test(threads): integrate real-daemon authority and replay journeys

[BunsDev]

Current integration checkpoint: 8576f41

Artifact names now include the commit, workflow run, and attempt, matching the
already-isolated storage roots. Two diagnostic attempts at the same commit
previously produced identical names; both were preserved by exact artifact ID.
The naming change prevents ambiguous name-based selection. Thirteen workflow
guards pass; no daemon or harness behavior changed. Native CI 34489425644
passed, with 20/20 Windows target cases in 32.20 seconds and 152 selected
feature-unit cases. Artifact 10157780426 has a commit/run/attempt-qualified
name and 28 passed manifests, all clean merge
0d8ccfca1725475b5e45f2ec47d8c4c2c45bc89d. #1000 is implemented and verified
in this draft, but remains open for reviewed main integration.

Previous measurement checkpoint: 92b701a

#1001 adds bounded advisory remaining-budget samples around start/restart launch
and fixed store checkpoints for connection configuration, Ward, runtime schema,
main lock, main schema, and commit. Ordinary store initialization uses a no-op
observer. SQL, transaction ownership, durability, deadline accounting, retries,
cleanup, and authority semantics are unchanged.

Parent review and 37 selected lifecycle/store/logging regressions passed.
The complete 20-case target passed at the committed head in 18.16 seconds with
isolated artifacts and the committed Threads dependency. Native CI
34485088291 attempt 1 passed, including 20/20 Windows target cases in 40.18
seconds. Preserved artifact 10156032323 has 28 passed manifests, all merge
bec6c2bdcc951c1ba8e19d9dfb27feb1f0c48bc6, with 63 complete phase/budget
sequences. Before-launch remaining budget ranged from 1935 to 1995 ms;
after-launch ranged from 1928 to 1992 ms. The maximum cumulative
daemon-store observation was 1327 ms. These successful samples do not diagnose
the earlier failures. The one additional diagnostic Windows attempt also
passed. Its separate artifact 10156935220 has 28 passed current-merge
manifests and 63 complete sequences: remaining budget was 1946-1994 ms before
launch and 1940-1990 ms afterward, with a maximum cumulative daemon-store
observation of 653 ms. Neither attempt reproduced the failure. Deliberate
diagnostic repetition stops here; retained instrumentation can capture a
future occurrence. Neither green attempt resolves startup causation or proves
the first-attempt stability requirement.

The independently proven macOS socket-leaf repair landed on main through
#1003 as dabeab9556c2051890203620ac65685ce1d5156c, closing #1002 rather than
being held behind the Windows investigation. This draft already contains the
same production discovery change.
These diagnostics add I/O, including within the main
transaction, and can perturb timing. Launch timestamps represent log writes,
not sample times. No startup repair or production-readiness closure is claimed.

Previous integration checkpoint: 0c1b262

The preceding native run executed all 20 target cases successfully but failed
artifact upload because the action rejects parent-directory path segments.
This checkpoint initializes an absolute runner-temporary evidence root through
GITHUB_ENV before cache restore. Upload selects the same traversal-free
run/attempt path, including when preceding steps fail. Thirteen workflow guards
pass. Native CI 34482201141 successfully uploaded artifact 10154746631:
all 28 manifests identify actual merge
07b53a6ac3fc73621d1c643685e316c1c505eb43, with 26 passed and two failed
scenarios and no historical revisions. #1000's artifact-isolation criterion is
proven in this draft, but the implementation is not yet on main.

Overall CI is red: two initial startups in the feature-off workspace target
failed with a still-running child and a connection timeout. The subsequent
feature-enabled target passed 20/20 in 34.23 seconds, and 152 feature-unit cases
passed. These successes do not cancel the earlier failures. Retained failed
setup evidence is under investigation; neither the atomic schema correction
nor artifact isolation is claimed to have resolved startup reliability.
No daemon code changed in this checkpoint.

Previous integration checkpoint: aa6bdfa

#1000 isolates Windows evidence outside both the checkout and build cache, with
a distinct root per workflow run and attempt. All test invocations and the
always-run upload use the same root; missing artifacts still fail. Local output
defaults, daemon behavior, deadlines, and authority semantics are unchanged.

