A served write of a missing entity also looked at the write tool's own
recordings, so a delete that recorded 200 null for a successful
deletion answered a missing target with success. A 2xx null is now an
absence only when the call is a read, as the gate takes it from item
reads; a write still answers with a recorded 400, 404 or 410, or is
refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Four places where the gate and serving still disagreed:
- the gate applied a document write to the held document whatever path
it wrote, while serving refuses any other path; a write at another
path is now unmodelled;
- a create took the first held collection its parent value matched,
so with acme1 and %61cme1 both held a create for acme1 could land in
the encoded one; the verbatim spelling now wins, as for item calls;
- the gate accepts a 2xx JSON null as a recorded absence, but serving
answered a missing entity only with a recorded 400, 404 or 410; the
null answer is now served too;
- data/add measured only the document it was given, so one that omits
types and the state Evidence id could load under 32 MiB and grow past
it as data/get writes it back; such a document is now refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keying checked lines by the raw path skipped a read serving still
answers: with the list recorded at /api/orgs/%61cme1/books, a later
/api/orgs/acme1/books read names the same line through replay's decoded
fallback, so it went unchecked while serving listed the encoded
collection, and a delete it contradicted stayed served.
The gate now ranks a view's checked lines for a read as replay ranks
them for its call: every parameter the read's value verbatim or once
percent-decoded and the same query, then the most verbatim parameters,
then recorded order. A list is compared from the collection of the line
it answers from, as serving lists it, in the check, the taint checks and
the insert retry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Checked lines now keep the path as spelled and canonicalise only the
query: replay prefers a verbatim path spelling, so two spellings of
one parent (acme1 and %61cme1 under one templated tool) stay separate
lines and each read is compared with its own line's envelope.
- A slug rule a later call shows is checked against the values earlier
calls recorded (the slug of the source they sent against the slug
they showed), not only their member names, so a call that resent an
unchanged name no longer hides the tool; an increment still conflicts
with an earlier call that showed an integer field unchanged.
The view fixture takes template rules so the gate can be tested over
templated parents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Five places where the gate approved a write serving would answer
differently:
- list and document reads are matched to checked lines as serving
matches calls (path and query values decoded, the query in any
order), so a reordered query no longer hides a contradiction;
- an increment or slug applies to every call, so a plan is
unexplained-change when one call changes such a field and another
leaves it as it was, in either order;
- an item read confirming a create no longer stops a later list from
choosing another insert candidate; only a list check fixes the rule;
- the gate runs serving's document body check (accepted members, JSON
types from the held and initial document), so a recorded write that
serving would refuse leaves the plan unserved;
- a served create decodes its path values from the collection the call
names, as the gate decoded the recorded path, whichever spelling the
call used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The coverage branch writes captured field names in response summaries as
JSON strings, which changes the replay card's tool descriptions. The pin
moves to the 12,818-byte card; removing the quotes reproduces the old
12,618-byte digest exactly, so nothing else in the card changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The state-writes spec now says what the review fixes changed: document
writes are served only at the path the state holds the document at and
type-check their members; a value data/add would refuse, or growth past
the 32 MiB intake limit, is refused; only a 2xx write is modelled; the
gate compares the full response serving would give; an update's
transformed member stores the value its call recorded; and an unfiltered
list answers from a line of the collection its path arguments name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Served writes now refuse, before changing the state:
- a document write with members or JSON types its plan did not accept
(the same body check entity writes use), or at a path other than the
one the state holds the document at;
- a body or resulting value data/add would refuse (a number inexact as
data/get writes it, a __proto__ member, nesting past the limit), so
data/get output always loads back, increments included;
- a create, update or document write that would take the state past the
32 MiB data/add intake limit (resource_constraint), with the state's
serialized size kept incrementally rather than reserialized.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The write gate confirmed effects the served environment would not show:
- a list check let a member the state no longer holds pass, so a
filtered list still showing a deleted entity confirmed the delete; it
now compares the whole list serving would return;
- item and list checks compared only the entity, so a wrapper member
that changed after the write (a revision, say) went unnoticed while
serving kept the base recording's; reads are now compared as the full
response rendered into the item view's or the line's base envelope;
- a later update's constant rule kept no value, so serving stored the
first observation's; each constant rule now carries the value the
call that showed it recorded, and the gate and serving read it alike;
- a redirected or unanswered write could become the example or a
modelled effect; only a 2xx write is modelled, others taint as
unmodelled writes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An unfiltered list call chose the first paging-only line of the tool
whatever its path arguments named, so with /api/orgs/1/books?limit=50
and /api/orgs/2/books?limit=50 behind one tool, a call for org 2 got
org 1's books. The line must now be of the collection the call's path
arguments name (matched as item calls match, chosen as replay chooses);
a parent with no such line answers from its recording.
