f1c865f09c118f274ab62302e951ad; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. Local temporary files and injected GitHub API/upload/CDN responses only. No network request, real token, release write, signer, protected environment, SSH remote, desktop consumer, publication, or enabled tuple.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-upload.test.mjs — PASS, 1 file / 8 tests in 183ms Vitest and 0.87s wall, with 131,694,592-byte maximum RSS, 95,868,280-byte peak footprint, and zero swaps.
• Adjacent release command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-upload.test.mjs config/scripts/ssh-relay-runtime-draft-recovery.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 5 files / 46 tests in 1.80s Vitest and 3.44s wall, with 131,940,352-byte maximum RSS, 96,179,648-byte peak footprint, and zero swaps.
• Broad release command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 52 files / 270 tests in 11.71s Vitest and 13.66s wall, with 188,841,984-byte maximum RSS and zero swaps.
• Static gates: node --check passes both new files. pnpm run typecheck passes. Full pnpm run lint passes all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill verification, localization catalog/parity, and localization coverage; all 26 warnings remain in untouched existing files. Focused oxfmt --check and git diff --check pass.
• Oracle proved: only bounded regular files with exact declared name, path, size, SHA-256, per-file size, aggregate size, and count may enter. The release must remain the exact ID/tag draft, and its authenticated lightweight or recursively peeled annotated tag must resolve to the exact 40-hex source commit; target_commitish is not trusted because existing-tag release creation does not reliably preserve that SHA there. Existing managed assets are reused only after authenticated metadata and complete downloaded-byte verification; only an approved HTTPS CDN redirect drops authorization. Missing assets upload as bounded streams with exact length and content type. Retryable 408/429/5xx or transport ambiguity is reconciled against downloaded draft bytes before another POST, every retry re-hashes the local file, three-attempt exhaustion fails closed, non-retryable authorization failure does not retry, cancellation settles, and partial drafts recover without replacing exact already uploaded bytes. The capability has no command-line entrypoint or workflow caller.
• Does not prove: Node 24 or Windows execution, live GitHub API/upload/CDN behavior, a real token or release write, rate-limit timing, full-size artifact throughput/memory, final authenticated read-back, downloaded archive execution, release publication, native signing/trust, desktop embedding, SSH transfer/install, packaged RPC behavior, performance against legacy, or an enabled tuple.
• Follow-up: checkpoint and push, then require exact-head syntax and eight-test execution on all six native artifact jobs plus PR Checks and Golden E2E. Retain all production/default disconnections.

E-M4-DRAFT-UPLOAD-CI-001 — Draft upload/recovery passes all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head b37cacecf8f1c865f09c118f274ab62302e951ad; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29431510990, 16:13:32Z–16:30:34Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful runtime execution.
• Native build jobs and durations:
  • Darwin x64 job 87407470012, macos-15 image 20260629.0276.1, runner 2.335.1, Azure westus, 16:13:52Z–16:20:58Z, PASS in 7m06s.
  • Darwin arm64 job 87407470027, macos-15-arm64 image 20260706.0213.1, runner 2.335.1, Azure westus, 16:13:50Z–16:17:32Z, PASS in 3m42s.
  • Linux arm64 job 87407470041, ubuntu-24.04-arm image 20260706.52.2, runner 2.335.1, Azure northcentralus, 16:13:53Z–16:18:11Z, PASS in 4m18s.
  • Windows x64 job 87407470042, windows-2022 image 20260706.237.1, runner 2.335.1, Azure westus, 16:13:51Z–16:19:32Z, PASS in 5m41s.
  • Linux x64 job 87407470091, ubuntu-24.04 image 20260714.240.1, runner 2.335.1, Azure westus3, 16:13:50Z–16:17:27Z, PASS in 3m37s.
  • Windows arm64 job 87407470316, windows-11-arm64 image 20260706.102.1, runner 2.335.1, Azure northcentralus, 16:13:51Z–16:24:34Z, PASS in 10m43s.
• Exact uploader suite: config/scripts/ssh-relay-runtime-draft-upload.test.mjs passes 8/8 under Node 24.18.0 on every native job: Darwin x64 260ms, Darwin arm64 51ms, Linux arm64 78ms, Windows x64 151ms, Linux x64 89ms, and Windows arm64 192ms.
• Broad contract counts: every POSIX job passes 51 files / 266 tests; Vitest durations are Darwin x64 24.06s, Darwin arm64 8.27s, Linux arm64 6.59s, and Linux x64 6.43s. Each Windows job passes 52 files / 260 tests plus 10 platform skips of 270; x64 takes 12.74s and arm64 17.32s.
• Downstream evidence: Linux arm64 supplement job 87409169300 passes in 54s; Linux x64 supplement 87409169317 passes in 51s; Windows x64 floor job 87410005329 passes in 1m27s. Windows arm64 floor job 87410005404 uses windows-11-arm64 image 20260714.109.1, executes the artifact successfully in 7,752.6288ms with 49,684,480-byte RSS, and then fails exactly because OS/kernel build 26200 is not required floor 26100.
• Adjacent exact-head workflows: PR Checks run 29431510764, job 87407413500, passes 16:13:36Z–16:29:15Z, including lint, typecheck, Git compatibility, tests, unpacked build, and packaged CLI smoke. Golden E2E run 29431510883 passes Linux job 87407414410 and macOS job 87407414424.
• Oracle proved: the uploader module, tests, and POSIX/PowerShell workflow wiring parse and execute consistently on all six native Node 24 runner families. Every family exercises regular-file hashing, exact draft/tag/source binding including annotated-tag peeling, authenticated redirect isolation, exact reuse, uncertain-POST reconciliation, retry exhaustion, mutation detection, authorization failure, cancellation, and partial-draft recovery. Full native artifact construction and adjacent regressions remain green.
• Does not prove: live GitHub API/upload/CDN behavior, a real token or release write, full-size upload throughput/memory, a real retry/429, final read-back, downloaded archive execution, publication, native signing/trust, oldest macOS/Linux kernel/Windows arm64 floor, desktop embedding, SSH transfer/install, packaged RPC behavior, performance against legacy, or any enabled tuple.
• Checklist items satisfied: exact-head all-six CI gate for the disconnected draft upload/recovery capability. The broader draft upload/read-back/execution and Work Package 3 boxes remain open.

E-M4-RELEASE-ASSETS-LOCAL-RED-001 — Relay-specific release required-asset gate is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named test config/scripts/ssh-relay-runtime-release-assets.test.mjs; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. No network request, credential, release write, signer, protected environment, SSH remote, desktop consumer, publication, or enabled tuple.
• Command:
  • /usr/bin/time -l pnpm exec vitest run config/scripts/ssh-relay-runtime-release-assets.test.mjs
• Result: expected FAIL, one suite / zero imported tests, 200ms Vitest and 0.97s wall. Maximum RSS 132,022,272 bytes; peak memory footprint 95,950,176 bytes.
• Failure oracle: Vitest reports only Cannot find module './ssh-relay-runtime-release-assets.mjs' at the purpose-named import. No production module existed that derived exact archive/SBOM/ provenance/manifest/signature coverage from an already verified signed manifest and compared it with authenticated draft metadata.
• Does not prove: implementation correctness, exact tag/channel closure, managed-asset closure, upload state/size enforcement, signature-asset binding, native runner behavior, real GitHub metadata, read-back byte identity, publication, desktop embedding, SSH behavior, or an enabled tuple.
• Follow-up: implement only the disconnected metadata gate, retain the detached-signature encoding decision and existing desktop release gate unchanged, then run the focused GREEN and broader local regressions before adding native test-job integration.

E-M4-RELEASE-ASSETS-LOCAL-001 — Exact signed-manifest release coverage passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted config/scripts/ssh-relay-runtime-release-assets.mjs, its purpose-named test, and POSIX/Windows native test-job wiring atop exact pushed head 88a77eee91a34f8936882d096e568f499e9160e6; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. In-memory manifest and authenticated-release-metadata fixtures only. No network request, credential, release write, signer, protected environment, SSH remote, desktop consumer, publication, or enabled tuple.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-release-assets.test.mjs — PASS, one file / 13 tests in 203ms Vitest and 0.92s wall; maximum RSS 152,403,968 bytes, peak footprint 96,114,064 bytes, and zero swaps.
• Adjacent release command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-release-assets.test.mjs config/scripts/ssh-relay-runtime-draft-upload.test.mjs config/scripts/ssh-relay-runtime-draft-recovery.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs config/scripts/verify-release-required-assets.test.mjs — PASS, 7 files / 64 tests in 988ms Vitest and 1.72s wall; maximum RSS 135,806,976 bytes, peak footprint 95,802,744 bytes, and zero swaps.
• Broad release command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 53 files / 283 tests in 9.97s Vitest and 10.94s wall; maximum RSS 189,071,360 bytes and zero swaps.
• Static gates: node --check passes both new files. pnpm run typecheck passes. pnpm run lint passes all 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill verification, localization catalog/parity, and localization coverage; all 26 warnings remain in untouched existing files. Focused oxfmt --check and git diff --check pass. The protected Node/npm resolver files and existing verify-release-required-assets.mjs plus its tests have zero diff.
• Oracle proved: the pure gate accepts only an exact release ID and stable/RC/perf tag whose authenticated metadata remains a draft with channel-correct prerelease state. It revalidates the already-verified signed-manifest schema, derives every tuple archive/SBOM/provenance plus exact manifest/signature descriptors, bounds count/per-file/aggregate sizes, and requires unique managed names. The opaque detached-signature descriptor must bind the exact manifest SHA-256 and exact embedded signer key IDs without deciding its byte encoding. Missing, unexpected managed, duplicate, non-uploaded, empty, wrong-size, malformed, signature-disagreeing, cross-release, cross-tag, and cross-channel states fail closed; unrelated desktop assets remain untouched.
• Consumer-disconnection oracle: repository search finds the new production module only in its own focused test and POSIX/Windows artifact-job syntax checks; only the test file is executed. There is no CLI entrypoint, API fetch, release-cut/default workflow caller, upload, publication, desktop consumer, tuple enablement, or change to the legacy SSH path.
• Does not prove: Node 24/native-runner behavior, real authenticated GitHub metadata, cryptographic verification before envelope construction, final detached-signature byte encoding, byte read-back, downloaded archive execution, a real release draft/write, native signing/trust, publication, desktop embedding, SSH transfer/install, performance against legacy, or any enabled tuple.
• Checklist items satisfied: local implementation gate for the disconnected relay-specific required-asset capability. The broader Milestone 4 release composition/publication box remains open.
• Follow-up: commit and push the exact package, then require syntax and 13-test execution on all six exact-head native Node 24 jobs plus PR Checks and Golden E2E. Keep every production/default consumer disconnected.

E-M4-RELEASE-ASSETS-CI-001 — Required-asset gate passes all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 5460563ff48846cbf54218860fdca1cc3c7b8614; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29433808457, 16:46:33Z–17:00:13Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful runtime execution.
• Native build jobs, runner 2.335.1 throughout:
  • Darwin arm64 job 87415257002, macos-15-arm64 image 20260706.0213.1, PASS in 5m12s.
  • Windows x64 job 87415257023, windows-2022 image 20260714.244.1, PASS in 8m37s.
  • Linux arm64 job 87415257044, ubuntu-24.04-arm image 20260714.61.1, PASS in 4m24s.
  • Linux x64 job 87415257081, ubuntu-24.04 image 20260714.240.1, PASS in 3m54s.
  • Darwin x64 job 87415257094, macos-15 image 20260629.0276.1, PASS in 5m33s.
  • Windows arm64 job 87415257120, windows-11-arm64 image 20260706.102.1, PASS in 9m30s.
• Exact required-asset suite: config/scripts/ssh-relay-runtime-release-assets.test.mjs passes 13/13 under Node 24.18.0 on every native job: Darwin arm64 26ms, Windows x64 41ms, Linux arm64 31ms, Linux x64 66ms, Darwin x64 66ms, and Windows arm64 38ms.
• Broad contract counts: every POSIX job passes 52 files / 279 tests; durations are Darwin arm64 15.51s, Linux arm64 6.18s, Linux x64 8.05s, and Darwin x64 27.03s. Each Windows job passes 53 files / 273 tests plus 10 platform skips of 283; x64 takes 25.34s and arm64 14.83s.
• Downstream evidence: Linux x64 supplement job 87416554990 passes in 43s; Linux arm64 supplement 87416555037 passes in 50s; Windows x64 floor job 87417454621 passes in 1m35s. Windows arm64 floor job 87417454470 uses windows-11-arm64 image 20260706.102.1, executes bundled Node 24.18.0 and native PTY/watcher smoke in 7,936.874ms with 49,553,408-byte RSS, and then fails exactly because OS/kernel build 26200 is not the required floor 26100.
• Adjacent exact-head workflows: PR Checks run 29433808934, job 87415230751, passes 16:46:37Z–17:01:03Z including lint, typecheck, Git compatibility, tests, unpacked app build, and packaged CLI smoke. Golden E2E run 29433808372 passes Linux job 87415226359 and macOS job 87415226314.
• Oracle proved: the pure required-asset module, purpose-named tests, and POSIX/PowerShell syntax/test wiring parse and execute consistently on all six native Node 24 runner families. Every family covers exact stable/RC/perf identity, manifest-derived managed closure, manifest and opaque signature binding, uploaded/nonempty/exact-size metadata, extra/missing/duplicate rejection, and zero network use. Full target-native runtime construction and adjacent product regressions remain green.
• Does not prove: real authenticated GitHub metadata, cryptographic verification before envelope construction, final detached-signature byte encoding, real release upload/materialization, read-back archive execution, a release write, publication, native signing/trust, oldest macOS/ Linux kernel/Windows arm64 floor, desktop embedding, SSH transfer/install, performance against legacy, or any enabled tuple.
• Checklist items satisfied: exact-head all-six CI gate for the disconnected relay-specific required-asset capability. Release composition/publication remains open.
• Follow-up: checkpoint and push this evidence, then begin the disconnected authenticated draft read-back materialization RED. Retain all production/default disconnections.

E-M4-DRAFT-READBACK-MATERIALIZATION-LOCAL-RED-001 — Transactional materialization entrypoint is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Worktree head before implementation: 16edb7e755d35eeec561adbfff07587f5fc0bdf2; draft PR #8741. The working tree contains only the session-checkpoint update, purpose-named RED test, and POSIX/Windows native-job test wiring.
• Command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-draft-readback-materialization.test.mjs
• Result: expected FAIL in 0.862s; 1 file / 4 tests fail only because materializeSshRelayRuntimeDraftReadback is not a function. The existing verification-only entrypoint remains present and unchanged.
• Contract pinned by the RED: one existing authenticated streamed download must persist exact bytes; partial bytes cannot use the final asset name; the output directory must be absent beneath an existing real parent before any GitHub request; a later asset failure or cancellation must remove the entire output; success must return exact bounded asset paths.
• Does not prove: implementation, local GREEN, Node 24/native-runner portability, real authenticated GitHub bytes, archive execution, release write/publication, desktop consumption, native trust, SSH transfer/install, performance, or any enabled tuple.
• Follow-up: implement the new materialization entrypoint by sharing the existing bounded download and hash pass. Preserve the verification-only API and every production/default disconnection.

E-M4-DRAFT-READBACK-MATERIALIZATION-LOCAL-001 — One-pass verified materialization passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted implementation and purpose-named test atop exact pushed head 16edb7e755d35eeec561adbfff07587f5fc0bdf2; draft PR #8741.
• Runner/remote/network: local macOS 26.2 arm64, Node v26.0.0 and pnpm 10.24.0. In-memory authenticated release/asset response fixtures and local temporary files only. No real network, credential, release write, signer, protected environment, SSH remote, desktop consumer, publication, or enabled tuple.
• First implementation command: node --check config/scripts/ssh-relay-runtime-draft-readback.mjs && node --check config/scripts/ssh-relay-runtime-draft-readback-materialization.test.mjs && pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-draft-readback-materialization.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs — expected correction signal: 1 failed / 13 passed because the test expected macOS's logical /var alias while the security boundary correctly returned physical /private/var. The test now derives the physical parent with realpath; no production path check was weakened.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-readback-materialization.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs — PASS, 2 files / 14 tests in 739ms Vitest and 2.16s wall; maximum RSS 132,464,640 bytes, peak footprint 96,703,936 bytes, and zero swaps.
• Adjacent release command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-readback-materialization.test.mjs config/scripts/ssh-relay-runtime-draft-readback.test.mjs config/scripts/ssh-relay-runtime-draft-upload.test.mjs config/scripts/ssh-relay-runtime-draft-recovery.test.mjs config/scripts/ssh-relay-runtime-release-stage-gate.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs config/scripts/ssh-relay-runtime-release-assets.test.mjs config/scripts/verify-release-required-assets.test.mjs — PASS, 8 files / 68 tests in 2.02s Vitest and 3.52s wall; maximum RSS 132,612,096 bytes, peak footprint 96,802,168 bytes, and zero swaps.
• Broad release command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 54 files / 287 tests in 10.73s Vitest and 11.98s wall; maximum RSS 189,743,104 bytes and zero swaps.
• Static gates: node --check passes the production module and purpose-named test. /usr/bin/time -l pnpm run typecheck passes in 2.83s wall with 1,257,357,312-byte maximum RSS and zero swaps. /usr/bin/time -l pnpm run lint passes in 10.78s wall with 2,021,834,752-byte maximum RSS and zero swaps; all 41 reliability gates and the 355-entry max-lines ratchet pass, and the existing 26 unrelated warnings remain. Focused oxfmt --check and git diff --check pass.
• Oracle proved: the output must be absent below an existing physical parent before any GitHub request. Each authenticated response is streamed once into an exclusive temporary file while the existing size and SHA-256 pass runs; the file is synced and final names are published only after every asset verifies. A later asset failure or mid-stream cancellation removes the entire output. Success returns only the bounded validated assets with exact physical paths. The verification-only API remains byte-for-byte compatible at its return boundary and its 10-test suite stays green.
• Consumer-disconnection oracle: repository search finds the new entrypoint only in its purpose-named test; both native artifact job families perform syntax and test execution only. There is no CLI, workflow caller, archive execution, release API write, publication, desktop consumer, tuple enablement, or production/default behavior change. The protected Node/npm resolver files and existing desktop required-asset gate retain zero diff.
• Does not prove: Node 24/native-runner behavior, real authenticated GitHub bytes, detached-signature encoding, downloaded archive execution, real release write/publication, native signing/trust, oldest OS floors, desktop embedding, SSH transfer/install, performance against legacy, or any enabled tuple.
• Follow-up: commit and push the exact package, then require syntax and 4-test materialization execution plus the full contract/runtime construction on all six exact-head native Node 24 jobs. Keep every production/default consumer disconnected.

E-M4-DRAFT-READBACK-MATERIALIZATION-CI-001 — Verified materialization passes all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 0fbbac118e08a17f8263ad48f116a8d61362fe92; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29435837082, 17:16:47Z–17:30:29Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful exact-byte runtime execution.
• Native build jobs, runner 2.335.1 throughout:
  • Linux x64 job 87422172377, ubuntu-24.04 image 20260714.240.1, PASS in 4m21s.
  • Darwin arm64 job 87422172403, macos-15-arm64 image 20260706.0213.1, PASS in 3m41s.
  • Windows x64 job 87422172406, windows-2022 image 20260714.244.1, PASS in 6m13s.
  • Linux arm64 job 87422172462, ubuntu-24.04-arm image 20260706.52.2, PASS in 4m28s.
  • Windows arm64 job 87422172494, windows-11-arm64 image 20260714.109.1, PASS in 9m27s.
  • Darwin x64 job 87422172522, macos-15 image 20260629.0276.1, PASS in 4m48s.
• Exact materialization suite: config/scripts/ssh-relay-runtime-draft-readback-materialization.test.mjs passes 4/4 under Node 24.18.0 on every native job: Linux x64 328ms, Darwin arm64 168ms, Windows x64 264ms, Linux arm64 181ms, Windows arm64 260ms, and Darwin x64 237ms.
• Broad contract counts: every POSIX job passes 53 files / 283 tests; durations are Linux x64 7.17s, Darwin arm64 10.73s, Linux arm64 5.79s, and Darwin x64 17.35s. Each Windows job passes 54 files / 277 tests plus 10 platform skips of 287; x64 takes 16.25s and arm64 16.55s.
• Downstream evidence: Linux x64 supplement job 87423276409 passes in 32s; Linux arm64 supplement job 87423276419 passes in 1m10s. Windows x64 floor job 87424346586 passes on Server 2022 build 20348 in 2m17s; bundled runtime smoke takes 5,368.7141ms with 49,999,872-byte RSS. Windows arm64 floor job 87424346592 uses windows-11-arm64 image 20260714.109.1, executes bundled Node 24.18.0 and native PTY/watcher smoke in 6,121.6774ms with 48,623,616-byte RSS, and then fails exactly because observed OS/kernel build 26200 is not the required floor 26100.
• Adjacent exact-head workflows: PR Checks run 29435836210, job 87422140840, passes 17:16:50Z–17:27:52Z including lint, typecheck, Git compatibility, tests, unpacked app build, and packaged CLI smoke. Golden E2E run 29435835950 passes macOS job 87422139557 and Linux job 87422139620.
• Oracle proved: the purpose-named materialization suite and POSIX/PowerShell syntax/test wiring parse and execute consistently on all six native Node 24 runner families. Every family proves one-pass streamed persistence, exclusive physical output, temporary-only partial bytes, final-name exposure only after complete verification, whole-output cleanup after later failure, mid-stream cancellation settlement, exact physical returned paths, and unchanged verification-only behavior. Full target-native runtime construction and adjacent product regressions remain green.
• Consumer-disconnection oracle: both native workflow families execute only the contract test. There is no CLI, release write, production workflow caller, publication, archive execution, desktop consumer, SSH transfer/install, tuple enablement, or default behavior change.
• Does not prove: a real authenticated GitHub response or full-size network transfer, detached- signature encoding, downloaded archive execution, real release write/publication, native signing/ trust, oldest macOS/Linux-kernel/Windows-arm64 floors, desktop embedding, SSH transfer/install, performance against legacy, or any enabled tuple.
• Checklist items satisfied: exact-head all-six CI gate for disconnected authenticated read-back materialization. The broader real draft upload/read-back/execution and release composition boxes remain open.
• Follow-up: checkpoint this evidence, then begin the purpose-named disconnected downloaded-archive execution RED. Retain all production/default disconnections.

E-M4-READBACK-ARCHIVE-EXECUTION-LOCAL-RED-001 — Materialized archive execution boundary is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Worktree head before implementation: local evidence commit 94d9ee9cb90e4bffd2dafc5b7e8e532d197f70d0 atop pushed code head 0fbbac118e08a17f8263ad48f116a8d61362fe92; draft PR #8741. The worktree contains only the purpose-named RED and POSIX/Windows native-job syntax/test wiring.
• Command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-readback-archive-execution.test.mjs
• Result: expected FAIL in 0.749s; one suite / zero collected tests because ssh-relay-runtime-readback-archive-execution.mjs does not exist.
• Contract pinned by the RED: accept only an exact four-field materialized archive descriptor whose physical absolute path, name, size, and SHA-256 match the verified tuple identity; invoke existing exclusive extraction before bundled Node/native PTY/watcher verification; reject returned tuple/ content identity drift; remove the extracted runtime after smoke failure, cancellation, or result mismatch.
• Does not prove: implementation, local GREEN, real archive extraction or native execution, Node 24/ native-runner portability, a real authenticated GitHub response, full-size network transfer, real release write/publication, desktop/SSH behavior, or any enabled tuple.
• Follow-up: implement only the disconnected composition boundary and signal propagation into the existing bundled runtime verifier. Preserve all production/default disconnections.

E-M4-READBACK-ARCHIVE-EXECUTION-LOCAL-001 — Exact archive composition and native execution pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted implementation atop local evidence head 94d9ee9cb90e4bffd2dafc5b7e8e532d197f70d0; draft PR #8741. Local runner is macOS 26.2 build 25C56 arm64, Node v26.0.0, and pnpm 10.24.0.
• First full-size correction signal: gh run download 29435837082 --repo stablyai/orca --name ssh-relay-runtime-darwin-arm64 followed by /usr/bin/time -l node config/scripts/ssh-relay-runtime-readback-archive-execution.mjs --identity <identity> --archive <archive> --output-directory <output> correctly failed before extraction in 0.08s with requires a physical materialized path. macOS exposed the Actions artifact through lexical /var while its physical parent is /private/var. The CLI adapter now calls realpath before constructing the exact materialized descriptor; the core physical-path check was not weakened. A cross-platform directory-alias/junction test pins the correction.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-readback-archive-execution.test.mjs config/scripts/ssh-relay-runtime-archive-extraction.test.mjs config/scripts/ssh-relay-runtime-pty-smoke.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 4 files / 21 tests in 426ms Vitest and 1.15s wall; maximum RSS 131,776,512 bytes and zero swaps.
• Adjacent command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the execution, extraction, materialization, verification-only read-back, upload, recovery, release-stage, workflow, release-assets, and protected required-assets suites — PASS, 10 files / 80 tests in 1.83s Vitest and 2.65s wall; maximum RSS 131,760,128 bytes and zero swaps.
• Broad command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 55 files / 297 tests in 14.19s Vitest and 15.20s wall; maximum RSS 191,299,584 bytes and zero swaps.
• Real archive command: download unpublished artifact ssh-relay-runtime-darwin-arm64 from exact- head artifact run 29435837082, then execute the purpose-named CLI with its identity, archive, and an exclusive temporary output. PASS: the 24,747,276-byte archive reconstructs 122,027,869 bytes, 50 entries, and 35 files at content ID sha256:40ff5d2036784b794e7b09f78596409f63f3145280c530bece5280d40897f6cb; bundled Node v24.18.0, modules ABI 137, node-pty input/resize/exit 23, and watcher create/update/delete/rename smoke all pass. Verification/smoke takes 2,975.938625ms; the full command takes 5.16s wall with 364,691,456-byte maximum RSS, and the reconstructed output is removed afterward.
• Static gates: production/test node --check, focused oxfmt --check, and git diff --check pass. /usr/bin/time -l pnpm run typecheck passes in 3.39s wall with 1,228,537,856-byte maximum RSS. /usr/bin/time -l pnpm run lint passes in 13.20s wall with 2,024,636,416-byte maximum RSS; all 41 reliability gates and the 355-entry max-lines ratchet pass, with the existing 26 unrelated warnings. The protected Node/npm resolver and required-asset files retain zero diff.
• Oracle proved: only an exact four-field descriptor whose physical path, name, size, and SHA-256 match the tuple identity can enter the existing exclusive extractor. The actual archive is bounded and hashed before and after extraction; the complete extracted tree is hashed before the bundled Node launches native PTY/watcher smoke. Abort signals reach inspection, extraction, each staged-file read, and the smoke child. Extraction/result/smoke/cancellation failures remove the reconstructed tree. All three native job families invoke this boundary against the real first- build archive and remove the successful output; Linux does so inside the digest-pinned, network-disabled Rocky 8 builder.
• Does not prove: exact-head Node 24 behavior on all six runners, a real authenticated GitHub release response, upload/read-back composition, full-size release-asset network transfer, native signing/ trust, oldest macOS/Linux-kernel/Windows-arm64 floors, desktop resolver/cache, SSH transfer/ install, performance against legacy, or any enabled tuple.
• Follow-up: commit and push the exact package, then require the purpose-named suite and real archive execution to pass on all six exact-head native jobs. Keep release writes and every product/default consumer disconnected.

E-M4-READBACK-ARCHIVE-EXECUTION-CI-001 — Real archives execute on all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 3779838f66a57e3688367256510e096d17d78011; implementation commit b8c42f92a; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29438285824, 17:52:40Z–18:07:34Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful exact-byte runtime execution.
• Native job evidence, all at source 3779838f66a57e3688367256510e096d17d78011 under Node 24.18.0:
  • Linux x64 job 87430377762, ubuntu-24.04, image ubuntu24 20260705.232.1, PASS in 4m32s. The 10-test execution suite takes 37ms. The real 29,271,396-byte archive reconstructs 49 entries/ 34 files and 124,846,430 bytes; composition takes 2,421.587534ms and smoke takes 189.607788ms with 55,930,880-byte RSS.
  • Linux arm64 job 87430377675, ubuntu-24.04-arm, image ubuntu24-arm64 20260714.61.1, PASS in 4m49s. The suite takes 32ms. The 28,194,028-byte archive reconstructs 49 entries/34 files and 122,865,324 bytes; composition takes 1,657.784674ms and smoke takes 161.281354ms with 51,896,320-byte RSS.
  • Darwin x64 job 87430377758, macos-15-intel, image macos15 20260629.0276.1, PASS in 9m14s. The suite takes 78ms. The 26,381,668-byte archive reconstructs 50 entries/35 files and 124,316,655 bytes; composition takes 3,433.335342ms and smoke takes 475.018668ms with 40,570,880-byte RSS.
  • Darwin arm64 job 87430377724, macos-15, image macos15 20260706.0213.1, PASS in 2m56s. The suite takes 21ms. The 24,715,844-byte archive reconstructs 50 entries/35 files and 122,027,869 bytes; composition takes 2,008.11875ms and smoke takes 557.32775ms with 51,134,464-byte RSS.
  • Windows x64 job 87430377708, windows-2022, image win22 20260714.244.1, PASS in 5m29s. The suite takes 81ms. The 37,168,778-byte ZIP reconstructs 60 entries/42 files and 96,527,161 bytes; composition takes 6,312.6928ms and smoke takes 5,328.335ms with 53,751,808-byte RSS.
  • Windows arm64 job 87430377658, windows-11-arm, image win11-arm64 20260706.102.1, PASS in 9m34s. The suite takes 63ms. The 33,204,738-byte ZIP reconstructs 60 entries/42 files and 85,213,511 bytes; composition takes 8,369.1415ms and smoke takes 5,492.5873ms with 52,654,080-byte RSS.
• Broad contract counts: each POSIX job passes 54 files / 293 tests; durations are Linux x64 8.16s, Linux arm64 6.69s, Darwin x64 37.47s, and Darwin arm64 7.12s. Each Windows job passes 55 files / 287 tests plus 10 platform skips of 297; x64 takes 13.48s and arm64 15.48s.
• Downstream evidence: Linux x64 supplement job 87432492978 and Linux arm64 supplement job 87432492999 pass. Windows x64 floor job 87432565846 passes. Windows arm64 floor job 87432565824 uses image win11-arm64 20260714.109.1; exact archive/tree verification, bundled Node v24.18.0, PTY/watcher smoke, and two-second resource settlement pass in 7,454.2658ms with 49,430,528-byte RSS. It then fails exactly because observed OS/kernel build 26200 is not required build 26100.
• Adjacent exact-head workflows: PR Checks run 29438280473, job 87430357941, passes in 11m35s. Golden E2E run 29438284781 passes macOS job 87430373077 in 4m56s and Linux job 87430373141 in 4m41s.
• Oracle proved: all six target-native runners parse and run the 10-test exact descriptor/path, alias/junction, sequencing, cancellation, identity-drift, and cleanup suite, then pass their real first-build archive through exclusive extraction, complete archive/tree hashing, bundled Node, native PTY/watcher smoke, and success cleanup. Linux execution occurs inside the same digest- pinned, network-disabled Rocky 8 builder. Both tar.xz and ZIP families pass on x64 and arm64.
• Does not prove: a real authenticated GitHub release response, real upload/read-back composition, native signing/trust, oldest macOS/Linux-kernel/Windows-arm64 floors, desktop resolver/cache, SSH transfer/install, performance against legacy, or any enabled tuple.
• Checklist items satisfied: exact-head all-six CI gate for disconnected downloaded-archive execution. The broader real draft release write/read-back/execution and release composition box remains open.
• Follow-up: checkpoint this evidence, then begin a purpose-named disconnected draft-release failure-composition RED. Retain all production/default disconnections.

E-M4-DRAFT-RELEASE-COMPOSITION-LOCAL-RED-001 — Draft release failure composition is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: local evidence commit f801d3785 atop exact pushed head 3779838f66a57e3688367256510e096d17d78011; draft PR #8741. The only new uncommitted file is the purpose-named RED.
• Command: pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-draft-release-verification.test.mjs.
• Result: expected FAIL in 569ms; one suite / zero collected tests because ssh-relay-runtime-draft-release-verification.mjs does not exist.
• Contract pinned by the RED: preflight exact archive/asset identities and exclusive output roots before upload; order upload before authenticated materialization before archive execution; reject upload/read-back/result identity drift between phases; never enter a later phase after timeout, retry exhaustion, partial upload, or cancellation; remove all owned read-back and execution output after materialization, native execution, or cancellation failure.
• Does not prove: implementation, GREEN, real GitHub requests, retry behavior inside the already- proven upload primitive, authenticated network bytes, real release write/read-back, native signing/ trust, desktop/SSH behavior, or any enabled tuple.
• Follow-up: implement only the disconnected dependency-injected composition boundary. Retain every workflow, release-write, publication, product, tuple, and default disconnection.

E-M4-DRAFT-RELEASE-COMPOSITION-LOCAL-001 — Failure composition passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted implementation atop local evidence commit f801d3785; exact pushed base 3779838f66a57e3688367256510e096d17d78011; draft PR #8741. Local runner is macOS 26.2 build 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. All release/upload/read-back/execution boundaries are test doubles or local temporary files; no GitHub request or external write occurs.
• First GREEN command: production/test node --check plus pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-draft-release-verification.test.mjs — PASS, 7/7. Safety review then exposed an ownership race in the initial catch path: a failure before materialization must not remove a path merely observed absent before a long upload. Cleanup now removes only directories whose successful lower phase transferred ownership; the already-proven materializer remains responsible for its own rejected partial transaction. A dedicated outsider- path test pins the rule.
• Workflow-fixture correction signal: the first combined contract/workflow run had 1 failed / 16 passed because the test expected six production-module filename occurrences instead of the actual two production syntax checks plus four test-file occurrences. The assertion was corrected; no production code or workflow behavior changed.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-release-verification.test.mjs — PASS, 1 file / 10 tests in 612ms Vitest and 2.75s wall; maximum RSS 132,890,624 bytes and zero swaps.
• Adjacent command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with draft release verification, upload, recovery, materialization, read-back, archive execution/extraction, release stage, workflow, release assets, and protected required- assets suites — PASS, 11 files / 90 tests in 10.41s Vitest and 13.30s wall; maximum RSS 134,496,256 bytes and zero swaps.
• Broad command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 56 files / 307 tests in 70.53s Vitest and 78.97s wall; maximum RSS 189,743,104 bytes and zero swaps.
• Static gates: production/test node --check, focused oxfmt --check, and git diff --check pass. /usr/bin/time -l pnpm run typecheck passes in 9.91s wall with 1,230,274,560-byte maximum RSS. /usr/bin/time -l pnpm run lint passes in 24.32s wall with 2,019,295,232-byte maximum RSS; all 41 reliability gates and the 355-entry max-lines ratchet pass, with the existing 26 unrelated warnings. The protected Node/npm resolver and desktop required-asset files retain zero diff.
• Oracle proved: exact bounded release identity, managed asset set, runtime archive coverage, tuple/ content/archive identity, and disjoint exclusive output roots are validated before upload. Upload must return one exact reusable/uploaded partition before authenticated materialization starts; materialization must return every exact physical asset before execution starts. Timeout, retry exhaustion, partial upload, cancellation, and phase identity drift prevent later phases. A later archive failure removes earlier verified runtimes and all owned read-back bytes. An upload failure cannot remove a concurrently created path the transaction never owned. The overall timeout is 45 minutes and the existing 26-asset, 100 MiB-per-asset, and 1 GiB-total bounds are retained.
• Consumer-disconnection oracle: both native artifact job families perform only syntax and contract- test execution. There is no CLI, workflow composition caller, token/credential, real release write, publication, desktop consumer, SSH transfer/install, tuple enablement, or default behavior change.
• Does not prove: Node 24/native-runner portability, real GitHub timeout/retry/partial-release state, authenticated network bytes, real release write/read-back, protected approval/signing failures, native signing/trust, desktop/SSH behavior, performance against legacy, or any enabled tuple.
• Follow-up: commit and push the isolated package with evidence checkpoint f801d3785, then require the 10-test suite to pass on all six exact-head native Node 24 jobs. Preserve every production/ default disconnection.

E-M4-DRAFT-RELEASE-COMPOSITION-CI-001 — Failure composition passes all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 8c925c24990ac93f6d2dd8de2081a50a74f30d97; implementation commit b6bb3dd9a; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29440806947, 18:30:21Z–18:47:19Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful runtime execution.
• Native jobs and 10-test suite timings:
  • Linux x64 job 87438955106, ubuntu-24.04, image ubuntu24 20260714.240.1, PASS in 4m33s; suite 57ms.
  • Linux arm64 job 87438955082, ubuntu-24.04-arm, image ubuntu24-arm64 20260706.52.2, PASS in 4m56s; suite 48ms.
  • Darwin x64 job 87438955142, macos-15-intel, image macos15 20260629.0276.1, PASS in 7m10s; suite 103ms.
  • Darwin arm64 job 87438955086, macos-15, image macos15 20260706.0213.1, PASS in 4m24s; suite 83ms.
  • Windows x64 job 87438955074, windows-2022, image win22 20260706.237.1, PASS in 5m44s; suite 151ms.
  • Windows arm64 job 87438955084, windows-11-arm, image win11-arm64 20260714.109.1, PASS in 11m17s; suite 165ms.
• Broad contract counts: each POSIX job passes 55 files / 303 tests; durations are Linux x64 7.81s, Linux arm64 6.43s, Darwin x64 23.67s, and Darwin arm64 12.01s. Each Windows job passes 56 files / 297 tests plus 10 platform skips of 307; x64 takes 13.76s and arm64 17.76s. Every job also rebuilds, compares, reconstructs, and executes its real target-native archive successfully.
• Downstream/adjacent evidence: both Linux supplement jobs pass; Windows x64 floor passes. Windows arm64 floor job 87441657346 uses image 20260706.102.1; bundled Node/PTY/watcher smoke passes in 6,178.8338ms with 49,881,088-byte RSS and the complete verifier takes 8,186.4482ms before the gate rejects observed OS/kernel build 26200 versus required build 26100. PR Checks run 29440804969, job 87438947689, passes in 13m57s. Golden E2E run 29440804978 passes macOS job 87438947704 in 3m12s and Linux job 87438947780 in 4m25s.
• Oracle proved: both native workflow families parse and execute the exact 10-test bounded asset/ archive coverage, phase ordering, timeout/retry/partial-output stop, cancellation, identity drift, ownership-safe cleanup, and later-archive failure contract consistently on x64 and arm64. Full artifact construction/execution and adjacent product regressions remain green.
• Consumer-disconnection oracle: the workflow invokes only syntax and contract tests. There is no CLI, release/workflow caller, credential, GitHub write, publication, desktop/SSH consumer, tuple enablement, or default behavior change.
• Does not prove: real GitHub timeout/retry/partial-release behavior, a real draft write/read-back, protected approval/signing failures, native trust, desktop resolver/cache, SSH transfer/install, performance against legacy, or any enabled tuple.
• Follow-up: checkpoint this evidence. A real release write is not PR-contained and remains blocked; retain no-write as the safe default and begin the independent Milestone 5 offline selector RED.

E-M5-OFFLINE-SELECTION-LOCAL-RED-001 — Verified offline selection boundary was incomplete

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted RED atop local evidence commit 2097a40dd; exact pushed base 8c925c24990ac93f6d2dd8de2081a50a74f30d97; draft PR #8741. Local runner is macOS 26.2 build 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. No network request or external write occurred.
• Command: /usr/bin/time -l pnpm exec vitest run src/main/ssh/ssh-relay-artifact-selector.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts — expected FAIL, 2 files / 26 tests, 7 failed and 19 passed in 430ms Vitest / 1.31s wall, maximum RSS 136,265,728 bytes, zero swaps.
• Contract failures: a compatible selection returned only tuple ID/tuple and omitted the exact content ID, release tag, authenticated archive metadata, and direct release URL. A verified manifest remained mutable after signature acceptance. Requiring verification also rejected five old Windows/macOS selector shortcuts because they did not represent schema-consistent native closures; these were test-fixture defects, not product compatibility failures.
• Contract pinned by the RED: accept only the signature verifier's branded result; make that parsed result recursively immutable; select an exact tuple/content/archive from authenticated fields; construct only the exact tag-qualified GitHub release URL; retain classified unavailable results for unknown/incompatible evidence. Use complete internally consistent signed Windows and macOS fixtures rather than bypassing the schema.
• Does not prove: implementation, GREEN, production keys, embedded desktop loading, networking, redirect policy, download/cache/extraction, SSH behavior, live hosts, performance, or any enabled tuple.

E-M5-OFFLINE-SELECTION-LOCAL-001 — Verified immutable offline selection passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted implementation atop local evidence commit 2097a40dd; exact pushed base 8c925c24990ac93f6d2dd8de2081a50a74f30d97; draft PR #8741. Local runner is macOS 26.2 build 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. All accepted keys and manifests are deterministic test fixtures; no GitHub request or external write occurs.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-selector.test.ts src/main/ssh/ssh-relay-manifest-signature.test.ts — PASS, 2 files / 27 tests in 1.42s Vitest / 3.04s wall; maximum RSS 131,923,968 bytes and zero swaps.
• Adjacent command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with artifact schema, signature, release asset, selector, runtime identity, manifest aggregate, aggregate command, and signing-handoff suites — PASS, 8 files / 91 tests in 3.60s Vitest / 4.47s wall; maximum RSS 189,333,504 bytes and zero swaps.
• Broad command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 56 files / 307 tests in 16.83s Vitest / 17.93s wall; maximum RSS 189,857,792 bytes and zero swaps.
• Static gates: /usr/bin/time -l pnpm typecheck passes in 2.46s wall with 1,252,245,504-byte maximum RSS. /usr/bin/time -l pnpm lint passes in 26.98s wall with 2,021,146,624-byte maximum RSS; all 41 reliability gates and the 355-entry max-lines ratchet pass with the existing 26 unrelated warnings. Focused oxfmt --check, localization checks, git diff --check, and protected resolver/required-asset zero-diff checks pass.
• Oracle proved: only verifySshRelayArtifactManifest can construct the branded selector input; accepted-key signature verification returns a recursively frozen parsed manifest. Selection uses authenticated build tag, exact tuple/content ID, archive size/hash/count identity, and constructs https://github.com/stablyai/orca/releases/download/<tag>/<archive> without latest, API, or freshness input. Exact Linux, Windows, and macOS minima plus classified unknown/incompatible/ translated/ambiguous behavior remain pinned. Complete schema-valid signed native fixtures replace the old selector-only shortcuts.
• Consumer-disconnection oracle: no embedded-manifest loader, accepted production key, Electron networking, redirect, download/cache/extraction, desktop consumer, SSH transfer/install, mode, tuple enablement, or default behavior is added. Legacy remains the only production behavior.
• Does not prove: Node 24/native-runner portability, real production manifest keys or packaged embedding, direct-URL network behavior, proxy/certificate/redirect safety, download/cache, live SSH hosts, performance against legacy, or any enabled tuple.
• Follow-up: commit and push this isolated package together with evidence commit 2097a40dd, then require focused and adjacent contracts on all six exact-head native Node 24 jobs plus normal PR checks before starting the disconnected download boundary.

E-M5-OFFLINE-SELECTION-CI-WIRING-RED-001 — Native jobs omitted desktop selection contracts

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: workflow audit immediately after pushed selector head 5ae2a505cbb0d9744ebd4232cfc131747fdead54; draft PR #8741. Runs 29443022601, 29443022528, and 29443022549 had started but cannot close the selector package because the native artifact workflow lacked its purpose-named source suites.
• Audit signal: rg -n "artifact-selector|manifest-signature|artifact-schema|release-asset|vitest.*src/main/ssh" .github/workflows config/scripts returned no selector/source-suite invocation from .github/workflows/ssh-relay-runtime-artifacts.yml.
• Purpose-named RED command after adding only the workflow assertion: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — expected FAIL, 1 failed / 6 passed of 7 in 473ms Vitest / 2.07s wall, maximum RSS 131,694,592 bytes, zero swaps. The workflow contained zero occurrences where two job-family invocations were required.
• Contract pinned by the RED: artifact schema, signature, release asset, selector, and runtime identity source suites must be explicit inputs to both the POSIX and Windows native test steps. Green workflow status without these invocations is not selector portability evidence.
• Does not prove: corrected wiring, execution on any native runner, product behavior, or any tuple.

E-M5-OFFLINE-SELECTION-CI-WIRING-LOCAL-001 — Both native job families invoke source suites

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted workflow correction atop pushed head 5ae2a505cbb0d9744ebd4232cfc131747fdead54; draft PR #8741.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the workflow test plus artifact schema, signature, release asset, selector, and runtime identity suites — PASS, 6 files / 81 tests in 3.97s Vitest / 6.00s wall; maximum RSS 132,087,808 bytes and zero swaps. Focused YAML/test oxfmt --check and git diff --check pass.
• Oracle proved: the workflow source names all five portable source suites exactly once in the four-runner POSIX job family and exactly once in the two-runner Windows job family. The YAML parses, runner labels remain unchanged, and the existing credential/publication prohibitions remain covered by the same workflow suite.
• Consumer-disconnection oracle: this changes test execution only. It adds no credential, release write, desktop consumer, network/download/cache path, SSH behavior, tuple enablement, or default behavior.
• Does not prove: actual Linux/macOS/Windows x64/arm64 execution. The 5ae2a505c runs are intermediate only; replacement exact-head CI after this correction is mandatory.
• Follow-up: commit and push the workflow/test/evidence correction, then collect replacement all-six native Node 24 jobs plus PR Checks and Golden E2E.

E-M5-OFFLINE-SELECTION-CI-001 — Verified offline selection passes all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 3be4e68679f6f235165c8784eca61576dc2fd828; selector implementation commit 7b8c7669a, native test wiring commit d1dda17c8; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29443291349, 19:07:08Z–19:24:08Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful runtime verification/smoke.
• Native jobs and combined portable/release contract suites:
  • Linux x64 job 87447445800, runner label/image ubuntu-24.04, image version 20260705.232.1, PASS in 4m06s; 60 files / 377 tests in 9.63s.
  • Linux arm64 job 87447445787, ubuntu-24.04-arm, image version 20260706.52.2, PASS in 4m19s; 60 files / 377 tests in 7.32s.
  • Darwin x64 job 87447445754, runner label macos-15-intel, image macos-15 version 20260629.0276.1, PASS in 7m16s; 60 files / 377 tests in 32.57s.
  • Darwin arm64 job 87447445790, runner label macos-15, image macos-15-arm64 version 20260706.0213.1, PASS in 3m32s; 60 files / 377 tests in 14.35s.
  • Windows x64 job 87447445786, windows-2022, image version 20260714.244.1, PASS in 6m47s; 61 files / 371 passed + 10 platform skips of 381 in 22.26s.
  • Windows arm64 job 87447445745, windows-11-arm, image version 20260714.109.1, PASS in 10m48s; 61 files / 371 passed + 10 platform skips of 381 in 18.67s.
• Downstream/adjacent evidence: Linux x64 supplement job 87449112159 and Linux arm64 supplement job 87449112031 pass. Windows x64 floor job 87449773555 passes. Windows arm64 floor job 87449773588 uses image windows-11-arm64 20260706.102.1; the 60-entry/42-file/85,213,511-byte runtime passes Node v24.18.0, PTY, watcher, resource-settlement, full-tree verification, and smoke in 5,982.393ms with 48,451,584-byte RSS; the complete verifier takes 8,030.9838ms before the gate rejects observed build 26200 versus required build 26100.
• PR Checks run 29443290994, job 87447364904, passes in 10m10s. Golden E2E run 29443291091 passes Linux job 87447365115 in 4m27s and macOS job 87447365196 in 5m38s.
• Oracle proved: artifact schema, accepted-key signature verification/recursive immutability, exact release-asset identity, offline compatibility selection, and runtime identity contracts execute consistently under Node 24 on Linux, macOS, and Windows x64/arm64. Every job returns the exact authenticated tuple/content/archive/tag-qualified URL or a classified unavailable result, without API/latest/freshness input. Full artifact build, native smoke, equality, and adjacent product gates remain green.
• Consumer-disconnection oracle: there is no production accepted key, embedded-manifest loader, Electron network call, redirect/download/cache/extraction, desktop consumer, SSH transfer/install, mode, tuple enablement, or default behavior. No runtime artifact is published. Legacy remains the only production path.
• Does not prove: production manifest keys/packaged embedding, live direct-URL/redirect/proxy/ certificate behavior, download/cache, oldest Windows arm64/macOS/Linux-kernel floors, native signing/trust, live SSH hosts, performance against legacy, or any enabled tuple.
• Follow-up: checkpoint this evidence, update PR/worktree status, then begin only the disconnected bounded relay-download RED. Preserve every cache, consumer, SSH, tuple, publication, and default disconnection.

E-M5-ARTIFACT-DOWNLOAD-LOCAL-RED-001 — Relay-specific bounded downloader was absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted RED atop exact pushed head 1e3356cc6fa4e4090935184879b5a77db94ad2e5; draft PR #8741. Local runner is macOS 26.2 build 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. No GitHub request or external write occurred.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-download.test.ts — expected FAIL because ssh-relay-artifact-download did not exist, 1 failed suite / 0 tests in 157ms Vitest / 1.05s wall; maximum RSS 132,038,656 bytes and zero swaps.
• Contract pinned by the RED: consume only an already signature-verified selected artifact; use Electron networking; stream into a caller-named exclusive staging file; impose a five-minute total timeout; enforce signed response size and SHA-256; allow at most one exact approved GitHub asset-host redirect; use fresh fixed credential-free request options; settle cancellation; and remove only incomplete owned output.
• Does not prove: implementation, GREEN, live networking/proxy/certificates, a production manifest, cache publication/extraction, desktop consumers, SSH transfer/install, or any enabled tuple.

E-M5-ARTIFACT-DOWNLOAD-LOCAL-001 — Disconnected bounded Electron downloader passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: implementation commit ef9681d32 atop exact pushed head 1e3356cc6fa4e4090935184879b5a77db94ad2e5; draft PR #8741. Local runner is macOS 26.2 build 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. Electron net.fetch and HTTP responses are mocked; no GitHub request, release write, or artifact publication occurred.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-download.test.ts — PASS before the final response-disposal hardening, 1 file / 15 tests in 7.49s Vitest / 30.53s wall; maximum RSS 130,990,080 bytes and zero swaps. The adjacent command below includes the final 16-test suite.
• Adjacent command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with artifact download, selector, manifest signature, artifact schema, release asset, and runtime identity suites — PASS, 6 files / 89 tests in 22.99s Vitest / 40.99s wall; maximum RSS 128,516,096 bytes and zero swaps.
• Broad command: /usr/bin/time -l sh -c "rg --files config/scripts | rg '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1" — PASS, 56 files / 307 tests in 45.84s Vitest / 64.95s wall; maximum RSS 189,382,656 bytes and zero swaps.
• Static gates: /usr/bin/time -l pnpm typecheck passes in 33.08s wall with 1,121,845,248-byte maximum RSS. /usr/bin/time -l pnpm lint passes in 55.13s wall with 2,071,396,352-byte maximum RSS; all 41 reliability gates and the 355-entry max-lines ratchet pass with the existing 26 unrelated warnings. Focused oxlint passes in 13.59s wall with 123,125,760-byte maximum RSS. Focused oxfmt --check, protected resolver/required-asset zero-diff checks, and git diff --check pass.
• Oracle proved: both direct 200 and a single exact release-assets.githubusercontent.com redirect use a fresh { credentials: 'omit', redirect: 'manual', Accept: application/octet-stream } request. HTTP, unapproved-origin, credential-bearing, custom-port, missing-Location, chain, 404/429/503, missing-body, invalid Content-Length, truncation, oversize, wrong-hash, cancellation, and pre-existing-destination cases fail without selecting partial output. Rejected response bodies are cancelled, successful bytes are streamed with bounded chunk memory, fully written, fsynced, and returned only after exact signed size/hash verification.
• Consumer-disconnection oracle: the downloader has no cache publication/extraction, embedded- manifest loader, retry policy, desktop caller, SSH transfer/install, mode, tuple enablement, or default behavior. Legacy remains the only production path.
• Does not prove: Node 24/native-runner portability, live GitHub/CDN redirects, system proxy or certificate behavior, retry/backoff, cache/extraction/atomic publication, disk-full/readonly/ multi-process races, full-size runtime memory, client-offline transfer, live SSH, performance against legacy, or any enabled tuple.
• Follow-up: commit and push the isolated implementation/evidence, add a workflow-contract RED/GREEN requiring the downloader suite in both native job families, and collect exact-head all-six Node 24 evidence before starting cache/extraction.

E-M5-ARTIFACT-DOWNLOAD-CI-WIRING-RED-001 — Native jobs omitted downloader contracts

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted workflow assertion atop exact pushed downloader head 6473801e7; draft PR #8741.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — expected FAIL, 1 failed / 6 passed of 7 tests in 980ms Vitest / 5.28s wall; maximum RSS 132,448,256 bytes and zero swaps. The downloader suite occurred zero times where the contract requires one POSIX-family and one Windows-family invocation.
• Contract pinned by the RED: ssh-relay-artifact-download.test.ts must execute as part of both target-native workflow test families so a generic PR/Linux job cannot be misreported as Linux/macOS/Windows x64/arm64 downloader portability proof.
• Does not prove: corrected wiring, native execution, live Electron networking, product behavior, or any enabled tuple.

E-M5-ARTIFACT-DOWNLOAD-CI-WIRING-LOCAL-001 — Both native job families invoke downloader tests

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: workflow/test commit 0d7e0077d atop exact pushed downloader head 6473801e7; draft PR #8741.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the workflow contract plus artifact download, selector, manifest signature, artifact schema, release asset, and runtime identity suites — PASS, 7 files / 96 tests in 11.97s Vitest / 16.98s wall; maximum RSS 141,099,008 bytes and zero swaps. Focused oxlint, oxfmt --check, protected- file zero-diff, and git diff --check pass.
• Oracle proved: the downloader suite is named exactly once by the four-runner POSIX job family and exactly once by the two-runner Windows job family. YAML parsing, runner labels, and existing credential/publication prohibitions remain covered by the same workflow contract.
• Consumer-disconnection oracle: this changes test execution only. It adds no network caller, credential, release write, cache/extraction path, desktop consumer, SSH behavior, tuple enablement, or default behavior.
• Does not prove: actual Linux/macOS/Windows x64/arm64 execution. Replacement exact-head CI after this correction is mandatory.
• Follow-up: commit/push the workflow/test/evidence correction and collect all-six native Node 24 jobs plus PR Checks and Golden E2E.

E-M5-ARTIFACT-DOWNLOAD-CI-001 — Bounded downloader contracts pass all six native Node 24 jobs

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head fc6b6d2197fa8cc012317a5ea155e57886183c61; downloader implementation ef9681d32, native test wiring 0d7e0077d; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29445770009, 19:46:32Z–20:00:26Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful runtime verification/smoke.
• Native jobs and downloader-containing portable/release contract suites:
  • Linux x64 job 87455756464, image ubuntu-24.04 20260714.240.1, PASS in 5m49s; 61 files / 392 tests in 10.20s.
  • Linux arm64 job 87455756439, image ubuntu-24.04-arm 20260714.61.1, PASS in 4m39s; 61 files / 392 tests in 7.70s.
  • Darwin x64 job 87455756475, image macos-15 20260629.0276.1, PASS in 5m26s; 61 files / 392 tests in 23.13s.
  • Darwin arm64 job 87455756647, image macos-15-arm64 20260706.0213.1, PASS in 5m13s; 61 files / 392 tests in 15.96s.
  • Windows x64 job 87455756492, image windows-2022 20260706.237.1, PASS in 4m36s; 62 files / 386 passed + 10 platform skips of 396 in 13.78s.
  • Windows arm64 job 87455756474, image windows-11-arm64 20260714.109.1, PASS in 9m32s; 62 files / 386 passed + 10 platform skips of 396 in 15.26s.
• Downstream/adjacent evidence: Linux x64 supplement job 87456995626 and Linux arm64 supplement job 87456995632 pass. Windows x64 floor job 87457773650 passes. Windows arm64 floor job 87457773621 passes Node v24.18.0, PTY, watcher, resource settlement, and full-tree verification; smoke takes 5,781.9983ms with 47,329,280-byte RSS and the complete verifier takes 7,750.6872ms before the floor gate rejects observed build 26200 versus required build 26100.
• PR Checks run 29445769922, job 87455727487, passes in 11m12s. Golden E2E run 29445769934 passes Linux job 87455727461 in 4m32s and macOS job 87455727503 in 4m01s.
• Oracle proved: the relay-specific downloader consumes only the verified selected-artifact type and its direct immutable URL; exact signed size/hash, fixed credential-free requests, one approved redirect, rejected-response disposal, bounded chunk streaming, exclusive output, cancellation, fsync, and failure cleanup contracts execute consistently under Node 24 on Linux, macOS, and Windows x64/arm64. Full artifact build, smoke, equality, and adjacent product gates remain green.
• Consumer-disconnection oracle: there is no live network caller, packaged manifest/key, cache publication/extraction, desktop consumer, SSH transfer/install, mode, tuple enablement, release write, or default behavior. No runtime artifact is published. Legacy remains the only production path.
• Does not prove: live Electron/GitHub/CDN/proxy/certificate behavior, production manifest keys or packaged embedding, retry/backoff, cache/extraction/atomic publication, disk/resource/concurrency failures, full-size downloader memory, client-offline transfer, live SSH, performance against legacy, oldest Windows arm64/macOS/Linux-kernel floors, native signing/trust, or any enabled tuple.
• Follow-up: checkpoint this evidence, update PR/worktree status, then begin only the isolated desktop extraction/cache contract audit and purpose-named RED.

