Add the v1 portable core contract validator (inactive)

[yihanzhu]

Closes #155

What changed

Adds the v1 portable core contract: the smallest vendor-neutral record family
later adapters can share, and a pure validator for it.

• core/v1/contracts.jq — the only product source for v1 shapes, the
  capability/permission registries, and relational validation (manifest ↔
  profile ↔ resolved-profile, request ↔ resolved-profile ↔ result). It never
  reads Git, launches a process, calls a model, or proves a claim true — it
  only checks that caller-supplied documents are internally consistent.
• scripts/core-contract.sh — the one public front door: validate-document,
  validate-profile-set, and validate-stage-run. It snapshots bounded input
  bytes, requires jq 1.6 exactly, checks byte-for-byte canonical JSON, hashes
  the accepted bytes, and hands a driver value (parsed JSON + digests, never a
  raw path) to contracts.jq. Success is exit 0 with empty output; failure is
  one allowlisted E_* token on stderr.
• scripts/test/core-contract-fixtures.jq + scripts/test/core-contract.test.sh
  — a hermetic test suite. The test script independently canonicalizes and
  hashes each fixture document with pinned jq and an external SHA tool (never
  the validator itself), wiring each digest into the next document's ref in
  dependency order (manifest → profile → resolved profile → request → result)
  so no fixture digest is ever self-referential.
• ci/required-files.txt, README.md, RESTORE.md — the new files are
  restore-critical and documented; the validator is explicitly called out as
  manual and inactive (nothing in the live profile or /yshifu calls it).

Why

This is the accepted portable-core-contracts spec/plan
(work/portable-core-contracts/{intent,spec,plan}.md, all read-only in this
PR): a small, machine-checked vocabulary so later adapter/profile-resolution
work has one shared, tested schema instead of drifting per implementation.
Nothing here activates a profile, extracts a real adapter, or changes any
current behavior.

Why CI can't run the new suite yet (proposals/)

I'm an unattended coder, and unattended agents cannot write constitution
paths (.github/**, AGENTS.md, etc.) directly — only an operator-driven
session can. The plan's CI wiring and doc update are both against
constitution paths, so they're saved as unified diffs instead of applied:

• proposals/portable-core-contracts-ci-jq16.patch — adds one new CI step to
  .github/workflows/ci.yml: download the official jq 1.6 Linux release,
  verify its pinned SHA-256, assert jq-1.6, and run
  scripts/test/core-contract.test.sh. Every existing CI step is unchanged.
• proposals/portable-core-contracts-agents-md.patch — replaces AGENTS.md's
  "validators are still to come" line with the new files and the exact local
  test command, keeping the existing jq/shellcheck safety guidance intact.

Both patches were verified with git apply --check against this PR's head.
Because of this, the new test suite does not run in this PR's own CI —
it only runs locally (see proof below). It starts running in CI once the
operator applies proposals/portable-core-contracts-ci-jq16.patch by hand.

How I tested it

Commit tested: 84633c95a1c3dddd16a4cc91c698a241d0ff4549

Pinned jq 1.6 (jq-osx-amd64 through Rosetta on this Apple Silicon host, SHA-256
verified) and shellcheck 0.11.0 (matches SHELLCHECK_VERSION in
.github/workflows/ci.yml; this host's shellcheck was already exactly 0.11.0).

$ jq --version
jq-1.6
$ shellcheck --version | awk '/^version:/{print $2}'
0.11.0

$ bash scripts/test/core-contract.test.sh
...
-- 191 passed, 0 failed --

86 distinct positive/mutation cases (191 individual assertions), well over the
required 60 — covering: the full positive path (every document kind,
profile-set, stage-run); CLI usage/arity including the 1–8 manifest boundary;
raw-byte/canonical edges (empty, multi-root, BOM, invalid UTF-8, duplicate
keys, alternate whitespace/escaping, missing/extra final LF, unsorted keys);
exact-boundary and one-over cases for byte size (1,048,576), depth (32),
member count (256), and string length (8,192), plus floats/negatives/oversize
integers; manifest/profile/resolved-profile/stage-request/stage-result shape
rules; profile-set and stage-run relations (tool/config mismatches, role
separation, missing/duplicate manifests, wrong binding, evidence-role rules,
the terminal-status presence matrix, time ordering); a PATH-stubbed non-1.6 jq
rejected as E_RUNTIME; the shasum -a 256 fallback when sha256sum is
absent, and a missing-SHA-tool failure; and that stderr never echoes an input
path or a distinctive fixture byte.

$ shellcheck -x -S style $(find . -name '*.sh' -not -path './.git/*')
(clean)

$ bash scripts/test/north-star-resolver.test.sh    # -- 74 passed, 0 failed --
$ bash scripts/test/north-star-gate.test.sh        # -- 226 passed, 0 failed --
$ bash scripts/test/models-conf-parser.test.sh     # -- 63 passed, 0 failed --
$ bash scripts/test/codex-degraded-gate.test.sh    # passed: 105, failed: 0
$ bash scripts/test/v2-pending-stage.test.sh       # ok
$ bash scripts/test/v2-round-cap.test.sh           # ok
$ bash scripts/test/v2-quota-preflight.test.sh     # ok
$ bash scripts/test/v2-check-rename.test.sh        # ok
$ bash scripts/check-rename.sh                     # check-rename: clean

git diff --check on the actual diff reports exactly two hits, both
expected and harmless: a single blank context line inside each committed
.patch file (a real, unchanged blank line in ci.yml/AGENTS.md, shown in
unified-diff form with its required leading space). That is normal unified-diff
syntax, not trailing whitespace in source; "fixing" it would corrupt the patch
and break git apply. Both patches were re-verified with git apply --check
after the commit.

Line count vs. the accepted 900–1,100 range

Per-file, counting real content lines (non-blank, non-comment-only for new
code files; net added lines for edited docs; real +-content lines, not diff
headers, for the two patches):

File	Total lines	Content lines (SLOC-style)
core/v1/contracts.jq	739	601
scripts/core-contract.sh	131	95
scripts/test/core-contract-fixtures.jq	132	110
scripts/test/core-contract.test.sh	381	324
README.md (net added)	31	31
RESTORE.md (net added)	25	25
ci/required-files.txt (net added)	7	7
proposals/…-ci-jq16.patch (real + content)	37	25
proposals/…-agents-md.patch (real + content)	32	16
Total (SLOC-style)		1,234
Total (raw wc -l / git diff --stat)		1,515

This is above the bridge's authoritative 900–1,100 range on both countings.
Breaking it down against the plan's own per-area estimate:

• contracts.jq (601 SLOC) and the shell wrapper (95 SLOC) are within/near
  their own estimated ranges (380–755, 50–110).
• Fixtures + tests (110 + 324 = 434 SLOC) run over the 240–330 estimate. This
  is because I built 86 distinct test cases (191 assertions) — comfortably
  over the required "at least 60" — with real, hand-crafted raw-byte fixtures
  for the exact-boundary/one-over limit cases (which need precisely-sized
  byte payloads, not just short strings) and independent digest-chaining
  across all five fixture documents, exactly as the plan's step 5 and the
  spec's "fixture circularity" risk require (never reusing the validator as
  its own test oracle).
• Docs + CI wiring (31 + 25 + 7 + 25 + 16 = 104 SLOC) runs over the 30–60
  estimate almost entirely because of the two proposals/ patches (41 SLOC
  of real content): that packaging overhead exists only because this is an
  unattended run routing constitution-path changes through proposals/
  instead of editing them directly, per AGENTS.md.

