Testing ledger

Every durable test result is recorded here. Deterministic Node.js tests do not invoke a model, so model variant and effort are marked not applicable rather than invented.

Tests are product contracts. A failure is never removed by weakening its requirement. An assertion changes only when on-disk evidence shows the assertion itself encoded the wrong requirement; the failed run, reason, and corrected run remain in this ledger.

2026-07-18 — First live gate smoke test

Variant: Not applicable; deterministic CLI run.
Effort: Not applicable.
What: The demo fixture’s receipt gate.
How: Initialized a clean temporary demo project, ran advance, read and quoted the generated receipt through approve, then ran advance again.
What happened: The first advance visibly refused because the ledger lacked the receipt. The exact receipt was recorded, the second advance opened the gate, and status derived the next phase from disk.
Verdict: PASS. The temporary sandbox was removed; only this result is retained.

2026-07-18 — Initial mutation suite

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Gate mutations, configuration, session creation, and pushed-session closure.
How: Ran npm test with 25 checks.
What happened: 24 passed. The closure test exposed macOS path aliases (/var and /private/var) being treated as different locations.
Verdict: DEFECT FOUND. Canonicalize both paths before checking repository containment.

2026-07-18 — Canonical-path correction

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Full suite after fixing closure path canonicalization.
How: Ran npm test again.
What happened: All 25 checks passed, including a session committed and pushed to a local bare Git remote.
Verdict: PASS.

2026-07-18 — Expanded fail-closed and recovery suite

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Every gate condition, every verdict, fresh-review rules, and printed recovery commands.
How: Ran npm test with deliberate mutations for missing/empty artifacts, missing reviews, invalid verdicts, missing/mismatched/reused receipts, changed artifacts, missing/mismatched ledger proof, missing approver/comments, and blocking verdicts. The tests also executed the printed review new, approve, and advance recovery commands from the states that printed them.
What happened: All 30 checks passed.
Verdict: PASS.

2026-07-18 — Coverage run

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Coverage of the expanded test suite.
How: Ran npm run test:coverage.
What happened: All 30 checks passed. Overall coverage was 86.94% lines, 69.09% branches, and 92.41% functions; the gate engine reached 98.26% line coverage.
Verdict: PASS. Remaining uncovered paths are mostly command usage errors and defensive corruption messages, not untested gate conditions.

Deferred GPT-5.6 variant matrix

Sol / effort levels: Skipped for now; no model-assisted product test has run yet.
Terra / effort levels: Skipped for now; no model-assisted product test has run yet.
Luna / effort levels: Skipped for now; no model-assisted product test has run yet.
Reason: Per the owner’s bounded-testing rule, model-assisted runs default to one variant and the full matrix begins only after target (a) has landed and time remains. A later entry must name the actual available variant and effort rather than infer them.

2026-07-18 — Reviewer skill package validation

Variant: Not applicable; deterministic skill validator.
Effort: Not applicable.
What: skills/peer-reviewer/SKILL.md frontmatter, naming, and package structure.
How: Ran Codex’s quick_validate.py against the repository-local skill folder.
What happened: The bundled artifact Python lacked its optional YAML package, so that runtime could not start the validator. The system Python had the required parser and returned Skill is valid!. The first Node run then failed because its assertion looked for different wording than the skill’s actual “review is saved on disk” instruction; the assertion was corrected without weakening the requirement. The Node test checks the six default phase sections, custom-phase rule, write-before-report rule, receipt boundary, and four-line agents/openai.yaml sidecar.
Verdict: PASS. After correcting the assertion, all 31 repository checks passed and the Codex validator again returned Skill is valid!. The skill exists only inside this project; nothing was installed globally.

2026-07-18 — Expanded relay, history, and immutable-close run

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Nine Koda-C skill packages, prior-phase entry evidence, immutable close binding, and Git between close preparation and verification.
How: Ran npm test after expanding the producer/reviewer relay and close ceremony.
What happened: 33 of 35 checks passed. Both failures were overly literal skill-test phrases: the summary used “resolved inputs” instead of the assertion’s full heading, and the close skill stated “immutable” and close.md separately rather than adjacently. The actual history and Git closure tests passed.
Verdict: TEST ASSERTIONS REVISE. Correct the wording checks without weakening their semantic requirements, then rerun the complete suite.

The first corrected rerun passed 34 of 35 checks. One assertion still assumed the words “resolved input” were adjacent, while five skills use the explicit heading “Inputs resolved during this phase.” The assertion was narrowed to the two accepted artifact headings and scheduled for another full rerun.

The final corrected run passed all 35 checks. A subsequent full run also proved session new refuses both an uncommitted close and a locally committed but unpushed close, then succeeds only after the close commit reaches the configured upstream. All nine skill folders independently returned Skill is valid! from Codex’s validator.

2026-07-18 — Tiny end-to-end dogfood session

Variant: Not applicable; deterministic CLI lifecycle proof.
Effort: Not applicable.
What: One complete configured phase from session open through review, receipt approval, advancement, immutable close, Git commit, push, and derived closure.
How: Ran npm run dogfood in a disposable project with a disposable local bare Git remote. Saved the normalized transcript and session snapshot under docs/dogfood/ and removed the temporary repositories.
What happened: The first run reached verified closure but revealed that the first-push hint printed git push while the harness needed git push -u origin main. Close was changed to inspect branch/upstream, print the exact first-push command, and refuse preparation when no remote exists. The current rerun also binds the full review hash into approval evidence, executed all three printed Git commands verbatim, refused closure after the local commit, pushed commit 8ba9b4ac1f374e68d19385362ca5af8552b5861e, then reported SESSION CLOSED from both close and status.
Verdict: PASS after UX correction. A repository test re-hashes the preserved session and checks that close.md still binds its final state, review, and receipt.

2026-07-18 — Owner-defined test classes, first expanded run

Variant: Not applicable; deterministic Node.js test runner.
Effort: Not applicable.
What: Explicit gate-mutation, receipt-adversarial, stale-review, status-truth, printed-command, and initial reviewer-fixture integrity tests.
How: Ran npm run test:record -- 2026-07-18-expanded-core-initial; every test and subtest is preserved in the per-test result.
What happened: 55 of 56 checks passed. The older advanced-history assertion expected the superseded phrase “changed after this review,” while the product had deliberately changed the refusal to “review is stale … re-review.” The mechanism passed; the wording assertion failed.
Verdict: TEST ASSERTION REVISE. Update the assertion to require the new named stale-review language, then rerun everything.

2026-07-18 — Owner-defined test classes, corrected run

Variant: Not applicable; deterministic Node.js test runner.
Effort: Not applicable.
What: The complete expanded deterministic suite, including one planted reviewer fixture and one honest control.
How: Corrected only the stale wording assertion, then ran npm run test:record -- 2026-07-18-expanded-core-final; every test and subtest is preserved in the per-test result.
What happened: All 58 checks passed. The suite names every core gate refusal, rejects earlier-review and cross-phase receipts, accepts outer trim only, refuses any changed receipt word, binds review hashes in both directions, derives status after behind-the-CLI mutations, and names malformed ledger and state evidence.
Verdict: PASS. The deterministic mechanism and two bounded fixture sources are ready; actual model-assisted fixture runs remain unrun.

2026-07-18 — Codex-native skill packaging correction

Variant: Not applicable; deterministic skill validator and Node.js test runner.
Effort: Not applicable.
What: Root AGENTS.md, repository skill discovery layout, nine skill packages, and all existing product checks after moving from top-level skills/ to .agents/skills/.
How: Ran Codex’s quick_validate.py independently for all nine folders, then npm run test:record -- 2026-07-18-codex-native-packaging. Every repository test and subtest is preserved in the per-test result.
What happened: All nine skills returned Skill is valid!; all 58 repository checks passed. The current task cannot prove startup discovery because Codex reads repository guidance and its initial skill list at task startup.
Verdict: DETERMINISTIC PASS; FRESH-TASK DISCOVERY STILL REQUIRED. This correction came from the owner’s question about .agents, followed by verification against current official Codex documentation.

2026-07-18 — Expanded core coverage

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Coverage after receipt adversarial, stale-review, status-truth, reviewer-fixture, and packaged-command additions.
How: Ran npm run test:record -- 2026-07-18-expanded-core-coverage --coverage; every named result is preserved in the per-test result.
What happened: All 58 checks passed. Overall coverage was 87.90% lines, 71.88% branches, and 91.58% functions; gate.ts reached 100% for lines, branches, and functions.
Verdict: PASS.

2026-07-18 — Bidirectional review binding

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Full-review acknowledgement binding and incomplete-template refusal.
How: Added the complete review SHA-256 to each approval entry, re-hashed it during every gate/status evaluation, and ran npm run test:record -- 2026-07-18-bidirectional-review-binding-initial. Every named result is preserved in the per-test result.
What happened: All 63 checks passed. Editing review findings after the receipt was acknowledged now refuses with approval_review_changed; merely flipping an untouched generated template to APPROVE refuses with review_incomplete. Status reflects both conditions directly from disk.
Verdict: PASS. The chain now binds artifact → review and complete review → approval, while still making no claim to prove cognition.

2026-07-18 — Real package investigation and correction

Variant: Not applicable; npm package/install rehearsal.
Effort: Not applicable.
What: The documented local package invocation and installed executable, including failed attempts.
How: Packed the repository, installed the tarball through npm exec, and executed the binary and its printed command. The exact sequence is preserved in the package investigation result.
What happened: Treating the tarball itself as an npm executable first produced a permission error. Correct npm syntax then exposed the real defect: Node refuses native TypeScript type stripping inside node_modules. A dependency-free build step now emits plain JavaScript to dist/; a follow-up exposed one printed .ts path literal, which was also corrected.
Verdict: DEFECTS FOUND AND CORRECTED. The automated package test now constructs a real tarball, installs it, starts koda, initializes the demo, executes the exact printed dist/cli.js advance command, and asserts the named refusal.

2026-07-18 — Packaged recovery command, corrected run

Variant: Not applicable; Node.js test runner plus npm tarball installation.
Effort: Not applicable.
What: Complete deterministic suite after compiling the installable binary and correcting the printed path.
How: Ran npm run test:record -- 2026-07-18-packaged-recovery-command-final; every named result is preserved in the per-test result.
What happened: All 63 checks passed, including the real tarball/install test and exact installed-package recovery command.
Verdict: PASS.

2026-07-18 — Final coverage run

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: All deterministic product, packaging, skill-shape, dogfood-integrity, and fixture-integrity checks.
How: Ran npm run test:record -- 2026-07-18-final-coverage --coverage; every named result is preserved in the per-test result.
What happened: All 63 checks passed. Overall coverage was 87.98% lines, 71.69% branches, and 91.75% functions; gate.ts, cli.ts, types.ts, and the test helpers reached 100% line, branch, and function coverage.
Verdict: PASS.

2026-07-18 — Installed-style one-minute demo rehearsal

Variant: Not applicable; manual CLI rehearsal using generated commands.
Effort: Not applicable.
What: The user-facing refusal → receipt prompt → successful advancement path.
How: Initialized the demo through the built dist/cli.js, then copied only commands printed by Koda. The exact commands and significant output are preserved in the rehearsal result.
What happened: The first advance refused because the current receipt was absent. The printed interactive approve command accepted the exact final receipt and printed another advance command. That command opened BRIEF and activated orient.
Verdict: PASS.

2026-07-18 — Owner-facing relay, first validation

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Persistent producer/reviewer role separation, disk-backed in-phase consultation, no chat-only handback, session-prompter boundary, and pinned ephemeral Ghostty fixture execution.
How: Ran npm test; the failed assertions and passing-scope record are preserved in the initial per-test result.
What happened: 63 of 65 checks passed. The expanded reviewer description no longer began with an accepted front-loaded discovery verb, and its broader receipt sentence no longer contained the exact explicit Do not quote the receipt in chat. prohibition required by the skill contract.
Verdict: SKILL WORDING REVISE. The new relay mechanisms passed. Restore both explicit discovery/receipt requirements without weakening either test.

2026-07-18 — Owner-facing relay, corrected validation

Variant: Not applicable; Node.js test runner plus Codex’s deterministic skill validator.
Effort: Not applicable.
What: The complete repository after correcting the two reviewer-skill contract violations.
How: Changed the reviewer description to front-load Review, restored the exact receipt sentence, ran all nine skills through quick_validate.py, and ran npm run test:record -- 2026-07-18-owner-facing-relay-final. Every test is preserved in the corrected per-test result.
What happened: All 65 checks passed and all nine skills returned Skill is valid!.
Verdict: PASS. No test was weakened.

2026-07-18 — Owner-facing relay coverage, first run

Variant: Not applicable; Node.js coverage runner.
Effort: Not applicable.
What: Coverage after the owner-facing relay and Ghostty fixture-runner additions.
How: Ran npm run test:record -- 2026-07-18-owner-facing-relay-coverage --coverage; every named result is preserved in the per-test result.
What happened: All 65 checks passed, with 87.86% overall line coverage. Gate coverage fell from 100% to 98.46% because the review_phase_mismatch refusal at gate.ts:62-63 had never been deliberately exercised.
Verdict: MISSING MUTATION TEST. Add a one-condition mutation that changes only the review metadata phase and asserts the named refusal. Do not accept lower gate coverage.

2026-07-18 — Owner-facing relay coverage, corrected run

Variant: Not applicable; Node.js coverage runner.
Effort: Not applicable.
What: The full suite with the missing review-phase mutation added.
How: Ran npm run test:record -- 2026-07-18-owner-facing-relay-coverage-final --coverage; every named result is preserved in the per-test result.
What happened: All 66 checks passed. Overall coverage is 87.98% lines, 71.77% branches, and 91.75% functions; gate.ts is again 100% for lines, branches, and functions.
Verdict: PASS. The new mutation refuses and names review_phase_mismatch.

2026-07-18 — Final package dry run

Variant: Not applicable; npm packaging.
Effort: Not applicable.
What: Exact files and build behavior of the current installable package.
How: Ran npm pack --dry-run with an isolated npm cache after the 66-check coverage run.
What happened: prepack built 10 dependency-free JavaScript files; npm listed 115 packaged files, 103.2 kB compressed and 384.4 kB unpacked, including all nine .agents/skills/ packages, docs, fixtures, scripts, source, tests, and dist/.
Verdict: PASS. Node emitted the already-known experimental warning for stripTypeScriptTypes; the real tarball/install test remains green.

2026-07-18 — Fresh reviewer runner integration failures

Variant: gpt-5.6-sol requested at medium effort; no model review completed in either failed run.
Effort: Medium requested; not evaluated.
What: First execution of the blind reviewer-fixture runner against planted-hard-number.
How: Prepared a copied fixture project and launched fresh ephemeral Codex tasks with the generated commands. Preserved both failed attempts under reviewer-runs/.
What happened: Run 01 never started Codex because the executor placed the global -a never option after exec; its result writer also omitted newline joining and collapsed the initial Markdown. Both runner defects were corrected and regression assertions added. Run 02 created a fresh task, but the service refused gpt-5.6-sol because the installed Codex CLI 0.139.0 was too old. Codex was upgraded to 0.144.6 before creating a new run. Neither failed project was reused or called a model result.
Verdict: RUNNER AND ENVIRONMENT FAILURES, PRESERVED. No fixture capability claim comes from either attempt.

2026-07-18 — Fresh Sol reviewer capability fixture

Variant: gpt-5.6-sol.
Effort: Medium.
What: Blind formal review of the one-defect planted-hard-number fixture in a fresh ephemeral Codex task.
How: The runner gave the task the named repository reviewer skill, a copied Koda project, the active artifact, and only its cited evidence. Expected behavior remained sealed outside the copied project until grading. Full evidence is in run 03.
What happened: The reviewer returned REVISE and identified exactly that neither cited file supports the brief’s five-second promise. It made no other item blocking, preserved review metadata and receipt, ran status, and did not expose the receipt in chat.
Verdict: PASS — capability control caught the plant.

2026-07-18 — Fresh Sol reviewer temperament fixture

Variant: gpt-5.6-sol.
Effort: Medium.
What: Blind formal review of the honest-control fixture in a separate fresh ephemeral Codex task.
How: Used the same bounded runner and evidence boundary as the planted run, with a clean copied project and sealed expectation. Full evidence is in run 01.
What happened: The reviewer verified the artifact against both cited sources and returned APPROVE without inventing a defect. It preserved review metadata and receipt, ran status, and did not expose the receipt in chat.
Verdict: PASS — temperament control approved honest work.

Both successful tasks emitted repeated local model-cache parse warnings about supports_reasoning_summaries; the task turns still completed with exit code 0 and their stderr remains attached. These runs prove fresh-context reviewer behavior because the runner names the skill explicitly. They do not yet prove automatic startup discovery of repository skills, which remains a separate test.

2026-07-18 — Reviewer runner corrected deterministic run

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Complete repository suite after correcting global Codex option placement and durable result formatting.
How: Ran npm run test:record -- 2026-07-18-reviewer-runner-final; every named result is preserved in the per-test result.
What happened: All 66 checks passed. Regression checks require --ask-for-approval never before the exec subcommand, forbid the broken post-subcommand shorthand, and require the prepared result lines to be joined with newlines.
Verdict: PASS. The failed attempts remain recorded; their tests were not weakened or erased.

2026-07-18 — Full native lifecycle scenarios, first run

Variant: Not applicable; deterministic Node.js and local Git scenarios.
Effort: Not applicable.
What: Three complete native chains: clean approval, REVISE recovery in plan, and DISCUSS with an owner ruling plus fresh live review. Every scenario traverses brief → orient → plan → produce → live → summary and reaches a pushed immutable close.
How: Added three independent temporary-project tests and strengthened the committed dogfood test to require all six native phases, then ran npm test before replacing the old snapshot.
What happened: All three new full-lifecycle scenarios passed. The complete suite reported 68 of 69 passing because the committed dogfood snapshot still honestly contained only its prior one-phase brief session.
Verdict: EXPECTED EVIDENCE MIGRATION FAILURE. Regenerate the dogfood through the full native chain; do not weaken the six-phase assertion or call the old snapshot sufficient.

2026-07-18 — Full native lifecycle scenarios, corrected run

Variant: Not applicable; deterministic Node.js and local Git scenarios.
Effort: Not applicable.
What: The complete repository after regenerating dogfood through all six native phases and retaining the clean, REVISE, and DISCUSS scenario tests.
How: Ran npm run dogfood, inspected the resulting six artifacts, six reviews, six advancement records, close metadata, and transcript, then ran npm run test:record -- 2026-07-18-full-native-lifecycle-final. Every named test is preserved in the per-test result.
What happened: All 69 checks passed. Each of the three full-session scenarios reached an immutable close committed and pushed to its own temporary Git remote. The preserved clean dogfood separately refused twice per phase—first without review, then without receipt—before every gate opened and summary handed to pushed close.
Verdict: PASS. Mechanical support for the full native lifecycle is now proved across multiple routes; actual model-driven producer/reviewer operation across that lifecycle remains a separate next proof.

2026-07-18 — Full native lifecycle coverage

Variant: Not applicable; Node.js coverage runner plus local Git scenario repositories.
Effort: Not applicable.
What: Coverage after adding three six-phase pushed-close scenarios and the full native dogfood snapshot.
How: Ran npm run test:record -- 2026-07-18-full-native-lifecycle-coverage --coverage; every result and the complete coverage table are preserved in the per-test result.
What happened: All 69 checks passed. Overall coverage increased to 88.24% lines, 72.46% branches, and 91.75% functions. gate.ts remains 100% for lines, branches, and functions.
Verdict: PASS. Adding lifecycle scenarios did not reduce mutation coverage or weaken any refusal test.

2026-07-18 — GPLv3 ownership and package metadata

Variant: Not applicable; deterministic file and package validation.
Effort: Not applicable.
What: Owner-directed replacement of MIT with GPLv3 only and the sole project copyright line Copyright (C) 2026 Kristian Bengtsson.
How: Retrieved the canonical GPLv3 text from GNU, added the project copyright header, set package metadata to GPL-3.0-only, added the README license section, and compared the license body after the header byte-for-byte with GNU’s source. Both SHA-256 values were 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986. Then ran npm run test:record -- 2026-07-18-gplv3-license-final; every named result is preserved in the per-test result.
What happened: All 70 checks passed, including the real packaged executable. The license test requires the exact owner line, GPLv3 title, standard sections 0 and 17, end marker, full-text size, package SPDX identifier, and README notice.
Verdict: PASS. The complete standard GPLv3 body is intact and package/readme metadata agree.

2026-07-18 — Terra medium reviewer pair

Variant: gpt-5.6-terra.
Effort: Medium.
What: The same sealed planted-hard-number and honest-control fixtures already used for Sol.
How: Ran each copied project in a separate fresh Codex task with the reviewer skill and evidence boundary pinned. The first planted attempt never reached a model because the desktop sandbox denied Codex state-database initialization; it remains preserved as NOT RUN. Fresh replacement and honest-control evidence are linked from the matrix.
What happened: Terra returned REVISE for the planted unsupported five-second promise and APPROVE for the honest control. It made no false blocking finding. It briefly tried a nonexistent 00-brief.md path in the planted run and an incorrect citation location in the honest run, then corrected both from disk before writing the reviews.
Verdict: PAIR PASS — capability 1/1, temperament 1/1. Operational path recovery remains visible rather than being collapsed into the verdict.

2026-07-18 — Luna medium reviewer pair

Variant: gpt-5.6-luna.
Effort: Medium.
What: The identical sealed planted-hard-number and honest-control fixture pair.
How: Ran each copied project in a separate fresh Codex task with the same prompt and evidence boundary as Sol and Terra. Evidence is linked from the matrix.
What happened: Luna returned REVISE for the plant and APPROVE for the honest control, with no false blocking finding. Its first planted-review edit retained generated template guidance; koda status named and refused the incomplete review, and Luna corrected it before reporting. In the honest run it first looked for root state.json, then followed disk discovery to the real session state.
Verdict: PAIR PASS — capability 1/1, temperament 1/1. The planted run also demonstrates that the mechanical gate catches a reviewer artifact defect even when the model’s final judgment is correct.

Medium baseline comparison

Sol, Terra, and Luna each score 2/2 on this bounded fixture pair at medium effort. That result is not evidence that their review processes were identical: preserved event streams show Sol completing more directly, Terra recovering from citation/path resolution errors, and Luna relying once on Koda’s incomplete-template refusal before producing valid review evidence. Broader capability claims require more defect classes; effort-sensitivity claims require paired runs at another effort.

2026-07-18 — Medium model matrix consistency run

Variant: Not applicable; deterministic Node.js validation of model-run evidence.
Effort: Not applicable.
What: Cross-check the six PASS cells in MODEL-TEST-MATRIX.md against the exact graded Sol, Terra, and Luna run folders.
How: Added a test requiring each recorded result to name the pinned model, medium effort, PASS status, and expected verdict, while requiring the matrix’s three medium rows to report 2/2 and retain the Terra infrastructure failure. Ran npm run test:record -- 2026-07-18-medium-model-baseline-final; every result is preserved in the per-test transcript.
What happened: All 71 checks passed, including the installed package, full lifecycle scenarios, GPLv3 validation, gate mutations, and matrix-to-folder consistency.
Verdict: PASS. The overview is now mechanically tied to the six graded medium runs instead of being an unsupported summary.

2026-07-18 — Discriminating fixture expansion, first deterministic run

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: Three new sealed reviewer fixtures—an inference-chain plant, a tempting honest control, and a missing-evidence trap—plus independent CATCH and VERDICT scoring for every run.
How: Added executable fixture-integrity checks and ran npm test before recording a final result.
What happened: 73 of 74 checks passed. The missing-evidence fixture’s actual three tests exited successfully, but the parent Node test process received no child TAP stdout and a test-only assertion expected # pass 3. The fixture plant itself remained intact: its claimed evidence/test-output.txt was still absent.
Verdict: TEST-HARNESS DEFECT. Keep the successful child exit assertion, count the three declared deterministic tests directly, and remove only the environment-dependent TAP-rendering assertion. Do not add the missing transcript or weaken the planted absence.

2026-07-18 — Discriminating fixture expansion, corrected run

Variant: Not applicable; Node.js test runner.
Effort: Not applicable.
What: The complete repository with five blind reviewer fixtures, versioned sealed scoring metadata, and every existing run migrated to separate CATCH, VERDICT, and secondary execution observations.
How: Kept the missing-evidence child test process’s successful exit assertion, added a direct count of its three declared checks, removed only the environment-dependent TAP-rendering check, and ran npm run test:record -- 2026-07-18-discriminating-fixtures-final. Every named result is preserved in the per-test transcript.
What happened: All 74 checks passed. The inference fixture mechanically requires the title and row-count omission to be derived across the dataset, envelope, and pipeline files. The tempting honest fixture proves its three bounded behaviors despite deliberate style temptations. The absence fixture proves its code/tests pass while the exact transcript claimed by the artifact remains absent.
Verdict: PASS. A blocking verdict with a vague rationale can no longer score as a catch, and operational recovery notes remain outside both score axes.

2026-07-18 — Persistent full-relay runner, first deterministic run

Variant: Not applicable; Node.js test runner and local Git preparation fixture. No model was called.
Effort: Not applicable.
What: Preparation and static execution contracts for a resumable six-phase relay using distinct persistent producer/reviewer thread IDs, real owner receipt prompts, pre-close output push, and restorable close evidence.
How: Ran npm test after adding the runner, package commands, protocol, and two deterministic relay checks.
What happened: 75 of 77 checks passed. Real preparation copied two ignored source residues—.DS_Store and an otherwise empty legacy peer-reviewer/ directory—because it recursively copied the entire .agents/skills parent instead of the declared nine packages. The second failure was a test-only wording mismatch: the protocol’s exact limitation used Markdown emphasis around not, while the assertion expected unformatted text.
Verdict: PACKAGING DEFECT AND ASSERTION DEFECT. Copy only the explicit nine-skill allowlist so ignored filesystem residue cannot enter a prepared project. Preserve the emphasized limitation and correct the assertion to its actual exact wording; do not accept an eleventh skill or weaken the runtime boundary.

