You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
schema/plan.schema.json: plan format v1. Claude (claude -p --json-schema) and Codex (codex exec --output-schema) both answer in it, and imported YAML or JSON plans are checked against it.
schema/plan-edit.schema.json: typed suggestions from the plan assistant.
schema/examples/: the #412 r3 plan and a suggestion reply.
docs/plan-format.md: the plain-language guide, including the checks after import.
prompts/plan-author.md: one prompt for both agents; issue text stays in a marked data block.
Design doc: "The plan format" rewritten; decision P1 and task T18 added; four new approved mockups listed.
How it was checked
Both schemas are valid draft 2020-12, meet the strict-mode rule, and pass their examples. 8 broken plans are rejected.
Live, on 2026-09-22: Claude Code 2.1.278 and Codex CLI 0.153.4 each returned a plan and a suggested edit that passed.
The tests found two things, both now documented: Claude Code rejects a $schema line for draft 2020-12, and codex exec must run with stdin closed.
Not in this PR
Code. The validation script becomes a real test in T18.
The HTML screen prototypes, which live outside the repo in the gstack design folder.
Review corrections
Task clones use git clone --local --no-hardlinks, with independent objects and no alternates back to the source. O6 and T1 require a regression check that modifying a disposable task object cannot change its source.
Import checks walk projected file state in execution order. Later items can edit files added or renamed by dependencies; missing sources and occupied destinations block approval.
Fields and validation constraints change only under a new schema version. Import validates the original version before explicit migration and current-version validation. Nullable fields remain required. T18 records the regression checks.
Validation on 270c7c9: the old clone command reproduced shared-object corruption; the corrected command used distinct inodes and left the source unchanged. Both schemas and examples passed, copied definitions matched, and an explicit v1-to-v2 migration passed. A small model of the documented projected-state rules passed five positive/negative cases. These are design probes, not production implementation tests. A hostile delimiter payload stayed inside its serialized data and round-tripped exactly. Automated review corrections also specify safe argv execution and semantic validation before applying suggestions, close Codex stdin, and align the four-status/D22 documentation. All seven review threads were addressed; no findings were declined. Live agent and Docker tests were not rerun.
Commit 06b597d clarifies script approval covers codeboost-run commands only; container/network containment must handle agent edit-and-execute. Declared final symlinks are supported while symlink parents and unsafe resulting targets are rejected. Import requires exact selected-task issue matching. Acceptance checks and schema descriptions are aligned. Both schemas compile, both examples validate, shared definitions match, and git diff --check passes. All three previously unresolved threads were answered and resolved; fresh review requested.
Follow-up review fixes
Commit d6f8a9b adds immutable v1 snapshots plus an explicit version registry, and serializes repository metadata/argv into an escaped JSON prompt block. Registry/copy consistency, schema compilation, both examples, shared definitions, serialization contract samples, and whitespace checks pass. Runtime prompt evaluations remain implementation acceptance criteria, not claimed execution evidence. Both new threads answered/resolved; fresh review requested.
Further contract fixes
Commit 4dba0a6 specifies phase-specific mounts/tool enforcement, validates head-only PR changes, unions rulesets with classic protection and blocks unknown rules, restricts v1 symlink changes to machine-identified pre-existing links, and rejects path aliases using task-filesystem identity. Acceptance cases are updated. New symlink creation is deferred to a future typed schema. Local schema/registry/example/prompt-contract and whitespace checks pass. All five threads answered/resolved; fresh review requested.
Schema identity and leaf-path fixes
Commit a46ae34 gives both retained v1 schemas unique version-qualified IDs with matching CLI copies. The ID contract check failed before the correction and now passes. Directory/root declarations and implicit descendant scope are explicitly rejected. All local schema, registry, example, shared-definition, serialization-contract, and whitespace checks pass. Three threads answered/resolved; fresh review requested. Future typed symlink creation is tracked in #5.