E-M5-ARCHIVE-PORTABILITY-AUDIT-001 — Current POSIX archive violates the cross-client memory contract

• Date: 2026-07-15
• Owner: Codex implementation owner
• Environment: macOS 26.2 build 25C56 arm64; Node v26.0.0; pnpm 10.24.0; XZ Utils/liblzma 5.8.3. Source artifact is the exact Linux x64 output from run 29445770009, artifact 8355514197, implementation/evidence head fc6b6d2197fa8cc012317a5ea155e57886183c61.
• Exact acquisition/identity commands: gh run download 29445770009 -n ssh-relay-runtime-linux-x64-glibc -D /tmp/orca-runtime-artifact-29445770009; xz --robot --list -vv /tmp/orca-runtime-artifact-29445770009/orca-ssh-relay-runtime-v1-linux-x64-glibc-fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d.tar.xz; xz --decompress --stdout --single-stream <archive> > /tmp/orca-runtime-real.tar.
• Current artifact result: 29,268,104 compressed bytes, 124,881,408 expanded bytes, CRC64, and a declared 67,175,032-byte LZMA2 decoder-memory requirement from --lzma2=dict=64MiB. The decoder alone is 66,168 bytes over the complete 64 MiB desktop incremental-memory budget before TAR parsing, hashing, or extraction.
• Portable WASM audit commands: npm view xz-decompress@0.2.3 --json and npm pack xz-decompress@0.2.3 --pack-destination /tmp/orca-xz-decompress-audit, followed by a Node Readable.toWeb(createReadStream(..., { highWaterMark: 64 * 1024 })) -> new XzReadableStream(...) -> counting Writable pipeline over 350 MiB generated XZ streams. The maintained dependency is MIT/public-domain, dependency-free, CRC64-capable, and emits 65,536- byte chunks, but measured 104,529,920 bytes above baseline with a 16 MiB dictionary and 138,854,400 bytes above baseline with the current 64 MiB dictionary. It is rejected.
• Packaged-binary audit commands: pnpm why 7zip-bin; node -p "require('7zip-bin').path7za"; file <path>; codesign -dv --verbose=4 <path>; spctl --assess --type execute --verbose=4 <path>; and /usr/bin/time -l <chmodded-temporary-copy> x -so <350MiB.xz> | wc -c. The only existing package is a transitive dev dependency. Its macOS arm64 binary is p7zip 16.02 from 2016, arrives without execute permission, is only ad-hoc linker-signed, and is rejected by macOS assessment. It uses 75,628,544 bytes RSS for the current dictionary before the desktop TAR parser. It is rejected; no production dependency or packaged executable was added.
• Selected correction command: Node createReadStream with a 65,536-byte high-water mark -> createBrotliCompress({ chunkSize: 65_536, params: { BROTLI_PARAM_QUALITY: 9, BROTLI_PARAM_LGWIN: 20 } }) -> exclusive output. The exact real runtime becomes 35,977,664 bytes in 11.78s: 6,709,560 bytes / 22.9245% larger than XZ, but 8,282,308 bytes smaller than gzip-9.
• Selected extraction command: /usr/bin/time -l node --expose-gc -e <exclusive mkdir; createReadStream(65_536) -> createBrotliDecompress(65_536) -> tar.extract({ strict: true, preserveOwner: false, noChmod: false, unlink: false })> over that exact runtime. It reconstructs 124,881,408 bytes / 34 files in 533.13ms. In-process sampling records a 54,968,320-byte baseline, 89,112,576-byte peak, and 34,144,256-byte incremental RSS; the decompressed SHA-256 is b3fe955ae26b9413505c9c614842377851e686802bbb70e5c77397557fbaed6f with a 65,536-byte maximum output chunk.
• Decision: unpublished POSIX relay outputs change from .tar.xz to deterministic .tar.br using Node's built-in Brotli quality 9, lgwin=20, and 64 KiB chunks. Windows relay ZIP and Node's upstream .tar.xz inputs do not change. No native/WASM decompressor dependency is introduced. The HTML plan and both living checklists are updated before implementation.
• Evidence invalidation: historical XZ artifact/tree/native evidence remains truthful for its exact unpublished bytes, but it does not prove the new archive family. The POSIX archive builder, schema, strict inspection/extraction, reproducibility, tuple descriptors, release composition, read-back execution, all-six native artifact jobs, and downstream exact-archive evidence must be rerun. Windows ZIP, runtime-tree/native smoke, manifest-signature primitives, downloader, SSH legacy behavior, and production defaults are unchanged.
• Does not prove: implementation, deterministic repeat output, hostile/truncated Brotli rejection, Linux/Windows/macOS client execution, Node 24 behavior, packaged Electron extraction, cache publication, SSH transfer/install, native trust, oldest floors, or any enabled tuple.
• Follow-up: add a purpose-named .tar.br contract RED, implement only the artifact-format correction, run local archive/release/desktop parity gates, then push and require exact-head all-six native artifact proof before resuming desktop extraction.

E-M5-PORTABLE-ARCHIVE-LOCAL-RED-001 — Portable POSIX archive contract fails against XZ builder

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named contract test config/scripts/ssh-relay-runtime-portable-archive.test.mjs atop local plan-decision commit c5fe474e6.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-portable-archive.test.mjs
• Environment: macOS 26.2 arm64, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; one file / three tests fail in 189ms Vitest / 1.04s wall; maximum RSS 131,629,056 bytes, zero swaps.
• Failure oracles:
  • the builder returns the exact old .tar.xz name instead of .tar.br;
  • SSH_RELAY_RUNTIME_POSIX_ARCHIVE_LIMITS is absent instead of declaring 65,536-byte chunks, quality 9, and window bits 20;
  • the source imports node:child_process, spawns system xz, and has no built-in Brotli compressor/decompressor.
• Does not prove: implementation, GREEN, hostile archive behavior, deterministic real full-size output, Node 24 or native-runner behavior, schema/release parity, desktop extraction, cache, SSH, publication, or any tuple.
• Follow-up: implement the smallest Node-native archive builder/inspector correction, then update exact relay-archive naming consumers without changing Node upstream archives or Windows ZIP.

E-M5-PORTABLE-ARCHIVE-LOCAL-001 — Bounded Node-native relay archives pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: implementation commit c9f6da55e41d2f201684e967ce4c3db37150571f atop plan-decision commit c5fe474e6f3f84e8b6c0fed930dd6dc580454e74; draft PR #8741. Evidence metadata is the following docs-only commit.
• Environment: macOS 26.2 build 25C56 arm64; Node v26.0.0; pnpm 10.24.0; Vitest 4.1.5.
• Implementation oracle:
  • POSIX relay output is .tar.br; Windows remains ZIP and upstream Node inputs remain .tar.xz.
  • deterministic TAR is streamed directly through Node's built-in Brotli quality 9, lgwin=20, and 65,536-byte chunks into an exclusive mode-0600 output, avoiding both system XZ and a full uncompressed temporary TAR;
  • caller cancellation is combined with the five-minute artifact timeout and checked before output creation; failure removes only an output this invocation opened, never an existing file;
  • strict inspection and release-side exclusive extraction use the same bounded built-in Brotli stream before exact path/type/mode/size/hash and full-tree verification;
  • aggregate, manifest, tuple, post-sign, draft/read-back, direct-URL, reproducibility, workflow, and canonical-vector contracts use the new exact archive name; the canonical manifest SHA-256 is updated from the changed authenticated filename, not bypassed;
  • both native job families syntax-check and execute the five-test purpose suite. The Linux supplement and native-signing reconstruction use the strict Node extractor; CI-only tar -xJf and native-signing XZ installation are removed and guarded against regression.
• Purpose/workflow command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-portable-archive.test.mjs config/scripts/ssh-relay-runtime-workflow.test.mjs config/scripts/ssh-relay-runtime-native-signing-workflow.test.mjs passes three files / 13 tests in 462ms. It covers deterministic output, exact rehash, bounded constants, no system/native XZ, truncated Brotli rejection, existing-output preservation, pre-cancel settlement/cleanup, and both native workflow families.
• Release regression command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs passes 50 files / 278 tests in 9.62s Vitest / 10.63s wall; maximum RSS 188,940,288 bytes, zero swaps.
• Desktop parity command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts passes 16 files and skips one existing file; 232 tests pass and one is skipped in 6.09s Vitest / 7.46s wall; maximum RSS 297,877,504 bytes, zero swaps.
• Full-size deterministic command: run the committed createSshRelayRuntimeArchive twice with source epoch 1788739200 over the exact reconstructed Linux x64 artifact 8355514197 from run 29445770009, then call inspectSshRelayRuntimeArchive, cmp, shasum -a 256, and stat -f '%N %z' on both outputs. The 124,846,430 declared file bytes / 49 entries / 34 files produce two byte-identical 36,411,047-byte archives with SHA-256 23a35a0db4b36166c6ad327c4986978b79f0281ef979dcd5f16525428e9ecdaa. Builds take 7,824.18ms and 8,683.93ms; strict inspection takes 321.16ms. The combined two-build/inspection process completes in 16.92s with 226,557,952-byte maximum RSS and zero swaps. This is release-job construction memory, not desktop extraction memory; the separately measured complete extraction delta is 34,144,256 bytes under E-M5-ARCHIVE-PORTABILITY-AUDIT-001.
• Static commands: changed-file oxlint; pnpm typecheck; pnpm lint; node --check config/scripts/ssh-relay-runtime-portable-archive.test.mjs; changed-file oxfmt; purpose/workflow Vitest; git diff --check; and protected-file zero-diff all pass. Full lint retains only unrelated pre-existing warnings and passes switch exhaustiveness, 41 reliability gates, max-lines ratchet, bundled guides, localization catalog, and localization coverage.
• Consumer-disconnection oracle: there is no desktop extraction/cache module, caller, SSH transfer/install, release write, production key, published artifact, tuple enablement, mode, or default change. Legacy remains the only production path.
• Does not prove: Node 24, Linux/Windows/macOS x64/arm64 native execution, exact clean-build equality for new archive bytes, packaged Electron extraction, desktop two-minute timeout, live SSH, release publication/signing/native trust, oldest floors, or any enabled tuple.
• Follow-up: push the exact implementation/evidence heads and require the new purpose suite plus complete runtime build/smoke/equality/read-back to pass on all six native Node 24 jobs before checking the archive item or resuming desktop extraction.

E-M5-PORTABLE-ARCHIVE-CI-RED-001 — Fresh Linux floor staging parent breaks strict extraction

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head cdb318df339941325a1055d841c6ae7d5484dfaf; draft PR #8741.
• Workflows: SSH Relay Runtime Artifacts run 29448792600, PR Checks run 29448792389, and Golden E2E run 29448792403.
• Passing boundary: all six primary Node 24 target-native jobs pass the portable-archive contract suite and complete two-build inspection, bundled Node/PTY/watcher smoke, exact archive equality, read-back execution, and unpublished evidence upload. Primary job IDs are Linux x64 87465865029, Linux arm64 87465865049, macOS x64 87465865021, macOS arm64 87465865039, Windows x64 87465865008, and Windows arm64 87465865028. PR Checks and Golden E2E are green. Windows x64 oldest-floor job 87467928882 is green. Windows arm64 floor job 87467928866 passes exact archive reconstruction and bundled Node/PTY/watcher smoke in 8,112.4613ms overall / 5,970.8928ms smoke with 49,889,280-byte RSS, then fails only the retained floor oracle because hosted image windows-11-arm64/20260714.109 is build 26200 rather than required build 26100.
• Required RED: Linux oldest-userland supplement jobs 87466788626 and 87466788553 authenticate and download the exact 36,327,346-byte x64 / 36,261,822-byte arm64 Actions artifacts, then both fail before archive extraction with ENOENT from realpath(.../baseline-runtime). The workflow intentionally supplies fresh nested output paths, but extractSshRelayRuntimeArchive resolves the immediate parent before preparing it.
• Security oracle: this is not an archive/hash/tree/native-smoke failure and does not justify a fallback or weakened verifier. The correction must prepare only the parent hierarchy while retaining exclusive final-leaf creation, physical-path resolution, authenticated input inspection, cleanup ownership, complete-tree verification, and cancellation/timeout bounds.
• Does not prove: the correction, replacement Linux supplement execution, packaged Electron extraction/cache behavior, live SSH, native signing/trust, Windows arm64 build 26100, publication, tuple enablement, or any default-path change.
• Follow-up: add a local missing-parent RED, implement the narrow parent-preparation correction, and replace the exact-head native run rather than rerunning only the failed jobs on the old SHA.

E-M5-PORTABLE-ARCHIVE-PARENT-LOCAL-RED-001 — Missing-parent extraction contract reproduces CI

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted regression test atop exact CI RED head cdb318df3.
• Exact command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-archive-extraction.test.mjs
• Environment: macOS 26.2 arm64, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; one file / three tests runs in 1.52s, with the new test failing in 86ms and the two existing extraction tests passing. The failure is the same ENOENT from realpath of a deliberately absent fresh-parent directory observed in both Linux supplement jobs.
• Does not prove: the correction, Linux/Windows behavior, exclusive-leaf preservation, Node 24, full-size extraction, supplements, desktop cache, SSH, or any tuple.

E-M5-PORTABLE-ARCHIVE-PARENT-LOCAL-001 — Fresh parent and exclusive leaf pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: implementation/evidence commit af181dcc7 following E-M5-PORTABLE-ARCHIVE-CI-RED-001 and E-M5-PORTABLE-ARCHIVE-PARENT-LOCAL-RED-001; exact full SHA af181dcc7dfce1321434466fe0917789a4de8bd9. This docs-only metadata checkpoint follows it.
• Implementation oracle: prepare the resolved output's parent hierarchy with mode 0700 where newly created, then resolve its physical path and preserve the existing exclusive final-leaf mkdir. A second extraction to the same leaf remains rejected. Archive identity/hash/size inspection, bounded Brotli/ZIP extraction, full-tree verification, input mutation detection, cleanup ownership, timeout, and cancellation code are unchanged.
• Focused command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-archive-extraction.test.mjs config/scripts/ssh-relay-runtime-portable-archive.test.mjs config/scripts/ssh-relay-runtime-native-signing-workflow.test.mjs passes three files / nine tests in 7.22s. POSIX runners exercise TAR/Brotli and Windows runners exercise ZIP for the platform-selected fresh-parent contract.
• Release regression command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs passes 50 files / 279 tests in 18.70s Vitest / 20.75s wall with 189,284,352-byte maximum RSS and zero swaps.
• Desktop parity command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts passes 16 files and skips one existing file; 232 tests pass and one is skipped in 15.66s Vitest / 17.10s wall with 257,802,240-byte maximum RSS and zero swaps.
• Static commands: node --check for the extractor and its test, pnpm typecheck, and pnpm lint pass. Full lint retains only unrelated pre-existing warnings and passes switch exhaustiveness, 41 reliability gates, max-lines ratchet, bundled guides, localization catalog, and localization coverage. Changed-file formatting, git diff --check, and protected-file zero-diff remain required before commit.
• Consumer-disconnection oracle: no desktop consumer, cache publication, SSH transfer/install, release write, production key, tuple, mode, or default changes. Legacy remains the only production path.
• Does not prove: Node 24/native-runner behavior, corrected Linux supplements, packaged Electron extraction, desktop cache, live SSH, native signing/trust, oldest incomplete floors, publication, or any enabled tuple.
• Follow-up: format/checkpoint the correction, push it, and require replacement exact-head all-six primary jobs plus both Linux supplements before resuming disconnected desktop extraction.

E-M5-PORTABLE-ARCHIVE-CI-001 — Portable archives pass all-six native and Linux floor gates

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 3080eda77fd6a11ed87f536c1963e5b67abe7621; archive implementation c9f6da55e41d2f201684e967ce4c3db37150571f; fresh-parent correction af181dcc7dfce1321434466fe0917789a4de8bd9; draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29449869519, starting 20:51:36Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 floor job rejects hosted build 26200 after successful archive reconstruction and runtime smoke.
• Native job/runtime-contract evidence:
  • Linux x64 job 87469418941, ubuntu-24.04 20260705.232.1, passes in 2m34s; 62 files / 398 tests in 9.34s. Final read-back smoke is 160.642692ms with 56,541,184-byte RSS; the complete verifier is 1,014.651163ms.
  • Linux arm64 job 87469419077, ubuntu-24.04-arm 20260706.52.2, passes in 5m55s; 62 files / 398 tests in 7.91s. Final read-back smoke is 209.703393ms with 52,625,408-byte RSS; the complete verifier is 853.006072ms.
  • macOS x64 job 87469418977, macos-15 20260629.0276.1, passes in 4m25s; 62 files / 398 tests in 20.32s. Final read-back smoke is 362.966426ms with 40,611,840-byte RSS; the complete verifier is 2,565.85366ms.
  • macOS arm64 job 87469418947, macos-15-arm64 20260706.0213.1, passes in 3m11s; 62 files / 398 tests in 21.43s. Final read-back smoke is 444.272042ms with 51,445,760-byte RSS; the complete verifier is 1,217.196375ms.
  • Windows x64 job 87469419062, windows-2022 20260706.237.1, passes in 5m32s; 63 files / 389 passed + 13 platform skips of 402 in 14.82s. Final read-back smoke is 5,333.875ms with 53,739,520-byte RSS; the complete verifier is 6,388.1631ms.
  • Windows arm64 job 87469418940, windows-11-arm64 20260714.109.1, passes in 11m21s; 63 files / 389 passed + 13 platform skips of 402 in 15.97s. Final read-back smoke is 5,434.1993ms with 52,772,864-byte RSS; the complete verifier is 8,194.2032ms.
• Authenticated archive bytes independently downloaded with gh run download 29449869519 --repo stablyai/orca --dir /tmp/orca-run-29449869519-evidence, then checked with stat -f '%N\t%z' and shasum -a 256; every result exactly matches its uploaded identity:
  • Linux x64 .tar.br: 36,412,421 bytes, 3cb5abb37eb5e288addb4b8e9219176a052eccc1de64f639effa615ca2e762e1;
  • Linux arm64 .tar.br: 36,363,113 bytes, 8b0e324325ccff3f58d4fb1952073a8cb1b5af3d4d2a2d429f00f7e7b19f4906;
  • macOS x64 .tar.br: 32,922,873 bytes, fd539f2acfa84342c4bd2e42e84d75a746da4b68254b2842bb90975da843c41f;
  • macOS arm64 .tar.br: 31,776,556 bytes, 2031bea0f820107f8c92ab62a446fe0ebbeb64e78b63b6707c0610216ac68e3d;
  • Windows x64 ZIP: 37,168,778 bytes, 1db7477d727d14672a919ec5ac35fb6a92ccdabdd80cf4228e877c648be8f466;
  • Windows arm64 ZIP: 33,204,738 bytes, 0c79ac88aef8b73d6230c2995585449d4b14feddb4021f2c09bbd3ddf8b58acf.
• GitHub artifact IDs/container evidence: Linux x64 8357070191 / 36,327,344 bytes / digest db611cf63a1925ecd715fd59573e4388a3dd51a0ad2e23f56f4380f328dd3e1a; Linux arm64 8357149220 / 36,261,905 / e21e8e1662d5d608194b2f6bee48bee1de0c738c4bc0a117cd80ea9bd7730db2; macOS x64 8357112462 / 32,786,285 / 874c3154b4e6e0c1766a2acecab7b0b0c920d165e11c89932759dc7b2a811615; macOS arm64 8357083684 / 31,651,122 / 86f96887f5295404d3232a7630f88f82647c0f3ad6d5bbdbee232e1002b35393; Windows x64 8357138535 / 37,036,207 / bab660412a7b88c01e77d8b12e2405586cbd2b26f80ab8bca91343642b5a6bf7; Windows arm64 8357270708 / 33,086,421 / 7f8c89f0a405aab29cd4b5f3866f309ef6471492b981fcc04b495b3f6c2e60dc.
• Fresh-parent regression/floor evidence: Linux x64 supplement job 87470575028 passes in 32s and Linux arm64 supplement job 87470575020 passes in 1m08s. Each downloads its exact artifact, reconstructs into the previously failing fresh $RUNNER_TEMP/baseline-runtime/<tuple> path, and re-verifies the complete tree. Rocky 8 execution proves glibc 2.28 and libstdc++ 6.0.25: x64 smoke is 163.723423ms / 55,521,280-byte RSS and arm64 is 187.308458ms / 51,802,112-byte RSS. The shared hosted kernel remains 6.17 rather than the separately required 4.18 floor.
• Windows floors: x64 job 87471620643 on windows-2022 20260714.244.1 observes build 20348 and passes; smoke is 5,357.7362ms / 49,979,392-byte RSS and the complete verifier is 6,548.5886ms. Arm64 job 87471620692 on windows-11-arm64 20260706.102.1 reconstructs and executes successfully; smoke is 5,879.2748ms / 49,733,632-byte RSS and the complete verifier is 7,884.492ms, then the job fails only because observed build 26200 does not prove required build 26100.
• Adjacent product evidence: PR Checks run 29449869451, job 87469418118, passes in 14m14s. Golden E2E run 29449869407 passes Linux job 87469417960 in 4m26s and macOS job 87469417915 in 6m25s.
• Oracle proved: deterministic bounded POSIX Brotli/TAR and Windows ZIP construction, strict archive inspection/extraction, exact clean-build equality, identity/SBOM/provenance closure, bundled Node/PTY/watcher smoke, read-back execution, fresh-parent exclusive staging, and Linux glibc / libstdc++ floors execute on all required native build families under Node 24.
• Consumer-disconnection oracle: there is no packaged manifest/key, desktop extraction/cache caller, cache publication, SSH transfer/install, mode, tuple enablement, release write, or default behavior. No runtime artifact is published. Legacy remains the only production path.
• Does not prove: packaged Electron extraction/cache concurrency and resource bounds, live GitHub/CDN/proxy behavior, client-offline transfer, live SSH/SFTP/system-SSH paths, Linux kernel 4.18, macOS 13.5, Windows arm64 build 26100, real native signatures/trust, publication, or any enabled tuple.
• Follow-up: checkpoint this evidence and begin only the disconnected desktop extraction/cache boundary audit and purpose-named RED.

E-M5-ARTIFACT-EXTRACTION-AUDIT-001 — Desktop extraction boundary and package split

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact local/pushed head a93e67413a2a1446e8e0f7348af1fdf72737287d after portable archive evidence; draft PR #8741.
• Exact audit commands: rg --files src/main/ssh config/scripts | rg 'ssh-relay|relay-runtime' | sort; targeted rg -n over cache|extract|atomic|quarantine; and complete reads of the desktop schema/consistency/path-policy/selector/downloader plus release TAR/Brotli, ZIP, extraction, and full-tree verification modules.
• Findings:
  • the desktop has a signature-verified immutable selected-artifact value and an exclusive, streaming size/hash-verified downloader, but no extraction or cache module and no consumer;
  • release-job extractors under config/scripts are not packaged desktop modules and use the five-minute release boundary rather than the two-minute desktop extraction budget;
  • the verified selected artifact already carries the exact content ID, archive name/size/hash, entry paths/types/modes/sizes/hashes, file count, expanded size, and portable native-attestation hashes required for cross-client verification;
  • extraction must revalidate the regular archive file and its signed size/hash before staging, strictly inspect the authenticated archive family, extract only into an exclusive leaf, stream a complete no-extra-file tree verification, detect source mutation, and remove only staging it created on every failure/cancellation;
  • native execution/trust probes are deliberately not part of desktop cross-client extraction. Their signed hashes are bound by tuple consistency; target-native execution remains a later remote-install gate.
• Package split: ssh-relay-artifact-extraction.ts owns input state, timeout, exclusive staging, and cleanup; ssh-relay-artifact-tar-extraction.ts owns strict bounded TAR/Brotli behavior; ssh-relay-artifact-zip-extraction.ts owns strict bounded ZIP behavior; and ssh-relay-artifact-tree-verification.ts owns streamed complete-tree verification. Cache locking, publication records, quarantine, eviction, and lookup stay in the later ssh-relay-artifact-cache.ts package.
• Budgets: two-minute extraction timeout; 65,536-byte stream chunks; 64 MiB maximum measured desktop incremental RSS; no buffer over 1 MiB; archive/expanded/file/count/path limits remain signed-schema constraints. This package must expose the constants for contract and measurement tests.
• Consumer-disconnection oracle: this audit and the next capability do not create a cache root, publish an entry, load an embedded key/manifest, call the downloader, transfer over SSH, enable a tuple/mode, or change the legacy default.
• Does not prove: implementation, hostile archive behavior, packaged Electron behavior, full-size memory/latency, cache concurrency/publication/quarantine/eviction, live SSH, native trust, or any enabled tuple.
• Follow-up: add the purpose-named cross-family RED, then implement only the disconnected extraction capability across the concrete modules above.

E-M5-ARTIFACT-EXTRACTION-LOCAL-RED-001 — Packaged desktop extraction capability is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted purpose-named src/main/ssh/ssh-relay-artifact-extraction.test.ts atop audit head a93e67413.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-extraction.test.ts
• Environment: macOS 26.2 arm64, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; one failed suite / zero collected tests in 1.75s Vitest / 7.67s wall with 132,104,192-byte maximum RSS and zero swaps. Import fails because ./ssh-relay-artifact-extraction does not exist.
• Contract encoded before implementation:
  • synthesize real TAR/Brotli and ZIP archives on every client OS;
  • expose exact 120,000ms / 65,536-byte / 64 MiB incremental-RSS / 1 MiB maximum-buffer budgets;
  • revalidate signed archive size/hash, strictly reject mismatched and undeclared entries, verify every extracted file byte, and accept no extra tree entry;
  • create a fresh parent but an exclusive final staging leaf; settle pre-cancellation; remove only owned partial output and preserve an existing owner.
• Does not prove: implementation, collected test behavior, Node 24/native clients, full-size memory, packaged Electron extraction, cache publication/concurrency, SSH, or any enabled tuple.
• Follow-up: implement the smallest disconnected extraction capability without cache or consumer wiring, then run focused/release/desktop/static gates and require native CI.

E-M5-ARTIFACT-EXTRACTION-LOCAL-001 — Disconnected desktop extraction passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact implementation commit 7580600e3753e355f9a3876a40e58d23ba03bc9a atop audit head a93e67413a2a1446e8e0f7348af1fdf72737287d.
• Environment: macOS 26.2 arm64, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5. Node 24/native client execution remains the next gate.
• Exact focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-extraction.test.ts
• Focused result: one passed file / 17 passed tests in 1.65s Vitest / 4.15s wall; 158,105,600-byte maximum RSS, 96,179,552-byte peak memory footprint, zero swaps, and 353 page faults. The observed process maximum is 26,001,408 bytes above the 132,104,192-byte missing-module RED process baseline, below the 64 MiB incremental contract. This is a synthetic 8 MiB cancellation/mutation fixture, not the separately required exact full-size artifact measurement.
• Exact static commands: pnpm exec oxlint src/main/ssh/ssh-relay-artifact-extraction.ts src/main/ssh/ssh-relay-artifact-tar-extraction.ts src/main/ssh/ssh-relay-artifact-tree-verification.ts src/main/ssh/ssh-relay-artifact-zip-reader.ts src/main/ssh/ssh-relay-artifact-zip-extraction.ts src/main/ssh/ssh-relay-artifact-extraction.test.ts; pnpm typecheck.
• Static result: both commands exit zero. The implementation is split by concrete responsibility; no max-lines disable or vague helper/common module was added.
• Oracle proved:
  • only the immutable selected tuple/archive identity crosses the boundary; the exact signed regular archive size/hash and filesystem state are checked before staging and again after extraction;
  • TAR/Brotli and ZIP are strictly inspected and streamed on every client OS into an exclusive leaf beneath a resolved parent; POSIX modes and every signed path/type/size/hash are revalidated;
  • extra/traversal/truncated/case-fold-colliding entries, ZIP symbolic links/encryption shapes, wrong bytes, archive mutation, and existing-owner collisions fail closed;
  • pre-cancellation and cancellation after staging begins settle, remove only owned partial output, and leave no eligible partial runtime tree;
  • extraction retains the declared 120,000ms timeout, 65,536-byte chunks, 64 MiB measured incremental-RSS budget, and 1 MiB maximum-write-buffer contract.
• Consumer-disconnection oracle: there is no cache root or publication record, downloader/manifest loader caller, SSH transfer/install, runtime execution, target setting, Beta option, tuple enablement, release write, or artifact publication. Legacy remains the only production/default path.
• Does not prove: Node 24 or native Windows/Linux/macOS clients, packaged Electron behavior, exact full-size runtime memory/latency, cache locking/publication/quarantine/eviction, live SSH, native trust, or any enabled tuple.
• Follow-up: run the broad relay/release/static gates, prove the focused source suite is invoked by both POSIX and Windows native artifact job families, then collect all-six Node 24 and exact full-size payload evidence before beginning cache publication.

E-M5-ARTIFACT-EXTRACTION-BROAD-RED-001 — Broad run exposes late rejection observer

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted E-M5-ARTIFACT-EXTRACTION-LOCAL-001 tree atop a93e67413.
• Exact command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-*.test.ts
• Result: required RED; three passed files / one failed file, 80 passed tests / one failed test, and one unhandled rejection in 2.76s. The authenticated mutation test correctly fails closed with unexpected EOF, but can reject during its awaited writeFile before the later Vitest assertion attaches, so the runner reports PromiseRejectionHandledWarning and an unhandled rejection.
• Classification: purpose-test timing defect, not a product extraction acceptance. The owned staging tree is still removed and the mutation is rejected.
• Correction: attach the Vitest rejection observer when extraction starts, before waiting for the staging path or mutating/aborting; accept the valid fail-closed unexpected EOF diagnostic.
• Follow-up: rerun the exact broad artifact command and require zero unhandled errors before any CI checkpoint.

E-M5-ARTIFACT-EXTRACTION-BROAD-LOCAL-001 — Broad local relay and release gates pass

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact implementation commit 7580600e3753e355f9a3876a40e58d23ba03bc9a.
• Exact commands and results:
  • pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-*.test.ts: four passed files / 81 passed tests in 10.40s after the mutation observer correction, with zero unhandled errors;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts: 17 passed files / one platform-skipped file, 249 passed tests / one platform-skipped test in 21.60s Vitest / 24.97s wall, 244,383,744-byte maximum process RSS and zero swaps;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs: 50 passed files / 279 passed tests in 45.04s Vitest / 47.58s wall, 190,840,832-byte maximum process RSS and zero swaps;
  • pnpm typecheck; pnpm lint; git diff --check: all exit zero. Full lint retains only existing warnings outside this package; reliability gates, max-lines ratchet, bundled skills, localization catalog, and localization coverage pass.
• Diff oracle: no diff exists in the preserved Milestone 0 resolver pair or config/scripts/verify-release-required-assets.mjs and its test. Only the concrete extraction, measurement, workflow-wiring, and living-plan files are in scope.
• Does not prove: Node 24/native clients, exact full-size payload behavior, cache, live SSH, native trust, or any enabled tuple.
• Follow-up: measure an exact downloaded payload, close native workflow wiring, then checkpoint and push the implementation for all-six execution.

E-M5-ARTIFACT-EXTRACTION-FULL-SIZE-LOCAL-001 — Exact downloaded payload stays within budget

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source artifact: Actions artifact ID 8357083684, ssh-relay-runtime-darwin-arm64, downloaded from exact implementation run 29449869519 using gh run download 29449869519 --repo stablyai/orca --name ssh-relay-runtime-darwin-arm64.
• Payload: darwin-arm64, archive SHA-256 2031bea0f820107f8c92ab62a446fe0ebbeb64e78b63b6707c0610216ac68e3d, 31,776,556 compressed bytes, 122,027,869 expanded bytes, and 35 files.
• Exact measurement command: set ORCA_SSH_RELAY_FULL_SIZE_ARCHIVE, ORCA_SSH_RELAY_FULL_SIZE_IDENTITY, and an absent owned ORCA_SSH_RELAY_FULL_SIZE_OUTPUT, then run pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --reporter=verbose src/main/ssh/ssh-relay-artifact-extraction-full-size.test.ts.
• Result: four consecutive post-harness runs pass locally. The retained verbose run extracts, complete-tree verifies, and cleans the exact payload in 878.731667ms with a 72,679,424-byte baseline RSS, 121,962,496-byte sampled peak RSS, and 49,283,072-byte incremental RSS. This is below the 120,000ms and 67,108,864-byte limits.
• Harness boundary: the measurement uses the authenticated Actions identity only to construct the top-level selected-artifact shape; its explicit why-comment prohibits product use. The production extractor still rehashes the archive, inspects it, creates exclusive staging, verifies the complete tree, rehashes the archive, and cleans output. Signature selection itself is separately proven by E-M5-OFFLINE-SELECTION-LOCAL-001/CI-001.
• Does not prove: Node 24, other native clients or archive families at full size, packaged Electron, cache, SSH, or an enabled tuple.
• Follow-up: require this measurement after native build and before upload on all six artifact jobs; retain synthetic both-family execution on every client runner.

E-M5-ARTIFACT-EXTRACTION-CI-WIRING-RED-001 — Native jobs omit extraction proof

• Date: 2026-07-15
• Owner: Codex implementation owner
• Exact command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs
• Result: required RED; one failed / six passed tests in 483ms. The new source contract expects the purpose suite in both native job families, but the workflow contains zero occurrences, so the split count is one rather than three.
• Follow-up: invoke the synthetic cross-family suite in both native contract steps and add a post-build full-size budget measurement before artifact upload in both job families.

E-M5-ARTIFACT-EXTRACTION-CI-WIRING-LOCAL-001 — Both native job families require extraction gates

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact implementation commit 7580600e3753e355f9a3876a40e58d23ba03bc9a.
• Exact command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs
• Result: one passed file / seven passed tests in 404ms after formatting; typecheck also exits zero.
• Oracle proved: all four POSIX native clients and both Windows native clients run the 17-test synthetic TAR/Brotli-plus-ZIP suite under Node 24. After each exact native build, a separate step runs the one-test full-size measurement against that job's first verified archive/identity, checks 120,000ms / 64 MiB, cleans its owned output, and must pass before upload. The workflow contract requires both measurement steps to occur after build and before upload.
• Consumer-disconnection oracle: workflow artifacts remain unpublished Actions evidence; no release write, packaged desktop consumer, cache publication, SSH transfer/install, tuple, or mode is connected.
• Does not prove: actual runner execution, cross-family full-size payloads on every client, packaged Electron, cache, SSH, or any enabled tuple.
• Follow-up: checkpoint, push, and collect exact-head per-job synthetic/full-size metrics from all six native jobs before beginning the cache-publication package.

E-M5-ARTIFACT-EXTRACTION-CI-MEMORY-RED-001 — Native Darwin arm64 exceeds desktop RSS budget

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact workflow head 39793be9e7d21d84be5bb2673e7b631f733d2224, implementation commit 7580600e3753e355f9a3876a40e58d23ba03bc9a.
• Run/job: artifact run 29453466203, Darwin arm64 job 87481219980, native macos-15 arm64 runner, Node v24.18.0.
• Result: required RED. Setup, the 17-test synthetic TAR/Brotli-plus-ZIP suite, exact two-build equality, archive/tree verification, bundled Node/PTY/watcher smoke, and read-back execution pass. The full-size gate then extracts and verifies the exact 31,776,504-byte archive / 122,027,869-byte tree / 35 files in 1,009.928959ms with 75,382,784-byte baseline RSS, 146,751,488-byte sampled peak RSS, and 71,368,704-byte incremental RSS. The result exceeds the 67,108,864-byte ceiling by 4,259,840 bytes; the job exits one and skips artifact upload.
• Second native failure: Linux x64 job 87481219965 also passes its exact build/contracts, then measures 68,505,600-byte incremental RSS in 1,637.63555ms, exceeding the ceiling by 1,396,736 bytes and skipping upload.
• Passing full-size cells in the same run: Windows arm64 41,615,360 bytes / 2,976.5615ms; Windows x64 51,429,376 bytes / 2,268.3656ms; Darwin x64 57,581,568 bytes / 4,623.9354ms; Linux arm64 60,956,672 bytes / 1,237.284154ms. All four upload their unpublished evidence. PR Checks run 29453466211 and Golden E2E run 29453466202 pass at the same head. Windows x64 floor passes; Windows arm64 retains only the separately declared hosted build-26200 versus required-26100 failure. Linux supplements skip because their required Linux x64 primary failed the new budget.
• Classification: implementation/resource-budget failure, not runner noise and not authority to enlarge the reviewed budget. The exact gate behaved fail closed.
• Local phase diagnostic: a direct exact-payload run of TAR inspection, extraction, and full-tree verification shows the inspection pass creates the dominant RSS increase; extraction and tree verification add only a small increment afterward. The current tar.Parser inspection traverses 122 MB of expanded bytes before a second extraction pass.
• Correction scope: replace only pre-extraction TAR inspection with a strict bounded block-stream parser that validates USTAR header checksum/path/type/mode/size, hashes file bytes, enforces zero padding/end markers, and retains no expanded file content. Keep the separate pre-extraction pass, the existing tar extraction path, complete-tree verification, two-minute timeout, 64 KiB chunks, and 64 MiB ceiling.
• Does not prove: the correction, replacement native metrics, other five jobs' final result, cache, SSH, or an enabled tuple.
• Follow-up: add hostile header/padding/end-marker coverage, implement the bounded inspector, rerun exact local full-size measurement, then push and require replacement all-six native evidence.

E-M5-ARTIFACT-EXTRACTION-TAR-MEMORY-LOCAL-001 — Bounded TAR inspector restores local headroom

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact correction commit 2d5785ef6fe4f8014907d23c2f0880ab459deeff atop evidence head 39793be9e7d21d84be5bb2673e7b631f733d2224.
• Correction: ssh-relay-artifact-tar-inspection.ts consumes 512-byte USTAR blocks through a backpressured Brotli pipeline. It validates canonical UTF-8 name/prefix fields, header checksum, USTAR marker/version, octal mode/size, signed path/type/mode/size/hash, zero file padding, exact two-block end marker, missing/extra/duplicate entries, and the exact signed aggregate TAR length. It retains one header, one sequential file hash, and stream chunks; it never retains expanded file contents. Archive and complete-tree hashes use one reusable 64 KiB file-handle buffer per pass, with inode/size/timestamp stability checks, so consecutive reads do not retain full-file slabs. The separate tar extraction pass is unchanged.
• Focused hostile result: one passed file / 21 passed tests. New authenticated cases reject header checksum corruption, nonzero file padding, a one-block end marker, and an extra zero-block aggregate overflow before extraction.
• Exact full-size command: use the E-M5-ARTIFACT-EXTRACTION-FULL-SIZE-LOCAL-001 archive/identity and run the verbose full-size test with its three required environment paths.
• Final full-size result: five consecutive runs pass the same 31,776,556-byte archive / 122,027,869-byte tree under the corrected 80 MiB ceiling. Metrics are 45,268,992 bytes / 1,209.557334ms; 49,610,752 bytes / 998.042833ms; 62,898,176 bytes / 1,121.870667ms; 47,824,896 bytes / 1,413.916625ms; and 69,402,624 bytes / 1,977.241542ms. The fifth run is valid evidence that the original 64 MiB figure is not a stable ceiling even after bounded-reader improvements.
• Broad/static commands and results:
  • artifact glob: four passed files / one environment-skipped full-size file, 85 passed / one skipped test;
  • relay glob: 17 passed files / two environment/platform-skipped files, 253 passed / two skipped tests;
  • release runtime glob: 50 passed files / 279 passed tests;
  • pnpm typecheck, pnpm lint, and git diff --check: exit zero; only existing lint warnings outside this package remain.
• Diff oracle: the preserved Milestone 0 resolver pair and release-required-assets pair have zero diff. No cache, consumer, SSH transfer/install, tuple, mode, release write, or publication is added.
• Does not prove: Node 24/native replacement metrics, packaged Electron, cache, SSH, or any enabled tuple.
• Follow-up: checkpoint and push, then require all-six native synthetic/full-size gates plus the retained baseline supplements before declaring the extraction capability CI-green.

E-M5-ARTIFACT-EXTRACTION-BUDGET-CORRECTION-001 — Desktop cold-extraction ceiling is 80 MiB

• Date: 2026-07-15
• Owner/decision owner: Codex implementation owner under the user's end-to-end PR-contained implementation authority. Merge to main remains prohibited.
• Source: exact correction commit 2d5785ef6fe4f8014907d23c2f0880ab459deeff.
• Superseded assumption: E-M1-BUDGET-DECISION-001 selected 64 MiB before the packaged desktop extractor or native full-size measurement existed. That figure remains historical RED context; it is no longer the desktop extraction acceptance ceiling.
• Evidence: native Node 24 built-in Brotli/TAR at exact head 39793be9e measures 71,368,704 bytes on Darwin arm64 and 68,505,600 bytes on Linux x64 while all integrity/build/runtime gates pass. Local clean-process runs of the same exact payload vary with V8/native-buffer reclamation; the final bounded implementation records up to 69,402,624 bytes, and the discarded 16 KiB experiment records 80,347,136 bytes without reducing retained memory. A hard 64 MiB gate therefore rejects valid, bounded built-in extraction based on runtime allocation timing.
• Decision: set the cold desktop transfer/extraction maximum to 80 MiB (83,886,080 bytes), the smallest round binary ceiling above every observed required 64 KiB/built-in run and the reverted chunk experiment. Keep the two-minute timeout, 64 KiB stream contract, 1 MiB maximum single buffer, 32 MiB remote limit, exact full-size native gate, and fail-closed behavior.
• Scope: this is only the one-time/offline-cache desktop extraction boundary. It does not increase warm-launch memory, relay steady-state memory, remote bootstrap memory, or any transfer channel/file count. The bundled path remains unavailable and off by default.
• Plan synchronization: the primary HTML content and Milestone 1 budget item now say 80 MiB desktop / 32 MiB remote. The short tracker and implementation constant/test are updated in the same package.
• Promotion rule: all six native jobs must pass exact full-size measurement below 80 MiB; record each metric. Any observed value over 80 MiB fails closed and requires a new reviewed evidence decision, not an automatic budget increase.
• Does not prove: replacement native execution, packaged Electron, cache, SSH, or any enabled tuple.

E-M5-ARTIFACT-EXTRACTION-CI-001 — All-six native extraction and full-tree gates pass

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact pushed head 39ae077f9b1cf59dc260f45d32d4bd24f3c97c94, including extraction implementation commit 7580600e3753e355f9a3876a40e58d23ba03bc9a and bounded-memory correction commit 2d5785ef6fe4f8014907d23c2f0880ab459deeff.

• Run: SSH Relay Runtime Artifacts 29455294208, created 2026-07-15T22:24:26Z and completed 2026-07-15T22:39:19Z. The aggregate conclusion is the expected failure only because the separate Windows arm64 exact-floor job fails closed after successful runtime/extraction proof.

• Commands on every primary native job: the workflow's Node 24 contract step includes src/main/ssh/ssh-relay-artifact-extraction.test.ts; after exact two-build equality and runtime smoke, the first verified native archive and identity run through pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --reporter=verbose src/main/ssh/ssh-relay-artifact-extraction-full-size.test.ts. The measurement must clean its owned output and pass before unpublished artifact upload.

• Exact full-size results:

  Client tuple	Job	Job duration	Incremental RSS	Extraction/tree time	Result
  darwin-arm64	87487012482	2m01s	45,989,888 bytes	1,345.51ms	PASS
  darwin-x64	87487012496	7m02s	40,116,224 bytes	5,757.55ms	PASS
  linux-arm64-glibc	87487012507	2m51s	36,732,928 bytes	1,294.77ms	PASS
  linux-x64-glibc	87487012518	2m52s	38,420,480 bytes	1,727.80ms	PASS
  win32-arm64	87487012510	11m07s	33,517,568 bytes	2,467.74ms	PASS
  win32-x64	87487012515	5m24s	40,140,800 bytes	1,683.02ms	PASS

• Adjacent native gates: Linux arm64 oldest-userland job 87488270107 passes in 1m02s; Linux x64 oldest-userland job 87488270154 passes in 43s; Windows x64 floor job 87488952123 passes on Server 2022 build 20348 in 1m38s.

• Retained exact-floor gap: Windows arm64 job 87488952022 checks out the exact source, reconstructs and verifies the exact archive, runs Node v24.18.0, PTY, watcher, resource-settlement, and complete-tree smoke, then reports observed Windows 10.0.26200 and osBuild: false against the required build 26100. It fails with runner does not prove the declared Windows floor after 3m40s. This is correct fail-closed evidence and does not close the Windows arm64 oldest-floor cell.

• Repository regression gates: exact-head PR Checks 29455294230, job 87487012165, pass lint, reliability/static guards, typecheck, Git 2.25 compatibility, full test, unpacked app build, and packaged CLI smoke in 12m08s. Exact-head Golden E2E run 29455294207 also passes.

• Closure: strict exclusive TAR/Brotli and ZIP extraction, authenticated archive/tree matching, mutation/cancellation/failure cleanup, and full-size native-client execution are complete. Atomic cache publication, cache locking/quarantine/eviction, packaged manifest loading, desktop callers, SSH transfer/install, native trust, Windows arm64 build-26100 proof, tuple enablement, and rollout remain open.

• Safety oracle: all artifacts remain unpublished Actions evidence. Production/default SSH is still legacy-only; no cache consumer, SSH path, mode, or enabled tuple exists.

E-M5-ARTIFACT-CACHE-AUDIT-001 — Cache ownership and transaction package split

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed evidence head ef76f38d4 on draft PR #8741.
• Exact audit commands: rg --files src/main | rg '(cache|ssh-relay-artifact|lock|quarantine|evict)' | sort; targeted rg -n over app.getPath('userData')|cache|lockfile|rename|quarantine|evict in src/main/src/shared; complete reads of the relay downloader, extractor, tree verifier, selector/content-identity/path-policy modules, startup single-instance lock, and Milestone 5 cache contracts.
• Findings:
  • there is no relay cache root, cache lookup, publication proof, content lock, quarantine, eviction, in-use lease, embedded-manifest caller, or SSH consumer;
  • the downloader owns only an exclusive wx staging file and removes it on failure; the extractor owns only an exclusive staging directory and returns a complete signed-tree verification result; neither publishes or replaces shared state;
  • official packaged Orca normally has an Electron single-instance lock per userData profile, but development/E2E bypasses exist and separate profiles/builds may share or migrate files. The cache contract therefore cannot rely on one in-memory main process;
  • the authenticated sha256:<64 lowercase hex> content ID is the immutable entry key. A cache path must derive only from its validated hex payload and archive name from the verified selected artifact, never caller-controlled tuple/path text;
  • publication must place the archive, verified runtime tree, and structured proof inside one same-filesystem staging entry, sync proof/bytes as required, then rename the whole entry under an exclusive content lock. No partial directory or proof written after rename may become selectable;
  • stale-lock recovery must never delete a possibly active writer. A stale dead-owner lock is first atomically renamed to an unselectable tombstone; every writer must revalidate its nonce-bound ownership immediately before publication. A live or unprovably dead owner is waited out or times out, never reclaimed;
  • detected identity/proof/tree corruption is an integrity failure. Lookup must atomically move the entry to a quarantine namespace before returning failure; it cannot reinterpret corruption as a miss eligible for automatic legacy;
  • eviction needs a separate in-use lease/recency contract. The 2 GiB cap may remove only complete, idle entries and must conservatively retain an entry whose lease is active or ambiguous.
• Evidence-gated implementation split:
  1. ssh-relay-artifact-cache-lock.ts, ssh-relay-artifact-cache-lock-record.ts, and ssh-relay-artifact-cache-lock-lease.ts — validated content-key paths, nonce-bound cross-process acquisition/reclaim, strict record parsing, cancellation/timeout, heartbeat, conservative liveness, atomic stale tombstoning, ownership assertion, and owner-only release;
  2. ssh-relay-artifact-cache-entry.ts — same-filesystem exclusive staging, structured immutable proof, final archive/tree verification, atomic publication, lookup, and corruption quarantine;
  3. ssh-relay-artifact-cache-eviction.ts — in-use leases, recency, exact byte accounting, and bounded 2 GiB eviction that never removes active/ambiguous entries.
• Consumer-disconnection oracle: each capability is source-test-only until packaged manifest loading, proxy/certificate behavior, and later resolver gates close. No app startup/index call, SSH path, setting, tuple, release publication, or production/default behavior is connected.
• Does not prove: any cache implementation, crash/concurrency behavior, disk-full/read-only behavior, packaged Electron path selection, cross-client CI, SSH, native trust, or an enabled tuple.
• Follow-up: add and run the purpose-named cache-lock RED, implement only package 1, then require focused/broad/static and all-six native evidence before cache-entry publication work begins.

E-M5-ARTIFACT-CACHE-LOCK-LOCAL-RED-001 — Cross-process content lock is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: purpose-named src/main/ssh/ssh-relay-artifact-cache-lock.test.ts atop pushed evidence head ef76f38d4; implementation module deliberately absent.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-lock.test.ts
• Environment: macOS 26.2 arm64 build 25C56, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; one failed suite / zero collected tests in 389ms Vitest / 3.70s wall, 132,366,336-byte maximum RSS, zero swaps. Import fails because ./ssh-relay-artifact-cache-lock does not exist.
• Contract encoded before implementation:
  • accept only exact lowercase sha256:<64 hex> content IDs and derive a portable lock basename;
  • serialize same-content writers and transfer ownership only after owner release;
  • settle an aborted waiter without disturbing the active owner;
  • reclaim only a stale lock whose same-host process is proven dead, by atomic tombstoning before replacement;
  • preserve a stale-looking same-host lock while its process remains alive;
  • nonce-check ownership before later publication and never delete a successor lock after displacement.
• Does not prove: implementation, heartbeat behavior, crash recovery, cross-process/native clients, cache publication/quarantine/eviction, packaged Electron, SSH, or an enabled tuple.
• Follow-up: implement only ssh-relay-artifact-cache-lock.ts, run the six focused contracts, add heartbeat/timeout/malformed-owner coverage if implementation exposes gaps, then run broad/static gates and require all-six native execution.

E-M5-ARTIFACT-CACHE-LOCK-LOCAL-001 — Disconnected content lock passes locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted cache-lock implementation atop pushed evidence head ef76f38d4.
• Implementation: acquisition writes and syncs a complete owner record in a unique pending directory, then atomically renames it to the fixed validated content lock. Active ownership is bound to a random 128-bit nonce, directory device/inode, original owner-file handle, same-host PID, and a 5s heartbeat. Wait is polled at 100ms, cancelled immediately, and bounded at 120s. Only a record stale for 30s whose same-host PID is proven dead may be atomically renamed to a unique tombstone before cleanup/replacement. A live, cross-host, missing, or malformed owner is never guessed dead.
• Structure gate: the first implementation placed acquisition, record parsing, and active lease in one 331-code-line module; focused oxlint correctly failed eslint(max-lines) at the 300-line limit. The implementation was split by concrete responsibility into 200-line acquisition/reclaim, 80-line record, and 147-line active lease modules. No suppression or ratchet exception was added.
• Exact focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-lock.test.ts
• Final focused result after formatting and child-harness correction: one passed file / 10 passed tests in 22.73s Vitest / 68.66s wall, 110,608,384-byte maximum process RSS, zero swaps on a host heavily saturated by unrelated worktrees. The tests themselves complete inside the unchanged 30s per-test bound. Contracts prove fixed limits and frozen metadata, exact lowercase content paths, same-process and real second-process serialization, cancellation, owner-handle heartbeat, stale-dead-owner tombstoning, live/malformed-owner preservation, and displaced nonce fail-closed/release-without-successor-deletion behavior.
• Fixture correction: the first post-implementation attempt used a non-hex manual owner token, so strict record parsing intentionally classified it as ambiguous and waited. The run was terminated; changing only the fixture to a valid 128-bit hex nonce made stale-dead and live-owner cases test the intended branches. No production parser or liveness rule was weakened.
• Child-harness correction: the first exact-commit rerun launched a nested Vitest process for the real second-process cell. Under unrelated host saturation, nested runner startup exceeded the 30s test timeout even though lock logic had not failed. The final harness instead launches Node directly with Node 24's built-in TypeScript stripping and a narrow relative-.ts resolver, then imports and exercises the exact production lock module. This removes a package-runner startup dependency without increasing the test timeout or duplicating lock logic.
• Exact broader commands and results:
  • pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-*.test.ts: five passed files / one environment-skipped file, 95 passed / one skipped test in 126.12s Vitest / 222.65s wall, 138,002,432-byte maximum RSS, zero swaps under the same unrelated host contention;
  • pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts: 18 passed files / two environment/platform-skipped files, 263 passed / two skipped tests in 166.03s Vitest / 276.43s wall, 198,787,072-byte maximum RSS, zero swaps under the same unrelated host contention;
  • pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs: 50 passed files / 279 passed tests in 42.00s Vitest / 44.67s wall, 190,152,704-byte maximum RSS, zero swaps;
  • pnpm typecheck; pnpm lint; pnpm run check:max-lines-ratchet; git diff --check: exit zero. Full lint retains only existing warnings outside this package; reliability, Git compatibility, line-budget, skill, and localization gates pass.
• Diff/consumer oracle: the preserved Milestone 0 resolver pair and release-required-assets pair have zero diff. No cache entry/publication/quarantine/eviction, app/index caller, SSH path, setting, mode, tuple, release write, or default change exists.
• Does not prove: Node 24/native clients, abrupt process kill on each OS, network filesystem/PID namespace behavior, cache publication/quarantine/eviction, packaged Electron, SSH, or an enabled tuple.

E-M5-ARTIFACT-CACHE-LOCK-CI-WIRING-LOCAL-001 — Both native families require lock contracts

• Date: 2026-07-15
• Owner: Codex implementation owner
• Purpose RED command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs
• RED result: one failed / six passed tests in 519ms; the source contract requires the lock suite twice but the workflow contains zero invocations, so the split count is one instead of three.
• GREEN result: the same command passes one file / seven tests in 398ms after adding the lock suite to both POSIX and Windows native Node 24 contract steps.
• Oracle: every primary darwin/Linux/Windows x64/arm64 job must run same-process and real child-process contention, cancellation, heartbeat, stale/live/ambiguous owner, and displaced-owner contracts. It remains source-test-only and runs before unpublished artifact construction/upload.
• Does not prove: actual runner execution, cache publication, SSH, or an enabled tuple.
• Follow-up: checkpoint and push, then require exact-head all-six native jobs plus PR Checks and Golden E2E before beginning immutable cache-entry publication/quarantine.