2026-07-18 — Persistent full-relay runner, corrected deterministic run

Variant: Not applicable; Node.js test runner and local Git preparation fixture. No model was called.
Effort: Not applicable.
What: The complete repository after constraining relay preparation to the declared nine skills and retaining the explicit interactive-reviewer boundary.
How: Replaced recursive parent-folder copying with a nine-name skill allowlist, corrected only the Markdown-aware boundary assertion, and ran npm run test:record -- 2026-07-18-persistent-relay-runner-final. Every named result is preserved in the per-test transcript.
What happened: All 77 checks passed. A real temporary preparation produced a clean project, exactly nine skills, an initial commit, a configured upstream, and zero unpushed commits. Static execution contracts require persistent thread resume, distinct role IDs, closed model stdin, interactive Kristian approval, disk gate/close evaluation, pre-close output commit, verified Git bundle capture, and cleanup of only nested runtime Git.
Verdict: PASS. The harness is ready for a genuine owner-acknowledged run; this deterministic result does not claim that such a model-driven run has happened.

2026-07-18 — First-time Ghostty guide validation

Variant: Not applicable; Node.js test runner. No model was called.
Effort: Not applicable.
What: Kristian’s exact two-window procedure for the prepared full relay, including the distinction between the supervised reviewer context and window B’s current role as a review-reading surface.
How: Added docs/GHOSTTY-TEST-GUIDE.md, linked it from the relay protocol and README, added plain-language baseline interpretation to the model matrix, and required the guide to preserve the exact execution command, chat receipt prohibition, resume rule, and RELAY COMPLETE evidence. Ran npm run test:record -- 2026-07-18-ghostty-guide-final; every named result is preserved in the per-test transcript.
What happened: All 77 checks passed. The prepared run remains PREPARED — NOT RUN; its folder is deliberately excluded from this documentation commit until Kristian completes the relay.
Verdict: PASS. The instructions no longer imply that the second Ghostty window is already an interactive reviewer interface.

2026-07-18 — Complete Ghostty command-sheet validation

Variant: Not applicable; Node.js test runner. No model was called.
Effort: Not applicable.
What: A literal copy-and-paste command sheet covering Window A execution, Window B review discovery and full reading, exact receipt copying, pause inspection, resume, and completion evidence.
How: Required every command and the receipt-safety boundary from docs/GHOSTTY-TEST-GUIDE.md, then ran npm run test:record -- 2026-07-18-ghostty-command-sheet-final. Every named result is preserved in the per-test transcript.
What happened: All 77 checks passed. The command sheet keeps receipt discovery in Kristian’s reading window and never sends a receipt through model chat.
Verdict: PASS. The prepared relay has a complete operator procedure with no implied terminal commands omitted.

2026-07-18 — First genuine persistent-relay attempt

Variant: Producer gpt-5.6-sol at medium effort; reviewer gpt-5.6-terra at medium effort was not reached.
Effort: Medium for the one producer context used.
What: The prepared six-phase relay in Ghostty, using the real persistent producer context and owner-visible supervisor.
How: Kristian ran npm run relay:execute -- docs/relay-runs/2026-07-18-software-clean-sol-medium-terra-medium-01. The supervisor saved every event stream, stderr file, thread ID, session artifact, and pause reason in that run folder.
What happened: Producer turn 1 opened session 2026-07-18-01. Producer turn 2 resumed the same thread but Codex rejected its brief edit because the resumed non-interactive invocation had fallen back to a read-only sandbox. No brief and no consultation request were written, so the supervisor refused to guess and paused with the missing-artifact condition named. The reviewer never ran.
Verdict: RUNNER DEFECT; RELAY NOT COMPLETE. Preserve the session and persistent producer thread, explicitly bind workspace-write to resumed turns, then continue the same run. This is not a model-quality result and must not enter the reviewer matrix.

2026-07-18 — Persistent-relay resume permission correction

Variant: Not applicable; deterministic Node.js and local Git tests. No model was called.
Effort: Not applicable.
What: Regression protection for identical least-privilege write access on initial and resumed Codex relay turns.
How: Added the per-invocation Codex configuration override sandbox_mode="workspace-write" to the argument list shared by both branches, required the resume branch to consume that shared list, documented the recovery invariant, and ran npm run test:record -- 2026-07-18-relay-resume-sandbox-final. Every named result is preserved in the per-test transcript.
What happened: All 77 checks passed. The saved run remains paused and unchanged apart from its already-recorded evidence; rerunning its exact execute command will resume the same producer thread from current disk state.
Verdict: PASS. The concrete first-run failure now has a tested correction, without broadening the model sandbox to danger-full-access or weakening any gate or mutation test.

2026-07-18 — First live owner acknowledgement UX finding

Variant: Live Sol/medium producer and Terra/medium reviewer relay; operator interaction by Kristian.
Effort: Medium for both model contexts.
What: Kristian’s first Brief review acknowledgement using the documented multi-command Window B procedure.
How: Kristian found and opened the complete review, read its APPROVE verdict and findings, then manually pasted the exact receipt into Window A. The gate accepted it and automatically activated Orient.
What happened: The gate and two-context relay behaved correctly, but the five-command owner procedure did not. Ambiguous instructions caused Kristian to expose the receipt once in the separate build-support chat while asking what to paste. That chat did not enter the producer context, reviewer context, run transcript, or approval ledger; Kristian still entered the receipt himself after reading. The incident nevertheless violates the intended operator boundary and is preserved as a usability failure.
Verdict: OWNER INTERFACE REVISE; GATE PASS. Replace review discovery, opening, unchanged-file verification, and clipboard copying with one owner-facing command. Keep manual paste into Koda and never claim that a machine proved comprehension.

2026-07-18 — One-command owner review, guarded validation attempts

Variant: Not applicable; deterministic Node.js test runner and a temporary prepared relay. No model was called.
Effort: Not applicable.
What: npm run relay:review, which finds the single waiting run, derives its active session/phase from disk, opens the complete review, detects changes during reading, and copies—but never prints—the exact receipt.
How: The temporary execution test opened a planted review through a noninteractive test pager, required the exact receipt in a test clipboard, and required stdout not to contain RECEIPT:. The first unrecorded npm test run passed 76/77 because the rewritten guide had softened the exact “Never paste” prohibition. After restoring it, npm run test:record -- 2026-07-18-one-command-owner-review-final again passed 76/77 because the shorter guide had omitted the exact “Do not run relay:prepare again” recovery prohibition. Every named result from the recorded failure remains in the failed per-test transcript.
What happened: Both failures were safety-copy regressions caught by the existing test, not gate failures. Neither assertion was removed or weakened; both exact prohibitions were restored.
Verdict: DOCUMENTATION REVISE. Retain the simpler interaction while preserving every prior safety boundary verbatim.

2026-07-18 — One-command owner review, corrected validation

Variant: Not applicable; deterministic Node.js test runner and a temporary prepared relay. No model was called.
Effort: Not applicable.
What: The corrected one-command owner reader, single-session identity documentation, and explicit current-versus-future two-window boundary.
How: Ran npm run test:record -- 2026-07-18-one-command-owner-review-corrected; every named result is preserved in the corrected per-test transcript.
What happened: All 77 checks passed. The executable helper finds exactly one AWAITING_OWNER_RECEIPT run, derives its current review from RUN.json and state.json, refuses zero or multiple waiters, verifies the review hash is unchanged after reading, copies the receipt without printing it, and leaves the actual Koda acknowledgement manual. The complete mutation, adversarial-receipt, status-truth, stale-review, package, and close suites remain intact.
Verdict: PASS. Window B now requires one stable command for every phase while the guide states honestly that the mature owner-facing reviewer conversation is still future work.

2026-07-18 — Persistent side-by-side runtime ruling

Variant: Not applicable; owner product ruling plus deterministic regression suite. No model was called for this validation.
Effort: Not applicable.
What: Clarify that one persistent producer context and one separate persistent reviewer context span the entire visible session; producer progress is observable but owner input is closed, while the reviewer is the sole conversational interface.
How: Updated root guidance, README, project contract, backlog, and the dated runtime design. Explicitly removed the prior suggestion that either context might normally be replaced at phase handoffs, distinguished exposed progress from hidden chain-of-thought, and ran npm run test:record -- 2026-07-18-persistent-side-by-side-runtime-ruling. Every named result is preserved in the per-test transcript.
What happened: All 77 checks passed. Fresh reviewer contexts remain useful for blind fixtures, but are not the ruled in-session experience. The current harness still proves only two persistent backend contexts behind a supervisor, not the future side-by-side interactive surface.
Verdict: PASS. Independent review is now defined as producer/reviewer context separation, not per-phase reviewer replacement, without changing any mechanical gate condition.

2026-07-18 — First genuine relay close attempt

Variant: Producer gpt-5.6-sol at medium effort in the active persistent relay.
Effort: Medium.
What: Immutable close after all six phases advanced, including one unplanned Summary REVISE loop and seven genuine owner acknowledgements.
How: The relay supervisor committed and pushed every produced output before resuming the producer with koda-c-close. The producer prepared close.md, recomputed and matched its session binding, then attempted Koda’s exact Git staging command.
What happened: Codex’s least-privilege workspace-write sandbox denied creation of .git/index.lock. The producer correctly reported the permission boundary, verified that no lock, staged change, or commit remained, and left only the immutable untracked close.md. Koda reported PHASES COMPLETE — SESSION NOT CLOSED; the supervisor preserved the pause as PAUSED_ERROR rather than claiming completion.
Verdict: SUPERVISOR RESPONSIBILITY DEFECT; CLOSE GATE PASS. The model must not receive broad filesystem access merely to mutate repository metadata. Keep close preparation and final verification in the same producer context, but assign the exact intervening Git commit and push to the trusted relay supervisor.

2026-07-18 — Supervised immutable-close recovery validation

Variant: Not applicable; deterministic Node.js, package, mutation, status, and local-Git suite. No model was called.
Effort: Not applicable.
What: A resumable three-part close: persistent producer prepares and validates immutable close.md; trusted supervisor commits and pushes exactly the session path; the same producer context resumes and independently verifies close and status.
How: Added supervised mode to koda-c-close, required the runner to refuse any preparation change other than the one untracked close.md, stage the exact session path, use an honest session-close commit, push, require both Koda close/status checks, and resume the saved producer thread for verification. Ran npm run test:record -- 2026-07-18-supervised-close-recovery-final; every named result is preserved in the per-test transcript.
What happened: All 77 checks passed. The gate, receipt adversarial, stale-review, disk-truth, printed-command, package, skill, and Git-close tests remain intact. The active relay is still paused with its original immutable close artifact; the correction has not yet been credited as live success.
Verdict: PASS FOR RECOVERY IMPLEMENTATION; LIVE CLOSE PENDING. Resume the same run only after this correction is committed and pushed, then accept success solely if the same session reaches RELAY COMPLETE with verified Git evidence.

2026-07-18 — First genuine persistent relay, completed result

Variant: Persistent producer gpt-5.6-sol medium; separate persistent reviewer gpt-5.6-terra medium.
Effort: Medium for both contexts.
What: One real software session through Session → Brief → Orient → Plan → Produce → Live → Summary → immutable close, with Kristian acknowledging every formal review.
How: Ran the resumable Ghostty supervisor against software-clean. Both roles kept one distinct thread ID for the entire session and conversational stdin remained closed for model subprocesses. Every event stream, stderr file, artifact, review, approval, advancement, live result, pause, recovery, close record, Git log, and verified history bundle is preserved under the completed relay folder.
What happened: Brief through Live received APPROVE. The first Summary made one unsupported Git-state assertion; Terra found it without a planted defect and returned REVISE. Kristian acknowledged it, Koda kept the gate shut, Sol corrected the Summary, and Terra approved the fresh artifact. Seven genuine acknowledgements produced six advancements. Two harness defects remained visible and recoverable: resumed turns initially fell back to read-only, and the model sandbox could not write .git during close. After narrow supervisor fixes, the same producer/reviewer contexts continued. Final Koda status was SESSION CLOSED; local and remote heads matched pushed commit bbcb5cf097e88db5ab95d8065f43c116eb926690, ahead count was zero, project status was clean, and git bundle verify reported complete history.
Secondary observation: The prepared snapshot contains one committed .DS_Store inside the copied Brief skill. It did not affect discovery or execution, but it is unnecessary source residue. The completed evidence remains immutable; future preparation now filters macOS metadata, gives each nested project its own .DS_Store ignore rule, and tests both protections.
Owner-interface observation: The initial multi-command review instructions caused one receipt to be exposed in the separate build-support chat while Kristian asked for help. It never entered either relay model context or the repository transcript. The replacement npm run relay:review reduced all later owner review cycles to one stable command.
Verdict: LIVE RELAY PASS. This proves a resumable backend relay between two persistent independent contexts and a real pushed close. It does not yet prove the future visible producer pane, interactive reviewer conversation, notifications, or unattended daemon.

2026-07-18 — Completed relay evidence regression and restoration

Variant: Not applicable; deterministic repository and restored-bundle validation. No model was called.
Effort: Not applicable.
What: Bind the genuine completed relay into the permanent suite and independently restore its nested Git history.
How: Added a test requiring COMPLETE status, distinct thread IDs, 11 producer and 7 reviewer turns, six configured advancements, seven ledger acknowledgements, the archived Summary REVISE, immutable close metadata, matching local/remote final commit, zero ahead count, clean project status, SESSION CLOSED, absent nested runtime metadata, and a verifiable complete-history bundle. Ran npm run test:record -- 2026-07-18-genuine-relay-evidence-final; every named result is preserved in the per-test transcript. Then cloned PROJECT-HISTORY.bundle into a fresh temporary directory and ran the restored project’s real test suite.
What happened: All 78 Koda-C checks passed. The restored history contained exactly the initial fixture commit, pre-close output commit, and final close commit at the recorded head; its working tree was clean and all five restored word-count tests passed.
Verdict: PASS. The completed relay is now executable, internally checked repository evidence rather than a prose claim or an opaque transcript archive.

2026-07-18 — Bounded reviewer model program, final result

Variant: Fresh ephemeral gpt-5.6-sol, gpt-5.6-terra, and gpt-5.6-luna reviewer contexts.
Effort: Medium for every run.
What: Two additional Luna hard-number repetitions, followed by the sealed inference-chain, tempting-honest, and missing-evidence fixtures on all three models. CATCH and VERDICT remained separately scored from execution behavior.
Contract: The three new fixture contracts were committed in b4434e4 before their first run. A low-effort inference confirmation was permitted only for one clear medium winner.
How: Ran each model in a fresh ephemeral Codex context with pinned model and effort, graded only after its disk review existed, then ran npm run test:record -- 2026-07-18-bounded-reviewer-model-program-final. All 78 named repository results are preserved in the passing integrity transcript.

Model	Fixture	Verdict	CATCH	VERDICT	Secondary execution observation	Evidence
Luna	hard number — repeat 2	REVISE	PASS	PASS	Direct; no gate repair	Result
Luna	hard number — repeat 3	REVISE	PASS	PASS	Gate refused retained template guidance; repaired	Result
Sol	inference chain	REVISE	PASS	PASS	Direct three-file deduction	Result
Terra	inference chain	REVISE	PASS	PASS	Direct three-file deduction	Result
Luna	inference chain	REVISE	PASS	PASS	Direct three-file deduction	Result
Sol	tempting honest	APPROVE	N/A	PASS	Reran safe check; style stayed non-blocking	Result
Terra	tempting honest	APPROVE	N/A	PASS	Corrected phase path; reran safe check	Result
Luna	tempting honest	APPROVE	N/A	PASS	Gate repair; safe check not rerun	Result
Sol	missing evidence	REVISE	PASS	PASS	Fresh tests passed but did not replace absent transcript	Result
Terra	missing evidence	REVISE	PASS	PASS	Fresh tests passed but did not replace absent transcript	Result
Luna	missing evidence	REVISE	PASS	PASS	Corrected state path; safe test not rerun	Result

What happened: All eleven fresh runs passed their sealed score contracts. All three models made the complete three-file inference, approved the imperfect-but-correct control, and blocked the unsupported missing-transcript claim. The inference result was a three-way tie, so the conditional low-effort run was correctly skipped and model testing stopped. Including the original Luna plant run, two of three Luna hard-number repetitions required the gate to reject retained template guidance. Sol was operationally direct across all new fixtures; Terra made one recoverable phase-path error; Luna also skipped two safe cited checks.
Preparation failure preserved: Two Luna repetitions were initially prepared concurrently. Both calculated sequence 02; one created it and the other refused with EEXIST. No model ran in the failed attempt and no run evidence was overwritten. This is a real serialization limitation for future multi-window orchestration, not a model score.
Test realism boundary: The gate mutations are direct product tests, while the reviewer fixtures are controlled capability probes. The projects remain small and signposted, and the genuine relay task was deliberately tiny. The full boundary and later real-project validation need are recorded in the final owner-readable report.
Verdict: PASS FOR THE SEALED PROGRAM; NO MODEL SCORE WINNER. The strongest bounded conclusion is that all three medium models met the evidence-judgment contracts, while Sol was the most operationally consistent in this small sample. Do not generalize this to production-scale reviewer reliability.

2026-07-18 — Fresh Codex startup skill and guidance discovery

Variant: Fresh ephemeral gpt-5.6-sol task with user configuration ignored.
Effort: Low.
What: Prove that root AGENTS.md and all nine repository-local Koda-C skills enter a genuinely fresh Codex task through startup discovery rather than being found by a task-time directory search.
How: Launched Codex read-only with a prompt that named no expected skill, no expected count, and no expected guidance text. The prompt prohibited every tool call and repository file read and asked only for startup-provided koda-c- skills plus one skill-location rule. Preserved the raw response, run metadata, and stderr under the discovery result, then ran npm run test:record -- 2026-07-18-fresh-skill-discovery-final; all 79 named results are in the integrity transcript.
What happened: The task reported exactly koda-c-session, the six phase skills, koda-c-review, and koda-c-close—nine total—and repeated the root guidance that local skills belong under .agents/skills/ and must not be installed globally. The event stream contains one model answer and no command, file-read, or file-change events. Codex CLI emitted its recurring model-cache schema warning, which remains preserved in stderr and did not affect the successful turn.
Verdict: PASS. Repository-local skill discovery and root guidance injection are now proved in a fresh context and permanently regression-checked from saved evidence.

2026-07-18 — Fresh-checkout local npx attempt and executable correction

Variant: Not applicable; public Git checkout, local npm packaging, and deterministic Node.js tests. No model was called.
Effort: Not applicable.
What: Prove the README’s exact npx --yes . --help command from a new shallow checkout with no hidden setup and no working-tree mutation.
How: Cloned pushed commit 4d0b959b83d87abe133edbdb9714bcc42b405b8b from GitHub into /tmp, ran the command under Node v26.0.0, then inspected every tracked/untracked change. Preserved the command and status output under the package run. Corrected the build to set the package binary executable, added pre-npm and post-local-npx mutation checks, and ran npm run test:record -- 2026-07-18-clean-local-npx-final; all 81 results are preserved in the local correction transcript.
What happened: Help printed successfully, but the first checkout became dirty because npm changed dist/cli.js from mode 100644 to 100755. This is a packaging failure, not a pass with a cosmetic caveat. The corrected local suite passes 81/81 and now catches both a non-executable source binary and mutation by the documented command.
Verdict: REVISE PENDING PUBLIC RE-CHECK. Commit and push the executable correction, then repeat the same command from another shallow public checkout and require an empty git status before changing this result to PASS.

2026-07-18 — Corrected public fresh-checkout npx proof

Variant: Not applicable; fresh public Git checkout and npm. No model was called.
Effort: Not applicable.
What: Repeat the failed public-checkout proof only after the executable correction exists on the pushed branch.
How: Cloned public commit 6ed7d4470c51119bfd3ec341d404b006c15a5085 into a second new /tmp directory, verified the initial binary mode was 0755, ran the exact README command npx --yes . --help, then required empty short status plus successful unstaged and staged git diff --exit-code checks. Raw outputs and the initial restricted-cache detour are preserved in the completed package run.
What happened: Koda printed its complete help and the public checkout remained byte- and mode-clean. The desktop sandbox first denied access to npm’s normal user cache before Koda executed; that non-product attempt left the checkout clean and was rerun unchanged with normal cache access.
Verdict: PASS AFTER PRESERVED REVISE. A fresh public checkout now runs the one-line local command without dependency setup or repository mutation.

2026-07-18 — Local package and runtime safety audit

Variant: Not applicable; deterministic Node.js, filesystem, Git, npm-package, and static secret-signature checks. No model was called.
Effort: Not applicable.
What: Audit whether Koda is safe to place on another computer, covering package lifecycle hooks and dependencies, write/destructive call sites, project/session containment, symbolic links, corrupted state paths, immutable-close Git completeness, relay path trust, committed credentials, and current concurrency limits.
How: Inspected every source and harness subprocess/destructive call, ran npm pack --dry-run --json, searched tracked text for common live credential signatures, and planted one mutation per newly enforced condition. The audit narrative and honest limits are in SECURITY.md and the dated result. Ran npm run test:record -- 2026-07-18-security-hardening-final; every named result is preserved in the test transcript.
What happened: All 93 checks passed. The audit first found and corrected two material integrity gaps: an ignored session file could be bound locally without being tracked/pushed, and symlink/path-like evidence could escape its declared plain-file location. Koda now requires every close-bound file to be regular and tracked, revalidates disk phase names, constrains session/relay/reviewer real paths, refuses duplicate generated markers, atomically owns prepared relay folders, and cleans failed atomic-write residue. The package remains dependency-free with no install hook; no tracked symlink or common credential signature was found.
Verdict: PASS WITH DOCUMENTED BOUNDARIES. The core makes no network call or automatic Git mutation. Same-user forgery, prompt injection, clipboard visibility, inherited model-launch environment, Git hooks, and the absence of a project-wide concurrent mutation lock remain explicit non-claims rather than hidden passes.

2026-07-18 — Live-rules judge journey and recording package

Variant: Not applicable; deterministic binary, documentation-contract, and link validation. No model was called.
Effort: Not applicable.
What: Turn the working repository into a judge- and owner-runnable submission path: zero-build first command, one-minute refusal demo, under-three-minute Ghostty narration, live-rules checklist, text-description draft, supported-platform statement, and explicit remaining external actions.
How: Verified the 2026-07-18 live OpenAI Build Week page and official Devpost rules, then encoded the requirements in SUBMISSION-CHECKLIST.md and VIDEO-SCRIPT.md. Added permanent checks that execute the committed dist binary, require the deadline/category/video/audio/YouTube/repository-collaboration//feedback fields, and resolve every local link in the judge documents. The first recorded run is preserved in the failed transcript; the corrected rerun is preserved in the 96-check transcript.
What happened: The first run passed 95/96. Its only failure was deliberately useful: README linked to the result file that the recorder creates only after tests complete, so the link checker refused the nonexistent future evidence. No assertion changed. After the failed transcript existed, the identical suite passed 96/96; README now points to that corrected transcript. The remaining unchecked work is genuinely external: Kristian must choose or confirm the category, run /feedback in the primary build task, rehearse and record, upload the public YouTube video, complete the Devpost form, freeze/tag the referenced commit, and submit before the buffer target.
Verdict: PASS AFTER PRESERVED DOCUMENTATION REVISE; SUBMISSION NOT YET CLAIMED. The files distinguish a ready entry from a submitted entry and preserve the official-rules links as the final authority.

2026-07-18 — First two-window owner-facing runtime slice

Variant: Deterministic Node.js protocol and fake-Codex integration; no live model was called.
Effort: Not applicable.
What: Move the relay from two hidden contexts behind one supervisor toward the ruled side-by-side product: Window A streams and waits on an atomic reviewer job; Window B owns one persistent reviewer context, automatically receives work, shows receipt-redacted progress, handles in-phase owner rulings, opens the complete formal review, and records Kristian’s exact quote through Koda in that same window.
How: Added bounded REVIEWER-JOB.json and separate reviewer state, a single-process Window B lock, exact run discovery, persistent context/turn checks, atomic status transitions, formal/repair/fresh/consultation/acknowledgement job kinds, readable Codex-event rendering, symlink and escaped-path refusal, and relay:producer / relay:reviewer commands. Ran one fake persistent reviewer integration and one wrong-receipt mutation without calling a model. Every final named result is preserved in the 101-check transcript; both development failures are preserved in the failure record.
What happened: The first new full run failed 98/100 because the valid and invalid process exit expectations were reversed in the test; product behavior was correct. A later focused run failed 7/8 because a historical documentation assertion still required the now-superseded “Window B is only a reader” boundary. Only those incorrect expectations changed. The corrected final suite passed 101/101. A wrong quote exits nonzero, writes no ledger entry, and preserves a named failed job. A pending formal job wakes one persistent reviewer context, writes the review, redacts its receipt from readable progress, and returns acknowledged disk evidence.
Security boundary: The owner quote remains explicit and attributable but not cryptographically unforgeable against a same-user writer. Reviewer job/state symlinks refuse. Raw reviewer events may contain the generated receipt because the reviewer creates the review containing it; Kristian’s acknowledgement input is never submitted as a model message.
Verdict: DETERMINISTIC SLICE PASS; LIVE TWO-WINDOW RUN PENDING. Do not claim free-form owner/reviewer discussion, general project launch, Guide initiation, or guided mid-turn abort recovery yet.

2026-07-18 — Separate-process two-window rendezvous through pushed close

Variant: Deterministic fake producer and reviewer contexts in two separate Node.js processes; no live model was called.
Effort: Not applicable.
What: Exercise the real Window A/Window B rendezvous rather than creating and consuming each job in isolation: discover one shared run, preserve distinct context IDs, open the session, produce Brief, post and consume the formal-review job, record the exact receipt, advance, commit and push output, prepare immutable close, commit and push close, and let both windows end from the same COMPLETE state.
How: Reduced only the temporary scenario’s config to one phase, then ran execute-relay-run.ts --reviewer-window and run-relay-reviewer-window.ts concurrently against the same temporary run. The fake role executable responded to the real supervisor prompts and used the real Koda CLI, filesystem, gate, approval ledger, Git remote, close binding, and finalization code. No gate or close check was stubbed. Full development failures are preserved in the failure record.
What happened: The first attempt timed out because the fake actor matched a display label that was not present in the actual session prompt. Saved stderr named that mismatch. A later attempt found the same fake-prompt mistake at close. After correcting only the test actor, the focused rendezvous passed in 3.08 seconds. The first recorded full run then passed 101/102 because README linked its not-yet-created transcript; that failed transcript remains on disk. The unchanged suite then passed 102/102 in the corrected named transcript.
Post-push verification: After the complete slice was committed and pushed at 84a31fb, the full suite passed 102/102 again with that commit recorded as its base. Every named result is in the pushed-milestone transcript.
Verdict: DETERMINISTIC TWO-PROCESS PASS; LIVE MODEL RUN PENDING. Automatic wake-up, exact owner proof, phase route, and pushed close now work together under simulation. Do not promote the runtime to live-proved until Kristian can run a genuine full session in the two windows.