Exact command approval
Commit d45c846 aligns all command contracts on element-for-element full argv approval. Prefix matches and appended flags do not authorize execution; a new entry requires explicit approval separately from the plan. Current and retained schema descriptions, authoring prompt, dispatcher requirements, and acceptance cases agree. Contract/schema/example/whitespace checks pass; all three related threads answered and resolved. Fresh review requested.
Resource and nested-path boundaries
Commit bc13172 requires preallocated task storage with hard byte/inode and pool caps, rejects same-invocation declared symlink/target aliasing, and keeps gitlinks metadata-only with empty read-only nested paths plus pre-test/commit audits. The no-host-slowdown claim is narrowed. Local contract checks pass; runtime tests are explicit future acceptance requirements. All three threads answered/resolved. Library alignment is tracked in #6; typed new symlinks in #5. Fresh review requested.
Invocation trust and merge race fixes
Commit a4fc1d9 specifies vendor auth location/environment allowlisting, atomic server-side base/head guarding (automatic merge blocks without it), deterministic v1 command tokenization, immutable agent Git metadata and isolated runner config, fresh retry filesystems with actual occupancy checks, and serialized current-plan data in every agent phase. Local schema/registry/example/shared-definition/prompt-contract/whitespace checks pass. Runtime controls are future acceptance requirements, not claimed live verification. Seven threads answered/resolved; fresh review requested.
Summary consistency and scope distinction
Commit 52c0e4d makes ledger ownership and projected file-state summaries consistent, extends declared-link alias checks to directory descendants, and distinguishes otherwise-safe out-of-scope regular-file changes (commit/show for review) from unsafe changes (no tests/commit, needs human). A repeated base-race finding was already fixed in a4fc1d9. Five threads answered/resolved. All local checks pass; fresh review requested.
Gitlink and suggestion limits
Commit 21cb365 clarifies v1 gitlinks are review-only and update_file uses an immutable exact path key. Path changes require a fully validated replacement revision or independently valid add/remove edits. Contract/schema checks pass; both threads answered/resolved; fresh review requested. Gitlink authoring is a future typed runner operation tracked separately.
Deterministic parsing
Commit 012bc41 addresses a summary-only review finding with a precise JSON-compatible YAML subset, duplicate-key rejection in both formats, pre-conversion alias/tag/merge rejection, and size/depth bounds. Runtime negative fixtures are specified in T18 and tracked for implementation in #6. Local contract checks pass; fresh review requested.
Typed identity and checkpoint continuation
Commits bf9add3/f5db136 distinguish blob versus commit object IDs, preserve explicitly unowned foreign ledger entries through rewrites, and deliberately pause on safe out-of-scope changes pending an approved amendment and actual-head checkpoint reconciliation. Accepted-decision summaries are aligned. All local contract checks pass; three threads answered/resolved; fresh review requested.
Rebase ownership branch
Commit ce04c4d makes ledger ownership the first rebase-conflict decision: missing/null owners route directly to the foreign branch; only owned commits enter Px-specific handling. The accepted ledger test criteria cover this ordering. Local checks pass; thread answered/resolved; fresh review requested.
Recovery and review invariant alignment
Commit 6d2e292 aligns rejection with transitive dependency staleness, rechecks foreign/ambiguous blockers after every rebase, replaces reset/reuse recovery with fresh filesystem materialization, and corrects ownership/safety summaries. Local checks pass; four threads answered/resolved; fresh review requested.
Versioned semantics and request binding
Commit c273c94 makes Codex state writable scratch while keeping auth read-only, registers a frozen v1 semantic contract plus validator key, and binds delayed suggestions to captured stable server-side plan identity. Declined the inverted-test claim: T9 already says the suite fails if prohibited writes/processes are possible. Local schema/semantic-registry/example/copy/serialization/whitespace checks pass. All four threads answered/resolved; fresh review requested.
Retained references and adapter examples
Commits e85c016 and 65f764a replace shell launch snippets with direct process APIs and pin v1 semantic schema/example references to retained v1 files. Registry, schema/example, shared-definition, and prompt serialization checks pass; git diff --check passes. All received inline threads are resolved; requesting the next current-head review.
