[Git-on-my-level]

Candidate repaired after independent review5. The verified subscription decoder/fanout identity-parity finding is repaired with exact-baseline counterfactuals and read-only store/CLI regressions. The three original round4 repairs remain unchanged. The parent owns fresh independent review6 and shipping decisions; this implementation does not supply a merge verdict.

Outcome

Child launches gain immutable managed-parent/native-caller attribution and bounded agentctl children discovery. The query returns local collection IDs and fails closed on incomplete reads, paged membership mutation and corrupt selected metadata. Native CLIs and Multica retain execution authority; parent-exit enforcement is separate.

Final repair head: e654157fddad41f908ca6f82b024b4e7e631b9a8. Independent review5 baseline: d20744400abb79a5e9b4c9f16318700db472fc97. Subscription repair commit: 3cc6980385ac7df0a08f679a6345b5d643165a6e. Before push, a fresh fetch found main had advanced to already-merged PR150 at a4d9bd57e986b4488d829b62dfbbbbf477da8413 (OpenCode transport recovery). Strict up-to-date protection required its ordinary local integration. The merge parents are the repair commit and that published main commit. Its four conflicts were generated bundle/manifest hashes, recomputed from the automatically merged canonical skill; canonical and embedded copies match. All subscription production/regression files and original round4 mechanisms remain byte-identical to the repair commit. The approved Go 1.26.11 security base remains included. No PR was merged. Public APIs and JSON for this repair are unchanged.

Final behavior and scope

• Native run/delegate/continue, detached admission, local Multica dispatch and admitted remote forwarding rows preserve launch attribution. Managed ownership resolves under the existing admission handle after keyed replay. Caller session declarations are hashed and stripped before native launch; prompts and raw caller session IDs are not retained.
• Discovery seeks only the selected parent/provider-session index. It uses read-only handles, a 1.5-second processing budget, 50 ms read-lock attempts, 128-entry / 256 KiB pages and existing total record/byte/result bounds. It never contacts SSH/Multica, reads results, acknowledges, creates waiter files, migrates metadata or runs maintenance. Errors never mean empty coverage.
• Per-scope transaction stamps and mixed-version/pruning fences establish stable membership through the final checked page. Current outcome writes and unrelated admissions do not invalidate the scope; uncertified older writes fail closed even if followed by a current write. Writer certification and scope guarantees are unchanged by this repair.
• Exact-ID await evidence covers native and remote forwarding rows. Registration remains best effort, local subscriptions cover only local completion, and attention/uncollected terminals stay actionable. Immutable attribution survives older projection writers. Cleanup validates that attribution before graph analysis and preserves replay, authority and inherited graph guards.

Three verified corrupt-state fixes

1. Acknowledgements: decode selected values and validate typed key/record ID agreement, nonzero timestamp and the existing allowed sources before suppressing collection. Invalid/mismatched values return ErrCorrupt; oversized values fail the bounded-query check.
2. Expired indexes: validate key/ObjectID agreement and any provided Scope/Key fields. Preserve legacy compact tombstones only when the target execution is absent. A retained target behind a tombstone is corruption.
3. Required buckets: return ErrCorrupt instead of a nil-pointer panic when the idempotency or execution bucket is missing. Read-only schema validation also catches this before explicit parent identity hydration. No migration or repair write occurs.

Public API signatures, JSON fields/enums/schema version, compatibility epoch, membership certification and mixed-version semantics are unchanged. Discovery corruption uses the existing exit-70 structured error; unavailable explicit parent identity evidence retains its earlier exit-9 children_query_incomplete convention. Every error is unknown coverage, never successful emptiness.

Review5 subscription identity/fanout parity repair

Discovery and actual event fanout now share decodeFanoutSubscription, using the existing fanoutUnderstands and validateStoredSubscriptionIdentity path. Supported active records must have valid typed identities and bucket key/record ID agreement. Discovery returns ErrCorrupt on an invalid understood record anywhere in the bounded metadata scan; a valid matching record cannot claim coverage when another record would abort fanout. Key disagreement now fails directly as corruption rather than later during delivery lookup.

