feat: qualify qoder native project E2E

cli/cmd/agentplugins/project_qoder_e2e_test.go

@@ -42,7 +42,7 @@ func configureProjectQoder(t *testing.T, app agentpluginscli.App, user string, r
 	app.Installer = engine
 	app.Detector = projectQoderDetector{user}
 	app.Lifecycle.Activator = providers.Activator{Registry: app.ClientRegistry, Runner: runner}
-	app.Lifecycle.NativeObserver = providers.NativeIdentityObserver{Registry: app.ClientRegistry, Runner: runner}
+	app.Lifecycle.NativeObserver = providers.NativeIdentityObserver{Stager: app.Lifecycle.Stager, Registry: app.ClientRegistry, Runner: runner}
 	compose := app.ForScope
 	app.ForScope = func(scope domain.InstallScope, root string) (agentpluginscli.App, error) {
 		selected, err := compose(scope, root)
@@ -139,3 +139,80 @@ func projectQoderOwned(t *testing.T, j projectJourney, project, expected string)
 	}
 	return installation, b
 }
+
+// Exercise the same direct local, explicit-target CLI group route as the native
+// cycle. No Qoder process is permitted; repair and retention use production APIs.
+func TestProjectQoderDirectGroupRepairAndDefaultRemovalKeepExactAuthority(t *testing.T) {
+	transport := newProjectJourneyTransport(t, "git")
+	j := newProjectJourney(t, transport)
+	user := filepath.Join(j.home, ".qoder")
+	projectJourneyWrite(t, filepath.Join(user, "plugins", "installed_plugins_v2.json"), "original registry\n")
+	runner := &projectQoderNoNative{}
+	j.app = configureProjectQoder(t, j.app, user, runner)
+	beforeUser := securityFixtureTree(t, user)
+	for _, project := range []string{j.a, j.b} {
+		j.run(t, project, "add", transport.repo, "--target", "qoder", "--no-save")
+	}
+	installed, binding := projectQoderDirectOwned(t, j, projectJourneySkill)
+	beforeB := securityFixtureTree(t, j.b)
+	if len(installed.DataReceipts) != 0 || installed.DataRetained || binding.DataReceiptID != "" {
+		t.Fatal("skills-only install invented a data allocation")
+	}
+	stateBefore := projectJourneyRead(t, filepath.Join(j.a, ".uap", "state-v2.json"))
+	for _, args := range [][]string{{"add", transport.repo, "--target", "qoder", "--no-save"}, {"update", installed.DeclaredName, "--target", "qoder"}} {
+		output := j.run(t, j.a, args...)
+		if !strings.Contains(output, `"mutated":false`) || stateBefore != projectJourneyRead(t, filepath.Join(j.a, ".uap", "state-v2.json")) {
+			t.Fatal("direct unchanged group changed state", output)
+		}
+	}
+	output := j.run(t, j.a, "repair", installed.InstallationID, "--target", "qoder")
+	intact, current := projectQoderDirectOwned(t, j, projectJourneySkill)
+	if !strings.Contains(output, `"mutated":true`) || intact.InstallationID != installed.InstallationID || current.ClientBindingID != binding.ClientBindingID || intact.Source.TreeDigest != installed.Source.TreeDigest {
+		t.Fatal("explicit direct CLI group repair lost exact restaging authority", output)