I did not compress code, shorten lines, or drop any test to move this number
down — every line here is either real validator behavior, a real test case,
or the mandated proposals/ packaging. If the size itself is a concern, I
defer to review/operator judgment on whether to accept it as explained or
split further.

Scope

Implements only the accepted intent (work/portable-core-contracts/intent.md),
spec (spec.md), and plan (plan.md) — all three are read-only in this PR.
No profile activation, no real adapter, no Git reads, no forge/CI/execution/
identity/publisher operations, no /yshifu or manager-persona change.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 84633c9
Reviewed-base: 14988a8
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/183-62089/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator rejects valid reviewer requests while accepting numerous invalid profile, request, and result relations, including unsupported manifest capabilities and proofless passing results. Its regression suite is also only present as an unapplied CI proposal.

Full review comments:

• [P1] Run the validator suite in the real CI workflow — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/proposals/portable-core-contracts-ci-jq16.patch:9-9
  This CI step is stored as patch text under proposals/, so GitHub Actions never executes it and a broken contract validator can merge while the existing CI remains green. The operator needs to apply the workflow change before this implementation is accepted.

• [P1] Compare reviewer change base to the request base wrapper — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:393-393
  For every reviewer request, change_ref.base is a {state,...} wrapper while .base.value is only the revision, so this comparison can never succeed, including when both bases are present and identical. Compare against the complete request .base; otherwise the review capability is unusable.

• [P1] Close delivered scopes over their named inputs — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:188-190
  A delivered scope currently needs only a syntactically valid input ID and content subject; it never checks that the ID selects an input whose value equals that subject or that the payload media type is text/plain or application/json. Requests can therefore pass with missing or mismatched instruction payloads, defeating the bounded instruction-delivery contract.

• [P1] Enforce the target repository on every request Git ref — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:416-418
  The request relation ends after binding and permission checks, without requiring Git revisions or objects in target revision, base, source, inputs, and reviewer changes to use target_repository_id. For example, a producer targeting repo-a can include a source Git object from repo-b and still validate, widening the claimed target-read scope beyond the exact target.

• [P1] Require verifier candidates to be Git trees — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:387-389
  This accepts any git-object, including a blob, as a verifier candidate. The contract grants candidate execution only against the exact target tree, so a blob input with the matching revision currently passes despite being unusable and outside that execution boundary.

• [P1] Validate each binding against manifest offers — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:304-307
  The binding/manifest relation checks packages and tools but never verifies that the manifest offers the binding's role, execution kind, requested capability, and requested permissions. After recomputing refs, a producer binding can therefore validate against a manifest that offers no producer capability or permissions, collapsing the required offer/request separation.

• [P1] Require completed evidence to match the request — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:634-636
  This only checks that supplied evidence kinds are generally allowed for the role; it does not require exactly one item for every required_evidence_kinds entry. Because all([]; ...) is true, a completed verifier or reviewer result with no evidence can be accepted as passed, and unrequested role-allowed evidence can satisfy a result.

• [P1] Match conclusive execution to the resolved binding — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:617-624
  For completed conclusive results, this comparison omits the actual adapter implementation, manifest ref, config, authority, performer identity/boundary fields, request environment, and requested model/prompt/skill values; tools are compared only by ID. A result can therefore claim a passing execution from a different environment or implementation and still validate as exact requested execution.

• [P1] Reject outputs and missing reasons for inconclusive completion — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:643-647
  When any evidence is non-passing, this branch requires only an inconclusive outcome and no delta. A completed-inconclusive result can retain output artifacts and omit reason, although the contract requires no output/delta and a reason for every completed-inconclusive result.

• [P2] Bind resolved source digests to supplied documents — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:326-333
  The profile-set relation matches manifest refs but never requires resolved_body.profile_source.value_sha256 to equal the supplied profile digest or each manifest_source.value_sha256 to equal its supplied manifest digest. Arbitrary 64-hex source claims therefore validate as provenance for different canonical documents.

• [P2] Reject unreferenced manifests in a profile set — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/scripts/test/core-contract.test.sh:143-145
  This positive test explicitly accepts four extra unreferenced manifests, but the accepted contract requires the supplied manifest set to be exact. Allowing extras makes the validated resolution bundle ambiguous and leaves unrelated adapter documents inside a supposedly closed profile set.

• [P2] Validate stale observations against request selectors — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:727-728
  The stage-run path checks only stale-result field presence; no relation derives the expected request value, verifies input or gate selectors exist, checks repository/identity constraints, or requires the observed value to differ. A stale result can therefore repeat the current target unchanged or name a nonexistent input and still pass.

• [P2] Enforce canonical ordering for set-valued arrays — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:41-43
  The contract defines every set<T> as sorted and unique by its key, but this helper checks uniqueness only, and the enum-set helper has the same omission. Reversing bindings, permissions, evidence refs, or another set therefore produces a different canonical document that is still accepted, defeating the single canonical representation.

• [P2] Validate timestamps as real UTC instants — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:34-34
  The regex checks formatting only, so values such as 2026-99-99T99:99:99Z pass shape validation and participate in lexical time ordering. The contract requires a real UTC second-level timestamp, so month/day/hour/minute/second ranges must also be validated.

• [P2] Restrict absent targets to bootstrap producer requests — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:384-384
  This condition checks only the producer role, so a routine or high-risk producer request with no target revision is accepted; the shipped positive fixture does exactly that. The contract allows an absent target only for bootstrap producer work, so the risk tier must also be constrained.

• [P2] Limit completed producer changes to one output — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.GZHFRB8Rh9/core/v1/contracts.jq:585-590
  The producer outcome logic treats every nonzero output count as a valid change, so two or more outputs pass and a git-patch result merely binds delta_ref to the first. The v1 operation produces one artifact, and the result rules specify one output for a completed change.

