test(hosts): align qualification regressions with updated #4201

[Green-hats]

Summary

Contributor follow-up to #4201, kept on Green-hats/loopx:niu/pr4201-fixes and merged into codex/native-goal-prompt-contract, not directly into main.

The original PR identified concrete shell-assignment, static safety/repair and release-environment isolation gaps. These fixes and the contributor's native-spawn/install-smoke tests are now shared with the evolving parent. This update merges the latest parent into the original fork without rewriting or dropping the contributor's commits.

The remaining content delta strengthens that native-spawn test: qualification must request the installed --bootstrap exactly once before spawning the host. It retains the real child-shell secret-isolation assertions. No runtime authority, scheduler state, prompt migration behavior or model-call default changes beyond the parent are introduced by this integration.

Validation

• Target base: codex/native-goal-prompt-contract at 08f597a39c051d9268f5ac5c9f437b5c8ea7bc8c.
• Tested revision: 7219dce91ebfb4e918b9d78e6f748b1634d96602.
• Run state: finished (local qualification).
• Input classes: synthetic, public_fixture.
• The integration tree differs from the parent only in the focused test; restored parent loader/migration contracts were checked during conflict resolution.
• 67 focused Python tests passed: native/Claude release-runner policy, real saved-loader CLI and bound stdio MCP paths, and real SQLite prompt migration/recovery. Focused Ruff and diff hygiene passed. No paid model call was made.
• No private host plans, credentials, transcripts, local paths or run logs are included. Model-backed release qualification is not claimed; the parent retains its explicit fix(host): recover vision settlement and preserve scoped replanning #4208 limitation.

Attribution and merge

Use a merge commit, not squash/rebase, to retain the contributor's original history and this PR's merged record. This supersedes the earlier plan to close the PR as merely incorporated. Parent #4201 still requires its own final review and validation before main.

[huangruiteng]

Thanks for refining this against the updated parent. I reviewed the latest head f7a6c26e23d4e7099e8df0e09b4ab188753e0501, not only the original patch.

The remaining independent delta is valuable: the native-spawn test verifies the isolated profile at the actual transport boundary (including a real secret-free child shell), and the install smoke needs the new standalone Turn-assignment assertion. Both are absorbed into #4201 with Co-authored-by attribution. The 13 native release-runner policy tests pass, without a model call.

The earlier static safety/repair, shell assignment and allowlisted-environment findings are already represented in the parent refinement. The storage decision remains deliberately narrower: matching a TOML heartbeat with a SQLite cron row is not sufficient evidence to convert scheduler kind or infer thread ownership. Consistently bound heartbeats now have a separate journaled update-time migration path; no everyday Codex auth/config/session import is introduced.

This avoids merging a second copy of the parent history while retaining your test contribution. #4201 carries the integrated verification and remaining release-qualification limitations; I will close this as incorporated once that parent is delivered.

[huangruiteng]

Reviewed final fork head 7219dce91ebfb4e918b9d78e6f748b1634d96602 against the exact parent 08f597a39c051d9268f5ac5c9f437b5c8ea7bc8c. No blocking findings in the remaining integration delta.

This is now a real fork-branch integration, superseding my earlier plan to close the PR as incorporated. The original contributor commits (9d7e3f9c, 5deda25e, f7a6c26e) remain in history. Resolving the overlap retains the current shared loader, explicit migration boundaries and qualified recovery behavior; no stale recipes or inferred cron ownership are restored.

The final base/head content delta is one test file (+8/-1): the contributor's native-spawn isolation test also verifies that qualification loads the installed bootstrap exactly once before spawning. This is a bounded companion refinement of the same host qualification boundary, not an extra runtime abstraction. Typed authority, domain-neutral execution rules, default-off paid execution and guidance/obligation semantics are unchanged relative to the parent. No provider or scheduler permissions are expanded.

Validation: 67 Python tests passed on this fork head, including actual saved-loader CLI, bound stdio MCP and isolated SQLite migration/recovery paths. Focused Ruff and diff hygiene passed; all original and new commits carry DCO sign-off. No private artifacts or real model calls are included. Existing parent live-model/vision qualification limits remain explicitly tracked in #4201/#4208.

With maintainer authorization, merging by merge commit into #4201's branch, preserving the original PR's merged record and contributor history. This does not merge #4201 into main or waive its remaining checks.