[777genius]

Problem

Embedding applications need the Go CLI's resolution, installation policy and recovery authority through a stable language-neutral interface, without terminal-output parsing or another installer in every language.

Changes

• Add one OpenAPI 3.0 management contract and an owned loopback HTTP process around existing Go application/installer use cases.
• Use oapi-codegen, openapi-typescript and openapi-fetch. The handwritten TypeScript client/Node lifecycle surface stays focused; an independent standard-library Python client demonstrates the language boundary.
• Retain reviewed plans, immutable captured context and durable accepted request identity. Lost-response retries observe the same work; interrupted work requires fresh proved recovery through existing native receipts/journals.
• Support verified registry plugins, standalone-Skill discovery/preview, saved dependency updates, locked restore, repair and selected removal.
• Keep local authoring, ownership refusal, exact-byte patches and reversible directory recovery in Go. Preserve edited native files and public manual activation instructions.
• Correct capacity admission: all 16 retained reviews remain applicable without consuming a seventeenth slot. Preparation limits, mutation fencing, freshness and accepted-request deduplication are unchanged.
• Distinguish same-name local restore points using optional recorded time and original action; bind confirmation to the exact retained operation identity. Receipt, ownership, snapshot and stale-plan checks remain authoritative.
• Show bounded, verified security warning reasons instead of only a count, without exposing arbitrary scanner messages/paths or weakening blocking policy.
• Preserve the existing installer SDK and native adapters. No daemon, second installer, database, custom RPC framework, unused language SDK or public release.

Plan and integration

Reviewed plan v11 and scenario/evidence matrix
· Per-alert source/guard/sink remediation record
· Agent Teams integration PR #989

CLI project foundations have landed through #472/#499; earlier #475/#480 drafts were consolidated. Management still explicitly supports user scope. S25/S26 require the qualified project identity and final-worktree preparation boundary; they are incomplete. The separate draft Host migration is not imported. Unsupported scope is refused and never counted as successful project installation. VS Code remains frozen.

Security corrections

The earlier blanket false-positive conclusion is withdrawn. A fresh independent audit of the owner's exact seventeen-alert list found a real package-link validation flaw and a missing journal-read confinement boundary.

• UAP feat(agentplugins): support comma-separated targets #50: resolve each directory symlink before processing a following parent component. Reject package-root escape, missing components and non-directory intermediates; preserve legal internal links, original target text, digest framing and bounded expansion.
• UAP fix(agentplugins): project Kiro stdio runtime paths #55: open directory-swap journals with Go's standard os.OpenInRoot, require a regular file and read through the same confined descriptor.
• UAP fix(agentplugins): verify batch lifecycle proof output #54: reject unsupported local Management archives using the existing offline source grammar, eliminating the unnecessary filesystem metadata probe. Ordinary CLI local-source support stays intact.
• All remaining UAP alerts have explicit input → guard → sink reasoning in the linked record, including the private-root assumptions, deliberate support for private HTTPS publishers and trusted startup executable authority. The record does not claim DNS-rebinding protection or hostile same-user process isolation.
• UAP feat(agentplugins): harden lifecycle and release E2E #47 follow-up: retain pre-open nonregular-file refusal, confine the receipt open with os.OpenInRoot, then validate and read the same descriptor with a 65,536-byte limit. Seven public restore cases cover exact-limit success and malformed, oversized and linked inputs while preserving active content and backups.
• App alerts #580/#581 were corrected in the linked integration PR through PR-only/cache-denied execution and a fixed CDP function with protocol arguments; their fresh current-pin App qualification is tracked there.

Current UAP SDK/E2E status — 2026-10-28

Current head: 51bf9f9dc5944e05e3aab097ff42aad0651c0c7c. Main 031a126d3f9aa524fce7f0fee4aab45d8ee85d3f is incorporated, including #548's native Pi support and the subsequent workflow-concurrency-only change. Earlier SDK/App receipts below retain their original source identities. Actual fresh CI checkout: 41c9453b841f28dd2715284039cbf382edf84122, with parents b2ecab27efc5d223ef1c17acb7c89eee55c3f145 and 51bf9f9. The additional main change touches 62 files exclusively under landing/; no Go/SDK/installer/workflow build inputs changed.

• Complete the existing UAP SDK lifecycle qualification: real owned-child signal-denial regressions, build/typecheck/46 tests/packed consumer on three OSes, and SDK → real Go → pinned OpenCode lifecycle in the existing native matrix.
• Preserve PI_CODING_AGENT_DIR and QODER_CONFIG_DIR during Node discovery so these existing native profile selectors reach the Go engine. Extend the existing environment test; the credential and launch-option exclusion assertions remain. This does not add a new SDK API or claim native Pi E2E.
• Reconcile main's Pi discovery count/support row with the SDK's executable-presence assertion. The merge tree was checked against all 5,951 expected leaf entries before publication.
• Extract only test-fixture target construction to satisfy the existing funlen rule; preserve the fixture behavior and lint thresholds. Independent comparison reconstructs the entire previous fixture exactly when the helper is inlined.
• Keep the explicit 15-minute Go suite budget within the existing 20-minute Terminal job. Two earlier runs exhausted the default 10-minute package budget; the qualified preceding Windows run passed the CLI package in 590.145 seconds.

Fresh qualification of this head is running:

• Required 40732128184: all four lints and the three SDK cells PASS; the full Go suite is still running. Actual Linux, macOS and Windows logs each confirm checkout 41c9453, build/typecheck, 46 passed / 0 failed / 0 skipped, native profile locator and all three signal-denial cases, and the clean packed-consumer check. Linux generated-contract drift also passes.
• Native 40732128063: six existing native cells, including the actual SDK/OpenCode macOS lifecycle.
• Terminal 40732127889: Linux/macOS/Windows.
• CodeQL 40732128155: both analyses must complete before assessing the findings gate. The preceding qualified head retained only alert fix(release): add verify-only npm recovery #45, whose intentional private-HTTPS capability disposition is reviewed but has not been applied through GitHub.

No local execution is claimed while the execution environment is unavailable. This continuation covers UAP SDK/user-scope management. Agent Teams member-runtime/profile/worktree architecture, S25/S26, new language SDK implementations and public releases remain separate.

Preceding SDK completion — 2026-10-28

Preceding SDK source: 95fa82eba339f30d6a7534fbd34642ee98b36331; its actual CI merge is 3797191f9aa19cdf565b250cf0fef210b0883912. The subsequent qualified head was 21863d016a89269677320f6180878f0a25e5b991, CI merge 8098698fa504b2d665ee6d26bf18b5c944453947, on main 272e7ba8a0f8a05d73c35e600be3f57f16e72057. These are preceding-source results.

• Correct a real Node lifecycle defect: a denied process signal emits error without proving exit. The owned host now continues shutdown escalation and reports SHUTDOWN_TIMEOUT if termination remains unconfirmed; discovery keeps repeated signal errors handled.
• Add three regressions using real owned child processes and controlled signal denial. They check successful escalation, refusal without false exit, continued authenticated service when the process remains alive, and bounded exact-child cleanup.
• Run SDK build/typecheck, the 46-test suite and the actual isolated packed consumer on Linux, macOS and Windows. Generated-contract drift remains checked on Linux; checkout preserves exact Git bytes.
• Wire the existing SDK → real Go → pinned OpenCode example into the macOS OpenCode native cell. It exercises installation, update, repair, edited-byte preservation, lost accepted response/process death/recovery, removal and local create/edit/delete/restart/restore. The gate binds commit and both binary digests to the native proof and requires successful process completion as well as the final receipt.
• Two independent source reviews found no P1/P2 in these seven changed files. The fresh hosted results are recorded below. No new public API, installer implementation, team runtime/profile design or release channel is added.

Fresh SDK qualification

• SDK matrix: SUCCESS on all three OSes. Linux, macOS and Windows each pass build/typecheck, 46/46 tests with zero skipped, all three denied-signal regressions and clean packed-consumer typecheck/runtime imports. Actual logs confirm checkout 3797191 for this source; the Linux generated-contract check also passed.
• Real SDK → Go → OpenCode E2E: SUCCESS. macOS job 122926885712 completed the five baseline native tests, SDK build and the new lifecycle step. Its actual output records Real SDK / Go / OpenCode lifecycle passed for 95fa82eba339f30d6a7534fbd34642ee98b36331 after bounded process completion and all receipt/source/binary-digest assertions. Artifact 12831637230 is 658,842 bytes, ZIP SHA-256 bcf78adc258943a5e7014678529a935544619bde553b60e69a746fb8d78d1b1c. The actual step log, exact workflow assertions and artifact metadata were reviewed; no independent ZIP-content audit is claimed.
• Source 95fa82 Required and Native are fully SUCCESS. Required 40719695821 passed its full tests, all four lints and the three SDK cells. Native 40719695715 passed all six Claude/Codex/OpenCode jobs on macOS/Windows, with no skipped required native scenarios. Terminal Linux/macOS passed; Windows hit the suite-budget problem described below. Its CodeQL Go analysis passed while the second language was still pending before the workflow-only follow-up.

Workflow-only terminal budget correction

Commit 21863d0 changes exactly one line in .github/workflows/terminal-ui.yml: the broad CLI suite now uses go test -timeout=15m inside its existing 20-minute job ceiling. All individual scenario/process deadlines and assertions remain unchanged. Git-tree comparison confirms identical Go, SDK, contract, installer, script and native-workflow inputs relative to the qualified 95fa82 source.

