[franksong2702]

Final status — 2026-10-20

Merged into fork main as 7a411644d444251c54dee9080c465ceb19341f82 after all 18 exact-head checks succeeded and independent delta review completed. Merge tree 7a5c496b448b12f8dfaadfb8c00fbd4b25c8d5e8 matches the validated candidate. Final review and CI. No installed service was changed.

Scope

Integrates frozen upstream f73e99cc1532bdf88dba12191f1835372dbb2377 into this fork as a review candidate. Fork main was 929b9e50122b65c7df94cfb4973037ad235a89c3, an ancestor 632 commits behind the snapshot. This intentionally includes the development history, not a small standalone backport or deployment approval.

The additional fork delta adapts attachment diagnostics #1010 and process fixtures #1087, retaining #1096 improvements. Current provenance-specific SSRF policy, permission defaults, bounded streaming, and uncertain-upload handling remain intact. Added safe trace diagnostics, verified-destination reference guidance, pre-initialization fixture identity, and observational process-group checks.

Initial CI additionally exposed Python 3.14 nesting behavior in existing tooling. A separately reviewed fix makes a documented 128-container nesting budget explicit for benchmark manifests/receipts and Host-timing input, preserving byte caps and pathological regressions.

Validation

Committed validation report

• Focused: attachment policy 21, MCP import 11, HTTP import 12, process fixtures 4 passed
• MCP App contracts: 582 passed
• Final Python script suites: 819 run on each of Python 3.12.14 and 3.14.8; zero failures/errors, 5 skipped each
• Exact initial CI Python selection plus Host timing: 296 passed
• Workspace all-targets check, fmt, Markdown, diff, and production dogfood warnings gate passed; production workspace warnings=0
• Full Server package attempt: library 3613 passed, 1 sandbox-blocked Unix socket fixture failed, 11 ignored; later package stages were not reached
• Static release gate has an existing npm inherited-proxy fixture failure, reproduced on the unchanged upstream snapshot; required sandbox/proxy restrictions were not weakened

The report preserves initial CI failures, cross-version reproduction, and partial native CI evidence. Latest-head CI must be evaluated independently; local results are not a claim that all CI is green.

Native release/installation acceptance, real Host attachment end-to-end behavior, and actual installed Server/Runner compatibility remain unverified. No release, deployment, restart, upstream PR, or force-push was performed. The earlier candidate validation preceded the merge recorded above.

[franksong2702]

Final integration review — 2026-10-20

Verified exact head 998d85dc8a7f46ef9ca1dbac49933a7638b88ca8: all 18 check runs completed successfully, including Linux Server/Runner/workspace/tooling, MCP conformance, Docker, Windows core/Runner/package/Desktop and macOS core/Desktop plus their aggregate gates. Final CI.

Independent review covered the fork-specific Rust/documentation delta against frozen upstream f73e99cc1532bdf88dba12191f1835372dbb2377 and the separately tested Python 3.14 compatibility change. No outstanding blocking findings remain in that reviewed delta. The final published tree differs from reviewed source tree 34dcbc718965ade5b38d4d58c961c5267a1aba3b only by the committed validation report. The report's reference to twelve source files describes the initial integration delta, before the subsequent Python tooling changes.

The local sandbox Unix-socket and inherited-proxy failures remain recorded; final GitHub CI does not change their historical outcomes. This is acceptance for integration into the fork, not a claim of an exhaustive review of all 632 upstream commits, native installed-version migration acceptance, real Host attachment E2E, release or deployment. Existing upstream contribution PRs yyjeqhc#1010/yyjeqhc#1087 are not closed by this fork integration.