[yihanzhu]

Manager fix claim

• claim_id: ystack-claim-20260829T164242Z-portable-core-contracts-fix-740d40e2
• mode: fix
• gh operator: yihanzhu
• manager session: yshifu (single manager session driving this target)

Exact tuple

• target: yihanzhu/ystack
• slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels — ready/claimed/needs-human all absent)
• PR: Add the v1 portable core contract validator (inactive) #183 (OPEN)
• gate_mode: artifact-high
• risk: high
• branch_state: existing
• review_size: accepted-exception — accepted range 900–1,100 normally formatted implementation lines
• branch: ystack/impl/portable-core-contracts
• local HEAD (must equal PR remote head): 84633c95a1c3dddd16a4cc91c698a241d0ff4549
• PR remote head: 84633c95a1c3dddd16a4cc91c698a241d0ff4549
• current base: 14988a8a5392e888ff1aaee4c48afa5024bee003
• round: round-0
• worktree: clean
• plan path: work/portable-core-contracts/plan.md
• plan blob: 2172609cde59a03b5f937d0d2da320f7779ddad8
• spec blob: f5b218626dec8484518295e901e427e3ff8f3daf
• intent blob: 3ed8bb434c096ec126d680019a9491ab8a113e31
• acceptance record: the high-risk plan-base refresh comment on issue Define portable core contracts #155 (comment 5463267042)
• bridge: one-time record pinned in the body of issue Policy: activate the manual risk-based plan gate #180; continues as artifact-high/high/existing

Round-0 Codex review was a not-pass (comment 5463604326, Reviewed-head
84633c95a1c3dddd16a4cc91c698a241d0ff4549, Reviewed-base
14988a8a5392e888ff1aaee4c48afa5024bee003). merge-ready was never applied and remains
absent. One fix spawn is authorized by this claim and no other. The operator remains the only
merge authority.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	ab4a708
Status:	✅  Deploy successful!
Preview URL:	https://cd7665e3.fabrica-6yx.pages.dev
Branch Preview URL:	https://ystack-impl-portable-core-co.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Round-0 fix: closed the review gaps

Commit: a11d9f0b53cc1766afda5744b7e8fd2f5ecb9a73 (pushed on top of 84633c9, same branch, no rebase/reset).

Per-finding disposition

All P1/P2 code and test findings from comment 5463604326 are fixed, each with a new mutation row that fails without the fix (scripts/test/core-contract.test.sh):

• P1 reviewer base compare — change_ref.base (a present<> wrapper) was compared against .base.value (the bare revision), so it could never match. Now compares the full present<> wrapper on both sides.
• P1 delivered scopes not closed over inputs — finish_condition/verification_instruction/the capability's own scope now require input_id to select exactly one named input whose value equals the scope's complete subject, and the payload media type must be text/plain or application/json (new delivered_scope_input_ok).
• P1 target_repository_id not enforced — every Git ref in target_revision, base, source, inputs, and a reviewer's change_ref must now use the request's target_repository_id.
• P1 verifier candidate not required to be a tree — now requires object_type=="tree".
• P1 binding/manifest offer not checked — binding_manifest_relation_ok now requires the manifest to offer the binding's role, execution kind, capability, and permissions.
• P1 vacuous evidence-kind check — completed results now require the evidence-kind set to exactly equal required_evidence_kinds (closes the all([]; ...) gap that let zero-evidence "passed" results through).
• P1 narrow conclusive-execution match — widened to implementation, manifest ref, config, authority, performer identity/boundary, and the request's environment; tools are now compared by full tool_ref equality, not ID only.
• P1 completed-inconclusive under-constrained — now forbids outputs/delta and requires reason.
• P2 source digests unbound — resolved profile/manifest value_sha256 must now equal the real supplied documents' digests.
• P2 profile-set accepted unreferenced manifests — now rejected; the positive test that asserted the old (wrong) "extras allowed" behavior now asserts exactness and has a companion rejection row.
• P2 stale observations unvalidated — selectors now derive the expected value from the request and require the observed value to actually differ (and, for input/gate-decision selectors, to name something the request actually carries).
• P2 canonical set ordering not enforced — set<T> must now be sorted by key, not just unique (both the object-keyed and enum-set helpers).
• P2 timestamps validated as text — now validated as real UTC ranges (month/day/hour/minute/second).
• P2 absent target too loose — now requires the bootstrap risk tier, not merely a producer role; the shipped positive fixture is updated to use it.

Not touched: the CI-wiring finding is correct and stays parked in proposals/portable-core-contracts-ci-jq16.patch for the operator — it's a constitution-path (.github/workflows/ci.yml) change an unattended agent can't make. The accepted spec.md/plan.md are unchanged; every fix above is the code catching up to what they already require.

Bugs found and fixed incidentally

While implementing the stale-observation fix I found the same defect class in three other spots — ARRAY | index(.field) reads .field off the piped array instead of the original value:

• is_stale_selector crashed with E_RUNTIME for 6 of its 8 selector kinds (only input/gate-decision avoided the pattern).
• is_document_kind always returned true regardless of input (every other call site happens to have a redundant exact-kind check next to it, so this was unobservable except via named_input's document-typed variant — now covered by a mutation).
• is_observed_capability's unclassified branch crashed whenever exercised (never previously exercised by any test).

Also fixed two jq scoping bugs in my own new code: delivered_scope_input_ok/stale_observation_ok needed $-bound value parameters, not filter parameters, since both are called from inside all(.[]; ...) — a filter parameter gets re-evaluated against the inner . instead of staying pinned to the value passed at the call site.

Fixture changes

A few fixes required the shipped positive document to become genuinely valid rather than incidentally accepted:

• stage_request now uses risk.tier = bootstrap (was routine) to match the tightened absent-target rule.
• delivered()'s scope subject now reuses the same in-<input_id> content ref as the matching named input (previously a different scope-<input_id> ref that only passed because nothing checked equality).
• profile.bindings/stage_request.inputs are now built pre-sorted by key (sort_by) to satisfy canonical ordering.
• resolved_profile.profile_source.value_sha256 now uses the real profile digest instead of a placeholder.
• The producer execution record is now derived from the same resolved-binding object (execution_for(rb)) instead of two independently hand-typed literals, so it satisfies the widened conclusive-execution match by construction.

Proof (commit a11d9f0b53cc1766afda5744b7e8fd2f5ecb9a73)

bash scripts/test/core-contract.test.sh        # -- 219 passed, 0 failed --
shellcheck -x -S style <all .sh files>          # clean, version 0.11.0 (matches CI pin)
bash scripts/test/north-star-resolver.test.sh   # 74 passed, 0 failed
bash scripts/test/north-star-gate.test.sh       # 226 passed, 0 failed
bash scripts/test/models-conf-parser.test.sh    # 63 passed, 0 failed
bash scripts/test/codex-degraded-gate.test.sh   # 105 passed, 0 failed
bash scripts/test/v2-pending-stage.test.sh      # all cases pass
bash scripts/test/v2-round-cap.test.sh          # all cases pass
bash scripts/test/v2-quota-preflight.test.sh    # all cases pass
bash scripts/test/v2-check-rename.test.sh       # 27 passed, 0 failed
bash scripts/check-rename.sh                    # clean
git diff --check                                # clean

jq 1.6 pinned per the plan's recipe (SHA-256 verified) was used for the contract-test run.