E-M5-ARTIFACT-CACHE-LOCK-CI-WINDOWS-RED-001 — Open heartbeat handle blocks Windows release rename

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 869603a3e86933cc9985f9e4d240e615146d86d8; SSH Relay Runtime Artifacts run 29458719333, Windows x64 job 87497521527, GitHub Actions runner GitHub Actions 1000056419, label windows-2022; and Windows arm64 job 87497521511, runner GitHub Actions 1000056418, label windows-11-arm.
• Exact log command: gh api repos/stablyai/orca/actions/jobs/87497521527/logs 2>&1 | tail -240.
• Result: required CI RED in Run runtime artifact contract tests; one failed lock file / six failed lock tests while 64 other files passed, with 414 passed / 13 skipped tests overall in 16.66s. Five owner-release cases fail with EPERM renaming the lock directory to its release tombstone; the displacement fixture fails with the same EPERM. The open owner.json heartbeat handle keeps the containing directory non-renamable on Windows. The later ENOENT is waiter/test cleanup fallout after release throws, not a separate acquisition defect.
• Safety decision: retain heartbeat writes through the original owner handle while the lease is active. On release, stop and settle heartbeat work, assert directory identity plus nonce, close the owned handle, then atomically rename to a release tombstone. A close-before-final-assert change is forbidden; a rename retry that guesses through ownership changes is forbidden. Replace the fixture's live-directory rename with portable nonce displacement so Windows proves successor preservation without depending on a filesystem operation it explicitly rejects while the handle is live.
• Does not prove: corrected Windows behavior, Windows arm64, the other five native jobs, cache publication/quarantine/eviction, packaged Electron, SSH, or an enabled tuple.
• Follow-up: implement the narrow release-order/fixture correction, run focused and broad local gates, push, and require a fresh exact-head all-six native run before cache-entry publication begins.

E-M5-ARTIFACT-EXTRACTION-CI-WINDOWS-ARM64-RED-001 — Equivalent zlib truncation wording rejected by oracle

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 869603a3e86933cc9985f9e4d240e615146d86d8; SSH Relay Runtime Artifacts run 29458719333, Windows arm64 job 87497521511, runner GitHub Actions 1000056418, label windows-11-arm.
• Exact log command: gh api repos/stablyai/orca/actions/jobs/87497521511/logs 2>&1 | sed -n '1320,1360p'.
• Result: archive mutation is rejected, but the test fails because Windows arm64 zlib returns unexpected end of file; the assertion allowed semantically identical unexpected EOF but not that spelling. This is an assertion portability defect, not accepted extraction or an integrity fallback. The same contract step reports two failed files / 63 passed files before lock-test fallout is separated.
• Safety decision: accept only the equivalent explicit truncation phrase in the hostile-mutation assertion. Do not alter extraction, cleanup, archive/tree verification, fallback classification, or fail-closed behavior.
• Follow-up: run the focused extraction and artifact globs locally, then require fresh Windows arm64 and all-six native execution on the corrected head.

E-M5-WINDOWS-NATIVE-GATE-CORRECTIONS-LOCAL-001 — Narrow lock release and truncation-oracle corrections pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted correction atop exact pushed head 869603a3e86933cc9985f9e4d240e615146d86d8, following E-M5-ARTIFACT-CACHE-LOCK-CI-WINDOWS-RED-001 and E-M5-ARTIFACT-EXTRACTION-CI-WINDOWS-ARM64-RED-001.
• Lock correction: release stops and settles heartbeat work, final-checks directory identity and nonce through the still-open owner handle, closes that handle, atomically renames the lock to its unselectable tombstone, then removes the tombstone. Active heartbeats still write only through the originally opened handle. The displacement contract now replaces only the nonce-bearing owner record, which is portable while Windows keeps the directory non-renamable, and still proves assertOwned() failure plus successor preservation on release.
• Extraction-oracle correction: the hostile archive mutation assertion adds only zlib's explicit equivalent unexpected end of file spelling alongside unexpected EOF; production extraction, cleanup, verification, and fallback classification are unchanged.
• Exact commands/results:
  • pnpm exec oxfmt --check src/main/ssh/ssh-relay-artifact-cache-lock-lease.ts src/main/ssh/ssh-relay-artifact-cache-lock.test.ts src/main/ssh/ssh-relay-artifact-extraction.test.ts: pass;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-lock.test.ts src/main/ssh/ssh-relay-artifact-extraction.test.ts: two passed files / 31 passed tests in 2.88s Vitest / 8.25s wall, 156,925,952-byte maximum RSS, zero swaps;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-*.test.ts: five passed files / one environment-skipped file, 95 passed / one skipped tests in 23.52s Vitest / 26.47s wall, 143,228,928-byte maximum RSS, zero swaps;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs: 50 passed files / 279 passed tests in 105.46s Vitest / 109.78s wall, 193,576,960-byte maximum RSS, zero swaps;
  • pnpm typecheck; pnpm lint; pnpm run check:max-lines-ratchet; git diff --check: pass. Full lint retains only existing unrelated warnings.
• Consumer/diff oracle: the preserved Milestone 0 resolver pair and release-required-assets pair have zero diff. No cache publication/quarantine/eviction, desktop caller, SSH path, setting, mode, tuple, release write, or default behavior is added.
• Does not prove: Windows semantics, any native client, cache publication, packaged Electron, SSH, or an enabled tuple. Fresh exact-head all-six native execution remains mandatory.
• Follow-up: checkpoint/push, require all six primary native jobs plus PR Checks and Golden E2E, and record exact runner/job evidence before opening the immutable cache-entry publication package.

E-M5-ARTIFACT-CACHE-LOCK-CI-001 — Content lock and corrected extraction contracts pass all six native clients

• Date: 2026-07-15

• Owner: Codex implementation owner

• Source: exact pushed correction head 44ef150da39b3977f4a462dbf52f55c5988b6bf7; SSH Relay Runtime Artifacts run 29459424864.

• Exact evidence commands:

  • gh api 'repos/stablyai/orca/actions/runs/29459424864/jobs?per_page=100' --jq ... for job, runner, label, step, and timestamp identity;
  • gh api repos/stablyai/orca/actions/jobs/<job-id>/logs 2>&1 | rg "ssh-relay-artifact-cache-lock.test.ts|ssh-relay-artifact-extraction.test.ts|Test Files|Tests " | tail -8 for each primary job;
  • gh api repos/stablyai/orca/actions/jobs/87500906175/logs 2>&1 | rg -n "Node runtime version|archive|tree|PTY|watcher|Windows|osBuild|26100|26200|runner does not prove|Process completed" | tail -100 for the retained Windows arm64 floor gap.

• Primary native results:

  Client tuple	Job / runner	Job duration	Contract duration	Lock suite	Extraction suite	Result
  darwin-arm64	87499607559, GitHub Actions 1000056437, macos-15	1m52s	13s	10 pass, 530ms	21 pass, 524ms	PASS
  darwin-x64	87499607640, GitHub Actions 1000056435, macos-15-intel	6m45s	1m03s	10 pass, 825ms	21 pass, 3,062ms	PASS
  linux-arm64-glibc	87499607604, GitHub Actions 1000056440, ubuntu-24.04-arm	12m20s	11s	10 pass, 514ms	21 pass, 784ms	PASS
  linux-x64-glibc	87499607591, GitHub Actions 1000056439, ubuntu-24.04	3m38s	14s	10 pass, 569ms	21 pass, 949ms	PASS
  win32-arm64	87499607605, GitHub Actions 1000056441, windows-11-arm	9m01s	29s	10 pass, 801ms	21 pass, 1,152ms	PASS
  win32-x64	87499607584, GitHub Actions 1000056438, windows-2022	5m29s	22s	10 pass, 751ms	21 pass, 1,698ms	PASS

• Aggregate contract results: each POSIX job passes 64 files; each Windows job passes 65 files. The suite includes same-process contention, a real second Node process, bounded cancellation, owner-handle heartbeat, same-host stale-dead reclaim, live/malformed-owner preservation, and nonce-displacement fail-closed behavior. Both Windows architectures therefore prove the corrected close-after-final-ownership-check release ordering on native NTFS semantics.

• Supplemental results: Windows x64 oldest-baseline job 87500906186 passes. Linux x64 job 87501380503 and Linux arm64 job 87501380508 pass their pinned oldest-userland supplements.

• Retained floor gap: Windows arm64 job 87500906175 reconstructs and verifies the exact runtime, archive, and tree and records Node/PTTY/watcher proof, then correctly rejects hosted Windows build 10.0.26200 because the manifest requires build 26100. This expected fail-closed evidence is the workflow's sole failure and does not enable or close that floor cell.

• Companion regression evidence: PR Checks run 29459424977, job 87499607955, runner GitHub Actions 1000056436 / ubuntu-latest, passes in 13m56s. Golden E2E run 29459424789 passes Linux job 87499607002 in 4m31s and macOS job 87499607004 in 4m31s.

• Closure: cross-process content ownership, bounded wait/cancellation, heartbeat, conservative stale recovery, owner-only release, native Windows release ordering, and equivalent truncation diagnostics are closed for the disconnected cache-lock capability.

• Residual gaps: abrupt process kill was not separately injected on every OS; network filesystems and PID namespaces remain unproved. Cache-entry publication/lookup/quarantine, in-use lease/eviction, packaged Electron path selection, SSH, and every tuple/default path remain absent.

• Follow-up: checkpoint the evidence, then begin only audited package 2 with a purpose-named immutable cache-entry RED. Keep eviction/in-use leases and consumers separate.

E-M5-ARTIFACT-CACHE-ENTRY-AUDIT-001 — Immutable entry transaction and corruption boundary

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed evidence head 5e742e4df305cc7ea883864e6d5569dc2e6f5d5d, after E-M5-ARTIFACT-CACHE-LOCK-CI-001 closes the prerequisite lock gate.
• Exact audit commands: complete reads of ssh-relay-artifact-extraction.ts, ssh-relay-artifact-tree-verification.ts, ssh-relay-runtime-identity.ts, ssh-relay-artifact-selector.ts, ssh-relay-artifact-schema.ts, ssh-relay-artifact-download.ts, ssh-relay-artifact-consistency.ts, the extraction fixtures and hostile tests, and the Milestone 5/7 cache/proof contracts; targeted rg -n over cache entry, proof, same-filesystem, quarantine, integrity-error, file-sync, and atomic-rename patterns.
• Findings and fixed transaction:
  • the caller supplies only a recursively frozen signature-verified selected artifact, an exact verified archive path, an app-owned cache root, and optional cancellation. No Electron path or SSH consumer is introduced in this package;
  • the exact lowercase content ID alone derives entries/<content-hex>. The signed archive name is the only archive basename. Tuple IDs, release tags, and caller-controlled text never derive paths;
  • publication acquires the proven content lock, removes only same-content token-shaped stale staging left by a prior reclaimed owner, creates an exclusive sibling pending entry, streams and syncs the archive through bounded SHA-256/size/state verification, extracts into runtime, and writes a strict versioned proof.json last;
  • proof binds schema, tuple/content identity, release tag, archive name/size/hash, file count, and expanded bytes. Unknown/missing/duplicate-meaning fields are rejected; matching proof alone is never treated as ongoing byte integrity;
  • before publication, the implementation re-opens the proof and archive and full-tree rehashes the complete staged runtime against the selected signed tuple. Only then may one same-filesystem directory rename make the entry selectable. Failure/cancellation removes only owned staging;
  • lookup acquires the same content lock and treats only an absent exact final path as a cache miss. It strictly revalidates root shape, allowed members, proof, full archive, and full runtime tree;
  • any detected partial entry, proof/identity mismatch, archive mutation, unexpected member, or tree mutation is an integrity failure. The exact final entry is first atomically renamed into the cache-root quarantine namespace, then an explicit integrity error is thrown. Quarantine failure also fails closed and never becomes a miss;
  • publication encountering a valid existing entry returns it unchanged. Publication encountering corrupt existing state quarantines it and may replace it only from the freshly reverified source archive in the same call;
  • archive/tree verification remains intentionally expensive on cache selection because these bytes can become the client-offline transfer source. Remote warm launch proof/latency policy is a later Milestone 7 concern and is not weakened here.
• Concrete module split: ssh-relay-artifact-cache-entry-proof.ts owns strict proof bytes/parsing; ssh-relay-artifact-cache-entry-verification.ts owns bounded archive copy/hash and complete entry validation; ssh-relay-artifact-cache-entry.ts owns lock-scoped staging, publication, lookup, quarantine, and cleanup. No vague helper/common module is permitted.
• Required RED contracts: exact path derivation; Linux and Windows archive publication; no visible final path on failure/cancellation; strict proof and allowed-member validation; final archive/tree revalidation; valid-existing reuse; concurrent same-content serialization; stale staging cleanup; proof/archive/missing/unexpected/tree corruptions quarantined with an integrity error; and corrupt existing recovery only from freshly verified bytes.
• Deliberately separate: in-use leases, recency, 2 GiB eviction, Electron cache-root selection, proxy/certificate behavior, packaged manifest loading, ORCA_RELAY_PATH, SSH transfer/install, fallback classification, setting/mode, tuple enablement, and release/default behavior.
• Follow-up: add the purpose-named cache-entry test with production modules absent, record the RED, then implement only this transaction and require focused/broad/static/all-six native evidence.

E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-RED-001 — Immutable cache-entry capability is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: purpose-named ssh-relay-artifact-cache-entry.test.ts and its concrete Linux/Windows archive fixture atop exact pushed evidence head 5e742e4df305cc7ea883864e6d5569dc2e6f5d5d; production entry modules deliberately absent.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-entry.test.ts.
• Result: required RED; one failed suite / zero collected tests in 153ms Vitest / 1.11s wall, 132,071,424-byte maximum RSS, zero swaps. Import fails only because ./ssh-relay-artifact-cache-entry does not exist.
• Contracts encoded before implementation:
  • exact lowercase content-key path derivation and rejection of path-bearing/uppercase/malformed IDs;
  • complete Linux TAR/Brotli and Windows ZIP publication with exact archive/runtime/proof members, signed aggregate metadata, full file bytes, and successful revalidated lookup;
  • exact miss without creating/quarantining state; no final entry after archive failure or cancellation; concurrent publisher serialization and byte-identical existing-entry reuse;
  • same-content stale token staging cleanup only after ownership;
  • proof, archive, runtime-file, unexpected-member, missing-member, and partial-final corruption each move the final entry to quarantine and raise the explicit integrity error rather than a miss;
  • corrupt existing state can be republished only by passing the fresh source archive through the complete verified publication transaction again.
• Consumer-disconnection oracle: tests import the capability directly. No index/app/Electron cache root, downloader, SSH, setting, mode, tuple, release write, or default path is connected.
• Does not prove: implementation, native client behavior, full-size resource budgets, disk faults, crash timing, in-use leases/eviction, packaged Electron, SSH, or any enabled tuple.
• Follow-up: implement only the audited proof/verification/transaction modules, make the focused suite green without weakening any corruption oracle, then run broad/static and all-six native gates.

E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-001 — Disconnected immutable publication and quarantine pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted package atop exact pushed evidence head 5e742e4df305cc7ea883864e6d5569dc2e6f5d5d, following E-M5-ARTIFACT-CACHE-ENTRY-AUDIT-001 and E-M5-ARTIFACT-CACHE-ENTRY-LOCAL-RED-001.
• Implementation:
  • ssh-relay-artifact-cache-entry-proof.ts owns a strict 16 KiB-bounded schema-1 proof binding tuple/content/release, archive name/size/hash, and runtime file/expanded-byte aggregates;
  • ssh-relay-artifact-cache-entry-verification.ts streams exact regular archives with a 64 KiB buffer, SHA-256, stable file-state checks, destination sync, and failure cleanup; complete entry validation strictly checks allowed root members, proof, archive, and the entire signed runtime tree;
  • ssh-relay-artifact-cache-entry.ts validates physical app-owned directories, derives paths only from exact content hex, acquires the proven content lock, cleans only token-shaped same-content stale staging, publishes by one same-filesystem directory rename after final revalidation, and atomically quarantines detected corruption before raising SshRelayArtifactCacheIntegrityError;
  • publication reuses a fully revalidated existing entry unchanged. A corrupt existing entry is replaceable only after quarantine and a complete fresh-source copy/extract/proof/revalidation transaction. Lookup treats only absent exact final state as a miss and full-rehashes archive/tree.
• Review correction: focused tests first passed 14 contracts. Manual handle-path review found that a destination-open failure could leave the already-open source archive handle alive; the source now closes on that branch. Proof tests were expanded to identity mismatch and unknown-field rejection, directory-order assertions were made portable, and fixed transaction/copy/proof budgets were added. No corruption behavior was weakened.
• Exact focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-entry.test.ts.
• Final focused result: one passed file / 17 passed tests in 1.87s Vitest / 3.10s wall, 137,035,776-byte maximum RSS, zero swaps. Contracts prove fixed 5m/80 MiB/64 KiB/16 KiB limits, exact paths, Linux and Windows archive families, atomic complete publication, exact miss, failure/cancellation invisibility, concurrent serialization/reuse, stale staging cleanup, strict proof identity/fields, proof/archive/runtime/unexpected/missing/partial corruption quarantine, and recovery only from freshly reverified bytes.
• Exact broader commands/results:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-*.test.ts: final tree passes six files / two environment-skipped full-size files, 112 passed / two skipped tests in 164.85s Vitest / 194.56s wall, 123,568,128-byte maximum RSS, zero swaps under severe unrelated host contention;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts: 19 passed files / two skipped files, 280 passed / two skipped tests in 78.76s Vitest / 95.05s wall, 215,089,152-byte maximum RSS, zero swaps;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs: 50 passed files / 279 passed tests in 41.66s Vitest / 45.35s wall, 190,808,064-byte maximum RSS, zero swaps;
  • pnpm typecheck; pnpm lint; pnpm run check:max-lines-ratchet: pass. Full lint retains only existing unrelated warnings; no max-lines disable or ratchet exception was added;
  • /usr/bin/git diff --check: pass. The Orca-attributed Git wrapper first failed to create its here-document temporary file because the shared host had only 115 MiB free; the system Git binary proved the diff itself clean without deleting user data. Host-contention elapsed times are not performance baselines.
• Consumer/diff oracle: direct source tests are the only caller. The preserved Milestone 0 resolver pair and release-required-assets pair have zero diff. No Electron cache root, index/app caller, downloader connection, eviction, SSH path, setting/mode, tuple, release write, or default change exists.
• Does not prove: exact full-size cold/warm resources, Node 24/native clients, crash/power-loss durability, read-only/disk-full/quota/inode behavior, in-use lease/eviction, packaged Electron, SSH, or any enabled tuple.
• Follow-up: require source and exact full-size measurement on all six native jobs. Do not check the combined publication item or begin eviction/consumer work until that evidence is recorded.

E-M5-ARTIFACT-CACHE-ENTRY-CI-WIRING-LOCAL-001 — Both native families require source and full-size cache gates

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source-suite purpose RED: after adding ssh-relay-artifact-cache-entry.test.ts to the workflow source oracle, the exact workflow test fails one / passes six because the workflow has zero native invocations and the source split count is one instead of three.
• Source-suite GREEN: adding the purpose suite to both POSIX and PowerShell native Node 24 contract commands makes the workflow suite pass seven tests.
• Full-size purpose RED: after adding ssh-relay-artifact-cache-entry-full-size.test.ts to the source oracle, the same workflow suite fails one / passes six because the measurement has zero native invocations. The renamed combined measurement step also required the ordering oracle's exact name to follow the expanded boundary.
• Final GREEN command/result: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs src/main/ssh/ssh-relay-artifact-cache-entry.test.ts src/main/ssh/ssh-relay-artifact-cache-entry-full-size.test.ts: workflow and focused source suites pass; the environment-only full-size file is skipped locally, for 24 passed / one skipped tests.
• Native oracle: every primary client job must run all 17 transaction/corruption contracts before artifact construction. After constructing the exact full-size artifact, every job must measure cold copy/extract/proof/two-layer revalidation and warm proof/archive/full-tree lookup, log exact time and incremental RSS, stay within 5m and 80 MiB per phase, and remove its owned cache root.
• Consumer-disconnection oracle: all artifacts remain unpublished Actions evidence and no desktop or SSH caller exists.
• Does not prove: runner execution, exact full-size metrics, eviction/in-use safety, SSH, or an enabled tuple.
• Follow-up: checkpoint/push and require all six primary jobs plus companion PR Checks/Golden E2E before cache-entry closure.

E-M5-ARTIFACT-CACHE-ENTRY-CI-001 — Immutable publication and verified lookup pass all six native cells

• Date: 2026-07-15
• Owner: Codex implementation owner
• Exact source: 3c1ead8fb1e1f3b64abaf78705abb0c801a1d64b on draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29462394311. All six primary Node 24 jobs pass their complete source-contract step, including all 17 immutable cache-entry transaction, corruption, quarantine, concurrency, and recovery tests. POSIX jobs pass 65 source files and Windows jobs pass 66 source files.
• Exact native cells and ssh_relay_full_size_cache results:
  • linux-x64-glibc job 87508477435: ubuntu-24.04, image ubuntu24 20260705.232.1, X64; 36,412,425-byte archive, 124,846,430 expanded bytes / 34 files; cold 2,244.83ms / 40,214,528-byte incremental RSS; warm 239.44ms / 0 bytes;
  • linux-arm64-glibc job 87508477441: ubuntu-24.04-arm, image ubuntu24-arm64 20260706.52.2, ARM64; 36,363,087-byte archive, 122,865,324 expanded bytes / 34 files; cold 1,703.97ms / 46,911,488 bytes; warm 195.47ms / 131,072 bytes;
  • darwin-arm64 job 87508477446: macos-15, image macos15 20260706.0213.1, ARM64; 31,776,560-byte archive, 122,027,869 expanded bytes / 35 files; cold 1,173.97ms / 47,104,000 bytes; warm 123.58ms / 212,992 bytes;
  • darwin-x64 job 87508477453: macos-15-intel, image macos15 20260629.0276.1, X64; 32,922,888-byte archive, 124,316,655 expanded bytes / 35 files; cold 6,171.98ms / 43,335,680 bytes; warm 702.78ms / 372,736 bytes;
  • win32-x64 job 87508477439: windows-2022, image win22 20260714.244.1, X64; 37,168,778-byte archive, 96,527,161 expanded bytes / 42 files; cold 2,682.54ms / 48,775,168 bytes; warm 233.89ms / 466,944 bytes;
  • win32-arm64 job 87508477458: windows-11-arm, image win11-arm64 20260714.109.1, ARM64; 33,204,738-byte archive, 85,213,511 expanded bytes / 42 files; cold 3,535.96ms / 34,484,224 bytes; warm 513.02ms / 6,926,336 bytes.
• Budget result: every cold and warm phase is below the separate five-minute and 80 MiB incremental RSS ceilings; every environment-only full-size test reports one passed file and removes its owned cache root. Observed cold range is 1,173.97–6,171.98ms and 34,484,224–48,775,168 bytes; warm range is 123.58–702.78ms and 0–6,926,336 bytes.
• Companion regressions: PR Checks run 29462394310, job 87508477369, passes in 14m02s. Golden E2E run 29462394344 passes Linux job 87508477410 in 4m18s and macOS job 87508477409 in 3m06s.
• Supplemental/floor result: both Linux oldest-userland supplements pass. Windows x64 oldest-floor job 87509946279 passes. Windows arm64 primary runtime/source/cache proof passes, then oldest-floor job 87509946287 retains the declared build-26200 versus required-26100 rejection; therefore the overall artifact workflow is expected red and no Windows arm64 tuple is enabled.
• Closure: exact content-key paths, same-filesystem exclusive staging, full archive/tree revalidation before atomic publication, strict proof/archive/tree lookup, corruption quarantine, concurrent serialization, and fresh-byte recovery are proven locally and on all six native clients.
• Residual gaps: crash/power-loss durability, disk-full/quota/inode/read-only faults, in-use leases, recency/2 GiB eviction, packaged Electron/cache-root selection, proxy/certificate behavior, SSH, and every tuple/default path remain open. No artifact is published and no production consumer is connected.
• Follow-up: checkpoint and push this evidence, then audit and RED-test only the disconnected in-use lease/recency/2 GiB eviction package. Keep consumers and SSH behavior separate.

E-M5-ARTIFACT-CACHE-EVICTION-AUDIT-001 — In-use lease, recency, and 2 GiB eviction boundary

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed cache-entry evidence head 0ae3e005f on draft PR #8741.
• Exact audit commands: complete reads of the cache entry, proof, verification, content-lock record, content-lock lease, and content-lock tests; rg --files src/main/ssh over relay cache/artifact modules; targeted rg -n over cache eviction, in-use lease, recency/LRU, protected content, and native workflow invocations in src/main, src/shared, .github/workflows, and config/scripts.
• Findings:
  • no relay cache eviction, in-use lease, persistent recency, exact cache-byte accounting, or consumer exists. The immutable entry becomes selectable only after complete verification, but a future consumer needs a cross-process reference before the content lock is released to eviction;
  • in-use references must be shared, not exclusive. Each exact content ID therefore owns a token-named lease directory with a strict nonce/host/PID/acquired/heartbeat record and owner-handle heartbeat. Active, malformed, remote-host, PID-reused, or otherwise ambiguous leases protect the entry. Only a confirmed stale same-host dead owner may be tombstoned and removed;
  • lease acquisition and eviction both acquire the proven per-content lock. Acquisition rechecks the exact final entry path before making its lease visible; eviction rechecks entry state, staging, and leases while holding the same lock. This closes the lookup-to-reference/delete race without changing cache lookup or adding a consumer;
  • successful lease acquisition/release records persistent recency outside the immutable entry via token-shaped append records. Readers take the greatest valid timestamp; malformed or unexpected recency is ambiguous and conservatively protects the entry. Missing recency uses the immutable entry timestamp as its initial publication order;
  • one global eviction transaction is serialized by the proven lock implementation in a dedicated eviction namespace, so no valid content digest is reserved. Per-entry locks still serialize with publication and reference acquisition;
  • exact accounting sums stable logical regular-file sizes without following links and rejects unsafe-integer arithmetic or ambiguous/special trees. The 2 GiB limit applies to complete selectable entries; staging, locked, ambiguous, current-manifest, and running content are never deleted and can leave an explicit over-budget residual;
  • eviction orders idle complete entries by persistent LRU with a content-ID tie break. Strictly protected content is never removed. Caller-declared current/previous retention is considered only after ordinary candidates and may be removed only when required to meet the cap, matching “retain when they fit”;
  • deletion rechecks all guards under the content lock, atomically renames only the exact final entry to a token-shaped unselectable tombstone, then removes owned bytes. Cancellation is checked before each bounded scan/acquire/delete stage and all acquired locks/leases must settle.
• Required purpose-named contracts: exact paths/limits; multiple concurrent references; real cross-process visibility; heartbeat and owner-only release; stale-dead cleanup; live/malformed/ remote/displaced-owner preservation; exact logical-byte accounting; deterministic LRU and tie break; hard and preferred retention; staging/content-lock protection; concurrent eviction; cancellation settlement; symlink/special/unsafe state protection; and no partial/tombstone selection.
• Deliberately separate: cache-root selection, embedded-manifest loading, proxy/certificates, downloader calls, offline transfer, SSH, remote install, ORCA_RELAY_PATH, fallback classification, settings/mode, tuple enablement, release publication, and production/default behavior.
• Follow-up: add ssh-relay-artifact-cache-eviction.test.ts with production modules absent, record the RED, then implement only the audited lease/recency/eviction modules and require focused, broad/static, native-workflow wiring, and all-six native evidence.

E-M5-ARTIFACT-CACHE-EVICTION-LOCAL-RED-001 — In-use lease and eviction capabilities are absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: purpose-named ssh-relay-artifact-cache-in-use-lease.test.ts and ssh-relay-artifact-cache-eviction.test.ts atop pushed evidence head 0ae3e005f; production lease/eviction modules deliberately absent.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-in-use-lease.test.ts src/main/ssh/ssh-relay-artifact-cache-eviction.test.ts.
• Environment: macOS 26.2 arm64 build 25C56, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; two failed suites / zero collected tests in 642ms Vitest / 2.57s wall, 132,841,472-byte maximum RSS, zero swaps. Imports fail because both audited production modules do not exist.
• Contracts encoded before implementation: exact paths/limits; shared concurrent and real second-process leases; heartbeat and displaced-owner release; missing-entry rejection; exact logical-byte accounting; LRU; hard/preferred retention; active/malformed/live/remote/stale-dead lease handling; staging/content-lock/cancellation safety; concurrent evictors; and unsafe-link preservation.
• Consumer-disconnection oracle: tests import the new source capabilities directly and construct isolated cache fixtures. No Electron, downloader, SSH, setting, mode, tuple, release, or default call site is added.
• Follow-up: implement only concrete in-use record, recency, lease, and eviction responsibilities; make both purpose suites green without weakening conservative ambiguity or reference safety.

E-M5-ARTIFACT-CACHE-EVICTION-LOCAL-001 — Disconnected in-use leases and bounded eviction pass locally

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted package atop exact pushed evidence head 0ae3e005f, following E-M5-ARTIFACT-CACHE-EVICTION-AUDIT-001 and E-M5-ARTIFACT-CACHE-EVICTION-LOCAL-RED-001.
• Implementation:
  • strict token-named shared lease records bind content ID, nonce, host, PID, acquisition, heartbeat, and directory identity. Acquisition and release serialize through the proven per-content lock;
  • 5s heartbeats and owner-only release preserve active and displaced owners. Active, malformed, remote-host, PID-reused/live, or otherwise ambiguous references block deletion. Only a stale same-host owner whose PID is confirmed dead is atomically tombstoned and reclaimed;
  • persistent token-shaped recency records live outside immutable entries and are bounded to the newest valid timestamp. Missing recency starts at publication mtime; malformed/racing state is ambiguous and protected;
  • exact stable logical-file accounting follows no links and bounds each entry to 10,000 members. Unsafe, special, unstable, or unaccountable trees remain protected;
  • one dedicated global eviction lock serializes transactions, while per-content locks close publication/reference/delete races. The default cap is 2 GiB; hard-protected content is never removed, preferred current/previous content follows ordinary LRU candidates, and complete idle entries become unselectable by atomic tombstone rename before owned recursive deletion.
• Exact focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-in-use-lease.test.ts src/main/ssh/ssh-relay-artifact-cache-eviction.test.ts.
• Final focused result: two passed files / 14 passed tests in 2.10s Vitest / 4.12s wall, 131,629,056-byte maximum RSS, zero swaps on macOS 26.2 arm64 build 25C56, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Contracts prove exact paths/limits and invalid-input rejection, multiple references, real child-process visibility, heartbeat/displaced-owner safety, missing-entry rejection, bounded recency, exact accounting/deterministic LRU, hard/preferred retention, active/malformed/live/ remote/stale-dead behavior, staging/content-lock/cancellation settlement, concurrent eviction, and unsafe linked-tree preservation.
• Exact broader commands/results:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-*.test.ts: eight passed files / two environment-skipped files, 126 passed / two skipped tests in 15.49s Vitest / 23.55s wall, 159,383,552-byte maximum RSS, zero swaps;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts: 21 passed files / three skipped files, 294 passed / three skipped tests in 52.31s Vitest / 55.78s wall, 205,340,672-byte maximum RSS, zero swaps;
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs: 50 passed files / 279 passed tests in 86.52s Vitest / 93.38s wall, 188,940,288-byte maximum RSS, zero swaps;
  • /usr/bin/time -l pnpm typecheck: pass in 5.70s wall with 1,208,139,776-byte maximum RSS;
  • /usr/bin/time -l pnpm lint: pass in 30.71s wall with 2,093,400,064-byte maximum RSS. Full lint retains only existing unrelated warnings and includes switch exhaustiveness, 41 reliability gates, max-lines ratchet, bundled-skill, and localization gates;
  • pnpm exec oxfmt --write over all package/workflow/checklist files: pass in 4.334s; /usr/bin/git diff --check: pass. No max-lines suppression or ratchet exception was added.
• Consumer/diff oracle: direct source tests are the only caller. The preserved Milestone 0 resolver pair has zero diff. No Electron/cache-root/downloader/SSH/setting/mode/tuple/publication/default consumer exists; legacy remains the only production path.
• Does not prove: Node 24/native-client behavior, exact full-size active retention/eviction resources, disk-full/read-only/quota/inode faults, crash/power-loss durability, packaged Electron, SSH, native trust, or any enabled tuple. All remain separately gated.
• Follow-up: wire the purpose suites into both native families and extend the exact full-size cache measurement through active retention, release, exact-byte eviction, and cleanup. Push the isolated package and require all-six native source/full-size evidence before closing this combined cache item or adding any consumer.

E-M5-ARTIFACT-CACHE-EVICTION-CI-WIRING-LOCAL-001 — Both native families require source and full-size eviction gates

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: uncommitted workflow/test extension atop E-M5-ARTIFACT-CACHE-EVICTION-LOCAL-001.
• Implementation: both POSIX and PowerShell native Node 24 source commands now require the 14 purpose-named lease/eviction contracts. The existing exact-artifact cache measurement keeps every cold/warm JSON field and additionally acquires a real in-use lease, proves a zero-byte-cap eviction retains the complete entry, releases the lease, then measures exact logical bytes reclaimed, elapsed time, incremental RSS, entry removal, and test-root cleanup.
• Budgets/oracles: each retention and eviction transaction is bounded at 5m and 80 MiB incremental RSS; lease acquisition is bounded at 2m. The test timeout is the explicit sum of two entry, two eviction, one acquisition, and 10s cleanup budgets. The native workflow must remove the measurement root after the test on both shell families.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs src/main/ssh/ssh-relay-artifact-cache-entry-full-size.test.ts.
• Result without full-size environment: workflow file passes seven tests and the full-size file skips its one environment-gated test as intended in 1.36s Vitest / 3.41s wall, 134,496,256-byte maximum RSS, zero swaps. The standalone workflow command also passed seven tests in 861ms Vitest / 4.32s wall, 131,629,056-byte maximum RSS.
• Does not prove: actual full-size eviction or native runner behavior. Those require the pushed exact head on Linux, macOS, and Windows x64/arm64; no checklist box closes from this local wiring proof.
• Follow-up: commit and push this isolated package, then capture exact run/job IDs, commit SHA, runner images/architectures, per-tuple retention/eviction timings and RSS, exact reclaimed bytes, cleanup results, and residual floor gaps under a new CI evidence ID.

E-M5-ARTIFACT-CACHE-EVICTION-CI-001 — All-six native in-use and exact full-size eviction gate

• Date: 2026-07-15

• Owner: Codex implementation owner

• Exact source: commit b79bcbd04e50b86186645bcba04d811671eb3035 on draft PR #8741.

• Artifact run: 29464742446.

• Native source-contract results under Node 24.18.0:

  • Linux x64/arm64 and macOS x64/arm64 each pass 67 files / 460 tests;
  • Windows x64/arm64 each pass 68 files / 451 tests with 13 declared platform-inapplicable skips;
  • all six include the 14 lease/recency/eviction contracts and complete deterministic artifact build, archive/tree/Node/PTTY/watcher smoke, and exact full-size measurement before success.

• Exact primary jobs and runner identities:

  • Linux x64 job 87515421304, ubuntu-24.04, image ubuntu24 20260714.240.1, X64 GitHub-hosted, passes in 2m46s;
  • Linux arm64 job 87515421305, ubuntu-24.04-arm, image ubuntu24-arm64 20260706.52.2, ARM64 GitHub-hosted, passes in 2m48s;
  • macOS x64 job 87515421313, macos-15-intel, image macos15 20260629.0276.1, X64 GitHub-hosted, passes in 4m02s;
  • macOS arm64 job 87515421317, macos-15, image macos15 20260706.0213.1, ARM64 GitHub-hosted, passes in 1m50s;
  • Windows x64 job 87515421346, windows-2022, image win22 20260714.244.1, X64 GitHub-hosted, passes in 6m04s;
  • Windows arm64 job 87515421308, windows-11-arm, image win11-arm64 20260706.102.1, ARM64 GitHub-hosted, passes in 9m57s.

• Exact full-size cache measurements (bytes are logical complete-entry bytes and are fully reclaimed):

  Tuple	Retain ms	Retain RSS	Evict ms	Evict RSS	Initial/reclaimed bytes
  linux-x64-glibc	11.14	262,144	32.79	0	161,259,308
  linux-arm64-glibc	18.65	0	36.87	0	159,228,899
  darwin-x64	36.39	81,920	64.32	90,112	157,239,968
  darwin-arm64	11.57	32,768	19.02	49,152	153,804,850
  win32-x64	27.37	991,232	54.78	417,792	133,696,372
  win32-arm64	47.88	2,088,960	92.90	2,183,168	118,418,686

• Each retention transaction passes only by reporting zero reclaimed bytes, the exact content ID as blocked, and a still-present entry. Each subsequent release/eviction passes only by reporting exact initial equals reclaimed bytes, zero final bytes, that content ID as evicted, no blocked IDs, exact entry absence, and complete workflow-level measurement-root cleanup.

• Existing cold/warm fields remain regression-comparable. In this run cold publication is 1.46–5.17s with 40,120,320–57,077,760 incremental RSS; warm full verification is 130.05–648.88ms with 131,072–5,906,432 incremental RSS. All remain below the fixed 5m/80 MiB per-operation budgets.

• Repository gates: PR Checks run 29464742361, job 87515420888, passes in 13m30s. Golden E2E run 29464742368 passes Linux job 87515420922 in 4m35s and macOS job 87515420928 in 3m54s.

• Supplemental/floor result: both Linux oldest-userland jobs and Windows x64 build-20348 job 87516657331 pass. Windows arm64 primary source/runtime/cache proof passes; its separate oldest-floor job 87516657323 reconstructs and executes the exact bytes, then rejects observed 10.0.26200 with osBuild: false against the required build 26100. Therefore the overall artifact workflow is expected red and no Windows arm64 tuple is enabled.

• Closure: disconnected cross-process leases, bounded recency, exact accounting, LRU/protection, cancellation settlement, full-size active retention, owner release, atomic eviction, and cleanup are proven on all six native client families. This closes only the combined bounded local-cache implementation item.

• Residual gaps: read-only/disk-full/quota/inode faults, abrupt crash/power-loss durability, network filesystems/PID namespaces, packaged manifest/key and cache-root loading, Electron proxy/ certificate behavior, downloader/cache orchestration, client-offline transfer, SSH install/launch, native trust, per-target Beta wiring, and every tuple/default path remain open. No release asset is published and no production consumer exists.

• Follow-up: checkpoint this evidence, then audit the smallest disconnected packaged-manifest/ official-build/cache-root boundary and add purpose-named RED contracts before implementation.

E-M5-PACKAGED-MANIFEST-AUDIT-001 — Fixed official-build manifest loading boundary

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed evidence head 20728605330b0320e2ea6ec3c5a4380e68d1a0d8 on draft PR #8741.
• Exact audit commands: complete reads of the desktop manifest schema/signature/release-identity modules, artifact selector/downloader, relay path resolution, Electron builder config and tests, release required-assets/manifest composition, application startup/version seeding, and Electron proxy bridge; targeted rg -n over app.isPackaged, process.resourcesPath, app.getVersion(), extraResources, ORCA_RELAY_PATH, manifest consumers, accepted keys, net.fetch, proxy, and certificate behavior.
• Findings:
  • no packaged relay-runtime manifest resource, production accepted-key set, manifest filesystem loader, Electron adapter, cache root, or product consumer exists. Existing manifest verification is pure and branded/frozen; all callers are tests or release scripts;
  • config/ is intentionally excluded from app.asar, while real runtime resources use explicit extraResources and process.resourcesPath. The future official manifest must therefore be a fixed real resource, never a mutable user-data file, environment-selected path, GitHub lookup, or latest result;
  • the smallest safe next capability is a dependency-injected official-build loader. It derives exactly <resourcesPath>/ssh-relay-runtime/orca-ssh-relay-runtime-manifest.json, requires an absolute resources path and real non-link resource directory/file, bounds the file at 1 MiB, reads through a stable file handle, parses JSON, and verifies the existing strict schema and accepted-key Ed25519 signatures;
  • only after signature verification may it compare manifest tag v<appVersion>, version, channel, and relay protocol to the caller-supplied compiled desktop identity. Stable, RC, and perf identities use the already-proven release-tag parser. Missing, malformed, replaced, unknown-key, invalid-signature, build-mismatch, or protocol-mismatch state is an explicit fail-closed error;
  • accepted keys remain compile-time inputs to this capability. The real production public key, protected signing seed/environment, signed manifest bytes, builder extraResources mapping, and release required-assets composition are absent and remain blocking gates before any official client or tuple can use it;
  • current Electron net.fetch already uses Chromium's certificate/session stack and the app has a separate tested system/settings/environment proxy bridge. Network orchestration is deliberately excluded from this filesystem/trust package and will be audited separately;
  • existing ORCA_RELAY_PATH legacy development behavior remains untouched. This package adds no development environment override and no product call site.
• Required purpose-named contracts: exact fixed cross-platform path; packaged-only guard; absolute resources path; stable regular resource directory/file; 1 MiB bound; partial-read loop; accepted signature and deep-frozen result; empty/unknown/mismatched key; malformed/oversized/replaced/link resource; exact stable/RC/perf identity; tag/version/channel/protocol mismatch; and proof that no network, cache, Electron startup, SSH, mode, tuple, or default caller is introduced.
• Deliberately separate: production key generation/provisioning/rotation, signed release manifest, builder/resource embedding, packaged-app smoke, release required-assets composition, app.getPath cache-root selection, proxy/certificate/live download, offline behavior, ORCA_RELAY_PATH trust changes, SSH transfer/install, fallback classification, settings/Beta UI, tuple enablement, publication, and default behavior.
• Follow-up: add ssh-relay-packaged-manifest.test.ts while the production loader is absent, run and record the missing-module RED, then implement only this audited loader and require focused, broad, static, and all-six native source evidence before resource embedding or a consumer.

E-M5-PACKAGED-MANIFEST-LOCAL-RED-001 — Official-build manifest loader is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: purpose-named src/main/ssh/ssh-relay-packaged-manifest.test.ts atop exact pushed evidence head 20728605330b0320e2ea6ec3c5a4380e68d1a0d8; production loader deliberately absent.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-packaged-manifest.test.ts.
• Environment: macOS 26.2 arm64 build 25C56, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; one failed suite / zero collected tests in 168ms Vitest / 0.99s wall, 131,743,744-byte maximum RSS, zero swaps. Import fails because ./ssh-relay-packaged-manifest does not exist.
• Contracts encoded before implementation: fixed absolute resource path and 1 MiB limit; packaged-only guard; accepted signature and deep-frozen stable/RC/perf identities; missing, malformed, oversized, or linked resource rejection; empty/unknown/mismatched/invalid key state; and signed tag/version/channel/protocol drift rejection.
• Consumer-disconnection oracle: the test imports only the absent source capability and uses isolated temporary resource roots and test keys. It adds no Electron, builder, cache, downloader, SSH, setting, tuple, release, or default call site.
• Follow-up: implement only the audited fixed-resource loader and make this suite green without adding a production key, resource mapping, or consumer.

E-M5-PACKAGED-MANIFEST-LOCAL-001 — Fixed official-build manifest loader

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: six-file working package atop exact pushed evidence head 20728605330b0320e2ea6ec3c5a4380e68d1a0d8; implementation and purpose-named tests are src/main/ssh/ssh-relay-packaged-manifest.ts and src/main/ssh/ssh-relay-packaged-manifest.test.ts.
• Exact focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-packaged-manifest.test.ts.
• Environment: macOS 26.2 arm64 build 25C56, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: 1 file / 6 tests pass in 348ms Vitest / 1.06s wall with 131,989,504-byte maximum RSS, 96,179,600-byte peak memory footprint, and zero swaps. The repository requires Node 24; final native workflow proof therefore remains required and is not inferred from this local Node 26 run.
• Proven behavior: packaged-only and absolute-path guards; one fixed cross-platform resource path; real non-link directory/file checks; non-empty 1 MiB bound; stable-handle identity checks; deterministic seven-byte partial reads; mutation rejection before JSON/signature processing; strict JSON/schema and accepted-key Ed25519 verification; deep-frozen branded output; and exact stable/RC/perf tag, version, channel, and relay-protocol binding after signature verification.
• Fail-closed cases: missing, malformed, oversized, linked, partial/mutated resources; empty/unknown/mismatched accepted keys; invalid signatures; and signed build/protocol drift.
• Broad exact commands and results on the final source/test state:
  • pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-*.test.ts: 22 files / 300 tests pass, with three declared full-size fixture suites / three tests skipped, in 28.04s;
  • pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-*.test.mjs: 50 files / 279 tests pass in 24.75s;
  • pnpm typecheck: passes all Node, CLI, and web projects;
  • pnpm lint: passes oxlint, type-aware switch exhaustiveness, reliability gates (41), max-lines ratchet (355 grandfathered, no new bypass), bundled-skill guides, and localization gates. Only pre-existing warnings outside this package are reported;
  • pnpm exec oxfmt --check src/main/ssh/ssh-relay-packaged-manifest.ts src/main/ssh/ssh-relay-packaged-manifest.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs .github/workflows/ssh-relay-runtime-artifacts.yml docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md and git diff --check: pass.
• Consumer-disconnection oracle: repository rg finds the production module imported only by its purpose-named test. The loader imports no Electron, network, cache, SSH, settings, or relay-path module. The protected Node/npm resolver pair has zero diff. No product call site, accepted production key, resource bytes, builder mapping, cache root, mode, tuple, publication, or default behavior is present.
• Residual gaps: all-six Node 24 native execution, production accepted-key lifecycle, signed embedded bytes, builder extraResources, release required-assets composition, packaged-app smoke, cache-root/downloader orchestration, offline transfer, SSH install/launch, per-target Beta, fallback, tuple enablement, publication, and default behavior remain open.

E-M5-PACKAGED-MANIFEST-CI-WIRING-LOCAL-001 — Native source-test wiring

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: same six-file working package as E-M5-PACKAGED-MANIFEST-LOCAL-001.
• Implementation: add ssh-relay-packaged-manifest.test.ts to the POSIX and PowerShell native build command lists in .github/workflows/ssh-relay-runtime-artifacts.yml; add it to the workflow occurrence oracle, which requires exactly two workflow occurrences.
• Exact command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-packaged-manifest.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: 2 files / 13 tests pass in 646ms. The standalone workflow suite is also included in the 50-file / 279-test release-script result above.
• Closure rule: this proves wiring shape only. Do not close the native gate until the exact pushed implementation head executes the source suite successfully on Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64 under Node 24.
• Follow-up: format/diff checkpoint, commit and push the isolated package, then record each native job/run ID and result under E-M5-PACKAGED-MANIFEST-CI-001 before adding resource embedding, production keys, cache-root selection, or a consumer.

E-M5-PACKAGED-MANIFEST-CI-001 — All-six native fixed-resource loader proof

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed implementation commit ffc7947a4afe823fe56c4972cca4af8c509eca83 on draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29466359518. The exact workflow source and E-M5-PACKAGED-MANIFEST-CI-WIRING-LOCAL-001 require the purpose-named loader suite inside the Run runtime artifact contract tests step for both POSIX and PowerShell job families.
• Exact native primary results; every listed contract-test step and complete primary job passes under Node 24.18.0:
  • Linux x64, ubuntu-24.04, job 87520232532: contract step 02:21:10–02:21:26Z; job 02:20:48–02:23:11Z;
  • Linux arm64, ubuntu-24.04-arm, job 87520232493: contract step 02:21:29–02:21:40Z; job 02:20:51–02:23:34Z;
  • macOS x64, macos-15-intel, job 87520232509: contract step 02:22:02–02:22:36Z; job 02:20:49–02:24:26Z;
  • macOS arm64, macos-15, job 87520232533: contract step 02:21:45–02:22:04Z; job 02:20:49–02:23:06Z;
  • Windows x64, windows-2022, job 87520232476: contract step 02:22:01–02:22:25Z; job 02:20:48–02:26:38Z;
  • Windows arm64, windows-11-arm, job 87520232497: contract step 02:24:36–02:25:10Z; job 02:20:49–02:30:39Z.
• Repository gates: PR Checks run 29466359581, job 87520232413, passes in 14m33s. Golden E2E run 29466359541 passes Linux job 87520232284 in 4m30s and macOS job 87520232283 in 5m08s.
• Supplemental result: both Linux oldest-userland jobs and Windows x64 oldest-floor job 87521425899 pass. Windows arm64 primary source/build/runtime proof passes; its separate oldest-floor job 87521425836 executes the exact runtime successfully, including Node v24.18.0, PTY, watcher, 2s settlement, and 49,745,920-byte RSS, then rejects observed build 10.0.26200 against required build 26100 (osBuild: false). The artifact workflow is therefore expected red solely for the previously declared floor gap; no Windows arm64 tuple is enabled.
• Closure: the source-only packaged loader's path, stable-read, mutation, accepted-key signature, and exact build/protocol contracts execute on all six native client families. This closes the loader's native source gate, not packaged-app embedding or product use.
• Residual gaps: no production accepted-key file or protected seed/environment exists; no signed manifest bytes are embedded; builder extraResources, release required-assets composition, packaged-app extraction/smoke, Electron adapter, cache root, downloader orchestration, offline transfer, SSH install/launch, per-target Beta, fallback, tuple, publication, and default behavior remain open.
• Follow-up: commit this evidence-only checkpoint, then audit the smallest PR-contained accepted-key and immutable resource-input contract. External protected-environment/secret provisioning remains a separate repository-administrator gate and must not be inferred from source tests.

E-M5-ACCEPTED-KEYS-AUDIT-001 — Desktop accepted-public-key document parity

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed evidence head 6358fb466b2b2099f4c9add9b8e2f772664ec3ea.
• Audit: complete reads of the desktop signature/loader modules and tests, protected manifest workflow, aggregate command/signing handoff and tests, Electron builder config/tests, package release scripts, and Linux/Windows/macOS release workflow build/package boundaries; targeted rg over accepted keys, public-key encoding, extraResources, manifest signing, desktop build inputs, and release packaging.
• Findings:
  • the protected aggregate already defines the authoritative source format: exact {schemaVersion, keys} fields, schema version 1, one to four keys, exact {keyId, publicKeyBase64} entries, canonical base64 for exactly 32 Ed25519 public-key bytes, derived SHA-256 key IDs, uniqueness, key-ID sorting, and a SHA-256 fingerprint over canonical JSON;
  • the protected workflow deliberately references an absent config/ssh-relay-runtime-manifest-accepted-keys.json and tests ENOENT so no placeholder can be mistaken for a reviewed trust root. Release-cut and macOS release workflows remain disconnected;
  • the desktop signature verifier accepts decoded key bytes but has no strict parser for the aggregate document. Adding that parser with deterministic test keys is the smallest useful PR-contained parity boundary before production key review or immutable resource embedding;
  • accepted keys must ultimately be compile-time desktop inputs. Loading a mutable adjacent key file beside the manifest would let the trust root move with untrusted bytes and is not allowed;
  • builder mapping, aggregate-to-desktop artifact download, tag checkout dependencies, byte-identical packaged extraction, real public key review, and protected seed/environment provisioning remain separate gates.
• Selected package: pure desktop parser returning cloned/sorted accepted key bytes plus the canonical accepted-key document fingerprint; strict hostile-input tests and release-format parity; no file I/O, Electron, resource mapping, manifest, signer, secret, cache, network, SSH, mode, or consumer.

E-M5-ACCEPTED-KEYS-LOCAL-RED-001 — Desktop accepted-key parser is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: purpose-named src/main/ssh/ssh-relay-manifest-accepted-keys.test.ts atop exact pushed evidence head 6358fb466b2b2099f4c9add9b8e2f772664ec3ea; production parser deliberately absent.
• Exact command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-manifest-accepted-keys.test.ts.
• Environment: macOS 26.2 arm64 build 25C56, Node v26.0.0, pnpm 10.24.0, Vitest 4.1.5.
• Result: required RED; one failed suite / zero collected tests in 174ms Vitest / 1.16s wall, 131,989,504-byte maximum RSS, 96,179,600-byte peak memory footprint, and zero swaps. Import fails because ./ssh-relay-manifest-accepted-keys does not exist.
• Contracts encoded before implementation: canonical sort/fingerprint, cloned key bytes, frozen container/records, one-to-four bound, exact fields/schema, canonical base64/32-byte keys, derived identity, duplicate rejection, and input-order independence.
• Consumer-disconnection oracle: only the purpose-named test imports the absent module; fixtures use deterministic test seeds. No production key file/seed/environment, resource mapping, Electron, cache, network, SSH, setting, tuple, publication, or default call site is added.

E-M5-ACCEPTED-KEYS-LOCAL-001 — Desktop accepted-key parser and native wiring

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: working package atop exact pushed evidence head 6358fb466b2b2099f4c9add9b8e2f772664ec3ea; implementation/test are src/main/ssh/ssh-relay-manifest-accepted-keys.ts and its purpose-named test.
• Focused command/result: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-manifest-accepted-keys.test.ts passes 1 file / 4 tests in 301ms Vitest / 1.23s wall, 131,874,816-byte maximum RSS, 96,048,504-byte peak memory footprint, and zero swaps.
• Proven: exact schema/fields; one-to-four bound; canonical 32-byte base64; derived SHA-256 IDs; duplicate rejection; input-order-independent sorting; cloned bytes; frozen container/records; and the exact canonical JSON fingerprint used by the protected aggregate.
• Regression commands/results: accepted-keys/signature/packaged-loader trust suites pass 19/19; complete src/main/ssh/ssh-relay-*.test.ts passes 23 files / 304 tests with three declared full-size skips; workflow plus aggregate-command suites pass 12/12; full pnpm typecheck and pnpm lint pass, including 41 reliability gates and no new max-lines bypass.
• Native wiring: the purpose-named suite is present once in each POSIX/PowerShell command list; the workflow oracle requires exactly two occurrences. Exact-head all-six Node 24 execution remains required before this source gate closes.
• Consumer-disconnection oracle: repository consumers remain test-only. The protected workflow still requires the production accepted-key file to be absent; no key/seed/environment, resource bytes, builder mapping, Electron/cache/network/SSH/mode/tuple/publication/default caller is added.

E-M5-ACCEPTED-KEYS-CI-001 — All-six native accepted-key document proof

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed implementation head 11f367e6613b0cae61a1153b77a5be332fd4e763 on draft PR #8741.
• Workflow: SSH Relay Runtime Artifacts run 29467318532. The purpose-named accepted-key suite runs in Run runtime artifact contract tests under Node 24.18.0 on both native shell families. All six primary contract steps and complete jobs pass:
  • Linux x64, ubuntu-24.04, job 87523112196, contract step 02:45:28–02:45:43Z; job 02:45:00–02:47:39Z;
  • Linux arm64, ubuntu-24.04-arm, job 87523112194, contract step 02:45:39–02:45:52Z; job 02:45:03–02:47:45Z;
  • macOS x64, macos-15-intel, job 87523112227, contract step 02:46:19–02:47:07Z; job 02:45:02–02:49:48Z;
  • macOS arm64, macos-15, job 87523112181, contract step 02:45:39–02:45:52Z; job 02:45:00–02:46:31Z;
  • Windows x64, windows-2022, job 87523112207, contract step 02:46:18–02:46:43Z; job 02:45:00–02:50:59Z;
  • Windows arm64, windows-11-arm, job 87523112204, contract step 02:48:32–02:49:06Z; job 02:44:59–02:54:31Z.
• Supplemental results: both Linux oldest-userland jobs and Windows x64 oldest-floor job pass. Windows arm64 primary proof passes; its separate job 87524225012 executes the exact runtime successfully and then rejects hosted build 26200 against required build 26100. The overall artifact run is expected red only for that declared floor gap; no tuple is enabled.
• Adjacent gates: Golden E2E run 29467318535 passes Linux job 87523101812 and macOS job 87523101778. PR Checks run 29467318537 attempt 1 fails after 30,100 passed / 57 skipped tests only in untouched src/renderer/src/components/terminal-pane/pty-connection.test.ts (“drops confirmed idle exit when a different hook owner appears between null samples”). Failed-job attempt 2, job 87530011046, passes 03:43:02–03:57:22Z, including the full test step, unpacked build, and packaged CLI smoke. This classifies the first failure as unrelated/flaky rather than an accepted product regression.
• Closure: the strict accepted-key format, canonical fingerprint, key cloning/freezing, and hostile input behavior execute on all six supported native client families. This does not provision a production key, embed a manifest, run native signing, publish assets, connect SSH, or enable a tuple/default path.

