[buildingjoshbetter]

Refs #761 (C05). Admit transcript sources using the trusted host supplied by installed hook commands and carry that identity through extraction and retry.

Changes

• Installed --host {claude,codex,gemini,cursor} selects transcript admission roots, session normalization and backlog/background routing. Legacy commands default to Claude. Stdin host/event fields and backlog markers cannot choose a different installed host.
• Install exact native --event values for C07 recall serialization. Stop/Compact parse the event flag, but their transcript admission uses --host only.
• Admit Codex CODEX_HOME/sessions (default ~/.codex/sessions) and Gemini workspace chats subtrees beneath its runtime tmp, including GEMINI_CLI_HOME and SANDBOX=sandbox-exec cache layout. Reject malformed paths, traversal, unresolved loops and sources that resolve outside admitted roots before transcript content reads.
• Carry the trusted host through Stop, compaction, prompt capture, background ingestion, SessionStart drain and CLI cascade. Wrong-host backlog entries remain available for their matching host. Validate source/session/marker shape before replay; legacy markers retain the Claude default. Hook extraction markers require a real background spawn.
• Normalize native Cursor identity from a valid conversation_id, with session_id fallback. Other approved hosts use session_id; malformed/blank/NUL identities retain caller defaults and existing sanitization.
• Refresh verified owned Codex/Gemini hook commands while preserving foreign handlers. Shared ownership uses actual Python package-script or exact hook-module invocation tokens; substring mentions, comments, argument text, malformed quoting and shell composition do not establish ownership.

Stack and scope

Proposed normal fast-forward refresh of existing draft #831 to C05 head 003705e9e3f4cd38f7a3abf5c79607af2ba45e7e, destination fix/transcript-allowlists-publish-v3. Previous published head: 72b66c20d5e00c6935f9ae2264b27d019b335925. Parent remains draft #829 through fix/preferences-status-publish-v1, head bf0f38c4cac55c8ccff1d39b19eacb9fe9213bbf.

The feature delta remains 15 paths: nine production and six tests. The only change since the previous published C05 head is tests/test-transcript-allowlists-761.py; all production and documentation bytes are unchanged. C07/#763 supplies native recall serialization and the downstream #630 fixture teardown; C10/#766 follows C07. Product egress defaults, models, rerankers, retrieval formulas and limits are unchanged.

Cursor has no inferred default transcript root; it requires an explicit admitted TRUEMEMORY_TRANSCRIPT_DIR. Transcript-home admission does not establish custom-home installer config support. Native stale-session discovery remains Claude-specific.

Controls and preserved failures

Actual-main AST/stub controls exercise installed argv, trusted host propagation, admission before transcript file/content reads, wrong-host sources/backlogs, native identity and real-spawn-only markers. These controls use synthetic collaborators and do not establish native lifecycle capture. Faithful installer fixtures use Python/package-script invocation forms and preserve foreign commands. Original forged-host, foreign-command rewriting, standalone parser-loss and other failed controls remain preserved.

The new allowlist suite contains 32 test definitions and 102 unittest assertion/fail call AST nodes. Codex and Gemini adapter fixtures contain 96 and 65 Python Assert statements respectively. These are source inventories, not runtime assertion execution totals. Fixture corrections preserve existing methods and meaningful admission/ownership assertions.

Original old-head Windows failures remain preserved. Draft #831 at 72b66c20d5e00c6935f9ae2264b27d019b335925 failed four ownership-fixture subtests because unconditional POSIX single-quoted commands were supplied to the native Windows parser; production correctly rejected them. Log SHA256 ac86315cb74ffde5db2086772a793f031b90d52d55cb2e05104facdd3477f8fb is preserved in .work/reports/transcript-hosted-failure-windows-114405870142-v1.log. The first fixture child b53c35d6b8bcdd705c5893d672976a65eb35cd0b passed its simulated methods but omitted literal-semicolon Windows coverage; that gap and its receipt remain preserved. Child 003705e9e3f4cd38f7a3abf5c79607af2ba45e7e explicitly tests POSIX single-quoted and native Windows double-quoted literal semicolons on both simulated platform paths, retaining all 32 methods, 102 assertion/fail call AST nodes and foreign/shell negatives. Production ownership is unchanged.

