Gates, the per-capture write verdicts over the 51 showcase captures, the
in-process smoke of every served write tool, the AgentEnv run of a randomly
chosen published environment graded from data/get, and the served model
compared with the live application on the same calls.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Admit only the corroborated missing-UUID validation diagnostic from header-stripped dyld stdout. Preserve readable load commands and nm exports with unknown dyld coverage, and keep unrelated process and tool failures typed.
Closes#5606
Derive Darwin subprocess test budgets from the bounded ownership compiler budget while preserving short command deadlines. Always join the retained command scope after test failures.
Refs #5094.
52d1a72af made a cancelled write whose staging cleanup also fails carry the
caller's exact abort reason as its cause, with the cancellation retained as
cleanupPrimary and the staging directory as cleanup state. The boundary test
still expected the old wrapped cause, so it failed on main and in every PR
built on it; its finally block then masked the assertion with a cleanup
error. Assert the current contract.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Classify legacy class-object names at the Hopper boundary and carry the typed fact into class discovery. Preserve exact labels, literal filtering, unrelated row metadata, and raw replies; derive classification from source text rather than incoming tags.
Closes#5617
Read bounded regular registrations asynchronously with retained descriptor cleanup. Carry the selected parsed configuration through provider factories and restoration, preserve exact cancellation reasons, and share workspace-parent resolution with doctor checks.
Closes#5561Closes#5559Closes#5604
Unit tests for clock, UUID, token, slug and delimited-token values, the field
rules that explain created and updated entities, response shapes, insert
rules and the shared apply functions; view tests for every plan reason, delete
confirmation by a 400, 404 or null read, learned insert rules, unmodelled
writes and observations from later reads; services tests for served creates,
updates and deletes, refusals that leave the state unchanged, deterministic
values across reset and load, missing entities, the catalog and paging-only
list lines; and an MCP boundary test that serves a capture through the built
CLI, applies a create and resets it. The capture fixture records request
bodies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A refused call no longer advances the served clock, the write counter or a
sequence: values are reserved while a call is answered and committed with its
mutation, and deletes and document writes advance the clock like the others.
Updated entities cite no records, so data/get output loads back unchanged.
The gate withholds an update or delete that answers with the entity when no
initial entity holds every field its recorded answer shows, which would
answer only for entities the environment created (incomplete-entities). A
create whose template keeps a path value is tied to its collection like a
constant, and a delimited token is found after an overlapping undelimited one.
Documents write plans, the gate and served writes in the environment-state
and serving guides, the CLI help, the analysis-view contract and the bundle
README, and records the replay card the response summaries now produce.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Compare executable fingerprints before and after the owned version probe, and capture the script prefix from the final hash stream. Preserve partial facts and failed-close ownership without claiming process interruption from a snapshot.
Closes#5611
Recognize AppKit binding connectors as explicit unknown connection facts and
report partial semantic coverage rather than silently omitting them. Share
format-aware connector admission across keyed archives and NIBArchive.
Make the keyed archive table own parsed class and superclass facts for names,
array hierarchy traversal, inherited connectors, and class-table projection.
Preserve malformed class evidence and exclude unrelated custom class names.
Validation: 84 focused tests passed, including compiled CLI, filesystem,
MCP summary, and retained views; check:fast and test discovery passed.
Independent source review found no blocker. Production CLI and stdio MCP
replayed a read-only copy of Terminal 2.15's picker NIB: 13 connections with
partial unsupported-type coverage, versus baseline 9 with complete coverage.
Advertised schemas and retained coverage results validated with the SDK/Ajv.
No app, analysis target, or optional deep provider was executed.
Fixes#5590
Prepare native process ownership outside short command deadlines. Reuse the shared cleanup adapter and resource scope for direct/nested preparation failures and command cleanup.
Fixes#5094.
The environment-state view now builds a write plan for every tool whose
method may change state (create, update, delete or document, by the state
type or document its path names) from its first successful recorded call:
the request body members the application stored as sent, values it generated
(identities, sequences, UUIDs, clock values in their recorded format), values
derived from the call (copies, path values, slugs, strings around a generated
id) and the recorded response's shape. It replays the capture's timeline on a
copy of the initial state, applying each modelled write and checking every
later read the served state would answer; a plan is served only when a later
read confirms it and none contradicts it. Writes it does not model leave the
entities and collections below their paths unknown until a read shows them
again, and failures they may explain are checked only on the members a write
sent. Unserved plans carry their reason.