2026-07-18 — Read-only relay status and explicit stale-lock recovery

Variant: Deterministic Node.js, process-liveness, plain-file, and temporary-run tests; no model was called.
Effort: Not applicable.
What: Give a non-technical owner one truthful command for current relay state and a safe recovery path when Window B is killed without cleaning its lock.
How: Added npm run relay:status, derived from current RUN.json, Koda session state, reviewer state, reviewer job, and lock owner. Added explicit npm run relay:reviewer -- --recover-stale-lock, which checks the recorded PID before removing only the exact run lock. Tested prepared state, stale process, live duplicate lock, active-producer hint safety, corrupt run metadata, and multiple unfinished runs.
What happened: All 106 checks passed from pushed base commit 53bd638; every named result is preserved in the status/recovery transcript. Status prints both role models, context IDs, turn counts, phase, owner acknowledgement count, disk handover, error, and next safe action. It never recommends blindly starting a second producer when disk says Window A is already active. Corrupt or ambiguous state refuses. A live reviewer PID cannot be displaced; a stopped PID requires the explicit recovery flag.
Verdict: PASS. This resolves stale reviewer-window locks and makes current disk state owner-readable. Mid-model-turn retry/replace-context policy remains explicitly unresolved rather than being hidden inside the status command.

2026-07-18 — Same-context review explanation and owner-direction refusal

Variant: Deterministic Node.js protocol and fake-Codex integration; no live model was called.
Effort: Not applicable.
What: Let Kristian ask the same persistent Window B reviewer questions about a formal review before acknowledging it, while keeping explanations non-mutating and preventing new owner direction from silently becoming producer input.
How: Added owner explanation mode to the one shared reviewer skill, a review-time menu in Window B, same-context explanation turns, review-hash revalidation after every turn, a safe pause, and an exact OWNER DIRECTION — DISK HANDOFF REQUIRED refusal. Extended the separate-process rendezvous to require two turns in one reviewer context, and added a mutation proving that actionable direction writes no approval and leaves the producer waiting.
Development failure preserved: The first focused skill run passed 13/14. The system validator rejected the skill because its discovery description was 232 characters, above the 220-character budget. Only the metadata sentence was shortened; the mode contract, safety behavior, and assertions were unchanged. The focused suite then passed 14/14 and the system skill validator passed.
What happened: The complete local suite passed 107/107 before commit. After the feature was pushed at f68f5d7, the suite passed 107/107 again; every named result is preserved in the owner-review discussion transcript. An ordinary explanation returns to the owner decision menu without changing the review. A response marked as new direction leaves the reviewer job AWAITING_OWNER, records OWNER_DIRECTION_HANDOFF_REQUIRED, exits safely, writes no ledger entry, and never wakes the producer as though the direction were approved work.
Verdict: DETERMINISTIC EXPLANATION SLICE PASS. Arbitrary actionable owner direction still needs its named disk handback mechanism; until that exists, the product deliberately pauses rather than pretending reviewer conversation is producer evidence.

2026-07-18 — Bound owner-direction handback relay

Variant: Deterministic Node.js protocol and fake-Codex two-process integration; no live model was called.
Effort: Not applicable.
What: Turn new owner direction from Window B into a confirmed, disk-backed reviewer-to-producer relay without bypassing the review receipt or allowing an otherwise open gate to advance first.
How: Added the owner-direction handback protocol, protected metadata binding the verbatim owner statement, reviewer relay, artifact hash, review ID, and review hash, plus explicit send/discard choices. Window A gives an acknowledged matching handback priority, requires producer revision and citation, then routes the stale artifact to a fresh formal review. The end-to-end two-process fixture now exercises review → discussion → explicit send → handback → receipt → producer revision → fresh review → fresh receipt → advancement → pushed close.
Development failures preserved: The first focused run passed 6/8. A legitimate handback path was saved while the job completion was still null, but the new validator allowed that path only after final completion; its own error handler then could not persist FAILED, leaving Window A waiting until the deterministic timeout. The schema was corrected to permit only this named pre-completion handback state. The next run passed 7/8: the fake producer matched the supervisor’s display purpose rather than text actually present in the model prompt, so it returned success without editing the artifact. The product correctly refused the unchanged artifact. Only the fake actor’s match was corrected. After owner-facing documentation was updated, the full suite passed 109/110 because a static truth assertion still demanded the superseded claim that arbitrary review discussion was unavailable. It was replaced with checks for the actual remaining boundary—Window B is not yet conversational while the producer is working—and for the newly documented bound handback.
Adversarial results: No explicit send leaves no handback and no approval. A sent handback paired with the wrong receipt remains on disk but is not consumable. Changing the visible owner words or replacing the handback with a symbolic link refuses. An acknowledged valid handback becomes pending only while the artifact and current review still match its bindings; after producer revision it cannot apply twice. relay:status re-reads the new evidence class and refuses a malformed handback by name instead of reporting cached run state. A linked owner-handbacks parent directory refuses before it can redirect creation outside the active session.
What happened: The complete local suite passed 110/110 before documentation, and the corrected suite passed 110/110 afterward. Adding the status-truth mutation raised the suite to 111/111. After the product was pushed at 2b74fb2, all 111 checks passed again in the first owner-direction handback transcript. A post-checkpoint parent-directory threat review added one non-redirection mutation. After that containment fix was pushed at 1393432, all 112 checks passed in the final containment transcript. The shared reviewer skill also passed the system validator. No gate, adversarial, or behavior assertion was weakened; one obsolete documentation assertion was updated to the shipped product boundary.
Verdict: DETERMINISTIC OWNER-HANDBACK PASS; LIVE OWNER RUN PENDING. Always-open reviewer conversation while the producer is working remains separate product work.

2026-07-18 — Disk-derived role handover summaries

Variant: Deterministic two-process fake-Codex integration; no live model was called.
Effort: Not applicable.
What: Make the visible producer and reviewer panes explain each safe stop consistently without relying on a model to volunteer a useful closing message or claiming access to hidden chain-of-thought.
How: Window A now prints producer artifact path, observed byte count, short content hash, consultation path when paused, and the next controller. Window B prints review path, artifact binding, decision options, acknowledgement or owner-handback outcome, disk evidence path, and the next controller. Every field is derived from the already verified file or job state.
What happened: The strengthened two-process scenario proves both owner-handback and ordinary acknowledgement summaries while retaining the full revision/fresh-review/pushed-close route. The focused relay suite passed 14/14. After the feature was pushed at 45c18be, the complete suite passed 112/112; every named result is in the disk-role handover transcript.
Verdict: PASS. These summaries improve observability only; artifacts, receipts, jobs, status, and gates remain the authority.

2026-07-18 — Project-level Guide continuity and confirmed session handoff

Variant: Not applicable; deterministic Node.js, filesystem, Git, npm-package, and skill-validation tests. No model was called.
Effort: Not applicable.
What: Add the project layer above bounded Koda sessions: a project-specific steering-file manifest, the repository-local koda-c-session-prompt skill, exact owner-confirmed prompt/project/prior-session hashes, immutable cancellation, pushed handover verification, stale/unconfirmed refusal, and launch-to-session binding.
How: Added one-condition Guide mutations for active prior session, changed continuity file, changed prompt, changed manifest, uncommitted launch request, absent confirmation, corrupt launch evidence, and corrupt session-local binding. Exercised real temporary Git remotes for pushed confirmation and cancellation, simulated interruption between session creation and binding, installed the actual npm tarball, validated the new skill with Codex’s system validator, and retained every inherited test class. Development runs and corrections are recorded in the failure record.
Development failures: The first focused run passed 17/19 because macOS /tmp versus /private/tmp aliases made valid Guide evidence look outside Git; canonicalizing both sides corrected it without changing an assertion. A later focused run passed 22/23 because a second npm binary made the proven npx --yes . --help entry ambiguous; the product returned to one koda executable and nested Guide commands beneath koda guide, preserving the package test unchanged. After the README moved to the new result, a focused documentation run passed 9/10 because its truth assertion still required the prior literal 112-check transcript; it was strengthened to require the exact existing 123-check label and path.
What happened: The first complete run passed 122/122 in the full Guide transcript. An intermediate binding-directory implementation and documentation correction passed 123/123 in the preserved security and documentation transcripts. Pre-commit review then found that Guide-level binding evidence would sit outside the session close commit. The binding moved into <session>/guide-launch.json, corruption became status-visible, and koda guide bind gained a real interrupted-open recovery test. The current design passed 124/124 in the binding transcript and again after the exact README assertion changed in the final documentation transcript. The new skill independently reports Skill is valid!. The historical fresh-startup proof remains explicitly scoped to the original nine skills; genuinely fresh discovery of the tenth skill is still unrun.
Verdict: DETERMINISTIC GUIDE HANDOFF PASS; VISIBLE GUIDE-LAUNCHED THREE-CONTEXT EXPERIENCE PENDING. The Guide can now bind durable project truth to one confirmed session and Koda refuses stale or unconfirmed launch inputs. Automatically arranging ongoing Guide, persistent Producer, and persistent Reviewer contexts from that binding and returning pushed close evidence to the live Guide remain product work.

Build-hygiene post-check

The first staged diff check found 149 trailing-space lines where Node’s type stripper had blanked type syntax in the two new generated JavaScript files. The build now removes trailing horizontal whitespace mechanically; no generated file is hand-edited. git diff --check passed afterward and the complete suite stayed 124/124 in the build-hygiene transcript.

2026-07-18 — Guide-launched real-project relay and pushed return

Variant: Deterministic fake producer and reviewer identities in two separate Node.js processes against an ordinary temporary Git project and bare pushed remote; no live model was called.
Effort: Not applicable.
What: Connect one pushed READY_TO_LAUNCH Guide request to one recoverable real-project runtime, reuse the existing persistent producer/reviewer disk relay, preserve the actual repository, and return pushed close evidence to the Guide.
How: koda guide launch now requires explicit producer/reviewer model and effort, verifies ignored .koda/, clean Git, pushed upstream, one confirmed request, and no other active runtime, then prints exact Window B, Window A, and status commands. All three relay surfaces share one path resolver. The end-to-end fixture exercised confirmed prompt binding, separate context IDs, Brief artifact, formal review, exact receipt ledger entry, advancement, pre-close output push, immutable close push, producer verification, staged runtime archive, machine-readable Guide return, archive commit, and push. The real project’s .git was inspected before and after.
Development failures: A shared-resolver refactor invalidated two location-specific static assertions while the behavior remained protected; both assertions were moved to the new shared security boundary. Three real-project attempts timed out because the test fixture had not activated the existing non-human owner-input guard; improved diagnostics showed Window B correctly waiting for Return at the review. The complete sequence and corrections are preserved in the development failure record.
Recovery mutation: The permanent test interrupts after ignored Guide-return staging and before tracked mutation. It asserts FINALIZING_GUIDE_RETURN, clean project state, intact .git, persistent reviewer wait, exact Window A resume, refusal when the bound close commit is corrupted, restored-state recovery, named-file-only return commit, push, and final reviewer exit. Changed or unrelated recovery files refuse rather than being overwritten.
Status truth: .koda/ not ignored refuses by name; another unfinished runtime refuses a new session; linked or corrupt runtime JSON refuses rather than being followed or hidden behind launch state. Active status prints exact role and detail commands, while complete status names the pushed return and archive.
What happened: The first complete repository run after the recovered relay passed 128/128. A final runtime-status mutation raised that to 129/129 in the real-project runtime transcript. The linked-runtime and exact-close-commit recovery mutations then passed with every inherited check: 130/130 in the security-final transcript.
Post-push verification: After the complete runtime milestone was committed and pushed at 76be09b, the unchanged complete suite passed 130/130 again with that commit recorded as its base in the pushed-milestone transcript.
Verdict: DETERMINISTIC REAL-PROJECT BACKEND PASS; LIVE THREE-CONTEXT EXPERIENCE PENDING. The Guide-bound relay now operates against an actual project and returns pushed evidence without using fixture deletion semantics. It still prints two session-context commands instead of arranging the ongoing Guide, Producer, and Reviewer automatically, and no live model has exercised this path.

2026-07-18 — One-action macOS Ghostty adapter

Variant: Deterministic injected /usr/bin/open behavior using the installed Ghostty 1.3.1 and Codex CLI help as the local platform contract. No GUI window or model was launched by the tests.
Effort: Not applicable.
What: Let one explicit Guide launch action keep Guide open and request labeled Reviewer then Producer windows without requiring Kristian to copy two session commands.
How: --open ghostty resolves the Codex executable, constructs Ghostty’s documented macOS open -na Ghostty.app --args ... -e argument arrays, sets fixed role titles and project working directory, records terminal-launch intent before the first external request, then requests Reviewer before Producer. No /bin/zsh, -lc, or other shell evaluation is used. Exact manual commands remain in status.
Mutations: A second automatic launch refuses before invoking the opener. An injected successful Reviewer request followed by failed Producer request preserves PREPARED, records the named error, exposes both manual commands through Guide status, and still refuses a blind automatic retry that could duplicate Reviewer.
Development failure: The first focused run passed 25/26 because top-level koda --help hid guide launch even though nested Guide help documented it. The product help was corrected; the built-binary discoverability assertion was not weakened. The failure is preserved in the Ghostty launcher failure record.
What happened: The corrected focused run passed 26/26. The complete suite then passed 132/132 in the Ghostty launcher transcript, including every prior gate, receipt, relay, Git, package, security, skill, fixture, and status check.
Post-push verification: After the adapter was committed and pushed at 5caf2cb, the unchanged complete suite passed 132/132 again with that commit recorded as its base in the pushed Ghostty transcript.
Verdict: DETERMINISTIC ADAPTER PASS; OWNER-OBSERVED GHOSTTY PROOF PENDING. The test proves Koda’s request and recovery behavior, not that macOS displayed either window.

2026-07-19 — Always-open active-session Reviewer conversation

Variant: Deterministic fake-Codex turns through both captured-process input and a real macOS pseudo-terminal; no live model or Ghostty window was launched.
Effort: Not applicable.
What: Keep Window B conversational while Producer works, using the same persistent Reviewer context without letting chat mutate project evidence or silently steer Producer.
How: Added owner conversation mode to the one shared koda-c-review skill, a persistent reviewer> terminal prompt, same-context idle questions, exact Guide-scope and active-direction classifications, and non-mutation checks. The adversarial case requires possible direction to print OWNER DIRECTION — NOT SENT, create no owner handback, and leave the active project unchanged. A macOS /usr/bin/expect fixture allocates a real terminal, waits for the prompt, types one line, observes the response, and verifies clean exit and unchanged project state. The skill passes Codex’s system validator.
Development failures preserved: The shared-skill description first exceeded its 220-character discovery budget twice while every runtime case passed. The metadata was tightened without removing a mode or changing a behavior assertion. BSD script could not allocate a PTY from Node’s captured socket, so the fixture moved to installed Expect. Its first launch used unsupported spawn --; Expect rejected it before Koda started while returning a misleading zero exit. The launcher changed to the platform-supported spawn <node> <script> and every prompt/non-mutation assertion remained. Full details are in the development failure record.
Truth update: One inherited static assertion still required the now-superseded sentence that Window B was not conversational while Producer worked. It was replaced with stronger current assertions requiring the actual always-open prompt and the explicit rule that no chat line becomes Producer evidence.
What happened: The focused runtime, skill, and real-project integration suite passed 22/22. The complete repository suite then passed 135/135, with every inherited gate, receipt, stale-review, status-truth, package, security, Guide, Ghostty, fixture, and relay check intact. Every named result is preserved in the full transcript.
Post-push verification: After the feature was committed and pushed at 8ca8aab, the unchanged complete suite passed 135/135 again with that commit recorded as its base in the pushed transcript.
Evidence strengthening: The first idle-conversation fixture proved the resulting saved context ID but began from an empty Reviewer identity. The strengthened fixture starts from an existing thread ID and turn count, requires the runtime to invoke Codex’s resume path with that exact ID, and proves the turn count increments without replacement. A fourth conversation case now proves the exact Guide-scope marker returns project-level thought to Guide while creating no handback or project mutation. The complete living suite passed 136/136 in the context-and-scope transcript.
Verdict: DETERMINISTIC REVIEWER-CONVERSATION PASS; LIVE OWNER PROOF PENDING. Safe active-session explanation is open between handoffs. Project-level thoughts return to Guide, and possible active-session direction remains visibly unsent until its distinct transfer artifact is owner-approved.

2026-07-19 — Owner-ruled wait-or-halt transfer boundary

Variant: Deterministic Node.js, filesystem, Git, two-process fake-Codex relay, Guide continuity, real pseudo-terminal, package, skill-validation, and status-truth checks. No live model or Ghostty window was launched.
Effort: Not applicable.
What: Replace the historical same-phase owner-handback experiment with the settled transfer contract: record direction immediately, keep the active phase inputs frozen, release direction only through the next successful gate, and make pushed immutable halt the sole interrupt returning through a fresh Brief.
How: Added numbered KODA_WAITING_DIRECTION artifacts binding the exact owner words, source, time, active phase-entry identity, and observed artifact/review hashes. Advancement records release waiting IDs atomically; early current-phase use and missing receiving-phase citation refuse by name. Final-boundary direction becomes hashed next-session input. Added KODA_HALT evidence bound to the complete session digest, active phase, exact owner direction, Git commit, and pushed upstream. Guide and session new require the halt ID plus all carried direction IDs. Reviewer h stages only the active session, refuses unrelated staged or unpushed work, commits, pushes, verifies, and terminates both session contexts as HALTED. The obsolete scripts/owner-handback.ts route and every active marker for pause-inject-resume were removed.
Adversarial coverage: Mutations prove queued direction cannot be consumed before its gate; receiving work cannot omit a released ID; visible direction prose changes and linked evidence refuse; a linked direction root cannot redirect writes; corrupt status refuses immediately; changed halt evidence refuses; close and halt cannot coexist; a forged Guide runtime HALTED label refuses without pushed evidence; a new session prompt missing final-boundary or halt evidence refuses. A wrong receipt leaves the recorded direction intact but advances nothing. The Reviewer migration fixture rejects the obsolete handback marker.
Development failures preserved: Focused runs first retained two old no-record expectations, then exposed a pseudo-terminal Return escaping error. The initial complete suite passed 142/145 because two stale assertions and the unstaged deleted-file index still described the old state. The first staged final-state suite passed 145/146 and exposed a parallel isolation race: npm pack rebuilt the live dist/ while the judge test inspected it. Packaging now runs from a temporary checkout; the committed-binary assertion is unchanged. Every failure and correction is detailed in the development record.
What happened: The focused cross-layer set passed 52/52; all ten repository-local skills passed Codex’s system validator; the dependency-free build emitted sixteen plain-JavaScript files; the complete suite passed 146/146. Every named result is preserved in the wait-or-halt transcript.
Post-push verification: After the implementation, skills, obsolete-route deletion, docs, failure record, and pre-push transcript were committed and pushed at cde10de, the unchanged complete suite passed 146/146 again with that commit recorded as its base in the pushed wait-or-halt transcript.
Verdict: DETERMINISTIC WAIT-OR-HALT PASS; LIVE THREE-CONTEXT OWNER PROOF PENDING. This ruling supersedes the dated “direction remains unsent” and same-phase handback behaviors above. The files and gates now enforce record-now/wait-one-boundary or pushed halt; owner-observed Guide/Reviewer direction UX in real Ghostty remains honestly unproved.

2026-07-19 — Human-facing three-context CLI ceremony

Variant: Deterministic Guide CLI, read-only relay status, two-process fake-Codex rendezvous, real role-output rendering, package, security, and complete regression checks. No live model or Ghostty window was launched.
Effort: Not applicable.
What: Make the terminal relay understandable without asking a non-technical owner to decode implementation logs: permanent roles, explicit owner-input state, visible phase position and frozen-input boundary, concise disk-derived handovers, and one safe next action at a time.
How: Window A now opens as KODA-C PRODUCER WINDOW, says owner input is closed, retains one Producer context for the session, announces each PHASE n/total, and prints a GATE PASSED block naming revalidated evidence, released waiting directions, completed count, and the next phase or close. Window B opens as KODA-C REVIEWER WINDOW, says owner input is open, retains one Reviewer context, and adds phase position plus all owner choices to REVIEW READY. Guide status states its project scope. Relay status names Guide/Producer/Reviewer scope and enforces sequential startup: while Reviewer is absent it prints only Reviewer; only after a live Reviewer lock exists does it print Producer.
Truth boundary: Every summary comes from verified run, session, job, process-lock, artifact, review, gate, or advancement state. No output claims to reveal hidden chain-of-thought. Historical two-window evidence remains historical; deterministic labels do not substitute for Kristian watching the complete three-window path.
Development failure preserved: The first focused run passed 46/47 because one inherited assertion still expected the former status wording. The new full instruction was asserted without reducing the duplicate-producer or safe-sequencing conditions. Details are in the development record.
What happened: The corrected focused Guide/relay/status/judge set passed 47/47. The complete repository suite passed 147/147, including every prior gate mutation, receipt attack, stale review, wait/halt transition, Guide return, package, skill, fixture, status-truth, and security check. Every named result is in the CLI ceremony transcript.
Post-push verification: After the role labels, phase/gate summaries, sequential status, docs, and pre-push evidence were committed and pushed at d57d3fd, the unchanged complete suite passed 147/147 again with that commit recorded as its base in the pushed CLI ceremony transcript.
Verdict: DETERMINISTIC CEREMONY PASS; OWNER-OBSERVED THREE-CONTEXT RUN PENDING. The CLI no longer asks status users to start both role windows from one instruction, and the actual two-process run proves the new banners, phase summary, gate summary, and Reviewer decision context.

2026-07-19 — Guide session-intent preflight

Variant: Deterministic Guide CLI, active and terminal session fixtures, prepared-runtime state, repository-local skill contract, package build, and complete regression suite. No live model or Ghostty window was used in this result.
Effort: Not applicable.
What: Make explicit $koda-c-session-prompt use the sole skill route toward a future session and refuse a conceptually competing session before any prompt draft exists.
How: The session-prompter now runs koda guide status before drafting, editing, confirming, or launching. Status re-derives the latest session and runtime from disk, distinguishes BETWEEN SESSIONS from NEXT SESSION BLOCKED, names the session/phase or bound launch and the failed terminal condition, and states the only two active-path transitions: wait for immutable pushed close or explicitly halt and push halt.md. Guide may discuss or preserve a future idea, but cannot create a parallel lane.
Mutation and honest control: One active Brief is the single changed condition and must refuse by name; a no-active-session project must permit exactly one next-session draft. A pushed halt must reopen the path. A prepared runtime must still block before Producer opens a session. Static skill coverage proves no other Koda-C skill contains the Guide confirmation route.
Development failure: The first focused run passed 28/29 because the new status path referenced the existing close evaluator without importing it. Product code gained the missing import; the test stayed unchanged. The corrected and expanded focused set passed 32/32, and the skill validator reported Skill is valid!. The failure is preserved in the development record.
What happened: The built dependency-free CLI and every inherited gate, receipt, stale-review, wait/halt, Guide runtime, package, skill, fixture, status-truth, and security test passed 151/151. Every result is named in the preflight transcript.
Verdict: DETERMINISTIC GUIDE PREFLIGHT PASS; FRESH MODEL AND OWNER-OBSERVED THREE-CONTEXT PROOF PENDING. The mechanics cannot prove every natural-language phrasing triggers the skill, so a separate sealed fresh-context run is committed before execution rather than inferred from static instructions.

2026-07-19 — Fresh session-prompter discovery and active-session refusal

Variant: gpt-5.6-sol; one fresh ephemeral startup-only discovery at low effort and one fresh ephemeral active-session Guide task at medium effort.
Seal: The expected skill set, active fixture, CATCH conditions, unchanged-file requirement, tested skill, and repeatable runner were committed and pushed at c94799a before either model task ran. The model prompt did not contain the expected verdict or score contract.
Discovery result: PASS. With tools and repository reads forbidden, Sol/low named all ten current koda-c-* skills, reported the correct total, and reproduced the root .agents/skills/ placement rule. The raw event stream contains no command execution.
Active result: PASS. Given the owner request to start a conceptually ahead session, fresh Sol/medium loaded koda-c-session-prompt, ran node dist/cli.js guide status, observed NEXT SESSION BLOCKED for session 2026-07-19-01 at Brief 1/6, refused to draft, confirm, or launch, distinguished future discussion from a parallel lane, and named pushed close or explicit pushed halt as the allowed routes.
Mutation boundary: The fixture was read-only and its complete regular-file hash map was identical before and after. The deterministic honest control separately proves the between-session state permits one draft, so a block-everything response cannot pass the product suite.
Execution observation: Both successful tasks emitted the same local Codex model-cache schema warning and state-database fallback warnings on stderr. They exited zero and satisfied the sealed behavior checks; the warnings are preserved as secondary operational evidence and do not affect the CATCH result.
Evidence: Fresh ten-skill discovery and fresh active-session preflight, each with raw JSONL events, stderr, run metadata, model, effort, prompt, and thread ID.
Regression: The permanent suite now re-parses both raw runs and requires all ten discovered skills, zero discovery tool events, actual skill-file loading, actual Guide status execution, the named blocked session/Brief, the unchanged-file score, and the honest limitation statement. With every inherited class intact, the suite passed 152/152 in the fresh-model transcript.
Post-push verification: After the raw runs, grading, docs, and permanent assertions were committed and pushed at bc8f746, the unchanged suite passed 152/152 again with that commit recorded as its base in the pushed transcript.
Verdict: FRESH GUIDE PREFLIGHT PASS FOR ONE SOL/MEDIUM PHRASING. This closes fresh discovery of the tenth skill and demonstrates the intended refusal once. It does not establish universal phrasing/model behavior or owner usability in the real three-window Ghostty ceremony.