Line recount

Raw wc -l on the four implementation files, before this round's fix vs. after:

File	Before	After	Δ
core/v1/contracts.jq	739	882	+143
scripts/core-contract.sh	131	131	0
scripts/test/core-contract.test.sh	381	448	+67
scripts/test/core-contract-fixtures.jq	132	155	+23
Total	1,383	1,616	+233

This round's growth is entirely closing proof gaps the reviewer named (widened relations, exact-match closures, canonical ordering) plus mutation-row coverage for each — no new concern, no compressed code, no dropped tests. It further widens the PR's total distance from the accepted 900–1,100 review-size range; that distance was already flagged and accepted as an explicit exception at G2/plan gate, and every addition here is required proof, not padding.

Not merging, not approving, not touching claimed — leaving that to yshifu.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: a11d9f0
Reviewed-base: 14988a8
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/183-32196/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator accepts several records forbidden by the accepted contract and rejects valid completed-inconclusive incident records. Its new test suite is also not wired into the active CI workflow.

Full review comments:

• [P1] Apply the contract-test step to the active CI workflow — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/proposals/portable-core-contracts-ci-jq16.patch:9-17
  This workflow addition exists only inside a file under proposals/, which GitHub Actions does not execute. On the current head, .github/workflows/ci.yml never runs core-contract.test.sh, so the validator can merge with failing tests despite the repository's hard CI requirement; have the operator apply this proposal before merge.

• [P1] Make unavailable facts force an inconclusive result — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:705-708
  For a completed model-backed run with passing evidence, an unavailable provider, model, effort, prompt, or skills fact returns true here, allowing a conclusive changed/passed outcome. The accepted contract says an unavailable requested fact must make the completed result inconclusive, so availability must participate in the outcome relation rather than being accepted unconditionally.

• [P1] Allow observed mismatches for completed-inconclusive results — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:791-791
  When completed evidence is failed or inconclusive, the contract explicitly allows execution facts to differ so the result can preserve the incident. This unconditional equality check still rejects such records when the actual binding, performer, environment, capability, or model facts differ; apply it only to completed non-inconclusive results.

• [P2] Enforce one claim per resolved source object — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:359-364
  If the same Git object appears in multiple resolved source fields or bindings with different value_format or value_sha256 values, this relation still succeeds because it never groups all source claims by git-key. That violates the contract's rule that one exact source object has only one format/digest claim and leaves downstream consumers with contradictory immutable-source metadata.

• [P2] Require dormant bindings to be deterministic — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:271-273
  A publisher, forge, CI, execution, or identity binding can currently use execution_kind:"model" as long as it supplies a prompt and model request, because only verifier is forced deterministic. The contract permits model backing only for producer and reviewer and requires all dormant roles to be deterministic, so such profiles should fail shape validation.

• [P2] Keep the resolved-profile ID in stale observations — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:587-590
  For a present resolved-profile stale observation, this checks only the document kind, so an unrelated resolved profile with a different ID is accepted as the observed version. The contract requires the expected kind and ID to remain fixed while the canonical value differs; require observed.value.id to equal the request's resolved-profile ID.

• [P2] Validate calendar dates, not only field ranges — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:41-42
  The day check is independent of the month and year, so values such as 2026-02-31T00:00:00Z and 2025-02-29T00:00:00Z pass as real UTC timestamps. Since these timestamps are subsequently compared lexically as genuine instants, validate month-specific day counts and leap years.

• [P2] Validate CLI arity before runtime dependencies — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/scripts/core-contract.sh:34-36
  These jq/SHA checks run before the command dispatch, so on a host without jq 1.6 even an unknown command or wrong argument count returns E_RUNTIME instead of the specified E_USAGE. Parse and validate the exact command form first, especially the profile manifest count, before checking runtime dependencies.

• [P2] Count object keys in the decoded-string limit — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.9JMsDyXrPb/core/v1/contracts.jq:810-812
  The recursive limit check visits object values but never their keys. A canonical document containing an 8,193-byte key therefore bypasses the decoded-string limit and is reported later as E_SHAPE rather than the required E_LIMIT, breaking the validator's fixed error-order contract.

[yihanzhu]

Manager fix claim

• claim_id: ystack-claim-20260829T173303Z-portable-core-contracts-fix-43d3532e
• mode: fix
• gh operator: yihanzhu
• manager session: yshifu (single manager session driving this target)

Exact tuple

• target: yihanzhu/ystack, slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels)
• PR: Add the v1 portable core contract validator (inactive) #183 (OPEN)
• gate_mode: artifact-high, risk: high, branch_state: existing
• review_size: accepted-exception — accepted range 900–1,100 normally formatted implementation lines
• branch: ystack/impl/portable-core-contracts
• local HEAD = PR remote head: a11d9f0b53cc1766afda5744b7e8fd2f5ecb9a73
• current base: 14988a8a5392e888ff1aaee4c48afa5024bee003
• round: round-1
• worktree: clean
• plan blob 2172609cde59a03b5f937d0d2da320f7779ddad8, spec blob f5b218626dec8484518295e901e427e3ff8f3daf, intent blob 3ed8bb434c096ec126d680019a9491ab8a113e31
• acceptance record: comment 5463267042 on issue Define portable core contracts #155
• bridge: record pinned in the body of issue Policy: activate the manual risk-based plan gate #180; continues as artifact-high/high/existing

Round-1 Codex review was a not-pass (comment 5463851247, Reviewed-head
a11d9f0b53cc1766afda5744b7e8fd2f5ecb9a73, Reviewed-base
14988a8a5392e888ff1aaee4c48afa5024bee003). merge-ready has never been applied and remains
absent. One fix spawn is authorized by this claim and no other. The operator remains the only
merge authority.

[yihanzhu]

Round-1 fix: findings closed, proof re-run on cbfa4f3

Fixed all eight named review findings from comment 5463851247. Left the ninth (CI wiring) untouched per the brief — it's a .github/** constitution-path change I can't make as an unattended agent; it stays parked in proposals/portable-core-contracts-ci-jq16.patch for the operator.