Draft #833's old Windows job separately failed seven manual-parity methods through unescaped native paths, JSON/TOML parsing and Hermes POSIX tokenization, plus the same four inherited C05 subtests. Its preserved log SHA256 is 6b6697440d6dc5e6360df7a0aaf31bcc384c3fe9f749d8b16e93f4f57a305c72, in .work/reports/manual-docs-hosted-failure-windows-114407979608-v1.log. C10's fixture-only encoding/tokenization/canonicalization correction retains eight method bodies and 58 assertion/fail call AST nodes. Narrow JSON-compatible double-quoted STRING decoding rejects duplicate keys, aliases, tabs, malformed/trailing input and non-string collections. Actual-source synthetic controls exercise POSIX and Windows path strings; they do not establish actual new Windows CI or native host acceptance.

The following #630 correction belongs to downstream C07 and the combined snapshot, not the C05 exact-source delta.

The preserved old #832 Ubuntu experimental failure used ordinary CPython 3.14.8; actual GIL state was not measured. Its #631 zero-vector rebuild hit the unchanged nonblocking model-publication busy fence with identity (0, "model2vec", 256). The exact lock owner and historical cause remain unproven. Log SHA256 b81ee74dfc997bc0e0824bb1ee09e8537c5bba02a2dc63a95888a1d26f83d3f3 remains in .work/reports/native-hook-ft-hosted-failure-114406830194-v1.log; the historical filename is not evidence of a free-threaded runtime.

Actual-source inspection identified a separate #630 fixture that opened its unique engine without teardown. C07's fixture-only correction captures that fixture's coordinator, checks its canonical database path against the unique fixture database, cancels and waits at most 10 seconds, surfaces failed completion, and always closes the fixture engine in a nested finally. It covers open/test failures without changing the model fence, shared lock, registry, model identity, caller transaction semantics, GC or production code. Initial child 67e73f3c7fe427b8b63fcfaa933fdcb339fcb2a2 failed a foreign-database negative by cancelling/waiting on that coordinator; its commit/report remain preserved. Child 26afddf7332f1586768d1d787cfe1aad2c1278e1 refuses before foreign cancel/wait and still closes the fixture engine. Root confirmed 16 frozen lifecycle controls and 32 production guards passed. All three #630 method bodies/nine Python Assert nodes and the entire #631 file (nine tests/28 Python Assert nodes) remain unchanged; these are source inventories, not runtime assertion totals. Synthetic actual-function ownership witnesses demonstrate safe teardown and possible interference, without proving the historical hosted owner.

The inherited #684 correction requires exact Engine/failed-handle proof, strict automatic-owner receipts, identity rechecks and one shared 10,000 ms budget. Current-owned writers refuse before opening; manual/receiptless, serving/already-admitted and replacement-handle cases retain refusal. Historical macOS and old #829 Windows owner identities remain unproven; duplicate hosted jobs passed. Separate synthetic verified-owner reproduction supports the narrow correction. Reconnect controls pass 26 methods and 42 independent probes. All 101 boundary methods and 550 unittest assertion/fail call AST nodes remain unchanged through fixture repairs; the memory-only run passes 101/101.

Original combined full 5cd23db000fd2a7c98e93395be33cf8638641db1 failed ten MCP fixture tests: nine missing-time NameError traces and one parallel-wait assertion cascade. Original source, container and full log remain preserved, log SHA256 2a706b32240afa808f582e1751beeea1a24302f1a6f86f3eb3eddec5fa85befd. The inherited MCP-only fixture repair retains all 11 test methods and 52 unittest/Mock assertion/fail call AST nodes, binds actual source-derived collaborators and strict unexpected-wait/import guards, and passes 11 safe methods plus 35 independent controls. Production, GC, model and retrieval behavior are unchanged by that fixture repair.