The target now contains 20 cases: 15 real-daemon journeys and five artifact
regressions. The complete local target passed at this committed head using the
isolated root, producing 23 passed scenario manifests with exact clean-checkout
provenance. Thirteen workflow guards passed. This local run used the committed
Threads dependency, not the separate current-checkout override described below.
Native CI 34480282352 executed 20/20 Windows target cases in 38.26 seconds,
with workspace and feature-unit steps also passing. Its artifact-upload step
failed on the parent-directory path pattern; no daemon artifact was published.
That failure is addressed in the current checkpoint above, not hidden by a retry.

Previous integration checkpoint: 0883d6d

This checkpoint integrates the isolated #998 atomic runtime-evidence bootstrap
correction without importing unrelated main changes. The five existing DDL
statements now commit together; rollback preserves caller-owned transactions
and handles commit-time contention. Schema bytes, immutable triggers, legacy
migrations, durability, and startup deadlines are unchanged.

Deterministic late-DDL and commit-failure regressions were red before repair.
All 28 coupled schema/migration/immutability/fingerprint/concurrency cases pass
in the component and integration. The combined target also passes 18 cases
locally with current Threads fdcd755 proven active (15 daemon journeys plus
three artifact regressions). Native CI 34477970475 passed at this head,
testing merge 63d1f339fb32ab53e6ab3cf18bd85b921bd184de. Windows executed
18/18 target cases in 32.46 seconds and 152 selected feature-unit cases.
The required PR gate passed; macOS was skipped by CI classification, so the
current-checkout local macOS evidence above remains separately identified.

Artifact 10152986441 contains 28 current passed manifests and 28 historical
manifests restored from the build cache. Only manifests with the exact current
merge SHA count as this run's evidence. The same contamination exists in the
baseline artifact. #1000 tracks run/attempt-isolated artifact storage outside
the build cache; raw artifact-directory totals are not acceptance evidence.
Hosted Windows used committed Threads c3bd46b, not the local checkout override.

After filtering by current merge, the corrected run has 63 observations per
startup phase: maxima of 514 ms for store initialization, 653 ms for the full
daemon-store phase, and 55 ms for status publication. These are observations
from one successful run, not independent stability trials or a controlled
performance comparison. The independently scoped schema fix landed on main
through #998 as ce5e7b1367b2b15cc016b37a546f358685d05130.

The preceding instrumented native run 34475643557 passed. Its recorded maxima
were 764 ms for store initialization, 924 ms for the full daemon-store phase,
and 86 ms for status publication. These successful samples do not establish
the earlier timeout cause or justify a deadline increase. The atomicity defect
is independently proven; startup reliability remains a separate acceptance gate.

Previous measurement checkpoint: 5443212

The retained failing subscenario was initial startup, before any policy
mutation, with only preliminary SQLite schemas visible. This checkpoint adds
fixed-category monotonic timing around store initialization and status
publication through the existing bounded recovery log. Logging remains
advisory; startup ordering, ownership checks, and the two-second budget are
unchanged. Native run 34475643557 must supply the timing evidence before a
store or timeout correction is justified. No production startup fix is claimed.

Previous diagnostic checkpoint: e273bf2

This checkpoint repairs proven startup evidence loss, not an unproven Windows
runtime cause. Failed CLI events and available sanitized status, recovery,
pending/workspace, and SQLite evidence are retained before fixture cleanup.
Fallback markers no longer overwrite partial captures. Windows readiness
errors retain child running/exited observation and a bounded last-probe
category; strict identity checks and the two-second deadline are unchanged.

Seven focused lifecycle units and all 18 target cases pass locally: 15 actual
daemon journeys plus three artifact regressions. The evidence-retention case
was red before repair. Hosted run 34470804698 attempt 1 passed full CI and
18 native Windows cases, but the explicitly labeled second diagnostic attempt
reproduced a startup failure in the scheduled replay/restart journey (17/18).
The retained error now reports child=still-running and
last_readiness=connect-timeout; exact subscenario/state diagnosis is active.
Neither the first green result nor a future rerun is treated as a startup fix.
Cleanup can still lack a discoverable child when no status was published;
no unsafe PID-only fallback was added.

