config-protection.js and post-edit-typecheck.js attached process.stdin
listeners at module scope. tests/hooks/hook-input.test.js requires
config-protection.js, so that test never exits while stdin stays open.
Attach the listeners only when the script runs directly
(require.main === module), as stop-format-typecheck.js and quality-gate.js
already do.
post-edit-typecheck.js picked tsc diagnostics with line.includes(candidate),
so editing a root index.ts reported the errors of src/index.ts, and a
Windows relative path (src\index.ts) never matched tsc's forward-slash
output. Compare the file at the start of each diagnostic instead, the same
check diagnosticMatchesFile() does in stop-format-typecheck.js.
Refs #3821
Reject numeric prefixes, fractions and unsafe window integers consistently with summary scheduling while preserving resolver precedence. Cap only the default context reminder at eighty percent of a valid earlier native compaction budget; explicit thresholds, including zero, retain their intentional policy. Document the independent capacity, summary and advisory contracts.
RED controls reproduce malformed-budget summary triggers and the known-1M/native-200k missed reminder. Resolver65, helper47, actualStop18 and actualPreToolUse54 pass on Node18 and24. Parent and independent reviewer approved the exact diff before commit. Registry rebinding remains the integration coordinator responsibility after combining documentation repairs.
Add null, blank and example-specific UTF-16 length checks to the English and Japanese login snippets before AuthService. Preserve credential bytes, authentication-failure behavior and the existing successful-session flow. Label the 256/1024 limits as application examples rather than tinystruct defaults.
Compile and execute exact extracted methods against controlled request/auth/session stubs with ephemeral official checksum-verified Temurin17. Baseline: 8 pass,20 fail. Candidate:28 pass,0 fail. Tagged Request API and Java17 target verified. Markdownlint, Unicode and diff checks pass. Root independently reviewed both documents. No full HTTP host, real authentication service, cookie-policy or envelope changes claimed; registry rebound remains root-owned.
Include captured stderr, status, signal and spawn error message when the existing unexpected-monitor-failure warning assertions fail. Preserve all status/raw-input/warning assertions, deadlines and product bytes.
The macOS hosted failure did not print its actual stderr, so its transient cause remains unverified. The unchanged source matches green main; 24 prior local diagnostic repeats passed 120 checks. This diagnostic-only patch passes all five fixture cases, affected ESLint and diff checks. Parent independently reviewed the diff. Fresh exact-head hosted CI remains required.
Zero the 32-byte r scalar while preserving the signature encoding, length, s and recovery byte. The previous tail overwrite could leave r/s unchanged and normalize recovery 27 to 0, preserving a valid payment. Keep and strengthen no-claim/no-handler/no-settlement checks before serving the original valid payment.
Restore the shipped payload-first contract from #3464/#3495 and the explicit source #3755 scope clarification. Two provider conversations must retain distinct IDs despite an inherited registered ECC parent ID. Normal and ambient producer24 tests, canonical resolver10 and independent differential review pass. Keep native importer guards; explicit provider/native correlation is queued separately.
Correct the English and Japanese static-file guidance against tinystruct v1.7.37 commit 089ec19022f3bb5d87f1e83e30b2034b24f7e77f. The configured-root exclusion uses lexical normalized paths before symlink resolution, and matching static candidates return before the later project-root-file check. Recommend real dedicated public directories without claiming an upstream security repair.
Verified the exact tagged HttpServer blob 58ff6ae082f7569e73207c9cb4614f680c9d3de7 and eight disposable POSIX filesystem path controls. Java is unavailable, so no Java or HTTP runtime verification is claimed. Changed Markdownlint, Unicode safety and diff checks pass. Parent independently reviewed both documents and the source evidence. Registry rebinding remains with the combined integration.
Clarify native compaction budget scheduling independently of the model window resolver and retain immutable transcript fixtures. Helper43, ten independent scheduling controls, affected lint and independent review passed.
Verify review discussion4419348312 against actual native producer/importer behavior. Prefer the independently sanitized ECC_SESSION_ID for the ECC-owned metrics feed, retain payload then legacy fallback for standalone hooks, and leave sibling hooks unchanged.