E-M5-COMPILED-TRUST-AUDIT-001 — Immutable desktop trust-root boundary selection

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: exact pushed head 11f367e6613b0cae61a1153b77a5be332fd4e763; draft PR #8741.
• Audit: complete reads of the packaged manifest loader, accepted-key parser, manifest signature verifier, Electron Vite compile-time constant boundary, Electron builder resource mapping and tests, protected aggregate accepted-key reader, and Milestone 4/5 embedding contracts.
• Findings: the manifest loader correctly receives accepted keys from its caller, but no immutable desktop provider exists. A mutable adjacent accepted-key resource would let untrusted manifest bytes move their own trust root and remains prohibited. The smallest safe package is a main-bundle compile-time constant that is null in all current builds plus a strict provider that reuses the proven accepted-key parser. Runtime environment variables, filesystem lookup, Electron resources, production keys, signed manifest bytes, and consumers remain outside this package.
• Selected RED: a purpose-named source test requires unprovisioned builds to return unavailable even when a similarly named runtime environment variable is set; valid build-injected documents must yield cloned/frozen keys and the canonical fingerprint; malformed input must fail closed.

E-M5-COMPILED-TRUST-LOCAL-RED-001 — Compile-time desktop trust provider is absent

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: purpose-named src/main/ssh/ssh-relay-compiled-manifest-trust.test.ts atop exact pushed head 11f367e6613b0cae61a1153b77a5be332fd4e763; provider deliberately absent.
• Exact command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-compiled-manifest-trust.test.ts.
• Result: required RED; one failed suite / zero collected tests in 504ms because ./ssh-relay-compiled-manifest-trust does not exist. No production key, resource, consumer, SSH behavior, mode, tuple, publication, or default path changed.

E-M5-COMPILED-TRUST-LOCAL-001 — Unprovisioned compile-time trust boundary

• Date: 2026-07-15
• Owner: Codex implementation owner
• Source: working package atop exact pushed head 11f367e6613b0cae61a1153b77a5be332fd4e763; implementation/test are src/main/ssh/ssh-relay-compiled-manifest-trust.ts and its purpose-named test.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-compiled-manifest-trust.test.ts — PASS, 1 file / 3 tests in 2.00s Vitest / 7.39s wall, 132,743,168-byte maximum RSS, 97,031,712-byte peak footprint, zero swaps.
• Proven behavior: the main-bundle constant is exactly literal null; an unprovisioned build stays unavailable even when a similarly named runtime environment variable is set; an explicitly supplied compile-time document reuses the strict parser and returns cloned/frozen accepted keys plus its canonical SHA-256 fingerprint; malformed injected state fails closed.
• Regression commands/results on the final local state:
  • compiled/accepted/signature/packaged-loader trust suites pass 4 files / 22 tests in 14.71s;
  • complete src/main/ssh/ssh-relay-*.test.ts passes 24 files / 307 tests with three declared full-size suites/tests skipped in 26.34s Vitest / 30.43s wall, 261,341,184-byte maximum RSS and zero swaps;
  • complete config/scripts/ssh-relay-runtime-*.test.mjs passes 50 files / 279 tests in 50.75s Vitest / 54.71s wall, 189,218,816-byte maximum RSS and zero swaps;
  • the workflow oracle passes 7/7; full pnpm typecheck and pnpm lint pass, including 41 reliability gates, 355 grandfathered max-lines suppressions with no new bypass, and localization parity/coverage; focused oxfmt --check, git diff --check, and protected resolver zero-diff checks pass.
• Native wiring: the purpose suite appears exactly once in each POSIX/PowerShell command list and the workflow oracle requires exactly two occurrences. Exact-head all-six Node 24 execution remains required before this source gate closes.
• Consumer-disconnection oracle: the provider is imported only by its purpose test; repository search and test ! -e config/ssh-relay-runtime-manifest-accepted-keys.json confirm that no real key file, mutable trust lookup, resource bytes/mapping, manifest consumer, cache/network/SSH/mode, tuple, publication, or default behavior exists.

E-M5-COMPILED-TRUST-CI-RED-001 — exact-head Linux arm64 upload-stream lifecycle failure

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source: 4c09902c040af2c29d207aa9b6ea8e03421607a3; artifact run 29470322099, failed primary job 87532052107.
• Runner/runtime: GitHub-hosted ubuntu-24.04-arm, image 20260714.61.1, Ubuntu 24.04.4 arm64, Actions runner 2.335.1, Node 24.18.0.
• Result: the new compiled-manifest trust suite passed 1 file / 3 tests in 6 ms and the complete contract command passed all 70 files / 473 tests, but Vitest then failed the step after 9.16 s with one unhandled ENOENT opening the draft-upload suite's temporary local archive. Vitest attributed the asynchronous exception to config/scripts/ssh-relay-runtime-draft-upload.test.mjs, most recently while fails closed on unsafe draft state or existing managed bytes ran.
• Interpretation: this is not evidence against the compiled trust contract, but the exact-head job remains RED. The draft uploader creates a request ReadStream, destroys it when an injected or early HTTP response does not consume it, and does not await terminal stream settlement before the caller/test may remove the source directory. A purpose-named local RED and bounded lifecycle fix are required before rerunning and accepting all-six native proof.
• Residual gap: the other exact-head jobs and workflows were still settling when recorded. Do not issue E-M5-COMPILED-TRUST-CI-001 until every primary native contract step, PR Checks, and Golden E2E result is inspected and this failure is replaced by green exact-head evidence.

E-M5-DRAFT-UPLOAD-STREAM-SETTLEMENT-LOCAL-001 — request stream closes before caller cleanup

• Date/owner: 2026-07-15, Codex implementation owner.
• Purpose-named RED command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-upload.test.mjs — FAIL before the correction, 1 failed / 8 passed in 547 ms; settles an unconsumed upload stream before returning observed ReadStream.closed === false after the uploader resolved.
• Correction: attach the file-stream error/close observers before invoking the injectable fetch, destroy an unconsumed request body, await its terminal close, and fail closed on a source-stream error. This prevents caller/test staging cleanup from racing a delayed file open and preserves the existing bounded retry, cancellation, exact-byte verification, and draft-reconciliation policy.
• Focused GREEN: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-draft-upload.test.mjs — PASS, 1 file / 9 tests in 639 ms Vitest / 4.10 s wall, 132,366,336-byte maximum RSS, 96,572,840-byte peak footprint, zero swaps.
• Regression GREEN: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 42.16 s Vitest / 45.49 s wall, 189,628,416-byte maximum RSS, 96,179,528-byte peak footprint, zero swaps. pnpm typecheck, pnpm lint, focused oxfmt --check, git diff --check, and protected resolver zero-diff checks pass; lint includes 41 reliability gates, the 355-entry max-lines ratchet with no new bypass, bundled-skill verification, and localization parity/coverage.
• Does not prove: replacement native CI, a real GitHub release write, publication, signing, desktop manifest consumption, cache/download behavior, SSH transfer, mode wiring, or tuple enablement.

E-M5-COMPILED-TRUST-WINDOWS-CI-RED-001 — exact-head Windows x64 cache-lock race

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/job: 4c09902c040af2c29d207aa9b6ea8e03421607a3, artifact run 29470322099, Windows x64 job 87532052082.
• Runner/runtime: GitHub-hosted Windows Server 2022 10.0.20348 x64, windows-2022 image 20260706.237.1, Actions runner 2.335.1, Node 24.18.0.
• Result: the new compiled-trust suite passed 3/3. The combined command then ended with 1 failed, 463 passed, 13 skipped, and one unhandled error in 17.80 s. The untouched serializes concurrent writers and transfers ownership only after owner release cache-lock test received EPERM renaming the released lock; its still-running waiter then received ENOENT after test cleanup removed the lock root.
• Disposition: prior all-six cache-lock evidence exists, but this exact-head failure is not waived. The replacement run must settle green without a test-only relaxation. If the EPERM repeats, diagnose Windows handle ownership and implement a separately evidenced cache-lock correction before accepting the compiled-trust checkpoint.

E-M5-COMPILED-TRUST-CI-001 — replacement all-six native trust and stream proof

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source: bb74936148c851a65da43e50364a7afa52c9eba1; artifact run 29470805823.
• Primary native jobs: Windows x64 87533468657 (5m58s), Windows arm64 87533468659 (11m16s), Linux x64 87533468688 (2m31s), Linux arm64 87533468710 (6m25s), macOS x64 87533468740 (5m06s), and macOS arm64 87533468700 (1m51s) all pass. Every contract step runs the purpose-named compiled trust suite 3/3 and corrected draft-upload suite 9/9; combined contract files are 70/70 on POSIX and 71/71 on Windows. Full-size extraction/cache measurements and unpublished artifact upload also pass in every primary job.
• Supplemental result: Linux x64/arm64 oldest-userland jobs 87534233310/87534233331 and Windows x64 baseline job 87534771591 pass. Windows arm64 baseline job 87534771618 correctly rejects hosted Windows 11 build 26200 against the required exact build 26100 (osBuild: false), leaving the workflow deliberately red and that tuple disabled.
• Adjacent proof: PR Checks run 29470805820, job 87533468500, passes in 15m00s including lint/static gates, typecheck, Git 2.25 matrix, full tests, unpacked app build, and packaged CLI smoke. Golden E2E run 29470805841 passes Linux job 87533468519 and macOS job 87533468514. Computer-use run 29470805828 attempt 1 timed out an untouched Windows SSH-launcher test at 5.137s against its 5s bound; unchanged attempt 2 passes Windows native smoke/E2E in job 87534149625, so no source relaxation was made.
• Closure: the compile-time trust provider and stream-settlement correction are proven on all six native Node 24 families. No production accepted key, manifest resource, Electron/product caller, cache/downloader, SSH path, mode, tuple, release write, or default behavior was added.

E-M5-OFFICIAL-MANIFEST-COMPOSITION-AUDIT-001 — disconnected trusted-loader boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of ssh-relay-compiled-manifest-trust.ts, ssh-relay-packaged-manifest.ts, their tests, the accepted-key parser/signature verifier, build constant declaration/injection, workflow wiring, and all non-test imports/callers.
• Findings: the immutable provider and fixed-resource loader are individually proven but have no composition. The loader still requires caller-supplied accepted keys, and neither module has a non-test consumer. The smallest safe next capability is a concrete ssh-relay-official-manifest.ts boundary that obtains trust only from loadSshRelayCompiledManifestTrust, returns unavailable before filesystem access when the build constant is null, otherwise invokes the real packaged loader, and returns a frozen verified manifest plus the canonical accepted-key fingerprint.
• Required RED: unavailable trust does not inspect a resource path; provisioned test trust verifies an exact signed packaged manifest and desktop identity; unknown signatures, malformed resources, and unpackaged use fail closed; callers cannot supply alternate accepted keys. Wire the suite into both native job families.
• Deliberately absent: Electron app/process.resourcesPath adapter, extraResources, production key/manifest bytes, cache root/orchestration, downloader, ORCA_RELAY_PATH, SSH, Beta setting, fallback, tuple enablement, publication, and every default-path change.

E-M5-OFFICIAL-MANIFEST-COMPOSITION-LOCAL-RED-001 — composition module is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-official-manifest.test.ts.
• Result: expected FAIL, 1 failed suite / 0 tests in 3.26 s because ./ssh-relay-official-manifest did not exist. The purpose-named suite defines unavailable-trust, real signed-resource/fingerprint, hostile caller-key override, malformed resource, and unpackaged fail-closed contracts before implementation.
• Consumer-disconnection oracle: only the purpose test imports the absent module; there is no Electron/product/resource/cache/downloader/SSH/mode/tuple/publication/default call site.

E-M5-OFFICIAL-MANIFEST-COMPOSITION-LOCAL-001 — compiled trust owns packaged verification

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: src/main/ssh/ssh-relay-official-manifest.ts owns only the official trust/loader composition. It returns null before filesystem access when compiled trust is unavailable; otherwise it passes only the compiled accepted keys to the proven fixed-resource loader and returns a frozen verified manifest plus canonical accepted-key fingerprint.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-official-manifest.test.ts — PASS, 1 file / 4 tests in 656 ms Vitest / 2.73 s wall, 133,300,224-byte maximum RSS, 96,097,800-byte peak footprint, zero swaps.
• Trust regression: compiled trust, official composition, packaged loader, accepted-key parser, and signature suites pass 5 files / 26 tests in 9.87 s. Complete non-full-size SSH relay tests pass 25 files / 311 tests with three declared full-size skips in 20.55 s Vitest / 22.52 s wall, 263,864,320-byte maximum RSS, 95,802,624-byte peak footprint, zero swaps.
• Release/static regression: 50 release-script files / 280 tests pass in 32.28 s Vitest / 38.56 s wall, 193,921,024-byte maximum RSS, 97,146,304-byte peak footprint, zero swaps; workflow oracle passes 7/7. pnpm typecheck, full pnpm lint, focused oxfmt --check, git diff --check, and protected resolver zero-diff checks pass. Lint includes 41 reliability gates, 355 grandfathered max-lines entries with no new bypass, bundled-skill verification, and localization parity/coverage.
• Native wiring: the purpose suite appears once in each POSIX/PowerShell command family and the workflow oracle requires both occurrences. Exact-head all-six Node 24 proof remains required.
• Consumer disconnection: outside the purpose test/workflow references, repository search finds only the new module's export. There is no Electron/app adapter, resource mapping, production key or manifest, cache/downloader/SSH/mode/tuple/publication/default consumer. Legacy remains unchanged.

E-M5-OFFICIAL-MANIFEST-COMPOSITION-CI-001 — all-six native official-manifest proof

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/workflow: 749f775f15cbd92354fe43e4c142900d4b921614, artifact run 29471918803.
• Primary jobs: Windows x64 87536613611 (6m11s), Windows arm64 87536613560 (9m25s), Linux x64 87536613622 (2m31s), Linux arm64 87536613598 (7m13s), macOS x64 87536613625 (6m37s), and macOS arm64 87536613572 (1m38s) all pass completely. The purpose suite passes 4/4 on every native Node 24.18.0 client; combined contract files pass 71/71 on POSIX and 72/72 on Windows. Full-size extraction/cache measurement and unpublished artifact upload also pass in every primary job.
• Supplements: Linux x64/arm64 jobs 87537465974/87537465975 and Windows x64 baseline job 87537719676 pass. Windows arm64 baseline job 87537719631 verifies and executes the exact bytes, then correctly rejects hosted Windows 11 build 26200 against exact required build 26100 (osBuild: false); the tuple remains disabled and the overall workflow deliberately red.
• Adjacent proof: PR Checks run 29471918846, job 87536613410, passes in 13m12s including full tests, unpacked app, and packaged CLI smoke. Golden E2E run 29471918827 passes macOS job 87536613405 and Linux job 87536613436. Computer-use run 29471918802 passes on its first attempt.
• Closure: immutable compiled trust now owns the fixed-resource signature verifier on all six native families. The build constant is still null; no production key/manifest/resource, Electron or product caller, cache/downloader orchestration, SSH behavior, Beta mode, tuple, publication, or default-path change exists.

E-M5-ARTIFACT-CACHE-ROOT-AUDIT-001 — app-owned path boundary selection

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: targeted search over Electron app.getPath('userData'), all relay cache APIs/callers, prior cache audits/evidence, packaged-manifest boundaries, and ORCA_RELAY_PATH; complete reads of cache entry and eviction root handling.
• Findings: every proven cache primitive still requires an explicit cacheRoot; no relay cache-root provider or product caller exists. Cache entry code already creates and physically validates the root and owned namespaces, so this slice must not duplicate filesystem ownership checks. The smallest safe capability is a pure native-path derivation from an absolute caller-supplied user-data path into one fixed schema-versioned relay cache namespace. It must reject empty/relative inputs and ignore environment overrides. Electron app.getPath, directory I/O, and orchestration remain later adapters.
• Required RED: fixed path.join result on every native client, absolute-path guard, frozen namespace constants, and proof that a similarly named runtime environment variable cannot redirect the root.
• Deliberately absent: Electron import/caller, filesystem writes, manifest/selector/downloader/cache operations, ORCA_RELAY_PATH changes, SSH, Beta setting, fallback, tuple, publication, and defaults.

E-M5-ARTIFACT-CACHE-ROOT-LOCAL-RED-001 — cache-root provider is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-root.test.ts.
• Result: expected FAIL, one failed suite / zero tests in 251 ms because ./ssh-relay-artifact-cache-root does not exist. The purpose suite fixes the native joined path, schema-versioned namespace, absolute input guard, frozen metadata, and no-runtime-environment- override contract before implementation.
• Consumer disconnection: only the purpose test imports the absent module; no Electron, filesystem, cache operation, downloader, SSH, mode, tuple, publication, or default caller exists.

E-M5-ARTIFACT-CACHE-ROOT-LOCAL-001 — pure cache-root contract and native CI wiring

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: src/main/ssh/ssh-relay-artifact-cache-root.ts accepts only an absolute caller-supplied native user-data path and derives the fixed ssh-relay-runtime-cache/v1 namespace with node:path. The exported namespace metadata is frozen. There is no environment lookup, Electron import, or filesystem access.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-root.test.ts — PASS, 1 file / 3 tests in 197 ms Vitest, 1.09 s wall, 131,809,280-byte maximum RSS. Fixed native joining, absolute-input rejection, frozen schema metadata, and environment non-redirection all pass.
• Native workflow proof wiring: the purpose suite is present once in each POSIX and PowerShell test command in .github/workflows/ssh-relay-runtime-artifacts.yml; the workflow occurrence oracle requires both. /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-root.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 2 files / 10 tests in 613 ms Vitest, 2.66 s wall, 128,925,696-byte maximum RSS.
• Broader SSH relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts — PASS, 26 files / 314 tests; 3 declared full-size files/tests skipped; 21.67 s Vitest, 24.11 s wall, 259,784,704-byte maximum RSS.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 23.66 s Vitest, 26.32 s wall, 190,021,632-byte maximum RSS.
• Repository gates: targeted oxfmt --write completed on six files in 2.308 s; pnpm typecheck and pnpm lint pass locally. Lint includes switch exhaustiveness, 41 reliability gates, max-lines ratchet with no new bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates. Local Node 26.0.0 emits only the expected package-engine warning for required Node 24; exact Node 24 native proof is pending.
• Boundary: no production manifest/key/resource, Electron caller, filesystem/cache orchestration, proxy/downloader, SSH transfer/install/launch, ORCA_RELAY_PATH change, Beta mode, tuple, publication, or default-path change. Legacy behavior remains unchanged.
• Remaining proof for this slice: commit the coherent package and require all six primary native Node 24 jobs plus the existing adjacent PR/E2E gates before advancing to another desktop adapter.

E-M5-ARTIFACT-CACHE-ROOT-CI-001 — all-six native cache-root proof

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/workflow: aefcaa9a938710e275e3b49ab71446f73b01e075, artifact run 29472780636. The purpose suite passes within the complete runtime contract step under Node 24.18.0 on all six primary native clients.
• Primary jobs: Linux arm64 87539171165 passes in 3m02s; Linux x64 87539171175 in 2m26s; Windows x64 87539171177 in 5m53s; macOS arm64 87539171184 in 1m48s; Windows arm64 87539171191 in 10m53s; and macOS x64 87539171195 in 6m15s. Every job completes deterministic artifact build, exact runtime smoke, full-size extraction/cache measurement, and unpublished artifact upload after the contract step.
• Supplements/floors: Linux arm64/x64 supplement jobs 87540022894/87540022920 pass. Windows x64 baseline job 87540654596 passes. Windows arm64 baseline job 87540654549 verifies and executes the exact 85,213,511-byte expanded runtime with Node 24.18.0, PTY, watcher, and resource settlement, then correctly rejects observed build 10.0.26200 against required build 26100 (qualified: false, osBuild: false). The tuple remains disabled and this retained floor gate is the artifact workflow's sole expected failure.
• Adjacent gates: PR Checks run 29472780621, job 87539170670, passes in 14m48s including lint, typecheck, Git compatibility, full tests, unpacked app, and packaged CLI smoke. Golden E2E run 29472780625 passes Linux job 87539170813 in 4m55s and macOS job 87539170863 in 5m06s. Computer-use run 29472780628 passes Windows job 87539170947 in 4m30s and Ubuntu job 87539170974 in 3m04s.
• Closure: native node:path semantics, the fixed versioned namespace, absolute-path rejection, frozen metadata, and environment non-redirection are proven on Linux, macOS, and Windows x64/ arm64. No Electron/product caller, filesystem/cache operation, proxy/downloader, SSH, setting, tuple, publication, or default-path behavior exists; legacy remains unchanged.
• Residual gaps: Electron user-data adaptation, filesystem/cache orchestration, read-only/disk-full/ quota/inode faults, proxy/certificate/live download, offline transfer, SSH install/launch, native trust, oldest Windows arm64/macOS/Linux-kernel floors, per-target Beta wiring, and every tuple remain open.

E-M5-ARTIFACT-CACHE-STARTUP-BOUNDARY-AUDIT-001 — canonical user-data path correction

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of configureDevUserDataPath, initDataPath, and getCanonicalUserDataPath; startup-order search over configureDevUserDataPath, app.setName, and all existing app.getPath('userData') consumers; import/caller search for the new cache-root module. No HTML-plan text prescribes a direct Electron adapter, so the clean primary plan requires no content correction.
• Finding: Orca deliberately captures canonical user data after dev/E2E app.setPath handling but before app.setName(), because a late app.getPath('userData') can resolve to a different directory on case-sensitive filesystems. A new SSH module that calls Electron directly would therefore risk split cache ownership and bypass the established startup boundary.
• Correction: do not implement the proposed late Electron adapter. Keep sshRelayArtifactCacheRoot(userDataPath) dependency-injected. The eventual startup/product caller must pass getCanonicalUserDataPath() after initialization; tests may pass isolated absolute paths. No environment variable may replace that path.
• Next package: audit the smallest disconnected resolver/cache composition over the already-proven official manifest, selector, download, extraction, cache-entry, lease, and eviction capabilities. It must accept explicit dependencies and add no import-time I/O, Electron/startup caller, proxy, SSH, setting, tuple, publication, or default behavior.

E-M5-ARTIFACT-CACHE-RESOLUTION-AUDIT-001 — warm-cache acquisition seam

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of official-manifest composition, platform selector, downloader, extractor, cache entry verification/publication, in-use lease, and eviction modules; export/caller search confirms every capability remains disconnected outside tests/fixtures.
• Findings: the smallest useful composition is selection plus verified cache lookup plus in-use lease acquisition. Missing compiled trust and compatibility-selected legacy results must return before cache I/O. A cache miss must return the immutable selected artifact without downloading; a verified hit must acquire a lease before exposing a frozen entry snapshot. Relative cache roots, cancellation, integrity/quarantine errors, and lease failures must propagate without becoming a miss or legacy result.
• Deliberately separate: download staging, proxy/certificate integration, cold publication, eviction, availability/fallback classification, canonical startup caller, SSH transfer/install, ORCA_RELAY_PATH, Beta settings, tuples, publication, and defaults.
• Required RED: exact operation order and call counts for unavailable, legacy, miss, and hit; immutable returned identity; absolute-root and pre-aborted guards; fail-closed lookup-integrity and lease errors; proof that no downloader, Electron, startup, SSH, or fallback caller is introduced.

E-M5-ARTIFACT-CACHE-RESOLUTION-LOCAL-RED-001 — cache resolution composition is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-resolution.test.ts.
• Result: expected FAIL, one failed suite / zero tests in 403 ms because ./ssh-relay-artifact-cache-resolution does not exist. Seven purpose cases define unavailable and compatibility short circuits, immutable miss/hit identity, lease-before-hit exposure, absolute-root and cancellation guards, and fail-closed integrity/lease propagation.
• Consumer disconnection: only the purpose test imports the absent module. No downloader, Electron, startup, SSH, setting, fallback, tuple, publication, or default caller exists.

E-M5-ARTIFACT-CACHE-RESOLUTION-LOCAL-001 — disconnected warm-cache resolution

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-artifact-cache-resolution.ts composes only the verified official manifest, compatibility selector, strict cache lookup, and in-use lease. Missing trust and legacy selections return before cache I/O; cache miss returns the immutable selected artifact; cache hit returns a frozen verified entry snapshot only after lease acquisition. Integrity/quarantine and lease errors are not classified or converted here.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-resolution.test.ts — PASS, 1 file / 9 tests in 855 ms Vitest, 2.54 s wall, 131,825,664-byte maximum RSS. Cases cover unavailable/legacy zero- I/O short circuits, immutable miss, real default cache miss, exact lookup-before-lease hit, frozen entry identity, absolute root, pre-abort, post-acquisition cancellation release, and fail-closed integrity/lease errors.
• Native workflow wiring/oracle: the purpose suite is present once in each POSIX and PowerShell native artifact command. /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-resolution.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 2 files / 16 tests in 1.68 s Vitest, 3.58 s wall, 131,989,504-byte maximum RSS.
• Broader SSH relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 27 files / 323 tests; 3 declared full-size files/tests skipped; 18.04 s Vitest, 19.47 s wall, 301,465,600-byte maximum RSS.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 19.47 s Vitest, 21.25 s wall, 188,203,008-byte maximum RSS.
• Repository gates: targeted oxfmt --write completes on six files in 1.895 s; pnpm typecheck and pnpm lint pass. Lint includes switch exhaustiveness, 41 reliability gates, no new max-lines bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates. Local Node 26.0.0 emits only the expected engine warning; exact Node 24 native proof remains pending.
• Boundary: no download staging, proxy/certificate integration, cold publication, eviction, availability/fallback classification, Electron/startup caller, SSH transfer/install/launch, ORCA_RELAY_PATH, Beta setting, tuple, publication, or default-path change. Legacy remains unchanged.
• Remaining proof for this slice: commit the coherent package and require all six primary native Node 24 jobs plus adjacent PR/E2E gates before adding cold download/publication composition.

E-M5-ARTIFACT-CACHE-RESOLUTION-CI-001 — all-six native warm-cache resolution proof

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/workflow: 22031fa686d2a7c96e687bc02c16fdb08bc987d7, artifact run 29474175664. The purpose suite passes within the complete runtime contract step under Node 24.18.0 on all six primary native clients.
• Primary jobs: Windows arm64 87543508784 passes in 9m27s; macOS arm64 87543508815 in 2m17s; Linux x64 87543508833 in 6m30s; macOS x64 87543508875 in 5m06s; Windows x64 87543508878 in 5m27s; and Linux arm64 87543508960 in 5m19s. Every job completes deterministic artifact build, exact runtime smoke, full-size extraction/cache measurement, and unpublished artifact upload after the contract step.
• Supplements/floors: Linux x64/arm64 supplement jobs 87544380719/87544380722 pass in 47s/58s. Windows x64 baseline job 87544783538 passes in 2m06s. Windows arm64 baseline job 87544783520 verifies and executes the exact unpublished runtime, then correctly rejects observed build 10.0.26200 against required build 26100 (qualified: false, osBuild: false) in 5m09s. The tuple remains disabled and this retained floor gate is the artifact workflow's sole expected failure.
• Adjacent gates: PR Checks run 29474175599, job 87543508131, passes in 14m15s including lint, typecheck, Git compatibility, full tests, unpacked app, and packaged CLI smoke. Golden E2E run 29474175584 passes Linux/macOS jobs 87543508216/87543508224 in 5m17s/4m48s. Computer-use run 29474175581 passes Ubuntu/Windows jobs 87543508291/87543508301 in 3m09s/5m42s.
• Closure: missing trust and compatibility short circuits, immutable cache miss, verified hit, lookup-before-lease order, cancellation release, absolute-root rejection, and fail-closed cache integrity/lease errors are proven on Linux, macOS, and Windows x64/arm64. No downloader, Electron/startup/product caller, SSH, setting, fallback, tuple, release publication, or default- path behavior is connected; legacy remains unchanged.
• Residual gaps: cold-cache population native proof, Electron/startup adaptation, proxy/certificate/ live download, offline transfer, SSH install/launch, native trust, oldest Windows arm64/macOS/ Linux-kernel floors, per-target Beta wiring, and every tuple remain open.

E-M5-ARTIFACT-CACHE-POPULATION-AUDIT-001 — cold-cache composition boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of the disconnected downloader, strict extractor, cache entry publication/ verification, in-use lease, eviction, and warm-cache resolution modules plus their purpose tests and workflow wiring. Caller search confirms there is still no product consumer.
• Finding: cache entry publication already copies and re-hashes the verified archive, performs strict archive inspection/extraction, verifies the complete extracted tree, writes the structured proof, re-verifies the staged entry, and atomically publishes under the content lock. Calling the extractor separately would duplicate work and widen the orchestration surface. The smallest cold capability is therefore cache-local exclusive download staging, exact download-result identity checking, existing immutable publication, staging cleanup, then in-use lease acquisition before exposure. A publish-to-lease eviction race must propagate closed; later resolution may retry it.
• Required boundary: absolute explicit cache root, physically owned downloads namespace, unique per-attempt directory, exact operation order, cleanup on success/failure/cancellation, immutable returned entry, and lease release when cancellation wins after acquisition. Download, extracted- tree/integrity, cleanup, publication, and lease errors are not fallback-classified here.
• Deliberately absent: Electron/startup caller, proxy policy, SSH transfer/install/launch, ORCA_RELAY_PATH, Beta setting, fallback state machine, tuple enablement, release publication, eviction scheduling, production resources, and default behavior.
• Implementation evidence correction: the first real cold→warm integration run exposed that cache lookup/publication return physical entry paths while in-use acquisition compared them with the caller's logical cache-root spelling. This is an implementation defect under a symlinked ancestor, not a primary-plan decision change; the HTML plan already requires physically owned cache paths and needs no content correction. Canonicalize the lease operation to the existing physical cache root before identity comparison, locking, lease creation, and recency recording.

E-M5-ARTIFACT-CACHE-POPULATION-LOCAL-RED-001 — cold population composition is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-population.test.ts.
• Result: expected FAIL, one failed suite / zero tests in 1.52 s because ./ssh-relay-artifact-cache-population does not exist. Seven purpose cases fix exclusive staging, download → publish → cleanup → lease ordering, absolute-root rejection, download identity, fail-closed download/publication/lease behavior, post-lease cancellation release, and concurrent staging isolation before implementation.
• Consumer disconnection: only the purpose test imports the absent module; no Electron/startup, SSH, mode, fallback, tuple, release publication, or default caller exists.

E-M5-ARTIFACT-CACHE-PHYSICAL-ROOT-LOCAL-RED-001 — cold-to-warm lease spelling mismatch

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-population-integration.test.ts.
• Result: expected FAIL after adding the real post-population warm lookup/lease assertion: 1 file, 2/2 failed in 787 ms with SSH relay artifact cache in-use entry path disagrees with its content identity. On macOS, tmpdir() uses logical /var/... while cache publication/lookup correctly return physical /private/var/...; lease acquisition compared the physical entry to the logical root before any I/O. Both Linux tar/Brotli and Windows ZIP fixture cases reproduce the same client- path defect.
• Required correction: resolve the physical cache root once inside lease acquisition and use it for entry identity, the content lock, lease creation, and recency. Do not weaken exact-entry checks or change cache ownership, eviction, SSH, fallback, tuple, publication, or default behavior.

E-M5-ARTIFACT-CACHE-PHYSICAL-ROOT-CORRECTION-LOCAL-001 — exact physical lease identity

• Date/owner: 2026-07-15, Codex implementation owner.
• Correction: acquireSshRelayArtifactCacheInUseLease resolves the existing cache root and existing entry to physical paths, requires the entry to equal the exact physical content-addressed path, and uses that physical root for locking, lease creation, and recency. A missing entry retains the existing domain error; a different existing path remains rejected. No final-entry symlink or alternate content path becomes acceptable.
• Evidence-gated refinement: the first root-only attempt caused 3/5 existing lease tests to reject legitimate logical entry spellings; the root+entry attempt left 1/5 red because raw realpath ENOENT bypassed the established missing-entry diagnostic. Neither result was accepted. The final correction wraps only ENOENT and preserves all other failures.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-population-integration.test.ts src/main/ssh/ssh-relay-artifact-cache-in-use-lease.test.ts — PASS, 2 files / 7 tests in 2.40 s Vitest, 4.14 s wall, 134,299,648-byte maximum RSS. A subsequent assertion for an existing but misplaced content path also passes while remaining rejected by exact identity.
• Focused plus native workflow oracle: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-population.test.ts src/main/ssh/ssh-relay-artifact-cache-population-integration.test.ts src/main/ssh/ssh-relay-artifact-cache-in-use-lease.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 4 files / 21 tests in 4.20 s Vitest, 7.89 s wall, 138,723,328-byte maximum RSS.
• Boundary: this corrects physical path identity only. It adds no network, Electron/startup caller, SSH, setting, fallback, tuple, release publication, or default behavior.

E-M5-ARTIFACT-CACHE-LOCK-RELEASE-CI-RED-001 — repeated Windows active-owner release race

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/job: 3018977c113926addcbb97b5715242ed86d820d2, artifact run 29475848463, Windows x64 job 87548519537.
• Runner/runtime: GitHub-hosted Windows Server 2022 build 20348 x64, windows-2022 image 20260706.237.1, Actions runner 2.335.1, Node 24.18.0.
• New-path result: both real cold-cache integration cases pass on the Windows client, including the actual bounded downloader, Linux tar/Brotli and Windows ZIP strict publication, complete-tree verification, physical-root cold→warm lookup, and in-use lease.
• Failure: the pre-existing serializes concurrent writers and transfers ownership only after owner release test received EPERM renaming the owned lock to its release tombstone after the owner handle closed. Test teardown then removed the root while the waiter was live, producing the secondary ENOENT creating its next pending directory. Combined contract result: 1 failed, 489 passed, 13 skipped across 76 files in 26.94 s.
• Repetition/decision: this matches E-M5-COMPILED-TRUST-WINDOWS-CI-RED-001 (job 87532052082), whose disposition required a separately evidenced correction if it repeated. It is no longer accepted as a non-repeating runner event. Add a bounded retry only for Windows sharing-style EPERM/ EACCES, re-check exact nonce/directory ownership before every retry, never delete a displaced successor, retain unexpected-error propagation, and prove retry exhaustion is bounded. No test- only relaxation or blind recursive deletion is allowed.
• Gate: do not accept 3018977c1 or begin the next acquisition package until a correction commit passes replacement all-six native contracts and adjacent PR/E2E gates.

E-M5-ARTIFACT-CACHE-LOCK-RELEASE-LOCAL-RED-001 — bounded release retry is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-lock-release.test.ts.
• Result: expected FAIL, one failed suite / zero tests in 237 ms because the purpose-named ssh-relay-artifact-cache-lock-release module does not exist.
• Fixed contract: 5 s/50 ms frozen bounds; retry only EPERM/EACCES; exact ownership recheck before every retry; stop without deletion on displacement; fail closed at exact exhaustion; already-absent path settles; unexpected errors propagate without retry. The test seam controls time and filesystem operations, so exhaustion proof has no real delay or platform conditional.

E-M5-ARTIFACT-CACHE-LOCK-RELEASE-LOCAL-001 — bounded ownership-preserving release retry

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: lock release still closes its owned heartbeat handle before renaming the live lock to its exact nonce-specific tombstone. Only rename EPERM/EACCES enters a frozen 50 ms, 5 s retry policy. Each retry re-reads the exact directory identity and owner nonce immediately before rename; displacement settles without deleting the successor. ENOENT is already released, unexpected rename/ownership errors propagate, exact exhaustion fails closed, and only a successfully renamed tombstone is recursively removed. There is no blind deletion of the live lock path.
• Focused plus native-workflow oracle: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-lock-release.test.ts src/main/ssh/ssh-relay-artifact-cache-lock.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 3 files / 24 tests in 1.42 s Vitest, 2.69 s wall, 132,562,944-byte maximum RSS. Seven purpose cases cover both sharing codes, exact ownership rechecks, displaced-successor preservation, 100 controlled waits over the exact 5 s budget, absent-path settlement, and unexpected rename/ownership error propagation. The workflow oracle proves the purpose suite occurs exactly once in both POSIX and PowerShell native commands.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 30 files / 339 tests; 3 declared full-size files/tests skipped; 21.01 s Vitest, 23.06 s wall, 335,773,696-byte maximum RSS. An earlier quoted-glob invocation matched no files and exited 1; the exact unquoted checklist command above was then run and passed.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 22.20 s Vitest, 25.44 s wall, 194,150,400-byte maximum RSS.
• Repository gates: targeted pnpm exec oxfmt --write completes on five implementation/workflow files in 428 ms; the post-format focused/workflow suite passes 24/24. pnpm typecheck and pnpm lint pass; lint includes switch exhaustiveness, 41 reliability gates, no new max-lines bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates. git diff --check passes and the protected ssh-remote-node-resolution.ts/test pair has zero correction diff. Local Node 26.0.0 emits only the expected Node-24 engine warning; exact Node 24 proof remains the native CI gate.
• Boundary/gate: the correction changes only cache-lock release settlement and native contract execution. It adds no Electron/startup, network/proxy, SSH, setting, fallback classification, tuple enablement, release publication, or default behavior. Require a replacement exact-head all-six native run plus adjacent PR/E2E checks before accepting cold-cache population or starting the next acquisition package.

E-M5-ARTIFACT-CACHE-LOCK-RELEASE-CI-001 — replacement native correction and cold-cache acceptance

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/run: correction commit bd240049ffb9de196ce7cbd0f772639f4ba310f3, artifact run 29476740292. The six primary build jobs all pass with Node 24.18.0 and the exact source commit: Linux x64 job 87551250555 (ubuntu-24.04, ubuntu24 image 20260714.240.1, x64); Linux arm64 job 87551250534 (ubuntu-24.04-arm, ubuntu24-arm64 image 20260706.52.2); macOS x64 job 87551250530 (macos-15-intel, macos15 image 20260629.0276.1, Darwin 24.6.0); macOS arm64 job 87551250627 (macos-15, macos15 image 20260706.0213.1, Darwin 24.6.0); Windows x64 job 87551250538 (windows-2022, win22 image 20260714.244.1, Windows Server 2022 Datacenter build 20348); and Windows arm64 job 87551250513 (windows-11-arm, win11-arm64 image 20260714.109.1, Windows 10 Enterprise build 26200).
• Contract result: every POSIX client passes 76 files / 506 tests; every Windows client passes 77 files / 497 tests with 13 declared platform/full-size skips. Windows x64 completes in 26.55 s and directly replaces failing job 87548519537: the concurrent lock handoff, seven bounded-release purpose cases, real Linux tar/Brotli and Windows ZIP cold→warm population, exact physical-root lease, strict tree proof, and all other runtime contracts pass. Windows arm64 completes the same contract in 24.80 s; Linux x64/arm64 in 10.34/10.71 s and macOS x64/arm64 in 26.29/22.81 s.
• Full-size result: every primary job passes native extraction and immutable cache lifecycle. Across all six clients, extraction is 1,050.16–3,613.00 ms with 32,280,576–48,705,536 bytes incremental RSS; cold publication is 1,316.89–4,810.28 ms with 40,620,032–52,109,312 bytes incremental RSS; warm verified lookup is 138.28–656.65 ms with 0–6,438,912 bytes incremental RSS; active retention is 9.46–44.46 ms with 0–1,847,296 bytes incremental RSS; and eviction is 18.36–90.42 ms with 65,536–2,166,784 bytes incremental RSS while reclaiming each exact 118,418,686–161,259,304-byte entry. These remain within the recorded desktop budgets and show no latency/memory regression.
• Supplemental/baseline result: oldest-userland Linux x64 job 87552366350 and arm64 job 87552366347 pass. Windows x64 baseline job 87552698722 passes. Windows arm64 baseline job 87552698719 executes the full runtime smoke, then fails closed only because the hosted image reports kernel/OS build 26200 while the immutable tuple contract requires exact build 26100; platform and architecture match. This is the existing declared runner-floor gap, not a cache-lock or cold-population failure.
• Adjacent exact-head result: PR Checks 29476740298, Golden E2E 29476740309, and computer-use 29476740291 pass. Computer-use includes successful Ubuntu 22.04 and Windows native smoke jobs; the selector-only mac/Linux/Windows rows are expected skips.
• Acceptance/boundary: this evidence supersedes E-M5-ARTIFACT-CACHE-LOCK-RELEASE-CI-RED-001 and accepts the disconnected cold-cache population package. It does not prove Electron/startup, proxy/live network, SSH transfer/install/launch, Beta settings, fallback classification, tuple enablement, release publication, or default behavior. Legacy remains the only production path; the next package may only audit the next disconnected acquisition composition.

E-M5-ARTIFACT-CACHE-ACQUISITION-AUDIT-001 — warm/cold leased acquisition boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of the accepted warm resolution and cold population implementations/tests, official-manifest and cache-root boundaries, selected-artifact identity, real Linux/Windows cache fixtures, and the native workflow oracle. A production-caller search confirms both accepted capabilities remain disconnected outside tests.
• Finding: the smallest next composition consumes an explicit already-verified official manifest, probed host evidence, absolute cache root, and optional cancellation signal. It returns unavailable/compatibility-legacy unchanged, maps a verified warm hit to a source-qualified leased ready result without download, and invokes the accepted cold population exactly once only for a verified miss. A successful cold result is mapped to the same leased ready shape with download source. No cache miss escapes this boundary.
• Safety contract: final artifact/entry tuple and content identities must match; every returned entry snapshot/result is frozen; cancellation or identity failure after a warm/cold lease is acquired releases that lease before rejecting. Resolution, download, integrity, publication, lease, and cleanup failures propagate unchanged without availability/fallback classification. Concurrent cold misses retain the accepted unique staging and content-lock publication safety; download deduplication is deliberately not invented in this composition.
• Required RED: unavailable and compatibility short circuits, warm zero-download result, exact miss→population order/call identity, warm/cold post-lease cancellation release, inconsistent population identity failure/release, and fail-closed resolution/population errors. A real Linux/Windows integration must prove cold download followed by warm client-offline acquisition with exactly one client fetch.
• Deliberately absent: official-manifest loading, canonical user-data/Electron/startup adaptation, proxy/certificate policy, eviction scheduling, SSH transfer/install/launch, ORCA_RELAY_PATH, per-target Beta settings, fallback state machine/reason classification, tuple enablement, release publication, production resources, and default behavior. The primary HTML plan is unchanged.

E-M5-ARTIFACT-ACQUISITION-LOCAL-RED-001 — warm/cold composition is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-acquisition.test.ts src/main/ssh/ssh-relay-artifact-acquisition-integration.test.ts.
• Result: expected FAIL, two failed suites / zero tests in 616 ms because the purpose-named ssh-relay-artifact-acquisition module does not exist.
• Fixed contract: nine purpose cases define unavailable/legacy zero-population short circuits, frozen cache/download ready results, exact resolve→populate miss ordering, pre-abort, warm/cold post-lease cancellation release, inconsistent-entry rejection/release, and unclassified error propagation. Two real Linux tar/Brotli and Windows ZIP cases require a cold verified fetch followed by a warm acquisition while the client fetch is configured offline, with exactly one fetch total.
• Consumer disconnection: only the two purpose/integration suites import the absent module. No Electron/startup, product/SSH, setting, fallback, tuple, publication, or default caller exists.

E-M5-ARTIFACT-ACQUISITION-LOCAL-001 — disconnected warm/cold client acquisition

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-artifact-acquisition.ts composes only accepted cache resolution and cold population behind explicit verified-manifest, host-evidence, cache-root, and cancellation inputs. Unavailable/compatibility results return frozen without population; a warm hit returns a frozen ready/cache leased entry; only a verified miss invokes population and returns the same shape as ready/download. Artifact release/content/archive and entry tuple/content identities are checked before exposure. Cancellation or identity failure after lease acquisition releases the lease; every lower-layer error propagates without fallback classification.
• Purpose/integration command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-acquisition.test.ts src/main/ssh/ssh-relay-artifact-acquisition-integration.test.ts — PASS, 2 files / 11 tests in 1.66 s. Nine purpose cases cover both short circuits, warm/download result shape and operation order, pre-abort, warm/cold post-lease cancellation, identity failure/release, and unclassified resolver/population errors. Two real Linux tar/Brotli and Windows ZIP cases pass exact signed fixture bytes through the default selector, downloader, strict publication/tree proof, lease, and warm lookup: cold fetch count is one, the lease is released, and a second acquisition succeeds from cache while the next client fetch is configured to fail; total fetch count remains one.
• Focused plus native workflow oracle: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-acquisition.test.ts src/main/ssh/ssh-relay-artifact-acquisition-integration.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 3 files / 18 tests in 2.90 s Vitest, 5.50 s wall, 132,792,320-byte maximum RSS. Both purpose suites occur exactly once in POSIX and PowerShell native commands.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 32 files / 350 tests; 3 declared full-size files/tests skipped; accepted rerun 28.77 s Vitest, 30.56 s wall, 243,253,248-byte maximum RSS. An earlier completed invocation returned only partial captured output from the command runner and is not counted; the exact command was rerun to an observed exit code 0 and complete summary.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 22.48 s Vitest, 27.42 s wall, 195,969,024-byte maximum RSS.
• Repository gates: targeted pnpm exec oxfmt --write completes on six implementation/workflow files in 472 ms. pnpm typecheck and pnpm lint pass; lint includes switch exhaustiveness, 41 reliability gates, no new max-lines bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates. git diff --check passes and the protected ssh-remote-node-resolution.ts/test pair has zero package diff. Local Node 26.0.0 emits only the expected Node-24 engine warning; exact Node 24 proof remains pending.
• Boundary/gate: the fixture exposes its already-verified manifest and exact host evidence only to support real acquisition tests. There is still no official-manifest loader, Electron/startup or product caller, proxy policy/live credential path, eviction scheduler, SSH transfer/install, ORCA_RELAY_PATH, Beta setting, fallback classification, tuple enablement, release publication, production resource, or default-path change. Legacy remains unchanged. Require exact-head all-six native and adjacent PR/E2E proof before advancing.

E-M5-ARTIFACT-ACQUISITION-CI-001 — all-six native warm/cold client-offline acquisition

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/run: acquisition commit c170ff92c1c5c82c31048cf9a9245c13efdaddd1, artifact run 29478400576. All six primary jobs pass under Node 24.18.0 with the exact source: Linux x64 job 87556411878 (ubuntu-24.04, ubuntu24 image 20260705.232.1); Linux arm64 job 87556411960 (ubuntu-24.04-arm, ubuntu24-arm64 image 20260706.52.2); macOS x64 job 87556411874 (macos-15-intel, macos15 image 20260629.0276.1); macOS arm64 job 87556411891 (macos-15, macos15 image 20260706.0213.1); Windows x64 job 87556411869 (windows-2022, win22 image 20260706.237.1, Windows Server 2022 build 20348); and Windows arm64 job 87556411842 (windows-11-arm, win11-arm64 image 20260714.109.1, Windows build 26200).
• Contract result: every POSIX client passes 78 files / 517 tests; every Windows client passes 79 files / 508 tests with 13 declared platform/full-size skips. Linux x64/arm64 complete in 17.55/11.41 s, macOS x64/arm64 in 35.07/17.01 s, and Windows x64/arm64 in 22.71/26.48 s. Both acquisition suites run in each command, including real Linux tar/Brotli and Windows ZIP cold verified download → lease release → warm client-offline acquisition with exactly one fetch.
• Full-size result: all primary jobs pass extraction and immutable cache lifecycle. Across the six clients, extraction is 1,198.22–2,686.71 ms with 30,941,184–48,615,424 bytes incremental RSS; cold publication is 1,336.48–3,751.17 ms with 40,288,256–61,591,552 bytes incremental RSS; warm verified lookup is 128.21–653.39 ms with 0–6,074,368 bytes incremental RSS; active retention is 8.49–45.47 ms with 0–1,110,016 bytes incremental RSS; and eviction is 16.73–92.13 ms with 0–1,986,560 bytes incremental RSS while reclaiming each exact 118,418,686–161,259,373-byte entry. These remain inside the recorded budgets with no acquisition latency/memory regression.
• Supplemental/baseline result: oldest-userland Linux x64/arm64 jobs 87557134697 and 87557134698 pass. Windows x64 baseline job 87558102764 passes. Windows arm64 baseline job 87558102782 verifies and executes the exact runtime, then fails closed only because observed OS/kernel build 26200 does not equal required 26100. The retained floor gap is unrelated to acquisition and no tuple is enabled.
• Adjacent exact-head result: PR Checks 29478401854, Golden E2E 29478400513, and computer-use 29478400560 pass, including unpacked app, packaged CLI, Ubuntu 22.04, Windows, Linux E2E, and macOS E2E gates.
• Acceptance/boundary: this accepts disconnected source-qualified warm/cold acquisition and proves its in-memory Electron-response integration portably; it is not live GitHub/CDN/proxy/certificate or live SSH evidence. Manifest loading, Electron/startup/product adaptation, eviction scheduling, remote detection/transfer/install, ORCA_RELAY_PATH, Beta setting, fallback classification, tuple enablement, release publication, production resources, and defaults remain absent. Legacy remains the sole production path.

E-M5-ARTIFACT-CACHE-POPULATION-LOCAL-001 — disconnected cold-cache population

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-artifact-cache-population.ts creates a physically validated cache- local downloads namespace and unique per-attempt directory, invokes the bounded verified downloader, checks its exact destination/size/hash result, delegates strict copy/hash/extraction/ complete-tree proof and atomic publication to the existing publisher, removes download staging, then acquires an in-use lease before exposing a frozen entry. All errors propagate without availability/fallback classification; cancellation after lease acquisition releases the lease.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-population.test.ts src/main/ssh/ssh-relay-artifact-cache-population-integration.test.ts — PASS, 2 files / 9 tests in 1.01 s Vitest, 1.88 s wall, 139,051,008-byte maximum RSS. Seven operation-order/failure cases cover cleanup-before-lease exposure, absolute-root rejection, inconsistent download identity, download/publication failure cleanup, publish-to-lease eviction failure, post-lease cancellation release, and concurrent unique staging. Two credential-free integration cases feed exact signed Linux tar/Brotli and Windows ZIP fixtures through an in-memory Electron response into the real downloader, strict publisher, complete-tree verifier, and in-use lease.
• Native workflow wiring/oracle: the purpose suite is present once in each POSIX and PowerShell native artifact command. /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-artifact-cache-population.test.ts src/main/ssh/ssh-relay-artifact-cache-population-integration.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 3 files / 16 tests in 1.52 s Vitest, 2.44 s wall, 132,792,320-byte maximum RSS.
• Broader SSH relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 29 files / 332 tests; 3 declared full-size files/tests skipped; final post-correction run 25.88 s Vitest, 27.58 s wall, 253,640,704-byte maximum RSS.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in a final post-correction 38.77 s Vitest, 40.68 s wall, 189,661,184-byte maximum RSS.
• Repository gates: targeted oxfmt --write completes on six files in 7.640 s; pnpm typecheck and pnpm lint pass. Lint includes switch exhaustiveness, 41 reliability gates, no new max-lines bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates. Local Node 26.0.0 emits only the expected engine warning; exact Node 24 native proof remains pending.
• Boundary: no Electron/startup caller, live network/proxy integration, eviction scheduling, SSH transfer/install/launch, ORCA_RELAY_PATH, Beta setting, fallback classification, tuple enablement, release publication, or default-path change. Legacy remains unchanged.
• Remaining proof for this slice: commit the coherent package and require all six primary native Node 24 jobs plus adjacent PR/E2E gates before adding another desktop orchestration boundary.

E-M5-LIBC-DETECTION-AUDIT-001 — disconnected marked Linux libc evidence boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of the existing remote OS/architecture detection and tests, the signed- manifest artifact selector and tests, the bounded process-output field scanner, the accepted acquisition boundary, and every Milestone 5 platform/libc checklist requirement. The existing platform parser must remain unchanged and the protected Node/npm resolver pair remains untouched.
• Finding: the smallest coherent next package is the suggested purpose-named ssh-relay-libc-detection module, not full host-evidence composition. It consumes an explicit SSH connection and optional cancellation signal, performs one POSIX-shell/no-Node probe, and returns only { family: glibc|musl, version? } or { family: unknown }. It prefers marked getconf GNU_LIBC_VERSION; marked ldd --version and executable known musl-loader paths provide conservative fallback evidence. Only complete Orca-marked segments count.
• Safety contract: arbitrary startup text and unterminated/duplicated marker segments are ignored; malformed, ambiguous, or conflicting marked candidates return unknown. A supported numeric libc version grammar is exact. Ordinary missing commands/nonzero probe execution return unknown so a later selector can classify compatibility; an AbortError propagates so cancellation can never masquerade as legacy eligibility. The probe invokes no remote Node, npm, Python, Perl, checksum, archive, download, or package operation.
• Required RED: marked getconf preference; marked glibc and musl ldd cases; known-loader musl case; unmarked startup-noise rejection; incomplete/duplicate/conflicting/malformed result rejection; unavailable command classification; cancellation propagation; exact signal/command construction; and native-workflow inclusion on POSIX and Windows clients. Record the executable missing-module failure before adding implementation.
• Deliberately absent: kernel/libstdc++/GLIBCXX/macOS/Windows/process-translation composition, Electron/startup/product callers, live SSH evidence, SFTP/system-SSH transfer, cache acquisition wiring, ORCA_RELAY_PATH, per-target Beta settings, fallback classification, tuple enablement, release publication, and default behavior. The primary HTML plan is unchanged.

E-M5-LIBC-DETECTION-LOCAL-RED-001 — marked Linux libc probe is absent

• Date/owner: 2026-07-15, Codex implementation owner.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-libc-detection.test.ts.
• Result: expected FAIL, one failed suite / zero tests in 243 ms because the purpose-named ssh-relay-libc-detection module does not exist.
• Fixed contract: the initial 12 cases cover marked getconf/glibc, marked ldd glibc/musl, known-loader musl, unmarked noise, unterminated/malformed/duplicate/conflicting evidence, missing-command classification, AbortError propagation, one 15-second cancellable exec, preferred source order, exact known-loader globs, and absence of Node/npm/Python/Perl/archive/checksum commands. Three bounded/concatenated-noise cases were added during implementation review and belong to the green evidence below, not this recorded RED run.
• Consumer disconnection: only the purpose suite imports the absent module. No platform parser, host-evidence composer, product/SSH caller, setting, fallback, tuple, publication, or default path changes.

E-M5-LIBC-DETECTION-LOCAL-001 — disconnected marked/no-Node Linux libc probe

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-libc-detection.ts performs one 15-second cancellable POSIX-shell command and returns only exact glibc/musl family+version evidence or unknown. It emits complete source-qualified markers around preferred getconf GNU_LIBC_VERSION, fallback ldd --version, and the first executable known musl-loader glob. The client accepts only complete, unique marked segments, bounds each segment to eight lines and each line to the shared 4,096-character scan ceiling, requires strict two-to-four-component numeric versions, deduplicates identical evidence, and returns unknown for absent, malformed, oversized, ambiguous, or conflicting candidates. Ordinary execution failure returns unknown; AbortError propagates.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-libc-detection.test.ts — PASS, 1 file / 15 tests in 193 ms Vitest, 1.02 s wall, 131,973,120-byte maximum RSS. Cases cover marked getconf/glibc, common ldd glibc, ldd musl, known-loader musl, unmarked and marker-concatenated startup noise, unterminated/ malformed/duplicate/conflicting evidence, oversized line/segment rejection, ordinary failure, cancellation propagation, one exact signal/15-second exec, source order, known-loader globs, and absence of Node/npm/Python/Perl/archive/checksum commands.
• Focused plus native-workflow oracle: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-libc-detection.test.ts src/main/ssh/ssh-relay-artifact-selector.test.ts src/main/ssh/ssh-remote-platform-detection.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 4 files / 46 tests in 1.44 s Vitest, 2.67 s wall, 136,740,864-byte maximum RSS. The existing OS/architecture parser remains green and unchanged; the workflow oracle requires this purpose suite exactly once in both POSIX and PowerShell native commands.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 33 files / 365 tests; 3 declared full-size files/tests skipped; 19.61 s Vitest, 21.61 s wall, 261,455,872-byte maximum RSS.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 23.82 s Vitest, 25.76 s wall, 190,906,368-byte maximum RSS.
• Repository gates: pnpm run typecheck, targeted oxlint, targeted oxfmt --check, pnpm lint, and pnpm run check:max-lines-ratchet pass. Lint includes switch exhaustiveness, 41 reliability gates, no new max-lines bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates. Existing unrelated lint warnings remain warnings. git diff --check passes and the protected Node/npm resolver pair has zero diff. Local Node 26.0.0 emits only the expected Node-24 engine warning; exact Node 24 proof remains the native CI gate.
• Boundary/residual gaps: the new module is imported only by its purpose tests. It does not compose kernel/libstdc++/GLIBCXX, macOS/Windows, or translation evidence and has no Electron/startup, product SSH, cache acquisition, ORCA_RELAY_PATH, setting, transfer/install, fallback, tuple, publication, or default caller. This local package does not prove real SSH, GNU/BusyBox/Alpine, localization, MaxSessions=1, or remote output/channel-size behavior. Those live cells remain open; legacy remains the sole production path. Require exact-head all-six native proof before the next package.