Metadata, symlink target, and prompt boundary follow-up
57bbeea addresses seven further comments: separate-filesystem Git metadata with no writable inode aliases; reject declared-link target mutations before safe scope handling; explicit container schema and output channels; escaped JSON lessons and revision feedback. Added runtime attack/startup acceptance cases. Local schema/contract checks pass; runtime isolation tests remain implementation work.
Approval fingerprints and runtime guarantee
f29013e explicitly binds non-line approvals to operation/path/mode/typed-object metadata and compares it at merge, with staleness cases. Clarified that symlink snapshots validate accepted states, not transient execution: runtime protection comes from container mounts/permissions/network. Declined a predeclared-target guarantee for arbitrary execution; the CLI already has intended access to its own mounted vendor credential. Added transient-link containment acceptance cases instead. Local checks pass.
Suggestion regeneration contract
858513c defines one card per revision: Apply atomically consumes its ID and stales remaining old-revision suggestions; the UI requires explicit refresh and review of regenerated cards. No silent operation rebasing. T18 now includes cross-plan same-revision/item-ID, concurrent/replay, and refresh regression cases. Also fixed the summary-only vendor-API wording finding. Local checks pass.
Identity and launch budgets
4f849bd adds stable plan/item identity to approval fingerprints and ID-only import regression coverage. Adapter pseudocode requires an enforced, startup-probed planning profile in the actual argv; missing enforcement fails closed. Defines pre-spawn byte/token caps with explicit oversize rejection and fixes the retained prompt link. All four inline/summary findings addressed; local checks pass.
Bounded output and validator registration
215cd78 specifies external bounded capture and whole-container termination for command overflow/deadlines, plus envelope headroom separate from the plan limit. Only registry snapshots enter validator registration; CLI copies resolve the same existing IDs. Local Ajv single-instance registration and all prior contract checks pass. Runtime overflow/termination tests remain implementation requirements.
Feedback closure verification
At 215cd78, all 76 review threads are resolved (zero unresolved, no further thread pages). Across 21 Copilot review rounds in this pass, the final current-head review 5287279356 reports Findings: None, has zero inline comments, and contains no actionable new summary finding. Its generic overview still mentions documentation concerns without identifying any; this is not claimed as formal approval.
Final local verification passed: strict schema compilation and single-instance registry registration; current/snapshot equality and IDs; plan/edit examples and shared definitions; prompt data serialization contracts; git diff --check. Working tree is clean. No CI checks are configured for this branch. Runtime isolation/startup/attack tests are requirements, not executed tests in this documentation PR.
Dispositions: corrected valid schema, prompt, path/symlink, runtime boundary, approval/identity, suggestion, and merge/recovery contracts. Declined the inverted-test-predicate report because the existing text correctly says the suite fails when isolation breaks. Clarified rather than promising transient-symlink prevention from snapshots: runtime boundaries govern access, including the CLI's intended credential access. One repeated base-race report was already fixed. Follow-ups are tracked in #2, #5, #6, and #7. PR remains unmerged.
- DESIGN.md: tokens, type, layout, components (provenance gutter,
file-change cards, logo), motion, and a decisions log.
- CLAUDE.md: point UI work at DESIGN.md.
- Design doc: screen specifications from the design review (D12-D28)
and mark D22 done.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- schema/plan.schema.json: plan format v1, strict-mode compatible, used by
claude --json-schema and codex exec --output-schema and for imports.
- schema/plan-edit.schema.json: typed plan-assistant suggestions.
- schema/examples/: #412 r3 plan (YAML) and a suggestion reply.
- docs/plan-format.md: plain-language guide, checks after import, versions.
- prompts/plan-author.md: one prompt for both agents.
- Design doc: rewrite "The plan format", add decision P1 and task T18,
list the four new approved mockups.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Establishes the Evidence Desk design system and versioned plan format for codeboost, including schemas, examples, documentation, prompts, and design-review updates.