Compatibility filtering retains its existing order: inactive and unsupported subscription/filter/destination records are skipped without counting as evidence. Malformed JSON or structurally undecodable records abort both scans, including inactive/unrelated records. No new revision/envelope requirements are imposed. The processing/record/byte/read-lock bounds, legacy writer fences, scoped membership certification, waiter/attention behavior, metadata retention, and all three round4 mechanisms are unchanged. Corruption retains structured exit 70 with no successful complete: true; no read-side repair, migration or maintenance is introduced.

Regressions and counterfactuals

The review5 store table checks real transactional fanout and both parent/session discovery scopes. It covers malformed subscription IDs, mismatched valid IDs, malformed keys, invalid origin/filter/coordinator/cursor identities, malformed records, and an independent valid matching record followed by corrupt unrelated metadata. It asserts fanout rollback. Controls cover valid exact/unrelated records, inactive/expired records, unknown filters/destinations and null compatibility. CLI probes cover both scope forms, structured error output, successful valid/compatibility controls, no maintenance and unchanged journal bytes.

Exact d20744400abb79a5e9b4c9f16318700db472fc97 production files are restored with a Go overlay while retaining the new tests. The store command exits 1 with eight failing cases; the CLI command exits 1 with four failing cases in both scopes, reproducing exit 0 with complete: true, count: 0. Malformed-record and compatibility controls pass on both versions. Without the overlay, both new suites and the original round4 corruption/read-only probes pass.

The original round4 acknowledgement/tombstone/bucket fixes and their tests are unchanged. Their exact 9799439e7f837d82ae75dbf17abd2b8033873388 counterfactuals remain documented: 11 acknowledgement cases fail, nine tombstone cases fail, and the missing-index probe panics on that baseline.

Evidence: review5 parity, controls and exact-baseline counterfactuals, original round4 repair.

Validation

Use exact Go 1.26.11 with disposable test/cache storage, the git-only shim and fake notification commands:

unset GOROOT
export GOTOOLCHAIN=local GOENV=off PYTHONDONTWRITEBYTECODE=1
export PATH="$PLAIN_GIT_DIR:$NOTIFY_BLOCK_DIR:$GO12611_BIN:$PATH"
export TMPDIR="$TEST_SCRATCH/tmp"
export GOCACHE="$TEST_CACHE/go-cache"
export GOMODCACHE="$TEST_CACHE/go-mod-cache"
export GOPATH="$TEST_CACHE/gopath"
make ci
scripts/go-hermetic.sh go test -race ./cmd/agentctl ./internal/store ./internal/adapter \
  -run 'TestChildren|TestFanout|TestSubscription|TestCleanup|TestAttribution|TestRemote|TestWaiter|TestAutomaticRetention|TestAutomaticCleanup|TestManagedChildren|TestNativeAdmission|TestAwaitContinues|TestAcknowledg|TestOpenCode|TestNativeTransient|TestFailedNative|TestContinu|TestNegotiateResume|TestResume|Test.*Steer' \
  -count=1
git diff --check

Fresh integrated Go 1.26.11 make ci passed on this head: vet and all Go packages (CLI 359.735 s, ANX 10.651 s), schema/link/script checks, embedded/distribution consistency, live-owner release-skew compatibility against v0.19.0 and v0.21.10 (epoch 1), and build. Linux-only systemd fixtures were skipped on macOS.

Fresh integrated focused stateful races passed: CLI 158.514 s, store 82.821 s, adapter 12.598 s. The filter includes real fanout, subscription compatibility and corruption, membership fences, attribution/replay, cleanup, exact waiters and remote collection, plus the incoming main OpenCode/native recovery, continuation/resume and steering cases. git diff --check passes and the worktree is clean.

Before main advanced, full make ci passed on repair commit 3cc6980. Its first attempt failed the unchanged ANX local-origin test with a nil lookup (the subprocess has a 500 ms deadline); ten isolated repetitions passed in 4.756 s, and the subsequent full CI run passed without a concurrent race job. ANX source was not changed. The initial failed attempt is retained in evidence, not waived or reported as passing. Pre-integration focused races also passed (CLI 139.613 s, store 139.401 s). Fresh integrated results are recorded above rather than inferred from those earlier checks.