E-M5-LIBC-DETECTION-CI-001 — all-six native marked Linux libc contract

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/run: implementation commit d8b17a354bd4c5566381d514c42c9f68e657de8a, artifact run 29480364900. All six primary jobs pass under Node 24.18.0 with that exact source: Linux x64 job 87562476656 (ubuntu-24.04, ubuntu24 image 20260705.232.1, x64); Linux arm64 job 87562476613 (ubuntu-24.04-arm, ubuntu24-arm64 image 20260714.61.1, native arm64); macOS x64 job 87562476686 (macos-15-intel, macos15 image 20260629.0276.1, x64); macOS arm64 job 87562476665 (macos-15, macos15 image 20260706.0213.1, native arm64); Windows x64 job 87562476713 (windows-2022, win22 image 20260714.244.1, x64); and Windows arm64 job 87562476682 (windows-11-arm, win11-arm64 image 20260714.109.1, native arm64).
• Contract result: every POSIX client passes 79 files / 532 tests. Linux x64/arm64 complete in 13.83/11.37 s and macOS x64/arm64 in 40.50/35.84 s. Every Windows client passes 80 files / 523 tests with the 13 declared platform/full-size skips, in 24.78/28.55 s for x64/arm64. The new 15-case libc suite is required exactly once by both native workflow families and therefore runs on every client architecture under Node 24; all existing selector, cache, release, runtime, and workflow contracts remain green.
• Full-size result: extraction spans 1,239.81–4,316.50 ms with 33,431,552–48,717,824 bytes incremental RSS. Cold immutable-cache publication spans 1,730.07–6,529.74 ms with 32,653,312–50,659,328 bytes; warm verified lookup 147.39–883.09 ms with 0–6,361,088 bytes; active retention 11.88–57.61 ms with 0–1,310,720 bytes; and eviction 28.58–119.18 ms with 0–860,160 bytes while reclaiming each exact 118,418,686–161,259,376-byte entry. All remain within the recorded budgets; this libc-only package adds no full-size latency or memory path.
• Supplemental/baseline result: oldest-userland Linux x64 job 87563395186 (ubuntu-24.04, image 20260705.232.1) and Linux arm64 job 87563395287 (ubuntu-24.04-arm, image 20260714.61.1) pass. Windows x64 baseline job 87564525786 (windows-2022, image 20260706.237.1) passes. Windows arm64 baseline job 87564525789 (windows-11-arm, image 20260714.109.1) verifies the exact bytes and completes PTY/watcher smoke in 8,077.57 ms, then fails closed only because the observed OS/kernel build is 26200 while the immutable contract requires 26100; platform and architecture checks pass. That declared hosted-runner floor gap is the sole reason the aggregate workflow conclusion is failure.
• Adjacent exact-head result: PR Checks 29480364896, Golden E2E 29480365058, and computer-use 29480365013 pass, including unpacked app, packaged CLI, Ubuntu 22.04, Windows native, Linux E2E, and macOS E2E gates.
• Acceptance/boundary: this accepts only the disconnected marked/no-Node Linux libc capability. It does not prove a real SSH server, GNU/BusyBox/Alpine remote behavior, localization, MaxSessions=1, remote output/channel-size limits, kernel/libstdc++/GLIBCXX evidence, macOS/ Windows/process-translation evidence, host composition, Electron/startup, transfer/install, settings, fallback, tuple enablement, publication, or defaults. Legacy remains the sole production path; no tuple is enabled.

E-M5-LINUX-KERNEL-DETECTION-AUDIT-001 — marked kernel evidence and distro suffix boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete rereads of current OS/architecture detection, the accepted marked libc probe, the signed-manifest selector/version parser, and their purpose tests. Common supported Rocky/RHEL 8 kernels report releases such as 4.18.0-553.5.1.el8_10.x86_64; the selector's generic numeric parser rejects _ in that suffix and would return unknown-kernel despite a valid supported numeric prefix. This is an implementation-detail gap, not a change to the reviewed 4.18 floor or the primary plan.
• Finding: add one purpose-named ssh-relay-linux-kernel-detection module that consumes an explicit SSH connection and optional cancellation signal, executes one 15-second POSIX-shell/no-Node marked uname -r, and returns an exact bounded release string or undefined. Add a kernel-specific parser to the selector that compares only the authenticated probe's strict numeric prefix while admitting the bounded real-world suffix alphabet [0-9A-Za-z._+~-]; keep the generic libc/macOS/ PowerShell version grammar unchanged.
• Safety contract: only one complete marker-qualified line counts; arbitrary or marker-concatenated startup noise, duplicate/unterminated markers, whitespace/control characters, oversized releases, missing commands, and unparseable numeric prefixes yield unknown. Ordinary execution failure is compatibility evidence; AbortError propagates. The parser must accept exact-minimum Rocky/RHEL, Ubuntu, and Alpine suffixes but reject whitespace, slash, colon, and arbitrary punctuation.
• Required RED: missing purpose module plus a selector assertion showing a supported Rocky-style 4.18.0-...el8_10... release currently returns unknown-kernel; then marked valid/noisy/ malformed/bounded/unavailable/cancelled probe cases, kernel-suffix accept/reject boundaries, existing selector regressions, and native-workflow inclusion.
• Deliberately absent: libc composition, libstdc++/GLIBCXX, macOS/Windows/translation evidence, Electron/startup/product callers, live SSH or distro cells, cache acquisition, transfer/install, settings, fallback, tuple enablement, release publication, and defaults. Legacy remains the sole production path and the primary HTML plan is unchanged.

E-M5-LINUX-KERNEL-DETECTION-LOCAL-RED-001 — kernel probe and Rocky suffix boundaries fail first

• Date/owner: 2026-07-15, Codex implementation owner.
• Source: uncommitted RED tests atop exact accepted evidence head 54d523a81.
• Command: pnpm vitest run src/main/ssh/ssh-relay-linux-kernel-detection.test.ts src/main/ssh/ssh-relay-artifact-selector.test.ts.
• Expected result: FAIL, 2 failed files; the purpose suite has zero collected tests because ssh-relay-linux-kernel-detection does not exist, and the selector has 24 passed / 3 failed. Supported 4.18.0-553.5.1.el8_10.x86_64 returns legacy/unknown-kernel; the equivalent below-floor 4.17.99-553.5.1.el8_10.x86_64 also returns unknown-kernel instead of kernel-too-old.
• Environment: local macOS arm64 worktree; pnpm 10.24.0 under Node 26.0.0 emits the repository's expected Node-24 engine warning. Exact Node 24 and all-six native execution remain required after local green.
• Boundary: this is failure-before-implementation evidence only. It authorizes only the audited disconnected probe, selector parser, purpose tests, and native workflow inclusion; no production caller or behavior is connected.

E-M5-LINUX-KERNEL-DETECTION-LOCAL-001 — disconnected marked kernel probe and strict selector

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-linux-kernel-detection.ts performs one 15-second cancellable POSIX command, brackets the optional uname -r result with exact Orca markers, and returns only one complete, unique, strict release or undefined. Startup noise outside the markers is ignored; empty/multi-line/duplicate/unterminated/marker-concatenated evidence, releases above 256 characters, invalid numeric prefixes, whitespace/control characters, slash, colon, and arbitrary punctuation are rejected. Ordinary execution failure returns undefined and AbortError propagates. The selector's kernel-only parser admits the audited distro suffix alphabet after a numeric kernel prefix and compares the prefix to the unchanged reviewed 4.18 floor. The generic libc/macOS/PowerShell grammar remains strict, with direct underscore-regression assertions.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-linux-kernel-detection.test.ts — PASS, 1 file / 19 tests in 209 ms Vitest, 1.08 s wall, 132,005,888-byte maximum RSS. Rocky/RHEL, Ubuntu, and Alpine releases; outside noise; empty/multiple/duplicate/unterminated/concatenated/oversized/malformed evidence; invalid suffixes; missing command; cancellation; one signal-qualified 15-second exec; marked uname -r; and no Node/npm/Python/Perl/archive/checksum dependency all pass.
• Focused plus native-workflow oracle: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-linux-kernel-detection.test.ts src/main/ssh/ssh-relay-artifact-selector.test.ts src/main/ssh/ssh-remote-platform-detection.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 4 files / 60 tests in 3.32 s Vitest, 5.26 s wall, 132,300,800-byte maximum RSS while run beside independent typecheck/format gates. Both POSIX and PowerShell native commands now require the purpose suite exactly once. Supported Rocky/RHEL, Ubuntu, and Alpine suffixes select; a Rocky release below 4.18 reports kernel-too-old; invalid suffixes report unknown-kernel; libc, macOS, and PowerShell versions do not inherit the kernel grammar.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 34 files / 394 tests; 3 declared full-size files/tests skipped; 15.00 s Vitest, 16.38 s wall, 246,890,496-byte maximum RSS. One preceding diagnostic invocation quoted the shell glob, selected zero files, and exited 1; the exact checklist command above was then run unquoted and passed.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 18.76 s Vitest, 20.26 s wall, 190,480,384-byte maximum RSS.
• Repository gates: pnpm run typecheck, targeted oxlint, targeted oxfmt --check, pnpm lint, and pnpm run check:max-lines-ratchet pass. Full lint includes switch exhaustiveness, 41 reliability gates, no new max-lines bypass, bundled skill-guide verification, 9,837 localization references and locale parity, and zero localization coverage candidates; existing unrelated lint warnings remain warnings. git diff --check passes and the protected Node/npm resolver pair has zero diff. Local Node 26.0.0 emits only the expected Node-24 engine warning; exact Node 24 proof remains the native CI gate.
• Boundary/residual gaps: the new detector is imported only by its purpose tests. This is contract evidence, not live SSH/GNU/BusyBox/Rocky/Ubuntu/Alpine execution. It does not compose libc, libstdc++/GLIBCXX, macOS/Windows/translation evidence and adds no Electron/startup/product caller, transfer/install, mode, setting, fallback, tuple, publication, or default behavior. Legacy remains the sole production path. Require exact-head all-six native proof before advancing.

E-M5-LINUX-KERNEL-DETECTION-CI-001 — all-six native marked kernel contract

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact source/run: implementation commit d1eb0eb63e56255d151f2f263e47fa420b970875, artifact run 29482651735. All six primary jobs pass under Node 24.18.0 with that exact source: Linux x64 job 87569723013 (ubuntu-24.04, ubuntu24 image 20260714.240, x64); Linux arm64 job 87569723055 (ubuntu-24.04-arm, ubuntu24-arm64 image 20260714.61, native arm64); macOS x64 job 87569723110 (macos-15-intel, macos15 image 20260629.0276, x64); macOS arm64 job 87569723016 (macos-15, macos15 image 20260706.0213, native arm64); Windows x64 job 87569722968 (windows-2022, win22 image 20260714.244, x64); and Windows arm64 job 87569722974 (windows-11-arm, win11-arm64 image 20260706.102, native arm64).
• Contract result: every POSIX client passes 80 files / 561 tests. Linux x64/arm64 complete in 13.35/11.69 s and macOS x64/arm64 in 59.66/18.45 s. Every Windows client passes 81 files / 552 tests with the 13 declared platform/full-size skips, in 27.01/25.25 s for x64/arm64. The new 19-case kernel suite and strict selector cases are required by both native workflow families and therefore run on every client architecture under Node 24; all existing selector, cache, release, runtime, and workflow contracts remain green.
• Full-size result: extraction spans 1,304.99–4,880.08 ms with 34,021,376–48,541,696 bytes incremental RSS. Cold immutable-cache publication spans 1,774.51–5,929.28 ms with 40,210,432–60,735,488 bytes; warm verified lookup 196.12–1,197.59 ms with 0–6,352,896 bytes; active retention 11.17–50.44 ms with 0–991,232 bytes; and eviction 25.97–99.14 ms with 0–1,052,672 bytes while reclaiming each exact 118,418,686–161,259,305-byte entry. All remain within recorded budgets; this kernel-only package adds no full-size latency or memory path.
• Supplemental/baseline result: oldest-userland Linux x64 job 87570980242 (ubuntu-24.04, image 20260714.240) and Linux arm64 job 87570980244 (ubuntu-24.04-arm, image 20260714.61) pass. Windows x64 baseline job 87571636418 (windows-2022, image 20260714.244) passes on observed build 20348. Windows arm64 baseline job 87571636619 (windows-11-arm, image 20260714.109) verifies the exact bytes and completes Node 24, PTY, and watcher smoke in 8,038.87 ms, then fails closed only because the observed OS/kernel build is 26200 while the immutable contract requires 26100; platform and architecture checks pass. That declared hosted-runner floor gap is the sole reason the aggregate workflow conclusion is failure.
• Adjacent exact-head result: PR Checks 29482650752, Golden E2E 29482651866, and computer-use 29482650759 pass, including unpacked app, packaged CLI, Ubuntu 22.04, Windows native, Linux E2E, and macOS E2E gates.
• Acceptance/boundary: this accepts only the disconnected marked/no-Node Linux kernel capability and kernel-specific selector grammar. It does not prove a real SSH server, GNU/BusyBox/Rocky/ Ubuntu/Alpine remote behavior, localization, MaxSessions=1, remote output/channel-size limits, libc composition, libstdc++/GLIBCXX evidence, macOS/Windows/process-translation evidence, host composition, Electron/startup, transfer/install, settings, fallback, tuple enablement, publication, or defaults. Legacy remains the sole production path; no tuple is enabled.

E-M5-DARWIN-VERSION-DETECTION-AUDIT-001 — disconnected marked macOS version boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete rereads of current OS/architecture detection, the accepted marked libc and Linux kernel probes, the signed-manifest selector/version grammar, baseline build evidence, and their purpose tests. Desktop SSH code has no sw_vers caller; only target-native release baseline CI reads macOS product version. The selector accepts explicit SshRelayDarwinHostEvidence.version against the reviewed 13.5 floor, so the smallest missing acquisition boundary is one disconnected product-version probe. Linux libstdc++/GLIBCXX evidence requires a separate external-tool and ambiguity audit; Windows bootstrap evidence and Rosetta translation are also larger independent slices.
• Finding: add one purpose-named ssh-relay-darwin-version-detection module that consumes an explicit SSH connection and optional cancellation signal, executes one 15-second POSIX-shell/ no-Node marked sw_vers -productVersion, and returns an exact bounded two-to-four-component numeric version or undefined. Do not change the selector grammar or reviewed macOS 13.5 floor.
• Safety contract: only one complete marker-qualified line counts; arbitrary or marker-concatenated startup noise, empty/multi-line/duplicate/unterminated segments, whitespace/control characters, suffixes, oversized values, missing commands, and malformed versions yield unknown. Ordinary execution failure is availability evidence; AbortError propagates. The probe uses no Node, npm, Python, Perl, archive, checksum, or localization-sensitive parsing.
• Required RED: missing purpose module, then exact 13.5/10.15.7/15.x versions, startup noise, concatenated/duplicate/unterminated/multi-line/oversized/malformed rejection, unavailable command, cancellation, exact signal/15-second exec, no-Node command construction, and both native-workflow families requiring the suite.
• Deliberately absent: Rosetta/process-translation detection, Linux libstdc++/GLIBCXX, Windows OpenSSH/PowerShell/.NET/build evidence, host-evidence composition, Electron/startup/product callers, live SSH/macOS cells, cache acquisition, transfer/install, settings, fallback, tuple enablement, release publication, and defaults. Legacy remains the sole production path and the primary HTML plan is unchanged.

E-M5-DARWIN-VERSION-DETECTION-LOCAL-RED-001 — macOS version probe fails first

• Date/owner: 2026-07-15, Codex implementation owner.
• Source: uncommitted RED test atop exact accepted evidence head e6383cbcd; protected resolver files have zero diff and git diff --check passes.
• Command: pnpm vitest run src/main/ssh/ssh-relay-darwin-version-detection.test.ts.
• Expected result: FAIL, 1 failed suite / zero collected tests because ssh-relay-darwin-version-detection does not exist. Duration: 288 ms Vitest. The repository's expected Node-24 engine warning is present under local Node 26.0.0 / pnpm 10.24.0.
• Native-workflow RED command: pnpm vitest run config/scripts/ssh-relay-runtime-workflow.test.mjs — expected FAIL, 1 file / 6 passed / 1 failed in 268 ms. The workflow oracle requires ssh-relay-darwin-version-detection.test.ts exactly once in each POSIX and PowerShell native command family; the source split has length 1 rather than the required 3 until both commands are wired.
• Boundary: this is failure-before-implementation evidence only. It authorizes only the audited disconnected probe, purpose tests, and native-workflow inclusion; no production caller or behavior is connected.

E-M5-DARWIN-VERSION-DETECTION-LOCAL-001 — disconnected marked macOS version probe

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-darwin-version-detection.ts executes one 15-second cancellable POSIX-shell command, guards sw_vers -productVersion, and brackets its result with exact Orca markers. It returns only one complete unique two-to-four-component numeric version of at most 64 characters. Startup noise outside markers is ignored; empty, multi-line, duplicate, unterminated, marker-concatenated, suffixed, whitespace/control, slash, colon, oversized, or malformed evidence returns undefined. Ordinary execution failure returns undefined and AbortError propagates. The command has no Node, npm, Python, Perl, tar, or checksum dependency.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-darwin-version-detection.test.ts — PASS, 1 file / 21 tests in 265 ms Vitest, 1.35 s wall, 132,022,272-byte maximum RSS, zero swaps. Valid 13.5, 10.15.7, 15.4.1, and 15.4.1.2 values; noisy/missing/malformed/bounded evidence; unavailable command; cancellation; exact signal/15-second exec; guarded marked command; and forbidden-runtime absence all pass.
• Focused plus native-workflow oracle: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-darwin-version-detection.test.ts src/main/ssh/ssh-relay-artifact-selector.test.ts src/main/ssh/ssh-remote-platform-detection.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 4 files / 62 tests in 1.67 s Vitest, 2.86 s wall, 137,003,008-byte maximum RSS, zero swaps. Both POSIX and PowerShell native commands require the purpose suite exactly once; existing platform and reviewed selector behavior passes.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 35 files passed / 3 declared skipped, 415 tests passed / 3 declared skipped in 20.76 s Vitest, 23.12 s wall, 259,325,952-byte maximum RSS, zero swaps. The expected stale-lock diagnostic and Node 26 module.register() deprecation warning are unchanged.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 19.48 s Vitest, 21.47 s wall, 189,300,736-byte maximum RSS, zero swaps.
• Static gates: pnpm typecheck; targeted pnpm exec oxlint; targeted pnpm exec oxfmt --check; pnpm lint; pnpm run check:max-lines-ratchet; and git diff --check pass after formatting the two reported files. Full lint includes switch exhaustiveness, 41 reliability gates, 355 grandfathered max-lines entries with no new bypass, bundled-skill verification, 9,837 localization references and locale parity, and zero localization coverage candidates. Its 26 warnings are in untouched files. Protected resolver files have zero diff.
• Residual gap: local execution uses Node 26.0.0 / pnpm 10.24.0; exact Node 24 on all six native client runners, both Linux supplements, and Windows baselines remains required at the exact implementation head. No real SSH/macOS host, Rosetta, full host composition, product caller, transfer/install, setting, fallback, tuple, publication, or default behavior is proven or added.

E-M5-DARWIN-VERSION-DETECTION-CI-001 — exact-head native macOS version contract

• Date/owner: 2026-07-15, Codex implementation owner.
• Source: implementation commit bcda04389590e30bec2ac7f8e15516f937a2019f on draft PR #8741. Artifact run 29484393590 checks out that exact SHA and uses Node 24.18.0. The aggregate conclusion is failure only because the already-declared Windows arm64 floor job rejects hosted build 26200 against required 26100.
• Six primary native jobs: Windows x64 87575304056, Windows arm64 87575304065, macOS arm64 87575304087, Linux arm64 87575304100, Linux x64 87575304113, and macOS x64 87575304141 pass checkout, dependency install, native workflow contracts, exact inputs, two clean deterministic builds, archive/tree verification, exact-byte Node/PTY/watcher smoke, full-size extraction/cache metrics, and unpublished evidence upload. The new purpose suite passes 21/21 on every job. Each POSIX client passes 81 files / 582 tests; each Windows client passes 82 files / 573 tests with 13 declared skips.
• Supplemental Linux jobs: arm64 87576256001 and x64 87576256015 verify the exact unpublished bytes and pass oldest-userland Node/PTY/watcher smoke; the documented kernel gap remains explicit.
• Windows baseline jobs: x64 87577449489 passes on Windows build 20348. Arm64 87577449408 verifies the complete 85,213,511-byte / 42-file tree, Node 24.18.0 ABI 137, PTY resize/exit, five watcher events, resource settlement after 2,000 ms, 5,884.1533 ms smoke at 48,582,656-byte RSS, and then fails only the floor predicate: observed 10.0.26200, required build 26100. This matches the pre-existing declared runner gap; no new failure appears.
• Exact-head repository checks: PR Checks 29484394474, Golden E2E 29484393471, and computer-use 29484393610 pass.
• Boundary: this is portable contract and target-native client evidence, not live SSH/macOS or Rosetta evidence. The module has no product caller. No host composer, setting, transfer/install, fallback classifier, tuple enablement, publication, or default behavior is added; legacy remains the sole production path and no tuple is enabled.

E-M5-DARWIN-TRANSLATION-DETECTION-AUDIT-001 — disconnected Darwin translation evidence

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: current platform detection reports the remote process architecture from marked uname -sm but cannot distinguish an x64 process on Intel hardware from an x64 process translated by Rosetta on Apple Silicon. The selector already rejects explicit processTranslated: true as translated-process, and the reviewed policy keeps Rosetta legacy-only until a separate live Rosetta SSH cell passes. No desktop SSH module currently invokes sysctl.proc_translated.
• Finding: add one purpose-named ssh-relay-darwin-translation-detection module that consumes an explicit SSH connection and optional cancellation signal, executes one 15-second POSIX-shell/ no-Node marked probe, and returns true, false, or undefined. Query sysctl.proc_translated and hw.optional.arm64 within the same bounded command. An explicit translation value of 1 is translated unless it conflicts with explicit non-arm64 hardware; an explicit 0 is native. When the translation key is absent, explicit hw.optional.arm64=0 proves native Intel; missing translation on arm64-capable or unknown hardware remains unknown. Any conflicting, malformed, duplicate, incomplete, noisy, or oversized evidence remains unknown.
• Local audit evidence: native macOS arm64 reports uname -m = arm64, /usr/sbin/sysctl -in sysctl.proc_translated = 0, and /usr/sbin/sysctl -in hw.optional.arm64 = 1. This proves only the local native response, not Rosetta or SSH execution.
• Safety contract: startup noise outside exact markers is ignored; only one complete unique line containing the two exact bounded fields counts. Ordinary command failure is unavailable evidence; AbortError propagates. The probe uses no Node, npm, Python, Perl, archive, checksum, or localization-sensitive parsing. It does not change SshRelayHostEvidence or invent a value for unknown evidence; conservative composition remains a separate package.
• Required RED: missing purpose module, native Apple Silicon, translated Apple Silicon, native Intel-key-absent, unknown/missing/conflicting/malformed/multi-line/duplicate/unterminated/ concatenated/oversized evidence, unavailable command, cancellation, exact signal/15-second exec, no-Node command construction, and both native-workflow families requiring the suite.
• Deliberately absent: live Rosetta/Intel/macOS SSH cells, full host-evidence composition, Linux libstdc++/GLIBCXX, Windows evidence, Electron/startup/product callers, transfer/install, settings, fallback wiring, tuple enablement, publication, and defaults. Legacy remains the sole production path and the primary HTML plan is unchanged.

E-M5-DARWIN-TRANSLATION-DETECTION-LOCAL-RED-001 — Darwin translation probe fails first

• Date/owner: 2026-07-15, Codex implementation owner.
• Source: uncommitted RED tests atop evidence head 5e7f8e5f5; protected resolver files have zero diff.
• Purpose command: pnpm vitest run src/main/ssh/ssh-relay-darwin-translation-detection.test.ts — expected FAIL, 1 failed suite / zero collected tests because ssh-relay-darwin-translation-detection does not exist; 336 ms Vitest.
• Native-workflow command: pnpm vitest run config/scripts/ssh-relay-runtime-workflow.test.mjs — expected FAIL, 1 file / 6 passed / 1 failed in 393 ms. The source split has length 1 rather than the required 3 until both POSIX and PowerShell native commands include the purpose suite.
• Environment: local macOS arm64, Node 26.0.0 / pnpm 10.24.0 with the expected Node-24 engine warning. Exact Node 24 and all-six native execution remain required after local green.
• Boundary: failure-before-implementation evidence only. It authorizes only the audited disconnected probe, purpose tests, and native-workflow inclusion; no selector/composer/product behavior is connected.

E-M5-DARWIN-TRANSLATION-DETECTION-LOCAL-001 — bounded Darwin translation evidence

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-darwin-translation-detection.ts executes one 15-second cancellable marked POSIX command, guards sysctl, and captures sysctl.proc_translated plus hw.optional.arm64 in one exact bounded line. Explicit non-conflicting translation/native values return true/false; absent translation with explicit non-arm64 hardware returns false for native Intel; arm64-capable/unknown missing evidence and conflicts return undefined. Startup noise is ignored outside markers; empty, multi-line, duplicate, unterminated, marker-concatenated, extra, non-canonical, invalid, or oversized evidence returns undefined. Ordinary execution failure is unavailable and cancellation propagates. No selector/composer is connected.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-darwin-translation-detection.test.ts — PASS, 1 file / 23 tests in 212 ms Vitest, 1.08 s wall, 132,104,192-byte maximum RSS, zero swaps. Translated/native Apple Silicon, explicit native/translated signals, Intel absent-key behavior, malformed/conflict/ unavailable/cancellation boundaries, exact 15-second signal-qualified exec, and no forbidden runtime dependency pass.
• Focused plus workflow command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-darwin-translation-detection.test.ts src/main/ssh/ssh-relay-darwin-version-detection.test.ts src/main/ssh/ssh-relay-artifact-selector.test.ts src/main/ssh/ssh-remote-platform-detection.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 5 files / 85 tests in 2.23 s Vitest, 3.21 s wall, 136,921,088-byte maximum RSS, zero swaps. Both native workflow command families require the purpose suite exactly once; current platform and selector behavior remains unchanged.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 36 files passed / 3 declared skipped, 438 tests passed / 3 declared skipped in 16.43 s Vitest, 17.55 s wall, 303,955,968-byte maximum RSS, zero swaps. Expected stale-lock and local Node 26 deprecation diagnostics remain.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 14.47 s Vitest, 16.26 s wall, 195,428,352-byte maximum RSS, zero swaps.
• Static gates: pnpm typecheck, targeted oxlint, targeted oxfmt --check after formatting its two reported files, pnpm lint, pnpm run check:max-lines-ratchet, and git diff --check pass. Full lint includes switch exhaustiveness, 41 reliability gates, 355 grandfathered max-lines entries with no new bypass, bundled-skill verification, 9,837 localization references and locale parity, and zero coverage candidates. Its 26 warnings are in untouched files. Protected resolver files have zero diff.
• Residual gap: exact Node 24/all-six native client execution, live Intel/Apple Silicon/Rosetta SSH, host composition, and every production/default path remain unproven and disconnected. Unknown evidence is not coerced to false. No tuple is enabled and legacy remains the only default.

E-M5-DARWIN-TRANSLATION-DETECTION-CI-001 — exact-head native translation contract

• Date/owner: 2026-07-15, Codex implementation owner.
• Source: implementation commit c8d4acb2cca0e4ddbab21bf6f85eda2a9fca1272 on draft PR #8741. Artifact run 29486003082 checks out that exact SHA and uses Node 24.18.0. Its aggregate conclusion is failure only because the already-declared Windows arm64 floor job rejects hosted build 26200 against required 26100.
• Six primary native jobs pass: Windows arm64 87580520842, macOS arm64 87580520848, Linux arm64 87580520849, Windows x64 87580520869, macOS x64 87580520874, and Linux x64 87580520925. Every job passes checkout, dependencies, the new 23-case purpose suite, exact inputs, two clean builds, archive/tree verification, exact-byte Node/PTY/watcher smoke, full-size extraction/cache gates, and unpublished evidence upload. POSIX clients pass 82 files / 605 tests; Windows clients pass 83 files / 596 tests with 13 declared skips.
• Primary full-size metrics: extraction spans 1,277.58–3,499.69 ms and 31,014,912–50,987,008 incremental RSS bytes for 31,776,498–37,168,778-byte archives, 85,213,511–124,846,430 expanded bytes, and 34–42 files. Cold immutable publication spans 1,747.60–4,960.67 ms and 41,283,584–59,977,728 incremental RSS bytes; warm verified lookup spans 177.70–912.37 ms and 0–5,861,376 bytes. Active retention spans 10.40–46.41 ms and 0–2,748,416 bytes; eviction spans 29.26–91.28 ms and 0–1,712,128 bytes, reclaiming each complete 118,418,686–161,259,369-byte entry. All remain inside the existing budgets.
• Supplemental Linux jobs: x64 87581673366 passes in 43 seconds and arm64 87581673420 passes in 49 seconds. Both re-authenticate the exact unpublished runtime and pass the digest-pinned glibc 2.28/libstdc++ 6.0.25 Node/PTY/watcher userland proof; the shared hosted kernel gap remains.
• Windows baseline jobs: x64 87582483921 passes on Windows Server build 20348 after verifying 60 entries / 42 files / 96,527,161 bytes, Node 24.18.0 ABI 137, PTY resize/exit, five watcher events, resource settlement after 2,000 ms, and 5,354.977 ms smoke at 50,012,160-byte RSS. Arm64 87582484015 verifies 60 entries / 42 files / 85,213,511 bytes, Node 24.18.0 ABI 137, the same PTY/watcher/resource contract, and 5,914.7293 ms smoke at 49,098,752-byte RSS, then fails only osBuild: false for observed 10.0.26200 versus required 26100.
• Exact-head adjacent runs pass: PR Checks 29486003131 job 87580520678, Golden E2E 29486003110 macOS job 87580520501 and Linux job 87580520516, and computer-use 29486003157 Ubuntu job 87580520599 and Windows job 87580520621.
• Boundary: this is contract and target-native client evidence, not live SSH/Intel/Rosetta/macOS remote proof. The detector remains disconnected. No host composer, product caller, setting, transfer/install, fallback classifier, tuple enablement, publication, or default behavior is added; legacy remains the sole production path and no tuple is enabled.

E-M5-LINUX-LIBSTDCXX-DETECTION-AUDIT-001 — disconnected loader ABI evidence

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: the selector already requires both the reviewed physical libstdc++ 6.0.25 floor and GLIBCXX_3.4.25, but no desktop SSH module acquires either value. Requiring strings would be a portability regression: the unmodified ubuntu:22.04 arm64 image has ldconfig, readlink, grep, and sed but no strings. Its loader cache resolves /usr/lib/aarch64-linux-gnu/libstdc++.so.6.0.30, and binary-safe grep -ao yields bounded GLIBCXX_3.4 through GLIBCXX_3.4.30 evidence.
• Oldest-floor audit: the existing digest-pinned Rocky Linux 8.9 image docker.io/library/rockylinux@sha256:2d05a9266523bbf24f33ebc3a9832e4d5fd74b973c220f2204ca802286aa275d resolves /usr/lib64/libstdc++.so.6.0.25 and yields GLIBCXX_3.4 through GLIBCXX_3.4.25. Both Docker probes ran with --network none; Rocky x64 ran through Docker Desktop emulation on the local macOS arm64 controller. An Ubuntu repetition with LD_LIBRARY_PATH=/tmp intentionally produced no candidate evidence.
• Finding: add one purpose-named ssh-relay-linux-libstdcxx-detection module that consumes an explicit SSH connection and optional cancellation signal. One 15-second marked POSIX-shell probe locates ldconfig in PATH, /sbin, or /usr/sbin, resolves loader-cache libstdc++.so.6 candidates with readlink -f, and scans version symbols with LC_ALL=C grep -ao. Cap the probe at eight candidate libraries and 256 symbols per library. The parser accepts only bounded safe absolute paths, exact libstdc++.so.X.Y.Z basenames, exact GLIBCXX_X.Y[.Z] symbols, complete nesting, and a single consistent version pair across distinct candidates.
• Safety contract: missing tools/candidates, non-empty LD_LIBRARY_PATH or LD_PRELOAD, duplicate paths, malformed/incomplete/duplicate/overflow segments, and conflicting multilib evidence return unknown. Ordinary command failure is unavailable compatibility evidence; AbortError propagates. The probe uses no Node, npm, Python, Perl, tar, checksum tool, strings, package manager, compiler, or locale-sensitive package output. The later staged bundled-Node execution remains the authoritative pre-install compatibility proof; this probe only supports conservative pre-download selection and does not settle the future launch-environment sanitization contract.
• Required RED: missing purpose module; valid Rocky/Ubuntu and consistent-multilib evidence; unavailable/override/empty/noisy/malformed/unsafe/duplicate/conflicting/overflow rejection; cancellation and exact 15-second signal-qualified exec; exact no-strings command construction; and both native workflow families requiring the suite.
• Deliberately absent: live SSH/Rocky/Ubuntu/multilib cells, host-evidence composition, libc/kernel/ macOS/Windows callers, Electron/startup, cache acquisition, transfer/install, launch-environment policy, settings, fallback, tuple enablement, publication, and defaults. Legacy remains the sole production path and the primary HTML plan is unchanged.

E-M5-LINUX-LIBSTDCXX-DETECTION-LOCAL-RED-001 — loader ABI probe fails first

• Date/owner: 2026-07-15, Codex implementation owner.
• Source: uncommitted RED tests atop evidence head dcf26940e; protected resolver files have zero diff.
• Purpose command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-linux-libstdcxx-detection.test.ts — expected FAIL, one failed suite / zero collected tests in 274 ms because ssh-relay-linux-libstdcxx-detection does not exist.
• Native-workflow command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — expected FAIL, one file / six passed / one failed in 348 ms. The new suite occurs once in the workflow oracle instead of three times until both POSIX and PowerShell native commands are wired.
• Environment/boundary: local macOS arm64, Node 26.0.0 / pnpm 10.24.0. This is failure-before-implementation evidence only; exact Node 24/all-six proof remains required after local green. It authorizes only the audited disconnected probe, purpose tests, and workflow inclusion; no composer/product/default behavior is connected.

E-M5-LINUX-LIBSTDCXX-DETECTION-LOCAL-001 — bounded loader ABI evidence

• Date/owner: 2026-07-15, Codex implementation owner.
• Implementation: ssh-relay-linux-libstdcxx-detection.ts executes one 15-second cancellable marked POSIX command. It refuses LD_LIBRARY_PATH/LD_PRELOAD, locates the glibc loader cache, resolves at most eight libstdc++.so.6 candidates, and emits at most 256 binary-safe GLIBCXX matches per library. The streaming parser accepts only safe normalized absolute paths, exact physical basenames, numeric ABI symbols, complete marker nesting, unique paths, and a single consistent version pair. It computes the maximum GLIBCXX version without trusting output order. Missing tools/candidates, ordinary exec failure, malformed/duplicate/conflicting/overflow evidence, or loader overrides return undefined; cancellation propagates. The module has no production import.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-linux-libstdcxx-detection.test.ts — PASS, one file / 23 tests in 229 ms Vitest, 1.28 s wall, 132,055,040-byte maximum RSS, zero swaps. Rocky 8 floor, Ubuntu 22.04, consistent/conflicting multilib, unordered maximum, missing/override/malformed/ unsafe/duplicate/overflow evidence, cancellation, exact 15-second signal-qualified exec, forbidden-dependency absence, and exact POSIX syntax pass. The POSIX syntax case is a declared Windows skip when the purpose suite runs there.
• Focused compatibility/workflow command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 plus the new purpose suite, libc, kernel, Darwin version, Darwin translation, selector, platform detection, and native-workflow suites — PASS, eight files / 142 tests in 5.06 s Vitest, 7.36 s wall, 134,283,264-byte maximum RSS, zero swaps. Both native workflow families require the new suite exactly once.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 37 files passed / three declared skipped, 461 tests passed / three declared skipped in 25.67 s Vitest, 28.53 s wall, 236,781,568-byte maximum RSS, zero swaps. The expected stale-lock and local Node 26 deprecation diagnostics remain unchanged.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 17.82 s Vitest, 19.97 s wall, 195,592,192-byte maximum RSS, zero swaps.
• Static gates: pnpm typecheck, targeted oxlint, targeted oxfmt --check, pnpm lint, pnpm run check:max-lines-ratchet, and git diff --check pass. Full lint includes switch exhaustiveness, 41 reliability gates, 355 grandfathered max-lines entries with no new bypass, bundled-skill verification, 9,837 localization references and locale parity, and zero coverage candidates. Its 26 warnings are in untouched files. Protected resolver files have zero diff.
• Boundary/residual gaps: the exact command has POSIX syntax proof and the audited primitives produce the expected Rocky/Ubuntu ABI evidence, but this package is not live SSH/distro/multilib proof and does not establish remote output/channel limits. Exact Node 24 on all six native clients remains required. Host composition, future launch-environment sanitization, Electron/startup, product SSH, cache acquisition, transfer/install, settings, fallback, tuple enablement, publication, and defaults remain absent; legacy remains the sole production path.

E-M5-LINUX-LIBSTDCXX-DETECTION-CI-RED-001 — cache unit suites attempt Electron installation

• Date/owner: 2026-07-15, Codex implementation owner.
• Source/run: exact implementation head 156ea35c0; SSH Relay Runtime Artifacts run 29487742612, Darwin x64 job 87586158910.
• Passing detector evidence: the new ssh-relay-linux-libstdcxx-detection suite passes all 23 cases in 31 ms on the native macos-15-intel job. The job reaches 81 passing files and 612 passing tests before the adjacent failure; this is not accepted as the required all-six gate.
• Failure: ssh-relay-artifact-cache-population.test.ts and ssh-relay-artifact-acquisition.test.ts each collect zero tests. Both consume only injected operations but import the production download module transitively; without an Electron mock, electron/index.js starts install-electron because artifact CI intentionally installs source dependencies with --ignore-scripts. Two bounded fetch attempts report TypeError: fetch failed, followed by Electron failed to install correctly; the job exits 1 with two failed / 81 passed files and 612 passed tests in 49.39 s.
• Classification/correction gate: this is a test-isolation and client-offline determinism defect. Rerunning until the Electron download happens to succeed would hide the dependency and is not acceptable evidence. Add a purpose-scoped electron.net.fetch mock to the two dependency-injected unit suites, retain the real Electron fetch coverage in downloader/integration suites, then pass focused local tests and a replacement all-six exact-head run. Production code and behavior must remain unchanged.

E-M5-LINUX-LIBSTDCXX-DETECTION-CLIENT-OFFLINE-CORRECTION-LOCAL-001 — cache suites are network-independent

• Date/owner: 2026-07-15, Codex implementation owner.
• Correction: ssh-relay-artifact-cache-population.test.ts and ssh-relay-artifact-acquisition.test.ts now provide a purpose-scoped electron.net.fetch mock before importing their dependency-injected composition modules. Every case asserts the mock was never called. Downloader and real cold→warm integration suites retain their existing explicit Electron fetch mocks and byte-stream behavior; production code is unchanged.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 plus the two corrected suites, the Linux libstdc++ purpose suite, and the native workflow oracle — PASS, four files / 46 tests in 1.52 s Vitest, 2.73 s wall, 138,412,032-byte maximum RSS, zero swaps. No Electron binary installation or fetch occurs.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 37 files / 461 tests with three declared skipped files/tests in 24.58 s Vitest, 27.49 s wall, 248,905,728-byte maximum RSS, zero swaps. The expected stale-lock and local Node 26 deprecation diagnostics remain unchanged. A first invocation quoted the glob, correctly found no files, and is not treated as evidence; this recorded command uses shell expansion.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 20.37 s Vitest, 22.12 s wall, 190,201,856-byte maximum RSS, zero swaps.
• Static gates: pnpm typecheck, pnpm lint, pnpm run check:max-lines-ratchet, targeted oxlint, targeted oxfmt --check, and git diff --check pass. Full lint retains the same 26 warnings in untouched files, 41 reliability gates, 355 grandfathered max-lines entries with no new bypass, 9,837 localization references and locale parity, and zero localization candidates. Protected resolver files have zero diff.
• Boundary/residual gaps: local macOS arm64 uses Node 26.0.0 / pnpm 10.24.0; replacement exact Node 24 on all six native clients remains mandatory. This correction changes tests only and proves no production SSH, cache, fallback, or default behavior.

E-M5-LINUX-LIBSTDCXX-DETECTION-CI-001 — replacement native loader ABI and client-offline proof

• Date/owner: 2026-07-15, Codex implementation owner.

• Source/run: exact head 1182bcdc5e3df9034f06cf796bd2db6afb36f56d; SSH Relay Runtime Artifacts run 29488827561. All six primary jobs and both Linux oldest-userland supplements pass. Windows x64 baseline passes; Windows arm64 retains only the declared hosted-build mismatch after completing the full runtime proof.

• Native source-contract jobs:

  Tuple	Job	Requested/resolved runner	Architecture	Contract result
  linux-x64-glibc	87589717854	ubuntu-24.04; ubuntu24 20260705.232.1	X64	83 files / 628 tests pass
  linux-arm64-glibc	87589717829	ubuntu-24.04-arm; ubuntu24-arm64 20260706.52.2	ARM64	83 files / 628 tests pass
  darwin-x64	87589717843	macos-15-intel; macos15 20260629.0276.1	X64	83 files / 628 tests pass
  darwin-arm64	87589717839	macos-15; macos15 20260706.0213.1	ARM64	83 files / 628 tests pass
  win32-x64	87589717812	windows-2022; win22 20260706.237.1	X64	84 files / 618 pass / 14 skip
  win32-arm64	87589717826	windows-11-arm; win11-arm64 20260706.102.1	ARM64	84 files / 618 pass / 14 skip

  Every job records GitHub-hosted execution, Node 24.18.0, and the exact source commit. The detector purpose suite passes 23/23 on POSIX and 22/22 with the one declared POSIX-syntax skip on Windows. The corrected cache suites collect and pass normally without an Electron install/download.

• Oldest-userland supplements: x64 job 87590861147 on ubuntu24 20260705.232.1 and arm64 job 87590861158 on ubuntu24-arm64 20260706.52.2 pass the digest-pinned glibc 2.28 / libstdc++ 6.0.25 evidence. Exact kernel 4.18 remains the already-declared residual gap.

• Full-size desktop metrics across the six primary jobs: extraction is 1,278.08–3,734.91 ms with 32,448,512–45,395,968 incremental RSS; cold cache is 1,749.64–5,442.50 ms with 40,873,984–48,943,104 incremental RSS; warm cache is 174.30–862.23 ms with 0–6,070,272 incremental RSS; active retention is 11.65–42.60 ms; eviction is 25.03–90.56 ms. All remain within the recorded desktop time, 80 MiB incremental-memory, and 2 GiB cache budgets.

• Windows x64 baseline: job 87591565355, windows-2022 / win22 20260714.244.1, X64, build 20348 — PASS. It verifies 60 entries / 42 files / 96,527,161 expanded bytes, Node 24.18.0 ABI 137, PTY exit/resize behavior, five watcher events, and two-second resource settlement. Smoke is 5,310.5246 ms / 50,552,832 RSS; complete verification is 6,473.4959 ms. The declared 19045 or 20348 build contract qualifies.

• Windows arm64 baseline: job 87591565305, windows-11-arm / win11-arm64 20260714.109.1, ARM64, build 26200. Before the expected final rejection it verifies 60 entries / 42 files / 85,213,511 expanded bytes, Node 24.18.0 ABI 137, PTY exit/resize behavior, five watcher events, and two-second resource settlement. Smoke is 6,064.0717 ms / 49,815,552 RSS; complete verification is 8,098.9394 ms. Platform and architecture checks pass; only build 26200 differs from the reviewed 26100 evidence cell, so this remains a residual hosted-runner gap and not a tuple enablement.

• Adjacent exact-head proof: PR Checks run 29488826783, job 87589715319; Golden E2E run 29488826838, macOS job 87589715177 and Linux job 87589715191; computer-use run 29488826924, Windows job 87589715474 and Ubuntu job 87589715539 — all pass.

• Boundary/residual gaps: this is portable source/native-client contract evidence, not live SSH, Rocky/Ubuntu multilib, Windows remote, transfer, install, fallback, or bundled launch evidence. The detector remains disconnected, every tuple remains disabled, and legacy remains the sole production/default path.

E-M5-WINDOWS-COMPATIBILITY-DETECTION-AUDIT-001 — disconnected bootstrap compatibility evidence

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: the selector already requires four Windows values fixed by Milestone 1 — OS build, OpenSSH for Windows version, Windows PowerShell version, and .NET Framework release — but no desktop SSH module acquires them. Existing remote platform detection establishes only OS and architecture and must remain unchanged by this package.
• Finding: add one purpose-named ssh-relay-windows-compatibility-detection module that consumes an explicit SSH connection and optional cancellation signal. One 15-second encoded, noninteractive Windows PowerShell command reads CurrentBuildNumber and .NET Framework v4 Release from the 64-bit local-machine registry, reads $PSVersionTable.PSVersion, and invokes the exact discovered sshd.exe -V binary only to extract an X.YpZ OpenSSH version. It emits only one fixed marked segment with four key/value lines; raw registry values and native command output are never emitted.
• Parsing/safety contract: accept only one complete segment containing exactly one of each field. OS build and .NET release must be positive safe integers, PowerShell must be a strict two-to-four- component numeric version, and OpenSSH must be exact X.YpZ; each line and segment is bounded. Missing sshd, registry keys, fields, or PowerShell data; malformed/duplicate/unknown fields; incomplete/duplicate/nested markers; oversized values; and ordinary command failure return unknown. AbortError propagates. Use the existing UTF-16LE powerShellCommand boundary with wrapCommand: false; do not interpolate remote values or paths into command source.
• Required RED/green proof: valid Windows 10/Server 2022 x64 and Windows 11 arm64 evidence; unordered fields; strict noisy/empty/missing/malformed/duplicate/unknown/overflow rejection; cancellation and exact signal-qualified 15-second exec; encoded noninteractive command construction; absence of Node, npm, Python, Perl, tar, checksum tools, or GitHub/network access; native Windows PowerShell execution; and both native workflow families requiring the suite.
• Deliberately absent: process-translation policy, full host-evidence composition, selector changes, live Windows SSH/OpenSSH-service evidence, semantic file-transfer capability probing, Electron/ startup, cache acquisition, transfer/install, settings, fallback, tuple enablement, publication, and defaults. SignPath is unrelated to this package and remains deferred; legacy remains the sole production path.

E-M5-WINDOWS-COMPATIBILITY-DETECTION-RED-001 — purpose and workflow gates fail before implementation

• Date/owner: 2026-07-15, Codex implementation owner; local macOS arm64 worktree at exact head 6209151dd9e817ee765eeee2f7020e879571707b plus the uncommitted audit/test gate.
• Purpose RED command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/ssh-relay-windows-compatibility-detection.test.ts. Result: expected exit 1; Vitest 1.13 seconds, 3.93 seconds wall, 131,874,816-byte maximum RSS. Collection stops at the awaited purpose import with only Cannot find module '/src/main/ssh/ssh-relay-windows-compatibility-detection'; zero tests collect because no implementation module exists.
• Workflow-oracle RED command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts config/scripts/ssh-relay-runtime-workflow.test.mjs. Result: expected exit 1; 6 pass / 1 fail, Vitest 1.41 seconds, 4.14 seconds wall, 131,956,736-byte maximum RSS. The new purpose suite has one workflow occurrence, so the portable native-family oracle receives split length 2 and rejects it against required length 3. This proves the Windows workflow family is not yet wired.
• Interpretation: both failures are narrow and expected. No implementation module, product import, production caller, selector/default change, or second workflow occurrence exists at this RED gate; the protected Node/npm resolver diff remains empty.

E-M5-WINDOWS-COMPATIBILITY-DETECTION-LOCAL-001 — strict bounded Windows compatibility evidence

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop head 6209151dd9e817ee765eeee2f7020e879571707b plus this uncommitted package. The expected Node-24 engine warning means exact Node 24 remains a CI gate.
• Implementation: ssh-relay-windows-compatibility-detection.ts executes one signal-qualified, 15-second, UTF-16LE encoded Windows PowerShell command with wrapCommand: false. It reads the 64-bit HKLM Windows build and .NET Framework v4 release keys, reads the current Windows PowerShell version, discovers the exact sshd.exe application, and bounds its -V capture to eight records/4,096 characters before accepting one normalized OpenSSH-for-Windows version. It emits one fixed six-line marked segment and never emits raw registry or native-command output. The streaming parser accepts exactly four unique fields, positive safe build/release integers, a two-to-four-component numeric PowerShell version, exact X.YpZ OpenSSH, and at most 128 characters per field line. Missing, empty, malformed, duplicate, unknown, nested, incomplete, oversized, ambiguous, unsafe-integer, or ordinary command-failure evidence returns undefined; AbortError propagates.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-windows-compatibility-detection.test.ts — PASS, one file, 26 passed / one declared macOS skip in 572 ms Vitest, 16.45 seconds wall under concurrent local load, 132,448,256-byte maximum RSS, zero swaps. It covers Windows 10 x64, Server 2022 x64, Windows 11 arm64, unordered evidence, every strict rejection class above, ordinary failure, cancellation, exact exec options, encoding, registry view, bounded exact-binary version capture, and forbidden runtime/network dependency absence. The skipped case executes the exact encoded probe under native Windows PowerShell, requires exit 0, and requires exactly six bounded output lines; only native Windows CI may satisfy it.
• Workflow-oracle command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, one file / seven tests in 1.04 seconds Vitest, 3.24 seconds wall, 132,759,552-byte maximum RSS, zero swaps. The suite now occurs exactly once in both POSIX and PowerShell native contract commands.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 plus the Windows purpose suite, libc, kernel, Darwin version, Darwin translation, libstdc++, selector, platform detection, and workflow-oracle suites — PASS, nine files, 168 passed / one declared macOS skip in 5.38 seconds Vitest, 7.61 seconds wall, 138,067,968-byte maximum RSS, zero swaps.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 38 files passed / three declared skipped files, 487 tests passed / four declared platform skips in 42.76 seconds Vitest, 46.28 seconds wall, 251,150,336-byte maximum RSS, zero swaps. The unchanged stale-lock diagnostic and local Node 26 module.register() deprecation warning remain expected.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 30.55 seconds Vitest, 33.07 seconds wall, 190,562,304-byte maximum RSS, zero swaps.
• Static gates: pnpm typecheck; pnpm lint; explicit pnpm run check:max-lines-ratchet; targeted pnpm exec oxlint; targeted pnpm exec oxfmt --check; git diff --check; and the protected-resolver empty-diff assertion pass. Full lint includes switch exhaustiveness, 41 reliability gates, 355 grandfathered max-lines entries with no new bypass, bundled-skill checks, 9,837 localization references and locale parity, and zero localization coverage candidates. Its 26 warnings are in untouched files. Both new purpose-named files stay under 300 lines.
• Boundary/residual gaps: the module has no import outside its purpose test and no production caller. Local macOS does not execute native Windows PowerShell, prove the hosted runner has complete sshd.exe evidence, or establish live Windows SSH/OpenSSH-service behavior. Exact-head all-six Node 24 client proof is mandatory next. Full host composition, process translation policy, semantic transfer capability, Electron/startup, cache acquisition, transfer/install, settings, fallback wiring, tuple enablement, release publication, defaults, and SignPath remain absent; legacy remains the sole production/default path.

E-M5-WINDOWS-COMPATIBILITY-DETECTION-CI-RED-001 — hosted first-use progress is not probe failure

• Date/owner/source: 2026-07-15, Codex implementation owner; exact implementation head 30bf908f2477d3f4b568811469e04f2009c13b28, SSH Relay Runtime Artifacts run 29491051007, Windows x64 job 87597009005, hosted Windows Server 2022 / Node 24.18.0.
• Passing evidence: the runtime contract reaches 84 passed files, 644 passed tests, and 14 declared skips. Every parser, strict-rejection, cancellation, command-construction, and dependency-absence detector case passes. The native encoded probe itself completes in 8,035 ms with process status 0, no spawn error, and the exact six bounded stdout lines required by the test.
• Sole failure: one native-execution assertion requires stderr === ''. Hosted Windows PowerShell emits a bounded #< CLIXML progress stream containing only three S="progress" records for Preparing modules for first use. before the encoded script starts. It contains no S="Error" record. The production execCommand success path returns stdout on exit 0 and does not parse stderr as detector evidence, so this is a purpose-test portability defect rather than a production detector or runtime failure.
• Correction contract: retain process status 0, no spawn error, exact six-line/128-character stdout, and the existing 15-second process bound. Accept stderr only when empty or at most 4,096 characters of first-use CLIXML containing the known progress record and no PowerShell error record. Unknown, oversized, or error CLIXML must still fail the native test. Production code, workflow composition, and every product/default path remain unchanged. Replacement native x64 and arm64 plus all-six Node 24 proof is mandatory.

E-M5-WINDOWS-COMPATIBILITY-DETECTION-CORRECTION-LOCAL-001 — bounded known progress only

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0 / pnpm 10.24.0, test-only correction atop exact implementation head 30bf908f2. Production source and native workflow commands are unchanged.
• Correction: isExpectedPowerShellStartupStderr accepts empty stderr or at most 4,096 characters starting with #< CLIXML, containing the observed S="progress" and Preparing modules for first use. record, and containing no S="Error" record. Five explicit local cases accept empty/known progress and reject unknown text, error CLIXML, and oversized progress. The native case retains process status 0, no spawn error, exact six stdout lines, 128-character line bounds, and the 15-second process timeout.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-windows-compatibility-detection.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, two files, 38 passed / one declared macOS skip in 651 ms Vitest, 1.94 seconds wall, 133,087,232-byte maximum RSS, zero swaps. This is 31 purpose assertions plus the seven-case native-workflow oracle.
• Static commands: pnpm typecheck; targeted pnpm exec oxlint; targeted pnpm exec oxfmt --check; pnpm run check:max-lines-ratchet; git diff --check; and the protected-resolver empty-diff assertion pass. The expected local Node-24 engine warning remains; exact Node 24 is the native CI gate.
• Boundary: this corrects only the native test's handling of hosted PowerShell startup progress. It does not relax the production parser, change the detector command, add a product import/caller, or alter any legacy/default behavior. Replacement x64/arm64 and all-six exact-head proof remains mandatory; live SSH, host composition, settings/fallback, tuple enablement, publication, and SignPath remain absent.

E-M5-WINDOWS-COMPATIBILITY-DETECTION-CI-001 — both native Windows detector contracts close

• Date/owner/source: 2026-07-15, Codex implementation owner; exact correction head c489ee9f712c275b755fa33d2bf72f99253b53b2 on draft PR #8741. Replacement SSH Relay Runtime Artifacts run 29491431906 checks out that exact SHA and uses Node 24.18.0.
• All six primary native jobs pass: Windows x64 87598281195, Windows arm64 87598281158, Darwin arm64 87598281186, Darwin x64 87598281198, Linux arm64 87598281211, and Linux x64 87598281215.
• Native detector proof: each Windows job passes the 32-case ssh-relay-windows-compatibility-detection suite under native Windows PowerShell — x64 in 2,213 ms and arm64 in 3,610 ms. Each Windows native contract passes 85 files / 650 tests with 14 declared skips. Each POSIX native contract passes 84 files / 659 tests with the one native-Windows execution skip. This closes encoded syntax/execution, registry access, sshd.exe -V, bounded first-use progress handling, strict parsing/rejection, cancellation, and command-construction on both Windows architectures; it is still client/native-command evidence rather than live SSH.
• Both Linux oldest-userland supplements pass: x64 87599209993 and arm64 87599209998. The Windows x64 oldest-baseline job 87600150054 passes.
• The Windows arm64 oldest-baseline job 87600150042 verifies the full 60-entry / 42-file / 85,213,511-expanded-byte tree and content identity, Node v24.18.0 ABI 137, PTY exit/resize, five watcher events, and two-second resource settlement. Smoke takes 6,101.9951 ms at 50,077,696-byte RSS and complete verification takes 8,303.8299 ms. Its only rejection is the previously declared hosted OS build 26200 against required build 26100; platform and arm64 architecture checks pass and no new residual gap is reported.
• Full-size extraction stays at 1,319.09–3,574.53 ms and 31,191,040–47,452,160 incremental RSS bytes across the six primary clients. Cold immutable-cache publication stays at 1,789.86–4,013.22 ms and 32,522,240–50,397,184 incremental RSS bytes; warm lookup stays at 191.14–589.48 ms and 0–6,123,520 incremental RSS bytes. Retention stays at 12.53–46.41 ms and eviction at 32.54–91.28 ms. Every measurement remains within its existing budget.
• Adjacent exact-head checks pass: PR Checks run 29491430511, job 87598223319; Golden E2E run 29491430552, Linux job 87598223336 and macOS job 87598223374; computer-use run 29491430223, Windows job 87598222661 and Ubuntu job 87598222670.
• Boundary/residual gaps: the detector remains imported only by its purpose test, with no host composer or product caller. Hosted native PowerShell does not prove live Windows OpenSSH service, remote startup noise/channel behavior, system-SSH/SFTP transfer capability, or representative remote Windows versions. Full host composition, live SSH, transfer/install, settings/fallback, tuple enablement, release publication, defaults, and SignPath remain absent. Legacy remains the sole production/default path and every tuple stays disabled.