Previous combined checkpoint: d4653f1

This head reconciles landed main/#993 diagnostics and the bounded #996
adoption-fixture correction. The two timed fixtures now initialize SQLite
during arrangement, matching real daemon startup, and assert readiness through
the non-initializing helper. Their deadlines and concurrency/authority/lock
assertions are unchanged. A deterministic assertion-only red exposed missing
tables; the repair proves fixture readiness, not a production timeout cause.

At published d4653f14, 41 combined adoption/identity/final-commit unit cases
pass. All 15 real-daemon journeys pass default-parallel (20.30 seconds) with
current Threads 2d21254d5afeefb7894d0c776d4eae82850cd1bb proven active through
Cargo metadata. The ephemeral override and lock delta were removed.
Hosted run 34466364843 now passes the Windows workspace and clock-feature
unit steps, but the real-daemon target fails 4 of 15 journeys on startup-health
timeouts. The affected journeys are clock restart, final-commit identity drift,
reviewed human approval, and bounded human apply. The overall PR gate remains
red. Exact artifact-based Windows lifecycle diagnosis is active; no timeout
increase, retry-only success, or serialization is presented as a repair.
The earlier Windows result below is not inherited.

Previous native checkpoint: fd610f6

0ce3af5 adds a bounded 30-minute Windows CI job budget. Run 34457192778
at a9347cc passed Linux and the other applicable jobs, but Windows exhausted
its previous 20-minute job cap while compiling the feature profile after a
16-minute workspace run. Its feature-enabled daemon step was skipped; the
smoke artifact is not native acceptance. Runtime deadlines are unchanged.
Run 34460583889 then stopped at the separate Windows prompt-delivery kill
unit's channel timeout (#992), before feature journeys. fd610f6 executes
both feature steps unless cancelled, preserving the workspace failure and
30-minute job cap.

Run 34461979876 now executes all 15 native Windows daemon journeys:
15 passed, none ignored or filtered, in 70.06 seconds. All 23 downloaded
scenario manifests passed, including final-commit identity drift. The actual
tested merge is 6daed594ffb36eea681adce0da090adaef48f812, combining main
efaf948a8a6f8b9abfe5bca7b1e661cb0cebdc01 and head fd610f6.
Windows used committed Threads c3bd46b, not the separate local override.

Overall CI is still red: two Windows adoption-lane workspace tests timed
out before the independently successful Threads steps. Evidence is coordinated
on #855. Neither those failures nor the PR gate are suppressed.

This draft now combines #978 (native Windows/client parity), #979 (final
validated-authority commit binding), and landed main 24774353. The component
PRs preserve reviewable history; do not merge their overlapping changes again.

The combined fixture initially failed compilation because the final-commit
case still called the removed Unix-only helper and used unconditional Unix
file modes. a9347cc repairs that integration using the shared authenticated
client and one portable private fixture writer.

• Native and Windows-GNU feature-enabled fixture compilation pass.
• Current Threads 16ad832c44d7247823122af263c7e86aff880d01 is proven active
  through Cargo metadata, with source null and the expected local manifest.
• The initial combined target was red (14/15) on a startup identity diagnostic.
  Diagnostics proved macOS canonicalization retained the temporary hard-link
  staging name after its removal, although the published socket retained the
  authenticated device/inode. 42f5e71 preserves the selected published leaf
  beneath the canonical home without relaxing any ownership/identity checks.
• A real-socket regression is red before repair and green afterward.
  All 47 client health cases pass. At committed 42f5e71, all 15 daemon
  journeys pass default-parallel with the proven current Threads override
  (64.85 seconds), including restart and final-commit identity drift.
• Fifteen selected identity-predicate/final-commit unit regressions pass.
• Independent integrated authority review at 0ce3af5 found no significant
  introduced correctness issues in the four production binding/recovery
  files. This is engineering review, not Nova/Val approval.
• Integrated native Windows journey evidence is now available as above;
  complete workspace/PR acceptance remains blocked. Earlier test: extend shared Threads daemon journeys to Windows #978 component
  evidence is retained only as historical evidence.

All platforms now compile the same 15 daemon journeys. #979 originally counted
16 because its Unix fixture retained a separate HTTP parser test; #978 moved
framing coverage to the production-client tests.

