FE-1317: Close host-landing oracle identity over PTY behavior

docs/archive/PLAN_HISTORY.md

@@ -3,6 +3,12 @@
 This file is the active POC-line plan archive for `memory/PLAN.md`.
 Legacy pre-`next` history was moved out of the live docs tree with the old archived implementation.
 
+## 2026-08-05 FE-1317 host-landing oracle identity closeout
+
+`host-landing-oracle-identity` ([FE-1317](https://linear.app/hash/issue/FE-1317/close-host-landing-oracle-identity-over-pty-behavior)) closed FE-1316 R13 on branch `ln/fe-1317-host-landing-oracle-identity`, stacked after FE-1316, without changing PTY-driver behavior. The compiled `brunch-host-landing-oracles-v1` implementation set now includes `tui-driver.ts`, `session.ts`, `screen.ts`, `keys.ts`, and `driver.exp`; a focused regression proves that changing each input independently changes `oraclePackSha256` while byte-identical inputs remain stable.
+
+The bounded hardening preserved the FE-1230 compile-time-closed oracle boundary and `src/dev/TOPOLOGY.md`'s immutable implementation-set rule. The existing non-slow controller/Git/refusal contracts and slow built-candidate public-TUI scenarios remained green; no retained comparison or outer evidence was run.
+
 ## 2026-08-06 FE-1316 system reorientation audit closeout
 
 `system-reorientation-audit` closed a bounded six-lane review of thirteen post-cleanup concerns. It found no deleted or stranded required behavior, separated merged executor mechanisms from their still-open outer witnesses, confirmed the comparison scenario layers are distinct, and routed tracing, dual-host, theme, and KA evidence work to their existing owners.

memory/PLAN.md

@@ -52,6 +52,7 @@
 
 ### Recently Completed
 
+- 2026-08-05 `host-landing-oracle-identity` (FE-1317) — **✓ complete:** the immutable host-landing oracle pack now includes all five behavior-bearing PTY inputs, with regression coverage for one-file-at-a-time hash sensitivity and identical-input stability.
 - 2026-08-06 `system-reorientation-audit` (FE-1316) — **✓ complete:** thirteen post-cleanup concerns received evidence-backed dispositions; one stale exchange-guidance defect was fixed, two bounded frontiers were admitted, and existing owners absorbed the remaining promoted work without creating a parallel queue.
 - 2026-08-05 `integrity-cleanup` (FE-1311) — **✓ complete:** the verified deletion/consolidation sweep and final five-row closure aligned the published package, probe topology, comparison public root, path-existence ownership, DB test naming, and portable repo-root Pi extension discovery without reopening falsified deletion targets.
 - 2026-07-22 `brownfield-comparison-cases` (FE-1241) — **✓ complete, learning-first:** frozen Brunch and Petrinaut packets, pinned-source preparation, deterministic oracles, publication-compatible attempt evidence, and portable CI are built.
@@ -61,7 +62,6 @@ Older completion history and archived completed frontier definitions live in [`d
 ### Next
 
 - `canonical-document-reconciliation` — earned closure over the exact normative-looking drift promoted by FE-1316: demote the unadopted PLAN-replacement prescription, archive/thin the enumerated superseded design notes, and correct comparison case/profile prose. Definition below.
-- `host-landing-oracle-identity` — close the immutable host-landing oracle pack over every behavior-bearing PTY input before its next comparison use. Definition below.
 - `saved-mission-comparison-witness` — later operator-owned frontier: FE-1215 is landed, so the remaining work is scheduling the real Brunch + Claude `/compare-specs` witness, then revising/rerunning the saved mission to prove historical snapshots remain immutable. Definition below.
 - `comparison-mission-isolation-hardening` — admitted from FE-1215 smoke (`TESTING_FINDINGS.md` CS2): move the private mission outside the target-reachable tree (or equivalently jail the target's file tools) so the D134-L/I67-L mission boundary is structural, not conduct-dependent. Definition below.
 - `shared-session-host-tracer` — prove the one-host TUI attachment seam that FE-1200 deliberately left open. Definition below.
@@ -109,20 +109,6 @@ Legacy link target; see Horizon.
 - **Depends on:** FE-1316 disposition audit.
 - **Traceability:** AGENTS.md §topology files; `docs/praxis/ln-skills.md` canonical-state ownership; D98-L, D110-L, D116-L, D132-L–D134-L.
 