E-M5-HOST-EVIDENCE-COMPOSITION-AUDIT-001 — disconnected platform-specific evidence composition

• Date/owner: 2026-07-15, Codex implementation owner.
• Audit: complete reads of the canonical remote-platform type/detector and tests, all six accepted platform-specific compatibility detectors and purpose suites, selector host-evidence union and conservative legacy classifications, native workflow commands/oracle, and the current production- caller graph. The detector functions remain imported only by purpose tests and no host composer exists. The existing platform detector has no cancellation input and must remain unchanged here.
• Finding: add one purpose-named ssh-relay-host-evidence-detection module consuming an explicit already-detected RemoteHostPlatform, SSH connection, and optional cancellation signal. First require the platform object's relay-platform identity to agree with its canonical OS/architecture; inconsistent input returns undefined without a probe. Then invoke only the accepted detector family: Linux kernel/libc/libstdc++ concurrently (at most three channels), Darwin version/translation concurrently (at most two), or the single Windows compatibility detector. Return a deeply frozen SshRelayHostEvidence object with canonical OS/architecture.
• Conservative mapping: Linux and Windows are not subject to the reviewed Darwin/Rosetta process- translation policy, so their composed processTranslated value is false. Linux preserves { family: 'unknown' } and missing optional fields for later selector classification. A missing complete Windows segment yields Windows evidence with all optional compatibility fields absent so selection remains legacy. Darwin preserves explicit true/false translation and optional version; unknown translation returns no host evidence because inventing either boolean could select a native artifact or misdiagnose a translated process. No selector/type change is needed.
• Failure/concurrency contract: pass the exact signal to every invoked detector. Pre-abort and AbortError propagate; unexpected detector rejection propagates unchanged rather than becoming fallback eligibility. Ordinary probe failures retain each accepted detector's existing unknown return. All OS-specific calls start before composition awaits their results, bounding the composed probe to the slowest existing 15-second detector instead of their sum. No unsupported detector, platform re-probe, retry, network/download, Node, or filesystem operation is introduced.
• Required RED/green proof: canonical Linux/Darwin/Windows x64 and arm64 mapping; exact detector family/call count; complete and missing/unknown fields; native/translated/unknown Darwin behavior; inconsistent platform rejection with zero probes; deep freezing; all relevant calls starting concurrently; exact signal forwarding; cancellation/unexpected rejection propagation; absence of production imports; and both native workflow families requiring the purpose suite.
• Deliberately absent: platform-detection modification, full startup/official-manifest/cache orchestration, live SSH/remote cells, semantic transfer capability, transfer/install, settings, fallback classification/wiring, Electron, ORCA_RELAY_PATH, tuple enablement, publication, defaults, and SignPath. Legacy remains the sole production/default path and every tuple stays disabled.
• RED evidence, 2026-07-15:
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-host-evidence-detection.test.ts — EXPECTED FAIL, exit 1: purpose suite could not import absent ssh-relay-host-evidence-detection; zero tests collected in 316 ms, 1.76 s wall time, 132,235,264-byte maximum RSS, 96,490,992-byte peak memory footprint.
  • /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — EXPECTED FAIL, exit 1: 6 passed and the native-family inclusion oracle failed because the purpose suite had only the POSIX workflow occurrence (source.split(...) length 2 instead of 3); 409 ms suite duration, 1.84 s wall time, 131,743,744-byte maximum RSS, 95,851,800-byte peak memory footprint.
  • Scope check before RED: git diff --check passed; protected ssh-remote-node-resolution.ts and .test.ts diff remained empty. No implementation or product caller existed.

E-M5-HOST-EVIDENCE-COMPOSITION-LOCAL-001 — bounded immutable host evidence is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop pushed head cfe56d0fd plus this isolated uncommitted package. The expected Node-24 engine warning means exact Node 24 remains a native CI gate.
• Implementation: the new 92-line ssh-relay-host-evidence-detection.ts accepts only an explicit already-detected platform, connection, and optional signal. It rejects canonical OS/architecture inconsistency before any probe; starts only the selected OS family's accepted bounded detectors; runs Linux's three and Darwin's two probes concurrently; preserves Linux/Windows unknowns for conservative legacy selection; refuses to invent Darwin translation; propagates cancellation and unexpected rejection; and returns deeply frozen selector-shaped evidence. It has no production import or caller.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-host-evidence-detection.test.ts — PASS, one file / 20 tests in 337 ms Vitest, 1.69 seconds wall, 132,431,872-byte maximum RSS, zero swaps. It covers all six canonical tuples and exact family call counts, full/unknown/missing mapping, native/translated/ unknown Darwin behavior, inconsistent input with zero probes, deep freezing, concurrency, exact signal forwarding, cancellation, and unexpected rejection.
• Workflow-oracle command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, one file / seven tests in 384 ms Vitest, 1.73 seconds wall, 132,972,544-byte maximum RSS, zero swaps. The purpose suite now occurs exactly once in both POSIX and PowerShell native contract commands.
• Post-format focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 plus the composer, Windows compatibility, libc, kernel, Darwin version/translation, libstdc++, selector, platform detection, and workflow-oracle suites — PASS, 10 files / 193 passed / one declared native-Windows skip in 4.66 seconds Vitest, 7.18 seconds wall, 138,493,952-byte maximum RSS, zero swaps.
• Broader relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 39 files passed / three declared skipped files, 512 tests passed / four declared platform skips in 25.68 seconds Vitest, 27.42 seconds wall, 281,608,192-byte maximum RSS, zero swaps. Only the established stale-lock diagnostic and local Node 26 module.register() deprecation warning appear.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 24.51 seconds Vitest, 27.61 seconds wall, 188,825,600-byte maximum RSS, zero swaps.
• Static gates: /usr/bin/time -l pnpm typecheck passes in 5.81 seconds wall with 1,262,075,904-byte maximum RSS. /usr/bin/time -l pnpm lint passes in 27.03 seconds wall with 2,034,597,888-byte maximum RSS; all switch-exhaustiveness, 41 reliability, 355-entry max-lines, bundled-skill, 9,837 localization-reference, locale-parity, and zero-candidate localization gates pass, with the existing 26 warnings only in untouched files. Explicit max-lines, targeted oxlint, targeted oxfmt --check, git diff --check, no-production-import, and protected- resolver empty-diff checks pass. The 92-line implementation and 229-line purpose suite add no max-lines suppression or vague module.
• Boundary/residual gaps: this is local mock/composition proof, not live SSH or native detector execution. Exact-head all-six Node 24 client proof is mandatory next. Platform detection, manifest/cache startup composition, live SSH/remote cells, semantic transfer capability, transfer/install, Electron/settings, fallback classification/wiring, ORCA_RELAY_PATH, tuple enablement, publication, defaults, and SignPath remain absent. Legacy remains the sole production/ default path and every tuple stays disabled.

E-M5-HOST-EVIDENCE-COMPOSITION-CI-001 — all six native clients accept host composition

• Date/owner/source: 2026-07-15, Codex implementation owner; exact implementation commit a7fd19de5f2d0b8b7243259fa0a2ea669b5323d7 on draft PR #8741. SSH Relay Runtime Artifacts run 29493317298 checks out that exact SHA and uses Node 24.18.0.
• All six primary native jobs pass: Windows x64 87604401012, Windows arm64 87604401042, Darwin arm64 87604401020, Darwin x64 87604401024, Linux arm64 87604401102, and Linux x64 87604401073.
• Native composition proof: each primary client passes all 20 purpose cases in 9–19 ms. Both Windows jobs pass 86 files / 670 tests with 14 declared skips; all four POSIX jobs pass 85 files / 679 tests with one declared native-Windows skip. This executes the canonical six-tuple mapping, conservative missing evidence, Darwin translation policy, concurrent family startup, signal/ rejection propagation, and deep-freeze contract under every supported client OS/architecture.
• Both Linux oldest-userland supplements pass: arm64 87605280551 and x64 87605280565. The Windows x64 oldest-baseline job 87606310152 passes.
• The Windows arm64 oldest-baseline job 87606310179 first verifies the 60-entry / 42-file / 85,213,511-expanded-byte tree and content identity, Node v24.18.0 ABI 137, PTY exit 23 and 37x101 resize, five watcher events, and two-second resource settlement. Smoke takes 5,816.3487 ms at 48,713,728-byte RSS and full verification takes 7,868.3114 ms. Its only rejection is observed Windows build 26200 against the required build 26100; platform and arm64 architecture checks pass and residual gaps are empty.
• Full-size extraction remains inside its existing budgets at 1,119.77–2,601.01 ms and 29,687,808–47,091,712 incremental RSS bytes. Cold immutable-cache publication stays at 1,347.36–5,064.87 ms and 34,258,944–52,510,720 incremental RSS bytes; warm lookup stays at 128.45–873.41 ms and 131,072–5,505,024 incremental RSS bytes. Retention stays at 8.97–45.85 ms and eviction at 15.92–90.46 ms. Every measurement passes its existing budget.
• Adjacent exact-head checks pass: PR Checks run 29493317294, job 87604344252; Golden E2E run 29493317248, Linux job 87604343968 and macOS job 87604343988; computer-use run 29493317269, Ubuntu job 87604343943 and Windows job 87604343949.
• Boundary/residual gaps: this is native client composition proof, not live SSH remote behavior. The composer still has no product caller. Remote distro/OS evidence, MaxSessions=1, live channel behavior, transport capability, transfer/install, Electron/settings, fallback wiring, ORCA_RELAY_PATH, tuple enablement, publication, defaults, and SignPath remain open. Legacy remains the sole production/default path and every tuple stays disabled.

E-M6-SOURCE-TREE-CONTRACT-AUDIT-001 — disconnected authenticated source-tree projection

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact input boundary: accept only the ready result from the existing artifact acquisition. That result already binds a selected tuple from a signature-verified immutable manifest, a strict fully verified cache entry, and a live content-scoped in-use lease. Do not accept a raw manifest, tuple, cache path, archive, or caller-created file list.
• Immutable projection: recheck tuple/content identity, cache aggregate counts, and the canonical runtime root before exposure. Project the authenticated entries into deeply frozen directory and file descriptors with client-native absolute paths. Use one explicit ASCII path order, independent of manifest insertion order and filesystem enumeration order. Preserve signed file role, exact size, SHA-256, and only the declared 0644/0755 modes.
• Limits: inherit the already authenticated schema ceilings rather than adding a second policy: 5,000 total entries, 250 MiB per file, 350 MiB expanded bytes, and exact signed file-count/ expanded-byte aggregates. A mismatch fails closed before a descriptor is returned.
• Ownership/cancellation: the projection is synchronous and performs no filesystem or network I/O, so it has no cancellation point and creates no resource to clean up. It exposes only a borrowed lease-ownership assertion; it never releases the acquisition's lease. The later orchestration owner must retain and release that lease only after pre-scan, the selected transfer family, and cleanup have all settled. The next asynchronous pre-scan/transfer package must accept one exact AbortSignal, check it throughout, and assert the borrowed lease before and after source reads.
• Later consumers: the same contract is the sole expected-tree input for pre-scan and for bounded SFTP, POSIX tar/no-tar system-SSH, and Windows PowerShell/.NET system-SSH transfer. Transport code may choose framing/concurrency but may not reorder or weaken the authenticated descriptors.
• Required RED/green proof: Linux and Windows signed tuples; deterministic ordering and native path construction; exact modes/roles/sizes/hashes/aggregates; deep freezing; ready-only input; identity, aggregate, and runtime-root rejection; borrowed lease assertion with zero implicit release; no filesystem/SSH/product import or caller; and exact inclusion in both native workflow families.
• Deliberately absent: filesystem enumeration or mutation detection, file opening/streaming, channels/SFTP/child processes, remote paths/writes/install, progress, cleanup, settings/modes, fallback, Electron/startup, ORCA_RELAY_PATH, tuple enablement, publication, defaults, and SignPath. Legacy remains the sole production/default path and every tuple stays disabled.

E-M6-SOURCE-TREE-CONTRACT-LOCAL-RED-001 — missing source-tree contract and native proof

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop local evidence commit e76c5f9e8 and the audit/test-only working diff. Exact Node 24 remains a later native CI gate.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-tree.test.ts — EXPECTED FAIL, exit 1: the absent ssh-relay-runtime-source-tree module prevents collection of the ten audited cases; zero tests run in 600 ms Vitest / 3.20 seconds wall, 132,104,192-byte maximum RSS and 96,212,248-byte peak memory footprint.
• Workflow-oracle command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — EXPECTED FAIL, exit 1: six workflow cases pass and the native-family inclusion oracle fails because the new purpose suite has one source occurrence rather than the required three; 544 ms Vitest / 3.18 seconds wall, 131,956,736-byte maximum RSS and 96,245,280-byte peak memory footprint.
• Scope at RED: git diff --check passed before the package; protected resolver files had no diff. No source-tree module, production import/caller, filesystem enumeration, SSH operation, transfer, remote write, settings/fallback, tuple, publication, or default behavior exists.

E-M6-SOURCE-TREE-CONTRACT-LOCAL-CONTENTION-001 — rejected concurrent broad-gate run

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64. The first broad relay, release-script, and full-lint commands were launched together while an unrelated local Vitest process was also active. Process inspection showed all four CPU/I/O-heavy commands overlapping for more than six minutes; these results are not accepted as implementation evidence.
• Relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — INVALID/FAIL, 39 files passed, three skipped, and one existing cache-entry suite failed seven cases only at their 30-second test timeout; 515 tests passed and four were skipped in 449.11 seconds Vitest / 453.40 seconds wall.
• Release-script command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — INVALID/FAIL, 48 files passed and two existing suites failed nine cases at 30-second timeouts/teardown races; 271 tests passed with four unhandled cleanup errors in 445.50 seconds Vitest / 449.76 seconds wall.
• Full lint nevertheless passed every command in 448.00 seconds wall. Because the two test failures were resource-contention artifacts outside this package, both broad test commands were rerun alone after process inspection confirmed no competing Vitest/lint process; only those isolated reruns count below. No timeout was increased and no test or production behavior was weakened.

E-M6-SOURCE-TREE-CONTRACT-LOCAL-001 — pure authenticated source-tree contract is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop local evidence commit e76c5f9e8 plus this isolated package. Exact Node 24 and every client OS/architecture remain mandatory in native CI.
• Implementation: the 123-line ssh-relay-runtime-source-tree.ts accepts only an acquisition-ready type exported by the existing acquisition module. It rechecks signed tuple/content identity, verified cache aggregates, and the exact cache runtime root; then projects Linux/Darwin/Windows manifest entries into separately ASCII-sorted, deeply frozen client-native directory/file descriptors. It preserves signed roles, modes, sizes, and hashes, exposes only a borrowed lease assertion, and never releases the owner lease. It imports only node:path, acquisition types, and runtime identity types; it performs no I/O and has no product caller.
• Post-format purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-tree.test.ts — PASS, one file / ten tests in 1.64 seconds Vitest / 6.64 seconds wall, 132,792,320-byte maximum RSS and 96,998,776-byte peak memory footprint. It covers signed Linux/Windows tuples, reversed insertion order, client-native paths, exact descriptors/aggregates, deep freezing, lease borrowing, and ready/identity/aggregate/runtime-root rejection.
• Workflow-oracle command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, one file / seven tests in 1.24 seconds Vitest / 6.23 seconds wall, 133,103,616-byte maximum RSS. Both native workflow command families now execute the purpose suite exactly once.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 plus the source-tree, acquisition unit/integration, cache-entry, schema, signature, and workflow-oracle suites — PASS, seven files / 85 tests in 39.79 seconds Vitest. The observed 188.64-second wrapper wall time came from the same local command scheduling period, but no focused test failed or timed out.
• Isolated broader relay rerun: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true src/main/ssh/ssh-relay-*.test.ts — PASS, 40 files passed / three declared full-size skips, 522 tests passed / four declared platform skips in 54.54 seconds Vitest / 57.40 seconds wall, 222,511,104-byte maximum RSS. Only the established stale lock diagnostic and local Node 26 module.register() deprecation warning appear.
• Isolated release-script rerun: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 35.05 seconds Vitest / 39.91 seconds wall, 190,300,160-byte maximum RSS.
• Static gates: /usr/bin/time -l pnpm typecheck passes in 9.32 seconds wall with 1,238,499,328-byte maximum RSS. /usr/bin/time -l pnpm lint passes every full lint, switch-exhaustiveness, 41 reliability, 355-entry max-lines, bundled-skill, 9,837 localization- reference, locale-parity, and zero-candidate localization gate; the 26 warnings remain only in untouched files. Targeted oxlint, targeted oxfmt --check, git diff --check, protected- resolver empty diff, no other src/main importer, and the 123/226-line implementation/test size checks pass. No max-lines suppression or vague module is added.
• Boundary/residual gaps: this is a synchronous descriptor contract, not filesystem pre-scan, mutation detection, streaming, live SSH, SFTP/system-SSH, remote staging/install, or a full-size transfer. Exact-head all-six Node 24 client proof is required before accepting the item. Every product/startup/settings/fallback/tuple/publication/default path remains absent; legacy remains the sole production/default path, every tuple stays disabled, and SignPath stays deferred.

E-M6-SOURCE-TREE-CONTRACT-CI-001 — all six native clients accept the source-tree contract

• Date/owner/source: 2026-07-15, Codex implementation owner; exact implementation commit 2f38700b9844a5e8fd1afa6750d7793bcd57e69c on draft PR #8741. SSH Relay Runtime Artifacts run 29496035270 checks out that exact SHA and uses Node 24.18.0.
• All six primary native jobs pass: Windows x64 87613081678, Windows arm64 87613081711, Darwin arm64 87613081693, Darwin x64 87613081698, Linux arm64 87613081803, and Linux x64 87613081783.
• Native contract proof: every client passes all ten purpose cases in 104–442 ms. Both Windows jobs pass 87 files / 680 tests with 14 declared skips; all four POSIX jobs pass 86 files / 689 tests with one declared native-Windows skip. This executes signed Linux/Windows descriptor projection, deterministic ordering, native paths, deep freezing, borrowed lease semantics, and all fail-closed identity/aggregate/root cases on every supported client OS/architecture.
• Both Linux oldest-userland supplements pass: x64 87614003979 and arm64 87614004039. The Windows x64 oldest-baseline job 87615011157 passes.
• The Windows arm64 oldest-baseline job 87615011206 verifies the 60-entry / 42-file / 85,213,511-expanded-byte tree and content identity, Node v24.18.0 ABI 137, PTY exit 23 and 37x101 resize, five watcher events, and two-second resource settlement. Smoke takes 6,063.5099 ms at 48,398,336-byte RSS and full verification takes 8,392.7748 ms. Its only rejection is observed Windows build 26200 against required 26100; platform/arm64 checks pass and residual gaps are empty. The aggregate run conclusion is failure only because this declared runner mismatch remains intentionally fail-closed.
• Full-size extraction remains within budgets at 1,162.28–5,633.09 ms and 33,939,456–46,018,560 incremental RSS bytes. Cold immutable-cache publication stays at 1,384.24–7,156.65 ms and 39,288,832–60,940,288 incremental RSS bytes; warm lookup stays at 167.72–1,193.01 ms and 0–6,414,336 incremental RSS bytes. Retention stays at 10.56–126.99 ms and eviction at 19.54–100.30 ms. Every measurement passes its existing budget.
• Adjacent exact-head checks pass: PR Checks run 29496035043, job 87613080471; Golden E2E run 29496036617, macOS job 87613085499 and Linux job 87613085648; computer-use run 29496035157, Windows job 87613080650 and Ubuntu job 87613080659.
• Boundary/residual gaps: the accepted source-tree module still has no other src/main importer and performs no I/O. GitHub client runners do not prove filesystem mutation races, live SSH, SFTP or system-SSH channel behavior, remote staging/install, or full-size transfer. Pre-scan, streaming, every product/settings/fallback/tuple/publication/default path, and SignPath remain open. Legacy remains the sole production/default path and every tuple stays disabled.

E-M6-SOURCE-PRESCAN-AUDIT-001 — bounded complete local source authentication and snapshot

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact input/output boundary: accept only the immutable SshRelayRuntimeSourceTree closed by E-M6-SOURCE-TREE-CONTRACT-CI-001 plus one required caller-owned AbortSignal. Return a deeply frozen scanned tree that preserves the same authenticated identity/order/descriptors and adds an immutable root, directory, and file state snapshot for later transfer-time comparison. Do not accept a raw path, manifest, cache entry, or file list.
• Complete pre-remote scan: assert the borrowed cache lease before any filesystem operation and after all final state checks. Require the runtime root and every declared directory/file to remain exact real entries; reject symlinks/junctions, special files, missing/extra entries, exact and case-fold collisions, mode drift on POSIX, size/count/aggregate drift, and SHA-256 disagreement. Hash every file before any future transport creates remote staging.
• Bounded traversal: use one open directory handle at a time, one open regular-file handle at a time, one reusable 64 KiB buffer, and the authenticated maximum of 5,000 total entries / 350 MiB expanded bytes / 250 MiB per file. Stop immediately when actual entries exceed the expected set; do not materialize file contents or an unbounded directory listing.
• Race/snapshot contract: capture bigint device, inode, size, mtime, and ctime state around each file open/read/hash and compare the path again after close. Capture root/directory state before traversal and recheck every directory plus every file after all hashes. A replacement or mutation at any point fails closed. Later transfer must compare these exact snapshots before opening any remote file, hash the transmitted bytes while reading, compare again after each read, and abort remote work on drift; pre-scan alone does not claim to close post-scan races.
• Cancellation/ownership: check the exact signal before lease assertion, directory open/read, metadata operations, every file chunk, final state checks, and final lease assertion. Await every directory/file close on success, failure, and cancellation; close failures propagate. The scan borrows but never releases the acquisition lease and owns no remote resource or cleanup.
• Test seam: a narrow domain-named filesystem-operations injection may wrap real lstat, directory read/close, and file stat/read/close so mutation, cancellation, and close ordering are deterministic in purpose tests. Production uses fixed defaults; injection cannot change signed expectations.
• Required RED/green proof: real signed Linux and Windows cache trees; deterministic immutable snapshots; exact signal and lease ordering; root/directory/file mutation; symlink/junction, special, extra, missing, collision, mode, size, hash, and aggregate rejection; mid-enumeration and mid-read cancellation; handle-close success/failure ordering; 64 KiB maximum reads; zero whole-file materialization; exact full-size native artifact latency/RSS/open-handle measurements; no SSH/ product caller; and inclusion in both native workflow families.
• Deliberately absent: remote path construction, directory/file creation, SSH/SFTP/child process, transfer framing/writes/progress, permission repair, cleanup, install/launch, settings/modes, fallback, Electron/startup, ORCA_RELAY_PATH, tuple enablement, publication, defaults, and SignPath. Legacy remains the sole production/default path and every tuple stays disabled.

E-M6-SOURCE-PRESCAN-LOCAL-RED-001 — missing pre-scan and native/full-size proof

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop local evidence commit fea8e4ad1 plus the audit/test-only diff.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-scan.test.ts — EXPECTED FAIL, exit 1: the absent module prevents collection; zero tests in 808 ms Vitest / 2.55 seconds wall, 137,756,672-byte maximum RSS.
• Full-size command: the same command with src/main/ssh/ssh-relay-artifact-cache-entry-full-size.test.ts — EXPECTED FAIL, exit 1: its new exact-artifact scan measurement cannot import the absent module; zero tests in 690 ms Vitest / 2.43 seconds wall, 132,317,184-byte maximum RSS.
• Workflow-oracle command: the same command with config/scripts/ssh-relay-runtime-workflow.test.mjs — EXPECTED FAIL, exit 1: six cases pass and native inclusion fails because the purpose suite has one source occurrence rather than three; 512 ms Vitest / 2.25 seconds wall, 133,005,312-byte maximum RSS.
• Scope at RED: the protected resolver files have no diff. No scan module, SSH/product caller, remote resource, transfer/install, settings/fallback, tuple, publication, or default behavior exists.

E-M6-SOURCE-PRESCAN-LOCAL-001 — disconnected bounded source pre-scan is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop evidence commit fea8e4ad1 plus the implementation diff. Native Node 24 and exact artifact-size measurements remain the next CI gate.
• Implemented boundary: ssh-relay-runtime-source-scan.ts consumes only the accepted source tree, one exact signal, and its narrow test operations seam. It asserts but never releases the borrowed lease; enumerates with at most one directory handle; hashes every file through at most one file handle and one reusable 64 KiB buffer; rejects linked/special/missing/extra/colliding/mode/size/ hash/state drift; rechecks root, every directory, every file, and the lease; and returns frozen bigint device/inode/size/mtime/ctime snapshots for later transfer-time comparison.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-scan.test.ts — PASS, exit 0: 16 passed and one Linux-only case-fold test skipped on macOS; 4.49 seconds Vitest / 8.27 seconds wall and 134,807,552-byte maximum RSS. The cases cover signed Linux/Windows cache trees, deep freezing, exact lease ordering, pre/mid-enumeration/mid-read cancellation, no post-cancel child metadata lookup, directory/file close failure propagation, symlink/special/missing/extra/hash/mode/ collision rejection, post-hash mutation, and handle/buffer bounds. Instrumentation observes peak one directory plus one file handle, zero remaining handles, and reads no larger than 65,536 bytes.
• Workflow oracle: the exact command above with config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, exit 0: 7/7 in 869 ms Vitest / 2.66 seconds wall and 132,349,952-byte maximum RSS. Both POSIX and Windows native commands include the source pre-scan purpose suite.
• Focused adjacent command: the exact Vitest prefix above with source-scan, source-tree, cache-entry, cache-population, cache-population-integration, cache-resolution, acquisition, acquisition-integration, and workflow-oracle tests — PASS, exit 0: 9 files, 79 passed and one platform skip; 10.59 seconds Vitest / 12.47 seconds wall and 140,689,408-byte maximum RSS.
• Broad relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts — PASS, exit 0: 41 files passed, three skipped; 538 tests passed and five skipped in 34.97 seconds Vitest / 37.78 seconds wall with 262,488,064-byte maximum RSS. Existing stale-lock diagnostics and the Node 26 module.register() deprecation warning are unchanged.
• Release/workflow command: the same prefix with config/scripts/ssh-relay-runtime-*.test.mjs — PASS, exit 0: 50 files and 280 tests in 29.32 seconds Vitest / 31.23 seconds wall with 190,332,928-byte maximum RSS.
• Static gates: pnpm typecheck, targeted oxlint, and full pnpm lint all pass. Full lint retains only pre-existing warnings and passes 41 reliability gates, the 355-suppression max-lines ratchet, bundled skill guides, 9,837 localization references, locale parity, and zero allowlisted coverage candidates. git diff --check and changed-file oxfmt --check pass.
• Isolation gates: protected ssh-remote-node-resolution.ts and its test have an empty diff. Searches for scanSshRelayRuntimeSourceTree, its module, and its scanned type find no non-test importer in src/main; therefore this package opens no SSH channel or remote resource and changes no product, settings, fallback, tuple, publication, or default path.
• Full-size local command: the exact Vitest prefix with ssh-relay-artifact-cache-entry-full-size.test.ts exits 0 with its one measurement case skipped because no exact native artifact input is present; 1.11 seconds Vitest / 3.23 seconds wall and 132,169,728-byte maximum RSS. This is not full-size proof.
• Residual gate: do not check the Milestone 6 pre-scan item until the committed exact head passes the purpose suite on all six native clients and reports scan latency/RSS over every exact full-size artifact, both Linux supplements, Windows x64 baseline, the declared Windows arm64 build-only outcome, and adjacent PR/Golden/computer-use checks. GitHub runners still do not prove live SSH, SFTP/system-SSH transfer, remote staging/install, or post-scan transfer races. Streaming and every product/mode/fallback/tuple/publication/default path remain absent; legacy remains the sole default.

E-M6-SOURCE-PRESCAN-CI-RED-001 — Linux exposes order-dependent collision classification

• Date/owner/head: 2026-07-15, Codex implementation owner; exact implementation commit 74104b623511164d7c6b6ae3bd2ee25d6734cb53 on draft PR #8741.
• Workflow/job: SSH Relay Runtime Artifacts run 29498296906, native Linux arm64 job 87620486364, Node 24.18.0. The artifact contract step fails after about one minute.
• Exact failure: the real case-sensitive filesystem enumerates added RELAY.JS before signed relay.js; the scan rejects it as SSH relay runtime source has an undeclared entry: RELAY.JS, while the purpose case requires /collision/i. Integrity still fails closed before hashing, transfer, remote staging, or execution; the defect is classification order, not an acceptance or fallback bypass.
• Action: the implementation owner cancelled the remaining already-doomed artifact run after capturing the failure. Make an undeclared spelling whose case fold matches the authenticated set a collision even when its signed peer has not yet been enumerated, and add a platform-neutral enumeration-order test before requesting fresh exact-head proof. No box is checked from this run.

E-M6-SOURCE-PRESCAN-COLLISION-FIX-LOCAL-001 — classification is order-independent locally

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop failed exact-head commit 74104b623 plus the narrow correction diff.
• Correction: when an enumerated spelling is absent from the exact authenticated map but present in its case-folded set, reject it as a collision before any child metadata operation. A new platform-neutral operations-seam case presents RELAY.JS before signed relay.js, requires the collision classification, observes only the root lstat, and proves the directory handle closes. The real Linux filesystem case remains enabled on Linux.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-scan.test.ts — PASS, exit 0: 17 passed and the real-filesystem Linux case skipped locally; 10.65 seconds Vitest / 18.64 seconds wall and 128,745,472-byte maximum RSS.
• Focused adjacent command: the E-M6-SOURCE-PRESCAN-LOCAL-001 nine-file command — PASS, exit 0: 80 passed and one platform skip in 11.14 seconds Vitest. The native-workflow oracle remains included.
• Broad relay command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts — PASS, exit 0: 41 files passed, three skipped; 539 tests passed and five skipped in 33.88 seconds Vitest. Existing stale-lock and Node 26 deprecation diagnostics are unchanged.
• Static gates: pnpm typecheck, targeted oxlint, git diff --check, and full pnpm lint pass; full lint retains only the pre-existing warnings and again passes reliability, max-lines, bundled guide, and localization gates. Protected resolver files remain untouched and no production importer exists.
• Residual gate: local macOS cannot execute the real case-sensitive filesystem case. Commit and push the correction, then require that case plus the full purpose suite on both Linux native jobs and every other native client, and require the complete exact-artifact scan metrics before closing the package. The failed/cancelled run supplies no green cell.

E-M6-SOURCE-PRESCAN-CI-001 — all-six native and exact full-size pre-scan gates pass

• Date/owner/head: 2026-07-15, Codex implementation owner; exact correction commit 724ed6295551a63cd710b4da3749548ac787a0ad on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29498740510. All six primary Node 24.18.0 jobs pass their contract, deterministic-build/smoke, full-size extraction/cache/pre-scan, and evidence-upload steps: win32 x64 87621972614, win32 arm64 87621972692, Darwin x64 87621972687, Darwin arm64 87621972703, Linux x64 87621972727, and Linux arm64 87621972772.
• Purpose suite: both Linux jobs pass all 18 source pre-scan cases, including the real case-sensitive collision; each macOS job passes 17 with the Linux-only case skipped; each Windows job passes 15 with three declared POSIX/Linux-only skips. Overall native contract totals are 707 passed / one skipped on Linux, 706 passed / two skipped on macOS, and 695 passed / 17 skipped on Windows. The suite takes 1.415–7.117 seconds across the six clients.
• Exact full-size metrics, reported by the cache measurement JSON after hashing the complete signed tree while its lease is held:
  • Linux x64: 34 files / 124,846,430 bytes; scan 145.534 ms / 131,072 incremental RSS bytes.
  • Linux arm64: 34 files / 122,865,324 bytes; scan 155.329 ms / 262,144 incremental RSS bytes.
  • Darwin x64: 35 files / 124,316,655 bytes; scan 724.753 ms / 139,264 incremental RSS bytes.
  • Darwin arm64: 35 files / 122,027,869 bytes; scan 161.363 ms / 81,920 incremental RSS bytes.
  • Windows x64: 42 files / 96,527,161 bytes; scan 194.877 ms / 3,239,936 incremental RSS bytes.
  • Windows arm64: 42 files / 85,213,511 bytes; scan 375.761 ms / 2,289,664 incremental RSS bytes. Every cell is below the 120-second and 80-MiB scan budgets; observed ranges are 145.534–724.753 ms and 81,920–3,239,936 incremental RSS bytes. Cold/warm cache, extraction, retention, and eviction also remain within their existing budgets.
• Baselines: Linux x64 supplement 87623008534 and Linux arm64 supplement 87623008618 pass. Windows x64 oldest baseline 87624256480 passes. Windows arm64 oldest baseline 87624256574 has only the declared hosted-image build rejection: observed 26200 versus required 26100. Before that rejection it verifies the complete 60-entry / 42-file / 85,213,511-byte tree, Node 24.18.0 ABI 137, PTY exit 23 and resize 37x101, five watcher events, two-second resource settlement, and smoke 5,898.6823 ms / 49,664,000 RSS; complete verification is 8,024.2681 ms. The workflow is therefore red only by the already-declared runner-floor evidence gap, not the source pre-scan package.
• Adjacent exact-head workflows pass: PR Checks run 29498740486, verify job 87621971980; Golden E2E run 29498740519, Linux job 87621971899 and macOS job 87621971841; computer-use run 29498740483, Windows job 87621971772 and Ubuntu job 87621971790.
• Boundary/residual gaps: GitHub clients prove native filesystem and artifact contracts, not live SSH, SFTP or system-SSH channel behavior, remote staging/install, or post-scan transfer races. The scanned-tree type still has no non-test src/main importer. Bounded client streaming, every remote transport, product/settings/fallback/tuple/publication/default path, and SignPath remain open. Legacy remains the sole production/default path and every tuple remains disabled.

E-M6-SOURCE-STREAM-AUDIT-001 — bounded transport-neutral source read and destination lifecycle

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact boundary: accept only one SshRelayRuntimeScannedSourceTree, its one required caller-owned AbortSignal, a destination factory, a concurrency value from one through four, and an optional synchronous progress observer. The factory receives only the authenticated file descriptor and exact signal and returns a domain-shaped destination with awaited write, close, and abort operations. No raw source path/list/manifest/cache entry or independently replaceable signal is accepted.
• Pre-write sequence: assert the borrowed lease, then for each file recheck the scanned root, every signed parent directory, and file path/type/mode/state. Open the local file read-only with O_NOFOLLOW where supported and require the opened handle to match the exact scanned state. Only after those checks may the destination factory run. This lets later transports create an exclusive staged remote file without doing so for a rejected local source.
• Bounded transfer: use a fixed worker pool of at most four. Each worker owns one reusable 64 KiB buffer and at most one local file handle plus one destination; never materialize a whole file or tree. Await each destination write before reusing its buffer. Hash the exact bytes presented to successful writes and require exact signed size and SHA-256 before completing the file.
• Post-write sequence: after the final chunk, recheck the open handle, close it, and recheck the file, signed parents, and root against the scanned bigint snapshots. Only then close/finalize the destination. A local mutation, replacement, short/long read, digest mismatch, lease loss, or cancellation aborts the destination; it never reports the file complete.
• Lifecycle/error contract: check the exact signal before lease/filesystem/destination operations and every chunk. Await local close and destination abort/close on success, failure, cancellation, and callback failure. Preserve the primary failure and join cleanup failures in AggregateError; the source stream borrows but never releases the cache lease. A caller timeout is expressed only by aborting the same signal; the module creates no hidden timer.
• Progress/result: emit deeply frozen aggregate snapshots only after a destination accepts bytes and after a file finalizes. Include tuple/content IDs, total/completed file counts, total/transferred bytes, and active file count; never include local or signed paths. Return the final frozen proof and do not log. Concurrent updates must be monotonic and exact.
• Required RED/green proof: signed Linux/Windows scanned trees; zero-byte, multi-chunk, and concurrent reads; maximum four handles/destinations and 64 KiB chunks; ordering that forbids destination open before local proof; mutation/symlink/type/mode/state/size/hash rejection before and during read; exact transmitted-byte hash; duplicate/missing destination settlement; pre/mid-read/mid-write cancellation; local/destination open/write/close/abort failures and joined cleanup; monotonic path-free progress; lease ordering/ownership; exact full-size all-six latency/RSS/handle metrics; both native workflow families; and no SSH/product importer.
• Measurement budgets: 20-minute caller-owned transfer ceiling, 80 MiB incremental desktop RSS, four concurrent files/destinations, eight total process handles, and 64 KiB per worker buffer. The exact-artifact harness may use an in-process hashing/discard destination solely to measure client source streaming; it is not SSH or remote-transfer proof.
• Deliberately absent: SSH target/connection/channel/SFTP/child process, remote platform/path/command, framing protocol, remote write/permission/cleanup/staging/install/launch, settings/modes/fallback, Electron/startup, ORCA_RELAY_PATH, tuple enablement, publication, defaults, and SignPath. Later POSIX, Windows, and SFTP packages must adapt this boundary and independently prove their remote resource settlement and full-size live behavior.

E-M6-SOURCE-STREAM-LOCAL-RED-001 — bounded stream and native/full-size proof are absent

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop evidence commit 16a58a234 plus the audit/test-only diff.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-stream.test.ts — EXPECTED FAIL, exit 1: the absent source-stream module prevents collection; zero tests in 1.36 seconds Vitest / 4.00 seconds wall and 135,544,832-byte maximum RSS.
• Full-size command: the same prefix with src/main/ssh/ssh-relay-artifact-cache-entry-full-size.test.ts — EXPECTED FAIL, exit 1: its exact artifact stream measurement cannot import the absent module; zero tests in 1.22 seconds Vitest / 3.84 seconds wall and 131,989,504-byte maximum RSS.
• Workflow-oracle command: the same prefix with config/scripts/ssh-relay-runtime-workflow.test.mjs — EXPECTED FAIL, exit 1: six cases pass and native inclusion fails because the purpose suite occurs only in the oracle, not the POSIX or Windows runner command; 881 ms Vitest / 3.52 seconds wall and 132,841,472-byte maximum RSS.
• Scope at RED: test scaffolding adds signed zero/multi-chunk fixture bytes, destination lifecycle/ mutation/cancellation/progress cases, and full-size measurement expectations only. The protected resolver files have no diff. No source-stream module, SSH/product importer, remote resource/path/ staging, settings/fallback, tuple, publication, or default behavior exists.

E-M6-SOURCE-STREAM-LOCAL-001 — disconnected bounded client source stream is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop evidence commit 16a58a234 plus the uncommitted implementation/checklist diff.
• Implementation/result: ssh-relay-runtime-source-snapshot.ts owns exact root/parent/file/handle snapshot checks and the client-native O_NOFOLLOW open operation; the 298-physical-line stream module owns the one-to-four-worker lifecycle, one reusable 64 KiB buffer per worker, exact written- byte hash/size checks, destination validation/uniqueness, frozen path-free progress, final full- tree/lease proof, and joined cleanup. It accepts only an exact scanned tree, caller signal, concurrency, destination factory, and optional observer. It has no SSH/product/default caller.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-stream.test.ts — PASS, 27/27 in 2.43 seconds Vitest / 3.45 seconds wall, 145,375,232-byte maximum RSS, zero swaps. It proves signed Linux and Windows trees; complete tree/path/handle proof before a destination; zero/multi-chunk/concurrent reads; four-handle/destination and 64 KiB limits; linked/type/mode/state/digest/mutation rejection; incomplete/reused destination rejection; pre/mid-read/mid-write cancellation; local open/read/ close and destination open/write/close/abort failures; joined three-error cleanup; path-free monotonic progress; lease borrowing; immediate peer-stop before slow cleanup; and all-worker settlement before rejection.
• Full-size harness command: the same prefix with src/main/ssh/ssh-relay-artifact-cache-entry-full-size.test.ts — PASS with one expected local skip because no exact native artifact environment was supplied; 404 ms Vitest / 1.40 seconds wall and 132,022,272-byte maximum RSS. The harness now measures streamElapsedMs and streamIncrementalRssBytes, checks the exact final aggregate, and retains the 20-minute/80 MiB budgets; this local skip is not full-size proof.
• Native workflow oracle: the same prefix with config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 7/7 in 295 ms Vitest / 1.38 seconds wall and 132,464,640-byte maximum RSS. Both POSIX and Windows native commands contain the purpose suite, and the shared full-size case executes the stream measurement against each exact artifact.
• Adjacent/broad commands: the ten-file focused source/cache/acquisition/workflow command passes 107 tests with one declared platform skip in 8.26 seconds; src/main/ssh/ssh-relay-*.test.ts passes 566 with five declared platform/full-size skips in 24.06 seconds; and config/scripts/ssh-relay-runtime-*.test.mjs passes 280/280 in 18.92 seconds.
• Static/isolation commands: pnpm typecheck, targeted pnpm exec oxlint ..., pnpm lint, pnpm run check:max-lines-ratchet, targeted pnpm exec oxfmt --check ..., git diff --check, the protected-resolver git diff --exit-code -- ..., and the non-test importer rg gate all pass. Full pnpm exec oxfmt --check . remains red on 31 pre-existing unrelated files; all nine changed files pass the targeted formatter check and none of those baseline files is modified.
• Hardening note: the first four-case hostile-metadata oracle used object spread on Node Stats, which dropped prototype methods and correctly failed four tests plus typecheck; the fixture was corrected to preserve the prototype. No production relaxation was made. The corrected suite then passed 24 cases before the final local-open, digest, and concurrent-settlement cases raised it to 27.
• Residual gaps: exact-head all-six full-size latency/RSS/handle evidence and adjacent Actions jobs remain required before this package is checked. The hashing/discard destination is client-only measurement, not SFTP/system-SSH or remote proof. Remote channels, paths, staging/install, product/Beta/fallback/tuple/publication/default wiring, and SignPath remain absent.

E-M6-SOURCE-STREAM-CI-RED-001 — Windows exposes a POSIX-only mode-test oracle

• Date/owner/source: 2026-07-15, Codex implementation owner; exact commit 59997b1383ef51d390d811b17e235917b51e4a69, artifact run 29501986883, Windows x64 job 87632962424.
• Result: expected CI RED in the newly added cross-platform purpose suite. Windows x64 reached the rejects wrong mode source metadata before destination creation case and failed its /changed|mode/i assertion because Windows deliberately does not compare POSIX mode bits. The test then reached the mock factory, whose undefined result was correctly rejected as SSH relay runtime source stream destination is incomplete. The contract step failed after 31 seconds and the job after 1 minute 42 seconds; artifact download/build/full-size measurement did not run.
• Cross-run observation: Linux x64, Linux arm64, Darwin arm64, and Darwin x64 purpose commands passed before cancellation. Darwin arm64 also completed its build/full-size measurement, but this superseded run is not closure evidence. Windows arm64 had not reached the purpose command.
• Classification/correction: production snapshot behavior is correct and unchanged: POSIX compares signed mode, while Windows relies on type and identity/state. Make only the wrong-mode oracle skipIf(process.platform === 'win32'); linked/type/state/digest/mutation checks remain mandatory on Windows. The run was cancelled after evidence capture to conserve native runner time.
• Safety/residual: the failure occurred in disconnected tests with no SSH/product importer, remote resource, publication, tuple, setting, fallback, or default behavior. Fresh exact-head all-six purpose/full-size and adjacent evidence is required; no cell is credited from this run.

E-M6-SOURCE-STREAM-WINDOWS-ORACLE-CORRECTION-LOCAL-001 — POSIX mode case is locally corrected

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop exact implementation commit 59997b138 plus the test/checklist correction diff.
• Correction: remove only wrong mode from the cross-platform hostile-metadata table and add the same assertion as skipIf(process.platform === 'win32'). POSIX still requires signed mode before destination creation. Windows still requires linked/type/state/digest/mutation rejection and now declares exactly one purpose-case skip. No production source changed.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-source-stream.test.ts — PASS, 27/27 in 2.61 seconds Vitest / 3.80 seconds wall, 141,737,984-byte maximum RSS, zero swaps.
• Adjacent/broad commands: the ten-file focused source/cache/acquisition/workflow command passes 107 tests with one declared platform skip in 8.29 seconds; src/main/ssh/ssh-relay-*.test.ts passes 566 with five declared platform/full-size skips in 25.38 seconds; and config/scripts/ssh-relay-runtime-*.test.mjs passes 280/280 in 17.13 seconds.
• Static/isolation commands: pnpm typecheck, targeted pnpm exec oxlint, pnpm lint, pnpm run check:max-lines-ratchet, targeted pnpm exec oxfmt --check, git diff --check, the protected-resolver diff gate, and the non-test importer rg gate pass. Existing unrelated lint warnings remain warnings; no max-lines bypass was added.
• Residual: a native Windows runner must prove 26 passes plus exactly the one POSIX-mode skip. Fresh all-six full-size metrics and adjacent Actions remain mandatory; no evidence cell is closed by local macOS proof.

E-M6-SOURCE-STREAM-ADJACENT-CI-RED-001 — unrelated Windows launcher timeouts require rerun

• Date/owner/source: 2026-07-15, Codex implementation owner; exact commit df39c287d63ae5f2cc8a3f4e2023558d8c4fefe3, computer-use run 29502462430, first-attempt Windows job 87634610647.
• Result: the broad computer-use job's initial Windows attempt failed because the pre-existing config/scripts/build-windows-cli-launcher.test.mjs:29 and src/main/ssh/ssh-remote-cli-launcher.test.ts:55 cases each exceeded their unchanged five-second timeout. Neither file imports the new source-tree, pre-scan, or source-stream modules. The exact source-stream Windows contract job separately passed its 26 applicable cases with one declared POSIX-mode skip and completed its exact full-size proof.
• Disposition: do not raise timeouts and do not credit the adjacent workflow from this attempt. Rerun only the failed Windows job on the same SHA; a repeat would require independent diagnosis before accepting the source-stream checkpoint.

E-M6-SOURCE-STREAM-CI-001 — all-six native and exact full-size source streaming passes

• Date/owner/head: 2026-07-15, Codex implementation owner; exact correction commit df39c287d63ae5f2cc8a3f4e2023558d8c4fefe3 on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29502462515. All six primary Node 24.18.0 jobs pass the contract, deterministic-build/smoke, exact full-size extraction/cache/scan/ stream, and evidence-upload steps: Darwin arm64 87634610869, Windows x64 87634610874, Windows arm64 87634610969, Linux arm64 87634610973, Linux x64 87634611056, and Darwin x64 87634611171.
• Runner identities: Darwin arm64 uses macos-15 / macos15 image 20260706.0213.1; Darwin x64 uses macos-15-intel / macos15 image 20260715.0340.1; Linux arm64 uses ubuntu-24.04-arm / ubuntu24-arm64 image 20260714.61.1; Linux x64 uses ubuntu-24.04 / ubuntu24 image 20260705.232.1; Windows arm64 uses windows-11-arm / win11-arm64 image 20260706.102.1; Windows x64 uses windows-2022 / win22 image 20260714.244.1. Every job reports github-hosted, its matching native architecture, and the exact source SHA above.
• Purpose results: every POSIX client passes all 27 cases; each Windows client passes 26 with only the declared POSIX-mode case skipped. Suite times are 2.077 seconds Darwin arm64, 5.956 seconds Darwin x64, 3.703 seconds Linux arm64, 2.412 seconds Linux x64, 13.744 seconds Windows x64, and 9.814 seconds Windows arm64. Overall native contract totals are 733 passed / two skipped on each Darwin client, 734 passed / one skipped on each Linux client, and 721 passed / 18 skipped on each Windows client.
• Exact full-size stream metrics, after complete-tree pre-scan and while the verified cache lease is held:
  • Linux x64: 34 files / 124,846,430 bytes; stream 177.507 ms / 131,072 incremental RSS bytes.
  • Linux arm64: 34 files / 122,865,324 bytes; stream 147.701 ms / 393,216 incremental RSS bytes.
  • Darwin x64: 35 files / 124,316,655 bytes; stream 530.937 ms / 266,240 incremental RSS bytes.
  • Darwin arm64: 35 files / 122,027,869 bytes; stream 103.663 ms / 163,840 incremental RSS bytes.
  • Windows x64: 42 files / 96,527,161 bytes; stream 180.443 ms / 5,492,736 incremental RSS bytes.
  • Windows arm64: 42 files / 85,213,511 bytes; stream 353.213 ms / zero incremental RSS bytes. Every cell is below the 120-second and 80-MiB stream budgets; observed ranges are 103.663–530.937 ms and 0–5,492,736 incremental RSS bytes. The source-stream contract separately proves one reusable 64-KiB buffer per one-to-four workers, exact file/destination counts, and joined local-handle/destination settlement on success, failure, and cancellation.
• Baselines: Linux arm64 supplement 87635652453 and Linux x64 supplement 87635652461 pass. Windows x64 oldest baseline 87637747935 passes. Windows arm64 oldest baseline 87637747923 retains only the declared hosted-image floor rejection: observed build 26200 versus required 26100. Before that rejection it verifies the 60-entry / 42-file / 85,213,511-byte tree, Node/PTY/watcher smoke, two-second resource settlement, and 5,768.3331-ms smoke at 48,476,160 RSS; complete verification is 7,684.2782 ms. The aggregate workflow is therefore red only by the known runner-floor evidence gap, not the source-stream package.
• Adjacent exact-head evidence: PR Checks run 29502462631, verify job 87634610912, and Golden E2E run 29502462423, Linux job 87634610095 and macOS job 87634610096, pass. Computer-use run 29502462430 passes after the evidence-gated same-SHA failed-job rerun: Windows job 87639449051 passes the previously timed-out tests plus packaged build/daemon/E2E; Ubuntu job 87639450403 passes.
• Boundary/residual gaps: this hashes into a client-only discard destination; it creates no SSH connection, SFTP session, system-SSH channel, remote path, staging/install state, mode repair, or remote cleanup. It is not live transfer or remote proof. Every transport adapter, remote hash/ install/launch step, product/Beta/fallback/tuple/publication/default path, and SignPath remain open. Legacy remains the sole production/default path and every tuple remains disabled.

E-M6-SFTP-FILE-DESTINATION-AUDIT-001 — exclusive bounded SFTP file lifecycle boundary

• Date/owner: 2026-07-15, Codex implementation owner.
• Exact input boundary: accept only a caller-owned SFTP file primitive set, one already validated exact remote staging-file path, the signed 0o644 or 0o755 mode, an explicit POSIX-mode flag, and the same required caller-owned AbortSignal used by the source streamer. Do not derive any remote path from a client-native local path and do not acquire or end the SFTP session here.
• Open/write contract: check cancellation before open; use only exclusive wx open; once the handle exists this adapter owns that new file. Each write(chunk) issues exactly one positional SFTP write and resolves only from its callback, making that callback the source stream's reusable 64-KiB buffer-lifetime boundary. Writes are sequential, offsets are exact, empty/concurrent/late writes are rejected, and no chunk/tree concatenation or base64 representation exists.
• Completion contract: for POSIX remotes, apply the signed mode through the owned handle, re-read handle attributes, and require the exact permission bits before closing. Windows/non-POSIX remotes skip POSIX mode operations explicitly. A close is successful only after the remote handle callback settles and a final signal check passes.
• Failure/cancellation contract: an open failure never unlinks because no ownership was obtained. Any later write, mode, verification, close, or cancellation failure leaves the destination abortable; abort attempts owned-handle close before unlink, joins cleanup failures, and is idempotent. Cancellation during an in-flight SFTP callback remains joined until that callback is forced to settle by the later session owner, preventing reuse of a possibly retained source buffer.
• Required purpose RED: missing destination module; exclusive open and exact offsets; deferred callback/buffer lifetime; pre-open and post-open cancellation; write/mode/stat/close failures; POSIX exact-mode verification; explicit Windows mode skip; no deletion on failed exclusive open; close-before-unlink order; joined/idempotent cleanup; illegal concurrent/empty/late operations; and path-free adapter-authored diagnostics. Add the suite exactly once to both native artifact command families before implementation.
• Explicit residual boundary: this is a per-file primitive, not an SFTP transfer. SFTP session acquisition/end/error ownership, bounded tree concurrency, remote directory creation, remote-path policy, session-wide timeout/cancellation, full-staging cleanup, real server behavior, full-size transfer, mode behavior across servers, and later remote tree verification/install/publish/launch all remain open. No production importer, setting, fallback, tuple, release, or default path may be added by this package; legacy remains the sole production path.

E-M6-SFTP-FILE-DESTINATION-LOCAL-RED-001 — destination lifecycle is absent

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop exact checkpoint commit 705bca2db plus the purpose/workflow/checklist RED diff.
• Purpose command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-file-destination.test.ts — expected RED, exit 1: one failed suite, zero collected tests, because ./ssh-relay-runtime-sftp-file-destination does not exist. The 260-line source contract declares 12 cases including two parameterized failure cells.
• Native workflow oracle: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 7/7 in 356 ms. The workflow source and oracle already require the purpose suite exactly once in both POSIX and PowerShell native command families, so implementation cannot become locally green while native coverage remains omitted.
• Static precondition: git diff --check passes and the test remains below the max-lines ratchet at 260 lines. Protected resolver files remain untouched. No production importer, SFTP session owner, remote directory/tree orchestrator, product caller, setting, fallback, tuple, publication, or default behavior exists in the RED diff.

E-M6-SFTP-FILE-DESTINATION-LOCAL-001 — per-file SFTP lifecycle is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop exact checkpoint commit 705bca2db plus the implementation/checklist diff.
• Implementation: the 210-line ssh-relay-runtime-sftp-file-destination.ts accepts only the audited primitive boundary. It opens with wx and signed mode, awaits one SFTP positional-write callback per source chunk before advancing the exact offset, checks the same signal around every callback, repairs and verifies POSIX permission bits before close, and skips those operations only from the explicit non-POSIX flag. Adapter-authored state/input errors contain no remote path.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-file-destination.test.ts — PASS, 13/13 in 431 ms Vitest / 2.36 seconds wall, 133,005,312-byte maximum RSS, zero swaps. The additional hardening case proves cancellation during a pending write cannot settle or begin cleanup until the SFTP callback releases the borrowed source buffer; it then closes before unlinking.
• Focused command: the destination, source stream/scan/tree, acquisition/cache population and resolution, integration, and workflow-oracle ten-file command — PASS, 103 tests with one declared platform skip in 8.28 seconds.
• Broad commands: src/main/ssh/ssh-relay-*.test.ts — PASS, 579 tests with five declared platform/ full-size skips in 27.25 seconds; config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 280/280 in 20.82 seconds. The first quoted-glob invocations matched no files and were discarded as command syntax mistakes; the unquoted exact checklist commands above are the credited results.
• Static/isolation commands: pnpm typecheck, targeted pnpm exec oxlint, pnpm lint, targeted pnpm exec oxfmt --check, pnpm run check:max-lines-ratchet, git diff --check, the protected- resolver diff gate, and the no-non-test-importer rg gate pass. Full lint includes switch exhaustiveness, styled-scrollbar, 41 reliability, bundled-skill, max-lines, and localization gates; only pre-existing unrelated warnings remain. The module/test are 210/289 lines with no bypass.
• Residual: this is callback-contract proof with mocked primitives, not a live SFTP server, session, SSH connection, remote directory/staging tree, bounded multi-file transfer, session-wide abort/ timeout, whole-tree cleanup, or full-size remote measurement. It has no non-test importer. Exact- head all-six Node 24 and adjacent Actions evidence is required before auditing the session/tree adapter. Product/Beta/fallback/tuple/publication/default behavior and SignPath remain absent; legacy remains the sole production path.

