Workflow policy: pull_request reachability rules (supersedes #682) and a ParseScalar-exact guard check

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: it supersedes Workflow hardening: no pull-request job reads a secret or holds a new write scope #682 (held at 6e166809; to be closed after this merges). It folds the Workflow hardening: no pull-request job reads a secret or holds a new write scope #682 assertions that CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681's tests/test_workflow_policy.py did not yet hold into that module as three rules on the parsed workflows, each with planted negative controls and accepted variants. It also fixes the coordinator's two P2 residuals on CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681's excludes_pull_request and qualifies the Dependabot token wording.
• Base commit: 6af8e55bd9e8f51aaafbf0304e510c11aaa71a6a (origin/main, CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681). Head: 33276786006a664b3c309b7d626ade654cec76ca, which merges origin/main at b629b5b4 (Retire the WSL retrieval lock as package-lock.json.frozen (Dependabot alert 17) #688, New-WSL: Codex 0.160.0 profile pins, main-checkout Codex trust grant, Opus 5.5 model (follow-up to #626) #683) through the hot-file protocol's merge path, after one review repair round (see "Cross-family review of aeb5ba25" below).
• Lane: lane:foundation
• Owned paths touched: tests/test_workflow_policy.py; docs/decisions/2026-10-04-ci-least-privilege.md (new dated section); docs/decisions/2026-09-22-github-automation-closure.md (one sentence qualified); manifests/evidence.json (the three rows re-registered, in the last commit only, per docs/lanes.md). No workflow changes.

The three rules (in RULES; check_directory() now reads the directory as a whole):

Rule	Fails on	Planted (each must fail with exactly this rule)	Accepted (must pass)
pull-request-environment	an environment: on a job that a pull_request-family event reaches, whatever its if:	environment-on-a-pull-request-job, environment-behind-an-if-guard, environment-on-a-comment-job, environment-in-a-called-workflow (two files: a pull_request caller and a workflow_call callee)	environment-off-the-pull-request-family (push only)
pull-request-remote-workflow	such a job calling a reusable workflow by anything but ./.github/workflows/{file} or $/.github/workflows/{file}	remote-reusable-workflow (pinned by SHA, so zizmor's unpinned-uses passes it), remote-call-in-a-reusable-workflow	remote-call-off-the-pull-request-family, local-reusable-workflow-call and same-commit-call-with-the-dollar-form (two files each)
comment-event-secret	a secret other than GITHUB_TOKEN (named, secrets: inherit or the whole context; decoded values, then the raw text, as pull-request-secret reads them) in a workflow that issue_comment, pull_request_review or pull_request_review_comment triggers	issue-comment-secret, review-secrets-inherit, review-comment-secret-behind-an-escape (secrets); from the review round: issue-comment-whole-context-after-a-quoted-marker, review-whole-context-after-a-quoted-marker, review-comment-whole-context-after-a-quoted-marker, comment-call-passing-an-indexed-secret-after-a-quoted-marker, comment-secret-by-a-computed-index	comment-workflow-with-the-job-token; from the review round: comment-workflow-with-the-job-token-by-index, comment-workflow-with-the-job-token-by-a-double-quoted-index

Reachability (reachable()). The pull_request family is #682's event set: pull_request, pull_request_target, pull_request_review, pull_request_review_comment, issue_comment and workflow_run. A workflow is reached by one of those triggers, and then, as #682 computed it, through every ./ or $/ call that a reached job makes, transitively and whatever the callee's own triggers. After that, a workflow_call trigger alone counts, as #681's PULL_REQUEST_EVENTS already counts it. The reason is that adoption/scaffold/.github/workflows/sota-sources.yml.template calls sota-sources-gate.yml from other repositories' pull_request workflows. This last step is stricter than #682 (see open points).

The two job rules do not credit if:. The module's one accepted guard, github.event_name != 'pull_request', still lets issue_comment and review runs through, and in a called workflow github.event_name is the caller's. A new test, test_reachability_follows_local_calls_and_names_the_caller, checks two things: a violation in a callee names its caller, and a call is followed through a $/ hop to a callee that has no workflow_call trigger.