Served from the state, the catalog adds the confirmed write tools, described
by their effect and body members. A call applies its effect atomically to the
live store and answers with a recorded status and a rendered body; refused
calls leave the state unchanged. Generated values are deterministic per state
Evidence and write count, sequences never reuse a value, and the clock starts
at the capture's end: data/reset and data/add restart them. Reads of an
entity the state does not hold answer the recorded 400, 404 or 410, and a
list line that only pages its collection and listed all of it answers calls
without query arguments from the state.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The list planner filtered each recording's candidate fields with a
linear includes per candidate, even on the first recording, so a
one-item list with tens of thousands of suffix-named fields cost
hundreds of millions of comparisons. The first recording's candidates
now stand as they are and later recordings intersect through a set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Teach client deadline recovery before REA results can be discarded, distinguish
producer-owned server budgets, and preserve Evidence/cleanup uncertainty.
Include actual Codex CLI recovery probes and CLI/MCP regression coverage.
Fixes#5598
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Use shared owned command supervision for all evaluation helpers, join streamed output, and retain/retry incomplete cleanup before deleting run files.
Fixes#5094.
Keep directly observed renderer listeners singular when bridge traversal
reaches them, while retaining separate paths for every exposed bridge member.
Preserve separate physical callsites and on/once operation identities.
Validation: 190 focused tests passed, including public CLI and stdio MCP
analysis and incoming feature tracing. Typecheck/lint and discovery passed.
The inert fixture was analyzed statically; no Electron target was executed.
Three alternating synthetic CLI tasks showed overlapping wall times (median
1.825s baseline, 1.808s current). Corrected bridge provenance increases serialized
task payload; no speed or context reduction is claimed. Actual model tokens
and full process-family CPU/peak memory were not measured.
Fixes#5586
Use the shared command supervisor for installation probes and retain exact
process cleanup owners through doctor, profile resolution, and session health.
Preserve exit status, bounded captured output, cancellation reasons, and live
cleanup facts. Block subsequent inspection until retained cleanup is retried.
Generalize the existing inspection resource scope and migrate its consumers,
including verifier scripts; remove the verifier's duplicate raw version probe.
Validation: 116 distinct focused tests passed, including built CLI doctor with
inherited output, cancellation/finalization, cleanup retry, and fake-provider
verifier workflows. Build, check:fast, and test discovery passed. No real Kuna
distribution or analysis target was executed.
Synthetic Darwin inspection timing: first-call median 707ms versus 5.79ms;
same-process repeat 37.9ms versus 3.08ms. First use includes ownership-helper
preparation. Family CPU and actual peak family memory remain unmeasured.
Fixes#5557
Reuse the cancellable segmented wait and settle observation termination through one cleanup owner. Preserve caller cancellation and release timers/listeners across early target end.
Fixes#3929.
answerBatch kept every settled reply in its pending array until the
batch ended, so a batch alternating data/add and data/get held each
loaded state alive; each reply now leaves the queue as it is encoded.
The exact-number policy judged a number by its recorded spelling, so a
state loaded with 1e20 came back from data/get as
100000000000000000000, which data/add refused, breaking the promise
that data/get output loads back unchanged. A number is exact only when
both its recorded spelling and the one serialization writes are safe,
so integers from 2^53 below 1e21 are refused in any spelling; replay
keeps such bodies as recorded text. A domain test checks that every
accepted number is accepted again once written back.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stop inheriting an outer nominal category when a zero-prefixed identifier cannot be decoded. Preserve exact manglings in unresolved results under class and enum filters while retaining ASCII nominal controls.
Validated 39 source and in-memory MCP tests, typecheck/lint, and 22 compiler-produced code symbols from an inert Swift 6.3.2 object. No real Hopper inventory or target execution. Fixes#5553.
Adds the state-writes spec folder: write plans per write tool (create,
update, delete, document) learned from the first successful recorded call,
the gate that replays the capture's timeline on the initial state and serves
a write tool only when a later read confirms its effect and none contradicts
it, deterministic generated values, the serving contract and what stays
unmodelled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every non-entity GET read became a document from its latest initial
recording, bounded only by writes under related roots, so GET /api/me
read before and after POST /api/orders published the post-write value
as initial state (entities already leave such a type recorded). A
document whose value changed between two of its line's reads across
any recorded write is now recorded as fields-differ; an unchanged
value is still a document.
MCP hints treated OPTIONS and TRACE as non-idempotent writes, so a CORS
preflight tool fell to the destructive default. The RFC 9110 safe
methods (GET, HEAD, OPTIONS, TRACE) are read-only and idempotent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain native-only dispatch workflows without requiring a deep provider profile. Validate exact target, operation, and current reader bindings during open, import, recording, and export; preserve selected deep bindings and caller limits.