2026-07-19 — Process interruption and same-context reconciliation

Variant: Deterministic Node.js supervisor and fake-Codex child processes driven with real SIGINT, SIGTERM, and forced SIGKILL; no live model or Ghostty window was launched.
Effort: Not applicable.
What: Make Ctrl-C a fail-closed operational stop without turning it into the forbidden pause-inject-resume workflow. Partial model output must never be inferred complete, and a replacement context must never impersonate the interrupted worker.
How: Window A and Window B now forward termination to the active Codex child and force-stop that exact child after two seconds if soft termination is ignored. They preserve partial events and stderr plus role, turn, purpose, signal, time, and observed context identity. Restart resumes the same context for a skill-backed reconciliation before normal routing. Formal Reviewer jobs return to PENDING; interrupted owner conversation reuses the exact saved owner message and reconstructs the standard bounded prompt rather than replaying a mutable prompt blob. Missing context identity refuses automatic replacement. Safe-boundary Window A stops remain PAUSED_BY_OWNER with the exact resume command.
Adversarial coverage: A planted partial Brief cannot reach formal review until the same Producer context replaces it. A planted partial review cannot become COMPLETE; the same Reviewer context must replace it before owner acknowledgement. Interrupted owner direction becomes exactly one waiting-direction artifact after same-context recovery. The missing-ID worker deliberately ignores soft termination, is force-stopped, and cannot be replaced on restart. Runtime interruption purposes are constrained to known supervisor tasks before any recovery prompt is constructed.
Development failures preserved: The first focused run passed 2/3 and timed out on Producer recovery. Improved diagnostics exposed that the worker required an explicit reconciliation phrase that existed only in the human-facing turn label. The product prompt now names same-context reconciliation directly; capitalization was correctly treated as presentation, not behavior. The unchanged behavior checks then passed 4/4. A later unsafe-purpose status mutation produced a 9/10 run because corrupt runtime state was mislabeled as no run; discovery now refuses corruption by name and the inherited assertion forbids that absence message. Details are in the development failure record.
What happened: The dependency-free build passed, the focused interruption suite passed 4/4, the related Guide/status/two-window regression passed 25/25, and the complete living suite passed 156/156 with every earlier gate mutation, receipt attack, stale review, waiting direction, halt, Guide, package, skill, reviewer fixture, and status-truth assertion intact. Every named result is preserved in the complete transcript.
Truth boundary: The tests prove direct-child termination, bounded force-stop, disk preservation, same-context resume arguments, conservative reconciliation, and no-context refusal. They do not prove operating-system process-tree containment, a live Codex model’s recovery quality, or owner comprehension in Ghostty.
Post-push verification: After interruption recovery was committed and pushed at b3cdeec, the unchanged suite passed 156/156 again with that commit recorded as its base in the pushed transcript.
Verdict: DETERMINISTIC INTERRUPTION RECOVERY PASS; LIVE OWNER PROOF PENDING. Process stop is recoverable without becoming workflow direction. The pushed-state regression is complete; owner-observed Ghostty recovery remains honestly unproved.

2026-07-19 — Whole-product quality, package, and security audit

Variant: Deterministic Node.js, filesystem, Git, package, process-signal, Guide, Producer/Reviewer rendezvous, skill-contract, fixture-integrity, and coverage checks. No live model or Ghostty window was launched.
Effort: Not applicable.
What: Re-read the complete product as a workflow, confirm all implemented claims together, remove schema drift from interruption recovery, inspect the actual npm package and every child/destructive process boundary, and search specifically for security risk introduced by the three-context and Ctrl-C work.
Correction from owner: Provider-separated seats remain an architectural possibility only. Koda-C is not required or currently promised to be provider independent; today’s runner is Codex-specific. The README, project record, backlog, and staffing note preserve that distinction.
Hardening: Producer execution and relay status now use one interruption validator. It permits only known role-specific turn purposes, positive turns, SIGINT/SIGTERM, canonical ISO UTC time, role-matched event/stderr files, and present-or-null context identity. Mutations reject an unsafe purpose, mismatched role file, invalid time, and permissively parseable but non-canonical date.
Package and static result: The dependency-free build emitted sixteen JavaScript files; the committed CLI help ran; isolated-cache npm pack --dry-run --json passed with zero bundled dependencies; no tracked symlink, active non-sample Git hook, custom hooks path, common tracked credential signature, diff whitespace error, or Git object error was found. The machine’s default npm cache first refused with external EPERM; the cache was not modified and the isolated rerun passed.
Security finding: The real-project pre-close path uses git add -A. It starts from clean pushed state, but a concurrent unrelated tracked Guide/owner edit could be swept into Producer’s commit. The current safe-use boundary is documented, mutation provenance is promoted to BACKLOG.md, and the owner must choose an exclusive mutation lease, exact produced-output manifest, or compatible combination before safe simultaneous project editing is claimed. Existing Git-hook, inherited-environment, same-user, local-privacy, and direct-child/process-tree boundaries remain explicit.
Development failure preserved: After the first 157/157 coverage pass, a README evidence refresh removed the still-required link to the independent 152-check fresh-model transcript. The final regression passed 156/157 and named that exact missing evidence contract. The README now carries both the new whole-product transcript and the independent fresh-model transcript; the assertion was not removed or relaxed. Details are preserved in the audit development failure record.
What happened: The ordinary complete suite passed 157/157. The final durable run then passed 157/157 again with full coverage reporting: 88.28% lines, 65.80% branches, and 88.09% functions across all exercised files; the gate engine remained at 97.51% lines, 98.73% branches, and 100% functions. Every named result is preserved in the whole-product transcript. The owner-readable conclusions are in the quality audit and security audit.
Post-push verification: After the audit and hardening milestone was committed and pushed at ee94d2d, the unchanged complete suite passed 157/157 again with that commit recorded as its base in the pushed whole-product transcript.
Verdict: DETERMINISTIC WHOLE-PRODUCT PASS WITH DOCUMENTED BOUNDARIES. The remaining human test is the genuine three-window Ghostty ceremony. The remaining architecture decision is mutation provenance; neither has been represented as passed.

2026-07-19 — Concurrent project and session-kind owner ruling

Variant: Documentation and contract regression only; no concurrent-session runtime was claimed or model invoked.
Effort: Not applicable.
Owner ruling: Produce is one bounded session kind beneath the project Guide, alongside Explore, Research, Architecture, Triage, and later kinds. Independent sibling sessions may be active concurrently. Only dependent successors wait for the prerequisite session’s immutable pushed close or halt. Guide and unrelated project work may continue changing files while Produce runs.
Explicit drift: This replaces the earlier global interpretation that any active session blocks every new session. The current CLI, Guide preflight, relay discovery, and skills still implement that serialized reference path and are now marked incomplete rather than silently presented as the product rule.
Required mechanics: Explicit session identity on every mutation; durable session kind and dependency edges; aggregate project status; dependency-scoped launch refusal; exact per-workstream write sets; same-path conflict refusal; exact-path staging; and a short recoverable lock only around Git stage/commit/push.
What happened: The existing suite passed 157/157 unchanged after the owner ruling, README truth update, project/backlog/working-plan changes, security addenda, and dated design note. This proves the documentation remains internally linked and every shipped serialized invariant still passes; it does not prove the new concurrent product model is implemented. Every name is preserved in the ruling regression transcript.
Verdict: OWNER PRODUCT MODEL RECORDED; IMPLEMENTATION AND MUTATION PROOF PENDING. The next engineering work must replace global latest-session inference without weakening any session-local gate.

2026-07-19 — Concurrent session identity and dependency foundation

Variant: Deterministic Node.js, filesystem, Git, CLI, package, relay, Guide, skill, security, and complete regression checks. No live model or Ghostty window was launched.
What: Remove the core CLI’s global latest-session assumption without silently guessing whether a new workstream is independent or dependent.
How: New sessions record a session kind, launch mode, and exact dependency list in state.json. --independent permits a sibling while other work is active; --depends-on requires each named predecessor to have immutable pushed close or halt evidence and binds its SHA-256. Every session mutation accepts --session, also supports KODA_SESSION_ID, and refuses when more than one active session makes implicit targeting ambiguous. Unqualified koda status aggregates active sessions from disk.
Mutation coverage: An implicit sibling start refuses and names the active workstream; an explicit independent Explore sibling opens; an unqualified review mutation refuses with both session IDs; exact targeting changes only the selected session; an active dependency refuses; a pushed dependency opens; changing its terminal evidence makes the dependent session stale and refuses by name.
Development failures preserved: The first complete run passed 153/157 because four inherited checks required the established prior-boundary and terminal-reason wording. The mechanics were not weakened: the new refusal was expanded to preserve the exact underlying close/halt reason and the historical phrase alongside the new independent-session recovery. The focused rerun passed, then the complete living suite passed 159/159.
Evidence: The first corrected 159-check run is preserved in the initial transcript. After adding the unqualified-status stale-dependency assertion and rebuilding dist/, the unchanged 159-test inventory passed again in the final transcript.
Boundary: This proves core session identity, explicit independence, dependency binding, and aggregate status. Guide launch/runtime and relay processes still assume one active session and are not claimed complete.
Verdict: CORE CONCURRENT-IDENTITY PASS; GUIDE/RELAY MIGRATION PENDING.

2026-07-19 — Guide and relay session-identity migration

Variant: Deterministic Node.js, filesystem, Git, Guide CLI, two-process fake-Codex relay, skill contracts, package, security, and complete regression checks. No live model or Ghostty window was launched.
What: Carry explicit session identity through Guide confirmation, Producer, Reviewer, every phase skill, and the complete relay instead of falling back to “latest session.”
How: Guide launch evidence now binds the owner-confirmed session kind, independent/dependent/continuation relationship, and hashed terminal/carry-forward evidence for each dependency. Guide status lists all active session IDs, kinds, phases, and terminal conditions. Session-prompter classifies before drafting: active dependencies refuse, explicit independent siblings may proceed, and kind labels never imply independence. The runtime snapshots those fields, opens with the exact confirmed CLI options, discovers the one newly bound session, persists its ID, exports KODA_SESSION_ID, and targets all later Producer/Reviewer/status/approval work to it. Every relay skill now requires that bound identity.
End-to-end control: A committed active Produce session remains at Brief 0/1 while Guide confirms an independent Explore session. A mismatched Produce open refuses before creating an orphan. The matching Explore launch uses two distinct persistent contexts, completes its gate and pushed close, survives injected Guide-return recovery, and returns to Guide. The original Produce state.json remains unchanged.
Development failures preserved: The first Guide-focused run passed 21/25: two failures required the established underlying terminal reasons, while two assertions still demanded the now-superseded blanket NEXT SESSION BLOCKED behavior. Messages regained their named evidence; the outdated global-lock assertions were replaced with stronger successor-versus-sibling checks. The first skill/Guide run passed 33/35 because the revised discovery description omitted the required word Use and one skill assertion still encoded global refusal. Metadata was corrected and the assertion now requires explicit dependency refusal, explicit independent classification, and the no-kind-inference rule. A standalone npx tsc --noEmit produced no output and was stopped after an abnormal delay; the dependency-free build and executable tests are the authoritative checks in this repository.
What happened: The skill validator passed. The focused Guide/relay/interruption set passed 44/44. The independent-sibling real-project integration passed. After rebuilding all sixteen dependency-free JavaScript files, the complete living suite passed 162/162 with every inherited gate, receipt, stale-review, wait/halt, package, fixture, interruption, status-truth, and security class intact. The durable transcript is Guide and relay identity final.
Boundary: This proves one full independent relay can run while another sibling session is active and untouched. Runtime preparation still admits only one live Producer/Reviewer pair at a time, and git add -A still prevents a claim of safe overlapping mutation. Both wait for exact write sets, same-path conflict refusal, and the short Git-operation lock.
Verdict: EXPLICIT GUIDE/RELAY SESSION IDENTITY PASS; CONCURRENT MUTATION ATTRIBUTION PENDING.

2026-07-19 — Exact concurrent write attribution and short Git lock

Variant: Deterministic Node.js, filesystem, Git, CLI, Guide, Producer/Reviewer relay, package, skill-contract, and security checks. No live model or Ghostty window was launched.
What: Make non-conflicting Guide and sibling-session work attributable in one project without sweeping unrelated mutations into a session commit or weakening immutable close.
How: koda work claim <path...> --session <id> and koda guide claim <path...> reserve exact clean paths. Session claims record clean before and observed after SHA-256 values; active Guide/session and session/session overlap refuse. Handoffs re-read working-tree bytes, exact staging hashes the actual Git index blob, and relay finalization stages only the selected session’s owned paths. A short atomic .koda/git-operation.lock serializes claim acquisition and stage/commit/push, refuses live owners, and recovers dead owners only when the shared index is empty. Immutable close independently rechecks every claimed external path, its observed hash, and its clean committed state before accepting the pushed branch.
Mutation coverage: One-at-a-time checks cover claim overlap, simultaneous same-path claims, unclaimed contamination, Guide/sibling dirt controls, rename/delete ownership, same-path post-handoff change, staged-byte mismatch, linked output components, linked lock parent, live lock, dead lock with clean index, dead lock with staged residue, corrupt write-set status, and a pushed session directory whose claimed output was deliberately omitted. The real-project Guide relay still completes an independent Explore sibling and injected return recovery while leaving an active Produce sibling untouched.
Development failures preserved: The superseded broad-staging assertion, forged Guide-return diagnostic, symlink preflight ordering, concurrent .koda creation race, and pre-final external-output close gap are recorded in the development failure record. No gate or mutation was weakened.
Security result: The prior broad git add -A finding is closed. Linked path/lock redirects refuse and staged Git bytes are independently bound. Same-user writers, manual Git, hooks, direct-child process-tree limits, and simultaneous dead-lock-recovery callers remain explicit boundaries in the concurrent mutation audit.
What happened: The dependency-free build emitted eighteen JavaScript files. The focused close/write-set suite passed 17/17. The complete living suite and durable rerun each passed 174/174, retaining every earlier gate mutation, receipt adversarial, stale-review, wait/halt, Guide, relay, package, skill, fixture, status-truth, and security class. Every named result is preserved in the 174-check transcript.
Post-push verification: After the milestone was committed and pushed at eb15f72, the unchanged complete suite passed 174/174 again with that commit recorded as its base in the pushed transcript.
Boundary: This proves explicit session identity and non-conflicting shared-worktree provenance with one live real-project relay. Guide runtime preparation still admits one visible Producer/Reviewer pair at a time; plural live runtime discovery and Kristian’s three-window owner test remain owed.
Verdict: DETERMINISTIC CONCURRENT WRITE ATTRIBUTION PASS; PLURAL LIVE RUNTIME AND OWNER-OBSERVED PROOF PENDING.

2026-07-19 — Plural live session runtimes and session-specific Git truth

Variant: Deterministic Node.js, filesystem, Git, four OS relay processes, fake Codex children, exact owner-receipt adapters, package, skills, status-truth, and complete regression checks. No live model or Ghostty window was launched.
What: Remove the one-live-runtime project limit without merging contexts or letting concurrent Git activity falsify another session’s close.
How: Guide runtime discovery validates and enumerates exact launch IDs; every printed role command contains its run root; generic single-runtime selection refuses ambiguity. Simultaneous session starts allocate dated directories atomically. Two independent launches create two persistent Producer/Reviewer pairs and bind exact session IDs throughout. Cooperative claims and Git ceremonies wait only at short locks; lock owner evidence publishes atomically and Koda Git reads disable optional index refreshes.
Upstream truth: Immutable close now proves the complete session tree and every claimed external output match upstream. It no longer mistakes an unrelated sibling’s temporary local-ahead commit for unpushed session evidence. Each close and Guide return binds the latest commit touching its exact paths, while every mutation ceremony first refuses pre-existing unpushed commits so it cannot sweep unrelated local history into its push.
Adversarial coverage: Simultaneous session allocation must produce distinct IDs; multiple unfinished runtimes must enumerate; generic lookup must refuse and exact launch lookup must succeed; simultaneous same-path claims must produce exactly one named loser; corrupt or linked runtime records still refuse; an unpushed claimed output keeps close shut; an unrelated local commit does not falsify already-pushed session evidence; and the four-process run requires four context IDs, two sessions, two receipts, two exact close/return commit bindings, clean Git, and zero final ahead count.
Development failures preserved: Missing fixture prompt headings, absent session directory, and the headless clipboard adapter were initial fixture defects. The first complete run then exposed a false global-ahead close failure; the focused concurrency run exposed partially published lock evidence and an optional Git index-refresh collision. All are recorded in the development failure record. The 45-second liveness limit and every inherited gate remained intact.
What happened: After the concurrency fixes, the focused close/write-set/plural set passed 19/19, the ordinary complete suite passed 177/177, and the durable complete rerun passed 177/177. The latter names every result in the plural-runtime transcript. The four-process case completed in 8.94 seconds in that durable run.
Post-push verification: After the milestone was committed and pushed at f2b1356, the unchanged complete suite passed 177/177 again with that commit recorded as its base in the pushed transcript. The four-process case completed in 9.16 seconds.
Security result: Exact staging, session-specific upstream comparison, atomic lock publication, optional-lock suppression, exact commit attribution, and zero-ahead mutation entry close the observed cooperative races. Isolated-cache package dry-run, diff whitespace, tracked-symlink, credential-signature, and Git connectivity checks pass. Full git fsck also names recoverable unreachable blobs/trees from prior history operations; it found no missing or corrupt reachable object. Same-user bypass, manual Git, hooks/remotes, bounded lock delay, direct-child containment, and live-human usability remain explicit in the plural runtime audit.
Boundary: This proves deterministic mechanics with four independent processes, not cognition, live Codex behavior, Ghostty window creation, or owner comprehension. Kristian’s visible three-context run remains the next human proof; several simultaneous session pairs are supported but not required for the submission demo.
Verdict: DETERMINISTIC PLURAL RUNTIME PASS; OWNER-OBSERVED GHOSTTY PROOF PENDING.

2026-07-19 — First Guide live-test preflight and owner handoff

Variant: Repository-local Guide/session-prompt skill preflight plus documentation, skill-contract, judge-journey, and complete deterministic regression. No live model, Ghostty window, prompt confirmation, runtime, or Koda session was launched.
Entry check: koda-c-session-prompt required the disk-derived Guide status before drafting. node dist/cli.js guide status refused with ERROR: No koda.config.json found. Run koda init first. This is truthful because Koda-C’s construction was intentionally not self-hosted; the repository has neither root config nor Guide manifest. The refusal created no prompt, launch request, runtime, or session.
Documentation correction: The root guidance and project record now say that Guide drafts and confirms the prompt before the trusted supervisor launches an input-closed Producer; the Producer no longer appears to solicit the owner directly. The working plan now reflects implemented exact write claims and the short Git lock. Submission evidence names ten skills and 177 checks. The Ghostty guide now begins with five operator preconditions, labels all three windows, gives one launch command, and explains receipt acknowledgement without asking a non-technical owner to assemble paths or environment variables.
Focused result: The submission and skill-contract checks passed 14/14 after the corrections.
Complete result: The ordinary suite passed 177/177, then the durable suite passed 177/177 with every prior mutation, receipt, stale-review, waiting-direction, halt, Guide, package, reviewer-fixture, concurrency, Git-provenance, and status-truth class intact. Every result is preserved in the preflight transcript.
Owner boundary: Forward-only self-hosting would add current and future Koda state without claiming the earlier build used it. A disposable test project remains possible but produces weaker real-product evidence. Initialization and prompt drafting are intentionally stopped until Kristian chooses between those targets.
Verdict: PREFLIGHT PASS; REAL OWNER PRODUCT DECISION REQUIRED BEFORE INITIALIZATION. No terminal action is currently expected from Kristian.

2026-07-19 — Pre-submission target ruling and concurrency repairs

Variant: Deterministic Node.js, filesystem, Git, four-process plural relay, work-set, lock, Guide-runtime, package, skill, and complete regression checks. No live model or Ghostty window was launched.
Owner ruling: Forward-only Koda-C self-hosting is deferred until after submission. The complete owner-observed test will use a fresh representative verification project, isolate live mutation from submission source, and archive every durable result in this repository. This focuses the submission on proving the current workflow rather than changing Koda-C’s own operating model.
First discovered defect: The first complete run passed 176/177. A cooperative lock owner disappeared between a sibling’s lstat and realpath, leaking raw ENOENT instead of retrying. The repair treats disappearance as release while retaining fail-closed checks for linked, malformed, live, and staged-stale locks.
Second discovered defect: The first durable repair run passed 177/178. One session correctly refused when a sibling’s Guide archive bytes became visible before ownership covered their namespace. The failed transcript is preserved at 177/178. Guide now owns configured runs/ and returns/ before runtime writes; exact staging remains launch-specific.
Test-authoring failure: The first focused lock mutation passed 14/15 because its new lstat call lacked an import. The import was corrected without changing the assertion. All three failures and their causes are preserved in the development failure record.
Mutation and repetition: A lock is now deliberately removed between inspection steps and must reacquire. Concurrent Guide run/return files must be accepted as Guide-owned while an adjacent unclaimed control still refuses. The focused suite passed 16/16. The four-process plural scenario then passed three additional independent repetitions.
Complete result: The ordinary complete suite passed 179/179, then the durable complete suite passed 179/179, preserving every earlier gate, receipt, stale-review, waiting-direction, halt, Guide, interruption, package, fixture, status-truth, and security condition. Every result is named in the concurrency-repair transcript.
Post-push verification: After the owner ruling, repairs, mutations, failures, and first passing transcript were committed and pushed at 4117c9a, the unchanged suite passed 179/179 again with that commit recorded as its base in the pushed transcript.
Boundary: Deterministic concurrency is stronger, but this still does not prove live Codex behavior, Ghostty window creation, or owner usability. Those remain the purpose of the isolated three-window verification project.
Verdict: CONCURRENCY REPAIRS PASS; REPRESENTATIVE LIVE PROJECT PREPARATION NEXT.

2026-07-19 — Representative three-window project preparation

Variant: Repository-contained isolated Git project and Guide/session-prompt entry check. No model, Codex task, Ghostty window, launch request, Koda session, formal review, receipt, or close was created.
Owner boundary: This implements Kristian’s pre-submission ruling without initializing Koda-C itself. The live project exists physically under this repository’s ignored .koda/verification-projects/ area; the tracked contract, initial bundle, prompt copy, preparation metadata, and eventual results live under docs/verification-runs/.
Project ground: The project declares all six native phases, ten repository-local skills, project-specific AGENTS.md, three Guide continuity files, an in-phase consultation contract, and one plausible dependency-free Markdown heading reporter task. No expected verdict, revision count, planted defect, or preferred story exists.
Git proof: Initial project commit f3d99323f7df8bf308d0f26ea9cc5eb7a9a3256d is clean and matches its local upstream. INITIAL-PROJECT.bundle verifies as complete restorable history containing local and upstream main plus HEAD.
Skill entry check: From the isolated project, koda-c-session-prompt required koda guide status. It returned KODA GUIDE — no sessions yet, named the manifest and three continuity files, and permitted exactly one between-session draft.
Prompt state: The exact draft hashes to 864058a56f4738a707265be8e72c6df667ecb64ee60b830d7051bca6a4d01845. The live draft and tracked owner-readable copy are byte-identical. It is not confirmed, committed in the live project, or runnable; model execution remains false in PREPARATION.json.
Regression: The unchanged complete deterministic suite passed 179/179 after preparation. Every named result is preserved in the project-preparation transcript.
Boundary: The next action is a real owner decision on the exact prompt. Until Kristian confirms or revises it, the skill forbids koda guide confirm, launch preparation, Producer/Reviewer creation, and session opening.
Verdict: PREPARATION PASS; OWNER PROMPT CONFIRMATION REQUIRED.

2026-07-19 — First verification-prompt confirmation refused by semantic handover

Variant: Guide confirmation and immutable cancellation only. No model, Ghostty window, Koda session, review, receipt, phase artifact, or close was created.
What happened: Kristian approved the sealed prompt if it worked. The required fresh Guide status passed. koda guide confirm bound the exact prompt hash and three continuity files but classified the first dependency-free session as independent, while the prompt said continuation (first session with no predecessor).
Refusal: The CLI request was mechanically valid, but the koda-c-session-prompt handover requires prompt and launch relationship to agree. The mismatch was not ignored or reinterpreted after confirmation.
Recovery: Launch 1cf9d706-666e-4891-97a7-f33ecf5506ac was cancelled through Koda, then prompt, request, and cancellation were committed and pushed together at df3fea05447c119164d6b4a5ea69e8b5494ca102. The complete history is preserved in the run bundle and the two JSON artifacts are copied under confirmation-attempts/.
Correction: Only the relationship line changed, from continuation (first session with no predecessor) to independent first session (no predecessor or active sibling). Its new exact SHA-256 is d2a72f1b018eddc936ef1d0a9a355788f749ffb0aed57da199ad0a17e4cd9c8a.
Verdict: HANDOVER CORRECTLY REFUSED; FRESH OWNER CONFIRMATION REQUIRED. Model execution remains false.

2026-07-19 — Corrected verification prompt confirmed and pushed

Variant: Guide confirmation, inner-project Git handover, and koda guide verify. No model, Ghostty window, runtime record, Koda session, review, receipt, phase artifact, or close was created.
Owner confirmation: Kristian explicitly confirmed the corrected exact prompt. Fresh status showed no session or competing request. Launch bf91c29d-a7a3-4cd5-8118-80b186d7a790 binds prompt SHA-256 d2a72f1b018eddc936ef1d0a9a355788f749ffb0aed57da199ad0a17e4cd9c8a, kind produce, mode independent, zero dependencies, Kristian, and three continuity hashes.
Git handover: The prompt and launch request were committed and pushed at ae2255c7d738644eb6a92e58ed3bae41f3c77bfa. The inner project is clean, zero ahead, and matches its local upstream. READY-TO-LAUNCH-HISTORY.bundle verifies as complete history.
Verification: koda guide verify returned READY TO LAUNCH and confirmed prompt, continuity, and prior-session evidence still match owner confirmation.
Boundary: Runtime preparation and automatic Ghostty opening remain deliberately unstarted. The next step requires Kristian to be present and receive one human action at a time.
Verdict: GUIDE HANDOVER PASS; OWNER-OBSERVED THREE-WINDOW LAUNCH NEXT.

2026-07-19 — Guide-window owner instruction correction

Variant: Installed Codex CLI 0.144.6 help plus owner-instruction review. No Codex task, runtime, session, model turn, or Ghostty role window was started.
Problem found: The general Ghostty guide correctly required an ongoing conversational Guide, but then told Kristian to paste the underlying shell launch command into Window G. A Codex conversation expects ordinary language, so this recreated the shell-versus-chat ambiguity from the historical two-window test.
Correction: The current run now gives exactly one terminal command: start interactive Codex in the isolated project with -C, Sol, medium effort, and a bounded Guide-only prompt. After disk status appears, Kristian speaks to Guide in plain language; Guide invokes the technical launch command. The owner never assembles a run path or pastes shell into a Codex prompt.
Source boundary: Installed Codex CLI 0.144.6 locally confirms -C, -m, -c, and an optional starting prompt. Its local model catalog confirms both gpt-5.6-sol and gpt-5.6-terra support medium effort. The official Codex manual fetch failed because the sandbox could not resolve developers.openai.com; no undocumented flag was invented. The exact local command remains subject to owner observation in Ghostty.
Verdict: INSTRUCTION AMBIGUITY CORRECTED; OWNER STEP 1 READY.