On the base's 21 workflows, no job declares environment:, no job calls a reusable workflow, and no workflow has a comment or review trigger. All three rules therefore pass on the real tree with no exemption.

The P2 residuals on #681's excludes_pull_request (repair round 2). The helper now follows actions/runner's TemplateReader.ParseScalar. A value either holds no ${{ (a bare expression), or opens one at its first character and closes it, quote-aware, at its last. The expression's text outside string literals may hold no delimiter.

• (a) strip() accepted literal whitespace around a whole expression. ParseScalar keeps that whitespace as a literal segment of a truthy format() string.
  • Planted regressions: upload-guard-with-a-leading-space, upload-guard-with-a-trailing-space, upload-guard-in-a-clipped-block-scalar (the line break a | scalar keeps), save-guard-with-a-leading-space and save-guard-with-a-trailing-space.
  • Unit cases: " ${{ ... }}", "${{ ... }} " and "${{ ... }}\n".
• (b) The }} substring check refused valid guards. ParseScalar closes an expression only at a }} outside a single-quoted literal.
  • Accepted regressions: upload-guard-with-a-quoted-closing-marker and save-guard-with-a-quoted-closing-marker.
  • Unit cases: contains('a}}b', 'a'), bare and wrapped.
  • The discriminating refused case: a quoted ${{ in a bare value (contains(github.head_ref, '${{ github.sha }}')) still starts a segment, because ParseScalar finds the first ${{ with IndexOf, whatever the quotes.

Dependabot wording (the P2 in the review of #682 at 846cb03e). docs/decisions/2026-09-22-github-automation-closure.md said "fork and Dependabot PRs get a read-only token". It now says that Dependabot's token is read-only by default (it can be raised), citing GitHub's "Changing GITHUB_TOKEN permissions". No other test or document on main states the Dependabot token. The check was a scan of every tracked .md, .py, .json, .yml, .yaml, .toml and .txt file for "Dependabot" within 250 characters of "read-only". #682's own wording never reached main.

Cross-family review of aeb5ba25 (FINDINGS; one repair round, in d73e617e5). Both findings reproduced before the fix. They sit in the secrets scan that pull-request-secret, comment-event-secret and test_pull_request_jobs_hold_no_secret_and_no_write share.

• P1. secret_references() delimited expressions with \$\{\{(.*?)\}\}, which stops at a }} inside a string literal. As a result, TOKEN: "${{ format('a}}b{0}', toJSON(secrets)) }}" gave no violation under any of the three comment/review events, nor under pull_request. The same held for secrets['NPM_TOKEN'] after the marker, including in a called workflow's secrets: mapping.
  • Fix: tests/test_workflow_policy.py:567 adds expressions(), which delimits as ParseScalar does, via expression_end() (:483, now taking a start offset). An expression that never closes is read to the end. secret_references() (:589) reads those spans (:598).
• P2. secrets['GITHUB_TOKEN'] was flagged while secrets.GITHUB_TOKEN passed, although index and property syntax access the same value (Contexts reference).
  • Fix: SECRET_INDEX (:586) normalizes index access by one single- or double-quoted literal, unescaping '', to the name it indexes, before the token exception applies (:600).
  • The whole context (secrets, toJSON(secrets), secrets.*) and an index that is not one literal (secrets[format('{0}_TOKEN', 'GITHUB')]) stay violations, whatever they compute.
• New controls.
  • Planted (each must fail with exactly its rule), at :994–:1008: the reviewer's env form under each of the three events, an indexed secret after a quoted }} in a call's secrets: mapping, and a computed index, all comment-event-secret; plus the env form under pull_request, pull-request-secret.
  • Accepted, at :1100–:1102: the token by single- and by double-quoted index.
  • Unit test test_secret_references_delimit_expressions_as_parse_scalar_does (:1352): 5 allowed and 9 refused forms, plus the span split.
• Decision record. docs/decisions/2026-10-04-ci-least-privilege.md:291 records the round.
• Not changed. The reviewer's non-blocking note that the reachability test's leaf.yml (on: workflow_dispatch) is not a GitHub-runnable callee: it is deliberate, to show that a call is followed whatever the callee's triggers, as the record states.

