[schlessera]

Closes #2022. Coordinates the native-tool portion of #2048 A; broader bridge-roster work remains there.

What changed

Hosted governed typed Claude turns auto-allow configured native Write/Edit/NotebookEdit alongside the existing server writers. Interactive strict and voice turns keep those definitions registered, and refuse their calls in PreToolUse and canUseTool before execution or an approval card, including under settings grants. Autonomous behavior and stale-read/write-lock/protected-path controls are preserved. The decision records and authoritative MCP contract record the selected registration-versus-authority amendment, with a minor backend changeset.

Why this shape

#2022 restores the governed writable decision's approval-free reversible edits. The maintainer's #2048 A ruling requires stable registration plus effective call-time exclusions. This implements the native slice without taking over the concurrent broader bridge-roster work. Moved source citations are refreshed throughout the documentation.

Proof

Blocked integration handoff

Blocked by #2111. The coordinator stopped further expensive confirmation after the renewed candidate was invalidated again by a concurrent main advance. Run 38899465213 was deliberately cancelled; the PR is draft, no merge was issued and no aggregate stale-base failure is claimed. Its actual metadata checkout was f8b23b799c4e1f8de0d8b1a3a6bf28d86b31116a, parents 2e362cc12aa3d2bda38145b6da23d0ac232281b2 and 9c1529f88c7e07cbc15999dab74dc9d2f1510076, tree 27b0e5ceba79c1251cb1d2ebb9bb537aef640600. Main subsequently advanced to 3fc6fea5e22304df2810348074c32b1983fbea46 through #1997's workflow docs/skills update; product/runtime/test-harness inputs are unchanged, but exact-base confirmation remains required.

#2111 selects automated expiring reservations and one exact PR/head/base scope; lifecycle, competing-candidate enforcement and override rulings remain open. Resume after those rules provide an authorized reservation procedure: assess live main and overlapping #2073, preserve the native guards/auto-allow and completed proof, prepare a new exact candidate, request complete fresh confirmation, then verify matching-head squash and automatic main proof. No new protocol or freshness exemption is inferred. All old-base receipts below preserve their original identities.

Renewed confirmation candidate

Head 9c1529f88c7e07cbc15999dab74dc9d2f1510076, tree 27b0e5ceba79c1251cb1d2ebb9bb537aef640600, integrates base 2e362cc12aa3d2bda38145b6da23d0ac232281b2. The integration is clean and preserves the native approval fix/guards. Committed preflight passes 864 tests / 5,541 expectations. API head/base matched immediately before the renewed ready event. Full current-candidate proof is pending; completed jobs and receipts will be audited incrementally, with final qualification recorded in a completion comment before matching-head merge.

Fresh base reconciliation

The last pre-merge live-ref read caught main advancing to 2e362cc12aa3d2bda38145b6da23d0ac232281b2 through #2062's measured layout-cost/shard-harness change. No merge was issued. The PR returned to draft for integration and fresh candidate confirmation. The full passing run below remains evidence for its original b67b1b84e base, not the newly advanced combined tree. Complete new-base proof remains pending.

Passing confirmation on the previous base

Head 4c115f70afb2a605e755c791557f1cd94a5cb686, tree 0ba17a5273d44cac3149f90cfb34ff7121ffd445, integrates live main b67b1b84e8ceacf8f0df3aee8f23f8bf32a91703. Since the prepared integration below, main adds only the owned inherited-pipe descendant cleanup in the boot-probe test (#2067); production/native authority inputs are unchanged. Committed preflight on this candidate passes 862 tests / 5,534 expectations. The API head and live main were read back immediately before its ready event. Confirmation run 38895995663, attempt 1 passes all fourteen selected jobs plus the final candidate gate. Every actual job checkout is e3fd4e7bf030b3c50ce4edd08a0da51b56ef9c05, whose immutable parents are the base/head above and whose tree matches this candidate. The final BRAIN_CANDIDATE_RECEIPT independently names the same ready event, live head/base and tree. Contract passes; there are no reviews requesting changes. Earlier source/base receipts remain historical.

Twelve API-digest-verified receipt archives reconcile complete discovery and results. All 960 unit files run exactly once: 13,498 cases, 13,470 passed, 28 reviewed exclusions, zero failures and 179,878 expectations. The exclusions are 24 disabled paid-image opt-ins and four inverse sqlite-vec-unavailable placeholders; their positive vector suite runs. Both new native suites pass 16 cases / 172 expectations; the real policy boundary passes 19 / 582 and the corrected application adapter 14 / 101 on this exact checkout.