The serving guide and the evidence-workflow reference still said state
mode leaves write tools out and that no write has an effect; they now
describe confirmed write tools being served and what a served write
does not model.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The inspect_analysis_view contract text conflicted; main's wording and this branch's state sentences touch separate parts of it and are both kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The contract text conflicted only because both sides carry the coverage sentence; this branch's adds the write sentence beside it, so it is kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain absent or invalid Runtime timestamps as null and mark console event coverage incomplete. Preserve observed finite timestamps, including zero, and document the epoch-millisecond clock.
BREAKING CHANGE: console event timestamps may now be null when the protocol does not provide a finite number.
Refs #5656
The response budget counted accepted replies only: a budget error that
replaced a reply, and a batch's brackets and commas, were not charged,
so near 64 MiB later refusals pushed the body past the advertised
limit. Every reply still to come now keeps room for its own budget
error, and a batch keeps room for its framing, so a refusal always fits
and the body never passes the budget. Reply ids and which messages are
answered come from one place shared by the replies and the reserve.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads
Parse the linkedit install name for lazy-load info commands, resolve those
edges without traversing them, and stop inspect-macho from treating an otool
dependency list as exhaustive when that payload is omitted.
Fixes#5551Fixes#5649
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load payload reads and image offsets
Reuse identical LC_LAZY_LOAD_DYLIB_INFO ranges, cap their combined size,
and reject flag or chain-start offsets outside the slice VM range.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load string scans and contained reads
Reject payload strings that start in the 24-byte header, validate each
file-offset string once, and reuse payload bytes already read for a
containing range.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): reject cached lazy-load strings outside a payload
Remember each cached string's terminating offset and require that NUL to
fall inside the payload being decoded.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): bound lazy-load payload range lookups
Count containment checks across earlier payload reads and stop at the
existing 16 MiB work limit.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): count every lazy-info string reference
Charge repeated and overlapping LC_LAZY_LOAD_DYLIB_INFO scans against the
16 MiB validation budget, and stop a scan once that budget is exhausted.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): cap retained lazy-info dependency results
Stop after 1024 LC_LAZY_LOAD_DYLIB_INFO commands so a load-command region
full of identical commands cannot become a million traced edges.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): reject a lazy-load path NUL in the final byte
dyld stops the load-path scan before the payload's last byte, so a
terminator in that byte leaves the image malformed.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): keep may-be-missing lazy loads optional
A missing LC_LAZY_LOAD_DYLIB_INFO with the may-be-missing bit is weak, so the lazy finding says dyld continues on first use instead of failing.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* fix(apple): cap lazy-info symbol string references
A payload of distinct one-byte symbol strings stayed under the byte budgets while caching one entry per offset. A slice now stops at 65536 symbol references.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
The census ran over 50 captures, 45 HAR inspections and 5 browser
scenarios; the verification said 51.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: split fast and deep static checks
Fast PRs run typecheck, lint, and format before provider admission.
Knip, duplication, architecture guards, and Python stay on the full tier.
Shared-boundary fallbacks keep the Linux x64 baseline, and Turbo jobs
export remote-cache credentials when they are configured.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep pull requests from writing the remote cache
Trusted default-branch runs still receive TURBO_TOKEN. Pull requests get an
empty token and remote read-only mode. Knip saves a per-commit cache key so
the next trusted full run can refresh the restored snapshot.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: forward the release cache token and upload deep static reports
Release qualification now passes TURBO_TOKEN into the called workflow.
Labeled pull requests still do not. The deep static job records its task
context and uploads duplication reports after a failed gate.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* style: format the turbo cache policy test
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep fast checks exclusive and trusted cache writes explicit
Declare the static artifact name and context script so typecheck matches the
implementations. Lock check:ci:fast around dist, and publish the remote cache
only for release qualification or default-branch push, schedule, and dispatch.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: record static task graphs without nesting the artifacts lock
Keep check:ci:fast locked, and point graph recording at the unlocked
check:ci:fast:tasks script so check:pr and check:test can record hashes
while they already hold that lock.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* ci: keep unauthenticated Turbo runs on the local cache
Open pull requests do not receive TURBO_TOKEN, so a remote read mode cannot
authenticate. Those runs now use the local cache. Trusted runs still publish.
Co-authored-by: morluto <morluto@users.noreply.github.com>
* test(ida): treat unchanged invalid requests as nonretryable
Main already stopped marking invalid_request retryable. The pull request
merge runs that projector, while the IDA lookup tests still expected
retryable true. Match the merged behavior.
Co-authored-by: morluto <morluto@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Sample the browser monotonic clock with observation already subscribed, filter historical lifecycle and network facts, and preserve scope and termination handling when event time is unknown.
Bound pre-arm retention using transport-owned wire bytes. Fail closed when the relevant-event buffer fills, and keep unrelated protocol payloads outside that budget.
