[rhein1]

Callback exceptions and async cancellation could erase local governance receipts or misclassify completed effects. This change separates JavaScript lifecycle handlers and adds phase-aware Python cancellation receipts while preserving CancelledError.

Approval failure records no dispatch. Evidence failure after success records completed_evidence_failed. Notification failure retains the original receipt ID. Cancellation during a tool call records cancelled_effect_uncertain without claiming rollback or safe retry. Existing exports, successful returns, deny precedence, owner-only spend/retry, and disabled-receipt behavior remain compatible.

Independent-review fixes preserve cancellation identity and already-durable inner receipts when persistence fails, attach bounded outer-action failure evidence, and avoid invoking hostile JavaScript metadata accessors. Regression coverage includes real filesystem failures, nested cancellation, redaction, and allow/ask/approval/write/deny flows. Relates to #334.

Includes shared prerequisite repairs from #444/#446: audit-clean n8n development fixtures with the published runtime peer unchanged, the Windows npm launcher fix, and the reviewed unpublished MatrAIx hold through 2026-10-08. No dependency overrides or audit suppression.

Validation:

• Exact-head local refresh on October 3: 18 targeted Node lifecycle/receipt tests and all 18 Python SDK tests passed with no skips. Independent source review confirmed the five follow-up repairs and triaged the five current CodeQL conversations as intentional diagnostic guards/cancellation assertions; no alert dismissal or suppression.
• 441 repository Node tests and 14 Python SDK tests passed for the lifecycle implementation.
• After merging the shared repairs, all 12 targeted lifecycle regressions and shared machine/count/n8n checks passed.
• Hosted checks on f65143f: 51 successful, 0 pending, 0 failed when refreshed on October 3, 2026. The five follow-up findings are addressed by guarded cancellation metadata, preserved approval-error identity, retained inner receipt metadata, Python 3.8-compatible cancellation tests, and isolated canonical callback receipts. Six JavaScript receipt-identity regressions run in required validation CI. Required independent approval remains outstanding.
• Offline release candidates remain publish_authorized: false.

Ready for the repository's required independent approval. This source change does not activate a runtime or authorize publication, provider calls, payments, automatic retry, or restart-safe execution.

The shared hosted MCP repair updates its actual lock and embedded fast-uri implementation to 3.1.8, refreshes ip-address to 10.7.3, and regenerates integrity records and notices. A regression now rejects a lock that disagrees with the advertised, installed and attested dependency. All 16 hosted artifact tests, source/artifact verification, packaging and zero-vulnerability audits pass locally. The bundle remains private and publication-disabled.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T23:53:39.047148Z	ca1ee6a	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca1ee6a858

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jmborden1112-beep]

LGTM

Needs Fixing

None. Node/Python governance receipts preserve truthful failure and cancellation outcomes, retain nested identity where present, and keep notification mutations away from persisted canonical receipt references.

Requires Human Review

None beyond the repository approval gate fulfilled here under the owner's second-account authorization. This is agent source review, not independent human sign-off.

Recommended Optional

None.

Create Follow-up Issue

None.

Workflow Trace: exact refreshed head42038f4548699a5381ab9e9318f4fc226475d69c; /root/integrations_stack_review plus root verification, gpt-6-luna medium fallback. Root ran18/18 Node lifecycle/identity tests and18/18 Python SDK tests, zero skips. Main's separate audit/request-boundary CI steps and redirect/x402 README material preserve the PR's additions; the next refresh adds already-reviewed source-only RRSI files from merged448 with no governance overlap. Integration counts and generated inventory checks pass. All final-head hosted checks pass. No provider calls, payment, live host activation or package publication.