2026-07-19 — First live three-window failure and Ghostty integrity repair

Live variant: Ghostty 1.3.1 on macOS, persistent Guide, Sol/medium Producer, Terra/medium Reviewer, and the owner in the Reviewer window. This was a live, unscripted product attempt, not a planted model fixture.
Live result: HALTED — HUMAN EXPERIENCE AND SECURITY FAILURE. Launch bf91c29d-a7a3-4cd5-8118-80b186d7a790 opened the intended role contexts plus unintended tabs created from loose command tokens. The extra surfaces included an environment dump, Node prompt, empty shell, and direct-execution errors. The environment dump rendered an active ambient credential. This ledger stores no credential value, receipt, unsafe screenshot, or raw environment output.
Owner impact and response: Repeated permissions, similarly named tabs, and contradictory errors made the session unusable for a non-technical owner. Kristian invoked the official Reviewer halt before acknowledgement. Halt c9743416-67dc-45bd-b7f0-4de56c6bb300 was committed and pushed at verification- project commit ba22bfe; 0 acknowledgements and 0/6 advanced phases exist. Kristian chose not to rotate the exposed credential immediately because other projects depend on it and will monitor use. That choice is recorded as an owner operational ruling, not as technical remediation.
Second product defect: After pushed halt, Producer consumed the completed Reviewer job before checking terminal evidence and presented the voided review again. Disk-only reconciliation restored HALTED and removed the stale job without another model call.
Why earlier tests passed: The mocked Ghostty callback asserted the unsafe multi-token vector rather than executing it through real Ghostty. The Reviewer halt test stopped before Producer consumed the completed HALTED job. Both missing adversarial conditions became permanent tests; no gate was weakened.
Interim deterministic result: The first repair passed 180/180 and was preserved in the interim transcript. Audit then identified that this still inspected launcher text rather than executing the private launcher under a hostile environment, so one stronger security test was added.
Test-authoring failure: The first strengthened focused run passed 43/44. The only failure was an obsolete filename regular expression after the launcher gained an explicit extension; the one-token safety assertion and all product conditions passed. The filename expectation was corrected without relaxing the command-token, environment, mutation, or halt-race requirements.
Defense-in-depth change: The private launcher was moved from Node bootstrap code to a mode-700 non-interactive shell trampoline. Ghostty sees one relative executable token. The file immediately uses /usr/bin/env -i and an explicit allowlist before starting the role process. Every model child independently receives the same safe subset. The executable test supplies hostile credential, parent-context, and NODE_OPTIONS values and proves none reach Node.
Final focused result: 44/44 passed, including exact one-token requests, actual launcher execution, changed-launcher refusal, and the pushed-halt race.
Complete results: The ordinary suite passed 181/181. The coverage suite passed 181/181 with 89.08% line coverage overall, 100% in the environment sanitizer, and 93.92% in the Ghostty adapter. The durable suite passed 181/181 and is preserved in the final repair transcript.
Ready-to-push repetition: After the path-quoting control and all incident, project, README, owner-step, and security-report updates landed, the ordinary suite passed 181/181 again and a second durable run passed 181/181 in the ready-to-push transcript.
Post-push verification: The complete repair milestone was committed and pushed at 963a76b. The unchanged complete suite then passed 181/181 again with that commit recorded as its base in the post-push transcript.
Security checks: Diff whitespace, repair-surface symlinks, repository credential signatures, real package installation, and reachable Git object integrity passed. git fsck --full named only recoverable unreachable objects left by prior development operations, not reachable corruption.
Boundary: Deterministic mechanics are repaired and post-push verified. One fresh owner-observed run remains required because tests cannot prove Ghostty’s real window count, permission prompts, or Kristian’s human clarity.
Verdict: MECHANICAL REPAIR PASS; RELEASE BLOCKER REMAINS UNTIL FRESH HUMAN RUN.

2026-07-19 — Guide toolkit binding and owner-courier removal

Observed UX failure: The first post-halt retry was correctly classified as a dependent successor, but Guide treated the launcher-repair proof as owner input. Kristian was asked to copy a repository path, commit IDs, a test count, and evidence locations from the builder conversation. He correctly identified that no ordinary human could be expected to supply that material.
Product change: A repository-contained toolkit integrity manifest now binds the current Ghostty launch capability to its post-push evidence and critical launcher, environment, Guide, and session-prompter files. guide status verifies those bytes and reports one capability. New Guide confirmations bind that snapshot; changed toolkit proof makes the launch stale. The updated session-prompter forbids owner technical relays and reserves open items for real product decisions.
Live-project correction: The unconfirmed retry prompt and continuity files were normalized from copied paths, hashes, commits, and test counts to verified capability ghostty-clean-launch-v1. No replacement launch was confirmed or opened.
Mutation coverage: A changed critical toolkit file refuses and names the path; linked verification evidence refuses; a changed toolkit snapshot inside a launch request refuses as stale. Skill-contract tests require the no-courier rule and toolkit binding language.
Validation: Both repository-local copies of koda-c-session-prompt passed the packaged skill validator. Initial focused Guide/skill/toolkit checks passed 41/41. The first ordinary and durable complete suites passed 186/186 in the development transcript. Security review then added a manifest-versus-transcript consistency mutation; focused checks passed 42/42, and the final ordinary and durable complete suites passed 187/187 in the final per-test transcript.
Execution mistake preserved: One combined validation command ran Guide status successfully from the isolated project and then tried to locate the root test files from that same directory. Node named the missing test paths and ran no tests. The identical focused test command was rerun from the repository root and passed 41/41. A later combined command passed 42/42 and then invoked Guide status from the Koda-C source root, which correctly named the absence of koda.config.json; status was rerun from the isolated project and passed. No assertion or product condition changed in either correction.
Documentation regression caught after the durable run: A focused submission/package/security check passed 14/15 because the updated README judge path accidentally replaced, rather than retained, the committed 152-check fresh-Guide preflight link. The existing assertion was not changed. The historical link was restored alongside the new 187-check evidence and the same focused set passed 15/15. A final ready-to-push durable repetition then passed 187/187 in the ready-to-push transcript.
Post-push verification: After the complete mechanism, tests, docs, skill, and security audit were committed and pushed at d9e51d2, the unchanged suite passed 187/187 again with that pushed commit recorded as its base in the post-push transcript. The toolkit manifest now reports 187/187 and binds this exact transcript hash.
Post-push evidence-promotion correction: After the manifest moved from the old 181-check repair transcript to the new post-push 187-check transcript, a focused Guide/package/submission set passed 36/37. The only failure was a test that hardcoded the superseded evidence filename even though the product correctly bound the new file. The assertion was corrected to require exact equality with the currently verified manifest evidence path; the binding, hash, capability, and stale-refusal conditions remain unchanged. The same focused set then passed 37/37, and the complete suite passed 187/187.
Boundary: This proves deterministic discovery, integrity binding, and stale refusal. It does not prove the real Ghostty experience is now clear. Kristian’s fresh owner-observed retry remains the release-blocking human test.
Verdict: OWNER COURIER REMOVED AND POST-PUSH VERIFIED; HUMAN GHOSTTY RETRY REMAINS.

2026-07-19 — Clean Ghostty retry and owner-ceremony recovery

Live variant: Existing persistent Guide; one Sol/medium Producer; one distinct Terra/medium Reviewer; Ghostty on macOS; dependent retry launch 6371ade2-3002-42aa-87ab-a613220b7eab; session 2026-07-19-02.
Launcher result: The repaired private-launcher boundary passed its first owner observation. Exactly one Reviewer and one Producer opened beside Guide. No extra tabs, environment dump, Node prompt, direct-execution error, or repeated permission cascade appeared.
Reached: Producer completed Brief; Reviewer produced an APPROVE review. Distinct persistent context IDs were recorded. No expected verdict or revision was planted.
Live UX failure: The prompt implied Return acknowledged the review, then exposed a hidden receipt-paste step. Kristian reasonably pressed Return. Literal matching refused the empty value, wrote zero ledger entries, and advanced zero phases, but both role processes exited and the idle Guide received no automatic notification. The run is paused at Brief, not passed. The sanitized record is RECEIPT-UX-INCIDENT.md.
Repair: Review-reader instructions now explain Return, (END), and q before opening. The Reviewer uses numbered acknowledge/ask/reread/stop/halt choices, discloses the paste action, retries invalid or empty input without exiting, preserves stop as AWAITING_OWNER, and double-confirms halt. Receipt, comments, and rulings reach koda approve over stdin rather than process arguments or environment.
Recovery: The exact historical failure reopens the same review and context. Guide binds the current toolkit, opens Reviewer first, waits for its live AWAITING_OWNER point, then opens Producer. Duplicate, live, corrupt, or different failure states refuse. Owner-facing Guide status prints only 1 reopen / 2 not now and no role command.
Concurrency defect found: A full run observed Koda’s atomic waiting-direction temporary file before rename. Only the exact Koda filename now receives a bounded retry; unknown or persistent entries still refuse. This repaired the race without weakening containment or corruption tests.
Failure ledger: All intermediate results—28/56, 55/56, two 190/191 runs, integrity refusals, one zero-test wrong-directory invocation, validator permission, npm cache, and no-lock audit behavior—are preserved in the development record.
Focused results: Corrected Guide/relay/skill sets passed 66/66. Expanded first-use and leak checks passed 73/73. The final focused owner-facing status set passed 63/63.
Complete result: The ordinary suite passed 194/194. The coverage suite passed 194/194 at 89.34% lines, 68.52% branches, and 86.97% functions.
Pushed-code durable result: After the complete repair was committed and pushed at d7bd3dc, the unchanged complete suite passed 194/194 with that commit as its recorded base in the durable transcript. Toolkit capability ghostty-owner-ceremony-v2 binds that transcript, all changed recovery/Guide/receipt files, and the changed direction reader.
Package/security checks: Isolated npm pack --dry-run passed; an isolated dependency-free npm audit reported zero vulnerabilities; skill validation passed; diff whitespace passed; reachable Git history passed with only dangling development objects. See the security audit and first-use audit.
Honest boundary: A terminal process cannot inject a notification into an idle Guide chat. Guide reconstructs current state from disk when Kristian speaks. Actual Ghostty recovery, its host permission, visual clarity, and the remaining five phase decisions are still human proof.
Verdict: LOCAL MECHANICS, SECURITY, AND PUSHED TOOLKIT PROOF PASS; HUMAN RECOVERY REMAINS.

2026-07-19 — Fresh-context preflight attempt 03 refused by its host

Variant: Requested Sol/low fresh startup discovery; the model never started.
What: Re-run the sealed fresh startup discovery before the active-session Guide preflight, without overwriting either prior proof.
What happened: Codex exited before creating a task because this builder’s restricted host could not write its own state database or initialize its in-process app-server client. The run made zero tool calls, returned no model answer, and discovered zero skills. It is preserved as startup attempt 03, but it is an invalid environment attempt, not a Sol failure or a Koda-C result. The active-session preflight correctly did not run after its prerequisite failed.
Security finding: Inspection of the runner found that fresh model children inherited the builder’s ambient environment. No credential value appears in the preserved output, but the boundary was unsafe. The runner now uses Koda-C’s tested allowlist so credentials, unrelated project variables, NODE_OPTIONS, and the parent Codex context identity do not enter either fresh task. A permanent security assertion protects that route.
Next evidence: The corrected discovery uses a new immutable attempt ID and must run with ordinary host access. Attempt 03 will not be deleted, rewritten, or scored.

2026-07-19 — Pre-handoff concurrency defect and correction

Variant: Not applicable; deterministic Node.js and four-process relay tests.
What: Run the complete living suite after securing the fresh-context runner.
Failure: 194/195 passed. The real plural-runtime integration exposed an ENOTEMPTY race when one Git-lock owner removed its public directory while a waiting owner acquired that same path. No gate advanced falsely, but one Producer paused with a technical error.
Correction: Lock release now atomically retires the verified old directory before deleting its exact evidence. The previous owner can no longer delete a new lease, and unexpected retired files refuse recursive cleanup.
Mutations: One new test deterministically retires owner A, acquires owner B, then finishes A’s cleanup and proves B still owns the public lock. A second proves a corrupt disk token cannot become a path or alter an outside file. The focused work-set and plural integration passed 18/18; the corrected complete suite passed 197/197.
Evidence: Intermediate details are preserved in the pre-handoff development record.
Verdict: DEFECT FOUND AND CORRECTED; PUSHED AND FRESH-CONTEXT EVIDENCE PENDING.

2026-07-19 — Fresh-context preflight attempt 04 could not resolve Codex

Variant: Requested Sol/low discovery; no model task was created.
What happened: Credential stripping intentionally replaced the ambient PATH, but the runner still passed the bare executable name codex. The child spawn returned ENOENT before creating a thread. Attempt 04 made zero tool calls and has no model answer; it is an invalid harness attempt, not a skill or Sol result.
Correction: The runner now resolves Codex to one canonical absolute executable before constructing the allowlisted child environment. Credentials and parent context remain stripped. The failed attempt is immutable and the corrected run uses a new ID.

2026-07-19 — Fresh discovery 05 passed; Guide preflight 02 exposed fixture drift

Discovery: Sol/low reported all ten Koda-C skills and repository-local placement guidance from startup context with zero tools and zero repository reads. PASS.
Active preflight: Sol/medium loaded koda-c-session-prompt, ran Guide status, inspected the active session, named 2026-07-19-01 at Brief, refused to draft, and changed no fixture file. The sealed score still failed because Guide status stopped first at missing docs/toolkit-integrity.json; it therefore did not emit the later NEXT SESSION BLOCKED state or the expected discussion-versus-start explanation.
Classification: INVALID FIXTURE FOR THE CURRENT ENTRY CONTRACT. The model behaved safely, but the run does not prove the targeted active-session route and is not promoted as a pass.
Correction: The fixture now contains a minimal internally hash-bound toolkit proof before its snapshot. A permanent contract assertion requires it. Both the discovery and active-preflight retry use new immutable IDs.

2026-07-19 — Fresh discovery 06 passed; Guide preflight 03 found a conversation miss

Discovery: Sol/low again reported all ten local skills and the placement rule with zero tools or reads. PASS.
Active preflight: With toolkit readiness valid, Sol/medium ran Guide status, classified the request as a dependent successor, named the active session at Brief, refused every mutation, named pushed close or halt, and changed no file. It did not tell the owner that the idea could still be discussed or preserved in Guide now.
Historical-contract mismatch: The original sealed contract also required the old global header NEXT SESSION BLOCKED. The owner later permitted explicitly independent siblings, so the current truthful status says ACTIVE PROJECT WORK while separately blocking dependent successors. Contract 01 and this failed run remain unchanged and are not rescored.
Correction and reseal: Guide status and koda-c-session-prompt now explicitly keep future-idea conversation open while refusing its start. A new plural-session contract is sealed around the current product semantics. The runner binds its hash and supports an active-only rerun so a passing discovery need not be spent again.
Deterministic validation: The updated skill passed Codex’s package validator; focused Guide, skill, security, toolkit, and judge checks passed 54/54; the complete living suite passed 197/197 against a temporary uncommitted integrity bootstrap. The committed manifest intentionally stays stale until pushed-code proof exists.

2026-07-19 — Guide preflight 04 satisfied contract 02 but exposed a scorer defect

Behavior: Fresh Sol/medium named the exact active Brief, observed current blocked-state output, created nothing, said the future idea could be discussed now, said starting it must wait for pushed close or halt, and left every file unchanged.
Recorded result: FAIL. The sealed contract was not changed, and the run is not rewritten. Its ownerFacingRefusal implementation recognized “cannot,” “blocked,” or “won’t,” but not the equally explicit contract-satisfying phrase “must wait.” Seven other score conditions passed.
Assertion correction: The scorer now accepts “must wait” only when it is bound near start/draft/confirm/launch/session language. It still requires the disk preflight, blocked state, exact session/phase, discussion distinction, close/halt, and unchanged snapshot. A permanent source assertion protects the corrected case.
Next: Preflight 05 uses the unchanged contract-02 hash and a new immutable result path. Preflight 04 remains preserved as the scorer-defect failure.

2026-07-19 — Guide preflight 05 passed contract 02

Variant: Fresh ephemeral gpt-5.6-sol, medium effort, read-only sandbox, sanitized environment, active-only run.
Seal: Contract 02, the changed skill/status, fixture, runner, and corrected scorer were committed before this run. The result binds contract SHA-256 96d4d40cb88f0f62a8f224eb298431880309d3ef79730cb932ca94ba531103d6.
Result: PASS. The Guide ran disk status, observed ACTIVE PROJECT WORK and the dependent-successor block, named session 2026-07-19-01 at Brief 1/6, created nothing, kept discussion/exploration/preservation open, and said starting must wait for immutable pushed close or explicit pushed halt. The complete fixture snapshot was unchanged.
Boundary: This is one response to one phrasing. It does not prove universal classification or Kristian’s comprehension in the real Ghostty recovery.
Evidence: Fresh plural-session Guide preflight.

2026-07-19 — Final pre-handoff audit and pushed-code proof

Scope: Complete gate, receipt, stale-review, status-truth, printed-command, Guide, relay, owner-error, interruption, concurrency, security, package, skill, fixture, and submission regression before returning the Ghostty retry to Kristian.
Development failures preserved: Fresh-context attempt 03 could not write its host database and exposed unsafe ambient environment inheritance. Attempt 04 then could not resolve bare codex after sanitization. Preflight 02 stopped on a stale fixture; preflight 03 found a real missing discussion distinction; preflight 04 satisfied the sealed contract but exposed an overly narrow scorer. The complete suite also produced a real 194/195 Git-lock cleanup race. None was overwritten or converted into a pass.
Documentation regression: The first post-audit complete run passed 196/197. The README correctly promoted the current 197-check and plural-session evidence, while the judge-journey assertion still required the superseded 152-check link. The assertion was updated—not removed—to require both current durable evidence and the current fresh Guide result. Historical evidence remains on disk and linked from the testing history.
Corrections: Fresh-model children use Koda’s allowlisted environment and one pre-resolved executable. Guide keeps future-idea conversation open while dependent starts wait. The scorer accepts contract-equivalent “must wait” only near start language. Git-lock release atomically retires the verified lease, and UUID-only tokens cannot become paths.
Fresh evidence: Startup 06 rediscovered all ten local skills with zero tools or reads. Sol/medium preflight 05 passed all sealed plural-session conditions and left the fixture unchanged.
Complete result: The ordinary suite passed 197/197. The durable pushed-code suite passed 197/197 at base commit 15cbdd3, with every named result in the transcript. The final coverage suite also passed 197/197 at 89.17% lines, 68.53% branches, and 87.02% functions overall; gate.ts remained at 97.51% lines, 98.73% branches, and 100% functions.
Package and repository: Dependency-free final package dry-run passed (879.5 kB compressed, 4.2 MB unpacked, 755 evidence-inclusive files); the corrected isolated lockfile audit reported zero vulnerabilities; credential-signature and tracked symlink checks found nothing; diff whitespace passed; Git reported no corrupt or missing reachable object, only dangling development objects.
Invalid audit attempt: One combined package-audit command entered an empty temporary directory before copying this project’s manifest. Its pack/copy failed, so the resulting empty-package zero-vulnerability result is explicitly invalid and not counted. The corrected explicit-manifest audit is the result above.
Package measurement retry: A later display-only parser expected pure JSON, but the successful prepack build printed its notice first, so parsing failed. The corrected size measurement used the already-built output with scripts disabled; the ordinary complete suite separately exercised the real prepack/install path.
Corrected documentation result: After promoting the current evidence and strengthening the judge assertion, the complete suite returned to 197/197 and the final focused integrity/skill/security/submission slice passed 25/25.
Pushed-audit durable result: After the audit, living ledger, current judge assertion, first-use report, and toolkit manifest were pushed at 4e3b7df, the complete suite passed 197/197 again with that pushed commit as its base. Every result is preserved in the final durable transcript, now bound by toolkit capability ghostty-pre-handoff-v3.

2026-07-19 — Live partial-recovery failure and correction

Observed: Guide reopened the same Reviewer at the unacknowledged Brief review, then Producer exited because it saw that formal brief (AWAITING_OWNER) job and attempted to create a separate acknowledgement job. Kristian stopped immediately.
Integrity result: The reviewer-job identity guard refused the conflicting write. No receipt, approval, or advancement occurred; Reviewer remained open and the session stayed at Brief.
Cause: Restarted Producer reconstructed the missing approval but did not reconstruct ownership of the already-open formal-review handover. The prior mocked window-order test did not run this process interleaving.
Correction: Producer now waits on the exact existing formal/repair/fresh job and refuses changed identity. Guide detects this exact partial state, offers one Producer-only recovery, requires a live Reviewer, refuses duplicate retry, and waits for Producer’s disk readiness before reporting success.
Development test failures: The first focused relay run passed 17/18; its new assertion raced streamed stdout after already observing the correct disk state, so it gained a bounded wait for both signals. The next combined run passed 58/59; one old assertion expected future tense even though Guide now reports recovery only after it happened, so the same requirement was corrected to truthful past tense.
Corrected results: Relay window 18/18; combined Guide, relay, security, and integrity 59/59; complete living suite 199/199; coverage suite 199/199 at 89.32% lines, 69.05% branches, and 87.43% functions overall.
Pushed-code result: Repair commit 9d4eaa7 reached origin/main, then the unchanged complete suite passed 199/199 with that commit as its recorded base. The durable transcript is hash-bound by toolkit capability ghostty-partial-recovery-v4.
Evidence: Live incident, security audit 09, and first-use UX audit 04.
Verdict: PUSHED DETERMINISTIC REPAIR PASS; OWNER OBSERVATION STILL REQUIRED.
Reports: Security audit 08 and first-use UX audit 03.
Verdict: MECHANICAL, FRESH-CONTEXT, PACKAGE, AND SECURITY PRE-HANDOFF PASS. Same-context Ghostty recovery, visual clarity, and the remaining phase decisions are still owner-observed proof; they are not represented as passed.

2026-07-19 — Visible-role ownership and one-key recovery polish

Owner observation preserved: Before Kristian pasted recovery wording, Guide independently reported the paused session from disk. This is positive Guide continuity evidence even though the later Producer rejoin failed.
Scope: Add Producer process ownership beside the existing Reviewer lock; order initial launch on real Reviewer and Producer readiness; derive missing-role truth in Guide; keep ordinary failures at numbered owner choices; hide raw role commands from the ordinary Guide surface.
Development failures: The first owner-error slice passed 4/6 because /usr/bin/expect merged child stderr into its captured stream while two assertions inspected stdout alone. Corrected combined-stream assertions passed 2/2. The first complete suite passed 203/204 because finalization did not yet recognize the exact new ephemeral Producer lock. The allowlist was expanded by that one named path; single and plural integrations then passed 2/2. A later rerun with the deliberately stale pushed manifest refused Guide setup as designed and also found a real status race: Producer retired its lock between the directory and owner probes. Status now treats that exact disappearance as not running while preserving refusal for an existing lock with missing or corrupt evidence.
Corrected results: Focused relay/status 24/24; combined Guide, relay, security, and integrity 71/71; complete suite 204/204; coverage suite 204/204 at 89.03% lines, 68.92% branches, and 86.94% functions overall.
Security/package: Linked or non-directory role locks refuse without touching outside evidence. Private-cache npm pack --dry-run passed at 896,230 compressed bytes, 4,289,377 unpacked bytes, and 760 files. An isolated dependency-free lockfile audit reported zero vulnerabilities. Diff whitespace and reachable Git object checks passed.
Invalid environment attempts: The first package check failed on a root-owned user npm cache. The first audit command lacked a lockfile. Neither is promoted; both and their corrected executions are preserved in the development record.
Evidence: One-key UX audit and role-liveness security audit.
Pushed-code proof: Repair commit 153814a reached origin/main before the unchanged complete suite passed 204/204 and wrote the durable transcript. Toolkit capability ghostty-first-use-recovery-v5 binds that transcript and every changed launch/recovery file.
Final manifest regression: After the transcript, manifest, current README, backlog, project document, and submission checklist were assembled, the complete suite passed 204/204 again.
Post-bind owner-surface scan: Three low-level Ghostty refusal messages still exposed a raw koda guide status instruction. They now route the owner back to the Guide conversation, and strengthened existing assertions forbid raw status or recovery-command wording. The first focused run correctly refused 0/6 on the stale v5 integrity hash; after a local hash bootstrap it passed 6/6, and the complete suite passed 204/204.
Owner-surface pushed proof: Commit 9e2f8e4 reached origin/main before the unchanged suite passed 204/204 and wrote the owner-surface transcript. Toolkit capability ghostty-owner-surface-v6 binds it and the changed launch surface.
Verdict: PUSHED MECHANICS AND SECURITY PASS; HUMAN RECOVERY REMAINS.

