Current authoritative state
Protected shipped truth is exact main@a40b9489665bed7d95af619a6079b9c51cab299a; local collaboration identity values still reach string operations without a complete runtime/source boundary. Closed Draft #167 is historical evidence only.
Issue-specific Draft PR #407 / codex/collaboration-user-validation-297 owns this repair. It is stacked on #406 at exact base 02f55466c0111bb53c6886f5d4a95de2068e944a; current exact head is 7a7093b92616296be6b4c3c7ce990880d12f8271. This is active-PR behavior, not protected-main shipped truth.
Required behavior
serializeCollaborationUser() reads userId, displayName, and cursorColor through one module-owned failure boundary. Each value must be a string no longer than 1,024 UTF-16 code units before trim or Unicode traversal; hostile getter/Proxy failures become stable field-specific errors without reflecting private values.
In-bound behavior remains: identifiers are trimmed, descriptive, nonnumeric, and at most 80 Unicode code points without proportional array materialization; display names are trimmed and truncated to 80 Unicode code points without splitting a scalar value; six-digit colors are emitted lowercase.
Remote awareness remains untrusted presentation data. Provider transport/lifecycle, authorization, tenancy, persistence, credentials, deployment, retention, migration, model policy, and durable audit remain host-owned.
Exact-head evidence
Test-only e37b10e97540701cd9db58f9b975693af8d98674 reproduces 10 failures with 30 existing checks passing. Current GREEN head passes:
- focused awareness contract: 40 / 40 tests;
- full TypeScript suite: 160 files / 901 tests;
- statement, branch, function, and line coverage: 100%;
- typecheck, build, and packed-package consumers.
Repository-local success is not protected integration, independent approval, or release proof. Keep #407 Draft until its dependency chain integrates or is otherwise resolved, and while #118 owns the protected release boundary. Before lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.
Current authoritative state
Protected shipped truth is exact
main@a40b9489665bed7d95af619a6079b9c51cab299a; local collaboration identity values still reach string operations without a complete runtime/source boundary. Closed Draft #167 is historical evidence only.Issue-specific Draft PR #407 /
codex/collaboration-user-validation-297owns this repair. It is stacked on #406 at exact base02f55466c0111bb53c6886f5d4a95de2068e944a; current exact head is7a7093b92616296be6b4c3c7ce990880d12f8271. This is active-PR behavior, not protected-main shipped truth.Required behavior
serializeCollaborationUser()readsuserId,displayName, andcursorColorthrough one module-owned failure boundary. Each value must be a string no longer than 1,024 UTF-16 code units before trim or Unicode traversal; hostile getter/Proxy failures become stable field-specific errors without reflecting private values.In-bound behavior remains: identifiers are trimmed, descriptive, nonnumeric, and at most 80 Unicode code points without proportional array materialization; display names are trimmed and truncated to 80 Unicode code points without splitting a scalar value; six-digit colors are emitted lowercase.
Remote awareness remains untrusted presentation data. Provider transport/lifecycle, authorization, tenancy, persistence, credentials, deployment, retention, migration, model policy, and durable audit remain host-owned.
Exact-head evidence
Test-only
e37b10e97540701cd9db58f9b975693af8d98674reproduces 10 failures with 30 existing checks passing. Current GREEN head passes:Repository-local success is not protected integration, independent approval, or release proof. Keep #407 Draft until its dependency chain integrates or is otherwise resolved, and while #118 owns the protected release boundary. Before lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.