Per-finding disposition

1. [P1] Regression — completed-inconclusive equality over-corrected. core/v1/contracts.jq stage_result_relations_ok: completed_execution_matches_binding is now called only if result_body.outcome.value != "inconclusive". A completed-inconclusive record (evidence failed/inconclusive, or forced inconclusive by an unavailable fact — see Add Claude Code GitHub Workflow #2) may report execution facts that differ from the resolved binding; a completed non-inconclusive record still requires exact equality. Tests: (j) completed non-inconclusive execution environment mismatches... (reject) / (j) completed-inconclusive execution environment may differ... (accept).
   I also re-audited the rest of round-0's diff for the same over-broad-tightening shape (finding-6/7/9 below were exactly that pattern too — see their scoping notes).
2. [P1] Unavailable facts must force inconclusive. Added metadata_requested_unavailable(meta) (checks provider/model/effort/prompt/skills only — not tools, not snapshot, matching exactly what the contract names) and OR'd it into the same condition that already forces the inconclusive-shape branch for failing evidence. Tests: (l) unavailable prompt fact still claims a conclusive outcome (reject) / (l) unavailable prompt fact correctly reported as a completed-inconclusive record (accept), built on a new model-backed producer fixture ((l) model-backed completed producer change... proves the baseline itself is sound).
3. [P2] CLI arity before jq-version. scripts/core-contract.sh: moved command-form parsing (including the 1-8 manifest count) to the very top of the script, before the jq/SHA-tool runtime checks. validate() is now called once at the bottom with the parsed $mode/$docs. Tests: (k) usage checked before the jq pin: unknown command / ...missing arg (both E_USAGE under a stubbed non-1.6 jq) — the pre-existing (k) non-1.6 jq on PATH is rejected test right above proves the runtime check itself wasn't just deleted.
4. [P2] Limit walker misses object keys. limits_violated's object branch now also checks keys_unsorted|any(.[]; utf8_len > 8192). Tests: (c) decoded object key 8,193 bytes... (E_LIMIT, reject) / (c) 8,192-byte object key is at the limit... (E_SHAPE, accept-adjacent — proves no false positive at the boundary).
5. [P2] One claim per resolved source object. Added source_claims_agree (groups every resolved-profile source claim — profile/manifest/package/config/prompt/skills/tool sources — by source_git_key and requires one value_format+value_sha256 per group), wired into profile_set_relations_ok. This also exposed a real bug in the test fixtures themselves: every role's manifest_source pointed at the same fake Git object while claiming a different real digest — fixed in scripts/test/core-contract-fixtures.jq (manifest_object_id(role)) so each role's manifest blob has its own identity, which is what let the existing (a) baseline validate-profile-set test keep passing. Test: (i) two bindings claim different digests for the same source Git object (reject); the (a) baseline is the accept case.
6. [P2] Dormant roles forced deterministic. is_profile_binding's role check widened from "only verifier" to "every role except producer/reviewer must be deterministic." Tests: (e) producer allowed to use model execution (accept) / (e) dormant role (publisher) forced to model execution (reject) — the pre-existing verifier test wasn't touched, so this only widens coverage, doesn't narrow the exemption.
7. [P2] Stale resolved-profile observation must pin the ID. Added $obs.observed.value.id==$req_body.resolved_profile_ref.id alongside the existing kind check. Tests: (j) stale resolved-profile observation keeps the request's own ID with a genuinely different digest (accept) / ...names an unrelated resolved profile ID (reject).
8. [P2] Calendar-aware timestamps. is_time now derives real month-specific day counts (leap-year Feb 29 included) instead of a flat 1-31 range. Tests: (g) requested_at names a day the month does not have (Feb 31, reject) / ...Feb 29 in a non-leap year (reject) / ...Feb 29 in a real leap year (accept).
9. CI wiring (untouched, as briefed). Still parked in proposals/portable-core-contracts-ci-jq16.patch; git apply --check against the current head still applies cleanly. Not my call to make — .github/** is a constitution path.

Proof (commit cbfa4f3bf1d9251769419656f58607c64e5c77b3)

• Pinned jq 1.6 verified (sha256 matched, jq --version == jq-1.6).
• bash scripts/test/core-contract.test.sh — 252 passed, 0 failed (66 new assertions across 33 new mutation/acceptance pairs; verified each new test fails against the pre-fix code and passes against the fix, so none are vacuous).
• shellcheck -x -S style at pinned 0.11.0 over every tracked *.sh — clean.
• All eight pre-existing repo suites (north-star-resolver, north-star-gate, models-conf-parser, codex-degraded-gate, v2-pending-stage, v2-round-cap, v2-quota-preflight, v2-check-rename) — all exit 0.
• bash scripts/check-rename.sh — clean.
• git diff --check — clean.
• Structure check (ci/required-files.txt) — ok.

Line recount (normal-format = non-blank lines; delta vs round-0 head a11d9f0)

file	total (wc -l)	non-blank	prior non-blank	delta
core/v1/contracts.jq	930	829	786	+43
scripts/core-contract.sh	138	123	117	+6
scripts/test/core-contract-fixtures.jq	168	154	142	+12
scripts/test/core-contract.test.sh	534	503	418	+85
total	1770	1609	1463	+146

This round's growth (+146 non-blank lines) is the same shape as round-0's: closing eight named findings, each with a real fix plus a mutation+acceptance test pair (per this round's explicit testing rule, since round-0's regression was a rejection-only-test gap). No new concern or scope was added — every line traces to one of the nine numbered findings above. We're well past the 900-1,100 accepted-exception range now (as flagged going into this round); I did not compress code or drop tests to fight that number, per the brief.

What I deliberately did not change

• .github/workflows/ci.yml (the CI-wiring P1) — constitution path, stays in proposals/.
• Accepted intent.md/spec.md/plan.md — untouched, hashes unchanged.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: cbfa4f3
Reviewed-base: 14988a8
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/183-9874/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator accepts resolved profiles and conclusive model results that violate core capability, role-separation, and tool-observation guarantees. The new contract suite is also not wired into the actual CI workflow, and the wrapper does not preserve its error contract on temporary-directory failures.

Full review comments:

• [P1][Security] Validate profile invariants in resolved profiles — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.UTJ0bEIN2o/core/v1/contracts.jq:324-330
  When validate-document or validate-stage-run receives a resolved profile directly, this only checks each embedded binding's basic shape. A producer binding with empty requested_capabilities/requested_permissions, or protected bindings sharing a principal or execution boundary, is therefore accepted even though the same data would fail profile validation; validate-stage-run can then approve an operation the binding never requested. Apply the capability and protected-role profile invariants to the embedded binding set.

• [P1][Security] Make unknown tool use inconclusive — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.UTJ0bEIN2o/core/v1/contracts.jq:744-747
  When a model binding requests tools but a completed result reports metadata.tools as unavailable, this helper ignores that fact, so passing evidence can still produce a conclusive result. That bypasses the requested-tool subset check and contradicts the contract rule that an unavailable requested fact makes the result inconclusive; include tools in this check whenever their actual use cannot be established.

• [P1][Compliance] Apply the CI proposal before merging — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.UTJ0bEIN2o/proposals/portable-core-contracts-ci-jq16.patch:9-9
  This test step exists only inside an inert patch under proposals/; the actual .github/workflows/ci.yml is unchanged. Merging the current tree would therefore leave core-contract.test.sh out of CI despite the accepted plan and documentation claiming a jq-1.6-pinned CI step, so the operator must apply this proposal to the real workflow before merge.