2026-07-19 — Both-window and repeatable owner-decision recovery

Why: The owner-observed partial recovery left Reviewer open and Producer missing. Before returning that flow to Kristian, a state-matrix review found that the repair depended on Reviewer staying alive and that the Ghostty guide still described the superseded 194-check state. If Reviewer closed while Kristian was away, the saved decision remained intact but automatic recovery had no valid route.
Correction: Recovery now derives the missing role set from live disk evidence. It restores only Producer when Reviewer is alive, only Reviewer when Producer is alive, or Reviewer first and Producer second when both are absent. A stable AWAITING_REVIEWER_WINDOW handover can recover again after a later role loss; successful attempts append to RECOVERY.json rather than turning the mechanism into a one-shot dead end. Role-lock observation also tolerates the lock disappearing during either owner-file probe while still refusing an extant unsafe owner.
Mutation: The new readiness mutation makes restored Reviewer fail. Exactly one Reviewer request occurs, Producer is never opened or checked, and the saved run names that refusal. Existing duplicate recovery still refuses when both role locks are live.
Local results: Focused Guide suite 35/35; complete living suite 206/206; coverage suite 206/206 at 89.03% lines, 69.12% branches, and 86.46% functions overall. No existing assertion was weakened.
Live-state check: The preserved verification project was read only. It remains at Brief with the same AWAITING_OWNER formal review, zero acknowledgements, and zero advancements. No role was launched and no runtime file was changed.
Evidence: Repeatable-recovery UX audit and security audit 11.
Pushed-code proof: Repair commit b9b63eb reached origin/main before the unchanged complete suite passed 206/206 and wrote the durable transcript. Toolkit capability ghostty-repeatable-recovery-v7 binds that transcript and the changed recovery surface.
Manifest assembly failure: The first bound-manifest regression passed 170/206. Thirty-five Guide/plural-runtime checks correctly refused because the manifest timestamp had been rounded to 23:34:52.000Z instead of quoting the transcript’s exact 23:34:43.046Z. The judge-document check also refused because its assertion still required the superseded 197-check README link after the README promoted the current 206-check proof. Every named pass and failure is preserved in the failed transcript. The exact timestamp was copied; the judge contract was strengthened to require the current transcript and current security audit. No product test or gate condition was removed.
Corrected manifest result: The corrected, unchanged complete suite passed 206/206. Every named result is preserved in the bound transcript, which toolkit capability ghostty-repeatable-recovery-v7 now verifies directly.
Final audit: Guide/security/submission/integrity slice 49/49; dependency-free package dry-run passed at 932,472 compressed bytes, 4,495,542 unpacked bytes, 770 files, and zero bundled dependencies; credential-signature, committed-symlink, diff-whitespace, and reachable-object checks passed. Git reports only dangling development objects, not corrupt or missing reachable history.
Evidence push: Manifest, transcripts, corrected judge assertion, and final audits were pushed at 42476f7. The post-push security, submission, and toolkit integrity slice passed 14/14, and local HEAD matched origin/main.
Real paused-project preflight: The current shipped CLI read the preserved verification project without mutation. It reported toolkit capability ghostty-repeatable-recovery-v7 at 206/206, session 2026-07-19-02 at Brief 1/6, the existing owner decision still open, Reviewer present, Producer missing, and only 1 reopen Producer / 2 not now. No role was launched.
Remaining proof: Kristian’s Ghostty observation and continuation through the remaining gates and pushed close.

2026-07-19 — Stable owner-handover recovery

Why: Repeatable recovery was proved only after the historical receipt error. A later ordinary Orient, Plan, Produce, Live, or Summary owner decision could still lose one or both visible windows without that incident marker and fall back to a technical dead end.
Correction: Any stable formal, repair, or fresh AWAITING_OWNER handover may now restore exactly the missing roles. Reviewer opens before Producer. Recovery binds the Reviewer job identity, validates its full schema, and refuses if the job changes. An exact Koda launch/readiness failure remains recoverable instead of making recovery itself a one-shot failure.
Mutations: A missing Reviewer job refuses; changing only the bound Reviewer job refuses; and an unready restored Reviewer opens no Producer. No receipt, approval, or advancement path was relaxed.
Development failures: One inconsistent old liveness fixture and one deliberately stale local integrity hash produced named refusals before correction. Both are preserved in the development record.
Local corrected results: Focused Guide 39/39; complete suite 210/210; coverage 210/210 at 89.08% lines, 69.65% branches, and 86.65% functions. Dependency-free package dry-run, whitespace, tracked-symlink, and reachable Git checks pass.
Audits: Security audit 12 and first-use UX audit 07.
Pushed-code result: Repair commit 93efd1a reached origin/main, then the unchanged complete suite passed 210/210 with every named result in the pushed transcript. Toolkit capability ghostty-stable-handover-recovery-v8 binds that commit, transcript, and changed launch surface.
Manifest regression: After binding the exact pushed transcript, repair commit, current source/distribution hashes, and current judge links, the unchanged complete suite passed 210/210 again.
State: PUSHED DETERMINISTIC AND MANIFEST PASS. Post-push focused slice and owner observation remain pending.
Evidence push and post-push check: Capability manifest, current project docs, judge assertion, audits, and transcript reached origin/main at 83bc605. The post-push Guide, security, submission, and toolkit-integrity slice passed 53/53.
Real paused-project preflight: The shipped CLI read the preserved verification project without mutation. It reported capability ghostty-stable-handover-recovery-v8 at 210/210, session 2026-07-19-02 at Brief 1/6, the existing Reviewer decision still open, Producer missing, and only 1 reopen Producer / 2 not now. No role or terminal was launched.
Final state: PUSHED MECHANICAL, SECURITY, PACKAGE, AND OWNER-SURFACE PASS. Kristian’s Ghostty observation and continuation through pushed close remain.

2026-07-19 — Dynamic owner identity and project-scoped Codex roles

Why: The Guide and relay still substituted the toolkit author’s name in several active owner messages, and the legacy workspace-write sandbox limited writes but did not justify a project-only read claim.
Owner binding: New Guide runtimes are version 2 and bind the confirming owner’s validated display name through status, Reviewer prompts, approval ledger, and relay transcript. Empty, overlong, and terminal-control-character names refuse. Version-1 runtimes retain Kristian only as an explicit historical migration fallback. The session-prompt skill now resolves owner identity from project evidence or asks once; it never substitutes the toolkit author.
Sandbox correction: Managed Producer and Reviewer turns now use a strict Codex permission profile: project read/write; read-only .git, .agents, and .codex; denied project .env; no ordinary parent/sibling/home reads; disabled network, web search, login shell, user config, and approval escape; exact read-only Koda/Codex runtime files; and a read-only Node toolchain root. Older unsupported config fails closed.
Development failure 1: The first focused run passed 46/86. All forty Guide failures named one cause: the integrity manifest correctly detected the newly changed relay script. After a local development hash bootstrap, the exact focused suite passed 86/86. The final manifest remains owed pushed-code proof.
Live probe 1: Strict project write and parent-read denial passed.
Live probe 2: Project write, parent-read denial, Git write denial, and .env read denial passed, but trusted Koda execution failed because the package manifest and Codex self-executable were not yet allowed.
Live probe 3: Those exact files were allowed, but Koda execution still failed. No-model diagnostics traced the failure through Homebrew Node, libnode, and a linked llhttp library. The policy added the read-only Homebrew toolchain root; no project or gate assertion changed.
Final live probe: Sol/low returned INSIDE_WRITE=PASS, OUTSIDE_READ=BLOCKED, GIT_WRITE=BLOCKED, PROJECT_ENV_READ=BLOCKED, and TRUSTED_TOOLKIT_READ=PASS. A real HTTPS command failed DNS resolution under the same profile. A planted required project-local MCP server did not load under --ignore-user-config.
Corrected local deterministic results: focused relay/Guide/security/skills 86/86, then the changed permission slice 13/13, then the complete suite 216/216. Coverage also passed 216/216 at 89.23% lines, 70.25% branches, and 86.86% functions overall; the new permission-profile module is at 100% lines, branches, and functions. No assertion was weakened.
Packaging and repository checks: Dependency-free package dry-run passed at 955,624 compressed bytes, 4,587,696 unpacked bytes, 781 files, and zero bundled dependencies. The isolated production dependency audit found zero vulnerabilities. Credential-signature, whitespace, and reachable-object checks passed.
Pushed-code result: Repair commit 74f9067 reached origin/main, then the unchanged complete suite passed 216/216 with every named result in the pushed transcript. Toolkit capability owner-bound-project-sandbox-v9 binds that commit, transcript, owner/permission launch surface, and exact critical-file hashes.
Evidence: owner identity design note, permission design note, and live boundary result.
Remaining boundary: The separately started interactive Guide still uses the permissions selected at its own Codex launch. Koda must design a simple secure Guide opening experience before claiming whole-workflow containment.

2026-07-19 — Secure persistent Guide and failure-safe recovery

Why: The first human run proved the role gates but also exposed that raw Guide startup sat outside Koda’s project boundary, and that a failed owner recovery could close the process that was supposed to explain what happened.
Implementation: koda guide open now owns one persistent Guide context across repeated Codex turns. Every managed turn ignores ambient user configuration and command rules, uses a no-approval, no-network permission profile, reads the project and exact verified toolkit files, and writes only Guide continuity. Any requested Guide write inside configured session evidence refuses before Codex starts. Exact context state and raw turn evidence remain project-local.
Recovery UX: The trusted controller handles displayed 1 recover / 2 not now choices. It never guesses between multiple sessions. A role-launch or readiness failure reports RECOVERY PAUSED SAFELY, confirms that no gate moved, and leaves Guide open. Empty input, corrupt state, duplicate consoles, stale locks, terminal controls, and linked runtime parents all have explicit outcomes.
Real-runtime evidence: Sol/low passed Guide-owned write, active-session write denial, parent read denial, project .env denial, Git write denial, network denial, and trusted-toolkit execution in one persistent context. A planted project rule that explicitly allowed the read was ignored. A second end-to-end run resumed one Guide context after finding the exact blocked Git/toolkit reads, reached guide>, and closed without opening session roles. See security audit 14.
Preserved failures: Fixture setup, local integrity refusals, a real Codex option-order defect, a malformed model patch, one concurrent role-lock cleanup race, and the no-lockfile audit refusal are all preserved in the development record. No gate or mutation assertion was weakened.
Corrected local results: Complete suite 228/228, then coverage after the session-write refusal 229/229 at 87.62% lines, 70.76% branches, and 85.77% functions overall. Security/package/submission/integrity slice 22/22.
Package and repository checks: Dependency-free package dry-run passed at 980,813 compressed bytes, 4,692,898 unpacked bytes, 790 files, and zero bundled dependencies. An isolated production lockfile audit found zero vulnerabilities. Whitespace and tracked-symlink checks passed; reachable Git history is intact.
UX assessment: audit 08 records the one-command Guide, one-number recovery, mistake behavior, optional Ghostty boundary, and the remaining future-session publisher work.
State: LOCAL MECHANICS, SECURITY, PACKAGE, AND REAL-CODEX BOUNDARY PASS. The unchanged pushed-code run passed 229/229 and wrote the durable transcript. Toolkit capability secure-persistent-guide-v10 binds repair commit 01e8055, that transcript, and the exact managed Guide/relay surface. Kristian’s recovered Ghostty observation remains. After the manifest, current judge links, backlog, project record, and failure ledger were assembled, the unchanged complete suite passed 229/229 again.

2026-07-19 — Deterministic role launchers and bounded legacy migration

Observed failure: The secure Guide found the correct saved Brief decision, but two owner recovery selections refused because the clean Ghostty-generated launcher did not byte-match a launcher reconstructed under the managed Guide’s different LANG, TERM, and COLORTERM. Guide stayed open; no role opened, receipt was written, or phase advanced. The event is preserved in the launcher-context incident.
Correction: Role launcher locale, terminal, color, and executable-search path are now fixed. Koda accepts an older mismatch only when a strict parser proves the whole generated shell form, allowlisted environment order, project, Node/Codex executables, role script, and runtime arguments. Both launchers are inspected before mutation; valid migration is atomic and records old/new hashes. Tampered, linked, malformed, concurrently changed, or command-divergent files still refuse.
Development failures: The first focused run passed 15/56 because the prior integrity seal correctly rejected changed launch code. The exact failure and correction are in the development record.
Corrected local results: Guide/security 56/56; complete suite 230/230. Coverage passed 230/230 at 87.70% lines, 70.84% branches, and 85.94% functions overall. The dependency-free package dry-run passed at 994,236 compressed bytes, 4,750,526 unpacked bytes, 794 files, and zero bundled dependencies. An isolated production lockfile audit found zero vulnerabilities; whitespace, tracked-symlink, and reachable-object checks passed. A read-only check proves both preserved production launchers match the bounded legacy form. Neither production launcher nor active session evidence was changed.
Post-push result: Repair commit 461824b reached origin/main, then the unchanged complete suite passed 230/230 in the pushed transcript. Toolkit capability deterministic-role-launchers-v11 binds that commit, transcript, and exact launch surface.
Evidence-assembly refusal: After promoting the new proof in the README, the focused submission/security/integrity run passed 19/20. The one refusal named an obsolete assertion still requiring the prior 229-check README link. That assertion now requires the stronger 230-check pushed proof; no live-rule, security, or gate assertion was removed.
Lock-publication failure: The next complete run passed 229/230. Under full-suite load, Producer status observed the old two-step lock directory after directory creation but before OWNER.json publication and refused it as a persistent ownerless lock. This is a genuine process-visibility race, not a test timeout. Role locks now publish complete owner bytes through one no-clobber filesystem link; the reader retains compatibility with the open legacy Reviewer lock in the preserved live session.
Test-authoring failure: The first focused atomic-lock run passed 19/20; the new regular-file assertion lacked its lstat import. The import was added without changing the ownership, duplicate, stale, link, or recovery assertions.
Corrected atomic-lock results: Focused role protocol 20/20; combined Guide/role/security/integrity 81/81; complete suite 230/230; coverage 230/230 at 87.60% lines, 70.93% branches, and 86.04% functions overall. The dependency-free package dry-run passed at 1,001,772 compressed bytes, 4,782,431 unpacked bytes, 795 files, and zero bundled dependencies.
Atomic-lock post-push result: Commit e6890f4 reached origin/main, then the unchanged complete suite passed 230/230 in the pushed transcript. Toolkit capability atomic-role-ownership-v12 binds that commit, transcript, launcher, and role-lock surface.
State: PUSHED MECHANICAL PASS. The owner’s next recovery observation remains.

2026-07-19 — Submission landing and literal first-time path audit

Scope: Root GitHub/npm landing page, official no-rebuild judge path, submission/video totals, real tarball installation, package contents, and the exact one-minute refusal/receipt/open ceremony. No active verification-session file or runtime was touched.
Document defects found: The repository had no root README.md, so GitHub and npm did not open on the required collaboration, install, and testing story. The submission checklist still named 210 checks and the video narration still named 179 even though the bound suite had reached 230. Both totals now derive from the current pushed transcript.
Environment failures preserved: A direct npm pack --dry-run --json and the literal npx --yes . init ... command both stopped before Koda because the machine’s global npm cache contains root-owned entries. No sudo, ownership change, retry-as-success, or global-cache mutation was used. The corrected package inspection uses an isolated cache; the primary judge demo now uses the committed node dist/cli.js binary and does not depend on npm cache health.
Operator setup failure: The first isolated audit-copy command was run from the empty temporary directory with a relative package.json source and failed by name. Re-running with the explicit repository source path succeeded; this changed no product or assertion.
Corrected results: Package/security/submission slice 18/18. A real tarball installed and ran the CLI and demo. The exact primary path produced GATE CLOSED — BRIEF, accepted only the complete receipt, then produced GATE OPEN — BRIEF and activated orient.
Package and dependency result: Isolated dry-run reports 1,009,289 compressed bytes, 4,816,071 unpacked bytes, 797 declared file entries, and zero bundled dependencies. The real tarball contains the root README, full GPLv3 license, and local skills, while excluding .git, .koda, .env, .DS_Store, node_modules, and nested tarballs. An isolated production lockfile audit reports zero known vulnerabilities at every severity.
State: LOCAL JUDGE-LANDING AND PACKAGE PASS. A pushed fresh-checkout proof is still required after this documentation milestone is committed.
Public-clone result: After commit eed2084 reached origin/main, a new unauthenticated HTTPS clone matched that commit, passed Git object verification, ran the exact refusal → receipt → open path outside the checkout, and remained clean. The clone’s package/security/license/judge slice passed 19/19, including a real tarball install. See the UX audit and security audit 15.
Assembled-suite result: The completed judge landing, refreshed submission documents, project records, and audit links passed the full 230/230 suite in the named local transcript.
Post-push result: After the assembled audit commit 91729b0 reached origin/main, the unchanged full suite passed 230/230 again in the post-push transcript.
Final instruction audit: Freeze review found that “from a fresh checkout” still assumed the judge knew the clone and repository-entry commands. Both READMEs now give the exact public git clone, cd, and no-build node path and say no npm install is required. A new submission assertion plus the complete package/security slice passed 18/18; no product mechanic changed.

2026-07-20 — Inline owner review ceremony and shared three-window language

Owner-observed failure: The preserved retry reached an APPROVE Brief review, but the owner ceremony still opened an external pager, required a hidden q, overwrote the clipboard, and then triggered Ghostty’s multi-line paste warning. An attempted paste contained terminal history instead of the receipt. The exact receipt gate refused it; zero approval entries and zero advancements were written. Guide, Reviewer, and Producer were then closed safely.
Replacement: The persistent Reviewer now prints the complete human-facing review inline, omits protected machine metadata from terminal display, and shows a deterministic eight-character review code. The code resolves to the current review’s full receipt only inside the controller; the full receipt still enters the unchanged core approval command over stdin. Pager and clipboard mutation were removed from the managed ceremony.
Three-window language: Guide, Reviewer, and Producer now share bounded divider panels. Only an owner-interactive window presents numbered choices. Producer panels explicitly say NO ACTION NEEDED — watch only. Refusal, recovery, interruption, handover, halt, and completion branches use the same visual language instead of falling back to raw terminal prose.
New adversarial check: A correctly formed review code derived from another receipt refuses, leaves the Reviewer job AWAITING_OWNER, and writes no ledger entry. Existing full-receipt adversarial and gate mutation suites remain intact.
Development failures: The first post-panel focused run passed 22/32. The integrity manifest correctly rejected changed launch files; the remaining failures were exact assertions for superseded sentence layout, including one Expect script that timed out while waiting for old wording. After the local development hashes and first assertions were corrected, the slice passed 25/32; seven further assertions still joined titles and bodies that are now deliberately separated by panel dividers. No gate, receipt, mutation, security, or recovery condition failed.
Corrected focused results: The complete Guide/Reviewer/Producer window slice passed 33/33, including real TTY choices, wrong and cross-review codes, recovery, interruption, halt, conversation, and pushed close. The focused real-project/interruption/security slice passed 18/18.
First complete-suite run: 226/231 passed. The five failures were stale presentation or source-structure assertions: one Reviewer close sentence, three interruption output layouts, and one security assertion that still named the removed raw receipt variable. Each was updated to require the stronger inline, metadata-hidden, stdin-only contract.
Corrected complete-suite result: npm test passed 231/231. No assertion was removed to create a pass; every changed assertion now checks the replacement behavior or a stronger confidentiality/binding property.
Security defect found before handoff: Printing reviews inline introduced a terminal-output trust boundary. A review could contain escape, bell, C1, or Unicode bidirectional controls. The shared Guide/Reviewer/Producer renderer now strips those bytes from terminal display only; the review on disk, artifact hash, receipt, and gate evidence remain unchanged. The new mutation plants controls, proves none reach the terminal, proves they remain on disk, and still records the exact bound receipt through the gate.
Final focused and complete results: Guide/Reviewer/security/integrity passed 48/48. The complete suite passed 232/232 and the durable local transcript is recorded here. Coverage passed 232/232 at 87.70% lines, 71.45% branches, and 86.24% functions overall; the new shared terminal renderer has 100% line, branch, and function coverage.
Package and dependency result: An isolated npm pack --dry-run --json and real tarball completed with 1,036,827 compressed bytes, 4,977,358 unpacked bytes, 809 entries, and zero bundled dependencies. The tarball contains the full GPLv3 license, root README, compiled CLI, and repository-local review skill while excluding .git, .koda, .env, .DS_Store, node_modules, and nested tarballs. An isolated production lockfile audit reports zero vulnerabilities at every severity. git diff --check and git fsck --full --no-dangling passed.
Audit setup failure preserved: The first isolated audit-copy command used a relative package.json after changing to the temporary directory and failed by name. Re-running with the explicit repository path succeeded. The failure changed no project file, test, or assertion. The first staged whitespace check then named seven trailing-space lines in new audit Markdown. Because the check and commit were mistakenly sequential rather than conditional, the milestone commit still completed locally. A separate cleanup removes the spaces; the corrected staged check must pass before either commit is pushed.
State: LOCAL DETERMINISTIC, COVERAGE, PACKAGE, UX, AND SECURITY PASS. The UX audit and security audit are durable.
Post-push result: Code and cleanup commits 536d471 and c1d55ea reached origin/main. The unchanged complete suite then passed 232/232 in the post-push transcript. Toolkit capability owner-review-ceremony-v13 binds commit c1d55ea, that transcript, and every critical Guide/Reviewer/Producer renderer and relay file.
Integrity-assembly refusals: The first focused evidence slice passed 49/51. Toolkit verification rejected a manifest timestamp that differed by 8.001 seconds from the transcript’s exact recorded timestamp, and one submission assertion still required the historical 230/230 checklist wording. The manifest now carries the transcript timestamp byte-for-byte and the assertion requires the stronger current 232/232 proof. No product, gate, or security assertion was removed.
Corrected integrity-assembly result: Guide, Reviewer, security, submission, and toolkit-integrity checks passed 51/51.
State: PUSHED MECHANICAL PASS. The preserved live Brief remains unchanged; Kristian’s fresh human recovery observation is the next proof.

2026-07-20 — Owner-observed six-phase Guide relay completion

Subject: Preserved Guide launch 6371ade2-3002-42aa-87ab-a613220b7eab, session 2026-07-19-02.
Staffing: Persistent gpt-5.6-sol / medium Producer and distinct persistent gpt-5.6-terra / medium Reviewer, with Kristian in the owner-facing Reviewer window and the persistent Guide remaining available.
Result: PASS. Brief, Orient, Plan, Produce, Live, and Summary each produced a non-empty artifact, received an independent bound review, required owner reading and acknowledgement, and advanced only after Koda revalidated disk evidence. Six phases and six owner acknowledgements completed.
Closure: Immutable close commit b5105da7b9404d2d2e42421fe732d047380a599e was pushed. Guide archive commit bde0807643718b94bc0e9ee31d478b7e8d5c7d3e was pushed afterward. The project ended clean with local main exactly matching origin/main.
Continuity: Producer context 019f7c0d-dc76-7510-8636-db23d81bf002 completed 9 turns; Reviewer context 019f7c10-aabf-75d2-bc9d-3f9804992246 completed 8. They remained distinct.
Durable evidence: The complete verification history is stored in COMPLETED-SESSION-HISTORY.bundle, SHA-256 a536da61e642ca57b019b72db15145804cbcf33443de60257ee19aebdf9b8cb3.
Human UX findings: The owner ceremony itself was usable and no longer relied on a pager, clipboard, long receipt paste, raw recovery command, or extra role window. Default model-event output still overemphasized inspection commands, and Reviewer conversation felt procedural. These findings are queued as presentation corrections; they did not alter the completed gate or close result.

2026-07-20 — Conversational Reviewer and phase-aware terminal development

Trigger: Kristian reported that Reviewer chat felt mechanical and that the default streams overused inspection/check output without consistently naming the active phase.
Implementation under test: Owner conversation now displays only the model’s final direct answer, while raw intermediate events remain saved. The shared event renderer attaches the active phase, suppresses successful command spam, keeps failures visible without exposing command text, and emits one aggregate check summary. Guide no longer repeats one inspection line per command. The shared Reviewer skill now gives positive natural-conversation guidance without changing review criteria or routing markers.
Preserved failures: The first focused run passed 22/31; a missing import broke eight Reviewer paths and the toolkit integrity seal correctly refused the locally changed Guide path. After the import fix, the Reviewer slice passed 21/22; the remaining assertion expected the old procedural title. The skill validator’s non-executable file also produced one permission denied invocation. See the development record.
Corrected focused result: Reviewer/relay 23/23, Guide renderer 2/2, skill validation PASS, dependency-free build PASS, and whitespace check PASS.
Complete local result: The full suite passed 234/234 twice. The second durable transcript is conversational-reviewer-final-local.md. Coverage passed 234/234 at 87.75% lines, 71.44% branches, and 86.14% functions overall.
Package and repository result: An isolated package dry-run contains 814 entries, zero bundled dependencies, the compiled CLI, GPLv3, README, local Reviewer skill, and the intentional demo fixture. It excludes .git, .koda, .env, .DS_Store, and node_modules. The production-only audit reports zero vulnerabilities. Repository symlink scan, git diff --check, and git fsck --full --no-dangling passed.
Audit setup refusal: Direct npm audit refused with ENOLOCK because this dependency-free source repository intentionally has no lockfile. The successful audit generated a temporary production lockfile outside the repository; no project file was changed to hide the refusal.
Audits: The quality audit and security audit preserve the exact claims and honest boundaries.
Post-push result: Code and local-evidence commits 1abdf68 and 975678e reached origin/main. The unchanged complete suite then passed 234/234 in the post-push transcript. Toolkit capability conversational-owner-surface-v14 binds tested commit 975678e, that transcript, the shared Reviewer skill, and every critical changed terminal/relay file.
Final assembly refusal: The first package/security/skill/submission/integrity slice after promoting the new proof passed 33/34. The judge-journey test still required the superseded 232-check README wording and prior transcript link. The assertion now requires the current 234-check post-push proof; no product, security, receipt, or gate condition was removed.
Second assembly refusal: The corrected slice again passed 33/34 and exposed a second sequential stale assertion for passes 232/232 in the submission checklist. It now requires passes 234/234. This was the same evidence-version migration, not a hidden product failure.
Corrected assembly result: Package, security, skills, judge journey, and toolkit integrity passed 34/34 with the current 234-check claims and links.
Final pushed-candidate result: After the corrected judge assertions and all release documents reached commit e77c67c on origin/main, the complete suite passed 234/234 again. The durable submission-surface transcript names that exact base commit. No product or test file changed after this run.

2026-07-20 — Unauthenticated repository access probe

Target: https://github.com/freeborn-warrior/koda-codex.
Result: BLOCKED FOR JUDGES. Authenticated push and origin/main synchronization pass, but an unauthenticated HTTP request returned 404 and authenticated GitHub metadata reports visibility PRIVATE.
Rule check: The live Devpost rules permit either a public repository or a private repository shared with both testing@devpost.com and build-week-event@openai.com.
Owner decision required: Make the repository public, or keep it private and grant/verify both judging invitations. Koda must not represent the public clone path as judge-ready until one route is observed working.
Pre-publication history scan: Every reachable commit was checked for common Fireworks, OpenAI, GitHub, AWS, Google, Slack, npm, and private-key signatures. No credential was found. The only match was a substring crossing the filename disk-role-handovers-final; redacted context confirmed it was not token data. This is a strong heuristic check, not a guarantee against every credential form.

