fix: deliver verified research files to synthesis

[afateen]

Summary

Deliver declared specialist research files into a dependent synthesis agent's own isolated workspace through the existing verified typed-artifact path.

Refs #297. This is a draft for coordination and verification, not a claim that the issue's acceptance criteria or pinned native Factory delivery contract are complete.

• Declare bounded note/probe outputs for new source-selected parallel-specialist plans while preserving legacy receipt-only contracts.
• Carry verified files through StartRun/ResumeRun with capability and current-epoch fencing.
• Validate paths, bounds, hashes and persisted write scope before safe workspace materialization; reject unequal existing content and preserve failed workspaces.
• Preserve dependency receipt history on durable replay and keep incompatible recoveries from blocking other runs.
• Add regression tests, a deterministic API-only fixture driver, and an explicit validation record.

Validation

• Workspace all-target type-check.
• Domain/protocol tests: 26 passed, zero failed or ignored.
• Native Windows dependency materialization tests: 23 passed, zero failed or ignored, after rebuilding the runner test target with bundled Rust LLD (see update below).
• Migration integrity: 41 immutable migrations.
• Rust formatting, staged diff whitespace and Node syntax checks.
• Three local fixture self-checks, including summary-only rejection and four-file readback. These use an explicit fixture copy, not the native materializer.
• Independent code review; two recovery/dispatch findings fixed and follow-up review found no significant issues in those fixes.
• Full native Rust test gates: the original GNU-linked server, runner and workspace-first CLI test executables exited with STATUS_ACCESS_VIOLATION before assertions. The LLD-built runner materialization suite now passes; server and full-workspace execution still need verification.
• SQLx and native full-stack consumption/authority regressions.
• Required browser-consumption/adversarial interfaces and trusted QA/source pins. The current driver is API-only.
• Canonical Clippy and web gates. The evidence record identifies an unchanged pre-existing Clippy diagnostic; npm access is confirmed blocked by local IT policy, so web dependencies cannot be restored here.
• Concrete owner/admin approval and native Factory qualification.

Review coordination

@rajesh-ms, you are the creator of #297; please verify the artifact/authority boundary and acceptance evidence when ready. After afateen accepted the collaborator invitation, GitHub accepted the formal review request to you. Issue #297 is now assigned to afateen, who is also this PR's author. The PR remains a draft, and independent outcome approval and the remaining acceptance gates are still outstanding.

@dstkwll: please flag overlap with #294's verifier-cache and workspace-preservation changes. No changes from that PR were copied.

The local Copilot workflow and helper-module scope were explicitly authorized by the contributor. The native controller allowlist and retained Factory execution/publication lane still need coordination; this draft does not substitute for that lane.

Evidence and scope

• Implementation overview
• Exact commands, source hashes, review findings and outstanding gates
• Investigation and acceptance context

Source base: b2523964e7576cafc00e84a51e1044f55826dea7. Candidate: ca15684b84710dbc6450c20b9117f62f89d38887.

No private transcripts, credentials, local tool installations or QA databases are included. No merge or deployment is requested.

Post-publication validation update

The actual runner unit-test target was rebuilt with Rust's already installed LLD linker. Its 23 Windows dependency_files::tests passed in 1.48 seconds: zero failed, zero ignored, 214 unrelated tests filtered out. Coverage includes exact bytes/replay, scope, size boundaries, aliases, unequal existing content, hard links, junctions and retained-handle concurrency.

The source checkout remains clean at ca15684b84710dbc6450c20b9117f62f89d38887. Runner test executable SHA-256: e82c236a86809e2e692e9fc889374ee31a7f34cfb1a464ba82e44110ab0e3c03. Materializer source SHA-256 remains 3777ad30ecdccd69cce7b40d6df08db33a1d380487081527eb9d89e316683927, matching the committed evidence record's working-file fingerprint.