+	}
+	projectJourneyWrite(t, filepath.Join(transport.repo, "skills", "docs", "SKILL.md"), projectJourneyAdvancedSkill)
+	j.run(t, j.a, "update", transport.repo, "--target", "qoder")
+	updated, current := projectQoderDirectOwned(t, j, projectJourneyAdvancedSkill)
+	if updated.Source.TreeDigest == installed.Source.TreeDigest || current.TargetLocator != binding.TargetLocator {
+		t.Fatal("same-version direct update lost source or physical authority")
+	}
+	// This inert CLI contract owns the complete selected package. The hosted
+	// cycle separately authorizes each leaf before nonrecursive fault removal.
+	if err := os.RemoveAll(current.TargetLocator); err != nil {
+		t.Fatal(err)
+	}
+	j.run(t, j.a, "repair", installed.InstallationID, "--target", "qoder")
+	repaired, _ := projectQoderDirectOwned(t, j, projectJourneyAdvancedSkill)
+	if repaired.Source.TreeDigest != updated.Source.TreeDigest {
+		t.Fatal("frozen local repair did not restore its exact recorded digest")
+	}
+	j.run(t, j.a, "remove", installed.DeclaredName, "--target", "qoder")
+	projectJourneyAbsent(t, current.TargetLocator)
+	state := j.state(t, j.a)
+	if len(state.Installations) != 1 || !state.Installations[0].DataRetained || len(state.Installations[0].Clients) != 0 || len(state.Installations[0].DataReceipts) != 1 {
+		t.Fatal("default skills-only removal did not retain its actual owner allocation")
+	}
+	if runner.calls != 0 || !reflect.DeepEqual(beforeUser, securityFixtureTree(t, user)) || !reflect.DeepEqual(beforeB, securityFixtureTree(t, j.b)) {
+		t.Fatal("direct A lifecycle invoked native or changed original user/B authority")
+	}
+}
+
+func projectQoderDirectOwned(t *testing.T, j projectJourney, expected string) (domain.Installation, domain.ClientBinding) {
+	t.Helper()
+	state := j.state(t, j.a)
+	if len(state.Installations) != 1 || len(state.Installations[0].Clients) != 1 || len(state.EnvironmentReceipts) != 0 {
+		t.Fatal("direct --no-save route lost exact unsaved state")
+	}
+	installation := state.Installations[0]
+	for _, binding := range installation.Clients {
+		if binding.ClientID != "qoder" || binding.Scope != "project" || binding.Activation != domain.ActivationPrepared || binding.Verification != domain.VerificationInstalled || binding.NativeProfileRoot != filepath.Join(j.a, ".uap", "managed", "clients", "qoder") || len(binding.NativeObjects) != 1 || binding.NativeObjects[0].Path != binding.TargetLocator {
+			t.Fatal("direct Prepared receipt ownership differs")
+		}
+		if projectJourneyRead(t, filepath.Join(binding.TargetLocator, ".agentplugins-qoder-native", "skills", "docs", "SKILL.md")) != expected {
+			t.Fatal("direct Qoder native view does not match frozen source")
+		}
+		return installation, binding
+	}
+	t.Fatal("direct binding missing")
+	return domain.Installation{}, domain.ClientBinding{}
+}

