Split Cave startup conformance diagnostics

[BunsDev]

Summary

• split the bounded Cave startup diagnostic into timeout, early-exit, health, and discovery subtypes
• preserve fixed public identifiers and prevent endpoint, path, PID, response, token, or child-output disclosure
• freeze the exact diagnostic source and refresh protected workflow metadata and run documentation

Test plan

• 36 focused Cave diagnostic tests
• 52 specification guards
• 95 workflow tests (19 skipped)
• 92 serialized authority lock tests (1 skipped)
• typecheck, lint, format check, and build
• independent code review

Final integrated head: 9dd25b0021a18361b64c02c2a3bda3abfdc6d4e8, preserving #229 quota-depth diagnostics and frozen source a0e13a30213496bdec88c1a6b88f632212bac762 / tree 1aa1d24ed6289667fec05037667c9480d5c16388. All 25 frozen file blobs and digests were independently checked. The roadmap now records landed Chat229/SDK212 and the approved, still-running protected run34670074847; this PR does not alter that run. CI34670529730 must pass at this head before an actual merge commit preserves the source ancestry. SDK rebinding and fresh protected subtype validation remain required. Chat and active worktrees are preserved.

Delivery checkpoint:

Chat #230 landed as verified actual merge 09410982d3a85cbfbcdf2d2d193c3a96e8e80f74. SDK #213 landed as verified squash 5e76d40a4056dae128c711c875ad8f9a5edbfe20, with merge tree identical to tested head 757ba1ed50e5707d021d3b833ffe28f83a7a5880. SDK CI 34671561530 passed: exact runtime 1,515 tests plus coverage and three stress seeds, both Node lanes, all native-keyring platforms and both CodeQL analyses. The initial unchanged Windows lock test failed with EPERM; a single same-head rerun passed 608 tests with two host skips. Original and rerun logs are retained; no source workaround or proven root-cause claim.

Repository and client-v1-conformance environment validator scopes both read back 5e76d40a4056dae128c711c875ad8f9a5edbfe20. Fresh protected run 34672157833 was dispatched at 04:07:05 UTC against Chat 09410982. Protected validation is pending; no aggregate or release acceptance is claimed. Prior run 34670074847 passed independent Linux/Darwin records with 197 ordered assertions each, but Windows failed closed at bootstrap-aggregate / directory-enumeration-depth-3-plus. Chat and active worktrees remain preserved.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

Splits Cave startup conformance diagnostics into stable, privacy-preserving subtypes and synchronizes related tests, locks, workflow metadata, and documentation.

Changes:

• Adds timeout, exit, health, and discovery diagnostic identifiers.
• Updates conformance tests and public allowlists.
• Refreshes authority pins, integrity metadata, and documentation.

File summaries

File	Summary
src/phase1-conformance.test.ts	Tests new diagnostic mappings.
src/phase1-conformance-lock.test.ts	Updates authority expectations.
scripts/phase1-schema-v2-producer.mjs	Classifies startup subtypes.
scripts/phase1-conformance.mjs	Allowlists public identifiers.
phase1-conformance.lock.json	Refreshes authority pins.
docs/roadmap.md	Records the conformance checkpoint.
docs/phase1-conformance.md	Updates diagnostic and authority documentation.
.github/workflows/client-v1-conformance.yml	Refreshes integrity metadata.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.