Map of #682's assertions (class PullRequestReachableJobsTests at 6e166809):

#682 assertion	Where it lives now
Reachability: on: names a pull_request* event, issue_comment or workflow_run; local reusable workflows are followed transitively	This PR: PULL_REQUEST_FAMILY and reachable(), which also counts workflow_call alone (stricter)
Every YAML-significant line stays in a plain block subset: no non-empty flow mapping, anchor, alias, tag, merge key, quoted key, multi-line scalar or backslash escape	#681: the strict loader and the unparseable rule (StrictLoaderTests.test_constructs_outside_the_subset_are_rejected; planted anchor-and-alias, flow-mapping, tag, multi-line-plain-scalar, duplicate-permissions-key, tab-indentation). Quoted keys and escapes are decoded rather than refused (planted secrets-inherit-under-a-quoted-key, secrets-inherit-under-an-escaped-key, secret-behind-a-u-escape, secret-behind-an-x-escape)
Every on: yields events	#681: load_workflow requires on, and triggers() reports any other form as unparseable
The job layout jobs() reads: headers at two spaces, keys at four, and a matching header count	Not needed: #681's loader reads every job, and load_workflow requires a non-empty mapping of job mappings
A reachable job's ./.github/workflows/x is a workflow file here	Not carried: a ./ or $/ path names a file at the caller's commit, and every file present is checked on its own; reachable() follows the call when the file is present
PyYAML cross-check of the event reader	#681: test_the_loader_agrees_with_pyyaml compares the whole parsed tree (now 84 texts)
No ${{ }} naming the secrets context (secrets.X, secrets['X'], toJSON(secrets), comment lines included) in a pull_request workflow or a callee	#681: pull-request-secret (decoded values, then the raw text with comments) for pull_request and workflow_call workflows
The same in a pull_request_target or workflow_run workflow	#681: dangerous-trigger bans both triggers
The same in an issue_comment, pull_request_review or pull_request_review_comment workflow	This PR: comment-event-secret
No secrets: key (secrets: inherit, a mapping, or a workflow_call declaration)	secrets: inherit: #681's pull-request-secret, plus comment-event-secret here. A mapping that forwards ${{ secrets.X }} is caught by that reference. A declaration with no use, or literal values, reads no secret and is not carried
secrets.GITHUB_TOKEN refused	Not carried (open point). #681 accepts it (accepted variant github-token-secret), and comment-event-secret follows that, now in both access forms (secrets.GITHUB_TOKEN, secrets['GITHUB_TOKEN']). It is the job's own token, also github.token, bounded by pull-request-write-scope and WRITE_GRANTS
No environment: on a reachable job	This PR: pull-request-environment
No remote reusable-workflow call from a reachable job	This PR: pull-request-remote-workflow
PULL_REQUEST_SECRET_SOURCE_ALLOWLIST (empty), where stale entries fail	#681: EXEMPTIONS and test_each_exemption_is_still_needed, which now runs over the directory-wide pass
The write scopes of reachable jobs equal PULL_REQUEST_WRITE_ALLOWLIST in both directions (the two SARIF uploads)	#681: pull-request-write-scope and WRITE_GRANTS (test_write_grants_are_the_reviewed_inventory, an equality over every job of every workflow)
write-all is refused, and so is any workflow-level write	#681: writes() treats any non-mapping form as a write, and workflow-permissions-not-empty requires a top-level {}
A job with no permissions under a workflow with none (the repository default)	#681: workflow-permissions-missing, and writes() counts the default as a write
A permissions form or access value it does not read	#681: non-empty flow mappings are unparseable, and writes() counts any access other than read or none as a write
if: is not credited for write scopes	Differs: #681 credits a whole github.event_name != 'pull_request' conjunct, now matching ParseScalar exactly (repair round 2). Both SARIF uploads pass through it
Its decision-record section and the PULL_REQUEST_EXPOSURE wording	docs/decisions/2026-10-04-ci-least-privilege.md, "Reachability rules and repair round 2". The Dependabot qualification is applied to the one such sentence on main

SOTA sources

All were read on 2026-10-04 at 08:18Z; GitHub Docs were fetched through the docs article API. The older page URLs named in the brief redirect to the ones below.