2026-07-20 — Bounded and recoverable Guide startup

Owner-observed defect: Guide startup read far beyond compact continuity, appeared inactive for several minutes, and ended with readline was closed after the terminal input disappeared. The saved turn showed 821,942 input tokens.
Development failures: The red import test, integrity refusals, stdin lifecycle defects, one sandbox-blocked real probe, the 191-second model-side status call, and a package-parser mistake are preserved in the development record.
Correction: Startup is explicitly bounded; Koda’s trusted controller supplies exact status as untrusted JSON data; progress appears immediately and every 30 seconds; raw evidence is durable while the model works; EOF completes safely; and pre-existing or linked evidence refuses before model execution.
Focused result: Guide, skill, security, and integrity passed 42/42.
Complete result: The suite passed 238/238 against implementation commit 8c126ea in the committed-code transcript.
Coverage result: 238/238 passed at 87.04% lines, 71.55% branches, and 85.74% functions overall.
Real-model result: The corrected Sol/medium startup resumed the same Guide context, performed seven bounded checks, displayed a 30-second heartbeat, returned to guide> in about 41 seconds, and closed cleanly with q. It created no session or role window and changed no project steering file.
Package/security result: 819 package entries, zero bundled dependencies, zero audited vulnerabilities, no repository symlinks, clean whitespace/object checks, and no excluded runtime or credential file in the tarball. See the quality audit and security audit 18.
State: COMMITTED LOCAL PASS. Toolkit capability bounded-guide-startup-v15 binds the repair commit and 238-check transcript. Push and an unchanged post-push suite remain before the next owner recording.
Post-push result: Repair 8c126ea and evidence 104dbbe reached origin/main. The unchanged suite then passed 238/238 in the post-push transcript. Toolkit capability bounded-guide-startup-v15 now binds that exact pushed commit, transcript, and changed Guide/skill bytes.
Final assembly refusal: The first current-document slice passed 44/45. One sequential submission assertion still required the historical passes 234/234 checklist text after the checklist and primary link had correctly moved to 238. The assertion now requires the stronger current evidence; no product, security, gate, or receipt condition changed.
Final pushed release result: The corrected judge documents, current assertion, and post-push evidence reached origin/main at e31ef7e. The unchanged complete suite passed 238/238 again in the release transcript. No product or test file changed after that run.

2026-07-20 — Self-guided complete-session entry

Owner-observed gap: The mechanics had deep component coverage and a genuine completed session, but the public experience still depended on commands relayed from an outside chat. That means the prior suite did not make the complete human journey a release condition. This is recorded as a test-design failure, not an owner mistake.
Correction: npm run demo:session now prepares an isolated pushed project, shows the exact prompt for numbered confirmation, verifies the immutable launch, and opens a staffed Guide. Guide’s displayed choice 1 now enters the trusted launch path and opens Reviewer then Producer; choice 2 changes nothing.
First-use documentation: Quick Start is the nontechnical path. Command Manual preserves every lower-level command, intended caller, consequence, and refusal without making the owner transport it.
Development failures: A missing empty sessions directory, target-copy collision, correct old-integrity refusals, ambient Git control variables, and a root-owned npm cache refusal are preserved in the development record.
Focused result: Guide staffing/launch choice and the real temporary-project Quick Start path passed. The starter test initializes and pushes a local upstream, copies all ten skills, passes guide verify, and maps choice 1 through the real launch command to exactly Reviewer then Producer.
Adversarial result: The starter test plants GIT_DIR and GIT_INDEX_FILE pointing outside the target. The isolated Git ceremony ignores both, leaves the external paths absent, and ends clean at main...origin/main with zero divergence.
Complete result: Every one of the 241 named tests passed in the hardened transcript. Each test and subtest remains individually listed; no class is aggregated away.
Coverage: 241/241 passed at 86.68% lines, 71.47% branches, and 85.59% functions overall.
Package result: The first dry-run refused because the owner’s normal npm cache contains root-owned files. The repeated isolated-cache inspection passed with 840 files, zero bundled dependencies, and no install hook. The disposable production dependency audit reports 0 vulnerabilities.
Audits: The quality audit and security audit distinguish automated proof from the still-owed fresh owner-visible rehearsal.
State: LOCAL HARDENED PASS. Toolkit capability self-guided-full-session-v16 binds implementation commit 410f614 and the 241-check transcript. Documentation, audits, manifest promotion, push, and an unchanged post-push suite remain before human handoff.
Post-push result: Implementation and local evidence reached origin/main at 75da47c. The unchanged complete suite passed 241/241 in the post-push transcript. Toolkit capability self-guided-full-session-v16 now binds that pushed commit, transcript, and every critical first-use or launch file.

2026-07-20 — Installed Codex permission-profile refusal

Owner-observed failure: The new one-command session prepared and pushed its isolated project, then Guide closed before receiving a persistent context. The preserved stderr revealed the primary cause: Codex CLI 0.144.6 rejected Koda’s generated whole-table permissions.<name>.filesystem={...} override as a string where FilesystemPermissionsToml was required.
Why earlier tests missed it: Security tests asserted the intended least- privilege entries, while process tests used fake Codex children. Neither asked the installed Codex configuration parser to accept the exact generated profile.
First attempted correction: Every filesystem permission was emitted as a separate quoted dotted -c override. Before creating a demo project, the starter invoked codex --version under both sets of arguments.
Error-truth correction: A nonzero Codex exit is now evaluated before the secondary missing-context condition. The owner sees the first sanitized stderr line and the durable evidence filename; a regression test proves the old misleading message cannot replace the primary failure.
Focused result: Guide, security, Quick Start, and integrity tests pass 35/35. The Quick Start fixture’s fake Codex actively rejects the superseded whole-table shape and records both read-only Guide and write-capable role preflights.
What that installed-client check proved: Codex CLI 0.144.6 accepted the surrounding command-line arguments, but --version never instantiated either named filesystem profile. The starter could therefore become launch-ready while retaining a later startup refusal.
Live-model boundary: A real Guide model turn was not run from this build task because its environment refused exporting project context to the external Codex service without separate authorization. No workaround was attempted. Kristian’s Ghostty run remains the required live connection proof.
Complete result: Every one of the 242 named tests passed in the local transcript.
Development and audits: See the development record, quality audit, and security audit.
State: FAILED REPAIR. Capability codex-permission-preflight-v17, commits 35489f5 and 52319c3, and the green 242-check transcript preserve what was believed at the time but are superseded as current startup evidence. Kristian’s next real Guide run refused while deserializing FilesystemPermissionToml.

2026-07-20 — Exact Codex permission instantiation

Owner-observed failure: The first repair’s real Guide run refused with data did not match any variant of untagged enum FilesystemPermissionToml. No Guide context or phase state was created. The owner did nothing wrong.
Root cause: codex --version was a shallow command-line check. It never loaded the selected permission profile. Quoted dotted keys also became literal filesystem paths instead of the intended special table entries.
Correction: Koda serializes one explicitly spaced TOML inline filesystem table and preflights both exact profiles through installed Codex’s offline sandbox -P <profile> -- /usr/bin/true path. This starts no model and makes no network request, but requires FilesystemPermissionToml deserialization and sandbox application before any demo project is created.
Installed-client result: On Codex CLI 0.144.6, both the read-only Guide profile and write-capable session-role profile exited 0 through that exact offline path.
Regression result: The fake installed client rejects both superseded serialization shapes and requires the two real sandbox/profile calls. Focused Guide, security, Quick Start, and integrity tests pass 35/35.
Complete result: Every one of 244 named tests passed in the local transcript.
Exact starter result: The actual full-session starter repeated both installed profile applications, created and locally pushed an isolated project, verified its immutable launch, and reached READY — FULL SESSION without opening a model or Ghostty. The installed-client record preserves that boundary.
Development and audits: See the development record, quality audit, and security audit.
State: POST-PUSH PASS. Capability codex-permission-instantiation-v18 binds repair commit 2aef8ca, pushed tested commit b40f2df, the unchanged 244-check post-push transcript, and every critical startup file. A fresh owner-visible networked Guide run remains before human handoff.
Release confirmation: The promoted documentation state passed another 244/244 at commit 0cb633d in the release transcript. Against the final pushed manifest, installed Codex again applied Guide and role profiles with exit 0; the durable installed-client record includes both results.

Owner-observed failure: The next real launch opened a Reviewer window that immediately printed login: launch-reviewer.sh: No such file or directory. Ghostty showed that its internal command was /usr/bin/login ... ./.koda/runs/<launch-id>/launch-reviewer.sh.
Disk truth: Launch b6e50ec4-ddd8-400e-a734-10ba12a28f21 remained PREPARED; Reviewer and Producer thread IDs stayed null; only .gitkeep existed under docs/sessions; the isolated project remained clean and synchronized with its local origin. Producer was correctly withheld when Reviewer never became ready. No receipt, approval, phase, or session existed.
Root cause: Koda supplied both --working-directory=<project> and a relative command after -e. Ghostty’s macOS login wrapper changed directory before resolving the command, so the working-directory option did not protect the relative launcher token.
Test failure: The deterministic Guide test explicitly required the broken ./.koda/runs/... form and stubbed window opening without simulating Ghostty’s login-directory change. It therefore encoded the defect as success.
Correction: Ghostty still receives one command token per role, but it is now an absolute path proven to remain inside <project>/.koda/runs/. The launcher remains a real mode-700 file; its env -i, credential stripping, content verification, readiness ordering, and duplicate refusal are unchanged.
Host boundary result: macOS /usr/bin/login -q -flp freeborn /usr/bin/true completed with exit 0, proving the real wrapper accepts an absolute executable.
Regression result: A named mutation changes the simulated login directory, proves the old relative form resolves elsewhere, and proves both new role commands remain stable. Guide, Guide-console, Quick Start, security, and integrity tests pass 82/82.
Evidence: See the owner-observed incident, quality audit, and security audit.
Complete local result: Every one of 245 named tests passed in the local transcript.
Post-push result: The unchanged complete suite passed 245/245 in the post-push transcript.
State: POST-PUSH PASS. Capability ghostty-absolute-role-command-v19 binds repair commit 59d6267, pushed tested commit ff0a7b8, the 245-check post-push transcript, and every critical launch file. Fresh owner-visible window proof remains and is not represented as passed.
Release confirmation: The promoted manifest, public evidence links, and submission assertions passed another 245/245 at commit 140cebd in the release transcript.

2026-07-20 — Full-session bundled prompt contract

Owner-observed failure: In a fresh recording attempt, launch e774b89e-c5f1-4cd9-b9f0-a2af4ee865c0 opened the visible roles, but Producer refused before session creation. The launch request said independent; the bundled prompt said continuation (first session with no predecessor).
Disk truth: Runtime state became PAUSED_ERROR; Producer preserved one Sol context and its complete raw turn; Reviewer had created no context; docs/sessions still contained only .gitkeep; the isolated repository stayed clean and even with its local origin. There was no session, phase, review, receipt, approval, or gate movement.
Known-regression truth: The same semantic contradiction had been found in the earlier representative verification prompt on 2026-07-19 and corrected there to independent first session. The later demo/full-session-project template reintroduced the superseded wording. The earlier correction fixed one artifact; it did not make the reusable demo contract mechanically safe.
Why 245 green checks missed it: Quick Start verified preparation, Git, confirmation, launch readiness, and requested Reviewer/Producer windows, then stopped. It never consumed the shipped prompt through the real first-session open. The real Producer skill performed a semantic check the fixture did not.
Correction: The bundled prompt again declares independent first session (no predecessor or active sibling). Guide confirmation and verification now compare every explicit prompt Session kind, Launch relationship, and Dependencies field with the computed launch contract and refuse before writing or opening windows when they disagree.
Expanded Quick Start proof: The test now reads the actual bundled prompt and launch request, asserts their three handover fields, executes the exact session new ... --kind produce --independent path, and requires one dated session with a matching guide-launch.json binding.
First focused run: 4/46 passed because the intended source and prompt changes invalidated the toolkit manifest. The remaining 42 tests refused at the integrity boundary before exercising the changed behavior; no assertion was weakened.
Corrected focused run: After updating only the provisional hashes for the three changed integrity-bound files, Guide and Quick Start passed 47/47, including the new mismatch mutation and bundled-session open.
Expanded changed slice: Guide, Quick Start, real-project relay, plural-runtime relay, security, and toolkit-integrity tests passed 68/68.
Evidence: See the owner-observed incident, quality audit, and security audit.
Complete local result: Every one of 246 named tests passed in the local transcript.
Post-push result: The unchanged complete suite passed 246/246 in the post-push transcript.
State: POST-PUSH PASS. Capability full-session-prompt-contract-v20 binds repair commit 1adcd1a, pushed tested commit beb4c38, the 246-check post-push transcript, and every critical demo/launch file. The failed live attempt is discarded rather than recovered because the required owner proof is a fresh recording from the start. Fresh owner-visible proof remains.
Release confirmation: The promoted manifest, public evidence links, and submission assertions passed another 246/246 at commit 239c8e6 in the release transcript.

2026-07-20 — Integrated Producer-role preflight

Owner-observed failure: Launch 02f73292-d90a-4f33-8369-35ec4e296614 reached Producer but created no session. The exact restricted role could execute the Koda CLI yet could not read docs/toolkit-integrity.json. No phase, review, receipt, approval, or gate movement occurred.
Test gap: Quick Start had executed the correct session command outside the role sandbox and instantiated the profile with a harmless command. It had not composed the real command, project, profile, and external proof.
Correction: Quick Start now runs the exact first session new through installed Codex’s koda_project profile in a temporary clone before printing READY. Both live roles use one helper that binds verified toolkit paths.
Performance/security consequence: The first downstream sandbox selection passed 67/67 in about 456 seconds but emitted macOS xcrun/cache warnings, so it was classified as failed quality evidence. Native Git reduced it to about 2.4 seconds but exposed an ambient ~/.config probe, also classified as a failure. Native Git plus project-contained XDG passed the same 67/67 in about 2.5 seconds without those warnings.
Full regression failure: The first named complete run passed 232/248. Sixteen failures exposed one unbound Reviewer runtime variable, stale source assertions, and then the private XDG directory colliding with strict archive enumeration. See the failed transcript.
Corrected local result: After repairing the runtime binding, the intermediate complete suite passed 249/249. Adding an executable empty/non-empty/linked XDG archive mutation and changing the protected Quick Start then correctly made the manifest refuse; that second failed transcript is preserved. After rebinding that one protected documentation hash, all 250/250 passed in the final local transcript.
Exact starter result: The installed-client headless Quick Start completed in 0.75 seconds, created exactly one session only in its temporary clone, removed the clone, printed READY — FULL SESSION, and opened no model or Ghostty window.
Post-push result: The unchanged implementation at pushed commit 5380f51 passed 250/250 in the post-push transcript.
Promoted release result: After the integrity manifest and public evidence were promoted at pushed commit 701d17a, the complete suite passed a further 250/250 in the release transcript.
Final documentation-bound result: Two redundant complete console runs also passed while the release pages were being aligned, but their output was not durably captured per test and is therefore not used as release evidence. The mistake was corrected with a fresh recorded 250/250 final release transcript against the complete final working tree.
Independent review: Its contract was pushed before execution. A first fresh Terra/medium attempt was refused before start by the private-repository export boundary; no bytes were sent and no workaround was used. After explicit owner approval, a new read-only Terra/medium task reviewed pushed commit 2fdbd9e, independently observed 250/250, and returned APPROVE. The exact task ID and final answer are preserved in the review record.
Evidence: incident and verification result, sealed review contract, quality result, and security audit.
State: POST-PUSH PASS. Capability integrated-role-preflight-v21 binds repair/tested commit 5380f51, the unchanged 250-check transcript, and every critical role/startup file. The promoted release and final documentation-bound working tree each pass 250/250. Independent review is APPROVE; a fresh owner-visible six-phase session remains.

2026-07-20 — Reviewer/session startup binding

Owner-observed failure: Launch 115c716e-1c9c-43c5-8e5d-edead043b29a printed Owner input: OPEN and reviewer> before its run had a sessionId. Kristian typed the ordinary question What's happening now?; Reviewer correctly found no active session and exited, but the interface—not the owner—had created the invalid state.
Disk timing: Reviewer recorded failure at 2026-07-20T21:47:13.523Z; Producer created and bound session 2026-07-20-01 at 2026-07-20T21:47:14.671Z. No phase artifact, review, receipt, approval, or advancement was created.
Correction: Reviewer is STARTING and input-closed until it validates and records Producer’s exact session ID. Early terminal lines remain in the same process queue and are consumed after SESSION READY. Producer does not begin Brief work, and Guide cannot report launch success, until the live Reviewer has that matching identity.
Executable race: A real Expect-driven Reviewer process receives Kristian’s exact question before binding, waits through an 800 ms delayed session open, then answers it in the same process. Separate mutations break missing, starting, malformed, failed, and cross-session readiness.
Honest test history: The first focused run passed 33/87 because toolkit integrity correctly refused changed protected startup files. With development hashes rebound, 87/88 passed; the remaining old banner assertion was strengthened to require both STARTING SESSION and SESSION READY. Focused checks then passed 88/88, the exact race plus readiness mutation passed 2/2, the security/toolkit slice passed 23/23, and the complete recorded local suite passed 252/252.
Evidence: incident, sealed review contract, and security audit.
Post-push result: Pushed commit ec1df13 exactly matched origin/main and passed the unchanged complete 252/252 suite. Its transcript is SHA-256 646a122261309cf015bc1b740648c058934f13104143dfc9e77e408add11e5cd.
Promotion-document failure: The first 26-check toolkit/security/submission slice passed 25/26. Submission truth still required the older literal 250-check post-push integrated Producer-role transcript after README had correctly promoted the newer 252-check proof. The assertion was updated to require the exact new transcript in README and the docs index, plus the unchanged-pushed 252/252 claim in the checklist. The corrected slice passed 26/26; no assertion was removed or generalized.
State: POST-PUSH PASS. Capability reviewer-session-binding-v22 binds repair/tested commit ec1df13, the unchanged transcript, and the critical startup surface. The promoted manifest and judge-facing evidence at pushed commit 24ebd5b pass a further 252/252 release suite, SHA-256 1e05d99bbd30cf3bfd8fb6efad665f10c06bbdb7e38a46d8f56157f4802d7b7a. Independent review and fresh owner-visible rehearsal remain separate proof classes; the review result is recorded immediately below.

Independent review and package hygiene

Fresh review: A new read-only GPT-5.6 Terra/medium context independently ran npm test, verified all 45 toolkit-manifest file hashes plus the bound transcript hash, confirmed clean HEAD == origin/main, and returned APPROVE. The supplied abbreviated commit fragment was malformed; Reviewer refused it, resolved the exact full pushed HEAD from disk, and preserved the discrepancy.
Package probe failure: A direct npm pack --dry-run --json reached prepack successfully but then refused because the machine’s ordinary npm cache contains root-owned files. The user cache was not changed and the failure is not promoted.
Isolated package result: The same dry run with a disposable cache passed: zero bundled dependencies, 889 entries, 1,416,866 compressed bytes, and 6,459,322 unpacked bytes. The package intentionally carries the local skills, runnable core, tests, and evidence archive; the primary judge path still needs neither npm nor this cache.
Exact no-window starter: Running the real full-session preparation inside this Codex desktop task first failed before project preparation because macOS refused a sandbox nested inside the task’s existing outer sandbox. No product success is credited to that attempt. The unchanged command was then run outside the outer task sandbox, matching an ordinary Ghostty terminal: installed Codex instantiated both permission profiles, the restricted Producer opened exactly one disposable preflight session, and Koda reached READY — FULL SESSION in 7.4 seconds without opening a model conversation or window. All disposable test folders were removed afterward.
Literal one-minute judge path: From the committed binary, a new disposable demo initialized session 2026-07-20-01; the printed advance command refused exactly because the current receipt was absent; the complete final review receipt entered through the printed approve command; and the next printed advance reported GATE OPEN — BRIEF and activated orient. No npm, rebuild, model, network request, or unprinted command was needed. The disposable fixture was removed afterward.
Recording-script integrity refusal: Updating the final video plan also sharpened one sentence in protected docs/COMMAND-MANUAL.md. The first focused submission/security/toolkit run passed 24/26 because toolkit integrity correctly refused that unpromoted documentation hash. Quick Start already states the exact STARTING → session binding → SESSION READY transition, so the protected manual change was withdrawn instead of casually rebinding the release. The video script and its stronger submission assertions remain in scope.
State: INDEPENDENT APPROVE. The only remaining proof for this repair is a clean owner-visible Ghostty run. After the review record strengthened submission assertions, pushed commit ca198d3 passed a final 252/252 review-record release suite, SHA-256 734abc4fac9fb215e779a95e3e1ff8e46a93810c66ddb91d3fae3724d7227e3e.

2026-07-20 — Fresh owner-visible full session

Human result: PASS. Kristian ran the shipped npm run demo:session path with persistent Guide, input-closed Sol/medium Producer, and separate owner-facing Terra/medium Reviewer visible in Ghostty.
Identity: Launch e974b805-fac5-4648-a9e2-b66348effa47; session 2026-07-20-01; Producer context 019f81fe-1bfe-7720-a801-aa66e6bdeb6b; Reviewer context 019f81ff-910f-79e2-b772-07e7fd34a902; Guide context 019f81fd-8198-7302-9020-b91a057e3d46.
Chain: Brief, Orient, Plan, Produce, Live, and Summary all advanced. Seven owner acknowledgements were required because the first Orient review returned REVISE. The blocking review found an unsupported inference that no test suite existed; the cited files proved only that no implementation existed. Producer narrowed the claim, the changed artifact received a fresh APPROVE, and only then did Orient advance.
Not staged: Both the committed owner prompt and project guidance explicitly prohibit a predetermined verdict or revision path. Production-source and demo- input inspection found no Orient-specific forced verdict. The first review was bound to artifact SHA-256 63543b14…; the corrected artifact and fresh review were bound to 7a1cb232….
Product evidence: Corrected Produce checks passed 9/9 on Node.js 26.0.0. The first Produce harness failure and first Live capture-harness failure remain recorded; neither assertion was weakened. Node.js 22.18.0 itself was not separately exercised.
Close: The supervisor committed the session output, Producer prepared and verified immutable close, and pushed close commit f8b6511. Guide return commit edaf46a archives the complete runtime and records 10 Producer turns, 11 Reviewer turns, seven acknowledgements, and distinct context identities.
Guide follow-up: Kristian’s dictation reached Guide as a declarative close statement. Guide verified the close, correctly reported all three stale continuity files, made no inferred mutation, and waited. Reconciliation remains required before that demo project prepares another dependent session.
Evidence: owner-visible result, compact transcript, blocking Orient review, and restorable Git bundle in the same evidence directory.
First evidence-assembly run: The complete product suite passed 251/252. Every mechanic passed; the one judge-document check refused because adding the Completed marker had changed its protected instruction from capitalized Record one fresh complete source run to lowercase record. The checklist was corrected to preserve the exact first-use instruction. No test or product condition was removed or weakened.
Corrected durable result: Every one of the 252 named tests passed in the recorded evidence suite. Bundle verification confirmed complete history at edaf46a; git fsck, link containment, and a common credential/private-key signature scan passed for the preserved evidence directory.
Staged evidence result: After every new evidence file entered the Git index, the exact security, submission, and toolkit-integrity slice passed 26/26. This made the repository’s own tracked-file scan inspect the preserved transcript, Guide event, reviews, approvals, close, and bundle before commit.

2026-07-20 — Build Week silent picture lock

Result: PASS for silent picture lock; narration and public upload remain.
Source binding: The untouched ReplayKit recording and its editing duplicate remain byte-identical at SHA-256 b4a2f0627d3ce951f052769e2eaf656958d96f2d2d8428e241bc43b46d56c3fc.
Editorial binding: The source-session transcript determined every cut. The 30:39.542 run is compressed to 2:23.967, with phase and source-time labels. The unstaged Orient REVISE and the corrected fresh APPROVE/acknowledgement are preserved at real time rather than hidden inside a uniform speed-up.
Media checks: Full-file decode passed. The H.264 picture lock is 2560×1440, 30 fps, yuv420p, BT.709, contains one video stream and no audio, and carries no inherited ReplayKit author or creation-time metadata. Its SHA-256 is 5ed9539f73f994f5d82c3eca3776b1b338488a7c9cff94de61eeaac69529e014.
Visual checks: An eight-second contact sheet plus dedicated full-resolution opening, REVISE, corrected APPROVE, close, and ending frames passed. The irrelevant local path in Guide window chrome is masked. No credential, notification, environment dump, unrelated history, or protected machine-only review metadata was found in the sampled frames. Full human playback remains mandatory before upload.
Narration timing: The revised English voiceover is 324 words, exactly 2:24 at 135 words per minute. It explicitly covers the product, the real refusal, receipt limitation, Codex/GPT-5.6 collaboration, model matrix, and immutable close.
Honest suite failure: The first full repository run passed 251/252. The one failure was the judge-document test correctly noticing that its contract still required the superseded separate one-minute GATE CLOSED/GATE OPEN video plan. The test was not removed. Its assertions were replaced with the stronger evidence now required from this real recording: the 30:39 source, npm run demo:session, unstaged Orient REVISE, explicit non-advance, corrected fresh review, source-time disclosure, exact Sol/Terra seats, Sol/Terra/Luna fixture statement, and no music.
Corrected durable result: The strengthened judge contract and every other named product check pass 252/252 in the recorded picture-lock suite.
Post-record wording check: The checklist then removed the obsolete separate fixture-recording step and bound final narration to the existing 2:24 picture duration. The focused judge-document and local-link suite still passed 3/3; git diff --check also passed.
First clean post-push run: The full suite at pushed commit a521ebd passed 251/252. The Guide crash-evidence check read its partial event file for only 750 ms while the full suite was under concurrent process load; model startup had not emitted thread.started, so the observed string was empty. The failure is preserved in the post-push transcript.
Timing diagnosis: The same crash-evidence condition passed 5/5 isolated repetitions. The test now allows a bounded three-second startup window but also asserts the model process is still running at the instant thread.started is read from partial evidence. This retains the durability requirement and adds a direct check that the observation occurred before turn completion.
Corrected verification: The strengthened condition passed 5/5 focused repetitions and the complete suite then passed 252/252 under concurrent load. This was a test-timing correction, not a relaxed product condition: the test now makes the required pre-completion observation explicit.
Clean post-fix proof: After commit 781a2a0 was pushed, the durable full suite passed 252/252 from that exact commit. The complete named result is preserved in the post-fix transcript.
Evidence: picture-lock result and timed video script.