docs/plans/project-install-e2e/qoder-auth-membership-addendum-plan.md

@@ -0,0 +1,81 @@
+# Qoder anonymous metadata: exact auth-directory membership
+
+Status: proposed correction; no code in this slice has been changed. This addendum
+responds to two independent reviews performed after the original metadata recipe
+was implemented. It does not backdate those reviews into preimplementation GOs.
+
+## Frozen starting point and concrete defect
+
+Start from candidate 39f1267d5096a0f8c2e3cd0388e047978c2c7de6, tree
+9e452cff096e0ab53b3cdf235258a4a2ddc9dd30, in a separate worktree. Preserve the
+existing author's complete commits and contracts. The helper currently has SHA256
+be18f86af7d290b079d5b360c85b501e8451969a47005761fe8ad6455c9ea7f7;
+contracts b2799da43d86c5ee961ba8eba0aec3f584155ec30914cae47e0cf6c6eb74736e;
+shared fixture 557b178c29b065ba5e17a55b42ae3e1c3c77dce3402a5199e9ed4eb00110359e.
+
+The current fixed-file checks do not enumerate .auth. setup runs native version
+and public add before the first complete-profile catalog snapshot. Consequently
+an unknown .auth sibling can pass recipe.check and enter that later baseline.
+This is a source counterexample, not observed native account creation.
+
+## Narrow implementation
+
+Add a private bounded verifier for the exact direct .auth names machine_id and
+.credential-transaction, and no others. Do not enumerate the whole profile or
+read unknown child bodies. Open a readable directory descriptor relative to the
+already-held .auth descriptor with openat(".", O_RDONLY|O_DIRECTORY|O_NOFOLLOW|
+O_CLOEXEC); never reopen an unchecked filesystem path or use O_PATH for readdir.
+Check held ownership, directory type, exact0700 and identity against the captured
+auth directory before and after enumeration. Use a fresh descriptor each call,
+read at most three entry names, and require exactly the two expected unique names
+and EOF, with all read and close errors refusing. Unknown names are not printed.
+Keep existing fixed-file regular-file, owner, mode, size, link, identity and digest
+checks; expected names still pass those independent checks, so no special file,
+alias or changed expected child gains authority.
+
+Enforce membership from initial capture onward and around every existing recipe
+check, including the final linked identity phase. Preserve held profile/auth
+checks and linked Fstatat verification before/after the membership operation.
+Do not pin directory access timestamps across commands; ordinary reads and
+same-mode chmod retain their existing semantics. Inside a single enumeration,
+verify stable directory identity and membership-relevant metadata to refuse a
+concurrent mutation; any observed change is a refusal, never a new baseline.
+Retain the full original-profile equality guard and all command boundaries.
+
+No changes to production adapters, vendor pins/argv, original HOME, credential or
+trust handling, file contents, deadlines, cleanup, parser allowances, qualification
+flags or VS Code. No native/vendor executable will run locally. The recipe still
+does not establish equivalence between the public npm source and the pinned
+standalone executable, or account authentication or successful native behavior.
+
+## Regression and validation
+
+Add actual recipe.check controls before any complete-profile snapshot: create
+.auth/user, .auth/user.production or an unrelated sibling as an ordinary file;
+also exercise a directory, symlink and FIFO without opening their bodies. Each
+must refuse promptly, leave the unknown object and the authored bytes intact,
+and keep the fixed-file protections. Add direct initial-capture rejection with
+an unknown entry and repeated positive checks, including after ordinary reads and
+same-mode chmod. Preserve every prior test. No mock positive native result.
+
+Run the new direct regression against the old helper using an inert Go overlay
+to show the concrete gap (expected failing test), then the corrected focused
+Qoder/shared inert Go contracts and actual affected all-enabled plus unfiltered
+whole-file architecture/size lint gates. Serialize Go/lint with any active job;
+do not delete another task's files. Use two independent plan GOs before coding and
+two independent exact-code reviews after the correction. Record source hashes,
+actual commands/results and their scope without attributing other workers' test
+execution to this worker.
+
+## Publication and concurrency
+
+Do not edit /tmp/uap-qoder-publish or its publication manifest/checkpoint. Commit
+this addendum, correction and actual validation separately in the isolated branch.
+Publish only after fresh inspection of the existing PR523 head, full source review
+and checks. A normal fast-forward may include the original author's39f126 ancestry;
+if concurrent source differs, stop publication, preserve it and reconcile/review
+the exact combined bytes. No force-push, replacement PR, merge of unqualified leaf,
+release, cancellation of unrelated CI or change to the original negative captures.
+
+All existing five qualification flags remain false until genuine current-source
+hosted evidence independently establishes applicable claims.

docs/plans/project-install-e2e/qoder-auth-membership-plan-review.md

@@ -0,0 +1,16 @@
+# Qoder auth-membership addendum: preimplementation review
+
+Plan SHA256: `ff0d090da140c389e0690990ab6cd7440b8c1f2c92c008f2f28bb64fb0ff2b3f`.
+
+Starting commit: `39f1267d5096a0f8c2e3cd0388e047978c2c7de6`.
+
+Before correction code was changed, two independent GPT-6.1 Sol xhigh reviewers
+read the exact plan and starting source. `kimi_current_review` returned R1 GO,
+and `native_current_review` returned R2 GO, without required plan corrections.
+Both confirmed the bounded readable descriptor anchored to the held auth
+directory, exact two-name set and EOF, initial and repeated checks, unchanged
+fixed-file protections, and direct prebaseline hostile controls.
+
+These approvals apply only to this membership correction. They do not backdate
+reviews of the original metadata implementation and do not establish a native
+pass, account authentication, MCP capability, model use or release qualification.