BREAKING CHANGE: observe_web_session timeline timestamps can be null when the producer supplies no comparable timestamp. Consumers must handle unknown time explicitly.
Refs #5609
Add opt-in Frida session status summaries linked to complete retained Evidence. Share canonical session facts across contracts and preserve observed state, source identity and capture truncation.
Validated with native SDK/client workflows, default delivery compatibility, lifecycle and provenance tests. The completed large-history task uses 50.9% fewer estimated request tokens; no general CPU or latency improvement is claimed.
Fixes#5640
Field and member names from a capture were joined raw into tool
descriptions that use ", " and "; " themselves, so a key such as
"x; recorded statuses 500" made a description claim a status the tool
never recorded, and "id, name" read as two fields. Names are now
written as JSON strings; a name too long for a sample is still refused
by the sample without being copied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The inspect_analysis_view contract text conflicted again; main's
wording and this branch's environment-state document sentence touch
separate parts of it and are both kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain process input and unexpected failure diagnostics through the shared error projector. Preserve filesystem causes and firmware validation issues, and mark unchanged invalid requests nonretryable.
Use typed stat settlement and parse unknown command failures without losing null or undefined rejection causes.
Refs #5397, #5401, #5402, #5642
Bind and recheck the digest-verified snapshot used by codesign, retaining cleanup ownership when its identity changes. Classify unsigned only from the exact operand-framed diagnostic so echoed caller paths cannot turn unrelated failures into signature facts.
Closes#5636
Keep parser-owned completed metadata and tensor declarations as typed partial Evidence on cancellation or physical read failure. Preserve unknown final identity and digests, exact caller inputs, primary failures, and retained cleanup owners; support inline and retained MCP error delivery.
Closes#5625
Add opt-in retained GDB and objdump summaries using the shared analysis-view layer. Preserve default complete Evidence, ordered records, provenance and completion facts.
Validate real Bash disassembly, whole-client context costs, CLI publication and cleanup; retain the original measured cohorts and explicit coverage limitations.
Closes#5584.
Gates, the per-capture write verdicts over the 51 showcase captures, the
in-process smoke of every served write tool, the AgentEnv run of a randomly
chosen published environment graded from data/get, and the served model
compared with the live application on the same calls.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Admit only the corroborated missing-UUID validation diagnostic from header-stripped dyld stdout. Preserve readable load commands and nm exports with unknown dyld coverage, and keep unrelated process and tool failures typed.
Closes#5606
Derive Darwin subprocess test budgets from the bounded ownership compiler budget while preserving short command deadlines. Always join the retained command scope after test failures.
Refs #5094.
52d1a72af made a cancelled write whose staging cleanup also fails carry the
caller's exact abort reason as its cause, with the cancellation retained as
cleanupPrimary and the staging directory as cleanup state. The boundary test
still expected the old wrapped cause, so it failed on main and in every PR
built on it; its finally block then masked the assertion with a cleanup
error. Assert the current contract.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Classify legacy class-object names at the Hopper boundary and carry the typed fact into class discovery. Preserve exact labels, literal filtering, unrelated row metadata, and raw replies; derive classification from source text rather than incoming tags.
Closes#5617
Read bounded regular registrations asynchronously with retained descriptor cleanup. Carry the selected parsed configuration through provider factories and restoration, preserve exact cancellation reasons, and share workspace-parent resolution with doctor checks.
Closes#5561Closes#5559Closes#5604
Unit tests for clock, UUID, token, slug and delimited-token values, the field
rules that explain created and updated entities, response shapes, insert
rules and the shared apply functions; view tests for every plan reason, delete
confirmation by a 400, 404 or null read, learned insert rules, unmodelled
writes and observations from later reads; services tests for served creates,
updates and deletes, refusals that leave the state unchanged, deterministic
values across reset and load, missing entities, the catalog and paging-only
list lines; and an MCP boundary test that serves a capture through the built
CLI, applies a create and resets it. The capture fixture records request
bodies.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A refused call no longer advances the served clock, the write counter or a
sequence: values are reserved while a call is answered and committed with its
mutation, and deletes and document writes advance the clock like the others.
Updated entities cite no records, so data/get output loads back unchanged.
The gate withholds an update or delete that answers with the entity when no
initial entity holds every field its recorded answer shows, which would
answer only for entities the environment created (incomplete-entities). A
create whose template keeps a path value is tied to its collection like a
constant, and a delimited token is found after an overlapping undelimited one.
Documents write plans, the gate and served writes in the environment-state
and serving guides, the CLI help, the analysis-view contract and the bundle
README, and records the replay card the response summaries now produce.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Compare executable fingerprints before and after the owned version probe, and capture the script prefix from the final hash stream. Preserve partial facts and failed-close ownership without claiming process interruption from a snapshot.
Closes#5611