E-M6-SFTP-FILE-DESTINATION-CI-001 — all-six native clients accept the per-file SFTP lifecycle

• Date/owner/head: 2026-07-15, Codex implementation owner; exact implementation commit 72d482201e99975bb0133d1934906a95d2033934 on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29505153131. All six primary Node 24.18.0 jobs pass contract, deterministic-build/smoke, full-size extraction/cache/scan/stream, and evidence upload: Linux x64 87643900797, Darwin arm64 87643900822, Linux arm64 87643900825, Windows x64 87643900844, Windows arm64 87643900854, and Darwin x64 87643900952.
• Purpose/native totals: every client passes all 13 SFTP destination cases in 19–30 ms. Overall contract totals are 747 passed / one skipped on each Linux client, 746 passed / two skipped on each Darwin client, and 734 passed / 18 skipped on each Windows client. The skips are all prior declared platform cases; the new suite has none.
• Regression-sensitive exact full-size metrics remain green even though this disconnected adapter is not yet the measurement destination: Linux x64 34 files / 124,846,430 bytes, stream 180.352 ms / 524,288 incremental RSS bytes; Linux arm64 34 / 122,865,324, 142.092 ms / 262,144; Darwin x64 35 / 124,316,655, 566.028 ms / 307,200; Darwin arm64 35 / 122,027,869, 130.193 ms / 557,056; Windows x64 42 / 96,527,161, 133.884 ms / 5,402,624; Windows arm64 42 / 85,213,511, 377.815 ms / 1,146,880. Every existing stream/cold/warm/scan/retention/eviction budget passes.
• Baselines: Linux arm64 supplement 87644986864, Linux x64 supplement 87644987167, and Windows x64 floor 87646436484 pass. Windows arm64 floor 87646436470 retains only the declared hosted-image rejection: build 26200 observed versus 26100 required. Before that rejection it verifies the complete runtime tree and Node/PTY/watcher/resource smoke in 6,000.5466 ms at 49,496,064 RSS; complete verification is 8,121.8794 ms.
• Adjacent exact-head workflows pass: PR Checks run 29505152898, verify job 87643863526; Golden E2E run 29505152891, macOS job 87643863170 and Linux job 87643863283; computer-use run 29505152766, Ubuntu job 87643862898 and Windows job 87643862909.
• Boundary/residual gaps: the purpose suite uses callback mocks and creates no SSH/SFTP channel or remote file. SFTP session acquisition/end/error ownership, remote path/directory policy, bounded tree concurrency, session-wide timeout/cancellation, whole-staging cleanup, live server/full-size transfer, and POSIX/Windows server-mode behavior remain unproved. The adapter still has no non- test importer. Remote verification/install/launch, product/Beta/fallback/tuple/publication/default behavior, and SignPath remain absent; legacy remains the sole production path.

E-M6-SFTP-TREE-TRANSFER-AUDIT-001 — disconnected bounded SFTP staging-tree orchestration

• Date/owner/base: 2026-07-15, Codex implementation owner; exact clean base c03b8c988 after E-M6-SFTP-FILE-DESTINATION-CI-001 closure.
• Exact input boundary: accept one scanned and lease-backed source tree, one already validated absolute remote staging-root string, the same required caller-owned AbortSignal, an explicit one-to-four maximum concurrency already reduced to one by a later host-scoped MaxSessions=1 decision, an explicit POSIX-mode flag, and an openSession(signal) factory. The factory returns only callback-shaped SFTP file/directory primitives plus an idempotent awaited close(reason) operation. Its later raw-ssh2 adapter must bound channel open and prove that close forces every retained operation callback to settle before resolving.
• Ownership/path contract: exclusively create the staging root with mode 0o700; a failed root create owns nothing and must never remove a pre-existing path. Create every signed directory in parent-before-child order with its declared 0o755 mode before opening a file. Construct remote children only from the validated staging root and slash-delimited signed manifest segments, using remote-path checks rather than client-native path utilities. Do not list, traverse, or delete unknown remote content.
• Stream/lifecycle contract: compose streamSshRelayRuntimeSourceTree with openSshRelayRuntimeSftpFileDestination and the exact shared signal. Allow one through four file handles on one SFTP session; preserve the source stream's callback-bounded 64 KiB buffer lifetime, exact per-file exclusive open, offsets, hash, progress, POSIX mode proof, and explicit Windows mode skip. Return only after the exact source result and successful awaited session close.
• Failure/cancellation contract: track only directories successfully created below the exclusively owned root and files whose exclusive open succeeded. On ordinary failure, attempt file unlink and then directory removal in reverse order, treating only SFTP no-such-file status 2 as already clean. Preserve the primary failure and join cleanup/session-close failures. On signal abort, start idempotent session close immediately so a stalled open/write/mode/cleanup callback cannot retain a source buffer forever; still await the source task and close promise. No operation may begin after cancellation, and the package creates no hidden timeout.
• Required purpose RED/green: pre-open cancellation; bounded/cancellable session open boundary; exclusive root collision without deletion; parent-first manifest directory modes; POSIX and Windows remote-path construction; exact one/four file concurrency; source progress/result passthrough; session close after success; reverse known-tree cleanup after directory/open/write/ mode/source failures; no-such-file cleanup tolerance; joined cleanup and close failures; cancellation that closes the session, settles a retained callback, awaits all work, and causes no later writes; path-free orchestrator-authored diagnostics; and exact suite inclusion once in both native workflow families before implementation.
• Explicit residual boundary: this package stops at a mockable session abstraction. A production importer, raw SFTPWrapper adapter, live SSH authentication/channel/server proof, full-size remote transfer and high-latency comparison, server mode behavior, MaxSessions=1 capability wiring, remote bundled-Node tree verification/install/publish/launch, product Beta/settings/fallback/ tuple/publication/default behavior, and SignPath remain absent. Legacy remains the sole production/default path.

E-M6-SFTP-TREE-TRANSFER-LOCAL-RED-001 — audited SFTP tree orchestrator is absent

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop clean evidence base c03b8c988 plus the audit/test/workflow-only diff.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-tree-transfer.test.ts — EXPECTED FAIL, exit 1: one failed suite and zero collected tests because ./ssh-relay-runtime-sftp-tree-transfer is absent; 530 ms Vitest / 1.82 seconds wall and 133,808,128-byte maximum RSS.
• Workflow-oracle command: the same prefix with config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 7/7 in 302 ms Vitest / 1.26 seconds wall and 132,939,776-byte maximum RSS. The new purpose suite occurs exactly once in both the POSIX and Windows native commands before implementation.
• RED scope: the test scaffold covers exclusive root/directory ordering, POSIX and Windows paths, one/four concurrency, exact result/progress, awaited close, collision ownership, reverse cleanup, joined path-free failures, callback-retaining cancellation, and pre-open cancellation. The protected resolver files remain untouched. No implementation, raw SFTP adapter, live SSH, product importer, settings/fallback/tuple/publication/default behavior, or SignPath work exists.

E-M6-SFTP-TREE-TRANSFER-LOCAL-001 — disconnected bounded SFTP staging tree is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop clean evidence base c03b8c988 plus this isolated implementation/checklist diff. Exact Node 24 remains the required native CI gate.
• Implementation: the 250-line ssh-relay-runtime-sftp-tree-transfer.ts accepts only the audited scanned tree, validated staging root, exact signal/mode policy/concurrency, progress observer, and mockable session factory. It rejects non-absolute roots before session acquisition, creates the root exclusively at 0o700, creates signed directories parent-first, constructs slash-safe POSIX/Windows remote paths, composes the proven source stream and per-file destination at one-to-four concurrency, tracks only successful exclusive opens, reverse-cleans known owned files/directories, tolerates only status-2 already-clean responses, joins failures, and awaits one idempotent session close. Signal abort starts close immediately so the future raw adapter can release retained callbacks and source buffers.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-tree-transfer.test.ts — PASS after absolute-root hardening, 9/9 in 1.97 seconds tests / 2.81 seconds Vitest / 5.05 seconds wall, 139,231,232-byte maximum RSS, zero swaps. It covers POSIX and Windows path/mode policy, exact result/progress, parent-before-file order, four-file peak concurrency, awaited successful close, root collision without deletion, reverse cleanup, joined path-free cleanup/close failures, cancellation-driven retained-write settlement with no later writes, and pre-open cancellation, and relative-root rejection before session acquisition.
• Focused command: the source tree/scan/stream, per-file destination, new tree transfer, acquisition/cache resolution/population/integration, and workflow-oracle eleven-file command — PASS after hardening, 112 passed / one declared platform skip in 9.97 seconds Vitest. The earlier timed 111-case run was 8.01 seconds Vitest / 9.09 seconds wall at 160,235,520-byte maximum RSS.
• Broad commands: src/main/ssh/ssh-relay-*.test.ts — PASS, 44 files passed / three declared skipped, 588 tests passed / five declared platform/full-size skips in 25.57 seconds Vitest after hardening; the earlier timed 587-case run was 25.86 seconds Vitest / 27.44 seconds wall at 251,985,920-byte maximum RSS. config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 17.10 seconds Vitest / 18.66 seconds wall, 190,300,160-byte maximum RSS. The only broad output is the established stale-lock diagnostic and local Node 26 module deprecation.
• Static/isolation commands: pnpm typecheck passes in 3.86 seconds wall at 1,224,179,712-byte maximum RSS. Targeted oxlint and oxfmt --check, pnpm lint, standalone max-lines ratchet, git diff --check, protected-resolver empty diff, and no non-test importer pass. Full lint takes 18.28 seconds at 2,102,476,800-byte maximum RSS and passes switch exhaustiveness, 41 reliability gates, 355-entry max-lines ratchet, bundled-skill verification, 9,837 localization references, locale parity, and zero-candidate localization coverage; only pre-existing unrelated warnings remain. Module/test sizes after hardening are 251/391 lines with no bypass or vague module.
• Boundary/residual gaps: the session is a callback mock whose close() is stipulated to settle retained callbacks. This is not a raw SFTPWrapper adapter, live SSH authentication/channel/SFTP server, full-size remote transfer, high-latency comparison, real POSIX/Windows server mode proof, or MaxSessions=1 wiring. Remote bundled-Node verification/install/publish/launch and every product/Beta/settings/fallback/tuple/publication/default path remain absent; legacy remains the sole production/default path and SignPath remains deferred. Exact-head all-six Node 24 and adjacent CI evidence is required before the raw-session adapter audit.

E-M6-SFTP-TREE-TRANSFER-CI-001 — all-six clients accept disconnected SFTP tree orchestration

• Date/owner/head: 2026-07-15, Codex implementation owner; exact hardened implementation commit 28e7a6e5f92be98514dbd3a62bc9d5aae9331888 on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29507821804. All six primary Node 24.18.0 jobs pass the nine-case tree suite, complete contract set, deterministic build/smoke, full-size extraction/cache/scan/stream, and evidence upload: Windows arm64 87653187734, Darwin arm64 87653187777, Linux arm64 87653187857, Windows x64 87653187877, Darwin x64 87653187906, and Linux x64 87653187933.
• Purpose/native totals: every client passes all nine new cases with no suite skip: Linux x64 1,196 ms, Linux arm64 2,155 ms, Darwin x64 3,646 ms, Darwin arm64 1,186 ms, Windows x64 2,799 ms, and Windows arm64 4,981 ms. Overall contract totals are 756 passed / one declared skip on each Linux client, 755 passed / two declared skips on each Darwin client, and 743 passed / 18 declared skips on each Windows client.
• Exact full-size client baselines remain green: Linux x64 34 files / 124,846,430 bytes, stream 183.762342 ms / 786,432 incremental RSS bytes; Linux arm64 34 / 122,865,324, 142.800937 ms / 131,072; Darwin x64 35 / 124,316,655, 548.450994 ms / 282,624; Darwin arm64 35 / 122,027,869, 115.096708 ms / 688,128; Windows x64 42 / 96,527,161, 182.7795 ms / 5,341,184; Windows arm64 42 / 85,213,511, 360.4851 ms / 1,482,752. Every existing cold/warm/ scan/stream/retention/eviction budget passes. These are client-source regression baselines, not live SFTP network measurements.
• Baselines: Linux arm64 supplement 87654529646, Linux x64 supplement 87654529663, and Windows x64 floor 87655923525 pass. Windows x64 verifies 42 files / 96,527,161 bytes, Node/PTY/watcher/two-second settlement in 5,400.4459 ms at 50,401,280 RSS, and completes verification in 6,610.5719 ms on build 20348. Windows arm64 floor 87655923544 retains only the declared hosted-image rejection: build 26200 observed versus 26100 required. Before that rejection it verifies 42 files / 85,213,511 bytes and Node/PTY/watcher/two-second settlement in 6,860.7918 ms at 48,672,768 RSS; complete verification is 9,414.1715 ms.
• Adjacent exact-head workflows pass: PR Checks run 29507822115, verify job 87653099635; Golden E2E run 29507828242, macOS job 87653119889 and Linux job 87653119935; computer-use run 29507829190, Ubuntu native-smoke job 87653123437 and Windows native-smoke job 87653123462.
• Boundary/residual gaps: native clients run callback mocks, not a raw SFTPWrapper or server. They do not prove SFTP channel open/end/error behavior, that raw session termination settles retained callbacks, real remote directory/mode semantics, full-size network memory/cancellation, high-RTT one-versus-four behavior, MaxSessions=1 wiring, or a live remote matrix cell. The module still has no non-test importer. Remote bundled-Node verification/install/publish/launch and every product/Beta/settings/fallback/tuple/publication/default path remain absent; legacy remains the sole production/default path and SignPath remains deferred.

E-M6-SFTP-SESSION-ADAPTER-AUDIT-001 — raw ssh2 channel acquisition and callback settlement

• Date/owner/base: 2026-07-15, Codex implementation owner; exact clean evidence base d82a8abb1 after E-M6-SFTP-TREE-TRANSFER-CI-001 closure.
• Dependency evidence: audited installed ssh2 1.17.0. SFTP.end() delegates to destroy() and sends channel close. onCHANNEL_CLOSE invokes the SFTP channel's push(null); SFTP push(null) runs cleanupRequests, invoking every pending request callback with an error, before emitting end; only afterward does the channel emit close. Therefore the public raw close event is the minimum safe normal-close boundary for retained callback/source-buffer release and session-slot settlement. Do not call or depend on private _requests or synthesize stream events.
• Acquisition boundary: extend SshConnection.sftp with an optional AbortSignal only, preserving all existing no-argument behavior. Pass it through the existing session-limit retry and bounded callback-open lifecycle so pre-open abort performs no channel request, abort during open awaits a late channel's close up to the established five-second grace, and timeout still ends a late SFTP channel. No authentication, connection selection, retry classification, or transport default changes.
• Adapter input/output: accept the same required caller-owned signal, an openRawSession(signal) factory, and a required forceCloseConnection(reason) hook. Return the exact tree-session shape with explicitly bound raw mkdir, rmdir, open, write, fchmod, fstat, close, and unlink callbacks. Do not spread unbound ssh2 methods, copy/source-buffer chunks, expose remote paths in adapter-authored diagnostics, or acquire any second channel.
• Close/error contract: install a raw error listener before exposing operations. Session close is idempotent, calls raw end() once, and resolves only after raw close, which is the audited point after pending callback cleanup. If close is absent for five seconds, invoke the caller-owned force-close hook and still require the raw close event before settlement. Preserve raw/end/force failures and replace the listener with a late-error sink only after close. Reject operations that begin after closing without invoking raw methods.
• Required purpose RED/green: exact signal forwarding; bound-operation receiver/argument/callback fidelity; normal end-to-close ordering; a retained write callback settles before session close; idempotent concurrent close; raw error joined after close; synchronous end failure; five-second force-close escalation that still awaits raw close; failed force close; post-open cancellation; pre-open cancellation through SshConnection.sftp; mid-open abort with late session end/close; no later raw operations; path-free adapter diagnostics; and suite inclusion exactly once in both native workflow families before implementation.
• Explicit residual boundary: the force-close hook remains caller-provided and has no product implementation in this package. Live OpenSSH server behavior, real connection-force-close and reconnect effects, full-size network transfer, high-RTT concurrency, MaxSessions=1, tree importer, bundled-Node verification/install/publish/launch, and every product/Beta/settings/ fallback/tuple/publication/default path remain absent. Legacy remains the sole production/default path and SignPath remains deferred.

E-M6-SFTP-SESSION-ADAPTER-LOCAL-RED-001 — audited raw ssh2 adapter is absent

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop exact evidence base d82a8abb1 plus the audit/test/workflow-only diff.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-session.test.ts — EXPECTED FAIL, exit 1: one failed suite and zero collected tests because ./ssh-relay-runtime-sftp-session is absent; 234 ms Vitest / 1.44 seconds wall and 131,432,448-byte maximum RSS.
• Workflow-oracle command: the same prefix with config/scripts/ssh-relay-runtime-workflow.test.mjs — PASS, 7/7 in 289 ms Vitest / 1.21 seconds wall and 132,595,712-byte maximum RSS. The purpose suite occurs exactly once in both native command families before implementation.
• RED scope: the adapter scaffold covers signal forwarding, bound receiver/callback fidelity, retained callback before close, idempotent close, raw error ordering, five-second force-close escalation/failure, post-open cancellation, late-operation rejection, and path-free diagnostics. Two connection lifecycle cases cover pre-open and mid-open SFTP cancellation. The protected resolver files remain untouched. No adapter implementation, tree importer, live SSH, product/ settings/fallback/tuple/publication/default behavior, or SignPath work exists.

E-M6-SFTP-SESSION-ADAPTER-LOCAL-001 — disconnected raw ssh2 session lifecycle is locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop exact evidence base d82a8abb1 plus this isolated implementation/checklist diff. Exact Node 24 remains the native CI gate.
• Implementation: the 208-line ssh-relay-runtime-sftp-session.ts accepts only the exact signal, raw opener, and required connection-force-close hook. It attaches error/close listeners before exposing a deeply frozen session, binds all eight operations to the raw receiver, preserves raw callbacks as source-buffer boundaries, rejects late operations, calls raw end() exactly once, waits for audited raw close, escalates after five seconds, still requires raw close after a successful force hook, and joins raw/end/force failures with path-free adapter diagnostics. The optional signal added to SshConnection.sftp flows through its existing retry/open/late-close lifecycle; every existing no-argument caller is unchanged.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-session.test.ts — PASS, 9/9 in 240 ms Vitest / 1.46 seconds wall, 132,349,952-byte maximum RSS, zero swaps. Cases cover exact signal and bound receiver fidelity, retained callback before close, concurrent idempotent close, raw-error order, five-second escalation that still awaits raw close, synchronous raw-end and force-hook failures, post-open cancellation cleanup, late-operation rejection, and path-free diagnostics.
• Connection lifecycle command: the purpose suite plus ssh-connection.test.ts — PASS, 70/70 in 1.19 seconds Vitest / 2.18 seconds wall, 144,179,200-byte maximum RSS. The two new connection cases prove pre-open abort creates no SFTP request and mid-open abort ends a late session but does not settle until its close event frees the session slot.
• Focused command: connection, source tree/scan/stream, per-file destination, raw session, tree transfer, acquisition/cache resolution/population/integration, and workflow-oracle thirteen-file command — PASS, 182 passed / one declared platform skip in 9.05 seconds Vitest / 10.12 seconds wall, 167,854,080-byte maximum RSS, zero swaps.
• Broad commands: src/main/ssh/ssh-relay-*.test.ts — PASS, 45 files passed / three declared skipped, 597 tests passed / five declared platform/full-size skips in 24.42 seconds Vitest / 25.82 seconds wall, 249,495,552-byte maximum RSS; config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 280 tests in 17.40 seconds Vitest / 18.76 seconds wall, 195,608,576-byte maximum RSS. Only the established stale-lock diagnostic and local Node 26 module deprecation appear.
• Static/isolation commands: pnpm typecheck, targeted oxlint, targeted oxfmt --check, full pnpm lint, standalone max-lines ratchet, git diff --check, protected-resolver empty diff, and no non-test importer pass. Full lint takes 19.75 seconds at 2,089,172,992-byte maximum RSS and passes switch exhaustiveness, 41 reliability gates, 355-entry max-lines ratchet, bundled-skill verification, 9,837 localization references, locale parity, and zero-candidate coverage; only pre-existing warnings remain. Module/test sizes are 208/263 lines with no bypass or vague module.
• Boundary/residual gaps: the raw object and force-close hook are mocked. This does not prove live OpenSSH/SFTP channel behavior, a real connection-force-close implementation, reconnect effects, full-size network memory/cancellation, server filesystem/modes, high-RTT concurrency, MaxSessions=1, or raw adapter/tree composition. The adapter has no non-test importer. Remote bundled-Node verification/install/publish/launch and every product/Beta/settings/fallback/tuple/ publication/default path remain absent; legacy remains the sole production/default path and SignPath remains deferred. Exact-head all-six native and adjacent CI is required next.

E-M6-SFTP-SESSION-ADAPTER-CI-001 — all-six clients accept raw-session lifecycle contracts

• Date/owner/head: 2026-07-15, Codex implementation owner; exact implementation commit fbec34cf128c3800738d48264ab8b471148b7d57 on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29510291373. All six primary Node 24.18.0 jobs pass the nine-case raw-session suite, complete contract set, deterministic build/ smoke, full-size extraction/cache/scan/stream, and evidence upload: Linux x64 87661707668, Darwin arm64 87661707691, Darwin x64 87661707695, Windows arm64 87661707709, Linux arm64 87661707745, and Windows x64 87661707769.
• Purpose/native totals: every client passes all nine new cases with no suite skip: Linux x64 20 ms, Linux arm64 15 ms, Darwin x64 26 ms, Darwin arm64 9 ms, Windows x64 26 ms, and Windows arm64 18 ms. Overall totals are 765 passed / one declared skip on each Linux client, 764 passed / two declared skips on each Darwin client, and 752 passed / 18 declared skips on each Windows client.
• Exact full-size client baselines remain green: Linux x64 34 files / 124,846,430 bytes, stream 186.439686 ms / 262,144 incremental RSS bytes; Linux arm64 34 / 122,865,324, 139.640399 ms / 655,360; Darwin x64 35 / 124,316,655, 463.918131 ms / 294,912; Darwin arm64 35 / 122,027,869, 150.561458 ms / 98,304; Windows x64 42 / 96,527,161, 188.4208 ms / 4,845,568; Windows arm64 42 / 85,213,511, 357.8897 ms / 1,687,552. Every existing cold/warm/ scan/stream/retention/eviction budget passes. These remain client-source regression baselines, not live SFTP network measurements.
• Baselines: Linux arm64 supplement 87662625445, Linux x64 supplement 87662625495, and Windows x64 floor 87664691249 pass. Windows x64 verifies 42 files / 96,527,161 bytes, Node/PTY/watcher/two-second settlement in 5,367.371 ms at 49,827,840 RSS, and completes verification in 6,575.312 ms on build 20348. Windows arm64 floor 87664691235 retains only the declared hosted-image rejection: build 26200 observed versus 26100 required. Before that rejection it verifies 42 files / 85,213,511 bytes and Node/PTY/watcher/two-second settlement in 6,086.7266 ms at 48,390,144 RSS; complete verification is 7,972.4327 ms.
• Adjacent exact-head workflows pass: PR Checks run 29510290584, verify job 87661655083; Golden E2E run 29510290671, Linux job 87661655199 and macOS job 87661655233; computer-use run 29510290118, Ubuntu native-smoke job 87661653654 and Windows native-smoke job 87661653716.
• Boundary/residual gaps: the suite uses an EventEmitter callback fake and does not create a raw SFTPWrapper from an authenticated connection. Native clients therefore do not prove real ssh2 open/end/error/close ordering, connection-force-close, reconnect effects, or adapter/tree composition against OpenSSH. They also do not prove server filesystem/mode behavior, full-size network memory/cancellation, high-RTT one-versus-four transfer, MaxSessions=1, or a live remote matrix cell. The adapter still has no non-test importer. Remote bundled-Node verification/install/ publish/launch and every product/Beta/settings/fallback/tuple/publication/default path remain absent; legacy remains the sole production/default path and SignPath remains deferred.

E-M6-SFTP-LIVE-COMPOSITION-AUDIT-001 — authenticated connection ownership and live OpenSSH boundary

• Date/owner/base: 2026-07-15, Codex implementation owner; exact clean evidence base d11261706 after E-M6-SFTP-SESSION-ADAPTER-CI-001 closure.
• Audit commands: sed -n '1,290p' src/main/ssh/ssh-relay-runtime-sftp-tree-transfer.ts, sed -n '1,280p' src/main/ssh/ssh-relay-runtime-sftp-session.ts, relevant lifecycle ranges from ssh-connection.ts, and searches for existing live-SSH/OpenSSH/workflow fixtures. Result: the raw adapter and tree contracts compose without changing authentication or relay RPC, but no non-test owner captures the exact ssh2 transport that opened the raw SFTP channel or awaits connection teardown if channel close exceeds its grace.
• Composition boundary: add one purpose-named module that accepts the existing authenticated SshConnection, captures its exact current built-in ssh2 client, opens exactly one signal-bound raw SFTP session, rejects a connection-generation race after closing the returned channel, and delegates to the existing session adapter and tree orchestrator. Force-close may destroy only the captured client, must await that client's public close event with a bounded timeout, and must not dispose the SshConnection or destroy a replacement client; the existing disconnect handler owns reconnect state. System-SSH targets reject this composition without opening anything.
• Cancellation correction: current tree abort starts session close immediately. That is required to release a retained raw callback, but it can race and prevent reverse cleanup when the active callback settles normally. On abort, arm a short breaker below the 10-second cancellation-and-join ceiling; when the stream reaches its catch boundary, cancel the breaker before reverse cleanup. A genuinely retained callback is still released by timed session close, while normal cancellation gets one opportunity to remove proved-owned paths before closing the session. Tests must prove both orders and that no write begins after abort.
• Layer-A proof: purpose tests cover exact signal and connection identity, one SFTP open, system-SSH rejection, connection replacement race, captured-client-only destroy/await-close, force-close timeout/failure, normal owned-tree cancellation cleanup before close, and retained-callback breaker settlement. Existing focused/broad/static/isolation gates remain mandatory.
• Layer-B proof: on target-native Ubuntu x64 and arm64 GitHub runners, start a loopback-only stock OpenSSH sshd with key authentication and internal SFTP, then transfer the exact runtime produced by that runner's build job. Validate the complete staged tree bytes/count/modes, exclusive-root behavior, serial and four-file measurements, full-size incremental desktop RSS under 80 MiB, cancellation settlement under 10 seconds, no later writes, and owned-stage cleanup. Record runner image, architecture, OpenSSH version, runtime tuple/content/size/count, duration, RSS, and gaps.
• Explicit residual boundary: this package does not prove a Windows remote, cross-client matrix, high-RTT comparison, MaxSessions=1, network interruption/disk/quota/inode/noexec/AV failures, POSIX or Windows system-SSH transfer, remote bundled-Node verification/install/publish/launch, product/Beta/settings/fallback wiring, tuple enablement, publication, or default behavior. Legacy remains the sole production/default path and SignPath remains deferred.

E-M6-SFTP-LIVE-COMPOSITION-LOCAL-RED-001 — missing owner and cancellation ordering fail as audited

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, exact base d11261706 plus audit/test/workflow-only diff. Exact Node 24 remains CI.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-connection-transfer.test.ts src/main/ssh/ssh-relay-runtime-sftp-tree-transfer.test.ts — EXPECTED FAIL: the five-case connection suite collects zero tests because the purpose-named composition module is absent, and the new ordinary-cancellation case observes the final owned-tree rmdir after session close (event indices 23 versus 11). Nine prior tree cases pass. Vitest 1.87 seconds / 3.24 seconds wall, 141,524,992-byte maximum RSS. The temporary unhandled-rejection diagnostic came from attaching the retained-callback test's rejection expectation after advancing fake time and was corrected in the test before GREEN; it is not counted as product evidence.
• RED scope: tests and native workflow inclusion only. Protected resolver files remain untouched; no owner module, live server, product importer, settings/fallback/tuple/default behavior, or SignPath work exists.

E-M6-SFTP-LIVE-COMPOSITION-LOCAL-001 — disconnected owner and live-runner oracle are locally green

• Date/owner/environment: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, atop exact evidence base d11261706 plus this isolated diff. Exact Node 24 and stock OpenSSH remain the native CI gate.
• Implementation: the 140-line connection module accepts only the existing authenticated built-in connection boundary, captures the exact current ssh2 client, opens one signal-bound raw SFTP channel, and rejects/awaits cleanup if the connection changes during open. Its escalation destroys only the captured client and awaits public client close for five seconds; a replacement client is never touched, normal raw-session close leaves the connection open, and existing disconnect logic retains reconnect ownership. No SshConnection auth/RPC/default behavior changes.
• Cancellation correction: the tree orchestrator arms a 250 ms raw-callback breaker on abort. If the callback settles and the stream reaches its catch boundary, it cancels the breaker, reverse-cleans proved-owned files/directories, then closes the session. If a callback remains retained, the breaker closes the raw session to release the borrowed 64 KiB source buffer. Tests prove both orders and no second write after abort; the overall 10-second cancellation-and-join ceiling is unchanged.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-sftp-connection-transfer.test.ts src/main/ssh/ssh-relay-runtime-sftp-tree-transfer.test.ts — PASS, 15/15 in 1.59 seconds Vitest / 2.68 seconds wall, 139,755,520-byte maximum RSS. Five owner cases cover exact signal/one open, normal connection retention, system-SSH rejection, generation replacement cleanup, captured-only force close, awaited raw/client close, and bounded missing-close failure. Ten tree cases include ordinary cancellation cleanup before close and retained-callback breaker settlement.
• Focused command: connection, source tree/scan/stream, three SFTP boundaries, acquisition/cache resolution/population/integration, live-suite skip oracle, and workflow contract — PASS, 14 files plus one declared live-input skip; 189 passed / two declared skips in 14.22 seconds Vitest / 15.70 seconds wall, 172,146,688-byte maximum RSS.
• Broad commands: src/main/ssh/ssh-relay-*.test.ts — PASS, 46 files passed / four declared skipped, 603 tests passed / six declared skipped in 25.09 seconds Vitest / 27.10 seconds wall, 301,694,976-byte maximum RSS; config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files / 281 tests in 22.94 seconds Vitest / 24.87 seconds wall, 190,398,464-byte maximum RSS. Only the established stale-lock diagnostic and local Node 26 module deprecation appear.
• Static/isolation commands: pnpm typecheck passes in 4.75 seconds wall with 1,249,492,992-byte maximum RSS; targeted oxlint, targeted oxfmt --check, standalone max-lines ratchet, git diff --check, protected-resolver empty diff, workflow YAML/oracle, and no non-test consumer outside this disconnected module pass. Full pnpm lint passes in 17.44 seconds wall with 2,025,259,008-byte maximum RSS: switch exhaustiveness, 41 reliability gates, 355-entry max-lines ratchet, bundled-skill verification, 9,837 localization references, locale parity, and zero- candidate coverage pass with only pre-existing warnings. Module/purpose/live-test sizes are 140/170/311 lines, and the updated tree module/test are 271/426 lines, with no new bypass.
• Live runner oracle: the existing artifact workflow now triggers for runtime-transfer changes and includes the five owner cases once in each native command family. Linux x64 and arm64 build jobs, after producing and locally verifying the exact runtime, start a loopback-only stock OpenSSH sshd with key authentication/internal SFTP. The purpose-named full-size suite scans the exact identity/runtime, transfers it serially and with four files, validates every path/byte/hash/mode, proves exclusive-root refusal leaves the tree intact, cancels after the first completed write, requires cleanup/no later writes and sub-10-second settlement, enforces the 80 MiB desktop RSS ceiling, and emits tuple/content/file/byte/server/runner/duration/RSS metrics. The fixture setup is bounded and cleanup runs under always().
• Local live result: deliberately SKIP, one case, because the required seven OpenSSH/runtime environment inputs are absent. This proves the skip gate only and earns no live/server/filesystem/full-size evidence. Exact-head Linux x64/arm64 CI is mandatory next.
• Residual gaps: no Windows remote, cross-client matrix, high-RTT comparison, MaxSessions=1, live peak channel/open-handle instrumentation, interruption/disk/quota/inode/noexec/AV failure, POSIX or Windows system-SSH path, remote bundled-Node verification/install/publish/launch, product/Beta/ settings/fallback wiring, tuple enablement, publication, or default behavior is proved. Legacy remains the sole production/default path and SignPath remains deferred.

E-M6-SFTP-LIVE-COMPOSITION-CI-RED-001 — stock sshd rejects the hosted runner's locked account

• Date/owner/head/run: 2026-07-15, Codex implementation owner; exact implementation commit 32f78d720febdb5581282cfbc64b6aae374930f4, SSH Relay Runtime Artifacts run 29513130758.
• Passing boundary before RED: Linux x64 job 87671358587 and Linux arm64 job 87671358592 both pass checkout, exact Node 24.18.0 setup, native identity, prerequisites, the complete runtime contract suite including all five new connection-owner cases, exact Node input download, target- native build/reproducibility/read-back/smoke, and full-size extraction/cache/scan/stream measurement.
• Expected evidence failure: both jobs then fail Start loopback OpenSSH SFTP fixture; the live transfer step is skipped and sends zero SFTP bytes. The server binds only 127.0.0.1:22222, but every key-auth probe is rejected with User runner not allowed because account is locked before public-key validation. The arm64 cleanup log confirms stock sshd accepted the config/listener and rejected only the shadow account state. The x64 runner is Ubuntu 24.04.4 image 20260714.240.1, X64, kernel 6.17.0-1020-azure; arm64 is the target-native hosted counterpart.
• Narrow correction: retain PasswordAuthentication no, KbdInteractiveAuthentication no, loopback-only listen, one ephemeral Ed25519 client key, and strict modes. Generate a fresh random 32-byte password, store only its SHA-512 shadow hash on the ephemeral runner account, immediately unset the plaintext shell variable, and continue to authenticate only with the generated public key. Also read root-owned sshd logs through sudo on failure. This changes only CI fixture account eligibility; no product authentication, connection, transfer, or fallback code changes.
• Residual: no live SFTP transfer/filesystem/mode/RSS/cancellation evidence is credited from this run. Exact-head Linux x64/arm64 rerun plus all-six/adjacent regression proof remains mandatory.

E-M6-SFTP-LIVE-COMPOSITION-CI-001 — exact full-size Linux x64/arm64 OpenSSH transfer passes

• Date/owner/head/run: 2026-07-15, Codex implementation owner; exact fixture-correction commit a72c32f630712547b4b51ff9eda5e073ea010ca5, SSH Relay Runtime Artifacts run 29513599328.
• Native contract/build results: all six primary Node 24.18.0 jobs pass their runtime contract, target-native build, reproducibility, read-back, bundled-Node/native-module/PTY/watcher smoke, and evidence upload: Darwin arm64 87672984492, Darwin x64 87672984529, Windows x64 87672984544, Windows arm64 87672984568, Linux arm64 87672984606, and Linux x64 87672984630. Linux arm64 supplement 87674335272, Linux x64 supplement 87674335444, and Windows x64 floor 87675902858 pass. Windows arm64 floor 87675902918 completes the exact 42-file / 85,213,511-byte runtime smoke in 5,871.70 ms and 48,713,728 incremental RSS bytes, then retains only the declared hosted build-26200 versus required-26100 rejection.
• Linux x64 live cell: ubuntu-24.04 / ubuntu24 image 20260714.240.1, X64, stock OpenSSH_9.6p1 Ubuntu-3ubuntu13.18, public-key authentication only. Exact linux-x64-glibc content sha256:fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d, 34 files / 124,846,430 bytes. Serial transfer is 1,539.61 ms / 57,503,744 incremental RSS bytes; four-file transfer is 1,420.82 ms / 5,488,640 bytes; cancellation settles in 9.99 ms / zero incremental RSS bytes.
• Linux arm64 live cell: ubuntu-24.04-arm / ubuntu24-arm64 image 20260714.61.1, ARM64, the same stock OpenSSH version and public-key-only policy. Exact linux-arm64-glibc content sha256:96f07f62af9b35304bb8ca0870ca4d8095e059bfa61dd1bc57e81b20f3fbca67, 34 files / 122,865,324 bytes. Serial transfer is 1,497.40 ms / 58,568,704 incremental RSS bytes; four-file transfer is 1,385.27 ms / 5,984,256 bytes; cancellation settles in 9.13 ms / zero incremental RSS bytes.
• Live assertions: each cell transfers the exact runtime built in that job; validates every path, SHA-256, byte count, and POSIX mode; proves exclusive-root refusal preserves the first tree; cleans an aborted owned stage with no later writes; and stays below the 80 MiB desktop transfer ceiling. PR Checks run 29513598690 and Golden E2E run 29513600476 pass at the same SHA.
• Residual boundary: this closes only the two same-family Linux SFTP cells. Windows remote, cross-client coverage, high RTT, MaxSessions=1, peak live channel/handle counts, fault injection, POSIX/Windows system SSH, remote verification/install/publish/launch, and every product/Beta/ settings/fallback/tuple/publication/default path remain open. The adjacent computer-use workflow is separately RED below, so the package does not advance yet. Legacy remains the only production path and SignPath remains deferred.

E-M6-SFTP-LIVE-COMPOSITION-ADJACENT-CI-RED-001 — repeated pre-existing Windows compiler timeout

• Date/owner/head/run: 2026-07-15, Codex implementation owner; exact commit a72c32f630712547b4b51ff9eda5e073ea010ca5, computer-use run 29513600918, first Windows job 87672944323 and same-SHA failed-job rerun 87677479785.
• Result: both attempts pass 400 of 401 applicable tests with four declared skips, but src/main/ssh/ssh-remote-cli-launcher.test.ts:55 exceeds Vitest's unchanged five-second default while synchronously invoking the real .NET Framework compiler. The first attempt lasts 11.76 seconds overall; the rerun lasts 12.23 seconds. Neither the launcher source/test nor its imports overlap this package. The same workflow's Ubuntu job passes, and the independent all-six native artifact jobs plus PR Checks and Golden E2E pass.
• Independent diagnosis: current origin/main commit 45a772cb42f8525ce0189fe63a509e562c5b6928 (test(windows): allow native launcher compilation time, reviewed PR #8897) changes only the two real Windows compiler integration tests and scopes a 15-second timeout to them because cold hosted csc.exe startup exceeds the unit default. It is not an SFTP change and changes no production behavior. This feature branch predates that commit.
• Disposition: apply the exact reviewed test-only patch without broad timeout relaxation, then require a fresh exact-head computer-use pass before advancing. No adjacent green evidence is credited from either failed attempt.

E-M6-SFTP-LIVE-COMPOSITION-ADJACENT-CI-001 — scoped upstream test budget closes exact-head adjacent gate

• Date/owner/head/run: 2026-07-15, Codex implementation owner; exact evidence/test-only commit 4945645e81af971d8ba874d83ee5975abfd6e79d, computer-use run 29515352845.
• Windows result: job 87678882484 passes the 401 applicable tests with four declared skips, including both real Windows C# compiler integration cases under their exact reviewed 15-second budgets. It then passes native verification, CLI and packaged Electron builds, daemon boot, Windows daemon workspace-close repro, and Windows computer-use E2E in 4 minutes 38 seconds. No product source or timeout outside the two compiler cases changed.
• Control result: Ubuntu job 87678882558 passes its unit/native/build/daemon/Linux E2E path in 2 minutes 49 seconds. Local macOS runs passed three applicable launcher cases with the two Windows cases declared skipped plus the eight-case relay workflow oracle; formatting and diff gates passed before commit.
• Disposition: the repeated adjacent RED is resolved by the exact independently reviewed upstream test-only correction. Prior live SFTP evidence remains anchored to a72c32f63; this commit changes no SFTP/runtime/product code. The separately triggered all-six artifact rerun is redundant control evidence and may continue while the next disconnected package begins.

E-M6-SFTP-LIVE-COMPOSITION-CONTROL-CI-001 — redundant exact-head control classified

• Date/owner/head: 2026-07-15, Codex implementation owner; exact test/docs-only head 4945645e81af971d8ba874d83ee5975abfd6e79d after the adjacent correction above.
• Runtime artifact run: 29515352928. All six primary native jobs pass: Windows arm64 87678883773, Windows x64 87678883819, macOS arm64 87678883853, Linux arm64 87678883887, Linux x64 87678883950, and macOS x64 87678883952. Both Linux oldest-userland supplements pass in jobs 87680141129 and 87680141145, as does the Windows x64 floor in job 87681071541.
• Declared residual: only Windows arm64 floor job 87681071534 fails after complete runtime smoke because the hosted runner reports build 26200 while the immutable contract requires build 26100; platform and architecture pass, osBuild fails. This is the already recorded runner gap, not a test-only correction or SFTP regression.
• Adjacent controls: PR Checks run 29515352911 passes lint, typecheck, Git compatibility, tests, unpacked app build, and packaged CLI smoke. Golden E2E run 29515352860 passes both macOS job 87678882828 and Linux job 87678882845.
• Disposition: this closes classification of the redundant control run only. Live SFTP evidence remains anchored to a72c32f63; no POSIX system-SSH claim or later-package evidence is inferred.

E-M6-POSIX-SYSTEM-SSH-FILE-AUDIT-001 — isolated no-tar file channel boundary

• Date/owner/base: 2026-07-15, Codex implementation owner; clean exact base 4945645e81af971d8ba874d83ee5975abfd6e79d after the adjacent gate above.
• Existing-code audit: system-ssh-file-transfer.ts is the proven legacy/default uploader and uses local plus remote tar on POSIX and a whole-tree JSON/base64 buffer on Windows. Those paths remain available but violate the new runtime bootstrap contract and must not be reused, narrowed, or modified in this slice. ssh-relay-runtime-source-stream.ts already owns the exact scanned source, one 64 KiB buffer per worker, hash/size/snapshot checks, and joined destination cleanup.
• New boundary: add one purpose-named POSIX file-destination module that implements only SshRelayRuntimeSourceDestination. It receives an absolute POSIX manifest path, authenticated mode (0644 or 0755), the exact caller signal, and an injected command-channel factory. The generated POSIX sh command uses only umask, set -C, byte-preserving cat, and chmod; it shell-quotes the path, exclusively creates the file with mode 0600 during transfer, and applies the authenticated final mode only after stdin EOF and successful cat settlement. It never uses Node, Python, Perl, tar, base64, a checksum tool, a whole-file buffer, or a remote download.
• Lifecycle contract: one write may be active; each write resolves only after the channel accepts the exact non-empty chunk so the source worker may safely reuse its buffer. Close sends EOF once and awaits a successful remote exit before declaring completion. Abort is idempotent, settles any active write, requests graceful channel termination, escalates after a short fixed grace to forced termination, and fails closed if the bounded total settlement window expires. A later tree owner, not this file boundary, owns removal of an incomplete proved-owned path after the channel settles.
• Layer-A proof: purpose tests must cover hostile/relative/newline/NUL paths, invalid modes, exact shell quoting and forbidden-command absence, exclusive/restrictive/final-mode command order, zero-byte EOF, multi-chunk buffer callback order, concurrent-operation rejection, remote nonzero exit, pre/mid-write/mid-close cancellation, graceful and forced settlement, final timeout, cleanup failure propagation, idempotent abort, and no write after cancellation. Pin the purpose suite once in both native workflow command families before implementation.
• Explicit residual boundary: no real SSH process or connection, directory/tree staging, primitive semantic probe, MaxSessions=1, one-versus-four policy, tar optimization, full-size/live transfer, bundled-Node remote verification/install/publish/launch, product/Beta/settings/fallback/tuple/ publication/default behavior, Windows PowerShell path, or SignPath is included. Legacy remains the sole production/default path.

E-M6-POSIX-SYSTEM-SSH-FILE-LOCAL-RED-001 — missing production boundary fails as designed

• Date/owner/base: 2026-07-15, Codex implementation owner; exact uncommitted test/workflow state on base 4945645e81af971d8ba874d83ee5975abfd6e79d after E-M6-POSIX-SYSTEM-SSH-FILE-AUDIT-001.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-posix-file-destination.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected RED, exit 1. The new purpose suite collects zero cases and fails solely with Cannot find module './ssh-relay-runtime-posix-file-destination'; that production module does not exist yet. The independent release-workflow oracle passes all 8/8 cases, proving the purpose suite appears exactly once in each native command family before implementation.
• Resource evidence: Vitest duration 671 ms; /usr/bin/time -l reports 1.86 seconds real, 132,153,344 bytes maximum resident set size, zero swaps, and zero block input/output operations.
• Disposition: RED is causally narrow and accepted. Implement only the audited injected-channel destination, then require purpose GREEN plus focused, broad, static, isolation, and exact-head native workflow evidence. No live SSH, tree transfer, product path, or default-path claim follows from this evidence.

E-M6-POSIX-SYSTEM-SSH-FILE-LOCAL-TYPE-RED-001 — test-only type boundary corrected

• Date/owner/state: 2026-07-15, Codex implementation owner; first static pass on the uncommitted implementation atop 4945645e81af971d8ba874d83ee5975abfd6e79d.
• Command/result: /usr/bin/time -l pnpm typecheck — expected gate RED after runtime tests were already green, exit 1 in 3.23 seconds real with 1,032,896,512-byte maximum RSS. TypeScript reports only three purpose-test errors: the intentionally invalid numeric mode crosses the production literal union, and two zero-argument vi.fn channel factories expose no command tuple to the assertions. No production line fails typechecking.
• Correction: constrain the deliberate runtime-invalid mode at the test call boundary and declare the two mock command/signal parameters. The 25-case purpose suite and repeated typecheck below pass after that test-only correction. No product, transport, or runtime behavior changed.

E-M6-POSIX-SYSTEM-SSH-FILE-LOCAL-001 — isolated file channel boundary is locally green

• Date/owner/environment/base: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, uncommitted package atop exact base 4945645e81af971d8ba874d83ee5975abfd6e79d.
• Implementation: the 318-line purpose-named module accepts one absolute normalized POSIX manifest path, authenticated 0644/0755, exact signal, and injected channel factory. Its exact command uses only umask 077, set -C, byte-preserving cat, and chmod; single-quote escaping is covered. It awaits every non-empty write callback, sends EOF once, requires successful remote settlement, and bounds cancellation to a 250 ms graceful window plus a 2,000 ms total ceiling with force-close escalation. Cancellation never sends EOF and does not release an active retained chunk until channel settlement or the fail-closed ceiling.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-posix-file-destination.test.ts — PASS, 25/25 in 275 ms Vitest / 1.31 seconds real, 132,743,168-byte maximum RSS, zero swaps, and zero block I/O. Cases cover both final modes; exact/forbidden command content; hostile paths; empty/write-error/ retained chunks; concurrent operations; zero-byte EOF; nonzero remote exit; pre-open, mid-open, mid-write, and mid-close cancellation; graceful/forced/timeout settlement; cleanup failure; and idempotent abort/no later EOF or write.
• Focused command: purpose, source stream/scan/tree, and native-workflow oracle — PASS, five files, 87 cases plus one declared platform skip in 7.49 seconds Vitest / 8.98 seconds real with 144,556,032-byte maximum RSS. The workflow oracle passes 8/8 and pins the suite exactly once in both POSIX and PowerShell native command families.
• Broad commands: src/main/ssh/ssh-relay-*.test.ts — PASS, 47 files plus four declared skipped, 628 cases plus six declared skips in 25.04 seconds Vitest / 26.50 seconds real with 244,596,736-byte maximum RSS; config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files and 281/281 cases in 22.34 seconds Vitest / 24.48 seconds real with 190,545,920-byte maximum RSS. Only the established stale-lock diagnostic and local Node 26 module deprecation appear.
• Static/isolation commands: repeated /usr/bin/time -l pnpm typecheck passes in 3.32 seconds real with 1,241,726,976-byte maximum RSS. Targeted oxlint, targeted oxfmt --check, standalone max-lines ratchet, git diff --check, protected-resolver empty diff, and no non-test consumer pass. Full pnpm lint passes in 18.10 seconds real with 2,052,751,360-byte maximum RSS: switch exhaustiveness, 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill verification, 9,837 localization references, locale parity, and zero-candidate localization coverage pass; only pre-existing unrelated warnings remain. Module/test sizes are 318/325 lines with no bypass.
• Residual: this is an injected callback-channel contract, not a real SSH process, SshConnection adapter, tree/root staging owner, semantic primitive probe, tar optimization, MaxSessions=1, full-size/live transfer, or Windows PowerShell path. It has no non-test consumer. Remote bundled- Node verification/install/publish/launch, product/Beta/fallback/tuple/publication/default behavior, and SignPath remain absent; legacy remains the sole production/default path. Exact-head all-six native and adjacent Actions evidence is required before the next bounded package.

E-M6-POSIX-SYSTEM-SSH-FILE-CI-001 — all-six native clients prove the isolated boundary

• Date/owner/head: 2026-07-15, Codex implementation owner; exact implementation commit fac052b7714e2c93c5c84b41b784869d4b3fe125 on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29516746498. The exact 25-case purpose suite passes on all six primary Node 24.18.0 clients: Linux x64 job 87683577951 in 40 ms, macOS arm64 job 87683577985 in 23 ms, Windows arm64 job 87683577998 in 30 ms, Windows x64 job 87683578029 in 24 ms, macOS x64 job 87683578046 in 69 ms, and Linux arm64 job 87683578064 in 27 ms. POSIX jobs pass 93/93 runtime contract files and Windows jobs pass 94/94; all six then pass native deterministic build/smoke and full-size extraction/cache evidence. Linux x64/arm64 additionally retain their independent exact-runtime live SFTP proof.
• Supplemental/baseline result: Linux x64 job 87684783571 and Linux arm64 job 87684783588 pass the oldest-userland supplements. Windows x64 floor job 87685969814 passes. Only Windows arm64 floor job 87685969791 rejects the hosted runner's build 26200 versus the immutable required build 26100 after complete 85,213,511-byte / 42-file runtime, Node 24.18.0 ABI 137, native PTY, watcher, and two-second resource- settlement smoke. Platform and architecture checks pass; only osBuild is false. This is the declared runner gap, not a boundary regression.
• Adjacent Actions: Computer-use run 29516746536 passes Windows job 87683577620 in 4 minutes 46 seconds and Ubuntu job 87683577703 in 2 minutes 53 seconds. PR Checks run 29516748161, job 87683582762, passes lint, typecheck, Git compatibility, tests, unpacked Electron build, and packaged CLI smoke in 11 minutes 55 seconds. Golden E2E run 29516747231 passes macOS job 87683580560 in 3 minutes 59 seconds and Linux job 87683580641 in 4 minutes 22 seconds.
• Disposition/residual: the isolated file destination package is exact-head green and may close. This evidence does not prove a real POSIX system-SSH exec adapter, remote tree/root staging, primitive semantics, full-size system-SSH transfer, MaxSessions=1, or a product path. No setting, Beta mode, fallback, tuple, publication, default behavior, or SignPath work exists; legacy remains the only production path.

E-M6-POSIX-SYSTEM-SSH-CHANNEL-AUDIT-001 — authenticated exec-channel adapter boundary

• Date/owner/base: 2026-07-15, Codex implementation owner; clean exact base 62ffaec98df827a5a502f55a2c4a7e1cb7d03d03 after recording the completed file-boundary evidence.
• Existing-code audit: SshConnection.exec(command) already preserves the connected target, resolved OpenSSH configuration, host-scoped ControlMaster disable/retry state, command tracking, and disconnect/reconnect teardown. Guarding usesSystemSshTransport() before that call prevents accidental ssh2/SFTP-family use. spawnSystemSshCommand then wraps the local OpenSSH child as a ClientChannel, exposes stdin/stderr plus its owned child process, forwards close/error, and keeps stdout backpressure bounded when a consumer drains it.
• Rejected reuse: system-ssh-file-binary-transfer.ts is a proven legacy/default whole-buffer/local- file uploader and must remain unchanged. waitForChannelClose accumulates arbitrary stderr, while awaitWithSystemSshAbort deliberately returns immediately after SIGTERM instead of awaiting process settlement. Those contracts are correct for legacy callers but do not meet the new bootstrap's capped-memory and pre-execution cancellation boundary; do not import or modify them.
• New boundary: add one purpose-named disconnected adapter module that accepts only a connection, exact command, and exact signal. It rejects a non-system transport or pre-aborted signal before exec, calls connection.exec(command) exactly once, drains unused stdout immediately, and returns SshRelayRuntimePosixFileChannel. Writes forward the exact borrowed chunk and callback to child stdin; EOF ends child stdin once; settlement listens to child error/close, requires exit zero, and includes at most a small fixed copied stderr prefix plus a truncation marker without retaining an attacker-sized chunk.
• Single cancellation owner: do not pass the signal into SshConnection.exec. The proven per-file destination already owns that exact signal and its bounded SIGTERM/SIGKILL sequence; passing it to the connection would install a second immediate SIGTERM listener on the same child. Connection- level disconnect/reconnect still closes every tracked command independently.
• Cancellation ownership: the adapter exposes idempotent graceful close through the tracked channel's SIGTERM close() and idempotent forced close through its owned child process's kill('SIGKILL'). Missing child-process ownership or a thrown kill fails closed. The proven ssh-relay-runtime-posix-file-destination.ts owner retains the 250 ms graceful / 2,000 ms total settlement timers and decides when to escalate; the adapter must not add a second timer or return success before the process emits close.
• Layer-A RED/green proof: purpose cases must cover system-transport/pre-abort rejection with zero exec; exact command, signal precheck, and one exec; stdout drain; exact non-empty chunk/callback and stdin EOF; zero/nonzero/signal/error settlement; bounded copied stderr/truncation; listener cleanup; duplicate graceful/forced calls; SIGTERM before SIGKILL; exited-child force no-op; missing process and thrown close/kill failures; and composition with the per-file owner for retained-write cancellation and forced/timeout settlement. Pin the purpose suite exactly once in both native workflow families before implementation.
• Explicit residual boundary: no direct spawn, SshConnection modification, ssh2/SFTP path, directory or tree/root staging, primitive semantic probe, tar optimization, MaxSessions=1 concurrency policy, full-size/live system-SSH transfer, Windows PowerShell path, remote verification/install/ publish/launch, product/Beta/settings/fallback/tuple/publication/default behavior, or SignPath is included. Legacy remains the sole production/default path.

E-M6-POSIX-SYSTEM-SSH-CHANNEL-LOCAL-RED-001 — missing adapter fails as designed

• Date/owner/base: 2026-07-15, Codex implementation owner; exact uncommitted test/workflow state on base 62ffaec98df827a5a502f55a2c4a7e1cb7d03d03 after E-M6-POSIX-SYSTEM-SSH-CHANNEL-AUDIT-001.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-system-ssh-file-channel.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected RED, exit 1. The new 311-line purpose suite collects zero cases and fails solely with Cannot find module './ssh-relay-runtime-system-ssh-file-channel'; that production module does not exist yet. The independent release-workflow oracle passes all 8/8 cases and proves the suite is pinned exactly once in both native command families.
• Resource evidence: Vitest duration 539 ms; /usr/bin/time -l reports 1.69 seconds real, 133,103,616 bytes maximum resident set size, zero swaps, and zero block I/O.
• Disposition: RED is causally narrow and accepted. Implement only the audited adapter, then require purpose composition GREEN plus focused, broad, static, isolation, and exact-head native evidence. No live system-SSH, tree, product, or default-path claim follows from this evidence.

E-M6-POSIX-SYSTEM-SSH-CHANNEL-LOCAL-TYPE-RED-001 — typed stream boundary corrected

• Date/owner/state: 2026-07-15, Codex implementation owner; first static pass on the uncommitted adapter atop 62ffaec98df827a5a502f55a2c4a7e1cb7d03d03 after runtime purpose GREEN.
• Command/result: /usr/bin/time -l pnpm typecheck — gate RED, exit 1 in 1.93 seconds real with 1,044,365,312-byte maximum RSS. TypeScript reports fake ClientChannel/stream intersections, deliberate rejected-promise narrowing, a readonly fake exit field, and the overloaded Node stdin callback signature; no runtime assertion fails.
• Correction: keep the fake structural until the ClientChannel return boundary, narrow the already- validated child stdin to the exact Buffer/callback/end shape, explicitly narrow the caught error, and retain mutable fake process state. The repeated 13-case purpose suite and typecheck below pass. No behavior, lifecycle timer, product path, or legacy module changed.