• [P2][Bugs] Sanitize temporary-directory creation failures — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.UTJ0bEIN2o/scripts/core-contract.sh:73-73
  When mktemp -d fails because the temporary directory is read-only, full, or unavailable, set -e exits here before fail is called and exposes mktemp's raw diagnostic and local path. This violates the public error contract that every failure begins with an allowlisted E_* token; handle this command failure explicitly as E_RUNTIME.

• [P2][Security] Reject all control characters in repository paths — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.UTJ0bEIN2o/core/v1/contracts.jq:68-70
  A canonical repository path containing DEL (U+007F) or a C1 control character passes this predicate because it rejects only U+0000 through U+001F. The accepted RepoPath contract forbids control characters, and allowing them creates ambiguous paths for later physical repository resolution; extend the control-character rejection accordingly.

[yihanzhu]

round-cap

Why this is stopping here

Three Codex review rounds are done. The findings are converging steadily — actionable
items went 15 → 8 → 4 — but the loop cannot reach a clean review by fix rounds alone,
and that is the reason for escalating rather than spinning another round.

Round	Head	Actionable P1	Actionable P2	Total
round-0	84633c95	8	7	15
round-1	a11d9f0b	2	6	8
round-2	cbfa4f3b	2	2	4

merge-ready has never been applied to this PR at any point, and is absent now.

The blocking item is not the coder's to fix

Codex has raised the same P1 in all three rounds: core-contract.test.sh does not run
in the real CI workflow. The jq-1.6-pinned CI step exists only as inert patch text in
proposals/portable-core-contracts-ci-jq16.patch, because .github/workflows/ci.yml is a
constitution path and an unattended agent may not write it.

This is correct behaviour by the rail, not a defect — but it means green CI on this PR
does not prove the validator passes its own suite, and no number of coder rounds can
change that. Only the operator applying that patch can. Until then, any merge-ready
label would be a false green, so none will be applied.

What is still open in the code

Two security-class P1s and two P2s, all in the accepted scope — none of them a disagreement
between coder and reviewer:

• P1 security — a resolved profile passed directly to validate-document /
  validate-stage-run skips the profile invariants, so a producer binding with empty
  requested capabilities or protected bindings sharing a principal can be accepted, and a
  stage run can then be approved for an operation the binding never requested.
• P1 security — when a model binding requests tools and the result reports
  metadata.tools as unavailable, the result can still be conclusive, bypassing the
  requested-tool subset check.
• P2 security — RepoPath rejects only U+0000–U+001F, so DEL and C1 control
  characters pass.
• P2 bug — a failing mktemp -d exits under set -e before fail runs, leaking a raw
  diagnostic and local path and breaking the "every failure starts with an allowlisted
  E_* token" contract.

Can this scope down instead? My answer is no

The productive way to resolve a cap is normally to ship the converged core and split the
contested remainder. I do not think that is honest here. These are not a separable feature
under dispute — they are correctness and safety gaps inside one cohesive validator whose
entire purpose is to fail closed. Shipping the core minus these would ship an artifact
whose central claim is not true. And even a perfectly fixed validator would still bounce on
the CI finding above, so scoping down would not produce a clean review either.

Size has materially exceeded the accepted range

The bridge pinned review_size: accepted-exception at 900–1,100 normally formatted
implementation lines, with provenance to plan blob
2172609cde59a03b5f937d0d2da320f7779ddad8.

Actual trajectory: ~1,234 → ~1,467 → 1,609 non-blank lines — about 46% above the
ceiling. Every added line traces to a finding Codex named, so this is explained growth
rather than the unexplained overrun the size guard stops on, and no new concern was added.
But the accepted range is the operator's, not the manager's, so re-accepting it or forcing a
scope-down is an operator decision, not one to absorb quietly.

Decisions needed

1. Apply proposals/portable-core-contracts-ci-jq16.patch to the real
   .github/workflows/ci.yml. Nothing else clears the standing P1, and without it CI green
   is not evidence about the validator.
2. Rule on size — re-accept the overrun as explained growth, or direct a scope-down with
   the remainder split to a follow-up (which re-enters intake plus its own G1/G2 and plan
   gates).
3. Authorize one more fix round if you want the four open findings closed. They are
   concrete and localized; I would brief them the same way as the previous rounds. This is
   the round-3 terminal round, so it needs your explicit go.

The attempt is preserved exactly as it stands: branch ystack/impl/portable-core-contracts,
head cbfa4f3bf1d9251769419656f58607c64e5c77b3, base
14988a8a5392e888ff1aaee4c48afa5024bee003, PR #183 open at round-2, worktree clean,
accepted intent/spec/plan untouched, no constitution path written directly. Nothing was
reset, rebased, force-pushed, or discarded. The operator remains the only merge authority.

[yihanzhu]

Operator ruling — exact terminal scope

The operator explicitly authorized this exact package in the active task:

1. Apply proposals/portable-core-contracts-ci-jq16.patch only to .github/workflows/ci.yml and proposals/portable-core-contracts-agents-md.patch only to AGENTS.md, then remove only those two consumed proposal files.
2. Treat the current and directly required round-3 proof growth as explained growth under the existing review_size: accepted-exception. This does not amend the accepted intent, spec, plan, bridge identity, recorded range, or concern. Readability, tests, CI, review, and scope remain hard requirements.
3. Authorize exactly one terminal round-3 revision, limited to the four findings in Codex review comment 5464015820: resolved-profile invariant closure; requested-tools unavailable forcing inconclusive; sanitized mktemp failure mapping; RepoPath DEL/C1 rejection. Direct plumbing and paired regression/mutation tests for only those findings are included.

No other scope is authorized. There is no automatic round-4. Re-run the complete proof, require the real validator suite in CI, and obtain a fresh native Codex review on the final exact head/base. The operator remains the only merge authority.

[yihanzhu]

Manager fix claim — terminal round-3

• claim_id: ystack-claim-20260829T182031Z-portable-core-contracts-fix-8a6b019e
• mode: fix
• gh operator: yihanzhu
• manager session: yshifu (single manager session driving this target)
• authority: operator ruling recorded in comment 5464063082 on this PR

Exact tuple

• target: yihanzhu/ystack, slug: portable-core-contracts
• parent intake: Define portable core contracts #155 (OPEN, no labels)
• PR: Add the v1 portable core contract validator (inactive) #183 (OPEN)
• gate_mode: artifact-high, risk: high, branch_state: existing
• review_size: accepted-exception — recorded range 900–1,100 unchanged; the operator ruled
  the current and directly required round-3 proof growth explained under that existing
  exception, amending no artifact, bridge identity, range, or concern
• branch: ystack/impl/portable-core-contracts
• local HEAD = PR remote head: 80a86e260563e47ebfa22512c2e670a6d44769c0
• first parent: cbfa4f3bf1d9251769419656f58607c64e5c77b3 (verified)
• current base: 14988a8a5392e888ff1aaee4c48afa5024bee003 (unmoved)
• round: round-2 → terminal round-3
• worktree: clean
• plan blob 2172609cde59a03b5f937d0d2da320f7779ddad8, spec blob f5b218626dec8484518295e901e427e3ff8f3daf, intent blob 3ed8bb434c096ec126d680019a9491ab8a113e31 — all re-verified unchanged at this head and at the current base
• bridge: record pinned in the body of issue Policy: activate the manual risk-based plan gate #180; all four pinned digests recomputed and matching; continues as artifact-high/high/existing

Operator disposition verified, not assumed

Head moved cbfa4f3b → 80a86e26 as the recorded operator disposition. Verified: single
parent cbfa4f3b; changes only .github/workflows/ci.yml and AGENTS.md; deletes only the
two consumed proposal patches; proposals/ retains only its README. CI is green on this exact
head and the workflow now really runs scripts/test/core-contract.test.sh under pinned jq 1.6,
which clears the P1 that stood in all three prior rounds.