Source-only controls rejected queue v4's marker-insertion argv and publisher v5's incomplete exact-PR identity checks; the originals and failed controls remain preserved. Root uses reviewed queue v5, SHA256 cb9136cbe4cd3c2ca75c9c52e225c0ed2d71f5f08b711ae8ea6e885fe9d17824, and publisher v6, SHA256 573d39c50d4258461fe6160f65ab5a66f9ffc5871425946e6970fdbad2277f8b. Root confirmed the publisher's 22 URL and 63 metadata negative controls passed. Those source controls are distinct from actual publication/readback. Plan v4 SHA256 45dd32d3f099b6445c97054089b66382bec9866e90ae6b1c268516e94b39eb56 and manifest v9 SHA256 8419a390c620d0f9fc6159f48631d123448a80745b1f2baad9f36cead85d1a8b pin the refresh source chain.

Exact-source validation

Gate	Exact source	Passing tests / subtests	Runner elapsed	Full-log SHA256
Expanded focused	acc9e00a55cadb91f392ec2a172a2f1fa580c749	845 / 658	40.071 s	7eadab0e30751d913a7ec9b092d2af719aee4039007eb8ace87896291dc85200
Combined full	acc9e00a55cadb91f392ec2a172a2f1fa580c749	3,735 / 3,248	417.054 s	f5e0f116edaddb79ed96fe3dc3b28b56198af256aa92e1d1c2c91bcb2b03bbc5
Exact C05 full	003705e9e3f4cd38f7a3abf5c79607af2ba45e7e	3,574 / 2,546	412.579 s	cfbc2cfe77bd213669f96ff26c234493db41b130d981e4ab9e3eb40a91c18829

Both full gates exited 0 with 17 skips, three network deselections and 39 warnings, no timeout/OOM and matching actual source/build/log hashes. The focused selection contains 39 files, including #630 and #631. The exact C05 pytest elapsed time was 405.54 seconds; the table reports runner elapsed time.

The gates ran sequentially on synthetic data in offline installed-wheel images with eight CPUs, 16 GiB, read-only source/models/fixtures, enabled native SQLite flags and no GPU exposed. Installed-wheel images were built and identified; all-test installed import origin was not measured. No GC-disabling override was used; three selected regression assertions observed GC enabled at their checkpoints. Full-run runtime GC state was not recorded.

Exact publication source/build/run: source-transcript-allowlists-publish-v6, build-transcript-allowlists-publish-v6, transcript-allowlists-publication-v2. Receipts: .work/reports/transcript-allowlists-publication-validation-v2.json, .work/reports/transcript-allowlists-publication-container-config-v2.json and .work/reports/build-transcript-allowlists-publish-v6-evidence-v1.json. Build-log SHA256 e7a27a34b0d229e994c0d722eb2603a6d67d1ea142947adb23505ded610a2321. Combined/focused receipts are .work/reports/native-integrations-combined-full-validation-v4.json and .work/reports/native-integrations-focused-validation-v8.json, with container configs v4/v5 and combined-v8 build evidence.

The complete five-gate set was independently accepted before body-file preparation. Those receipts validate exact sources; actual publication and remote readback remain separate root actions.

Remaining validation

Actual corrected-head Windows CI and fresh CPython 3.14 hosted CI remain unproven. The current root GPU images record Python 3.12.15; the old Python 3.14.8 experimental job's actual GIL and busy-fence owner were not measured. No matched-3.14 runtime success is claimed.

Configuration presence, registration, status output, serializer emission and written instructions do not establish native event execution, payload translation, transcript capture, host acceptance or model-visible recall. No native Codex, Cursor, Gemini, Kimi, Hermes or OpenClaw version was exercised by the manual parity controls. Kimi's newer home, Hermes translation under #765, and OpenClaw discovery/activation/runtime payloads/user/database propagation under #764 remain unverified. The adapter's OpenClaw staging divergence remains separate.

Historical macOS closed-handle and old #829 Windows I/O owner identities remain unproven; duplicate jobs passed and synthetic verified-owner controls support only the scoped inherited admission correction. The original 26.24 GB Mac memory fix and native host/model acceptance remain unproven. Complete-archive DeepSearch and durable source citations remain future work; #758/#759 product egress policy is held.

Validated private integration remains 3a9360b1ba6bf210a1b54e05287117923fbbaae5; adoption of the refreshed passing combination is separate. Draft only. No merge, release, refreshed private adoption or accepted issue closure is claimed.