This follows a second actual Windows package timeout on unchanged Go source: job 122926878320 reached the default 600-second package alarm while TestSourcesAndStandaloneSkillsShareSavedColdRepair had run for only three seconds. There was no failed assertion; cmd/agentplugins separately passed in 409.863s. Earlier complete package runs took 516.345s and 578.934s, so the implicit 600-second whole-suite budget lacked runner-variance margin. A second unchanged-source retry is not being used as a substitute for that correction.

Current automatic verification: Terminal 40724745169, Required 40724745289, Native 40724745158 and CodeQL 40724745277 are queued/running. The completed SDK/native receipts above retain their exact 95fa82 provenance; they are not relabelled as later builds.

The new SDK source is qualified independently in UAP. The completed App receipt below remains honestly attributed to SDK/engine source 53a4332; it does not qualify this later SDK change.

Completed preceding-source qualification — 2026-10-28

The existing user-scope Management E2E is complete for the exact pair UAP 53a433298e626d9831adb55bd6fca422cedd5d89 / App ac1c8bc60436e546c0f9300a490c31a11f43da13. UAP incorporates main 27b96f2468acae1b14b5dfeac905384bc50e8b71; App incorporates main 805003575a8bf3d0790ed15c9cae8998b29a9392. Actual UAP CI merge c25c70f4b468a34994719871f1f9805263258a56 and source 53a have the same tree 34e8501e968a3cab5e6aaff67b8a02280b173a78. Actual App CI merge is ff73610b02e03563a938f4cbc0ebbae041fef06e.

Three narrow corrections finish the existing qualification:

• The macOS native evidence helper reaps its exact exited child and retries the same process group once after EPERM from a zombie-only group. Live-child and persistent permission errors still fail; a surviving descendant must still be terminated. The new regression fails against the old helper. Native safety suites pass 78 + 42 checks, including on hosted macOS.
• Management Skill review/recheck now passes the explicitly selected targets to the existing shared preparation. A real HTTPS regression proves that a Codex-only request preserves an edited, unselected Claude installation, its bytes/identity and saved intent. It fails against the merged old call and passes after the one-line correction.
• 737b85030e99d40c1ebaabd5f1b9ac55191ba759 changes only .github/workflows/physical-profile-native.yml. The historical negative control previously replaced the complete seam with a file predating main's current interface, producing a compile error instead of the intended regression. The corrected overlay restores only the pinned historical projection guard in the current seam. Historical hash/single-match checks, current positive assertions and the exact old selected projection callback calls=0, want 1 failure remain required. Hosted Physical profile 40704028184 is SUCCESS on all three platforms. Its actual Linux log proves the current positive and the precise historical-negative behavior, without a compilation failure; local red/green validation also passed without skips.

The workflow-only follow-up does not change Go/SDK source, native provisioning, native/SDK build inputs or product tests. App provenance remains honestly pinned to source 53a; the completed receipt is not relabelled as a build of the later workflow commit.

Fresh qualification evidence

• Required 40698325330: SUCCESS, all six jobs, including the full Required tests, four module lints, SDK 43/43, typecheck and clean packed-consumer runtime imports.
• Native Client Runtime 40698325086: SUCCESS, all six Claude Code / Codex / OpenCode jobs on macOS and Windows. This includes the formerly failing OpenCode macOS lane.
• Fresh App Electron 40699038602: SUCCESS. Artifact 12821167893 contains the completed receipt and 30 screenshots. Independent audit passes 168 receipt conditions, including all 15 raw native CLI digests/parsed listings; root also inspected the receipt and actual UI screenshots. Receipt SHA-256: bbf0e3c556d56d0c61a83dd91291b183741e703d0fa7a27fd1a84d4273fe2a70.
• App Full 40699038777: SUCCESS, including Windows task-ledger qualification. App CodeQL 40699038596 and its separate findings check pass. Public bootstrap 40699038847: SUCCESS, all four platforms. Intel Mac required one failed-job retry after a release-download fetch failed; the exact asset digest matched the lock and the unchanged-source retry completed download, checksum, extraction, receipt/version execution and cache reuse. Packaged matrix 40699038669: all five actual platform jobs SUCCESS (Linux x64, macOS x64/arm64, Windows x64/arm64). The final packaged full gate aggregate also completed successfully; the complete App packaged workflow is SUCCESS.
• Completed UAP workflow-only source 737b850: Required 40704028303, Native 40704028199, Physical profile 40704028184, Authoring 40704027989, both CodeQL analyses 40704028158 and the remaining functional workflows passed. Terminal 40704028095 completed successfully after one unchanged-source Windows retry: the broad CLI package took 578.934s, below Go's existing 600s package deadline, while the first attempt timed out at 600.099s without a failing assertion. No timeout or assertion was weakened. At closure there were 70 successful checks, one neutral and no pending checks; the separate findings aggregate still reported one Critical.

The desktop receipt proves UI install → version-2 update → all three targeted removals, with exact surviving native identities/source locations/file bytes; local create/copy/edit/delete/restart/restore including binary bytes; HTTP Host/Origin/capability and restart revocation; S27's five refusals while exact lead/worker identities remain alive, owned stop, and successful post-stop update; and real OpenCode plugin MCP initialize/list/call with nonce plus a fresh session without the removed tool. It records completed=true, artifacts.trackedDirty=false, rendererErrors=[], passive unchecked Cursor discovery without executing it, and the 760px layout.

The clean SDK archive is 25,338 bytes, SHA-256 570d947dd47766ea52613432dc4615b32df1ea390936f22e94b71bed6bcc79c5; source, package/lock and native provenance agree on 53a. The receipt's Linux engine is 0.1.91+agentteams.53a433298e62, SHA-256 e38e3d2c033f06e4e6dfe7940fc01592b661b2ba713b1096c2bf8ac21c9d016c.

Current security disposition and scope

Fresh Go/TypeScript CodeQL 40698325081 analyses succeeded. Go analysis 2045469119 on actual merge c25c produced 12 findings/42 flows. After independent source → guard → sink review of all 38 candidate flows, exact-source/tree verification and checking every alert's ref instances, 46, 48, 49, 50, 51, 52, 53, 56, 57, 58 and 59 were individually dismissed as false positives through gh by 777genius, each with its own justification. Previously corrected 47, 54 and 55 remain fixed.

The findings gate now reports one Critical: #45, request forgery. It remains open. Authenticated local-owner selection of private HTTPS publishers is an intentional capability, not a sanitization false positive; the existing checks do not provide private-IP exclusion or DNS-rebinding isolation. The reviewed plan explicitly preserves this intentional local capability and requires its formal alert disposition. A new separate owner-approval requirement was not found in the owner instructions; the current request already authorizes completion and merge. The reviewed disposition is won't fix for the existing intentional local capability, not a sanitization false positive. No query suppression or protection bypass was introduced.

The accepted S01–S30 matrix uses Go/transport/renderer/native evidence at the appropriate layer. This completes the existing user-scope management lifecycle, not every team member's managed Skill-body/plugin-MCP consumption. The model boundary is scripted; live-model/OAuth behavior, runtime/profile alternatives A/B and S25/S26 project/final-worktree preparation retain their explicit separate owner-decision boundary. Runtime 0.0.145 was inherited from App main; no new loader or projection workaround was added.

Previous qualification — 2026-10-26

Published UAP head: 1d2769d99f5f2408c1801b1c6be9c7c1225aa09f, a single-test-file follow-up to 86d4d0d4bfc68ea454f9df8840f23461eb043177. Actual synthetic merge 812f2a7f0c53d0131d6b60e91f547638617d5247 has parents main 9e705ddda90be8edaef943b1b9feb16d5e6c1996 and this exact head, with tree 6eba99f494fdb58156eba60ad8eb80238fedfbf4. Direct recursive Git-tree comparison with the preceding tested merge proves the sole changed file is management_archive_update_test.go; production, SDK and security guards are unchanged.

Portable archive lifecycle fixture. The preceding Windows terminal job passed its terminal/ConPTY scenarios, then failed the broad CLI lane because the selected OpenCode executable was compared with an uncanonicalized temporary path. The unmodified three-target test reproduces the same failure under a real temporary-directory symlink while its Claude/Codex control passes. Canonicalizing the existing executable parent at fixture construction makes both cases pass on physical and aliased roots. Exact executable comparison, the no-unselected-probe/zero-probe guards, update identity and delivered-byte assertions remain byte-identical. Two independent reviewers approved the six-line addition/one-line replacement; no production guard or CI gate changed. Fresh Windows confirmation remains required.

Current-source workflows:

• Required 40398586980 is SUCCESS: all six jobs passed on actual merge 812f. SDK 43/43 plus clean packed-consumer typecheck/runtime imports, all four module lints, full Required/generated/manifest/vet and conformance 133 pass/0 fail/0 error/0 skipped/0 warnings pass. Root and an independent reviewer read the actual checkout and final test log.
• Terminal and Windows regression 40398586774, Windows job 121838091415.
• Native Client Runtime 40398586915.
• CodeQL 40398587317: both analyses are pending; there is no current-head findings verdict yet.