Changes:
Adds strict plan and plan-edit schemas with examples.
Documents imports, validation, migrations, and agent usage.
Adds design tokens and updates design specifications.
File
Reviewed change and final findings
schema/plan.schema.json
Defines plan format v1. No review findings.
schema/plan-edit.schema.json
Defines typed plan suggestions. Moderate (3 votes, line 57):op is not conditionally linked to payload fields, allowing unusable combinations.
schema/examples/plan-edit-412-r3.json
Provides an edit example. No review findings.
schema/examples/plan-412-r3.yaml
Provides a complete plan example. No review findings.
prompts/plan-author.md
Provides the shared planning prompt. Critical (2 votes, lines 26 and 45): untrusted issue text can escape the delimiter and inject instructions; use escaped or structured data. Moderate (2 votes, line 6): Codex example omits closed stdin redirection.
docs/plan-format.md
Documents schema and import checks. Critical (3 votes, line 107): command-prefix validation permits shell operators and additional commands. Moderate (2 votes, line 103): rename target semantics are undefined. Moderate (1 vote, line 147): strict-mode additions require explicit migration or backfilling.
docs/designs/codeboost-plan-indexed-review.md
Updates design decisions and tasks. Nit (3 votes, line 320 and line 532): D21 specifies four checks but the row says three icons. Nit (3 votes, line 1998): stale D22 score and 7/10 references remain. Nit (1 vote, line 2034): DT1 remains unchecked despite D22 being done. Nit (1 vote, line 88): ownership wording should use commit-ledger membership. Nit (1 vote, line 1555): historical scope still says there are three checks.
DESIGN.md
Adds Evidence Desk visual tokens and guidance. Nit (1 vote, line 247): reduced-motion guidance should specify prefers-reduced-motion: reduce.
CLAUDE.md
Requires using the design system for UI work. No review findings.
The builder command shown for Codex does not close stdin, despite the validated requirement below that codex exec waits when stdin is non-terminal. Copying this command can hang plan generation; include < /dev/null in the canonical invocation.
Raw issue fields can break untrusted-data delimiters
prompts/plan-author.md:29
issue_title and issue_body are inserted raw between <issue_data> tags. An attacker can put </issue_data> in the issue body and then add apparent instructions outside the data block, so the model may no longer apply the untrusted-data rule. Escape or serialize the interpolated fields (and comments) before embedding them instead of relying on literal delimiters.
…ding
- Design doc: lock down agent containers (read-only root, tmpfs scratch,
non-root, no capabilities, no host mounts, resource limits) with a
start-up self-test; /work is the only lasting writable place. T1 verify
steps extended. Fix the last "three checks" to four.
- plan-format.md: reject symlink components and .git targets in path and
renamed_from; after each run, reject undeclared symlinks, symlinks that
leave the repo, and any .git change; run codeboost's git with hooks off.
- Both schemas, the guide, and the prompt describe cmd as one program with
literal arguments run without a shell. Example P2 command no longer
contains a quoted pipe.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Undeclared changes conflict with the post-run rejection rule
docs/plan-format.md:112
This new post-run rule says codeboost rejects every change outside the declared files, but the current execution contract commits an ordinary undeclared edit and shows it on the plan item's row as out of scope (docs/designs/codeboost-plan-indexed-review.md:192). Clarify this as recording the change out of scope, while retaining rejection for symlink and .git violations; otherwise the two documents disagree on whether those changes reach review.
Clarify vendor API access remains allowed without web browsing
prompts/plan-author.md:26
The builder note says the agent has “no web access”, but the approved container contract grants the selected vendor API and only disables web-browsing/MCP tools. Treating this literally would make Claude/Codex unable to generate a plan; clarify that only web-browsing/MCP access is disabled and the pinned vendor API remains allowed.