• GitHub Docs, Secure use reference (formerly "Security hardening for GitHub Actions"):

  • untrusted input: "the preferred approach to handling untrusted input is to set the value of the expression to an intermediate environment variable";
  • "The pull_request_target and workflow_run workflow triggers, when used with the checkout of an untrusted pull request, expose the repository to security compromises";
  • required reviewers protect environment secrets.

• GitHub Docs, Using secrets in GitHub Actions: "With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository"; "Secrets are not automatically passed to reusable workflows".

• GitHub Docs, reusable workflows:

  • Reuse workflows, "Using inputs and secrets in a reusable workflow": secrets: inherit; "If you include environment in the reusable workflow at the job level, the environment secret will be used, and not the secret passed from the caller workflow".
  • Reusing workflow configurations, "github context": "the github context is always associated with the caller workflow".
  • Workflow syntax, jobs.<job_id>.uses: the $/, ./ and {owner}/{repo}/...@{ref} forms; a same-repository call is "from the same commit as the caller workflow". Also jobs.<job_id>.secrets.inherit.

• GitHub Docs, Managing environments for deployment and Deployments and environments, "Environment secrets": "Secrets stored in an environment are only available to workflow jobs that reference the environment. If the environment requires approval, a job cannot access environment secrets until one of the required reviewers approves it."

• GitHub Docs, Events that trigger workflows:

  • issue_comment runs the default branch's workflow;
  • pull_request_review and pull_request_review_comment: "Workflows in forked repositories";
  • workflow_run "is able to access secrets and write tokens, even if the previous workflow was not".

• GitHub Docs, Troubleshooting Dependabot on GitHub Actions, "Changing GITHUB_TOKEN permissions": "By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. You can use the permissions key in your workflow to increase the access for the token".

• zizmor docs/audits.md at v1.30.1 (99a054ed9283c90abdd2d5b9fb5101d27dde9783), the version .github/requirements-ci.txt pins:

  • dangerous-triggers (pull_request_target, workflow_run);
  • secrets-inherit;
  • unpinned-uses (branch or tag refs; a SHA-pinned remote call passes);
  • self-repository, new in 1.30.0: prefer $/ to ./, which is why both forms are local here.

  None of them flags an environment: on a pull request job or a secret in a comment-triggered workflow.

• actions/runner src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateReader.cs at d7bc179baf11a02110b46cfbbc4040f74ac3f60a, ParseScalar and AddString: the scan that the repair-round-2 helper and, since the review round, expressions() mirror.

• GitHub Docs, Contexts reference, "Available contexts": "you can access context information using one of two syntaxes. Index syntax: github['sha']. Property dereference syntax: github.sha" (P2). Evaluate expressions in workflows and actions: "Literals" (strings take single quotes; "Wrapping with double quotes (") will throw an error") and format ("Escape curly braces using double braces") (P1). Both read 2026-10-04 at 14:15Z.

• Implementation references: CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681's module at 6af8e55b (the loader, workflow_secret_references, the planted-control pattern and EXEMPTIONS), and Workflow hardening: no pull-request job reads a secret or holds a new write scope #682's reachability computation at 6e166809.