Matched downstream package. App 42c1c2a90773af39cfaf272b93079cf2084f061f incorporates current App main dc66ae9e3dbe8ad50221c6f0857762c105660b1f through merge 0bdbb0225292d93d16aeceea53b89cdf1e0d55a3 and pins this exact UAP source. Its clean-source SDK archive is 25,338 bytes, SHA-256 570d947dd47766ea52613432dc4615b32df1ea390936f22e94b71bed6bcc79c5, byte-identical to source 86. Fresh local packed-consumer checks, frozen App install and all 2,522 supply-chain entries pass. The ordinary native stager builds 0.1.91+agentteams.1d2769d99f5f; Linux binary SHA-256 is 7c72068fa6b62aecffc963c89e9c5273efd8bff189c59b25404e71a81afd3a78. Existing packaged source/version/platform/digest guards pass. Its fresh hosted gates are recorded in App #989; no earlier receipt is transferred to the new pin.

Fresh downstream Electron is complete for App 42c/UAP 1d. Run 40400598247 is SUCCESS on exact merge efbc3fb7cb2e7cff7f983557656f0c593b82a2be (parents dc66 and 42c, tree 0090b6b0). Artifact 12689840569 contains 30 screenshots and the complete receipt. ZIP SHA-256 9c5e53b8577a00b14d7234e8de6474f8216851d784008ec29b56b5ee85655efc; receipt SHA-256 638e9a0b564e0a1ce1559bdbab4d0bea12be1df8a9bcfc2ac4fdfa61596e0ed9. Independent review passes 131 receipt conditions plus all 15 raw native CLI digests/parsed listings. All three UI/native plugin installations, version 2 updates and targeted removals complete with exact surviving identity/source/file preservation; S27 verifies five active-run refusals, exact owned lead/worker stop and successful post-stop update. Native OpenCode plugin MCP invocation and fresh-session absence after removal, local recovery and HTTP authority checks pass. completed=true, trackedDirty=false, rendererErrors=[]. Source 1d/SDK 570d/native 7c720 match throughout. Actual-team Skill-body consumption remains unqualified; the model boundary is scripted.

App 42c also passes its complete canonical Full qualification (21:34:20 UTC), all four anonymous bootstrap platforms, both CodeQL analyses and the separate no-new-alert findings gate. Its packaged matrix and UAP native/Windows/security gates are still running or queued; no pending gate is implied by the completed Electron/Required/Full results.

Concrete team-loading boundary under owner discussion. Further exact-source review and the completed App 42 native/model receipts establish that UAP's official Claude @skills-dir envelope is not an automatic plugin source in pinned team runtime 0.0.140. The runtime's immediate Skill-directory loader sees the direct local copy; its plugin loader combines marketplace, explicit session and builtin plugins. Two independent reviewers recommend adding native format support within the runtime's existing policy-aware loading pipeline before claiming managed original Skill/plugin-MCP use by every supported team member. Profile alignment alone cannot add this missing format. The full source links, artifact digests, alternatives and limitations are recorded in App #989. An additional standalone native-call diagnostic did not execute because of workspace capacity, so it supplies no native-call result. No projection, app forwarding, runtime capability or production policy was changed.

Completed preceding-source evidence. Required 40384418585 passed all six jobs on source 86 and tested merge 6b674877f5e313ed4685b3f6fed0482a04563931, including full tests/generated/manifest/vet, four lints, SDK 43/43 and downstream conformance 133 pass/0 fail/0 error/0 skipped/0 warnings. Its later Windows fixture failure is the correction above; overall platform qualification was not complete.

On App 0f967c52822de8612e9dc1124bb756400ad0621d / merge 58507d045ff768b8d53161d885797c1cc3548b51 with source 86, Electron 40392234241 fully passed. Artifact 12686472315 contains the completed receipt and 30 screenshots; ZIP SHA-256 5c4acb4f00ac04d2c2772219b7c00f1f2e664091928ca0cc2752b4375ca01b00. Independent audit passed 103 receipt checks and all 15 raw native CLI digests: three-client UI installation→update→all targeted removals with exact sibling identity/byte preservation; S27 active lead/worker refusal and post-stop update; local Skill recovery; HTTP capability boundaries; installed/removed OpenCode plugin MCP. The model boundary is scripted; per-member Skill-body use and OAuth remain unqualified. App 0f Full types/build/all Linux test shards/lint, bootstrap 4/4 and the separate no-new-alert CodeQL gate passed; its remaining gates were not substituted for later sources.

Owned-process recovery is retained. The SDK read-only hasExited reflects the exact child's exit code/signal, never an HTTP error; the SDK does not restart or replay mutations automatically. Real-child regressions, the 43-test suite and clean consumer qualify that contract. The App independently proves old cached-dead-context failure and corrected reconnection with real Go, preserving captured authority, original request identities and durable-work fencing.

The last completed UAP findings aggregate remains the historical 0311 result documented below, not a 1d verdict. Current #46 source clarification records the confined same-descriptor receipt reader; the thread remains open for formal security disposition. No alert dismissal, merge or public release is claimed.

Previous matched integration qualification at 0311d9b

Published head: 0311d9b373725a80d6be529717b726a3e1910f97. The matched Agent Teams #989 head is 75ec93b425a7bda84083bfeb883aa1fc548481e5.

Three-client update correction. The actual Electron journey installs one plugin into Claude, Codex and OpenCode, then refuses update preparation because the selected Claude update lacks prepared host facts for its installed OpenCode sibling. The real HTTPS-archive Management regression reproduces the failure for all three targets while the Claude/Codex control passes. Preparation now includes only verified installed siblings of the selected installation, checks binding identity before probing and freezes a separate host snapshot. Apply still revalidates root, executable and version; unrelated OpenCode installations create no new prerequisite. Six new sibling cases, 27 existing host protection cases and both archive lifecycle variants pass. Independent reviews found no remaining P1/P2.

Passive target discovery. Add a bounded private manage discover command and Node SDK discoverTargets export using the existing Go detector and registered user-scope policy. Fixed argv, filtered environment, validated identities, 64 KiB/32-target bounds and owned deadline/abort cleanup apply. Discovered native clients are never executed. Safely inspectable undetected profiles retain existing-binding inspection/removal; new installs refuse before acquisition. Unsupported detected clients are display-only and receive no startup authority. This does not add project scope, local authoring roots or team runtimes.

The SDK was built and typechecked from the exact committed source. Its archive is SHA-256 3f7b3984149099d2e9beecf13a0f89aaba10c47a3059c387998de9345f4730f3; the downstream engine version is 0.1.91+agentteams.0311d9b37372. All 41 SDK tests pass. Initial broad CI correctly caught two fixture issues: duplicate main functions in one Go package, then an unconstrained PID marker write. Separate executable packages and a root-confined literal marker correct those without exclusions or suppressions. The Go 1.25 file minimum matches the API; the actual pinned Go 1.26.10 includes and scans it. Exact golangci-lint 2.13.2 and all 14 discovery tests pass after correction. These fixture-only follow-ups leave packaged SDK bytes unchanged.

Fresh Required 40374865422 is SUCCESS: all six jobs passed. This includes the complete make test-required, downstream conformance (133 pass / 0 fail), four module lints, 41 SDK tests and a clean packed-consumer typecheck/runtime import. Core fast 40374865445 has passed test-core, lint, vet and cross-builds; remaining platform jobs are queued. Coverage, all govulncheck jobs, Windows native Codex and macOS/Windows physical-profile checks pass. Other native/platform jobs remain pending.

The tested merge b821ffa4949d4fcc7a0f59dd825b002b4ad65ba5 has actual parents main 9e705ddda90be8edaef943b1b9feb16d5e6c1996 and this exact head; Required test and SDK checkout logs confirm it. Earlier green workflows do not qualify changed source.

Both current CodeQL analyses 40374865289 are SUCCESS, including the Go manual build. The separate current-head findings check 121780953133 is FAILURE: 12 alerts, 2 Critical / 10 High. This is a genuine findings blocker, not an analyzer/build failure. The counts match the previous snapshot; the available API does not establish identical alert IDs. No formal alert disposition, suppression, permission change or protection bypass has occurred. Matched App full Electron/package qualification remains in progress.

Previous retained-installation correction at 2647dcc

After last-binding removal, reuse only the uniquely inspected empty installation/source-binding identity, preserving PLUGIN_DATA and ownership receipts. Ambiguity, prior-review drift and foreign live bindings do not grant reuse; empty Directory identities cannot borrow live-installed release eligibility. Same-client and cross-client regressions fail against old production and pass after correction. Actual App e740 Electron now completes S27 and three-client native installation; its subsequent update failure is addressed above.

On 2647dcc, Required and the applicable native/source workflows pass. Both CodeQL language analyses also pass, but the separate findings check 121728308783 remains failed with 12 findings: 2 Critical / 10 High. Current 0311d9 analysis/findings results are recorded above and preserve the findings blocker. No formal alert disposition, suppression, permission change or protection bypass has been performed.

Previous qualification at e84

Published source: e84b4da218f4445986daa9ed15f40acd828ae06f, tree e7c4520f86131538cdb28d0c82af797036f38544. Main d5c16856cef67a1457704971d46765739141ab08 is incorporated. The qualified synthetic merge is d11b9b3cd5a56a3da3832b18bc9b8f494c6ec760.