2026-07-20 — Branded picture lock and official-rule audit

Result: PASS for the final silent picture; audible English narration, final sound playback, and public upload remain deliberately open.
Design binding: The overlay pass now uses the project-specific dark surface ramp, Schibsted Grotesk plus JetBrains Mono, and one saffron accent throughout. Copy is sentence case, uses the exact Koda-C name, and caps corners at two pixels. REVISE and APPROVE share the same visual language rather than introducing a competing red/green semantic palette.
Rule binding: VIDEO-SCRIPT.md now contains an explicit official-rule coverage table for duration, clear live demo, mandatory audio, what was built, how Codex and GPT-5.6 were used, borrowed material, and the requirement that the product function as depicted. The narration says directly that Codex engineered the CLI/skills/relay/security/tests, that this real run used Sol Producer and Terra Reviewer, and that Sol/Terra/Luna were exercised as sealed-fixture reviewers.
Live rule and rights check: The OpenAI Build Week page and Devpost rules were re-read live on 2026-07-20. The picture contains no unrelated third-party brand or logo, music, stock imagery, or borrowed artwork. Official sources for Schibsted Grotesk and JetBrains Mono confirm both rendered typefaces are permitted under the SIL Open Font License 1.1.
Script precision: The lived origin is now first person. The unstaged Orient defect is stated exactly: the artifact asserted that no test suite existed, while its evidence proved only that no implementation existed. The moving exact test count became the still-evidenced, recording-safe phrase “over two hundred and fifty checks.” The complete timed narration is 316 words, about 132 words per minute over the 2:24 picture.
Visual QA failure retained: Branded candidate v03 decoded and sampled cleanly, but the return-to-Guide frame exposed a narrow desktop-wallpaper strip. It was not accepted as final. The mask was corrected and a new v04 was rendered.
Final media checks: v04 is 2:23.967, H.264 High at 2560×1440/30 fps, yuv420p, BT.709, one silent video stream, and 21,345,511 bytes. Full-file decode passed. An 18-frame contact sheet plus launch, REVISE, fresh APPROVE, Guide-return, and ending frames passed visual inspection. The final SHA-256 is 12383dab0b780d3d9e8c82d2f75a7b1b970bd17b67835269e8af3ff9d2e880f4.
Focused judge-test failures retained: The first two reruns each passed 2/3. The revised narration wrapped “no advance” across a Markdown blockquote line, and the initial whitespace correction still failed to account for the repeated > marker. The assertion now tolerates Markdown blockquote syntax while still requiring the exact spoken sequence “No approval, no receipt, no advance.” The corrected suite passed 3/3. After the live-rule wording was made exact, one more 2/3 run caught the stale capitalized literal No music; the replacement requires the stronger sentence contains no music. The final focused judge-document/link suite passed 3/3, and git diff --check passed.
Complete verification: The unrecorded full suite passed 252/252. The required durable rerun also passed 252/252 and is preserved in the named transcript. After the exact live-rule and font-permission wording was added, a second full suite passed 252/252 and its final durable rerun passed 252/252 in the rule-audit transcript.
Evidence: branded picture-lock result and timed video script.

2026-07-20 — Public guide truth and Koda-C naming

Owner requirement: Use Koda-C whenever prose names the product; retain lowercase koda only as the executable command. Every current guide must describe the way a first-time user can actually run the shipped release.
Documentation defects found: The root README, Quick Start, Command Manual, Security policy, and several current runtime messages still used bare “Koda.” DEMO.md incorrectly said the three-window retry still needed owner completion after the July 20 six-phase pass. GHOSTTY-TEST-GUIDE.md still presented a July 19 paused recovery as current onboarding. The macOS requirement did not say clearly enough that it belongs only to the optional automated Ghostty demo, not the filesystem gate.
Correction: The root README now maps Quick Start, Process, Commands, Security, and License. PROCESS.md distinguishes invariant project/session/gate mechanics from the adaptable phase skills. Public prose, current generated artifacts, CLI help, Guide output, recovery messages, and the bundled demo use Koda-C consistently. Quick Start and Security state that this is a one-human independent project tested only on the owner’s macOS 26.5.1 arm64 machine, while making no macOS-filesystem claim. The old Ghostty guide is explicitly historical; Quick Start is the supported first-use route.
New contract: PUBLIC GUIDE CONTRACT rejects bare product naming across the current entry docs, requires the README document map, binds npm run demo:session to the package script, checks the platform boundary and process/adaptation claims, rejects the stale owner-proof sentence, and resolves links in Quick Start, Process, Commands, Security, Demo, and the historical Ghostty record.
Focused result: The package, literal no-window full-session preparation, security, license, submission, and guide slice passed 26/26 twice.
Complete result: The full suite passed 253/253. Two durable local passes are preserved: the first 253/253 transcript and the final naming-consistent 253/253 transcript.
Post-push result: Commit 1d95af0 exactly matched origin/main before the run and passed the complete unchanged 253/253 suite. Its transcript SHA-256 is c5fb7c6be73b090a52aa77b67634ac30b112c6012c3a346bb01e0a6222f6b1c0.
State: POST-PUSH PASS. Toolkit capability public-guide-truth-v23 now binds that exact tested commit, transcript, count, and every protected launch file. A final release regression after promotion remains separate proof.
Promotion failure retained: The first focused promotion run passed 28/31. The manifest used the later promotion time as verifiedAt, while the verifier correctly requires the exact bound transcript’s Recorded at value. Quick Start and both toolkit-backed permission checks refused with the named missing claim. verifiedAt was corrected to the transcript’s 2026-07-21T03:15:22.013Z; no verifier or assertion changed.
Corrected promotion result: The same focused package, Quick Start, security, submission, and toolkit slice passed 31/31. The complete promoted local release suite then passed 253/253.

2026-07-20 — Build Week repository contract and GPL detection

Live requirement audit: The Build Week FAQ and official rules were read again. The repository must expose setup, sample data where needed, running guidance, Codex acceleration, key decisions, GPT-5.6 use, installation, supported platforms, and a no-rebuild judge path. The /feedback ID must come from the primary build task and belongs in Devpost, not in public repository evidence.
Documentation change: The root README now names the repository, Developer Tools track, GPLv3 license, generated sample fixture, runtime/platform boundary, committed CLI, complete suite command, and no-install/no-build path together. Its collaboration section is titled “How Kristian, Codex, and GPT-5.6 built it” and explicitly separates owner decisions, Codex acceleration, and GPT-5.6 use.
Integrity refusal retained: An initial redundant edit to the hash-protected Quick Start made the complete durable suite pass 186/252 and fail 66 Guide/security checks with the single named cause Toolkit integrity file changed after verification: docs/QUICKSTART.md. The full failure is preserved in the stale-integrity transcript. The new official wording did not require changing the launch-bound document, so only that redundant addition was removed. The verified Quick Start hash returned exactly, and the affected Guide/security/submission slice passed 91/91. No test or verifier was weakened.
Corrected requirement result: The complete durable suite then passed 253/253 in the requirements transcript.
Live GitHub defect: Authenticated GitHub inspection reported the repository as PRIVATE and its license as Other. The license text was complete, but a custom Koda-C/copyright preface prevented standard detection. LICENSE now contains the unmodified GPLv3 text; Kristian’s sole copyright line remains in both READMEs. The license test was strengthened to require the standard opening and both sole-copyright notices instead of preserving the detector-breaking preface.
Final local result: License plus judge-document checks passed 5/5; git diff --check passed; the complete durable repository-contract suite passed 253/253.
Post-push result: Commit e0282a2 exactly matched origin/main before the unchanged complete suite ran. The durable post-push repository-contract transcript passed 253/253 and has SHA-256 ef0cc2e7e61297813c27f4c99ee18a19a16f0fa8ef115701a992662836e5d33a. GitHub then reported the license as GNU General Public License v3.0; repository visibility remained PRIVATE. Kristian also generated the required /feedback ID from the primary build task; only confirmation of that action is recorded publicly, not the identifier.
Submission-state regression: After the README evidence pointer and private /feedback handling were updated, the complete durable submission-state suite passed 253/253.

2026-07-21 — Public repository proof

Scope: Judge access and the exact no-build mechanical path from outside the development checkout.
How: A fresh unauthenticated clone of https://github.com/freeborn-warrior/koda-codex resolved commit c918bc0. The committed CLI printed help; a generated demo refused advancement without its receipt, accepted the exact receipt through the printed route, opened the Brief gate, and activated Orient. The clone remained clean.
Result: PASS. GitHub public access and the README’s mechanical judge path are now observed facts, not pending owner intent. Evidence is preserved in the public submission clone result.
Documentation-test correction: The first updated submission check passed 3/4. Its only failure expected the shortened phrase Repository access, while the checklist’s actual table label is Repository URL and judge access. The assertion was corrected to the exact visible label; no product, security, access, or gate requirement changed.

2026-07-21 — Reviewer conversational halt and terminal status truth

Live defect: In launch 17a3d86f-25d0-4b3e-887a-68f52ce059f7, the owner explicitly told Reviewer to halt because the toolkit changed after launch. The Reviewer explanation was semantically correct but emitted WAIT FOR GATE; the controller wrote direction 59916d43-d0c4-4da3-a078-ce24dc2d24aa instead of opening halt. No later gate released it.
Live preservation: The existing verified halt engine was compared with the launch-version implementation before use. It immutably halted session 2026-07-20-01, pushed commit cb8d372, preserved the exact owner reason in halt 6cbb0460-a7fb-4308-a12f-e5a33df469ea, and left Summary void.
Repair: Exact /halt and Halt this session... forms now route before any model turn to a numbered confirmation. The shared Reviewer skill has one exact OWNER DIRECTION — HALT REQUESTED boundary for other explicit language. Confirmation reuses the established exact-path Git halt; cancellation changes nothing, and neither route may create waiting direction. Guide and relay status derive terminal halt from pushed session evidence, so stale PAUSED_ERROR no longer invites recovery; forged terminal labels still refuse.
Honest bootstrap refusal: Before the provisional development integrity hashes were assembled, the first targeted run passed 36/95 and failed 59 toolkit-backed checks because changed protected files correctly refused. This was the expected integrity bootstrap, not a weakened verifier.
Development correction: The next targeted run passed 95/96. Its one failure caught an over-broad inference that pushed normal close should become COMPLETE before Guide return. The implementation was corrected so only pushed halt directly supersedes a stale runtime label; close remains in its required finalization ceremony. The focused correction passed 6/6.
Complete result: The durable local suite passed 258/258 in the initial transcript. After the public, incident, security, backlog, and plan records were added, the final documented tree passed the unchanged 258/258 suite again in the final local transcript. The focused security, toolkit-integrity, status-truth, and halt slice passed 33/33. The current security judgment is recorded in audit 26.
Actual-run status check: Against the halted live project, Guide reports BETWEEN SESSIONS, State: HALTED, and that the saved PAUSED_ERROR label is superseded by pushed halt evidence. Relay status agrees. guide recover refuses with No active session needs recovery.
Post-push result: Repair commit 53bebfc exactly matched origin/main before the unchanged complete suite ran. All 258/258 checks passed in the post-push transcript, whose SHA-256 is d2410fd34dc84bb36c3739b77fad405702c2314e310e111340f296a25382fbce.
State: POST-PUSH PASS. Toolkit capability reviewer-halt-status-v24 binds repair/tested commit 53bebfc, the exact transcript timestamp/hash/count, the changed Reviewer/Guide/status surface, and the halt classifier/compiled engine.
Promoted release confirmation: After capability v24 and the public evidence links were committed and pushed at beec682, the complete unchanged suite passed 258/258 again in the release transcript. Its SHA-256 is b3323064b31953e25e2ae1b4ebfc497c8807fa2296a41473a610c49ff0d3042b.

2026-07-21 — POSIX test-shell portability

External observation: An outside fresh-clone Linux run was reported against the earlier 253-test public state: 246 passed, six skipped, and one failed. The failure was tests/guide.test.ts executing a shell-agnostic printed status command through macOS-specific /bin/zsh, which did not exist on that Linux system. The exact Linux distribution, Node version, commit, and raw transcript were not supplied, so this remains attributed external evidence rather than a repository-reproduced Linux certification.
Inspection: Current code contained one active /bin/zsh execution, in that test helper. The only other current test occurrence asserts that a generated Ghostty role request does not contain /bin/zsh. Historical model-event archives retain their observed commands and were correctly left unchanged.
Correction: The helper now invokes /bin/sh -c. The printed command uses POSIX shell quoting and requires no zsh feature. Product runtime, gate behavior, optional Ghostty integration, and platform claims are unchanged.
Focused result: The exact Guide runtime test passed 1/1 through /bin/sh.
Complete local result: The complete current suite passed 258/258 in the durable transcript.
Post-push result: Commit dc905ce exactly matched origin/main before the unchanged complete suite ran. The suite passed 258/258 in the post-push transcript, whose SHA-256 is 864fcaf3ed6f97d644872f0b7be28a7810aaba5320f49541dfac7b27a62f81a9.
State: POST-PUSH PASS. A fresh Linux rerun remains welcome external confirmation; Koda-C does not broaden its supported-platform claim from this one reported run alone.

2026-07-21 — Dual Ghostty and manual-terminal launch exploration

Owner ruling: Preserve the automatic Ghostty path and recorded video. Explore a second path on branch codex/manual-terminal-launch where the owner opens the terminals personally; merge only if both interfaces are proven over the same session, evidence, review, and gate.
Architecture: Shared clean-environment role launchers now live outside the Ghostty adapter. Ghostty only requests macOS windows; manual mode prints the exact Reviewer-first and Producer-second launcher paths. Both paths use mode-700 files, absolute bound paths, a cleared environment, tamper checks, role locks, and the same runtime ID.
Focused pre-bootstrap result: Four unaffected checks passed 4/4: Guide’s three-way launch choice, shared launcher determinism, executable clean-environment behavior, and the updated session-prompt skill contract.
Honest bootstrap refusal: The first durable full run is preserved in the bootstrap transcript. Toolkit-backed checks refused because protected launch files no longer matched capability reviewer-halt-status-v24; the integrity guard was not bypassed or weakened. The run also caught one new public-guide assertion whose wording did not permit a line break between “manual” and “surface”; that assertion was corrected to match the exact visible sentence without changing the requirement.
First integrity-enabled full result: The durable first full transcript passed 258/262 and exposed four exact defects: one hyphenated UI assertion, explanatory prose after a supposedly executable final status line, and two tests that changed KODA_CODEX_BIN between interfaces and therefore correctly tripped launcher tamper protection. The status command is final again; the wording check matches the visible hyphenation; and both coexistence tests now hold one configured executable across surfaces. The exact correction slice passes 4/4.
Corrected local result: The complete durable local transcript passes 262/262.
Unchanged pushed result: Branch commit f3b93fa exactly matched origin/codex/manual-terminal-launch before the durable post-push transcript passed 262/262. Transcript SHA-256: 672e3cb0dcc51d8ab9e96f506909121505d35f40b027aa55c961448d9d8ec7ec.
Security: Audit 27 records a post-push pass for shared clean launchers, path quoting, environment isolation, tamper and duplicate refusal, surface switching, recovery, status truth, and the unchanged same-user threat boundary.
Promotion: Capability dual-launch-surface-v25 binds repair commit 4a134f0, pushed test commit f3b93fa, all 262 named checks, the exact transcript hash, and the shared launcher plus Ghostty/Guide protected files.
Promoted release result: Commit c7c7cb0 exactly matched its pushed branch before the complete release transcript passed 262/262 again. Transcript SHA-256: 69b9d66c3d9df69b4a7364fda4065d6400709668a0c03f5214c130c7780b5734.
Merged-main result: main fast-forwarded without a merge commit or history rewrite. Pushed main commit 519fb4d matched origin/main before the complete main transcript passed 262/262. Transcript SHA-256: b582663d8924dd481644d347db9768e41394d030e8e33a1a73d7ca4773d0c48b.
State: RELEASE PASS. The branch satisfies the mechanical and security merge condition. A later owner-observed manual-terminal model session is welcome UX proof, not a hidden requirement for the gate or recorded Ghostty demonstration.

2026-07-21 — Ghostty judge path and narrated video candidate

Owner requirement: Tell judges exactly how to reproduce the recorded Ghostty flow while keeping the ordinary-terminal choice explicit, then fit the supplied narration parts to the established 2:24 picture without changing any source.
README correction: The complete-session section now says that reproducing the video requires macOS, Ghostty, npm run demo:session, and launch choice 1. It separately states that choice 2 uses ordinary terminals and does not require Ghostty. Personal terminal theming is presentation, not a workflow dependency.
Media failures retained: The first filter expression refused on literal continuation characters. The next timeline attempt yielded 0.15 seconds. The first full-length master reached +0.3 dBFS true peak after AAC encoding and was rejected. The corrected finite loudness pass produced a 144.000-second candidate at -16.3 LUFS and -1.3 dBFS true peak. Sources were never overwritten.
Media result: Full decode passed; the candidate’s decoded video frames are identical to picture-lock v04; inherited Voice Memos identity and creation tags are absent. Exact hashes and the still-open owner listening check are preserved in result 08.
First focused documentation result: 27/28. The judge contract correctly refused when “post-push” was removed from the public evidence label. The README now says the linked 262-check merged-main evidence is post-push; no assertion changed.
Second focused documentation result: 27/28. The only refusal was the old assertion requiring narration to remain unrecorded. Because that product state had genuinely changed, it was replaced with stricter checks for the candidate filename, exact hash, duration, loudness, true peak, Ghostty reproduction steps, completed mux, and still-open full playback. The corrected slice passed 28/28.
Complete local result: The durable audio-master transcript passed 262/262. Transcript SHA-256: 3c4224207e943acea883b6f3bc563536554e063a309eb341615cbbf90f5eda48.
Post-push result: Commit d1faab3 exactly matched origin/main before the unchanged complete post-push transcript passed 262/262. Transcript SHA-256: 14495d3e076caac651883a6b00fd1b1f2afd600c5c025ef0c9c27d7430fd34a6.
State: POST-PUSH MECHANICAL PASS. Repository behavior and judge documents agree. Final listening approval, YouTube publication, and Devpost submission remain owner actions.

2026-07-21 — Narrated video v02 owner selection

Owner decision: After listening to both complete exports, Kristian selected v02 as sufficient and substantially better than v01. v01 remains untouched as a mechanically valid fallback; v02 is the submission master.
Editorial change: v02 shortens detected pauses of at least 250 ms to 150 ms before calculating any tempo fit. This kept six narrated parts closer to their recorded cadence; two of those parts now require no speed change at all.
Exact result: The selected 144.000-second H.264/AAC master has SHA-256 9d0783aaef627d50cf4080837c3f2fe847a9bf12f2ad4a9729236a0e68e39a4e, measures -16.3 LUFS integrated and -1.4 dBFS true peak, decodes completely, and has video frames identical to picture-lock v04. Raw Voice Memos identity and creation metadata are absent.
Evidence: Timing changes, file hashes, media inspection, and the remaining publication actions are preserved in result 09.
Repository result: The first complete suite containing the exact v02 master assertions passed 264/264 in the local transcript.

2026-07-21 — Manual-terminal multi-part acknowledgement repair

Owner-observed defect: The manual Apple Terminal session bound to launch 1c2a5c0f-d578-4d64-822b-ee99fa184133 reached Produce after three successful acknowledgements. Terra returned APPROVE WITH COMMENTS; after Kristian entered the correct code and comments, the CLI stopped with Node’s unsettled-top-level- await warning. Status reported phase 4 of 6 and no Produce acknowledgement or advancement. The gate failed closed.
Root cause and scope: Reviewer sent receipt plus comments through stdin, but a new readline interface per prompt let the first interface consume both lines. The second prompt waited on an exhausted stream. DISCUSS owner rulings shared the same risk; one-line APPROVE did not.
Red proof: The first new APPROVE WITH COMMENTS controller regression failed 0/1 with the same warning before implementation changed.
Repair: Non-terminal stdin is read once and queued line by line. Interactive terminal prompting is unchanged. Receipt, comments, and rulings remain out of process arguments and environment variables.
Green focused proof: The affected comments and ruling cases passed 2/2; gate mutation plus printed commands passed 36/36; and the exact security boundary passed 1/1.
Honest integrity bootstrap: The first protected slice passed 78/92 and the first complete durable run passed 191/263. Every one of the respective 14 and 72 refusals named changed protected src/commands.ts before a new capability existed. The full refusal transcript is preserved here, SHA-256 b64690e2936a5f1dffba11d2fd7ded73830e4b6dac751e25d2004fe78bbc857b.
Integrity-enabled result: Provisional capability owner-comments-pipe-development-v0 binds repair commit 4dc31b5 to the exact three-check bootstrap pass. The complete suite then passed 264/264 in the local transcript, SHA-256 5dca2b914f6ab217f720430970d450e0ea6d29dabc7b0828d89a3f7e190b5f3c.
Detailed incident: Result 10 preserves the live identifiers, zero-write outcome, repair, and recovery boundary.
Post-push result: Commit f77f10c exactly matched origin/main before the unchanged complete suite passed 264/264 in the post-push transcript, SHA-256 f02c4025643341a32c3848cc198a23c34c1c90f8566a19437e0c27653dbfa0a9.
Security: Audit 28 records the stdin queue, argument/environment boundary, fail-closed live result, and unchanged same-user/process-input limitations.
State: POST-PUSH PASS. Capability multi-part-owner-ack-v26 binds repair commit 4dc31b5, pushed tested commit f77f10c, all 264 named checks, the exact transcript hash, and every protected runtime file. The interrupted owner session is not called a clean post-repair completion.
Promoted release confirmation: After the v26 manifest, security audit, and public evidence links were pushed at bf204f7, the unchanged complete suite passed 264/264 again in the release transcript, SHA-256 2d00456b3788880b1a62c0729a91de45bc5ee62ef5af50d2730dd0c3a859ea2f.

2026-07-21 — Exact preserved-session acknowledgement recovery

Why another mechanism was required: The v26 input repair made future multi-part acknowledgements work, but it correctly did not reinterpret the already-failed runtime. Guide therefore continued to withhold recovery for launch 1c2a5c0f-d578-4d64-822b-ee99fa184133 rather than guessing from an error string.
Red proof: Before the recovery classifier existed, the exact Guide fixture returned no recovery roles and the Reviewer refused the saved unsettled-await job. The three new focused cases failed 0/3.
Recovery contract: Eligibility requires the exact old warning in runtime, job, and Reviewer state; the same launch/session/phase/job/review path; unchanged Producer and Reviewer context IDs; matching guide-launch.json; prior advancement and acknowledgement counts ending at the active phase; unchanged artifact and review evidence; and no current receipt entry in the ledger.
Mutation result: Changing only the error signature yields ordinary Guide attention rather than recovery. Changing the artifact, job identity, Reviewer context, or approval ledger refuses with the named violated condition.
Surface result: The valid fixture reports SESSION RECOVERY READY, restores Reviewer before Producer for either automatic Ghostty or manually opened terminals, and records a distinct multi-part-owner-ack-input-retry recovery reason. The same Reviewer process reopens the bound review and preserves the supplied comments.
Focused results: Exact valid recovery plus mutations pass 3/3; the entire Guide and Reviewer controller slice passes 84/84.
Complete development result: The complete durable suite passes 267/267 in the recorded transcript, SHA-256 6e21f2ef4033316569ca0397265e216fc3643f811f77e6eee54c8ee0039d9509. The run name anticipated an integrity refusal, but the already-installed development manifest allowed the complete suite to execute; the file truthfully records PASS and the name is retained rather than rewritten after the result.
Post-push result: Repair commit 894a747 exactly matched origin/main before the unchanged complete suite passed 267/267 in the post-push transcript, SHA-256 a7b30086cdb08baa5be494d1b8a45d22ee12fbc1c9a0508dbcdf847af973b2a0.
State: POST-PUSH PASS. Capability bound-owner-ack-recovery-v27 binds the exact repair/test commit, transcript, count, and protected runtime files. Owner-observed continuation of the preserved session remained required at this point and was completed in the follow-up below.
Promoted release confirmation: After the v27 manifest and public evidence were pushed at a496742, the unchanged complete suite passed 267/267 again in the release transcript, SHA-256 68d0df3f3167566f41ae54b56824bb181bb388bef14f1e04f54e373d8b083269.

2026-07-21 — Owner-visible manual-terminal recovery and pushed close

Surface: Guide’s manual-terminal choice using the generated Reviewer-first and Producer-second launchers; the same relay and gate as the Ghostty adapter.
Preserved state: Launch 1c2a5c0f-d578-4d64-822b-ee99fa184133, session 2026-07-21-01, original Sol/medium Producer context, original Terra/medium Reviewer context, original Produce review, and no pre-existing Produce ledger entry.
Observed recovery: The old Guide process was safely closed so the promoted v27 controller could load. Fresh disk status then reported SESSION RECOVERY READY. Guide restored Reviewer before Producer; neither a replacement session nor a replacement review was created.
Acknowledgement result: The same APPROVE WITH COMMENTS review accepted the displayed review code and saved Kristian’s one-line comment. The ledger contains one Produce entry, and the gate advanced to Live.
End-to-end result: Live and Summary received fresh approvals. Final state is 6/6, with 6 owner acknowledgements, pushed close commit ed4ad4d, and Guide-return commit 2a9bd706. Both role contexts remained unchanged; no waiting direction or Reviewer job remained.
Security check: The complete demonstration working tree, every reachable commit, and the selected public copies produced no match for the bounded credential/provider-key/private-key signature scan. The restorable bundle verified as complete with HEAD, main, and origin/main equal.
Evidence: Owner-visible result 11 includes the review, ledger, final state, close, Guide return, compact transcript, pre-repair Reviewer events, Git evidence, and complete history bundle.
Complete repository result: The durable per-test transcript passed 267/267 with zero failures or skips. Transcript SHA-256: 63d6f52d97685b656152eb98fdf23bb0ba1fef4a682932cb04638af46e501987.
Post-push confirmation: Evidence commit ddb0728 exactly matched origin/main before the unchanged complete suite passed 267/267 again in the post-push transcript, SHA-256 ffd8608918aa5794a06ad380741ff3d3537ea8eae7deb0559afac1900e5e63d3.
Honest boundary: This was a repaired continuation of a real pre-repair failure, not a fresh uninterrupted post-repair run. It proves exact saved-state recovery and completion; it does not relabel the failed first attempt as clean.