Evidence-class table

Claim	Evidence class	Command / receipt
The three rules pass on the 21 workflows of main at b629b5b4 (merged in, including #688's security-scan.yml change), and both modules pass	local_integration	python3 -m unittest tests.test_workflow_policy tests.test_workflow_hardening: 138 tests, OK (skipped=3), exit 0 (base 6af8e55b: 136, exit 0)
Each of 59 planted entries fails with exactly its rule, and all 15 accepted variants pass	synthetic	the same run (PlantedViolationTests)
Breaking each new rule's predicate fails exactly that rule's controls	synthetic	a mutation harness kept outside the repository; results below
#681's helper fails the repair-round-2 regressions, and reverting either review-round fix fails its controls	synthetic	the same harness, cases M4, M6 and M7
Both review findings reproduced at aeb5ba25 before the fix: [] for the quoted-marker forms under all three events and pull_request, and comment-event-secret for secrets['GITHUB_TOKEN']	synthetic	an in-memory check_directory() probe on that head
The loader agrees with PyYAML on all 92 texts, including the block-scalar, quoted-whitespace and quoted-marker forms	local_integration	uv run --no-project --with pyyaml==6.0.3 python -m unittest tests.test_workflow_policy.StrictLoaderTests.test_the_loader_agrees_with_pyyaml: OK, exit 0
GitHub's behaviour for environments, reusable workflows, events, context access, expression literals and Dependabot; ParseScalar's scan; zizmor's audits	source_review	the sources above
Hosted CI	aeb5ba25: 8/8 required green (20 pass, 5 skipping); this head is next	this PR's checks

Mutation results (at head 33276786; identical to the run before the merge). Each case runs PlantedViolationTests (12 tests) on a scratch copy of the module, with .github linked read-only. The worktree file's hash did not change.

Case	Mutation	Result
M0	none	exit 0, OK
M1	pull-request-environment never fires	exit 1, 5 failures: planted environment-on-a-pull-request-job, environment-behind-an-if-guard, environment-on-a-comment-job and environment-in-a-called-workflow, plus test_reachability_follows_local_calls_and_names_the_caller
M2	pull-request-remote-workflow never fires	exit 1, 2 failures: planted remote-reusable-workflow and remote-call-in-a-reusable-workflow
M3	comment-event-secret never fires	exit 1, 8 failures: planted issue-comment-secret, review-secrets-inherit, review-comment-secret-behind-an-escape, and the 5 review-round comment-event-secret controls
M4	excludes_pull_request reverted to #681's	exit 1, 14 failures: the 5 repair-round-2 planted guards, its 2 accepted variants and 7 unit cases
M5	reachable() stops following calls	exit 1, 1 failure: the reachability test. The workflow_call step still reaches the planted callee
M6	secret_references() back on the \$\{\{(.*?)\}\} regex (P1 reverted)	exit 1, 8 failures: the 5 quoted-marker planted controls (all three events, the call's secrets: mapping, and pull_request) and 3 unit cases
M7	every index access read as the whole context (P2 reverted)	exit 1, 7 failures: the 2 index-form accepted variants and 5 unit cases

Local commands run

All ran with nice -n 19 and a scratch TMPDIR outside the checkout, at head 33276786 (origin/main b629b5b4 merged in):

$ python3 -m unittest tests.test_workflow_policy tests.test_workflow_hardening
Ran 138 tests ... OK (skipped=3)                     # exit 0 (base 6af8e55b: 136 tests, exit 0)
$ python3 -m unittest tests.test_workflow_security_coverage tests.test_sota_sources_gate tests.test_adoption_docs_consistency
Ran 60 tests ... OK (skipped=1)                       # exit 0
$ uv run --no-project --with pyyaml==6.0.3 python -m unittest tests.test_workflow_policy.StrictLoaderTests.test_the_loader_agrees_with_pyyaml
OK                                                    # exit 0
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 9881, "profiles": 4, "receipts": 195, "status": "passed"}   # exit 0
$ python3 scripts/evidence_manifest.py --check
{"files": 9881, "status": "passed"}                   # exit 0
$ python3 scripts/component_matrix.py --check; python3 scripts/new_host_grand_list.py --check
# exit 0; exit 0 (their --write steps in the hot-file protocol changed nothing)
$ git diff --check origin/main...HEAD                 # exit 0
$ python3 -P merge_tree_landing_check.py b629b5b41 332767860    # the coordinator's landing check, against current main
ok 1 to ok 5, LANDABLE                                # exit 0
$ python3 mutation_harness.py <worktree>              # kept outside the repository; exit 0, results above