The local Cargo patch and lock delta were removed and are not in this commit.
The broader local client-library run had four existing checkout-relative
socket-path-length failures; this is not presented as a full local suite pass.
The Threads required stable pin, full-contract acceptance, Cave live
acceptance, Nova coherence review, and Val freeze remain open. The actively
owned #984/#988 status-file repair is not imported.

Historical checkpoint: objective and scope

Integrate the real-daemon Threads acceptance work for #884, #885, #886, #887,
and #888. This draft now contains the coordinated implementation stack, not
only the original smoke fixture. Earlier accepted engineering checkpoint:
345d4cf0c2314ab70cbf843fee84e0db7776ec6d.

The separate drafts #932, #933, #968, #969, #970, #972, and #973 preserve
reviewable component history. This branch includes their relevant changes,
explicit supersession, and additional cross-lane production repairs. Do not
blindly merge overlapping drafts as independent changes.

Acceptance evidence

• Actual checkout-built daemon, owner-local IPC, unique synthetic homes,
  filesystem, SQLite, pending state, and captured source provenance.
• Current Threads checkout is proven through Cargo metadata, not assumed
  from the dependency declaration.
• Canonical repository-generated retired-Ward case passes actual migration,
  classified intake, exact minimum visibility, persisted logical time,
  restart, deadline replay, and exactly-one apply.
• All five typed terminal families are exercised through the real daemon:
  applied, vetoed, evidence diverged, revalidation failed, and superseded.
• Explicit replacement is verified by the daemon, persisted for recovery,
  and cannot silently become an ordinary veto if its durable fields corrupt.
• Human/no-window approval remains valid; contradictory human-path plus
  real opened-window history is rejected rather than normalized.
• Reviewed drift cannot overwrite materialized bytes; response, pending
  envelope, and submission audit bind the same classification/replay digest.
• Identity checks run before reviewed/logged intake and during replay;
  changed or unavailable authoritative evidence cannot apply.
• Changed/removed effective regional approval policy and rotated principal
  binding cannot reuse the old delayed decision after restart.
• Unsupported duplicate-surface corpus input fails closed.
• Bounded human approval includes authoritative validation and the logged
  companion's exact previous/next hashes and byte count.
• Feature-enabled daemon journeys are wired into Linux and the existing
  macOS push CI lane.
• Windows executes the same nonzero daemon journeys with isolated evidence;
  this establishes execution coverage, not sustained startup reliability.
• Full J1-J8 contract acceptance, including changed runtime bindings and
  every atomicity/TOCTOU assertion.
• Signed principal-authorization profile, Windows first-attempt reliability,
  Cave live acceptance, and the reviewed Threads required-pin gate.
• Independent Nova coherence review and Val freeze.

The suite uses the strongest currently supported owner-local authorization
path. A submitted fingerprint is not protected-write authority. The first two
unchecked items are limitations, not claims that a descriptor or fixture can
replace missing authority.

Production failures exposed by the real boundary

Captured red evidence preceded the corresponding production fixes:

1. Protected proposal intake admitted claimed fingerprints and lacked a
   durable non-authorizing refusal audit.
2. Supported retired-Ward intake downgraded reviewed files to immediate logged
   writes rather than publishing scheduled evidence.
3. Identity predicate failure left an opened window retrying without a close.
4. A pending principal label overrode a rotated live Ward binding.
5. Explicit replacement incorrectly closed as ordinary veto.
6. Non-protected intake skipped configured identity predicates entirely.
7. A strengthened live veto policy did not invalidate the old pending policy.
8. Unix startup published the socket before applying private permissions
   (Daemon Unix socket is visible before owner-only permissions are installed #974). It now publishes an already-private socket without clobbering a
   raced path; client ownership checks and lifecycle deadlines are unchanged.

The Windows startup fix also handles the precise pre-connect timeout without
retrying unrelated identity, protocol, or permission failures. The affected
#933 lineage at 3d2c06d0 passed full hosted CI, including Windows:
https://github.com/OpenCoven/coven/actions/runs/34394040609.
The authenticated Ubuntu-only dependency repair passed full hosted CI at
c731cada: https://github.com/OpenCoven/coven/actions/runs/34388895012.
These results do not substitute for this new integration head's own hosted run.