• All 16 workflow runs completed successfully. Across current-head checks, 63 succeeded and one failed, with none pending: the separate CodeQL findings aggregate.
• Required 40316582875, Core fast 40316582871, Native Client Runtime 40316582761 and Terminal UI 40316582805 passed. These include the applicable generated/packed SDK, module tests, native clients and platform/project contract gates.
• Both languages in CodeQL 40316582730 succeeded. The separate findings aggregate 121558802770 still fails with 12 findings: 2 Critical / 10 High, down from 13. Analyzer success is not security acceptance.
• The feat(agentplugins): harden lifecycle and release E2E #47-linked review thread was automatically resolved and marked outdated by github-advanced-security[bot] after the confined receipt correction. This is an observed review-thread state, not a substitute for an unavailable per-alert API record.
• Current-main reconciliation preserves scoped environment/removal authority. An independent critic reproduced a copied-before-publication freshness closure returning ErrPlanChanged after durable publication; the callback now observes the current request. Actual single/group project Prepare→Apply regressions and the applicable current-source CI pass.
• Independent source review found no P1/P2 in the merge reconciliation and receipt correction. The matched downstream SDK/native pin is retained in App 7f09d0d8350aae8e31fdc3e9c132914f6a68109e. App 26e2169 passed Full, but actual Electron stopped at initial managed Claude installation before S27; the next test-only source adds an isolated ordinary CLI diagnostic. Exact current Electron/platform/security results are tracked in #989.

Historical security review at e84

A read-only full-source Go scan was reproduced at exact source e84b4da with official CodeQL 2.27.3 and Go query pack 1.6.13, using the same six module builds. It produced 13 findings/75 flows: 12 sink locations correspond to the current PR findings, plus one unchanged legacy archive finding outside the PR's changed-code set. Unlike GitHub, this local scan did not apply the PR diff-range extension. The raw SARIF SHA-256 is b65e95a5bbe1e4d24a42eb4336d18e5dbe78b4039c1a77fd92ea1f74b0cfd9fe.

Two independent reviewers traced the critical groups:

• feat: expose grouped acquisition proof #59 / command injection — proposed false positive for the reported five flows. Git acquisition constructs a literal git at argv[0]; request-derived values remain later validated arguments. exec.Command(argv[0], argv[1:]...) invokes the vector directly. The reported flows propagate slice taint into the program slot; two native-credential continuations are also infeasible for the relevant command. This does not deny that the trusted OS owner's Git/SSH helpers may execute configured programs.
• fix(release): add verify-only npm recovery #45 / request forgery — proposed accepted intentional local capability, not a sanitization false positive. An authenticated local capability holder can choose a private HTTPS publisher. Exact Host/Origin and bearer admission, credential-free HTTPS, refused redirects, fixed well-known index coordinates, same-publisher derived paths, TLS and bounded reads apply. No private-IP denylist, DNS pinning or DNS-rebinding protection is claimed. An internet-facing or multiuser proxy would require a different policy.
• The ten path findings were reviewed separately against strict receipt IDs, scoped containment, normalized package paths, private acquisition roots, validated inventories and corrected component-order link resolution. No additional source defect was established by those reported flows; the linked ledger retains each boundary and its private-root assumptions.

These were review proposals at the e84 checkpoint. The current 2026-10-28 exact-source review and eleven individual false-positive dispositions supersede that historical status; #45 remains open as recorded above.

Historical evidence

UAP 8645 and App 7667 previously passed their applicable Required/Full, actual Electron, bootstrap and packaged workflows. The twenty-screenshot Electron receipt, packaged receipt and Python/native receipt retain those source and artifact identities. They do not qualify this changed engine or App harness.

Those historical App receipts cover OpenCode plugin install/removal and standalone Skill install/update/removal. The new exact-source three-client UI install/update/removal receipt is recorded in Current qualification above. PR macOS packaging is unsigned; ad-hoc Mach-O fixture checks do not establish Developer ID signing/notarization.

Remaining merge gates

Finish the fresh 51bf9f9 automatic qualification and formally dispose the remaining UAP #45 finding with the reviewed intentional-capability justification; then verify the actual base/head and final findings result before merge. The user has authorized completion and merge. Source review does not itself change the alert state. The current connection has no alert-disposition operation and its execution environment/CLI is unavailable, so that formal operation is pending; no gate or protection is bypassed.

The older 21863d0 UAP functional suite and the exact-source App Electron/Full/bootstrap/packaged qualifications are complete as recorded above. Per-member managed Skill/plugin-MCP consumption and S25/S26 project/final-worktree preparation remain separate architecture work; they are not counted as complete by the UAP SDK E2E.

No public package, release or tag is included. Source changes remain on this PR.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 166 files, which is 66 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 629d8d64-3702-4079-895a-e155bbb36fce

Commits

Reviewing files that changed from the base of the PR and between 031a126 and 51bf9f9.

Files ignored due to path filters: 2

• sdks/typescript/package-lock.json is excluded by !**/package-lock.json
• sdks/typescript/src/generated/schema.d.ts is excluded by !**/generated/**