Browser/layout/endurance: all 297 browser files and 56 layout files reconcile without omission or duplication. Browser results are 8,808 pass plus ten source-declared fine-pointer exclusions with twenty passing coarse/mixed counterparts; layout is 1,098 pass. Endurance passes its one complete case: 588 chunks / 9,665,247 bytes, 599.769 seconds saved and 599.699977 seconds decoded. All four healthy native backend/UID cells and the other runtime phases pass. The constructed automatic-index failure is separately verified with qualification: false, never counted as a healthy fifth cell. All receipt checkouts match; no retained browser/layout execution is claimed.

Prepared integration candidate — 2026-10-16

Head 9f43da32033eb10545c027cc8bea9568a30ce438, tree a05f8502374b54c2bc1339a68f99d7d16b74a05f, integrates current main 9506026705425653a40608395aa756cae2a344b2, including the #1862 candidate-confirmation policy, #2071 Pi transcript/startup behavior and #2064 Claude Git-prefix suppression. No native authority guard was weakened in the integration.

• Committed-tree bun run check:pr --base origin/main: 862 pass / 5,534 expectations, including lint/leakage/env/changeset and citation checks.
• bun run typecheck: passed.
• Focused real SDK options/native worker/runtime proof: sixteen tests / 172 expectations passed on this integrated tree.
• Full pending changeset status remains minor-only, with all package references recognized.
• Earlier adapter correction: fourteen tests / 101 expectations. Earlier full real policy-boundary receipt: nineteen tests / 582 expectations, in an offline namespace with private temporary storage and worker-visible system Python. These remain attributed to the earlier corrected source described in comment 6213899734; the new integrated tree awaits its own complete hosted proof.

The original run 38885909564 failed four stale absence-of-native assertions. They were corrected to require retained registration and actual strict/voice refusals, preserving all policy, descriptor, alias, subagent, capture and authoritative-route checks. The independent valid-prior-read NotebookEdit fixture proves the mandatory host-hook denial, rather than accepting an upstream unread-input refusal. No failed/older-base run qualifies this candidate. That prepared head stayed draft until its integration and serialized ready event described above; it did not receive a completion claim.

Original implementation receipts

Base: ab0e9fb77a236cefbe5a0b19424836acf9205bde. Installed SDK/CLI identity is asserted against MEASURED_RUNTIME by the real-runtime tests; no provider credentials or external inference calls are used.

• Failing first: all four new SDK-options cases fail on the unmodified tree. Governed typed fails GOVERNED_NATIVE_AUTO_ALLOWED because Write was replaced by the bridge name; strict/voice fail NATIVE_ROSTER_STABLE because native Write was disallowed.
• Mutation: restore unconditional hosted migration → governed typed fails GOVERNED_NATIVE_AUTO_ALLOWED; restore the fix → passes.
• Mutation: disable native authority refusal → every strict/voice runtime case fails FIRST_PARTY_NATIVE_AUTHORITY_DENIAL; restore the guard → passes.
• Real createClaudeSdkTurn options, real isolated worker and installed Claude, loopback Messages endpoint: twelve cases cover all three natives under fresh/stale/strict/voice conditions. Complete request-visible tool definitions are byte-identical. Governed writes raise no cards, hold the shared write lock and reject byte-stale reads with preserved mtime. Strict/voice calls refuse before handlers, even with settings permissions and a granting settings hook. The scripted bridge would allow a card, so zero cards is asserted rather than assumed.
• bun run test packages/ui-backend-claude: 591 passed / 2,391 expectations.
• bun run typecheck: passed.
• bun run lint: passed (existing unrelated React hook warnings remain).
• bun scripts/check-changeset-packages.ts and full bunx --no-install changeset status: passed; the full pending plan has eighteen minor bumps, no major bump.
• bun run check:pr --base origin/main: passed, 852 tests / 5,464 expectations, including all citation checks.

The final comment-only citation correction also passes the same 852-case preflight (5,464 expectations). Restored focused proof: sixteen tests / 172 expectations. PR #2065 and issues #2022/#2048 have milestone 0.44.0, confirmed against registry latest 0.43.1 and live milestone metadata.