With the Rust 1.94 GNU environment loaded, the build and test commands were:

$lld = Join-Path $env:RUSTUP_HOME 'toolchains\1.94.0-x86_64-pc-windows-gnu\lib\rustlib\x86_64-pc-windows-gnu\bin\rust-lld.exe'
cargo rustc --locked --offline -p crony-runner --tests -- -C "linker=$lld" -C linker-flavor=ld.lld
& .\target\debug\deps\crony_runner-c83486b9363eacc0.exe dependency_files::tests --test-threads=1

The test process used owned disposable TEMP/TMP directories. DEP and other OS protections were unchanged. The package-specific build also selected dependency feature variants, so this is not claimed as a byte-identical linker-only A/B diagnosis. It proves this candidate's native materialization tests, not browser, signed-artifact, SQL or full Factory acceptance. The committed evidence document retains the earlier GNU-linked results as a historical snapshot.

[afateen]

Browser-interface increment - September 17

Local commit c97b5e04b4f791e3ccf40d2d6fb4ed923a11e795 now adds the guarded --case browser-consumption --require-owned-qa interface. It requires the actual App to display the held mission, launch exactly once and download synthesis evidence matching the verified artifact bytes/digest. It checks candidate/source/binary/process/web-asset pins and rejects unexpected browser writes or scripts.

The parent verification reran 64/64 passing contract tests: nine new cases plus 55 existing owned-stack/source-identity cases, with zero failures or skips. Four Node syntax checks and whitespace/evidence-metadata checks also passed. The earlier 24/24 Rust materializer regression is retained; these counts are separate test families, not proof of end-to-end acceptance.

The committed tree exactly matches the verified working-tree fingerprint 591a9021592dc129dd321eb85602676e1d83a658. This commit is local only; published PR HEAD remains ca15684b84710dbc6450c20b9117f62f89d38887.

No browser, services, database, provider or Factory execution was performed for the interface increment. Real browser/runtime qualification requires an adopted, exact owned-QA context and qualified candidate processes/assets/tooling; private controller-schema compatibility is not asserted. --case adversarial still fails explicitly as unsupported, with no unit-test substitution. Its remaining implementation/fixture requirements are being clarified separately. R4/native qualification, broader contributor gates and actual independent owner/admin approval remain outstanding.

The PR remains draft. No push, merge, deployment or acceptance/closure claim is made.

Earlier materializer checkpoint (retained)

@rajesh-ms, a bounded local test increment now exercises the real Rust dependency-file materializer into the existing deterministic Node synthesis fixture. It checks consumption/replay of four declared files and rejects summary-only input and same-length file tampering.

The focused materializer family passed 23/23 at the existing candidate, then 24/24 with the new regression: one additional test, not 47 unique tests. The expanded run had zero failures/ignored tests and 214 filtered tests. Offline test build, formatting, fixture Node syntax and whitespace checks also passed.

Source boundary: published PR HEAD is still ca15684b84710dbc6450c20b9117f62f89d38887. The tested uncommitted local tree for this increment is 75599bd05c1313624cf07c7901bd1755961da579; it has not been pushed. Exact test/binary/fixture fingerprints and the patch are retained locally.

This is materializer/child-fixture regression evidence, not the required browser-consumption or adversarial end-to-end interface and not native Factory acceptance. I am continuing the guarded interface implementation separately. No server/database/provider was started for this increment; SQLx, workspace/Clippy/web gates, portable R4 fixtures and actual independent owner/admin approval remain outstanding.

Dan's bounded integration proposal has been acknowledged. Its combined-candidate evidence remains separate. The PR stays draft; no issue closure, publication, merge or deployment is implied.

[afateen]

Offline adversarial-fixture increment (not acceptance)

The AI-assisted test increment is committed locally as 5c83b654f0657c199932dac127f036da91cd8861, on the existing PR branch. Its committed tree exactly matches tested tree 12f9dc98fd0093cfb4deec1ef4ff66e8e388509e. Published PR HEAD is still ca15684b84710dbc6450c20b9117f62f89d38887; this update does not publish the code.