Files selected for processing: 166

• .github/workflows/agentplugins-native-clients.yml
• .github/workflows/ci.yml
• .github/workflows/physical-profile-native.yml
• .github/workflows/terminal-ui.yml
• cli/cmd/agentplugins/compose.go
• cli/cmd/agentplugins/main.go
• cli/cmd/agentplugins/management.go
• cli/cmd/agentplugins/management_discovery_test.go
• cli/internal/agentpluginscli/app.go
• cli/internal/agentpluginscli/deps_apply.go
• cli/internal/agentpluginscli/deps_directory_identity.go
• cli/internal/agentpluginscli/deps_security_warnings_test.go
• cli/internal/agentpluginscli/deps_skills.go
• cli/internal/agentpluginscli/deps_sync.go
• cli/internal/agentpluginscli/management/apitypes.gen.go
• cli/internal/agentpluginscli/management/backend.go
• cli/internal/agentpluginscli/management/local_skills.go
• cli/internal/agentpluginscli/management/local_skills_metadata_test.go
• cli/internal/agentpluginscli/management/local_skills_test.go
• cli/internal/agentpluginscli/management/operations.go
• cli/internal/agentpluginscli/management/plans.go
• cli/internal/agentpluginscli/management/reads.go
• cli/internal/agentpluginscli/management/reconciliation.go
• cli/internal/agentpluginscli/management/recovery_test.go
• cli/internal/agentpluginscli/management/review_capacity_test.go
• cli/internal/agentpluginscli/management/server.go
• cli/internal/agentpluginscli/management/server_test.go
• cli/internal/agentpluginscli/management/skills_catalog_lifecycle.go
• cli/internal/agentpluginscli/management/skills_catalog_lifecycle_test.go
• cli/internal/agentpluginscli/management/store.go
• cli/internal/agentpluginscli/management_apply.go
• cli/internal/agentpluginscli/management_archive_update_test.go
• cli/internal/agentpluginscli/management_backend.go
• cli/internal/agentpluginscli/management_catalog.go
• cli/internal/agentpluginscli/management_catalog_lifetime_test.go
• cli/internal/agentpluginscli/management_command.go
• cli/internal/agentpluginscli/management_context.go
• cli/internal/agentpluginscli/management_context_test.go
• cli/internal/agentpluginscli/management_diagnostics.go
• cli/internal/agentpluginscli/management_discovery.go
• cli/internal/agentpluginscli/management_discovery_test.go
• cli/internal/agentpluginscli/management_grok_removal_test.go
• cli/internal/agentpluginscli/management_http_test.go
• cli/internal/agentpluginscli/management_inspect.go
• cli/internal/agentpluginscli/management_lifecycle_test.go
• cli/internal/agentpluginscli/management_local_skills.go
• cli/internal/agentpluginscli/management_local_skills_apply.go
• cli/internal/agentpluginscli/management_local_skills_paths_test.go
• cli/internal/agentpluginscli/management_local_skills_receipt_test.go
• cli/internal/agentpluginscli/management_local_skills_retention.go
• cli/internal/agentpluginscli/management_local_skills_test.go
• cli/internal/agentpluginscli/management_local_skills_tree.go
• cli/internal/agentpluginscli/management_native_commands_test.go
• cli/internal/agentpluginscli/management_native_recovery_test.go
• cli/internal/agentpluginscli/management_native_remediation_test.go
• cli/internal/agentpluginscli/management_native_verify.go
• cli/internal/agentpluginscli/management_plan.go
• cli/internal/agentpluginscli/management_prepare.go
• cli/internal/agentpluginscli/management_preview.go
• cli/internal/agentpluginscli/management_reconcile.go
• cli/internal/agentpluginscli/management_recovery.go
• cli/internal/agentpluginscli/management_recovery_test.go
• cli/internal/agentpluginscli/management_refusals.go
• cli/internal/agentpluginscli/management_registry_test.go
• cli/internal/agentpluginscli/management_reinstall_test.go
• cli/internal/agentpluginscli/management_removal.go
• cli/internal/agentpluginscli/management_removal_recovery_test.go
• cli/internal/agentpluginscli/management_removal_test.go
• cli/internal/agentpluginscli/management_result.go
• cli/internal/agentpluginscli/management_result_test.go
• cli/internal/agentpluginscli/management_scope.go
• cli/internal/agentpluginscli/management_scope_test.go
• cli/internal/agentpluginscli/management_skills.go
• cli/internal/agentpluginscli/management_skills_test.go
• cli/internal/agentpluginscli/management_source_test.go
• cli/internal/agentpluginscli/management_update.go
• cli/internal/agentpluginscli/management_validation.go
• cli/internal/agentpluginscli/management_web.go
• cli/internal/agentpluginscli/root.go
• cli/internal/agentpluginscli/saved_add.go
• cli/internal/agentpluginscli/saved_direct.go
• cli/internal/agentpluginscli/saved_lifecycle.go
• cli/internal/agentpluginscli/saved_registry_update.go
• cli/internal/agentpluginscli/skills_batch.go
• cli/internal/agentpluginscli/skills_batch_prepare.go
• cli/internal/agentpluginscli/skills_batch_selection.go
• cli/internal/agentpluginscli/skillspicker/server.go
• cli/internal/loopbackapi/http.go
• cli/internal/loopbackapi/http_test.go
• contracts/management/.gitignore
• contracts/management/README.md
• contracts/management/generate.ts
• contracts/management/oapi-codegen.yaml
• contracts/management/openapi.yaml
• contracts/management/python_smoke.py
• docs/plans/management-codeql-remediation-20261025.md
• docs/plans/management-sdk-and-agent-teams.md
• docs/plans/management-sdk-security-review.md
• install/integrationctl/adapters/dirswap/dirswap.go
• install/integrationctl/adapters/dirswap/journal_read_test.go
• install/integrationctl/agentplugins/adapters/packagedigest/snapshot.go
• install/integrationctl/agentplugins/adapters/packagedigest/snapshot_links_test.go
• install/integrationctl/agentplugins/adapters/sourceacquisition/skill_web.go
• install/integrationctl/agentplugins/adapters/sourceacquisition/skill_web_catalog.go
• install/integrationctl/agentplugins/adapters/sourceacquisition/skill_web_index.go
• install/integrationctl/agentplugins/clients/all/removal_policy_test.go
• install/integrationctl/agentplugins/clients/cline/activate.go
• install/integrationctl/agentplugins/clients/cline/removal_policy.go
• install/integrationctl/agentplugins/clients/codex/lifecycle_deactivate.go
• install/integrationctl/agentplugins/clients/codex/removal_policy_test.go
• install/integrationctl/agentplugins/clients/copilot/removal_policy.go
• install/integrationctl/agentplugins/clients/grok/lifecycle.go
• install/integrationctl/agentplugins/clients/grok/removal_policy.go
• install/integrationctl/agentplugins/clients/kiro/activate.go
• install/integrationctl/agentplugins/clients/kiro/removal_policy.go
• install/integrationctl/agentplugins/clients/lifecycle.go
• install/integrationctl/agentplugins/clients/opencode/native_apply.go
• install/integrationctl/agentplugins/clients/opencode/native_config_selection_test.go
• install/integrationctl/agentplugins/clients/opencode/native_skills.go
• install/integrationctl/agentplugins/clients/opencode/native_skills_conflict_test.go
• install/integrationctl/agentplugins/clients/qoder/lifecycle.go
• install/integrationctl/agentplugins/clients/qoder/removal_policy.go
• install/integrationctl/agentplugins/clients/shared/copilot_removal_policy.go
• install/integrationctl/agentplugins/clients/windsurf/activate.go
• install/integrationctl/agentplugins/clients/windsurf/removal_policy.go
• install/integrationctl/agentplugins/domain/native_errors.go
• install/integrationctl/agentplugins/environment/coordinator.go
• install/integrationctl/agentplugins/environment/resolve_graph.go
• install/integrationctl/agentplugins/environment/selected_update_test.go
• install/integrationctl/agentplugins/installer/apply.go
• install/integrationctl/agentplugins/installer/engine.go
• install/integrationctl/agentplugins/installer/errors.go
• install/integrationctl/agentplugins/installer/group_project_remove_test.go
• install/integrationctl/agentplugins/installer/group_remove.go
• install/integrationctl/agentplugins/installer/inspect.go
• install/integrationctl/agentplugins/installer/opencode_host.go
• install/integrationctl/agentplugins/installer/opencode_sibling_host_test.go
• install/integrationctl/agentplugins/installer/prepare.go
• install/integrationctl/agentplugins/installer/removal_requirements.go
• install/integrationctl/agentplugins/installer/support_test.go
• install/integrationctl/agentplugins/installer/target_facts.go
• install/integrationctl/agentplugins/installer/types.go
• install/integrationctl/agentplugins/installer/verify_prepared.go
• install/integrationctl/agentplugins/pathcontract/safety.go
• install/integrationctl/agentplugins/usecase/observe_owned_binding.go
• scripts/native_client_research.py
• scripts/test_native_client_research.py
• sdks/typescript/.gitignore
• sdks/typescript/LICENSE
• sdks/typescript/README.md
• sdks/typescript/examples/real-engine-smoke.ts
• sdks/typescript/package.json
• sdks/typescript/scripts/check-packed.ts
• sdks/typescript/scripts/copy-schema.ts
• sdks/typescript/src/client.ts
• sdks/typescript/src/discovery.ts
• sdks/typescript/src/index.ts
• sdks/typescript/src/node.ts
• sdks/typescript/src/types.ts
• sdks/typescript/test/client.test.ts
• sdks/typescript/test/discovery.test.ts
• sdks/typescript/test/fixtures/discovery/main.go
• sdks/typescript/test/fixtures/host.go
• sdks/typescript/test/node.test.ts
• sdks/typescript/tsconfig.json
• sdks/typescript/tsconfig.test.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 58.05861% with 1603 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.84%. Comparing base (031a126) to head (51bf9f9).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
...l/agentpluginscli/management_local_skills_apply.go	50.73%	79 Missing and 55 partials ⚠️
...nternal/agentpluginscli/management/apitypes.gen.go	24.24%	100 Missing ⚠️
cli/internal/agentpluginscli/management/reads.go	21.84%	87 Missing and 6 partials ⚠️
...nternal/agentpluginscli/management_local_skills.go	63.63%	54 Missing and 38 partials ⚠️
.../internal/agentpluginscli/management/operations.go	61.00%	65 Missing and 20 partials ⚠️
sdks/typescript/test/fixtures/host.go	0.00%	73 Missing ⚠️
cli/internal/agentpluginscli/management/plans.go	67.71%	49 Missing and 23 partials ⚠️
sdks/typescript/test/fixtures/discovery/main.go	0.00%	63 Missing ⚠️
...li/internal/agentpluginscli/management_recovery.go	38.61%	55 Missing and 7 partials ⚠️
cli/internal/agentpluginscli/management_plan.go	65.60%	27 Missing and 27 partials ⚠️
... and 56 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #500      +/-   ##
==========================================
- Coverage   60.89%   60.84%   -0.05%     
==========================================
  Files        1799     1853      +54     
  Lines      106458   110015    +3557     
==========================================
+ Hits        64827    66939    +2112     
- Misses      32312    33377    +1065     
- Partials     9319     9699     +380     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[777genius]

Exact 5224 independent Python/native qualification — passed

The executable was rebuilt from committed 5224ebd5f66bbdfab0bef906dba0b089062f6073 using git archive, Go 1.26.10, CGO disabled and the same reviewed trimpath/buildvcs/version flags as app staging. Its SHA-256 is 9abf1107e690e6f383c7874843dd5ad01995cc3e8b8a613838df439cb8ce5043, matching the downstream staged binary.

The public standard-library contracts/management/python_smoke.py was unchanged (SHA-256 c2d85c755ec8c057e313c9ab269d0645fe872c4ef1ee73a18e5204e107ec3940). It discovered/previewed the pinned Skill, retained a plan through two catalog discards, applied it and replayed the same accepted request. It observed one owned entry and success. Actual OpenCode 1.18.34 then discovered the precise captured path and exact immutable source bytes. The run exited 0 in 27.03 seconds; build completed in 78.62 seconds.

All mutable state was in a new disposable temporary root. The wrapper differs from the previous qualification wrapper only by the four recorded path substitutions. No Node process or production repository file was changed by this proof. This is a real current-engine Python/native Skill receipt, distinct from the pending Electron MCP tool-use lane.

Receipt SHA-256: 9fa41b77c3e526ca5be76ce28ebfd55ea660212ac4846e5092326073dcf9e9a4.

uap-python-skill-5224-isolated-evidence.json

{
  "status": "passed",
  "stage": "complete",
  "root": "/tmp/uap-5224-python-63eb488b-pwef135h/runtime/uap-python-skill-ox2vlk5n",
  "source": "777genius/universal-agent-plugins@4555aa53844ee0078e9036cd82638afd67f77c16//repotests/testdata/agentplugins_commands_fixture/skills/fixture-guide",
  "sourceCommit": "5224ebd5f66bbdfab0bef906dba0b089062f6073",
  "engineVersion": "0.1.91+agentteams.5224ebd5f66b",
  "engineSHA256": "9abf1107e690e6f383c7874843dd5ad01995cc3e8b8a613838df439cb8ce5043",
  "nativeSHA256": "9ca0b9953d49997601655e54f846a3efa464f237e47c6f1b04716d0f2e64c4c2",
  "expectedSkillSHA256": "07f73f7836f0e929a84bd85943cbac7b26746ee0c4642b4e117b866d681276b0",
  "checks": [
    "unchanged standard-library Python client discovers and previews a pinned Skill, retains a plan, discards discovery twice, applies and replays one accepted operation",
    "real OpenCode debug skill discovers the exact captured Skill path whose bytes match the immutable public Git source"
  ],
  "protocol": {
    "apiVersion": 1,
    "engineVersion": "0.1.91+agentteams.5224ebd5f66b",
    "contextId": "a90dc839f8ecf3b9a3af26248d200f44f70223bbe59bee55f2d0898b8068834f",
    "environmentId": "f2799496ba7e7d12d9c7d95eb8a75c48547361b1034650e075e7ff63008b3e18",
    "kind": "skill",
    "catalogDiscardedBeforeApply": true,
    "operationId": "e698842aac905dc90d91a9ad992c90905da7e69eb464a7f00735dd1e1985ea29",
    "state": "succeeded",
    "observedEntries": 1
  },
  "nativeSkillPath": "/tmp/uap-5224-python-63eb488b-pwef135h/runtime/uap-python-skill-ox2vlk5n/config/opencode/skills/fixture-guide/SKILL.md",
  "installedSkillSHA256": "07f73f7836f0e929a84bd85943cbac7b26746ee0c4642b4e117b866d681276b0"
}