Initial run 38885574888 was deliberately cancelled by returning to draft for that citation correction; it is not claimed as proof. Selected final-head hosted proof and exact checkout evidence will be reconciled before matching-head merge.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria are implemented; fresh advanced-base confirmation remains pending above.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.

Anything left open

Fresh exact-base confirmation and resolution of the #2111 integration blocker remain pending. Broader bridge-tool roster stability remains scoped to #2048. This PR proves stability for its configured native/server roster across governed typed, governed voice and strict turns and preserves current server-tool authority; it does not claim completion of #2048.

Session merge authorization — 2026-10-16

The maintainer explicitly authorized merging after tests passed once without repeating full confirmation solely for main advancement, with integration conflicts detected in postmerge proof. This authorization supersedes the earlier #2111 freshness handoff and pending-refresh statements above for this session. Historical passing receipts retain their actual tested head/base identities. Actual merge conflicts will be resolved and focused checks recorded before normal matching-head squash merge. Automatic main proof remains enabled. No implementation criterion is deferred.

Resolved integration — 2026-10-16

Actual merge conflicts with #2073 were resolved at ae059a4ec1671c80a05c3ebf44a792ff90fcf216, integrating main b70d422576725f968c3bd2f37a3a36367e6c4697. Both the stable full tool roster/availability guards and configured native auto-allow with strict/voice execution refusal are preserved. Combined native permission/runtime, stable-roster/runtime and actual application-adapter suites pass 65 tests / 590 expectations; citation checks pass 44 tests / 113 expectations; typecheck passes. The earlier full hosted run 38895995663 remains attributed to its recorded older source identities. Under the maintainer's explicit instruction, full suites are not restarted solely because main advances; actual squash ancestry and automatic main proof are reconciled after normal matching-head merge.

[schlessera]

Main advanced through #1862 to 5af945306, changing the candidate-confirmation workflow and proof harness. The existing run 38885909564 remains evidence for its original base ab0e9fb77; it will not qualify the new combined candidate.

The policy integration is prepared locally with no product changes. Updated bun run check:pr --base origin/main passes 862 tests / 5,534 assertions. The existing selected jobs are allowed to complete before publishing the integrated candidate and requesting fresh confirmation. Original failed or cancelled receipts remain distinct.

[schlessera]

The original ready run 38885909564 completed with failures in four stale registration assertions: one application-adapter case in unit shard 1 and three policy-boundary cases in shard 2. Those cases expected native Write/Edit/NotebookEdit to be absent from strict/voice tool rosters, contrary to selected #2048 A. They now assert retained registration and actual execution refusal; policy bytes, aliases, mappings, descriptors, subagents, capture and authoritative-route assertions remain intact. NotebookEdit may reject an unread input before hooks; the separate native runtime fixture uses valid read receipts to prove its mandatory hook denial.

The corrected adapter file passes 14 tests / 101 assertions. The full real policy-boundary file passes 19 tests / 582 assertions in a keyless network namespace with private temporary storage and worker-visible system Python. Earlier local attempts remain incomplete receipts: the default Python was under a masked home, and a separate run observed maintenance-budget contention; the latter observation is recorded on #1890 without attributing the reservation to an unknown owner. No guard or budget was weakened.

Updated exact-head preflight passes 862 tests / 5,534 assertions. The published branch includes #1862's CI policy integration and the corrected tests. The PR remains draft in the serialized final-confirmation queue; none of the failed or older-base runs qualifies the corrected candidate. A fresh ready event will request full current-base proof before merge.

[schlessera]

Actual merge conflicts with #2073 were resolved at ae059a4ec1671c80a05c3ebf44a792ff90fcf216, integrating main b70d422576725f968c3bd2f37a3a36367e6c4697. Both the stable full tool roster/availability guards and configured native auto-allow with strict/voice execution refusal are preserved. Combined native permission/runtime, stable-roster/runtime and actual application-adapter suites pass 65 tests / 590 expectations; citation checks pass 44 tests / 113 expectations; typecheck passes. The earlier full hosted run 38895995663 remains attributed to its recorded older source identities. Under the maintainer's explicit instruction, full suites are not restarted solely because main advances; actual squash ancestry and automatic main proof are reconciled after normal matching-head merge.