The normal push and its actual make pre-push hook passed using exact Go 1.26.11 and plain git first for tests. The final fetch confirmed origin/main remained a4d9bd57e986b4488d829b62dfbbbbf477da8413, already an ancestor of this head, and no unseen feature commits were overwritten. The published candidate is e654157fddad41f908ca6f82b024b4e7e631b9a8; the worktree is clean.

All seven exact-head hosted checks passed on e654157fddad41f908ca6f82b024b4e7e631b9a8: Verify, stateful race tests, Go vulnerability scan, Actions/Go/Python analyses and aggregate CodeQL. The bounded CI waiter exited green and GitHub reported CLEAN. After that, the authorized ready transition triggered Devin Review at this exact head, which completed SUCCESS. All eight reported exact-head checks are green. GitHub reports the open PR ready (isDraft: false) with merge state CLEAN. The bounded CI and Devin waiters exited green. The parent still requires fresh independent review6 on this frozen head; automated success does not supply that verdict.

Hosted evidence: Verify, stateful races and vulnerability scan, Actions/Go/Python analysis, aggregate CodeQL, Devin Review.

The shim was verified to use plain /usr/bin/git for tests and the pre-push hook; task/worktree operations use the managed wrapper. Tests isolate HOME/XDG state, use fake native/SSH fixtures and blocked notification commands. No real provider/page/Telegram call is used. All newly owned test/cache/process output is disposable. Shared refs are fetched immediately before normal push; no force/admin/hook bypass is used.

After Devin completed, all seven existing automated threads were rechecked and remain resolved, with zero unresolved threads and no new automated finding. No finding was dismissed or waived. Final fresh shared refs still show origin/main at a4d9bd5, an ancestor of the published head.

All owned test jobs and bounded waiters completed. The heartbeat was stopped and reaped; no leftover test/watcher retains the worktree or task scratch cwd. The active parent-managed execution worker exits with this handoff. The parent records outcomes and launches independent review6; this implementer launched no independent/delegated review.

Remaining limits and integration

• Completeness covers retained attributed executions. Historical/unattributed launches and pre-receipt remote launches remain outside that index. Lost SSH receipts remain uncertain and require identical-key recovery; an empty index never proves remote non-launch.
• Lifecycle and waiter evidence retain their existing observation semantics. Older waiters/await-any, stale remote cached state and excessive sidecar residue retain documented limits.
• Older uncertified writes and empty-scope pruning can conservatively require retry. Older cleanup can leave a small unused optional stamp. Existing parent-linked graph retention remains protected.
• Subscription compatibility follows actual fanout: unsupported records supply no coverage, while understood corrupt metadata aborts the query. Existing optional notification delivery is not a guarantee of eventual human action.
• PR148 and all other branches/worktrees are untouched. The new decoder is private and changes no public API/JSON. The final candidate also includes current main PR150; the parent should reconcile that required base when updating the stack. The parent must obtain fresh independent review6 on this final head. No independent/delegated review is launched by this implementer.

No GCP tier, production call, credential/spend operation, real page/Telegram, host installation, PR merge, tag, release or ANX/bus write was used. The parent records outcomes. Owned test/waiter/heartbeat cleanup is complete; the active managed execution ends with the handoff.

[cursor]

PR Summary

Medium Risk
Touches journal admission, execution immutability, and launch paths across delegate/dispatch/remote, though queries are read-only with explicit bounds and extensive tests.

Overview
Adds immutable launch attribution on admission for run, delegate, continue, dispatch, and remote paths: journal-observed managed context can set parent_execution_id, while caller_identity (hashed provider/session, separate from harness caller) comes from shared identity resolution or new AGENTCTL_CALLER_PROVIDER / AGENTCTL_CALLER_NATIVE_SESSION_ID env vars that are stripped before native children start.

Introduces read-only agentctl children to list a caller’s terminal uncollected runs and active children without known durable waiters, using caller indexes in the execution idempotency graph, a 1.5s budget, and fail-closed children_query_incomplete instead of partial empty results. Journal writes attribution snapshots/indexes on create; replay and cleanup preserve or remove them; schemas, help, and portable skill document the contract.

^{Reviewed by Cursor Bugbot for commit bfcdf30. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T12:48:20.430177Z	e654157	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.