Claim created while needs-human still blocked; needs-human is removed only after this exact
tuple matched. One fix spawn is authorized by this claim and no other. There is no automatic
round-4. The operator remains the only merge authority.

[yihanzhu]

Terminal round-3 revision — done

Commit tested/pushed: ab4a7082f02e67b5748c5c54b9214f37d222f53f (parent 80a86e260563e47ebfa22512c2e670a6d44769c0).

Scoped to exactly the four findings authorized in the operator ruling (comment 5464063082) from Codex review comment 5464015820. No other changes.

Per-finding disposition

1. [P1][Security] Resolved-profile invariant closure — fixed. Added resolved_bindings_profile_invariants_ok in core/v1/contracts.jq, reusing the existing profile_protected_roles_ok and profile_binding_capability_ok predicates (no parallel copies) against a resolved profile's own embedded binding set (.bindings | map(.binding)). Wired into both mode_document (kind resolved_profile) and mode_stage_run (the resolved doc). Closes the path where validate-stage-run could approve an operation an embedded binding never actually requested — neither stage_request_relations_ok nor stage_result_relations_ok ever looked at a binding's own requested_capabilities/requested_permissions, only its role.
   Tests: (m) section — invalid: emptied producer capability/permission closure (document mode, E_RELATION); invalid: two protected embedded bindings sharing one principal_id (document mode, E_RELATION); invalid: same emptied-closure resolved profile fed through a full stage-run triple (E_RELATION); paired accepts: unmutated resolved profile alone, and unmutated request/resolved/result triple.

2. [P1][Security] Requested tools unavailable must force inconclusive — fixed. metadata_requested_unavailable now includes meta.tools in the same unavailable-fact array as provider/model/effort/prompt/skills — one path, no second mechanism.
   Tests: extended (l) — invalid: tools.state=unavailable on an otherwise-valid completed model result claiming a conclusive outcome (E_RELATION); paired accept: same mutation plus the correct inconclusive outcome/reason/empty-outputs.

3. [P2][Bugs] Sanitized mktemp failure mapping — fixed. scripts/core-contract.sh: tmpdir="$(mktemp -d 2>/dev/null)" || fail "E_RUNTIME" replaces the bare set -e-guarded assignment, so a failing mktemp -d can no longer exit past fail with its raw diagnostic/path on stderr.
   Tests: new (p) section — invalid: a stubbed failing mktemp (only mktemp shadowed on PATH) maps to exactly E_RUNTIME with the stub's raw diagnostic text absent from stderr; paired accept: the normal succeeding mktemp path (real PATH) still passes.

4. [P2][Security] RepoPath DEL/C1 rejection — fixed. is_repopath's control-character test now uses jq's \x{...} codepoint-brace syntax over [\x{0000}-\x{001f}\x{007f}\x{0080}-\x{009f}] — bare \xHH only matches single-byte input under UTF-8 mode, so the original \x80-\x9f byte-range never matched the 2-byte-encoded C1 codepoints it was meant to catch (verified directly against pinned jq 1.6 before writing the fix).
   Tests: new (n) section — invalid: DEL (U+007F), C1 low (U+0080), C1 high (U+009F) in a repository path (document mode, E_SHAPE each); paired accept: a genuine non-ASCII, non-control character (é) in a path segment stays legal.

Proof (all run on commit ab4a7082f02e67b5748c5c54b9214f37d222f53f)

Pinned jq 1.6 (SHA-256 verified) and shellcheck 0.11.0 (this host's shellcheck was already exactly 0.11.0, matching SHELLCHECK_VERSION).

$ jq --version
jq-1.6
$ shellcheck --version | awk '/^version:/{print $2}'
0.11.0

$ bash scripts/test/core-contract.test.sh
...
-- 279 passed, 0 failed --   (was 191 before this round)

$ shellcheck -x -S style $(find . -name '*.sh' -not -path './.git/*')
(clean, exit 0)

$ bash scripts/test/north-star-resolver.test.sh    # -- 74 passed, 0 failed --
$ bash scripts/test/north-star-gate.test.sh        # -- 226 passed, 0 failed --
$ bash scripts/test/models-conf-parser.test.sh     # -- 63 passed, 0 failed --
$ bash scripts/test/codex-degraded-gate.test.sh    # passed: 105, failed: 0
$ bash scripts/test/v2-pending-stage.test.sh       # ok
$ bash scripts/test/v2-round-cap.test.sh           # ok
$ bash scripts/test/v2-quota-preflight.test.sh     # ok
$ bash scripts/test/v2-check-rename.test.sh        # ok
$ bash scripts/check-rename.sh                     # check-rename: clean
$ git diff --check                                 # exit 0, no findings

CI on this exact head: run 33268655453, conclusion success, including the "Portable core contract tests" step (conclusion: success).

Line recount vs. the accepted review_size: accepted-exception

Net changes this round (git diff --numstat against 80a86e26), all in the three files this scope touches:

File	Before (raw lines)	Net delta	After (raw lines)
core/v1/contracts.jq	930	+22 (+30/-8)	952
scripts/core-contract.sh	138	+3 (+4/-1)	141
scripts/test/core-contract.test.sh	534	+65 (+65/-0)	599
Total		+90

No other file changed (confirmed via git diff --stat / git status). No compression, shortened lines, or dropped tests — every added line is either the direct fix plumbing for one of the four findings or a paired reject/accept regression test for it (191 → 279 assertions). Per the operator ruling, this growth is explained under the existing review_size: accepted-exception and does not amend the accepted intent/spec/plan, bridge identity, or the recorded 900–1,100 range.

Observations deliberately not acted on (out of scope for this terminal round)

• None. The four authorized findings were the only issues in scope, and no other defect was noticed while making these fixes.