Addressed the summary-only finding in review 5287086371 with 858513c: the plan-author builder note now explicitly disables web-browsing/MCP while permitting the pinned selected-vendor API through the approved proxy.
Unbounded prompt argument can exceed process or vendor limits
prompts/plan-author.md:37
The issue body/comments, full repo_tree, allowed argv arrays, lessons, and feedback are serialized into promptText and passed as one process argument without any size bound or fallback. A large repository or hostile oversized issue can exceed the host execve argument limit (or the vendor context limit) before the CLI starts, making planning fail as a denial of service. Define and enforce a deterministic size policy, or use a bounded mounted/input channel instead of one unbounded argv value.
Retained v1 prompt link resolves to the wrong path
schema/versions/1/semantics.md:152
This relative link is broken from schema/versions/1/semantics.md: ../prompts/plan-author.md resolves under schema/versions/, while the prompt is at the repository root's prompts/ directory. Readers of the retained v1 contract cannot reach the required authoring prompt.
Both summary-only findings from review 5287174718 are addressed in 4f849bd: fixed the retained v1 prompt link, and defined deterministic prompt/schema/environment/aggregate argv byte caps plus selected-model token budgets. Oversize/NUL inputs fail before spawn, without silent truncation; boundary/escaping/aggregate tests and pinned-container launch probes are required.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two design pieces for codeboost, both written in plain language (ISO 24495-1:2023).
Design system: "Evidence Desk" (422527c)
DESIGN.md: color, type, spacing and component tokens; the provenance gutter; the logo; motion; a decisions log.CLAUDE.md: UI work must readDESIGN.mdfirst.Plan format (933744b)
schema/plan.schema.json: plan format v1. Claude (claude -p --json-schema) and Codex (codex exec --output-schema) both answer in it, and imported YAML or JSON plans are checked against it.schema/plan-edit.schema.json: typed suggestions from the plan assistant.schema/examples/: the #412 r3 plan and a suggestion reply.docs/plan-format.md: the plain-language guide, including the checks after import.prompts/plan-author.md: one prompt for both agents; issue text stays in a marked data block.How it was checked
$schemaline for draft 2020-12, andcodex execmust run with stdin closed.Not in this PR
Review corrections
git clone --local --no-hardlinks, with independent objects and no alternates back to the source. O6 and T1 require a regression check that modifying a disposable task object cannot change its source.Validation on
270c7c9: the old clone command reproduced shared-object corruption; the corrected command used distinct inodes and left the source unchanged. Both schemas and examples passed, copied definitions matched, and an explicit v1-to-v2 migration passed. A small model of the documented projected-state rules passed five positive/negative cases. These are design probes, not production implementation tests. A hostile delimiter payload stayed inside its serialized data and round-tripped exactly. Automated review corrections also specify safe argv execution and semantic validation before applying suggestions, close Codex stdin, and align the four-status/D22 documentation. All seven review threads were addressed; no findings were declined. Live agent and Docker tests were not rerun.🤖 Generated with Claude Code
Remaining Copilot feedback addressed
Commit 06b597d clarifies script approval covers codeboost-run commands only; container/network containment must handle agent edit-and-execute. Declared final symlinks are supported while symlink parents and unsafe resulting targets are rejected. Import requires exact selected-task issue matching. Acceptance checks and schema descriptions are aligned. Both schemas compile, both examples validate, shared definitions match, and git diff --check passes. All three previously unresolved threads were answered and resolved; fresh review requested.
Follow-up review fixes
Commit d6f8a9b adds immutable v1 snapshots plus an explicit version registry, and serializes repository metadata/argv into an escaped JSON prompt block. Registry/copy consistency, schema compilation, both examples, shared definitions, serialization contract samples, and whitespace checks pass. Runtime prompt evaluations remain implementation acceptance criteria, not claimed execution evidence. Both new threads answered/resolved; fresh review requested.