-### host-landing-oracle-identity
-
-- **Name:** Close host-landing oracle identity over PTY behavior
-- **Linear:** unassigned — create at pickup in Frontend / brunch.
-- **Branch:** tbd at pickup; stack after FE-1316 independently of the docs closure.
-- **Kind:** bounded verification hardening.
-- **Certainty:** earned.
-- **Objective:** make the immutable host-landing oracle-pack hash change for every behavior-bearing `tui-driver` input.
-- **Closes:** FE-1316 R13's concrete identity gap; it does not redesign or split the PTY driver.
-- **Acceptance:** the compiled host-landing implementation set includes `tui-driver.ts`, `session.ts`, `screen.ts`, `keys.ts`, and `driver.exp`; changing any one changes `oraclePackSha256`; identical inputs produce a stable hash.
-- **Verification:** focused oracle-pack identity regression plus current host-landing oracle contract tests.
-- **Depends on:** FE-1316 disposition audit; must land before the next retained host-landing comparison attempt or any claim that its current oracle identity covers PTY behavior.
-- **Traceability:** FE-1230 execution-comparison oracle boundary; `src/dev/TOPOLOGY.md`; `src/dev/execution-comparison-operator.ts`.
-
 ### walkthrough-remediation-2
 
 - **Name:** Walkthrough chapter closure — remediation, evidence, and design follow-through (absorbs FE-1167)
@@ -237,10 +223,6 @@ next:
     dependency_satisfied: FE-1316 disposition audit
     closes: FE-1316 R06 | R07 | R12
     classification: buildable-now earned docs closure
-  host-landing-oracle-identity
-    dependency_satisfied: FE-1316 disposition audit
-    closes: FE-1316 R13
-    blocks: next retained host-landing comparison attempt
   saved-mission-comparison-witness
     gated_by: operator availability
     depends_on: landed FE-1215 workflow

src/dev/__tests__/tier-2-harness.test.ts

@@ -6,7 +6,7 @@
 
 import { readFile } from 'node:fs/promises';
 
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 import { openWorkspaceGraphRuntime } from '../../graph/index.js';
 import { assistantMessage, userMessage } from '../../probes/test-helpers.js';
@@ -211,21 +211,25 @@ describe('origination-kick-live — the product originates the opening turn on i
   });
 
   it('a boot with no available model does not kick (content boots stay deterministic)', async () => {
-    const boot = await bootTier2RuntimeThroughRunBrunchTui({ dev: false });
+    vi.stubEnv('ANTHROPIC_API_KEY', 'ambient-key-must-not-enable-tier-2-models');
     try {
-      // No auth/provider in this boot — the model-availability guard must keep
-      // the trigger silent rather than firing a turn that errors at startup.
-      await new Promise((resolve) => setTimeout(resolve, 100));
-      const entries = boot.runtime.session.sessionManager.getBranch();
-      expect(customEntries(entries, 'brunch.kick')).toHaveLength(0);
-      // The synthetic present_* pair includes a sentinel-provenance assistant
-      // toolCall; "no kick turn ran" means no provider-produced assistant message.
-      expect(
-        messagesByRole(entries, 'assistant').filter((message) => message.provider !== 'brunch'),
-      ).toHaveLength(0);
+      const boot = await bootTier2RuntimeThroughRunBrunchTui({ dev: false });
+      try {
+        // Ambient provider credentials must not turn this deterministic content boot into a live turn.
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        const entries = boot.runtime.session.sessionManager.getBranch();
+        expect(customEntries(entries, 'brunch.kick')).toHaveLength(0);
+        // The synthetic present_* pair includes a sentinel-provenance assistant
+        // toolCall; "no kick turn ran" means no provider-produced assistant message.
+        expect(
+          messagesByRole(entries, 'assistant').filter((message) => message.provider !== 'brunch'),
+        ).toHaveLength(0);
+      } finally {
+        await boot.runtime.dispose();
+        boot.restoreEnv();
+      }
     } finally {
-      await boot.runtime.dispose();
-      boot.restoreEnv();
+      vi.unstubAllEnvs();
     }
   });
 

src/dev/comparison-provenance.test.ts

@@ -174,7 +174,7 @@ async function createControllerRepository(input: { readonly tag?: string } = {})
   await git(root, ['config', 'user.email', 'comparison@example.test']);
   await git(root, ['add', 'package.json']);
   await git(root, ['commit', '-m', 'fixture']);
-  if (input.tag !== undefined) await git(root, ['tag', input.tag]);
+  if (input.tag !== undefined) await git(root, ['tag', '--no-sign', input.tag]);
   return {
     root,
     commitSha: await git(root, ['rev-parse', 'HEAD']),