Validated public CLI and stdio MCP save/reopen, exact CLI replay, changed-limit cache partitioning, baseline failure and candidate success on an Apple-clang fixture, snapshot lifecycle regressions, typecheck and lint. No target or deep engine execution. Fixes#5529.
The inspect_analysis_view contract text conflicted; main's Go and
IL2CPP wording and this branch's environment-state document sentence
touch separate parts of it and are both kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Combines the state-serving branch and the coverage branch so write effects
build on both: the catalog takes the source with the data-plane options, tool
descriptions keep the response summaries, and two tests follow the documents
the coverage branch now extracts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two conflicts, both from main's listener-failure classification
(0c440bfc): the command keeps its commandLogger (the same
listenerLogger) and takes main's typed onerror, and the serve options
keep state and fetchState beside main's StreamableHttpListenError
onerror type.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Have method, property, ivar, and adopted-protocol list owners flag real budget omissions on returned class, protocol, and category records. Preserve known empty lists and existing decode reasons.
Validated 59 source tests, two built CLI controls, five static inspections of an Apple-clang fixture, and typecheck/lint. The target was never executed. Fixes#5543.
Classify wholly unknown or unavailable node observations at the version-item owner and retain their limitations across matched and unmatched comparisons. Preserve positive mixed observations and genuine additions/removals.
Validated source regressions and public CLI/stdout MCP workflows in the 103-test focused gate; typecheck and lint pass. Fixes#5534.
Add opt-in Go build summaries and selected retained metadata pages while preserving complete Evidence and source identity.
Validated with 258 focused tests, full static/docs checks, real CLI/SDK workflows and native metadata oracles. CI baseline remediation assertions reproduce on unmodified main; fail-fast cancels two other shards. Owner authorized bypass with those coverage limits recorded in PR #5524.
Fixes#5499.
Normalize non-finite timer literals to the existing unknown value at the semantic fact producer. Keep timers, source provenance, binding resolution and unrelated functions; preserve all finite delay values.
Qualify shared CLI/MCP behavior with precise regression oracles, 111 tests, actual source fixtures, real-package summary/fact/Evidence workflows and current-main integration.
Fixes#3400.
83fcc739 bounded one /agentenv response to 64 MiB, but it still
serialized each reply whole before measuring it, so a batch of data/get
calls on a large state built every refused reply in full only to drop
it. Each reply is now measured in bounded JSON parts (the shared
jsonParts encoder), its parts kept only while it fits; a reply past the
budget is counted for its exact reply_bytes but never assembled. A test
checks that a refused read is never handed to JSON.stringify whole and
that its reply_bytes is exact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Allow the preceding Ghidra ownership preparation before waiting for the gated Kuna child. Keep the two-second cancellation join, exact reasons, reaping and cleanup assertions unchanged.
Refs #5568. A controlled startup delay reproduces the old failure; disabling cancellation forwarding still fails the retained join assertion. All 86 focused setup, doctor, helper and CLI checks passed on pinned Node 24.18.0/macOS arm64.
Keep installation availability and full doctor inspection facts separate from the setup ready-provider list. A blocked Kuna cache no longer advertises deep analysis; passing unverified-version notes remain usable.
Refs #5105. All 16 focused setup and public CLI dry-run controls passed; typecheck and lint passed. Tests use a scripted Kuna version fixture and do not establish real-engine behavior. The pre-existing doctor cancellation startup-poll failure is tracked separately.
Use the public rename API for an explicit empty existing name, retain omitted names and raw listing values, and verify fresh unnamed creation and explicit mutations by readback. Preserve independent verifier restorations and their primary failures.
Refs #5475. Focused bridge regressions and the complete real-Hopper suite passed on macOS arm64 with Hopper 6.6.0-demo 42.6316032. The verifier used a temporary unavailable Ghidra override to meet its sole-candidate prerequisite; reporter Hopper 6.1 remains unverified.
Give partial thin-header facts one domain owner and reuse them for standalone target admission and Mach-O load-command inspection. Preserve each consumer endianness policy and header/command checks; remove the FAT-only parser names.
Refs #5542. All 246 focused checks and six public CLI archive/image controls passed; typecheck and lint passed.
Reject browser scenario waits and action deadlines beyond the underlying signed 32-bit timer interval in the shared input contract. Preserve maximum legal values and omitted deadlines; prevent unsupported input from opening a browser.
Strengthen the rejection oracle and verify public CLI/MCP canonical validation in both schema profiles, actual Chromium timing/cancellation/cleanup, Evidence export and compatibility with current main.
Fixes#3392.
Preserve typed input-contract recovery and source diagnostics through filtered CLI output in JSON, TOON, YAML and Markdown. Update legacy remediation-text assertions introduced by the concurrent main update.
Refs #5431 and #5470.