Further contract fixes
Commit 4dba0a6 specifies phase-specific mounts/tool enforcement, validates head-only PR changes, unions rulesets with classic protection and blocks unknown rules, restricts v1 symlink changes to machine-identified pre-existing links, and rejects path aliases using task-filesystem identity. Acceptance cases are updated. New symlink creation is deferred to a future typed schema. Local schema/registry/example/prompt-contract and whitespace checks pass. All five threads answered/resolved; fresh review requested.
Schema identity and leaf-path fixes
Commit a46ae34 gives both retained v1 schemas unique version-qualified IDs with matching CLI copies. The ID contract check failed before the correction and now passes. Directory/root declarations and implicit descendant scope are explicitly rejected. All local schema, registry, example, shared-definition, serialization-contract, and whitespace checks pass. Three threads answered/resolved; fresh review requested. Future typed symlink creation is tracked in #5.
Exact command approval
Commit d45c846 aligns all command contracts on element-for-element full argv approval. Prefix matches and appended flags do not authorize execution; a new entry requires explicit approval separately from the plan. Current and retained schema descriptions, authoring prompt, dispatcher requirements, and acceptance cases agree. Contract/schema/example/whitespace checks pass; all three related threads answered and resolved. Fresh review requested.
Resource and nested-path boundaries
Commit bc13172 requires preallocated task storage with hard byte/inode and pool caps, rejects same-invocation declared symlink/target aliasing, and keeps gitlinks metadata-only with empty read-only nested paths plus pre-test/commit audits. The no-host-slowdown claim is narrowed. Local contract checks pass; runtime tests are explicit future acceptance requirements. All three threads answered/resolved. Library alignment is tracked in #6; typed new symlinks in #5. Fresh review requested.
Invocation trust and merge race fixes
Commit a4fc1d9 specifies vendor auth location/environment allowlisting, atomic server-side base/head guarding (automatic merge blocks without it), deterministic v1 command tokenization, immutable agent Git metadata and isolated runner config, fresh retry filesystems with actual occupancy checks, and serialized current-plan data in every agent phase. Local schema/registry/example/shared-definition/prompt-contract/whitespace checks pass. Runtime controls are future acceptance requirements, not claimed live verification. Seven threads answered/resolved; fresh review requested.
Summary consistency and scope distinction
Commit 52c0e4d makes ledger ownership and projected file-state summaries consistent, extends declared-link alias checks to directory descendants, and distinguishes otherwise-safe out-of-scope regular-file changes (commit/show for review) from unsafe changes (no tests/commit, needs human). A repeated base-race finding was already fixed in a4fc1d9. Five threads answered/resolved. All local checks pass; fresh review requested.
Gitlink and suggestion limits
Commit 21cb365 clarifies v1 gitlinks are review-only and update_file uses an immutable exact path key. Path changes require a fully validated replacement revision or independently valid add/remove edits. Contract/schema checks pass; both threads answered/resolved; fresh review requested. Gitlink authoring is a future typed runner operation tracked separately.
Deterministic parsing
Commit 012bc41 addresses a summary-only review finding with a precise JSON-compatible YAML subset, duplicate-key rejection in both formats, pre-conversion alias/tag/merge rejection, and size/depth bounds. Runtime negative fixtures are specified in T18 and tracked for implementation in #6. Local contract checks pass; fresh review requested.
Typed identity and checkpoint continuation
Commits bf9add3/f5db136 distinguish blob versus commit object IDs, preserve explicitly unowned foreign ledger entries through rewrites, and deliberately pause on safe out-of-scope changes pending an approved amendment and actual-head checkpoint reconciliation. Accepted-decision summaries are aligned. All local contract checks pass; three threads answered/resolved; fresh review requested.
Rebase ownership branch
Commit ce04c4d makes ledger ownership the first rebase-conflict decision: missing/null owners route directly to the foreign branch; only owned commits enter Px-specific handling. The accepted ledger test criteria cover this ordering. Local checks pass; thread answered/resolved; fresh review requested.