Commits: 0a876732b (content), aeb5ba259 (registry), d73e617e5 (review-round content), then 332767860, the last commit. It merges origin/main at b629b5b4, takes main's manifests/evidence.json and re-registers the three files, per docs/lanes.md's merge path. Main's #688 had edited docs/decisions/2026-09-22-github-automation-closure.md 30 lines at 465, which merged cleanly with this branch's sentence, now at 1653. The registry differs from main's in exactly those three rows.

Decision record

docs/decisions/2026-10-04-ci-least-privilege.md, section "Reachability rules and repair round 2 (2026-10-04, superseding #682)". It covers the rules, the reachability computation, why these three rules, repair round 2, the Dependabot wording, what #682 held that is not carried, zizmor as the alternative, the overturn conditions, the evidence class and the sources.

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). No workflow or action changes.
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). No workflow changes; the tripwire now also refuses environments and remote reusable workflows on pull_request-family jobs.
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

Open points

• Stricter than Workflow hardening: no pull-request job reads a secret or holds a new write scope #682: workflow_call alone counts. Workflow hardening: no pull-request job reads a secret or holds a new write scope #682 reached a reusable workflow only through a caller in this repository. This PR also counts any workflow_call workflow, as CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681's PULL_REQUEST_EVENTS does, because sota-sources-gate.yml is called from other repositories' pull_request workflows. Reversing it is one line (drop the second seed set in reachable()); the decision record names the overturn condition.
• GITHUB_TOKEN stays allowed in comment-event-secret. The brief reads "no secrets.* references", and Workflow hardening: no pull-request job reads a secret or holds a new write scope #682 refused secrets.GITHUB_TOKEN. This PR reuses workflow_secret_references for consistency with pull-request-secret. The token is also github.token, which no secrets scan sees, and its scopes are bounded by pull-request-write-scope and WRITE_GRANTS. This is the coordinator's decision to make; changing it touches one call site.
• CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire #681's guard credit. pull-request-write-scope and the cache rules credit github.event_name != 'pull_request'. That guard does not exclude issue_comment or review runs that reach a workflow_call callee. WRITE_GRANTS still pins every write grant. The new rules do not credit if:, so they do not inherit this gap.
• comment-event-secret covers the three events the brief names. issues, discussion and discussion_comment also run the default branch's workflow on outside text, and are not covered.
• A ./ callee missing from the directory is not reported (Workflow hardening: no pull-request job reads a secret or holds a new write scope #682 reported it); see the map above.
• OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489 was still open when checked at 14:23Z. Once it merges, this branch should take main and rerun OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489's gate_reads derivation and breadth-cap tests.
• No hosted run exercises the new rules yet. CI runs them in the required validate job's python3 -m unittest step.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T10:50:03.201611Z	aeb5ba2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aeb5ba2597

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 33276786006a664b3c309b7d626ade654cec76ca. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned FINDINGS at aeb5ba2597df; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with its 1 P1 item(s) resolved in one repair round as recorded.

Observed main b629b5b413d75deb4c98dd26d62b129173b87d44. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main b629b5b413d75deb4c98dd26d62b129173b87d44 head 33276786006a664b3c309b7d626ade654cec76ca base b629b5b413d75deb4c98dd26d62b129173b87d44 merged-tree 839db27a790f9a3324c95d00b3c08e3e2c212e91 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 4, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 3, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9881 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 839db27a790f9a3324c95d00b3c08e3e2c212e91)

Required checks at this head: 8 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 07a6a0a71c9d4823cc641e41b31fee58f10f7acd (parent b629b5b413d75deb4c98dd26d62b129173b87d44), tree 839db27a790f9a3324c95d00b3c08e3e2c212e91. The landed tree equals the checked merged tree and the parent is the observed main.