FEATURE-ci-darwin-test-contracts: Mark task complete

Author: etr

specs/tasks/FEATURE-ci-darwin-test-contracts.md

@@ -1,6 +1,6 @@
 # FEATURE-ci-darwin-test-contracts
 
-Status: In Progress (implementation ready; caller validation/finalization pending)
+Status: Complete (local implementation/validation/finalization; native CI pending)
 Base: local v3 `a5a72356741300e5da16b94090f0f26a67a2d1f7`
 
 Repair four native-reproduced test/setup assumptions without changing production
@@ -11,7 +11,7 @@ runtime, quota accounting, APIs, peer addresses or unrelated workflows.
 - [x] Size the shared response fixture budget from actual reserved string capacity.
 - [x] Prepare and clean up only the Darwin selected-archive proof's owned loopback alias; execute lifecycle regressions.
 - [x] Run focused local checks and record native verification limits.
-- [ ] Caller validation and finalization.
+- [x] Caller validation and finalization.
 
 Evidence: primary `.debug/ci-darwin-test-contracts-8m2spsq4/journal.md`.
 Native RED batch 40055653509 is closed. Diagnostic refs f6475daf/88cd82fd
@@ -34,3 +34,10 @@ in the journal; neither is reported as a passing run. Two Automake wrappers were
 interrupted during unrelated prerequisite compilation before tests; verification
 then executed only the three requested binaries. No production owner expansion,
 full baseline suite, native rerun, CI control or publication occurred.
+
+Groundwork validation `b98a1e2fed06734a1161df488d03ed79` sealed PASS for
+implementation `bcd8f6143e84902bc612c0790392b03190908b0c`: one iteration,
+nine independent approvals, zero fixes and one unworked finding persisted by
+the helper. The report is preserved without caller reading it. Native post-fix
+platform execution remains incomplete and CI/v3 PR owned; overall CI remains
+unsuccessful. Header/outbox causes remain uncertain and CLOSED.

specs/unworked_review_issues/manual-validation_validation_b98a1e2fed06734a1161df488d03ed79.md

@@ -0,0 +1,11 @@
+# Unworked Review Issues
+
+**Run:** 2026-10-23 20:34:22
+**Task:** manual-validation
+**Total:** 1 (0 critical, 0 major, 1 minor)
+
+## Minor
+
+1. [ ] **security-reviewer** | `.github/workflows/v3-release-acceptance.yml:142` | resource-cleanup
+   A trapped signal after successful alias creation but before peer_alias_owned=true leaves the newly created privileged alias behind (CWE-459). Bash processes the pending trap before the ownership assignment, so EXIT cleanup sees false. One bounded controlled-boundary check using the actual workflow and existing fixture, with os.kill(os.getppid(), 15) immediately after the fake ifconfig state.touch(), returned 143 with only query/create calls and alias_remains=True. This misses the accepted interrupted-command cleanup contract; impact is limited to loopback state on the ephemeral runner.
+   *Recommendation:* Defer exiting on HUP/INT/TERM during creation until the creation result and ownership have been recorded, then honor the pending signal through cleanup. Add a lifecycle case that signals immediately after creation and verifies removal while retaining preexisting-alias preservation.