Recovery and review invariant alignment
Commit 6d2e292 aligns rejection with transitive dependency staleness, rechecks foreign/ambiguous blockers after every rebase, replaces reset/reuse recovery with fresh filesystem materialization, and corrects ownership/safety summaries. Local checks pass; four threads answered/resolved; fresh review requested.
Versioned semantics and request binding
Commit c273c94 makes Codex state writable scratch while keeping auth read-only, registers a frozen v1 semantic contract plus validator key, and binds delayed suggestions to captured stable server-side plan identity. Declined the inverted-test claim: T9 already says the suite fails if prohibited writes/processes are possible. Local schema/semantic-registry/example/copy/serialization/whitespace checks pass. All four threads answered/resolved; fresh review requested.
Retained references and adapter examples
Commits e85c016 and 65f764a replace shell launch snippets with direct process APIs and pin v1 semantic schema/example references to retained v1 files. Registry, schema/example, shared-definition, and prompt serialization checks pass;
git diff --checkpasses. All received inline threads are resolved; requesting the next current-head review.Metadata, symlink target, and prompt boundary follow-up
57bbeea addresses seven further comments: separate-filesystem Git metadata with no writable inode aliases; reject declared-link target mutations before safe scope handling; explicit container schema and output channels; escaped JSON lessons and revision feedback. Added runtime attack/startup acceptance cases. Local schema/contract checks pass; runtime isolation tests remain implementation work.
Approval fingerprints and runtime guarantee
f29013e explicitly binds non-line approvals to operation/path/mode/typed-object metadata and compares it at merge, with staleness cases. Clarified that symlink snapshots validate accepted states, not transient execution: runtime protection comes from container mounts/permissions/network. Declined a predeclared-target guarantee for arbitrary execution; the CLI already has intended access to its own mounted vendor credential. Added transient-link containment acceptance cases instead. Local checks pass.
Suggestion regeneration contract
858513c defines one card per revision: Apply atomically consumes its ID and stales remaining old-revision suggestions; the UI requires explicit refresh and review of regenerated cards. No silent operation rebasing. T18 now includes cross-plan same-revision/item-ID, concurrent/replay, and refresh regression cases. Also fixed the summary-only vendor-API wording finding. Local checks pass.
Identity and launch budgets
4f849bd adds stable plan/item identity to approval fingerprints and ID-only import regression coverage. Adapter pseudocode requires an enforced, startup-probed planning profile in the actual argv; missing enforcement fails closed. Defines pre-spawn byte/token caps with explicit oversize rejection and fixes the retained prompt link. All four inline/summary findings addressed; local checks pass.
Bounded output and validator registration
215cd78 specifies external bounded capture and whole-container termination for command overflow/deadlines, plus envelope headroom separate from the plan limit. Only registry snapshots enter validator registration; CLI copies resolve the same existing IDs. Local Ajv single-instance registration and all prior contract checks pass. Runtime overflow/termination tests remain implementation requirements.
Feedback closure verification
At 215cd78, all 76 review threads are resolved (zero unresolved, no further thread pages). Across 21 Copilot review rounds in this pass, the final current-head review 5287279356 reports Findings: None, has zero inline comments, and contains no actionable new summary finding. Its generic overview still mentions documentation concerns without identifying any; this is not claimed as formal approval.
Final local verification passed: strict schema compilation and single-instance registry registration; current/snapshot equality and IDs; plan/edit examples and shared definitions; prompt data serialization contracts; git diff --check. Working tree is clean. No CI checks are configured for this branch. Runtime isolation/startup/attack tests are requirements, not executed tests in this documentation PR.
Dispositions: corrected valid schema, prompt, path/symlink, runtime boundary, approval/identity, suggestion, and merge/recovery contracts. Declined the inverted-test-predicate report because the existing text correctly says the suite fails when isolation breaks. Clarified rather than promising transient-symlink prevention from snapshots: runtime boundaries govern access, including the CLI's intended credential access. One repeated base-race report was already fixed. Follow-ups are tracked in #2, #5, #6, and #7. PR remains unmerged.