Historical baseline commands and results

With the current Threads checkout at
c3bd46bcadb6396db8436c47411a4d0eac17192b:

CARGO_INCREMENTAL=0 cargo test --locked -p coven-cli --bin coven \
  --features threads-test-clock -- threads_ identity_predicate_ retired_ward_ \
  scheduled_ post_familiar_edits_ piped_prompt_failure_overrides_successful_root_exit
# 218 passed

COVEN_THREADS_E2E_REQUIRE_LOCAL_OVERRIDE=1 CARGO_INCREMENTAL=0 \
  cargo test --locked -p coven-cli --test threads_e2e \
  --features threads-test-clock -- --nocapture
# 15 passed, repeated successfully three times after socket-publication repair

CARGO_INCREMENTAL=0 cargo test --locked -p coven-cli --bin coven \
  --features threads-test-clock -- daemon::tests::bind_api_socket \
  daemon::tests::windows_start_wait daemon::tests::write_status_and_socket
# 13 passed

CARGO_INCREMENTAL=0 cargo clippy -p coven-cli --all-targets \
  --features threads-test-clock -- -D warnings
cargo fmt --all
python3 scripts/check-ci-workflow-test.py
# 11 passed
python3 scripts/classify-ci-changes-test.py
# 19 passed
bash scripts/check-workflows.sh
python3 scripts/check-secrets.py
python3 scripts/check-coven-privacy.py --staged
# all passed

One of the 15 daemon tests contains an eight-scenario replay/restart loop.
These are actual nonzero selectors, not zero-test --exact invocations.
Per-run sanitized provenance/JUnit and failure bundles are under
target/e2e-artifacts/<run-id>/. The local Cargo override and corresponding
lock delta were not committed.

Hosted full-suite follow-up at c226656d found one fixture mismatch
(2,973 passed, one failed, three ignored): the protected-region scheduling
fixture still declared a different name than its synthetic source. 345d4cf0
corrects the fixture while retaining the original scheduling-refusal assertion.
The unrelated prompt-pipe test also accepts its existing during-write
termination outcome without relaxing failed status, root-exit diagnostics,
cleanup, or deadlines. The final head 345d4cf0 passed full hosted CI, including the feature-enabled
Linux daemon target, Windows workspace suite, Rust lint, and PR gate:
https://github.com/OpenCoven/coven/actions/runs/34396479737.
The scoped publication head e139023f also passed full hosted CI:
https://github.com/OpenCoven/coven/actions/runs/34396479783.

Independent read-only engineering review of api.rs and threads_gate.rs
reported no high-confidence introduced correctness bugs. This is not the
independent human coherence/freeze decision.

Canonical sources and ownership

Consulted Threads AGENTS.md, agent/manifest.yaml,
specs/PHASE-5-APPROVAL-SEMANTICS.md, public approval/identity/audit contracts,
the generated retired-Ward corpus, docs/testing/e2e-contract.md, and
e2e/compatibility.toml. Exact implementation surfaces include Coven
api.rs, threads_gate.rs, ward.rs, ward_identity.rs, ward_migrate.rs,
threads_clock.rs, daemon.rs, client transport errors, and
tests/threads_e2e.rs; source-adjacent references and CI are updated.

Threads remains the validator/schema owner. Coven owns every filesystem,
SQLite, staging, scheduling, transport, and recovery effect. No new audit
store, audit schema, familiar identity model, or protected-write route is added.

Compatibility, rollback, and remaining uncertainty

The Threads stable compatibility pin remains
39feb6de98816d10b490091e918f62035e6ce0df; it was not advanced to this draft.
The clock is opt-in and disabled in production builds. Identity declarations
remain active after migration, with the original Ward backup retained.
Existing unclassified envelopes retain legacy handling without inventing
regional policy. Ambiguous post-apply recovery remains explicit manual
recovery, never a fabricated successful terminal.

Rollback must preserve the database, pending claims, and Ward backup.
Older daemons cannot recover the additive durable replacement fields:
drain or explicitly recover those in-flight claims before downgrade.
Unix socket staging uses an existing locked tempfile package as a Unix runtime
dependency; publication requires same-directory hard-link support and fails
closed if unavailable.