Verified results:

• Independent parent reruns passed 105/105 Node tests and 63/63 native unit tests, with no failures or skips.
• All 23 offline native case mappings are implemented and were exercised: 20 native rejection observations, one exact-limit control, and two explicitly unqualified cases. This is not 23 accepted cases.
• Native test fixtures are gated by cfg(test). Non-test production compilation, formatting, migration checks and strict runner Clippy passed. Offline SQL fixtures use a separate owned database, not the retained application stack.
• Setup errors, missing permissions, incomplete evidence and unsupported cases remain failures. The offline driver reports accepted:false and exits nonzero; it cannot substitute unit fixtures for live acceptance.

Two concrete qualification gaps remain:

1. destination-symlink: this Windows identity cannot create the native symlink (error 1314). A permitted symlink-capable host/identity is needed; no privilege escalation or simulated rejection was used.
2. parent-tree-isolation: the actual fake-process child could read the owned sibling-parent sentinel. The documented same-user runner model is not an OS filesystem boundary. Claiming parent-tree unreadability needs an agreed isolation design, such as separate execution identities/ACLs or a container boundary, not a fixture permission trick.

@rajesh-ms, the second point needs an explicit requirement/isolation decision before this acceptance claim can pass. It is a demonstrated gap against the stronger acceptance condition, not a claim that a worktree or job object provides a security boundary.

Broader strict Clippy remains blocked by an unchanged baseline store warning. Live browser-to-server-to-runner checks, full production-migration/HTTP identity qualification, R4 and independent owner approval remain outstanding. Earlier failed runs and the two unqualified observations are retained.

This supersedes the unsupported/adversarial-implementation status in the earlier checkpoint, not its historical results. The PR stays draft. No push, merge, issue closure, provider inference or Factory dispatch was performed.

[afateen]

Pinned main integration checkpoint

The author push of 5c83b654f0657c199932dac127f036da91cd8861 is verified. I have now completed two additional local merges, ending at 155dc9cc4df91f2d9a5372de0c2cc9446c58c89c, with exact tested tree f0c7263c31e3d54e5162c6cb1e0b32c6bb3240d5.

This integrates pinned main 30ec3fab6acd566cc1fc1e574c8a6343d0ce0596, including the landed #79 cost guardrails and #265 activity/finished-review changes. It does not integrate the separate #294 branch.

The first merge retained both sets of planner tests and added a combined handoff/cost-boundary regression. The second merge had no textual conflicts; the incoming activity UI and narrow finished-review behavior were retained without new production edits.

Validation for the final pinned candidate:

• Independent parent reruns: 367 Node tests (105 handoff + 262 web), 240 native unit tests, and this worktree's web build/lint passed.
• One opt-in native dispatcher is excluded from ordinary unit-test passes and exercised separately by the offline driver.
• The implementation worker passed 52 real PostgreSQL regressions, including finished-review, handoff/recovery and cost/connection/locking cases.
• All 23 offline native mappings ran again: 21 qualified observations and two unqualified cases. The latter remain Windows native symlink privilege and actual same-user sibling-parent readability.
• Nine synthetic browser component states passed. This is component evidence, not the real App-to-server-to-runner handoff acceptance.

Dependencies were restored from the exact approved cached graph after the missing-layout failure; tracked manifests/locks and supply-chain checks were preserved. Earlier failures and source-bound receipts remain retained.

accepted:false remains explicit. Core live TF-01/02/03 and independent owner review are not complete; stronger OS isolation is not claimed. Full workspace tests were not run, and strict Clippy retains the unchanged baseline warning. No private benchmark source or broader R4 acceptance is inferred.

The new merge commits are local only until the author pushes them. Published PR HEAD remains 5c83b65; therefore this is not a claim that GitHub's mergeability status has already changed. The PR stays draft. No push, remote merge, provider inference, Factory dispatch or #297 closure was performed.

The subsequent Dynamic agent teams lifecycle sequence is tracked under existing #48, not a duplicate epic.