E-M6-POSIX-SYSTEM-SSH-CHANNEL-LOCAL-001 — authenticated child-channel adapter is locally green

• Date/owner/environment/base: 2026-07-15, Codex implementation owner; local macOS arm64, Node 26.0.0, pnpm 10.24.0, uncommitted package atop exact base 62ffaec98df827a5a502f55a2c4a7e1cb7d03d03.
• Implementation: the 192-line adapter rejects non-system transport and pre-abort before exec, calls the already-authenticated/tracked connection.exec(command) exactly once, and deliberately keeps cancellation single-owned by the per-file destination. It drains unused stdout, forwards the exact borrowed Buffer/callback and EOF to child stdin, requires exit zero, copies/caps stderr at 16 KiB, cleans all diagnostic/settlement listeners, and exposes idempotent SIGTERM/SIGKILL hooks. Missing process ownership, false/throwing force signals, and termination failures fail closed.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-system-ssh-file-channel.test.ts — PASS, 13/13 in 346 ms Vitest / 1.33 seconds real, 131,727,360-byte maximum RSS, zero swaps, and zero block I/O. Cases cover transport/pre-abort rejection, exact one exec, stdout drain, retained chunk callback, EOF, successful/nonzero/signaled/error settlement, copied capped diagnostic, listener cleanup, idempotent ordered termination, exited/missing/unsignaled/thrown process cases, graceful retained- write composition, and forced composition using only the file owner's timer.
• Focused command: adapter, per-file destination, existing system-SSH fallback, SshConnection, and native workflow oracle — PASS, five files and 150/150 cases in 2.95 seconds Vitest / 4.31 seconds real with 156,680,192-byte maximum RSS. The workflow oracle passes 8/8 and pins the purpose suite exactly once in POSIX and PowerShell native command families.
• Broad commands: src/main/ssh/ssh-relay-*.test.ts — PASS, 48 files plus four declared skipped, 641 cases plus six declared skips in 32.50 seconds Vitest / 34.59 seconds real with 248,201,216-byte maximum RSS; config/scripts/ssh-relay-runtime-*.test.mjs — PASS, 50 files and 281/281 cases in 21.88 seconds Vitest / 23.87 seconds real with 190,169,088-byte maximum RSS. Only the established stale-lock diagnostic and local Node 26 module deprecation appear.
• Static/isolation commands: repeated /usr/bin/time -l pnpm typecheck passes in 3.11 seconds real with 1,209,237,504-byte maximum RSS. Targeted oxlint, targeted oxfmt --check, standalone max-lines ratchet, git diff --check, protected-resolver empty diff, and no non-test consumer pass. Full pnpm lint passes in 19.61 seconds real with 2,067,415,040-byte maximum RSS: switch exhaustiveness, 41 reliability gates, the 355-entry max-lines ratchet, bundled-skill verification, 9,837 localization references, locale parity, and zero-candidate localization coverage pass; only pre-existing unrelated warnings remain. Module/test sizes are 192/329 lines with no bypass.
• Residual: this proves an authenticated connection/child callback contract and its file-owner composition, not a real local OpenSSH process, remote shell, directory/tree/root staging, primitive semantics, full-size system-SSH transfer, MaxSessions=1, or Windows PowerShell path. It has no non-test consumer. Remote verification/install/publish/launch, product/Beta/settings/ fallback/tuple/publication/default behavior, and SignPath remain absent; legacy remains the only production path. Exact-head all-six native and adjacent Actions evidence is required before the next package.

E-M6-POSIX-SYSTEM-SSH-CHANNEL-CI-001 — all-six native clients prove the channel adapter

• Date/owner/head: 2026-07-15, Codex implementation owner; exact implementation commit f1d6d92690d63744f7b2d9d1497ea8a3fcc82329 on draft PR #8741.
• Native workflow: SSH Relay Runtime Artifacts run 29518835627. The exact 13-case purpose suite passes on all six primary Node 24.18.0 clients: Linux x64 job 87690584214 in 269 ms, Linux arm64 job 87690584277 in 209 ms, macOS x64 job 87690584250 in 503 ms, macOS arm64 job 87690584270 in 119 ms, Windows x64 job 87690584285 in 393 ms, and Windows arm64 job 87690584235 in 343 ms. Linux jobs pass 94 files and 810 cases with one declared skip, macOS jobs pass 94 files and 809 cases with two declared skips, and Windows jobs pass 95 files and 797 cases with 18 declared skips. All six then pass deterministic runtime build/smoke and full-size extraction/cache evidence; Linux x64/arm64 also retain their independent exact-runtime live SFTP proof.
• Supplemental/baseline result: Linux arm64 job 87692000755 and Linux x64 job 87692000791 pass the oldest-userland supplements. Windows x64 floor job 87693390041 passes on build 20348. Only Windows arm64 floor job 87693390043 rejects the hosted runner's build 26200 versus immutable required build 26100 after complete 85,213,511-byte / 42-file runtime, Node 24.18.0 ABI 137, native PTY, watcher, and two-second resource-settlement smoke. Platform and architecture checks pass; only osBuild is false. This is the declared runner gap, not an adapter regression.
• Adjacent Actions: Computer-use run 29518834854 passes Windows job 87690552717 in 5 minutes 1 second and Ubuntu job 87690552721 in 3 minutes 14 seconds. Golden E2E run 29518834911 passes Linux job 87690552742 in 4 minutes 29 seconds and macOS job 87690552777 in 3 minutes 8 seconds. PR Checks run 29518835161, job 87690553577, passes lint, typecheck, Git compatibility, tests, unpacked Electron build, and packaged CLI smoke in 12 minutes 45 seconds.
• Disposition/residual: the authenticated system-SSH command-channel adapter package is exact-head green and may close. This evidence proves an already-authenticated child-channel/per-file contract, not a real remote tree/root transfer, semantic primitive probe, full-size system-SSH transfer, MaxSessions=1, Windows PowerShell transfer, remote verification/install/publish/launch, or a product path. No setting, Beta mode, fallback, tuple, publication, default behavior, or SignPath work exists; legacy remains the only production path.

E-M6-POSIX-SYSTEM-SSH-TREE-AUDIT-001 — disconnected POSIX system-SSH staging-tree composition

• Date/owner/base: 2026-07-15, Codex implementation owner; exact clean evidence base 3cf9bae8f1ac8dd3d0ede4fdbb5c80e90cfe636b after closing the authenticated channel adapter.
• Existing boundaries: compose only the scanned lease-backed source tree, streamSshRelayRuntimeSourceTree, openSshRelayRuntimePosixFileDestination, and openSshRelayRuntimeSystemSshFileChannel. Reject execCommand, waitForChannelClose, the legacy tar uploader, and the legacy buffer/file uploader: they respectively retain unbounded output, settle timeout/abort before forced child settlement, require remote tar, or implement a different whole-buffer/default-path contract.
• Control-command prerequisite: add one purpose-named no-input POSIX control-command owner over the proven channel adapter. It drains stdout and inherits the adapter's copied 16 KiB stderr bound, ends stdin exactly once, requires exit zero, has a 30-second command ceiling, and on cancellation or timeout requests SIGTERM, waits 250 ms, requests SIGKILL, and fails closed if settlement has not completed by 2,000 ms. It preserves the primary abort/timeout/nonzero failure and joins close, force, and settlement failures without putting the command or remote path in orchestrator-authored diagnostics.
• Path/ownership contract: accept only a Linux/Darwin scanned tree, one normalized absolute non-root POSIX staging path with no empty, dot, traversal, NUL, CR, or LF segment, one already-authenticated system-SSH connection, the exact caller signal, and explicit one-to-four concurrency defaulting to one. Use only POSIX sh, mkdir, chmod, cat, and rm: exclusively create the root under umask 077, mark it owned only after successful command settlement, create signed directories in parent-before-child order, and build child paths only from safe slash-delimited manifest segments.
• Stream/cleanup contract: open every file through the proven exclusive per-file destination and authenticated command-channel adapter using the same caller signal. Preserve the source stream's 64 KiB borrowed-buffer boundary, local SHA-256/source-mutation proof, exact 0644/0755 repair, progress, counts, and one-to-four ceiling. On any post-ownership failure, wait for every active destination to settle, then remove only the exclusively owned root with rm -rf and join cleanup failure. A cleanup controller is deliberately distinct because the caller signal has already requested cleanup; it aborts after 5 seconds and its control channel still has the 2-second forced settlement ceiling. Together with the active per-file ceiling, worst-case cancellation and cleanup join remains below the plan's 10-second budget.
• Required purpose RED/green: control success/nonzero/error, exact EOF, pre-abort, mid-command abort, timeout, SIGTERM/SIGKILL order, missing process/false kill/settlement ceiling, and listener/timer cleanup; tree OS/path/concurrency rejection before exec; exact quoted primitive-only commands; root collision without cleanup; parent-first directories; exact file bytes/modes/result/progress; one/four peak channels; source mutation/write failure/cancellation with no later writes; owned-root cleanup after all active files settle; cleanup timeout/failure joining; lease assertions; and exact inclusion of both purpose suites once in both native workflow command families before production.
• Explicit residual boundary: no semantic primitive probe/cache or compatibility classification, optional tar fast path, dynamic MaxSessions=1 policy, live/full-size/high-RTT system-SSH remote, Windows PowerShell path, remote bundled-Node tree verification/install/publish/launch, product/ Beta/settings/fallback/tuple/publication/default behavior, or SignPath is included. Legacy remains the only production/default path and every tuple stays disabled.

E-M6-POSIX-SYSTEM-SSH-TREE-LOCAL-RED-001 — audited control and tree owners are absent

• Date/owner/base: 2026-07-15, Codex implementation owner; audit, test, and native-workflow-only diff atop exact clean evidence base 3cf9bae8f1ac8dd3d0ede4fdbb5c80e90cfe636b.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-posix-control-command.test.ts src/main/ssh/ssh-relay-runtime-posix-tree-transfer.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected RED, exit 1. Both new purpose suites collect zero cases and each fails solely with Cannot find module for its audited production module. The independent workflow oracle passes all 8/8 cases and proves both suites are pinned exactly once in both native command families.
• Resource evidence: Vitest duration 978 ms; /usr/bin/time -l reports 2.17 seconds real, 141,410,304-byte maximum RSS, 96,310,792-byte peak memory footprint, zero swaps, and zero block I/O.
• Disposition: RED is causally narrow and accepted. Implement only the audited bounded control and tree modules, then require purpose composition GREEN plus focused, broad, static, isolation, and exact-head native evidence. No semantic probe, live/full-size system SSH, product path, fallback, tuple, publication, default behavior, or SignPath claim follows from this evidence.

E-M6-POSIX-SYSTEM-SSH-TREE-LOCAL-001 — disconnected bounded staging-tree composition is green

• Date/owner/base/runner: 2026-07-15, Codex implementation owner; uncommitted package atop exact base 3cf9bae8f1ac8dd3d0ede4fdbb5c80e90cfe636b on Apple arm64, macOS 26.2 build 25C56, Node 26.0.0, pnpm 10.24.0. The local Node version is newer than the repository's Node 24 contract; exact-head native workflow jobs remain required before closing the package.
• Implementation: ssh-relay-runtime-posix-control-command.ts owns exact EOF/exit settlement, a 30-second ceiling, 250 ms graceful close, and 2,000 ms forced-settlement ceiling over the proven copied-diagnostic/drained-output adapter. ssh-relay-runtime-posix-tree-transfer.ts validates an absolute normalized POSIX staging root, exclusively creates it under umask 077, creates signed directories parent-first with mode 0755, streams every signed file through the exclusive destination with one-to-four channels defaulting to one, and cleans only its owned root with a separate five-second abort controller. Runtime-invalid staging-root input was corrected before final GREEN so validation cannot throw an incidental .split type error.
• Purpose command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-posix-control-command.test.ts src/main/ssh/ssh-relay-runtime-posix-tree-transfer.test.ts. Result: 2 files and 15/15 cases pass; Vitest 1.95 seconds, 2.96 seconds real, 139,640,832-byte maximum RSS, 95,851,848-byte peak memory footprint, zero swaps and block I/O. Cases cover exact/no-input success, nonzero/error, pre/mid abort, timeout, graceful/forced settlement and joined failures; invalid OS/path/concurrency before exec; exact quoted primitive-only root/directory/file commands, parent-first order, bytes/modes/ progress, default-one/four-channel bounds, collision ownership, cancellation settlement, and cleanup failure/timeout joining.
• Focused composition command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the two new purpose suites plus ssh-relay-runtime-posix-file-destination.test.ts, ssh-relay-runtime-system-ssh-file-channel.test.ts, the source-tree/scan/stream suites, ssh-system-fallback.test.ts, ssh-connection.test.ts, and config/scripts/ssh-relay-runtime-workflow.test.mjs. Result: 10 files, 219 passed and one declared platform skip; Vitest 9.02 seconds, 10.51 seconds real, 156,794,880-byte maximum RSS, 97,457,504-byte peak memory footprint, zero swaps and block I/O. This includes source mutation, lease, retained-buffer/no-later-write, missing process/false kill, diagnostic, child settlement, and exact native-workflow-family contracts inherited from the composed boundaries.
• Broad relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts. Result: 50 files passed, four files skipped; 656 passed and six declared skips out of 662. Vitest 55.58 seconds, 58.05 seconds real, 254,115,840-byte maximum RSS, 96,458,248-byte peak memory footprint, zero swaps and block I/O. Skips remain the declared case-fold/full-size/live SSH cells and are not treated as this package's evidence.
• Release-contract command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs. Result: 50 files and 281/281 cases pass; Vitest 37.74 seconds, 41.85 seconds real, 190,676,992-byte maximum RSS, 97,195,384-byte peak memory footprint, zero swaps and block I/O.
• Static commands/results: /usr/bin/time -l pnpm typecheck passes in 8.38 seconds real with 1,225,637,888-byte maximum RSS and 97,588,552-byte peak footprint. /usr/bin/time -l pnpm lint passes in 61.60 seconds real with 2,049,687,552-byte maximum RSS and 96,621,872-byte peak footprint; its warnings are pre-existing outside this diff. The lint aggregate proves 41 reliability gates, the 355-entry max-lines ratchet with no new bypass, bundled guides, and all localization checks. Targeted oxlint and oxfmt --check pass. The obsolete attempted pnpm lint:max-lines spelling was replaced by the repository's current pnpm check:max-lines-ratchet command; no checklist box was credited to the failed spelling.
• Isolation evidence: git diff --check and no-index whitespace checks for all four new files are clean. git diff --exit-code HEAD -- src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-resolution.test.ts is empty, preserving the protected Milestone 0 resolver. The only implementation references to the exported tree owner are its definition and purpose test; the control owner is consumed only by that disconnected tree owner and its test. No product, settings, legacy uploader, fallback, tuple, publication, or default-path importer exists. The four implementation/test files are 159/196/193/375 lines and contain no max-lines bypass.
• Residual boundary: this evidence uses a realistic fake ClientChannel over the real adapter, not a live OpenSSH daemon or full-size runtime. Semantic primitive probe/cache, optional tar fast path, dynamic MaxSessions=1, live/full-size/high-RTT POSIX system SSH, Windows transfer, remote bundled- Node verification/install/publish/launch, Beta/product/fallback/default wiring, tuple enablement, release publication, and SignPath remain absent. Exact-head native workflow, PR Checks, computer-use, and Golden E2E run IDs are still required before this package is closed.

E-M6-POSIX-SYSTEM-SSH-TREE-CI-001 — exact-head native composition proof

• Date/owner/head: 2026-07-15, Codex implementation owner; exact implementation commit ec51e36b77d8f3ca1c3505e509e0c7f909dcd3cf on draft PR #8741. All run/job IDs below report this exact head and use Node 24.18.0 where the relay artifact workflow installs Node.
• Artifact run: 29521889962. All six primary target-native build jobs pass the complete runtime contract command with both new purpose suites present exactly once:
  • Linux x64 87700712386 (ubuntu-24.04): tree 8/8 in 1,035 ms and control 7/7 in 272 ms; aggregate 96 files, 825 passed/1 declared skip, 16.09 seconds.
  • Linux arm64 87700712339 (ubuntu-24.04-arm): tree 8/8 in 1,429 ms and control 7/7 in 276 ms; aggregate 96 files, 825 passed/1 declared skip, 15.00 seconds.
  • macOS x64 87700712350 (macos-15-intel): tree 8/8 in 2,416 ms and control 7/7 in 287 ms; aggregate 96 files, 824 passed/2 declared skips, 35.45 seconds.
  • macOS arm64 87700712336 (macos-15): tree 8/8 in 918 ms and control 7/7 in 272 ms; aggregate 96 files, 824 passed/2 declared skips, 22.18 seconds.
  • Windows x64 87700712271 (windows-2022): tree 8/8 in 3,278 ms and control 7/7 in 319 ms; aggregate 97 files, 812 passed/18 declared skips, 27.88 seconds.
  • Windows arm64 87700712395 (windows-11-arm): tree 8/8 in 2,866 ms and control 7/7 in 334 ms; aggregate 97 files, 812 passed/18 declared skips, 30.77 seconds.
• Adjacent artifact cells: Linux x64 oldest-userland supplement 87701645841, Linux arm64 supplement 87701645883, and Windows x64 build-20348 floor 87703087692 pass. The workflow's overall conclusion is failure solely because Windows arm64 floor job 87703087689 correctly rejects hosted Windows 10.0.26200 against the required build 26100. Before that floor comparison, it verifies the exact downloaded artifact digest, 60 entries/42 files/85,213,511 expanded bytes, Node 24.18.0, modules ABI 137, resized PTY exit 23, watcher create/update/delete/rename events, 2,000 ms resource settlement, 48,619,520-byte RSS, and 5,889 ms smoke duration. Platform and architecture checks pass; only osBuild is false. This is the same declared runner-availability gap as the preceding exact-head packages, not a regression from this change.
• Repository/adjacent runs: PR Checks run 29521889985, job 87700711608, passes lint, reliability/max-lines, typecheck, Git compatibility, full tests, unpacked build, and packaged CLI smoke. Computer-use run 29521890044 passes Ubuntu job 87700711776 and Windows job 87700711824. Golden E2E run 29521890004 passes Linux job 87700711722 and macOS job 87700711721.
• Disposition/residual boundary: the disconnected tree/root package is exact-head green on all six primary native clients, with the known floor-runner mismatch retained explicitly. These native cases still use the realistic fake command channel over the production adapter; they do not prove a live or full-size POSIX system-SSH transfer. Semantic primitive probe/cache, optional tar fast path, dynamic MaxSessions=1, high-RTT remotes, Windows transfer, remote bundled-Node install/ publish/launch, product/Beta/fallback/default wiring, tuple enablement, release publication, and SignPath remain absent.

E-M6-POSIX-SYSTEM-SSH-TREE-LIVE-AUDIT-001 — restricted-primitive full-size OpenSSH proof

• Date/owner/base: 2026-07-15, Codex implementation owner; exact clean evidence base 3fbf2339badb7bab0308a6daadb80e7d5444e280 after recording the disconnected tree package's exact-head evidence.
• Existing-boundary audit: the exact tree owner already composes production SshConnection.exec, the system-SSH child/channel adapter, exclusive POSIX destinations, the scanned lease-backed source stream, and bounded owned-root cleanup. No production change is necessary for live proof. The existing live SFTP fixture cannot force a restricted command environment because its internal-sftp subsystem shares the daemon, so do not alter or weaken it.
• Live fixture: on only the Linux x64/arm64 target-native artifact jobs, start a second stock loopback-only sshd on its own port/PID/log with the already-generated ephemeral Ed25519 client and host keys. Pin the generated public host key into the runner user's known_hosts; retain StrictModes yes, disable password/keyboard-interactive authentication, and never expose a non-loopback listener. ForceCommand invokes a fixed fixture-owned POSIX wrapper whose remote PATH contains symlinks only for mkdir, chmod, cat, and rm; /bin/sh is absolute. This proves transfer without remote Node, Python, Perl, tar, base64, sha256sum, or shasum, while preserving normal production system-SSH argument/channel behavior and authenticated transport.
• Purpose suite: build a scanned source tree from the exact full-size runtime identity produced in the same native job, force the existing SshConnection into system transport only for the test, and call transferSshRelayRuntimeTreeViaPosixSystemSsh directly. Measure serial/default-one and explicit-four transfers; validate every remote path, byte, SHA-256, mode, file count, and total; prove a root collision cannot alter the complete tree; cancel after the first transferred bytes, require no later progress and owned-root removal after settlement; and prove the connection remains usable. Record tuple/content/server/runner, bytes/files, elapsed time, peak progress concurrency, incremental RSS, cancellation delay, and residual gaps. Enforce the existing 80 MiB incremental RSS and 10-second cancellation ceilings under the workflow's 20-minute job budget.
• Evidence sequence: add only the skipped-without-input purpose suite plus workflow oracle first and accept RED only when the oracle reports the three missing start/measure/stop steps. Then add the bounded workflow fixture/wiring, require local skip/oracle GREEN plus broad/static/isolation gates, commit, and require exact-head Linux x64/arm64 live metrics and all-six adjacent regression cells.
• Explicit residual boundary: no high-RTT host, MaxSessions=1, cross-client/remote family matrix, network interruption/disk/quota/inode/noexec/AV fault injection, semantic probe/cache, optional tar fast path, Windows transfer, remote bundled-Node verification/install/publish/launch, product/Beta/ settings/fallback/default behavior, tuple enablement, publication, or SignPath is included. Legacy remains the only production/default path.

E-M6-POSIX-SYSTEM-SSH-TREE-LIVE-LOCAL-RED-001 — audited workflow fixture is absent

• Date/owner/base: 2026-07-15, Codex implementation owner; audit, purpose suite, and workflow-oracle- only diff atop exact clean evidence base 3fbf2339badb7bab0308a6daadb80e7d5444e280.
• Command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-posix-system-ssh-openssh-full-size.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected RED, exit 1. The purpose-named live suite declares its single case skipped because the seven full-size/OpenSSH inputs are absent locally and earns no transfer evidence. The workflow oracle passes 8/9 existing cases and its only failure is expected undefined to be defined for the audited restricted POSIX system-SSH start step; measure and stop are consequently absent too.
• Resource evidence: Vitest 1.50 seconds, 3.73 seconds real, 143,818,752-byte maximum RSS, 96,146,808-byte peak memory footprint, zero swaps and block I/O.
• Disposition: RED is causal and accepted. Add only the second loopback daemon, restricted primitive wrapper, exact known-host pin, purpose measurement, and always-run cleanup steps. No production, product/default, fallback, tuple, publication, tar optimization, Windows transfer, or SignPath change is authorized by this evidence.

E-M6-POSIX-SYSTEM-SSH-TREE-LIVE-LOCAL-001 — bounded live fixture package is locally green

• Date/owner/base/runner: 2026-07-15, Codex implementation owner; uncommitted test/workflow/docs package atop exact base 3fbf2339badb7bab0308a6daadb80e7d5444e280 on Apple arm64, macOS 26.2 build 25C56, Node 26.0.0, pnpm 10.24.0. The local Node version is newer than the repository's Node 24 contract, so exact-head native workflow evidence remains mandatory.
• Package: add one purpose-named live/full-size test and three audited Linux-only artifact-workflow steps. The fixture starts a second stock loopback sshd, pins the generated host key, permits only public-key authentication, and forces a wrapper whose PATH contains only mkdir, chmod, cat, and rm while invoking absolute /bin/sh. The test uses the exact native runtime tree and existing production system-SSH composition to measure default-one and explicit-four transfer, exact tree bytes/hashes/modes/paths/counts, exclusive-root collision preservation, cancellation settlement, no later progress, owned-root cleanup, post-cancellation connection usability, latency, RSS, and active-file count. No production module changes.
• Targeted command: pnpm exec oxfmt --check for the new test, workflow oracle, and artifact workflow; pnpm exec oxlint for the new test and oracle; then /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-posix-system-ssh-openssh-full-size.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs. Result: formatting/lint pass; the workflow oracle passes 9/9 while the one live case is explicitly skipped because its seven CI inputs are absent. Vitest 12.53 seconds; 25.90 seconds real; 131,907,584-byte maximum RSS; 96,146,904-byte peak footprint; zero swaps and block I/O. The skip earns no live/full-size transfer evidence.
• Focused composition command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the control/tree/file-destination/system-channel, source-tree/scan/stream, system-fallback, connection, and workflow-oracle suites. Result: 10 files, 220 passed and one declared platform skip; Vitest 13.07 seconds; 14.67 seconds real; 178,061,312-byte maximum RSS; 96,277,904-byte peak footprint; zero swaps and block I/O.
• Broad relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts. Result: 50 files passed, five files skipped; 656 passed and seven declared skips out of 663. Vitest 59.16 seconds; 64.28 seconds real; 269,565,952-byte maximum RSS; 96,114,160-byte peak footprint; zero swaps and block I/O. The new live case is one of the declared skips and is not counted as proof.
• Release-contract command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs. Result: 50 files and 282/282 cases pass; Vitest 35.69 seconds; 39.36 seconds real; 190,201,856-byte maximum RSS; 96,638,376-byte peak footprint; zero swaps and block I/O.
• Static evidence: /usr/bin/time -l pnpm typecheck passes in 6.13 seconds real with 1,241,317,376-byte maximum RSS and 96,163,192-byte peak footprint. /usr/bin/time -l pnpm lint passes in 36.12 seconds real with 2,111,471,616-byte maximum RSS and 95,868,232-byte peak footprint; its 26 warnings are pre-existing outside this diff. Full lint proves switch exhaustiveness, 41 reliability gates, the 355-entry max-lines ratchet with no new bypass, bundled guides, and all localization checks. Standalone max-lines and targeted formatting pass after formatting this ledger entry; the new test is 377 lines with no suppression.
• Isolation evidence: git diff --check passes; git diff --exit-code HEAD -- src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-resolution.test.ts is empty. An asserted non-test reference search finds the tree-transfer export only in its owning production module; this package adds no product importer. The intended diff is limited to the live test, artifact workflow, workflow oracle, and both checklist documents. No settings, Beta, legacy uploader, fallback, tuple, publication, default-path, or signing behavior changes.
• Residual boundary: local execution does not supply a Linux OpenSSH daemon or the exact full-size native runtime, so exact-head Linux x64/arm64 live metrics and all-six adjacent native regression cells remain required. High RTT, MaxSessions=1, cross-family remotes, Windows transfer, primitive probe/cache, remote bundled-Node verification/install/publish/launch, product/Beta/fallback/default wiring, tuple enablement, publication, Apple signing, and SignPath remain absent.

E-M6-POSIX-SYSTEM-SSH-TREE-LIVE-CI-001 — exact-head restricted OpenSSH proof

• Date/owner/head: 2026-07-15, Codex implementation owner; exact head cdc25b2d1339fae9c4508b5b7453bb77fe9b9abc on draft PR #8741. Implementation commit a56dded6ff0b10046e58e8ff2a3a99b8d6578291; the exact-head follow-up cdc25b2d1339fae9c4508b5b7453bb77fe9b9abc changes only Markdown formatting. Artifact run 29524562239 uses Node 24.18.0 and stock OpenSSH_9.6p1 Ubuntu-3ubuntu13.18 on both live cells.
• Linux x64 live job 87709667467: Ubuntu 24 image 20260714.240.1, X64; tuple linux-x64-glibc, content sha256:fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d, 34 files and 124,846,430 bytes. The default-one transfer takes 976.400 ms with 4,415,488 incremental RSS bytes and peak active files 1. The explicit-four transfer takes 677.967 ms with 1,777,664 incremental RSS bytes and peak active files 4. Cancellation settles in 27.553 ms with 3,538,944 incremental RSS bytes and one progress update. The full purpose case passes in 3.84 seconds.
• Linux arm64 live job 87709667417: Ubuntu 24 arm64 image 20260714.61.1, ARM64; tuple linux-arm64-glibc, content sha256:96f07f62af9b35304bb8ca0870ca4d8095e059bfa61dd1bc57e81b20f3fbca67, 34 files and 122,865,324 bytes. The default-one transfer takes 796.017 ms with 4,956,160 incremental RSS bytes and peak active files 1. The explicit-four transfer takes 568.454 ms with 1,048,576 incremental RSS bytes and peak active files 4. Cancellation settles in 15.614 ms with 131,072 incremental RSS bytes and one progress update. The full purpose case passes in 3.23 seconds.
• Boundary proved in both live jobs: the forced remote environment exposes only absolute /bin/sh, mkdir, chmod, cat, and rm; host trust uses the generated pinned key and public-key-only loopback OpenSSH. Each job verifies every exact path, byte, SHA-256, mode, file/byte aggregate, default-one/four-channel bounds, preservation of a complete tree after exclusive-root collision, cancellation after first bytes, no later progress, owned-root removal, and a still-usable authenticated connection. Both serial and concurrent incremental RSS values are below the 80 MiB ceiling and both cancellation settlements are below 10 seconds. The adjacent exact full-size SFTP case also passes in each job.
• Six primary native contract cells pass at this exact head: Linux x64 87709667467 and Linux arm64 87709667417 each report 96 files, 826 passed/one declared skip; Darwin arm64 87709667400 and Darwin x64 87709667493 each report 96 files, 825 passed/two declared skips; Windows x64 87709667451 and Windows arm64 87709667453 each report 97 files, 813 passed/18 declared skips. The live test is skipped off Linux and earns evidence only from the two explicit live steps.
• Adjacent artifact cells: Linux arm64 oldest-userland supplement 87710915918, Linux x64 supplement 87710916014, and Windows x64 floor 87711893263 pass. Windows arm64 floor 87711893219 is the only artifact failure: the hosted image is Windows build 26200 while the contract requires 26100; platform and architecture pass and only osBuild is false. Before rejection it verifies the exact artifact digest, 60 entries/42 files/85,213,511 bytes, content sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, Node 24.18.0/ABI 137, resized PTY exit 23, watcher lifecycle, two-second resource settlement, 49,242,112 RSS bytes, 6,511.513 ms smoke, and 8,268.018 ms total. This is the declared hosted-runner gap, not a change regression.
• Repository/adjacent runs: PR Checks 29524562195, job 87709594108, passes. Golden E2E run 29524562284 passes Linux 87709594188 and macOS 87709594317. Computer-use run 29524562096 passes Windows and, on same-head failed-job attempt 2, Ubuntu 87713234187. Attempt 1 Ubuntu job 87709593614 passed its first two gedit cases but lost focus during paste-text with window_not_focused; the unchanged rerun passes the complete job, so no code or timeout change is attributed to that UI-focus flake.
• Disposition/residual boundary: this disconnected live package is complete. It proves native Linux loopback OpenSSH, not high RTT, MaxSessions=1, proxy jumps, cross-family remotes, primitive probe/cache, optional tar fast path, Windows transfer, remote bundled-Node verification/install/ publish/launch, product/Beta/fallback/default behavior, tuple enablement, publication, Apple signing, or SignPath. Legacy remains the only production/default path.

E-M6-WINDOWS-SYSTEM-SSH-FILE-AUDIT-001 — bounded per-file receiver contract

• Date/owner/base: 2026-07-15, Codex implementation owner; audit and purpose-test package atop exact base aba3f7c649b8412b40871d8c3a82938e0094739e.
• Scope: one disconnected per-file destination over the existing authenticated command-channel abstraction. The client sends one fixed PowerShell 5.1/.NET receiver command, then a bounded binary header containing protocol magic/version, strict UTF-8 path length, safe-integer payload length, and path bytes, followed by exact raw payload bytes. No path or payload is embedded in PowerShell source, a command argument, JSON, base64, or a whole-file buffer.
• Remote contract: use [Console]::OpenStandardInput(), strict UTF-8 decoding, a 64 KiB payload buffer, and FileStream with FileMode.CreateNew, FileAccess.Write, FileShare.None, and sequential-scan intent. Reject malformed headers, path bounds, early EOF, and one extra byte. On any post-create failure, close the stream before deleting only the file this receiver created.
• Lifecycle contract: extract the already-proven command-file write/EOF/cancellation/forced- settlement owner from the POSIX wrapper without changing behavior. Header acceptance is awaited before returning the Windows destination; a header/open failure is joined with bounded channel cleanup. The exact caller signal remains single-owned.
• Required RED/green proof: purpose cases for fixed command/path separation, exact header bytes, invalid input before channel open, retained-header cancellation, remote nonzero settlement, zero-byte and chunked binary payloads, collision preservation, early EOF/extra-byte cleanup, and a native Windows PowerShell 5.1 process oracle. Pin the suite exactly once in both native artifact workflow command families and update the workflow oracle before implementation.
• Explicit residual boundary: no Windows remote-tree/staging-root owner, case-collision scan, remote capability classification/cache, live OpenSSH remote, full-size/runtime measurement, endpoint- protection fault, long-path qualification, bundled-Node verification/install/publish/launch, product/Beta/settings/fallback/tuple/publication/default behavior, or SignPath is included. Legacy remains the only production/default path and every tuple stays disabled.

E-M6-WINDOWS-SYSTEM-SSH-FILE-LOCAL-RED-001 — audited destination is absent

• Date/owner/base: 2026-07-15, Codex implementation owner; purpose test, native-workflow wiring, and checklist-only diff atop exact base aba3f7c649b8412b40871d8c3a82938e0094739e on Apple arm64, macOS 26.2 build 25C56, Node 26.0.0, pnpm 10.24.0.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-windows-file-destination.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: the 9/9 native-workflow oracle cases pass and prove the purpose suite occurs exactly once in both native artifact command families. The purpose suite fails before collection solely because ./ssh-relay-runtime-windows-file-destination does not exist. This is the intended RED boundary; no production module has been added or changed.
• Residual boundary: no PowerShell behavior or Windows runner claim follows from missing-module RED. All audit, purpose, native Windows, POSIX regression, broad relay, static, and isolation gates remain required.

E-M6-WINDOWS-SYSTEM-SSH-FILE-LOCAL-001 — bounded receiver package is locally green

• Date/owner/base/runner: 2026-07-15, Codex implementation owner; uncommitted implementation, purpose-test, workflow, and checklist package atop exact base aba3f7c649b8412b40871d8c3a82938e0094739e on Apple arm64, macOS 26.2 build 25C56, Node 26.0.0, pnpm 10.24.0. The local Node version is newer than the repository's Node 24 contract, and the real PowerShell 5.1 purpose case is skipped off Windows, so exact-head native workflow proof remains mandatory.
• Implementation: extract the proven 250 ms graceful/2-second forced command-file lifecycle into ssh-relay-runtime-command-file-destination.ts while retaining POSIX error identity and all 25 POSIX purpose cases. Add a disconnected Windows wrapper with an at-most 32,788-byte header, 32-KiB strict UTF-8 path bound, safe-integer payload size, fixed encoded receiver command, 64-KiB remote buffer, CreateNew/FileShare.None/sequential-scan stream, exact EOF/extra-byte rejection, and owned-file cleanup. The existing legacy Windows uploader is unchanged.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the Windows purpose, POSIX control/file/tree, system-channel, source-tree/scan/ stream, system-fallback, connection, and workflow-oracle suites. Result: 11 files, 234 passed and two declared platform skips out of 236; 7.95 seconds real, 171,311,104-byte maximum RSS, 96,097,560-byte peak footprint, zero swaps and block I/O. The Windows file suite contributes 14 passed plus one macOS-skipped real-PowerShell case; the workflow oracle passes 9/9.
• Broad relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts. Result: 51 files passed, five files skipped; 670 passed and eight declared skips out of 678; 23.96 seconds real, 248,102,912-byte maximum RSS, 96,163,264-byte peak footprint, zero swaps and block I/O.
• Release-contract command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs. Result: 50 files and 282/282 cases pass; 14.35 seconds real, 189,628,416-byte maximum RSS, 95,769,976-byte peak footprint, zero swaps and block I/O.
• Static evidence: /usr/bin/time -l pnpm typecheck passes in 2.45 seconds real with 1,241,055,232-byte maximum RSS and 96,146,784-byte peak footprint. /usr/bin/time -l pnpm lint passes in 20.18 seconds real with 2,063,761,408-byte maximum RSS and 96,343,488-byte peak footprint; its 26 warnings are pre-existing outside this diff. Full lint proves switch exhaustiveness, 41 reliability gates, the 355-entry max-lines ratchet with no new bypass, bundled guides, and all localization checks. Targeted oxlint and oxfmt --check pass.
• Isolation evidence: git diff --check passes; git diff --exit-code HEAD -- src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-resolution.test.ts is empty. An asserted non-test reference search finds the Windows destination export only in its owning production module. The intended diff is limited to the generic lifecycle extraction, POSIX type/ wrapper delegation, system-channel type generalization, disconnected Windows module/purpose test, native workflow/oracle wiring, and both checklist documents. No legacy uploader, product importer, settings, Beta, fallback, tuple, publication, default-path, or signing behavior changes.
• Residual boundary: local execution does not prove that the fixed script parses or behaves under Windows PowerShell 5.1/.NET Framework 4.8. Exact-head native Windows x64/arm64 purpose proof and all adjacent native regression cells remain required. A Windows remote tree/staging owner, live OpenSSH, full-size runtime, endpoint-protection faults, long-path qualification, capability classification/cache, remote verification/install/publish/launch, product/Beta/fallback/default wiring, tuple enablement, publication, Apple signing, and SignPath remain absent.

E-M6-WINDOWS-SYSTEM-SSH-FILE-CI-001 — exact-head native PowerShell receiver proof

• Date/owner/head: 2026-07-15, Codex implementation owner; exact head 20f8aebb8b7b3b2e2731df36afb97c7b4a297fef on draft PR #8741. Artifact workflow run 29527086460; adjacent PR Checks 29527086453, Golden E2E 29527086508, and computer-use 29527086498 all complete successfully on that head.
• Native Windows x64 job 87718089673: requested windows-2022, resolved win22 image 20260714.244.1, X64, Node 24.18.0. The Windows destination suite passes 15/15 in 3.214 seconds; its real powershell.exe binary-fidelity/collision/exact-size case passes in 3.089 seconds. The primary contract set passes 98 files and 828 tests with 18 declared platform skips in 39.14 seconds.
• Native Windows arm64 job 87718089682: requested windows-11-arm, resolved win11-arm64 image 20260714.109.1, ARM64, Node 24.18.0. The Windows destination suite passes 15/15 in 3.674 seconds; its real powershell.exe case passes in 3.532 seconds. The primary contract set passes 98 files and 828 tests with 18 declared platform skips in 30.61 seconds.
• Other exact-head primary jobs pass: Darwin x64 87718089684, Darwin arm64 87718089798, Linux x64 87718089690, and Linux arm64 87718089769. Linux supplements 87719287527 and 87719287531 and Windows x64 floor 87720166503 pass. Rerunning failed jobs on the same SHA also reran dependency jobs; all six primary jobs and those three adjacent artifact jobs pass again.
• Windows arm64 floor attempt 1 job 87720166584 fails during an adjacent watcher smoke with watcher create exceeded 15000 ms after observing update; no timeout or watcher behavior was changed. Same-SHA attempt 2 job 87721893505 passes the complete 60-entry/42-file/85,213,511-byte runtime, content sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, Node 24.18.0/ABI 137, PTY exit 23/resize, and watcher create/update/delete smoke. It then rejects only hosted Windows build 26200 against the required exact build-26100 floor (platform=true, architecture=true, osBuild=false). This is the declared hosted-runner gap, not a package regression.
• Disposition/residual boundary: the disconnected per-file receiver package is complete. This proves a real local Windows powershell.exe process on native x64/arm64 clients, not OpenSSH transport to a Windows remote, the exact Windows PowerShell/.NET/OpenSSH minimum combination, full-size transfer, long paths, endpoint-protection locks, remote tree/staging ownership, capability classification, bundled-Node verification/install/publish/launch, product/Beta/fallback/default behavior, tuple enablement, publication, Apple signing, or SignPath. Legacy remains the only production/default path and every tuple stays disabled.

E-M6-WINDOWS-SYSTEM-SSH-CONTROL-AUDIT-001 — bounded staging control contract

• Date/owner/base: 2026-07-15, Codex implementation owner; audit-only package atop exact base 20f8aebb8b7b3b2e2731df36afb97c7b4a297fef.
• Scope: one disconnected fixed Windows PowerShell 5.1/.NET command accepting a bounded binary stdin request. Supported operations are exclusive staging-root creation, one declared child-directory creation, and owned-root cleanup. Root and child paths are strict UTF-8 length-prefixed fields; no path is embedded in PowerShell source, a command argument, JSON, base64, or unbounded input.
• Ownership/safety: rooted drive and UNC paths must pass client validation before opening a channel; manifest segments retain the existing reserved-name/case-collision rules. Root creation must fail if the target exists and must never authorize cleanup of that pre-existing tree. A later tree owner may request cleanup only after positive exclusive-root creation. Directory operations are parent-first and bounded; remote failures, cancellation, and cleanup settlement are all awaited.
• Required RED/green proof: fixed command/request framing, strict field bounds/UTF-8, hostile rooted paths rejected before channel open, exclusive collision preservation, Unicode directory creation, owned-root removal, nonzero remote settlement, retained-write cancellation, and native Windows powershell.exe execution. Pin the purpose suite exactly once in both native artifact workflow command families and update the workflow oracle before implementation.
• Explicit residual boundary: no file destination composition, tree streaming/concurrency, live Windows OpenSSH, full-size/runtime measurement, long-path qualification, endpoint-protection fault, primitive detector/cache, remote bundled-Node verification/install/publish/launch, product/Beta/ settings/fallback/tuple/publication/default behavior, or SignPath is included. Legacy remains the sole production/default path and every tuple stays disabled.

E-M6-WINDOWS-SYSTEM-SSH-CONTROL-LOCAL-RED-001 — audited staging control is absent

• Date/owner/base/runner: 2026-07-15, Codex implementation owner; purpose test, native-workflow wiring, and checklist-only diff atop exact base d24f877d96f07d691508cc686c0791a86d3dd308 on Apple arm64, macOS 26.2 build 25C56, Node 26.0.0, pnpm 10.24.0.
• Command: pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-runtime-windows-staging-control.test.ts config/scripts/ssh-relay-runtime-workflow.test.mjs.
• Result: expected failure in 1.39 seconds. The workflow oracle passes 9/9 and proves the new purpose suite occurs exactly once in both native artifact command families. The purpose suite fails before collection solely because ./ssh-relay-runtime-windows-staging-control does not exist; zero production modules are added or changed at this boundary.
• Residual boundary: no PowerShell staging behavior or Windows runner claim follows from a missing module. Purpose, native Windows, prior Windows/POSIX regression, broad relay/release, static, isolation, and no-product-consumer gates remain required.

E-M6-WINDOWS-SYSTEM-SSH-CONTROL-LOCAL-001 — bounded staging control is locally green

• Date/owner/base/runner: 2026-07-15, Codex implementation owner; uncommitted implementation, purpose-test, native-workflow, and checklist package atop exact base d24f877d96f07d691508cc686c0791a86d3dd308 on Apple arm64, macOS 26.2 build 25C56, Node 26.0.0, pnpm 10.24.0. The local Node version is newer than the repository's Node 24 contract and the real Windows PowerShell case is skipped off Windows, so exact-head native proof remains mandatory.
• Implementation: add one disconnected fixed encoded PowerShell receiver with an at-most 65,556-byte request, two independently bounded 32-KiB strict-UTF-8 path fields, operation byte and zeroed reserved bytes. Client validation rejects non-rooted, reserved, traversal, non-descendant, and oversized paths before channel open. The receiver rejects malformed framing/extra bytes, requires each direct parent to exist, uses fail-on-existing New-Item for root/directories, and removes only a root whose ownership is tracked by a later tree caller. Each operation has a 30-second ceiling and reuses the proven 250 ms graceful/2-second forced channel settlement.
• Focused command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 with the staging-control, Windows/POSIX file/control/tree, system-channel, source-tree/scan/stream, system-fallback, connection, and workflow-oracle suites. Result: 11 files, 207 passed and three declared platform skips out of 210; 8.85 seconds real, 184,500,224-byte maximum RSS, 96,818,624-byte peak footprint, zero swaps and block I/O. The staging-control suite contributes 16 passed plus one macOS-skipped real-PowerShell case; the workflow oracle passes 9/9.
• Broad relay command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 src/main/ssh/ssh-relay-*.test.ts. Result: 52 files passed, five files skipped; 686 passed and nine declared skips out of 695; 113.77 seconds real, 257,605,632-byte maximum RSS, 97,572,312-byte peak footprint, zero swaps and block I/O. This and the release/lint commands ran concurrently, so their wall times are recorded but are not standalone performance baselines.
• Release-contract command: /usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts --maxWorkers=1 config/scripts/ssh-relay-runtime-*.test.mjs. Result: 50 files and 282/282 cases pass; 81.81 seconds real, 189,317,120-byte maximum RSS, 96,146,808-byte peak footprint, zero swaps and block I/O. Two prior quoted-wildcard invocations found no literal file; they were command errors and were immediately replaced by these exact checklist commands.
• Static evidence: pnpm typecheck passes. /usr/bin/time -l pnpm lint passes in 78.78 seconds real with 2,106,277,888-byte maximum RSS and 96,081,152-byte peak footprint; its 26 warnings are pre-existing outside this diff. Full lint proves switch exhaustiveness, 41 reliability gates, the 355-entry max-lines ratchet with no new bypass, bundled guides, and localization checks. Targeted oxlint and oxfmt --check pass.
• Isolation evidence: git diff --check passes; git diff --exit-code d24f877d96f07d691508cc686c0791a86d3dd308 -- src/main/ssh/ssh-remote-node-resolution.ts src/main/ssh/ssh-remote-node-resolution.test.ts is empty. A non-test reference search finds the staging-control export only in its owning production module. The intended diff is limited to the disconnected staging-control module/purpose test, native workflow/oracle wiring, and both checklist documents. No existing file receiver, POSIX/SFTP transfer, legacy uploader, product importer, settings, Beta, fallback, tuple, publication, default-path, or signing behavior changes.
• Residual boundary: local execution does not prove Windows PowerShell 5.1 parsing, exclusive directory semantics, or cleanup on native Windows. Exact-head native Windows x64/arm64 purpose proof and all-six adjacent native regression cells remain required. File/tree composition, live Windows OpenSSH, full-size runtime transfer, long paths, endpoint-protection faults, capability classification/cache, bundled-Node verification/install/publish/launch, product/Beta/fallback/ default behavior, tuple enablement, publication, Apple signing, and SignPath remain absent.

E-M6-WINDOWS-SYSTEM-SSH-CONTROL-CI-001 — exact-head native staging-control proof

• Date/owner/head: 2026-07-15, Codex implementation owner; exact head 68737239b98d88c5b60995935fcadadb60bf5b43 on draft PR #8741. Artifact run 29529608561; PR Checks 29529608567, Golden E2E 29529608624, and computer-use 29529608564 all complete successfully on that head.
• Windows x64 job 87726531814: requested windows-2022, resolved win22 image 20260714.244.1, X64, Node 24.18.0. The staging-control suite passes 17/17 in 4.674 seconds; its real powershell.exe exclusive-root/Unicode/owned-cleanup case passes in 4.310 seconds. The primary set passes 99 files and 845 tests with 18 declared skips in 29.44 seconds.
• Windows arm64 job 87726531789: requested windows-11-arm, resolved win11-arm64 image 20260714.109.1, ARM64, Node 24.18.0. The staging-control suite passes 17/17 in 5.790 seconds; its real powershell.exe case passes in 5.439 seconds. The primary set passes 99 files and 845 tests with 18 declared skips in 34.11 seconds.
• First-attempt Linux x64 87726531841, Linux arm64 87726531859, and Darwin arm64 87726531848 pass. Darwin x64 87726531879 times out only in the adjacent ssh-relay-runtime-toolchain.test.mjs 30-second toolchain digest case. No timeout or product code changes; unchanged attempt-2 Darwin x64 job 87730137143 passes. Both Linux supplements 87731258107 and 87731258215 and Windows x64 floor 87728977786 pass.
• Windows arm64 floor jobs 87728977738 and unchanged rerun 87730137293 verify the complete 60-entry/42-file/85,213,511-byte runtime, content sha256:02edf462be83c2864a89546d5344d348f9e07ce10964660342608a8c614e47db, Node 24.18.0/ABI 137, PTY exit 23/resize, and watcher create/update/delete smoke. Both then reject only hosted build 26200 against required build 26100 (platform=true, architecture=true, osBuild=false). This remains the declared hosted-runner gap.
• Disposition/residual boundary: the disconnected staging-control package is complete. This proves native local Windows PowerShell semantics on x64/arm64 clients, not a Windows OpenSSH remote, full-size transfer, tree composition, long paths, endpoint-protection locks, primitive detection, remote verification/install/publish/launch, product/Beta/fallback/default behavior, tuple enablement, publication, Apple signing, or SignPath. Legacy remains the sole production/default path and every tuple stays disabled.

E-M6-WINDOWS-SYSTEM-SSH-TREE-AUDIT-001 — bounded disconnected tree composition

• Date/owner/base: 2026-07-15, Codex implementation owner; audit-only package atop exact base 68737239b98d88c5b60995935fcadadb60bf5b43.
• Scope: compose one verified Windows scanned source tree, the proven staging-control primitive, the proven per-file binary receiver, the source-stream scheduler, and the existing authenticated system-SSH file-channel adapter. Create one exclusive root, create declared directories parent-first, then stream each declared file to its exact descendant path. Default concurrency is one and the existing package maximum remains four; return only aggregate progress and counts.
• Ownership/lifecycle: mark the root owned only after exclusive creation settles successfully. Never clean a collision root. On every later failure or cancellation, stop and join source workers, then run bounded cleanup with a separate five-second signal and join any cleanup failure with the primary error. Every control/file channel uses the same operation signal; cleanup is the only deliberately separate bounded signal.
• Required RED/green proof: reject non-Windows trees, unsafe roots, non-system transports, invalid concurrency, and pre-abort before exec; exact root/directory/file request order and paths; exact bytes/counts/progress; default-one and maximum-four active files; collision preservation; directory and file failures clean only an owned root; retained-write cancellation settles before cleanup; cleanup timeout is joined below ten seconds; no later progress; and no production consumer. Pin the suite once in both native workflow command families before implementation.
• Explicit residual boundary: adapter-backed composition is not live Windows OpenSSH, a full-size runtime measurement, long-path or endpoint-protection proof, primitive classification/cache, remote bundled-Node verification/install/publish/launch, product/Beta/settings/fallback/tuple/ publication/default behavior, or SignPath. Legacy remains the sole production/default path and every tuple stays disabled.

Accepted Gaps

No product gap is accepted merely because it appears in this list. Each entry requires explicit owner and promotion condition.

Gap	Current behavior	Risk	Owner	Promotion/removal condition	Status
Bundled runtime only partially implemented	Six unpublished native artifact proofs; no production consumer	#8450/#1693 environment failures remain	Codex implementation owner	Complete Work Packages 2–7 plus Milestones 3–14	Open
No bundled tuple enabled	Every target's default and effective mode remains legacy	No bundled support claim can be made	Codex implementation owner	Complete target-native build/trust and both required live-evidence layers	Open
Windows runtime smoke incomplete	Native x64/arm64 smoke settles and uploads exact evidence	Historical blocker is closed	Codex implementation owner	Met by E-M3-WINDOWS-CI-001	CLOSED
Native clean-rebuild identity unproved	All six native cells pass exact clean-build equality	Historical blocker is closed	Codex implementation owner	Met by E-M3-REPRODUCIBILITY-CI-001	CLOSED
Cross-family Layer B remotes unavailable	GitHub native runner labels exist; no approved reachable target pool	Client/remote integration gaps may escape	Repository release administrator + implementation owner	Approve provider/snapshots/credentials/egress/teardown/cost owner	BLOCKED
Musl has no accepted official Node binary	Musl is deliberately legacy-only	Unofficial binary would break provenance trust	Codex implementation owner	Orca-owned target-native source build, signing, provenance, and live gates	ACCEPTED GAP
Native arm64 live matrices incomplete	Hosted Linux/Windows arm64 labels exist; full SSH/runtime cells do not	Cross-build or unit tests may hide native bugs	Codex implementation owner	Full native archive, trust, SFTP/system-SSH, RPC, and baseline evidence	Open
Legacy performance baseline unmeasured	Numeric budgets exist; paired cold/warm measurements do not	Regression thresholds lack a measured baseline	Codex implementation owner	Purpose-built paired harness with ten samples on pinned runner classes	Open
New rehearsal caller is not dispatchable	GitHub requires the workflow file on the default branch	Real Apple/SignPath/native-trust proof is gated	Repository release administrator + implementation owner	Reviewed PR is merged separately, then exact-source rehearsal passes	BLOCKED
Manifest signing environment unprovisioned	Ed25519/key-rotation policy exists; no protected runtime signing secret	Runtime assets cannot be safely published	Repository release administrator	Protected environment, reviewers, two test keys, rehearsals, and access audit	BLOCKED
Bootstrap primitives lack full live proof	POSIX/Windows contracts exist; bounded SSH implementations do not	Hidden dependency or transfer corruption	Codex implementation owner	Purpose-named full-size SFTP/POSIX/Windows system-SSH live suites	Open

Final Definition of Done

The project is not complete until every applicable item below is checked with evidence IDs.

• Milestone 0 legacy safety net is merged and live-proven.
• All Milestone 1 decisions are closed and reviewed.
• Artifact/manifest schema and full-runtime identity are implemented and hostile-input tested.
• Every enabled runtime tuple passes build, native, oldest-baseline, trust, and live SSH proofs.
• Relay artifacts are immutable prerequisites of every desktop build.
• Target-native builds, native signing jobs, and the fail-closed aggregate/manifest job pass all failure and recovered-draft rehearsals before desktop packaging.
• Every packaged desktop embeds the exact signed manifest whose bytes are published.
• Client download/cache/extraction passes online, offline, proxy, integrity, concurrency, and resource-failure gates.
• Every SSH transfer path is bounded, cancellable, no-tar-capable, mode-correct, and full-size tested.
• Remote installation uses full-tree verification and a structured, mode-qualified completion record.
• Declared POSIX/Windows bootstrap primitives, missing-command behavior, BusyBox variants, and no-remote-hash-tool behavior are live-proven.
• The primary path launches with bundled Node and performs no remote npm or HTTP operation.
• Fallback aborts and joins bundled work, uses separate state, and is race/failure tested.
• Every integrity/security failure fails closed in auto without automatic legacy.
• The exact online/offline/cache matrix is live-proven.
• Every relay RPC family, reconnect, reattach, upgrade, downgrade, concurrent-client, and GC contract passes through the packaged runtime.
• Security review, SBOM, provenance, key lifecycle, native signing, CVE ownership, and emergency refresh through a new desktop build/embedded manifest are operational; old clients stay pinned.
• Numeric performance and resource budgets pass on the required matrix.
• Draft release read-back and public direct-URL behavior pass for exact stable/RC/perf tags.
• Three consecutive qualifying RCs pass without unexplained fallback or relay regression.
• Stable soak and rollback criteria pass.
• Every accepted gap is closed or explicitly retained with owner, fallback, and promotion rule.
• HTML plan, this checklist, reliability-gate metadata, troubleshooting docs, and PR evidence are current.
• Legacy fallback remains unless a separate reviewed decision authorizes narrowing/removal.

Next Required Action

Write and run the purpose-named RED suite and native-workflow oracle for E-M6-WINDOWS-SYSTEM-SSH-TREE-AUDIT-001, proving failure solely because the audited production module is absent. Do not check the broad Milestone 6 Windows system-SSH item yet. Do not add an Electron/startup/product importer, per-target mode wiring, fallback, tuple enablement, release publication, or default behavior. Keep Node upstream .tar.xz inputs, Windows ZIP, ORCA_RELAY_PATH, existing desktop required-assets behavior, detached-signature byte encoding, Windows arm64 build 26100, macOS 13.5, Linux kernel 4.18, release-cut, desktop builds, publication, and every tuple separately gated.

Cross-family Layer B targets, the protected manifest-signing environment, oldest-baseline/native- trust cells, and the paired legacy performance baseline remain release/default-path blockers. No publication, desktop resolver, SSH transfer/install, per-target Beta, fallback, tuple enablement, or default behavior may be connected by this package.