No main merge, compatibility certification, release, human coherence approval,
or freeze is authorized by this packet. Refs #884 #885 #886 #887 #888 #974;
Threads execution epic threads-8pz.

[BunsDev]

Checkpoint 99a27e6 hardens the advisory fixture after CI/review:

• adds the required source-adjacent docs ownership metadata;
• canonicalizes Cargo manifest/workspace paths so /tmp vs /private/tmp does not break dependency proof on macOS;
• rejects incomplete HTTP headers and truncated Content-Length bodies;
• emits the complete artifact directory shape for setup failures with explicit unavailable/null provenance markers;
• adds a regression for truncated daemon responses.

Focused E2E now passes 4/4 tests. The remaining dependency-audit failure (der 0.8.0 yanked through fastembed/ort) is present across #931-#933 and is not introduced by this branch.

[BunsDev]

Cody agent review checkpoint - 2026-09-09 (local, unpublished)

The remote head is unchanged. The local test/884-threads-real-daemon follow-up
changes only crates/coven-cli/tests/threads_e2e.rs.

Added reusable same-home start/stop/restart/crash helpers and success-run
provenance. The lifecycle journey now includes restart from a stopped state,
requires a running-process restart to replace its PID, and arms cleanup before
launch attempts. Stale remembered PIDs no longer prevent discovery of a replacement
process. Artifact checks can fail the manifest/JUnit coherently rather than leave
a false passed result; fixture paths are sanitized in logs and responses.

Evidence:

• cargo test --locked -p coven-cli --test threads_e2e -- --nocapture: 5 passed
  against the unchanged historical c102844 dependency.
• With a temporary Cargo patch and
  COVEN_THREADS_E2E_REQUIRE_LOCAL_OVERRIDE=1, the same target passed all 5 cases
  against Threads c3bd46bcadb6396db8436c47411a4d0eac17192b.
  cargo metadata first proved source = null and the exact current-checkout
  manifest path. Four daemon journey manifests then recorded override active,
  the current Threads SHA, and result = passed.
• cargo clippy --locked -p coven-cli --test threads_e2e -- -D warnings,
  cargo fmt --check, and git diff --check passed.
• The temporary Cargo config and lockfile changes were restored byte-for-byte,
  and the historical-pin target was rerun successfully.

This is real-process smoke/lifecycle evidence, not full J1-J8 conformance. The
stable required pin still lacks the target. Supported scheduled publication,
deterministic daemon time, and the terminal/protected production journeys remain
separate work. No production changes from #932 or #933 were imported.

Authority/privacy/compatibility impact: test harness only, synthetic fixtures,
no new authority endpoint, schema, migration, dependency pin, or audit store.
Sources consulted include both repository instructions, the Threads E2E
contract, compatibility manifest, and the existing PR handoff.
Rollback is the isolated test-file delta. Remaining uncertainty includes
cross-PR integration and full required-pin acceptance.

Changes are uncommitted/unpushed; this comment does not claim the remote diff
contains them. Execution evidence is recorded in threads-av3.1.

[BunsDev]

Run 34470804698 passed all applicable CI at commit e273bf2. Windows results were real, not simulated: 18/18 cases green (15 daemon journeys plus 3 artifact regressions) in 52.25 s. All 28 downloaded manifests passed at synthetic merge ad716af (main 98cfa9ce + head e273bf2), with committed threads at c3bd46b. Separately, a local run with the current threads override fdcd755 also passed 18/18.

What this does and does not establish: it confirms the retention change is compatible. It does not show that the intermittent Windows startup failure is fixed.

Next step: one bounded additional native Windows diagnostic attempt against the same source, to exercise the newly retained observations. Its results will not be relabeled as first-attempt stability or as a retry-based repair.

[BunsDev]

The protected-intake slice is now independently ready in #933 at 79c94ec. It extracts only neutral real-daemon lifecycle/IPC support and seven protected/refusal/restart journeys from this branch, credits the original author, and imports no dependency pins or production consumer changes. Identical tests on unchanged main show 1 pass / 6 failures; the #933 head passes all seven. Once landed, the broader harness can reuse crates/coven-cli/tests/fixtures/threads_daemon.rs and avoid requiring the whole integration branch to obtain protected-route evidence. Full Phase-5/reviewed-pin/human acceptance is still not claimed.