src/dev/execution-comparison-operator.ts

@@ -81,6 +81,8 @@ const COMPILED_ORACLES: Readonly<Record<CompiledOracleId, CompiledOracle>> = {
       fileURLToPath(new URL('./tui-driver.ts', import.meta.url)),
       fileURLToPath(new URL('./tui-driver/session.ts', import.meta.url)),
       fileURLToPath(new URL('./tui-driver/screen.ts', import.meta.url)),
+      fileURLToPath(new URL('./tui-driver/keys.ts', import.meta.url)),
+      fileURLToPath(new URL('./tui-driver/driver.exp', import.meta.url)),
     ],
     run: async ({ appDir }) => await runBrunchHostLandingOracle({ candidateRoot: appDir }),
   },

src/dev/execution-comparison/__tests__/operator-oracle-dispatch.test.ts

@@ -15,6 +15,16 @@ import { loadControllerOraclePack } from '../oracle-pack.js';
 const petrinautCaseDir = fileURLToPath(
   new URL('../../../../testing/execution-comparisons/cases/petrinaut-optimization/', import.meta.url),
 );
+const hostLandingCaseDir = fileURLToPath(
+  new URL('../../../../testing/execution-comparisons/cases/brunch-host-landing/', import.meta.url),
+);
+const hostLandingPtyInputNames = [
+  'tui-driver.ts',
+  'session.ts',
+  'screen.ts',
+  'keys.ts',
+  'driver.exp',
+] as const;
 
 describe('execution comparison compiled oracle dispatch', () => {
   it('keeps shared framing neutral across browser and backend delivery contracts', () => {
@@ -134,6 +144,40 @@ describe('execution comparison compiled oracle dispatch', () => {
 
     expect(rivalPack.packSha256).not.toBe(knownPack.packSha256);
   });
+
+  it('content-addresses every behavior-bearing host-landing PTY input independently', async () => {
+    const oracle = resolveCompiledExecutionOracle('brunch-host-landing-oracles-v1');
+    const ptyInputs = oracle.implementationFiles.filter((path) =>
+      hostLandingPtyInputNames.some((name) => path.endsWith(name)),
+    );
+    expect(ptyInputs.map((path) => path.split('/').at(-1))).toEqual(hostLandingPtyInputNames);
+
+    const [knownPack, identicalPack] = await Promise.all([
+      loadControllerOraclePack({
+        caseDir: hostLandingCaseDir,
+        implementationFiles: oracle.implementationFiles,
+      }),
+      loadControllerOraclePack({
+        caseDir: hostLandingCaseDir,
+        implementationFiles: oracle.implementationFiles,
+      }),
+    ]);
+    expect(identicalPack.packSha256).toBe(knownPack.packSha256);
+
+    for (const inputPath of ptyInputs) {
+      const root = await mkdtemp(join(tmpdir(), 'brunch-host-landing-pty-rival-'));
+      const rivalPath = join(root, inputPath.split('/').at(-1) ?? '');
+      await writeFile(rivalPath, Buffer.concat([await readFile(inputPath), Buffer.from('\n')]));
+      const rivalPack = await loadControllerOraclePack({
+        caseDir: hostLandingCaseDir,
+        implementationFiles: oracle.implementationFiles.map((path) =>
+          path === inputPath ? rivalPath : path,
+        ),
+      });
+
+      expect(rivalPack.packSha256, inputPath).not.toBe(knownPack.packSha256);
+    }
+  });
 });
 
 function snapshot() {

src/dev/tier-2-harness.ts

@@ -297,11 +297,14 @@ export async function withTier2FauxAgentServices<T>(
 }
 
 async function createNoModelAgentServices(): Promise<BrunchAgentServicesOverride> {
+  const modelRuntime = await ModelRuntime.create({
+    credentials: new InMemoryCredentialStore(),
+    modelsPath: null,
+  });
+  modelRuntime.getAvailable = async () => [];
+  modelRuntime.getAvailableSnapshot = () => [];
   return {
-    modelRuntime: await ModelRuntime.create({
-      credentials: new InMemoryCredentialStore(),
-      modelsPath: null,
-    }),
+    modelRuntime,
   };
 }