[Zacharon]

PR #10 and #11 implement competing handoff lifecycles in the same files. This consolidates their useful capabilities into one bounded controller: explicit synthetic-local authorization → existing public.4 packet/handoff contracts → one exact file candidate plus source-hashed issue inventory → mechanical acceptance, rationale coverage and an applyable patch. Pure inspect-export validates a local GitHub export without creating or authorizing a task.

Recommendation: use #10's execution architecture with #11's strict export parsing, escaped untrusted context, inventory comparison and Windows/Ubuntu × Python 3.11/3.14.5 matrix. Engineering review, PowerShell/manual route, public-safe implementer receipt.

Corrections from review:

• Reject preauthorization worktree drift before approval/staging, including unknown paths before reading their contents. Original Add bounded synthetic issue-to-AEOS handoff proof of concept #10 could absorb an unrelated file into its baseline.
• Verify patch applyability inside normal verification; independently compare inventory even after worker artifact rehashing; require exact declared/actual scope and no canonical writeback.
• Pin controller/Git locator and sanitize inherited Git routing, hooks, signing, line endings and fsmonitor.
• Capture and parse one issue byte snapshot for selected context, archived evidence and input hashes. The new regression reproduces a changing export splitting the original implementation's two reads.
• Arrange the Windows tampering fixture using existing-file update mode so Git's hidden locator can be corrupted deliberately and the safeguard is actually tested.

Verified final head 507ea4d8d694f902ed59b9c51c72afe615ae8b35, tree 4a61a260523d5af666635166e88643a43b05f802 (GitHub tree equals tested local tree):

• Linux CPython 3.12.14: 35 repository tests (27 prototype), 40 frozen public.4 handoff/rationale tests and 20 scanner tests passed, no skips. Fresh synthetic handoff/inventory/patch-apply verification passed.
• Final four-job prototype/public.4 matrix: all four jobs passed, each running 27 prototype tests, 40 public.4 contract tests and the 42-file public.4 manifest check.
• Final Windows CPython 3.14.5 package validation: passed. This separately checks the older unpublished candidate and repository regressions.
• Final full-history boundary CI: passed; 271 tracked files and 192 historical blobs, shallow=false, no findings. Whitespace checks passed.
• Frozen distribution/archive/site bytes are unchanged. Main remains f8b6258af5ed421c5c6803473ac92233378e701c.

Known limitation: the initial broader Ubuntu/Python 3.14.5 matrix failed the unchanged historical candidate ZIP deterministic-byte rebuild comparison while its prototype tests passed. That archive/toolchain portability issue remains uncorrected and documented. The dedicated matrix covers prototype/public.4; full repository regressions remain in the existing Windows package workflow. No archive was rebuilt or regression removed.

This remains a draft. Original engineering review and the later intake correction were independently examined, but the implementers cannot award their own final H3. Before integration: separate exact-head H3, documented human-authorized manual T3/assistant return, target Windows 10 acceptance, and a separate owner integration decision. CLI opt-in is not authenticated identity; worktrees are not OS sandboxes; hashes require trusted controller records. No autonomous model runtime, scheduler, live fetch, Docker, mandatory paid API, private-vault access, merge, release, deployment or Gold writeback is added.

Supersedes #10 and #11. Both originals are closed without merge; their original branch heads and history remain intact.

[Zacharon]

Independent comparison reproduced both original suites (#10: 24 repository tests; #11: 20 prototype tests) and the preauthorization-baseline gap. I recommend this single #10-based lifecycle with #11's validation/inventory/matrix and have kept a separate local alternative unpublished.

Fresh review of 9417bb9's exact tree reproduced 34 repository tests on Linux 3.12.14. Hosted Windows Python 3.11 job 124675947344 failed before exercising the locator safeguard: write_text uses CREATE_ALWAYS on Git's hidden .git locator and raises PermissionError. Open the existing fixture locator with r+b, write the tamper bytes and truncate; retain the rejection assertion. The Ubuntu 3.14 historical ZIP byte mismatch is separately documented by 228f22c and the scoped matrix is appropriate while existing Windows package validation retains full repository coverage.

I am preparing the narrow Windows tamper-fixture correction against the current branch using an expected-head lease. No merge or H3 acceptance is implied; native Windows 10/manual transport and independent acceptance remain pending.

[Zacharon]

The 83cc477 Windows jobs still fail on locator.write_text even after chmod (jobs 124676557444 and 124676557574). This confirms the hidden-file truncation issue remains; the correction uses chmod plus opening the existing locator with r+b and truncate. I have also added a regression for intake reading the export twice: changing it after the first read could split archived bytes/input hash from selected context. The narrow follow-up captures/parses one byte snapshot for prepare and inspect-export. Linux checks currently pass 35 repository tests (27 prototype), 40 public.4 contracts and 20 scanner tests. I will publish only these follow-up corrections onto this PR with an expected-head lease; no competing PR or merge.

[Zacharon]

Published the intake-evidence correction as 507ea4d on this same PR. The GitHub tree 4a61a260523d5af666635166e88643a43b05f802 exactly matches the tested local tree. No competing branch/PR was published.

prepare and inspect-export now parse and hash one captured byte snapshot. The new regression changes the input immediately after its first read and checks that selected context, archived export and input hash remain aligned. Local Linux 3.12.14 verification: 35 repository tests (27 prototype), 40 public.4 handoff/rationale tests, 20 scanner tests; zero skips. Fresh synthetic handoff/inventory/patch-apply verification, 42-file public.4 manifest, 271-file tracked boundary scan and whitespace checks passed. Frozen package/archive/site bytes are unchanged.

The Windows r+b locator correction from 493458c is preserved. Fresh hosted matrix, package validation and full-history scans are required for 507ea4d; earlier green runs do not cover it. Independent H3 of the new correction, target Windows 10, manual transport and owner acceptance remain pending.