5224-python-skill-isolated-run.json

{
  "status": "passed",
  "sourceCommit": "5224ebd5f66bbdfab0bef906dba0b089062f6073",
  "engineVersion": "0.1.91+agentteams.5224ebd5f66b",
  "engineSHA256": "9abf1107e690e6f383c7874843dd5ad01995cc3e8b8a613838df439cb8ce5043",
  "publicProtocolSHA256": "c2d85c755ec8c057e313c9ab269d0645fe872c4ef1ee73a18e5204e107ec3940",
  "wrapperPathOnlyReplacements": {
    "workspace = Path('/workspace/scratch/a0f1bffd2cea')": "workspace = Path('/workspace/scratch/63eb488b84f8')",
    "repo = workspace / 'universal-agent-plugins'": "repo = workspace / 'uap'",
    "app = workspace / 'agent-teams'": "app = Path('/tmp/uap-5224-python-63eb488b-pwef135h/app-metadata')",
    "dir=workspace / 'uap-build-cache/tmp'": "dir=Path('/tmp/uap-5224-python-63eb488b-pwef135h/runtime')"
  },
  "evidence": "/workspace/scratch/63eb488b84f8/build-evidence/uap-python-skill-5224-isolated-evidence.json",
  "log": "/workspace/scratch/63eb488b84f8/build-evidence/5224-python-skill-isolated.log",
  "allMutableFixturesUnder": "/tmp/uap-5224-python-63eb488b-pwef135h",
  "startedUTC": "2026-10-25T11:24:43.931186+00:00",
  "command": [
    "/opt/codex/runtimes/codex-primary-runtime/dependencies/python/bin/python3",
    "/workspace/scratch/63eb488b84f8/build-evidence/python-skill-qualification-5224.py",
    "--executable",
    "/tmp/uap-5224-python-63eb488b-pwef135h/bin/agentplugins",
    "--client-executable",
    "/workspace/scratch/a0f1bffd2cea/uap-tools/native-opencode-1.18.34/opencode",
    "--output",
    "/workspace/scratch/63eb488b84f8/build-evidence/uap-python-skill-5224-isolated-evidence.json"
  ],
  "exitCode": 0,
  "elapsedSeconds": 27.03,
  "finishedUTC": "2026-10-25T11:25:10.964789+00:00",
  "root": "/tmp/uap-5224-python-63eb488b-pwef135h/runtime/uap-python-skill-ox2vlk5n",
  "operationId": "e698842aac905dc90d91a9ad992c90905da7e69eb464a7f00735dd1e1985ea29",
  "receiptStatus": "passed"
}

5224-python-native-build.json

{
  "status": "built",
  "root": "/tmp/uap-5224-python-63eb488b-pwef135h",
  "sourceCommit": "5224ebd5f66bbdfab0bef906dba0b089062f6073",
  "sourceTree": "9e69fda96251d54d0193830d90467eaeec4376bb",
  "sourceArchiveSHA256": "e714ee3d6049e628268c4f41f2bb871f12b339c8419b7e08499db082b17be762",
  "engineVersion": "0.1.91+agentteams.5224ebd5f66b",
  "goVersion": "go version go1.26.10 linux/amd64",
  "buildCommand": [
    "/workspace/scratch/a0f1bffd2cea/toolchains/go1.26.10/bin/go",
    "build",
    "-trimpath",
    "-buildvcs=false",
    "-mod=readonly",
    "-ldflags",
    "-s -w -X main.version=0.1.91+agentteams.5224ebd5f66b",
    "-o",
    "/tmp/uap-5224-python-63eb488b-pwef135h/bin/agentplugins",
    "./cmd/agentplugins"
  ],
  "publicProtocolSHA256": "c2d85c755ec8c057e313c9ab269d0645fe872c4ef1ee73a18e5204e107ec3940",
  "sdk": {
    "schemaVersion": 1,
    "repository": "777genius/universal-agent-plugins",
    "sourceCommit": "5224ebd5f66bbdfab0bef906dba0b089062f6073",
    "engineVersion": "0.1.91+agentteams.5224ebd5f66b",
    "baselineRelease": {
      "tag": "agentplugins-v0.1.91",
      "sourceCommit": "4555aa53844ee0078e9036cd82638afd67f77c16"
    },
    "packageName": "@uap/management-sdk",
    "packageVersion": "0.0.0-development",
    "file": "uap-management-sdk-0.0.0-development-5224ebd5f66b.tgz",
    "sha256": "31eb798b31be66d1c4d80d1cfa094934fa786cf2b46313360b4c6a8f6bfdd96c",
    "integrity": "sha512-aRx2GmwEHSMfzaaEYyvsfHpsrmIGfjaCn1Us+MRNIikmrUivQo9S26J26NvaXmahjkEzQeQc7AlAqWFG5SFxsg=="
  },
  "native": {
    "source": "https://registry.npmjs.org/opencode-linux-x64/-/opencode-linux-x64-1.18.34.tgz",
    "version": "1.18.34",
    "archive": "opencode-linux-x64-1.18.34.tgz",
    "archive_integrity": "sha512-RTAMjCve4euxP2QKLuvRmdoW5J5DQK1DiZqt+7slfixyjAEi79QC2Df2oYKogibaAI4IEU8uzenoJeEl3k+UEw==",
    "binary_sha256": "9ca0b9953d49997601655e54f846a3efa464f237e47c6f1b04716d0f2e64c4c2"
  },
  "startedUTC": "2026-10-25T11:22:56.922214+00:00",
  "exitCode": 0,
  "elapsedSeconds": 78.62,
  "engineSHA256": "9abf1107e690e6f383c7874843dd5ad01995cc3e8b8a613838df439cb8ce5043",
  "wrapper": "/workspace/scratch/63eb488b84f8/build-evidence/python-skill-qualification-5224.py",
  "wrapperSourceSHA256": "59cb06b69b8dca805fae94e7c8d561073570e4ef7c2e6c01a9b2d3a6ed494579",
  "wrapperSHA256": "227966bffef8ebee3efbf194708c9ccee6b161414cad0b52f3f1672c2eaa5adc",
  "wrapperPathOnlyReplacements": {
    "workspace = Path('/workspace/scratch/a0f1bffd2cea')": "workspace = Path('/workspace/scratch/63eb488b84f8')",
    "repo = workspace / 'universal-agent-plugins'": "repo = workspace / 'uap'",
    "app = workspace / 'agent-teams'": "app = Path('/tmp/uap-5224-python-63eb488b-pwef135h/app-metadata')",
    "dir=workspace / 'uap-build-cache/tmp'": "dir=Path('/tmp/uap-5224-python-63eb488b-pwef135h/runtime')"
  },
  "runtimeMetadata": "/tmp/uap-5224-python-63eb488b-pwef135h/app-metadata/resources/uap/runtime.json",
  "binary": "/tmp/uap-5224-python-63eb488b-pwef135h/bin/agentplugins",
  "nativeBinary": "/workspace/scratch/a0f1bffd2cea/uap-tools/native-opencode-1.18.34/opencode",
  "finishedUTC": "2026-10-25T11:24:15.607182+00:00"
}

[777genius]

Exact 8645 independent Python/native qualification — passed

The unchanged public standard-library Python client passed against a fresh native executable built from clean committed source 8645eb5e71321f9321b8e742b8eda74408b55f13, version 0.1.91+agentteams.8645eb5e7132, in 30.05 seconds. It discovered and previewed the immutable Skill fixture, retained the plan, discarded discovery twice before Apply, applied/replayed one accepted operation and observed one owned entry. Actual OpenCode 1.18.34 then discovered the exact installed Skill path; its bytes matched the immutable Git source.

Native engine SHA-256: 6ad7f4732f6cd38e1ec90cb8292522c49b00dd3dae390a2044c85562cbf0fdb8. SDK SHA-256: 02d921a6466a7eca86c8161e8d6de0a4ac9b7ee0ed1135de3f27d12bdfcbea0e. The source archive, tree, exact build command, toolchain, native consumer and unchanged public-client digests are recorded below. The safe archive extractor omitted one unrelated pre-existing website screenshot fixture's absolute symlink; all native build inputs come from the named commit. The downstream CI binary digest will be checked against this executable when its new receipt completes.

Every runtime HOME/config/state/cache is disposable and isolated. The task wrapper changed only its metadata/runtime paths from the previously reviewed 5224 wrapper; the public protocol client and assertions were not edited. This qualifies Python-to-Go protocol and native discovery for 8645, not live-model/OAuth behavior or project/worktree activation.