Actual Node producer plus read-only cached native binary reproduces zero imported metrics before the fix and exactly one tool/file/log after repeated sessions/status commands. Four producer regression controls and normal/adversarial inherited-env suites pass22/22. Focused coverage96.47percent lines and91.47percent branches; parent independent source review passed.
Prefer a preinstalled rg application. Otherwise download the official ripgrep 15.2.0 x64 MSVC ZIP with bounded HTTP retries/timeouts, verify its committed SHA256 before extraction and execution, validate rg.exe, and publish its directory through GITHUB_PATH. Preserve the existing version and PCRE2 checks and every test lane.
Separate confirmed model capacity from Stop-summary scheduling. Use the smaller confirmed capacity/native budget, or native-only budget for inferred capacity. Three unit and one actual hook RED cases now pass; helper43, actualStop15 and ten independent controls pass without changing the capacity resolver.
Bind the combined canonical skill changes to registry1bc6b059 while retaining all34 curated trigger lists and their unchanged digest. Context profile and deterministic Pi validation passed after integration.
Verify context fallback order against transcript-context and passing 55-case workflow suite. Ground CLI injection guidance in tinystruct v1.7.37 Action.getArguments, CommandLine and ApplicationManager at 089ec19022f3bb5d87f1e83e30b2034b24f7e77f. Markdown lint and Pi projection check pass; preserve explicit Pi exclusions.
Verify and address PR #3809 discussions 4419228221, 4419257840 and 4419257844. Iterate string-array assertions through sparse positions, validate the declared example identifier grammar before request construction, and refresh Turkish/Chinese reviewer references. Regenerate the canonical Pi copy.
Compile and execute the actual typed fixture; keep published validation bodies aligned and prove invalid identifiers never call fetch. RED: 28 pass, 2 fail. GREEN: 30 pass, 0 fail. Strict tsc, changed ESLint/Markdownlint, Unicode/agent/skill validators and deterministic Pi checks pass. Parent independently reviewed all six paths. Registry rebinding is deferred to the combined integration.
Reject a feed row whose hook event ID already belongs to another session before reserving in-memory deduplication. Reuse one parameterized indexed lookup rather than loading historical logs. Register the previously unknown session against the unchanged same-ID fixture and verify metrics remain consistent with persisted ownership.
Preserve the reviewed Dependabot source ancestry. The rustls patch release addresses four advisories affecting 0.23.45; dependency closure is unchanged. Verified downloaded crate checksum, full native tests, actual CLI readback fixtures, and locked offline build.
Recompute only registryDigest through the canonical registry after tinystruct and TypeScript integration; retain all 34 curated trigger lists and their verified digest. Context profiles, carrier closure, Pi projection and independent combined review passed.
Preserve PR #3758 source head deec267f07. Correct the static-root policy against tagged upstream 089ec19022f3bb5d87f1e83e30b2034b24f7e77f: current directory and ancestors are rejected, while configured siblings are permitted. Independent EN/JA source review and Markdown lint passed.
Preserve harryert source ancestry and skip external session events before deduplication. Strengthen same-ID ordering, late-registration and repeat-sync coverage. Isolate the affected dashboard selection fixture from shared user metrics.
Carry forward AbhiramMandala’s canonical TypeScript guidance from PR #3142, reviewed source head 643f61d604. Rebuild current-main counts, Pi projection and trigger digest without replacing existing registry entries.
Use bracket access under the documented noPropertyAccessFromIndexSignature baseline. Type-check and execute the actual fixture, compare published function bodies, and preserve deterministic undefined, sparse-array and concurrency regressions.
Validation: 26 focused checks; strict TypeScript compile; all repository validators; affected ESLint and Markdownlint; deterministic Pi rebuild; real npm pack; disposable Claude, Codex and Copilot install/repair/uninstall with exact skill bytes and preserved user files. Parent independently reviewed the complete staged diff.
Co-authored-by: AbhiramMandala <abhirammandala02@gmail.com>
Quinn O'Donnell