[BunsDev]

Coordination from the issue-885 owner: #969 is ready at 93568a8, with protected exact-head auto-merge enabled pending native CI. It includes a standalone threads_identity_invariants target using the shared real-daemon fixture: 13 public intake/approval/restart journeys plus nine fixture tests. Four of those journeys reproduce real invalid writes on unchanged main aa527d2 while two valid controls pass; all 22 are green on the PR. Canonical identityEvidence binding and typed identity deadline refusal are now wired. Please integrate that dependency rather than duplicating the predicate adapter or restoring protected intake; the broader consolidated matrix and publication acceptance remain open.

[BunsDev]

Identity prerequisite #969 is merged as edf3500, preserving both the original and concurrent cloud-agent histories. The final standalone identity target has 15 daemon journeys plus nine fixture tests. Please use merged main rather than the superseded e65b1c8 permanent-backup-parity policy; 30dfeec follows the explicit #885 no-implicit-backup-authority clarification and preserves active-policy replay binding. Public scheduled publication and the complete consolidated acceptance matrix remain downstream work.

[Copilot]

🟡 Changes recommended

Identity commitments omit workspace authority and can accept explicitly empty identity declarations.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Integrates real-daemon Threads authority, replay, deterministic-clock, cross-platform, and diagnostic coverage.

Changes:

• Adds identity-aware Ward migration, scheduled proposals, and final-commit revalidation.
• Adds deterministic Threads clock and real-daemon E2E coverage.
• Hardens daemon startup, socket publication, evidence retention, and schema initialization.

File summaries

File	Description
.github/workflows/ci.yml	Runs Threads journeys cross-platform and uploads Windows evidence.
Cargo.lock	Updates Threads and transitive dependency pins.
crates/coven-cli/Cargo.toml	Adds test-clock feature, Threads pin, and Unix tempfile dependency.
crates/coven-cli/src/automations/runtime_terminal_evidence.rs	Makes schema initialization atomic.
crates/coven-cli/src/cockpit_sources.rs	Exposes roster identity fields.
crates/coven-cli/src/daemon.rs	Adds startup diagnostics and private socket publication.
crates/coven-cli/src/main.rs	Registers Threads modules.
crates/coven-cli/src/mobile_memory/config.rs	Shares private-directory validation.
crates/coven-cli/src/pty_runner.rs	Accepts another valid prompt-termination outcome.
crates/coven-cli/src/store.rs	Adds initialization phase observations.
crates/coven-cli/src/threads_clock.rs	Implements deterministic test time and commit pause controls.
crates/coven-cli/src/ward.rs	Adds approval metadata, invariants, and commit checks.
crates/coven-cli/src/ward_identity.rs	Builds candidate identity evidence.
crates/coven-cli/src/ward_migrate.rs	Migrates retired Ward policy and invariants.
crates/coven-cli/tests/support/threads_final_commit_cases.rs	Tests final-commit identity drift.
crates/coven-client/src/discovery.rs	Preserves the published socket leaf.
crates/coven-client/src/http.rs	Adds raw authenticated JSON requests.
crates/coven-client/src/lib.rs	Exports raw response type.
crates/coven-client/src/transport/mod.rs	Permits exact root health requests.
crates/coven-client/tests/health.rs	Tests raw requests, framing, and socket discovery.
docs/AUTH.md	Documents hardened Unix socket publication.
docs/CLIENT-INTEGRATION.md	Documents raw client requests.
docs/design/threads-test-clock.md	Documents deterministic clock fixtures.
docs/design/ward-gate3-coherence.md	Updates Tier-1 and Tier-0 lifecycle design.
docs/reference/api.md	Documents scheduled proposals and supersession.
docs/reference/cli-ward.md	Documents migration, invariants, and pending proposals.
docs/reference/threads-e2e.md	Documents the E2E harness and evidence.
scripts/check-ci-workflow-test.py	Adds workflow regression guards.

Review details

• Files reviewed: 28/31 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.