8645-python-native-build.json

{
  "status": "built",
  "root": "/tmp/uap-8645-python-63eb488b-9qqiwb2l",
  "sourceCommit": "8645eb5e71321f9321b8e742b8eda74408b55f13",
  "sourceTree": "adf13f92d6969e43a55f3b4ab7f6b8432e6f5a50",
  "sourceArchiveSHA256": "5c0989b4d97f47356c3588393b1c23575795777f6605e796a925f2648f993bd0",
  "omittedNonBuildArchiveLinks": [
    "website/.playwright-artifacts-mermaid-check/server-root/plugin-kit-ai"
  ],
  "engineVersion": "0.1.91+agentteams.8645eb5e7132",
  "goVersion": "go version go1.26.10 linux/amd64",
  "buildCommand": [
    "/workspace/scratch/a0f1bffd2cea/toolchains/go1.26.10/bin/go",
    "build",
    "-trimpath",
    "-buildvcs=false",
    "-mod=readonly",
    "-ldflags",
    "-s -w -X main.version=0.1.91+agentteams.8645eb5e7132",
    "-o",
    "/tmp/uap-8645-python-63eb488b-9qqiwb2l/bin/agentplugins",
    "./cmd/agentplugins"
  ],
  "publicProtocolSHA256": "c2d85c755ec8c057e313c9ab269d0645fe872c4ef1ee73a18e5204e107ec3940",
  "sdk": {
    "schemaVersion": 1,
    "repository": "777genius/universal-agent-plugins",
    "sourceCommit": "8645eb5e71321f9321b8e742b8eda74408b55f13",
    "engineVersion": "0.1.91+agentteams.8645eb5e7132",
    "baselineRelease": {
      "tag": "agentplugins-v0.1.91",
      "sourceCommit": "4555aa53844ee0078e9036cd82638afd67f77c16"
    },
    "packageName": "@uap/management-sdk",
    "packageVersion": "0.0.0-development",
    "file": "uap-management-sdk-0.0.0-development-8645eb5e7132.tgz",
    "sha256": "02d921a6466a7eca86c8161e8d6de0a4ac9b7ee0ed1135de3f27d12bdfcbea0e",
    "integrity": "sha512-1tLAEkSWogeksOTL6aFJPLZB9IlDisdHafxpmBshEQVZjqvRuUsrHxng4VUBEwad29F01NjW2qgbcGX2btZZ0A=="
  },
  "startedUTC": "2026-10-25T11:52:47.979895+00:00",
  "exitCode": 0,
  "elapsedSeconds": 189.12,
  "finishedUTC": "2026-10-25T11:55:57.112118+00:00",
  "engineSHA256": "6ad7f4732f6cd38e1ec90cb8292522c49b00dd3dae390a2044c85562cbf0fdb8",
  "wrapper": "/workspace/scratch/63eb488b84f8/build-evidence/python-skill-qualification-8645.py",
  "wrapperSourceSHA256": "227966bffef8ebee3efbf194708c9ccee6b161414cad0b52f3f1672c2eaa5adc",
  "wrapperSHA256": "c5399ad435f9ab8f61ceae3fde108f4b2ccf451281106e8e2bb96f2532d22195",
  "wrapperPathOnlyReplacements": {
    "app = Path('/tmp/uap-5224-python-63eb488b-pwef135h/app-metadata')": "app = Path('/tmp/uap-8645-python-63eb488b-9qqiwb2l/app-metadata')",
    "dir=Path('/tmp/uap-5224-python-63eb488b-pwef135h/runtime')": "dir=Path('/tmp/uap-8645-python-63eb488b-9qqiwb2l/runtime')"
  },
  "runtimeMetadata": "/tmp/uap-8645-python-63eb488b-9qqiwb2l/app-metadata/resources/uap/runtime.json",
  "binary": "/tmp/uap-8645-python-63eb488b-9qqiwb2l/bin/agentplugins",
  "nativeBinary": "/workspace/scratch/a0f1bffd2cea/uap-tools/native-opencode-1.18.34/opencode",
  "nativeSHA256": "9ca0b9953d49997601655e54f846a3efa464f237e47c6f1b04716d0f2e64c4c2"
}

8645-python-skill-isolated-run.json

{
  "sourceCommit": "8645eb5e71321f9321b8e742b8eda74408b55f13",
  "command": [
    "python",
    "/workspace/scratch/63eb488b84f8/build-evidence/python-skill-qualification-8645.py",
    "--executable",
    "/tmp/uap-8645-python-63eb488b-9qqiwb2l/bin/agentplugins",
    "--client-executable",
    "/workspace/scratch/a0f1bffd2cea/uap-tools/native-opencode-1.18.34/opencode",
    "--output",
    "/workspace/scratch/63eb488b84f8/build-evidence/uap-python-skill-8645-isolated-evidence.json"
  ],
  "startedUTC": "2026-10-25T12:00:06.619748+00:00",
  "exitCode": 0,
  "elapsedSeconds": 30.05,
  "finishedUTC": "2026-10-25T12:00:36.674018+00:00"
}

uap-python-skill-8645-isolated-evidence.json

{
  "status": "passed",
  "stage": "complete",
  "root": "/tmp/uap-8645-python-63eb488b-9qqiwb2l/runtime/uap-python-skill-2h3jw9k0",
  "source": "777genius/universal-agent-plugins@4555aa53844ee0078e9036cd82638afd67f77c16//repotests/testdata/agentplugins_commands_fixture/skills/fixture-guide",
  "sourceCommit": "8645eb5e71321f9321b8e742b8eda74408b55f13",
  "engineVersion": "0.1.91+agentteams.8645eb5e7132",
  "engineSHA256": "6ad7f4732f6cd38e1ec90cb8292522c49b00dd3dae390a2044c85562cbf0fdb8",
  "nativeSHA256": "9ca0b9953d49997601655e54f846a3efa464f237e47c6f1b04716d0f2e64c4c2",
  "expectedSkillSHA256": "07f73f7836f0e929a84bd85943cbac7b26746ee0c4642b4e117b866d681276b0",
  "checks": [
    "unchanged standard-library Python client discovers and previews a pinned Skill, retains a plan, discards discovery twice, applies and replays one accepted operation",
    "real OpenCode debug skill discovers the exact captured Skill path whose bytes match the immutable public Git source"
  ],
  "protocol": {
    "apiVersion": 1,
    "engineVersion": "0.1.91+agentteams.8645eb5e7132",
    "contextId": "bdbfd652e53efd5cbce10f0caf6f0326b30cfd96645e2009067e760aaf24a02b",
    "environmentId": "efb5c1c918e015710d6a7cc75e2952cf23fa089a663086d55befd06b87889d1a",
    "kind": "skill",
    "catalogDiscardedBeforeApply": true,
    "operationId": "f7300d9218f4f5f94f63e834ab82e7a67c5504cf23ac1245ebd27c216d422eea",
    "state": "succeeded",
    "observedEntries": 1
  },
  "nativeSkillPath": "/tmp/uap-8645-python-63eb488b-9qqiwb2l/runtime/uap-python-skill-2h3jw9k0/config/opencode/skills/fixture-guide/SKILL.md",
  "installedSkillSHA256": "07f73f7836f0e929a84bd85943cbac7b26746ee0c4642b4e117b866d681276b0"
}

[777genius]

Fresh exact-source Python → native Skill proof: PASS

Source 1bdc7bb4c111da19c93d2839b7403e4a7d57df57, tree 788205cf1d2d51e62b08fb3c20790ade6b47b142. This is a new build and run, not relabeled 8645 evidence.

Identity	Verified value
Engine	0.1.91+agentteams.1bdc7bb4c111
Go	go1.26.10 linux/amd64
Native engine SHA-256	7084ef196eaceb555acda97414d40cee02ed2dfe7a31ef20aa86275506857d83
OpenCode	Real 1.18.34; executable SHA-256 9ca0b9953d49997601655e54f846a3efa464f237e47c6f1b04716d0f2e64c4c2
Unchanged public Python client	SHA-256 c2d85c755ec8c057e313c9ab269d0645fe872c4ef1ee73a18e5204e107ec3940
Fixture	777genius/universal-agent-plugins@4555aa53844ee0078e9036cd82638afd67f77c16//repotests/testdata/agentplugins_commands_fixture/skills/fixture-guide
Installed Skill bytes	SHA-256 07f73f7836f0e929a84bd85943cbac7b26746ee0c4642b4e117b866d681276b0, equal to the immutable fixture

The binary was built from a separate archive of the exact committed tree with CGO_ENABLED=0, -trimpath -buildvcs=false -mod=readonly and -ldflags "-s -w -X main.version=0.1.91+agentteams.1bdc7bb4c111".

One qualification attempt passed: authenticated session, discovery/preview, retained review, double catalog disposal, Apply and replay of the same accepted operation, completed authoritative inventory, actual opencode debug skill and exact captured path/content. Operation 222c42d848af60f085600781cd231f69380d867d85bc05bc3c905468a753573c ended succeeded with one observed entry. All processes used disposable native profiles.

Build exit 0 in 30.257 s. Protocol exit 0 in 52.607 s; actual native version and Skill discovery exit 0 in 3.672 / 7.511 s. Total qualification: 63.812 s. Public client bytes and the clean tracked checkout were rechecked afterward.

The rebuilt TS SDK is byte-identical to the prior contract artifact: 22,404 bytes, SHA-256 02d921a6466a7eca86c8161e8d6de0a4ac9b7ee0ed1135de3f27d12bdfcbea0e. App #989 pins this source for SDK and native staging.

Scope: Linux Go/Python/native Skill consumer. This receipt does not claim Electron GUI, Claude/Codex UI lifecycle, current CodeQL clearance, Developer ID signing or notarization. Those gates retain separate results.

[777genius]

UAP current-source CodeQL disposition evidence

Evidence and proposals only. No code-scanning alert was dismissed, no review thread was manually resolved, and no tracked source was changed by this audit.

