FE-1317: Close host-landing oracle identity over PTY behavior

[lunelson]

Why

Brunch's automated product-comparison system needs an ironclad guarantee: whenever anything about how it drives and observes a terminal session changes, old comparison results must be treated as stale rather than silently reused. That guarantee had a gap — a few files that affect terminal-driving behavior weren't part of the fingerprint used to detect change.

What

• Every file that can affect how a terminal session is driven or read is now included in the immutable fingerprint ("oracle pack") that comparison evidence is checked against.
• Added regression coverage proving that changing any one of those files changes the fingerprint, and that re-running with byte-identical inputs does not — so there are no false staleness alarms either.
• No behavior change to the terminal driver itself; this only closes a blind spot in how we detect when it has changed.
• Also fixed two unrelated sources of test flakiness across different developer machines (stray local provider credentials and git signing configuration leaking into test runs).

How to test

1. npm run verify:full passes.
2. Confirm it passes consistently regardless of local git/provider environment configuration.

[lunelson]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• FE-1321: Converge TUI and web session runtime contracts #416
• FE-1320: Structural private-mission isolation for /compare-specs #415
• FE-1318: Reconcile canonical documentation with current topology #414
• FE-1317: Close host-landing oracle identity over PTY behavior #413 👈 (View in Graphite)
• FE-1316: Audit current system authority and drift #412
• FE-1311: Remove dead code and clarify repository contracts #402
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Low Risk
Changes comparison fingerprint membership and test isolation only; no product PTY or comparison execution path behavior is altered beyond stale-evidence detection becoming more complete.

Overview
Closes FE-1317 by expanding brunch-host-landing-oracles-v1 so oraclePackSha256 content-addresses every behavior-bearing PTY input: tui-driver.ts, session.ts, screen.ts, plus newly included keys.ts and driver.exp. A focused dispatch test asserts identical inputs keep a stable hash and that mutating any one of those files changes the pack hash—without changing PTY driver runtime behavior.

Planning artifacts move host-landing-oracle-identity to Recently Completed and archive the closeout in PLAN_HISTORY.md.

Separate test hardening: tier-2 “no model” boot stubs ANTHROPIC_API_KEY and forces an empty model list so ambient credentials cannot trigger kicks; comparison fixture git tags use --no-sign to avoid machine-local signing config flakiness.

^{Reviewed by Cursor Bugbot for commit c69463b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f109ea4. Configure here.}

[Copilot]

Pull request overview

This PR closes a provenance gap in Brunch’s execution-comparison system by ensuring the host-landing oracle’s immutable “oracle pack” fingerprint includes all PTY behavior-bearing inputs, and adds regression coverage to prove the fingerprint changes on any relevant input change while remaining stable for identical inputs. It also includes small changes intended to reduce test flakiness from ambient developer environment configuration.

Changes:

• Extend the compiled brunch-host-landing-oracles-v1 implementation file set to include tui-driver/keys.ts and tui-driver/driver.exp so PTY-driving behavior is fully captured in the oracle pack hash.
• Add a regression test that mutates each PTY input one-at-a-time and asserts the oracle pack hash changes, while identical inputs produce an identical hash.
• Hardening for local-environment flakiness: force “no model available” in Tier-2 harness services, avoid signed tags in git fixtures, and isolate provider creds from a determinism test.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/dev/tier-2-harness.ts	Forces the “no model available” harness path to stay deterministic by overriding model availability to empty.
src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts	Adds regression coverage asserting oracle pack hash sensitivity per PTY input and stability for identical inputs.
src/dev/execution-comparison-operator.ts	Adds keys.ts and driver.exp to host-landing compiled oracle implementationFiles for fingerprint completeness.
src/dev/comparison-provenance.test.ts	Prevents local git signing config from affecting tag creation in fixtures via git tag --no-sign.
src/dev/tests/tier-2-harness.test.ts	Stubs provider env vars to ensure deterministic boots don’t become live turns due to ambient credentials.
memory/PLAN.md	Marks FE-1317 as completed and removes the now-closed frontier definition entry.
docs/archive/PLAN_HISTORY.md	Archives the FE-1317 closeout summary and traceability notes.
.pi/settings.json	Updates Pi settings (currently introduces machine-local absolute paths).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts:169

• Building rivalPath via inputPath.split('/') can fail on Windows and the current ?? '' fallback risks writing to the temp dir itself (or, if split fails and returns an absolute path, escaping the temp dir). Use a separator-agnostic split and remove the empty fallback.

      const rivalPath = join(root, inputPath.split('/').at(-1) ?? '');

src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts:153

• This test extracts file names by splitting on '/', which breaks on Windows paths (fileURLToPath returns platform-native separators). Use a separator-agnostic split (or basename) so the assertion is portable.

This issue also appears on line 169 of the same file.

    expect(ptyInputs.map((path) => path.split('/').at(-1))).toEqual(hostLandingPtyInputNames);