This is the terminal round. Round bumped round-2 → round-3 (verified added/absent). claimed retained. Not merging — operator merge only.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: ab4a708
Reviewed-base: 14988a8
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/183-54910/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The validator accepts malformed resolved profiles and impossible verifier requests, and it rejects the specified failed outcome for completed checks. The shell wrapper also violates its sanitized error contract on temporary-storage failures.

Full review comments:

• [P1] Enforce resolved-profile source projections in standalone modes — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.99Cd0g9fsy/core/v1/contracts.jq:911-911
  When validate-document or validate-stage-run receives a resolved profile whose package_source.source differs from its embedded binding.package_ref (similarly for config, prompt, skill, tool, or conflicting source claims), this helper still passes because it checks only capability and protected-role invariants. Since profile_set_relations_ok is not called in either mode, the malformed profile is accepted and can support a conclusive stage result; apply all self-contained resolved-profile source relations in these modes, leaving only manifest-dependent checks to profile-set validation.

• [P1] Preserve failed outcomes for completed checks — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.99Cd0g9fsy/core/v1/contracts.jq:844-847
  When a completed verifier or reviewer has failed evidence, the contract requires check/failed with failed-before-inconclusive precedence. This branch routes every non-passing verdict to inconclusive, so a valid completed check/failed result is rejected while the semantically wrong inconclusive outcome is accepted; keep the producer rule separate and route check results through the failed/inconclusive precedence logic.

• [P1] Reject reviewer-only evidence on verifier requests — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.99Cd0g9fsy/core/v1/contracts.jq:482-483
  For verifier operations this condition checks only that deterministic is present, so a request containing independent-review also passes validate-document and can pass a skipped or stale stage run. That kind is reviewer-only and no completed verifier result can satisfy the request because result validation later rejects it; restrict verifier requests to deterministic, behavioral, and architecture.

• [P2] Route temporary-file write failures through E_RUNTIME — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.99Cd0g9fsy/scripts/core-contract.sh:112-112
  If the temporary filesystem fills or becomes unwritable after mktemp succeeds, this unguarded redirection exits through set -e before fail() runs, emitting a raw shell diagnostic that may include the private path instead of the promised E_RUNTIME token. Guard this and the following temporary-file writes so all such failures use the sanitized error path.

[yihanzhu]

round-cap

Terminal round-3 did not pass

The operator-authorized terminal round-3 revision is complete and the fresh Codex review
(comment 5464192510) is bound to Reviewed-head: ab4a7082f02e67b5748c5c54b9214f37d222f53f /
Reviewed-base: 14988a8a5392e888ff1aaee4c48afa5024bee003. It is a not-pass: three P1 and
one P2.

Per the operator ruling there is no automatic round-4, so this returns to needs-human.
merge-ready has never been applied to this PR and is absent.

What went right

• The CI gate is now genuine. .github/workflows/ci.yml really runs
  scripts/test/core-contract.test.sh under pinned jq 1.6, and the "Portable core contract
  tests" step reports success on run 33268655453, whose head_sha matches the reviewed
  head exactly. The suite is at 279/279.
• The round-3 commit stayed exactly in scope: core/v1/contracts.jq,
  scripts/core-contract.sh, scripts/test/core-contract.test.sh only. No constitution path,
  no accepted artifact, no proposals/ file touched. Artifact blobs and all four bridge
  digests re-verified unchanged.
• The RepoPath fix found a real subtlety worth keeping: bare \xHH in Oniguruma matches a raw
  byte, so it never matched the 2-byte-encoded C1 codepoints it was meant to reject. The fix
  switched to \x{...} codepoint form.

What the four findings actually are

I checked each against the round-3 diff rather than taking the labels at face value.

Two are incomplete closures of authorized findings, not new scope.

• Resolved-profile invariant closure (P1) — round-3 applied the capability and
  protected-role invariants to the embedded binding set, but not the self-contained source
  projections (package_source.source vs binding.package_ref, and likewise config, prompt,
  skill, tool). profile_set_relations_ok is called in neither standalone mode, so a
  malformed resolved profile still passes and can support a conclusive stage result. Same hole
  class as authorized finding 1, narrower.
• Temporary-file writes (P2) — round-3 guarded mktemp -d but not the redirections that
  follow it, which fail the same way and leak a raw diagnostic instead of E_RUNTIME. Same
  hole class as authorized finding 3, one step later in the same function.

One is a latent defect from the round-1 fix, surfacing now — not a round-3 regression.

• Failed outcomes for completed checks (P1) — the branch that routes every non-passing
  verdict to inconclusive was introduced in round-1 and is untouched by round-3; the round-3
  diff only added meta.tools to metadata_requested_unavailable. The contract requires a
  completed verifier or reviewer with failed evidence to be check/failed under
  failed-before-inconclusive precedence, so a valid check/failed record is currently
  rejected while the semantically wrong inconclusive one is accepted. Round-3 did widen the
  condition that reaches this branch, so it enlarged the blast radius without creating the bug.

One is genuinely new and was not among the authorized four.

• Reviewer-only evidence on verifier requests (P1) — a verifier operation checks only that
  deterministic is present, so a request carrying independent-review also validates even
  though no completed verifier result can ever satisfy it.

The honest read on trajectory

Actionable findings went 15 → 8 → 4 → 4. This round plateaued rather than converged, and
the composition is the reason: two findings were adjacent members of families the authorized
fixes only partly closed, and one was a latent defect from an earlier fix. Narrow, tightly
scoped rounds are not driving defect density down in this file, because each fix keeps
revealing the next member of the same family.

That is a signal about the artifact, not about coder effort: a single ~950-line jq validator
encoding this many interlocking relations is at the edge of what one review pass can certify.
The same over-correction pattern has now appeared twice (round-1's conclusive-execution
equality, and this round's inconclusive routing), which is what happens when one dense
predicate carries several contract rules at once.

Decisions needed

1. Authorize a further scoped revision for the two incomplete closures plus the round-1
   latent defect — these are direct continuations of already-accepted scope, and I would brief
   them as one package. The new verifier-evidence finding is separate scope and would need its
   own authorization.
2. Or split. Land nothing further here and open a follow-up initiative for the remaining
   relation-closure work, through the normal intake plus its own G1/G2 and plan gates. That
   would leave this PR unmergeable as-is, so it is only worth doing if you want the concern
   re-cut rather than continued.
3. Consider whether the accepted concern is right-sized. I am not asking to change it
   inside this attempt — that would need G2 — but the evidence now suggests one PR carrying the
   full v1 relation set may be structurally hard to certify, and that is worth a decision at the
   artifact level rather than another round.

State preserved exactly: branch ystack/impl/portable-core-contracts, head
ab4a7082f02e67b5748c5c54b9214f37d222f53f, base 14988a8a5392e888ff1aaee4c48afa5024bee003,
PR #183 open at round-3 + needs-human, issue #155 open and unlabeled, worktree clean, local
HEAD equal to remote. Nothing reset, rebased, force-pushed, or discarded. The operator remains
the only merge authority.