Source: e84b4da218f4445986daa9ed15f40acd828ae06f; tree e7c4520f86131538cdb28d0c82af797036f38544. Base: d5c16856cef67a1457704971d46765739141ab08. PR: #500.

What GitHub directly confirms

• At 2026-10-26 12:10:07 UTC, all 16 workflows succeeded. Of 64 check runs, 63 succeeded and only the CodeQL findings aggregate failed; no work remained queued/running.
• Both CodeQL analyzers completed successfully: Go at 11:58:39 UTC, JavaScript/TypeScript at 11:59:47 UTC, in run 40316582730.
• The final findings aggregate reports 12 findings: 2 Critical and 10 High, compared with 13 on the prior exact head (2 Critical, 11 High). No missing-language qualification remains.
• Advanced Security automatically marked the feat(agentplugins): harden lifecycle and release E2E #47-linked ReadFile review thread resolved/outdated. The docs: simplify npm installer examples #46-linked Lstat thread remains current/unresolved. This is review-thread evidence, not a direct alert-state API export.

Identifier and analysis provenance

The exact current open alert-ID list was not accessible. The numbered associations below come from the owner-provided historical per-alert mapping, matched against the same rule/sink locations in the current local reproduction. Do not present them as newly fetched GitHub alert records.

The reproduction uses the same CodeQL CLI 2.27.3, Go query pack 1.6.13, default Go code-scanning suite (36 queries), and Go 1.26.10 linux/amd64 as current CI. The official Go-only bundle was verified against its release asset SHA-256:

71513c904dcf7f40577c46e3daf466cd92ec6b2d99239fcc7573a791954ac812

The six manual Go builds match CI: root, cli, plugininstall, install/integrationctl, install/integrationctl/agentplugins and sdk; submodules use GOWORK=off. Analysis exports up to 32 paths per result with snippets, without GitHub’s PR diff-range extension. It scanned 1,916 of 3,170 Go files in the Linux manual-build invocation. It is not additional Windows/macOS extractor coverage.

The full-source SARIF contains 13 results and 75 exported flows. Twelve rule/sink correspondences have 69 flows; the additional six-flow ZipSlip result is in unchanged legacy plugininstall/adapters/archive/targz.go:185. It is outside the twelve mapped PR sinks and has no verified GitHub alert ID/state here.

Individual proposed dispositions

All proposals retain private-root/startup authority assumptions. None promises isolation from another hostile process using the same OS identity. A security reviewer must assess each proposal individually before formal repository disposition.

Historical alert ID	Current local rule and severity	Current sink	Flows	Proposed individual handling
#45	go/request-forgery — Critical	skill_web.go:178	4	Intentional authenticated HTTPS destination capability. Propose explicit accepted-risk / intentional-feature review; not a false positive. Private destinations and DNS rebinding remain unblocked.
#46	go/path-injection — High	management_local_skills_apply.go:80	1	Proposed false positive for path injection: exact 64 lowercase-hex ID, fixed receipt directory and containment guard. Keep the pre-open FIFO refusal and rooted bounded read.
#48	go/path-injection — High	pathpolicy.go:111	1	Proposed false positive inside the containment validator: the ID is fixed-format; strict relative-child checks precede metadata inspection of base/descendants.
#49	go/path-injection — High	snapshot.go:87	4	Proposed false positive: directory destination comes from validated WalkDir relative inventory under a fresh private snapshot root.
#50	go/path-injection — High	snapshot.go:92	4	Proposed false positive for the current destination argument flow. Retain the separately corrected component-order link-target validation; that earlier defect was real.
#51	go/path-injection — High	snapshot.go:152	4	Proposed false positive on reported flows: a validated Git subpath selects a directory in a private immutable checkout before root inspection.
#52	go/path-injection — High	snapshot.go:381	4	Proposed false positive: validated inventory determines exclusive-create destinations. Source descriptor identity/size checks and bounded copy remain required.
#53	go/path-injection — High	acquirer.go:357	4	Proposed false positive: checked subpath, immutable Git tree and selected-directory proof precede the derived private checkout path probe.
#56	go/path-injection — High	snapshot.go:428	4	Proposed false positive: reverse sealing touches owned snapshot entries and skips symlinks; inventory cannot contain descendants reached through a link.
#57	go/path-injection — High	package.go:77	20	Proposed false positive on reported inventory flows: validated executable relatives encounter additional clean-relative/root checks before snapshotting.
#58	go/path-injection — High	package.go:414	14	Proposed false positive: acquired executable inventory is validated and resealed against exact source/digest/inventory identity.
#59	go/command-injection — Critical	osrunner.go:637	5	Proposed reported-flow false positive: tainted Git arguments do not control the literal git at argv[0]; there is no shell construction in these paths.

Guard source ledger

• fix(release): add verify-only npm recovery #45: Exact Host, bearer capability and Origin admission; Require normalized credential-free HTTPS with no query/fragment; Derive fixed well-known index locations; Redirect refusal and acquisition timeout; GET with no request credentials/cookies and bounded response reading.
• docs: simplify npm installer examples #46: Exact 64 lowercase-hex predicate; Predicate and strict contained-child check before metadata/open; Root-confined open, same-descriptor validation and bounded read.
• docs: clarify agentplugins quick start #48: Fixed receipt path enters the shared validator; Lexical strict-child test and component-by-component no-link policy.
• fix(agentplugins): separate ChatGPT target lifecycle #49: shared guards for subsequent rows: Direct Git subpath: normalized portable relative components; Legacy GitHub subpath: normalized portable relative components; Private temporary Git checkout; immutable tree and selected-directory checks before snapshot; WalkDir inventory; checked relative paths and file types; no recursive traversal through symlink entries; Portable path components, depth, Unicode/case collisions and reserved names; Fresh private snapshot root and derived destination.
• feat(agentplugins): support comma-separated targets #50: Resolve directory links before subsequent parent components; reject escape, missing/non-directory targets and excessive chains; Current reported destination sink.
• feat(agentplugins): add signed directory lifecycle #51: shared guards for subsequent rows: Absolute-clean root and real-directory/final-symlink rejection.
• feat(agentplugins): activate signed directory bootstrap #52: Same source descriptor identity/size and exclusive destination creation.
• fix(agentplugins): test packaged documentation in isolation #53: Selected immutable tree and directory proof before materialization; Derived package root and final real-directory check.
• fix(agentplugins): complete Cursor native projection #56: Reverse sealing walk skips symlinks and touches owned paths.
• fix(deps): resolve site security alerts #57: Root and profile checks before snapshotRequestPackage; Absolute-clean/nonoverlapping package roots; Additional executable-relative path validation and regular-file requirement.
• feat(agentplugins): reconcile native identity in info #58: Validate acquisition identity and reseal with exact digest/inventory equality; Acquired source authority, origin and inventory constraints; Clean-relative/volume/backslash and regular-file checks.
• feat: expose grouped acquisition proof #59: Contained Git runner and NativeCredentials gate; Literal git prefix before all tainted arguments; Literal git prefix for TLS config inspection; Native credential mode restricted to fetch; Validated Skill path, exact object identity and option boundaries; Direct exec with separate argv; no shell concatenation.

The path-flow census covers every exported path for the ten path-injection results: 2 exact receipt-ID paths, 42 modern normalized-subpath paths, 16 legacy normalized-subpath paths, and no unclassified package path. The reviewed inventory guards and executable-path checks apply after those normalizers. Source taint through a validator does not itself demonstrate a path-escape exploit.

Independent Critical review and verification

The independent critic agreed that #59’s five reported flows cannot control the fixed Git program. One path routed through the TLS verification helper from ls-tree is also infeasible under the fetch-only NativeCredentials gate. For #45, the critic agreed that the network capability is intentional and real; it should receive explicit accepted-risk/feature review, not a false-positive label. No new source exploit or required fix was demonstrated in the reviewed flows.

Independent focused reruns all passed:

• sourceacquisition: TestWebSkillCompleteTreeAndPinnedRestore, TestWebSkillFallbackOnlyFor404, TestWebSkillLimitsAndRedirects, TestWebSkillRefusesUntrustedCertificateByDefault.
• sourcespec: TestNormalizeGitURLRejectsLeadingDashInSCPHostOrUser, TestUnsafeSourcesFailWithoutEchoingInput.
• loopbackapi: TestGuardProtectsAllAPIRequests, TestDecodeRejectsAmbiguousOrOversizedInput.
• management: TestHTTPAuthorityAndStrictJSON.

Loopback cases initially encountered a sandbox bind denial and passed unchanged after permitted escalation. Durations were not reliably retained and are not asserted. The fresh full Required, Core fast, native client and platform workflows qualify the published source separately.

GitHub plugin capability and safe next steps

No available GitHub plugin tool exposes code-scanning alert reads, review or disposition. Two direct read probes — the #46 alert endpoint and the current aggregate’s annotations endpoint — return HTTP 400 / INVALID_ARGUMENT: endpoint not allowed. This is a connector capability/allowlist limitation; it does not establish that the repository owner lacks permission.

PR-review dismissal and review-thread resolution are different operations and must not substitute for code-scanning disposition. Existing PR comment/update tools can publish this evidence and correct the qualification section when authorized. Formal alert action needs an actual supported alert-review capability or the repository security reviewer’s normal workflow. The failing aggregate must remain in place until that occurs.

No auth/token extraction, browser fallback, endpoint obfuscation, CI API proxy, query suppression, protection bypass, alert dismissal or manual thread resolution was used.