docs/plans/project-install-e2e/qoder-auth-membership-validation.md

@@ -0,0 +1,63 @@
+# Qoder exact auth-membership correction: validation
+
+## Reviewed source and chronology
+
+The membership addendum was approved before its implementation by independent
+GPT-6.1 Sol xhigh reviewers `kimi_current_review` (R1) and
+`native_current_review` (R2), at exact plan SHA256
+`ff0d090da140c389e0690990ab6cd7440b8c1f2c92c008f2f28bb64fb0ff2b3f`.
+The plan and review record were committed as `2b63d444f9cbb25be9fa23a475e80e50e0a5b22a`.
+
+The correction was committed as `b42ff698deb486b69b611b9d2adb6ead6accebb9`.
+Both independent reviewers read the complete helper, contracts and wiring and
+returned exact-source CODE GO. Actual lint then identified one staticcheck QF1001
+finding. Commit `83dd06d0bc3e932baf4f8de3d59333f167898e08` changes only the two
+predicate lines using De Morgan's law. Both reviewers read that exact delta and
+extended their CODE GO. Final code tree:
+`c25f4a711379822b835b3e1e18f0bd6624cbcea4`.
+
+The original metadata author's complete `39f1267d` history and tests remain
+preserved. This correction's plan approvals do not backdate reviews of that
+original implementation.
+
+## Actual inert validation
+
+The new direct regression was run against the original helper through a Go
+source overlay. It failed as expected for all six unknown auth siblings and for
+initial capture, demonstrating the early-baseline gap. It ran in 0.013 seconds
+of package test time. The old helper was never installed over the working source.
+
+On the final corrected source, the following gates actually passed:
+
+- `go test -p=1 -count=1 -timeout=120s ./repotests -run '^(TestQoder|TestProjectNativeCLI)'`:
+  PASS, 0.049 seconds of package test time.
+- All enabled lint on the affected delta from `39f1267d`: zero issues.
+- Unfiltered whole-repotests `revive,funlen,gocyclo,gocognit,dupl,depguard`:
+  zero issues.
+- Formatting and whitespace checks: clean.
+
+Go 1.26.10 and golangci-lint 2.13.2 ran with offline dependency resolution. No
+vendor executable, hosted environment simulation or native qualification ran
+locally. The reviewers' static code approvals are separate from these root-run
+tests.
+
+| Actual log | SHA256 |
+| --- | --- |
+| Original helper counterexample | `564c195467b4282a497b9c9a4aa0c39c01cae30f4f9d68c4a5f721642dac7d5d` |
+| Final focused Go | `0df67033922854846ec5ae3c86b30b637afb41defd26348a039098ec250430c9` |
+| Final affected lint | `e92606b0bf483111dff0a120c315ea165821348f31365020e2468a0059095c47` |
+| Final unfiltered six-linter gate | `e92606b0bf483111dff0a120c315ea165821348f31365020e2468a0059095c47` |
+
+## Preserved evidence limits
+
+The fixture now rejects any direct `.auth` entry other than `machine_id` and
+`.credential-transaction`, including before the first full-profile snapshot.
+It enumerates bounded names through held directory authority and never reads
+unknown bodies. Existing file ownership, byte, mode, inode, link, directory and
+full-profile checks remain required.
+
+This is a fixture acceptance correction. All five qualification flags remain
+false until genuine, current-source hosted evidence establishes applicable
+claims. The earlier negative captures, their omissions and the absence of account
+or model qualification remain unchanged. No new MCP support, VS Code work, merge
+of an unqualified leaf, release or vendor-binary/source equivalence is claimed.

docs/plans/project-install-e2e/qoder-empty-telemetry-directories-plan-review.md

@@ -0,0 +1,18 @@
+# Qoder empty telemetry directories: preimplementation review
+
+Exact reviewed plan SHA256: `27a91ec4a8dcff76d08eabb2363701feeb20f73a4ce7a4c12e108db746d14256`.
+The retained plan is the original frozen draft; both decisions below approve
+that exact text before implementation.
+
+Independent GPT-6.1 Sol xhigh reviewers `native_finish` (R1) and
+`kimi_cline_finish` (R2) returned GO. Both independently checked the pinned
+official npm archive and bundle, the three corrected UTF-8 byte spans and
+the three literal path hashes. They reviewed exclusive creation, exact
+0700/current-owner held ancestry, closed membership from the first child,
+within-check stability and no timestamp pin across commands.
+
+The current genuine 89321cbe capture remains failed/unqualified. Source supports
+the three-directory fixture recipe, not shipping binary/source equivalence or
+any unexported marker value. Four omitted log details remain unproved; the
+complete profile, auth membership, original IDs/settings and logging guards
+are unchanged. No vendor or public installer was run for either review.