lidge-jun · Oct 4, 2026 · Oct 3, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
@@ -0,0 +1,63 @@
+# Independent regression acceptance
+
+The integrated source at `0818ea1812a028e1c14cd0b0511b44863407bc52`
+(tree `98c6c2f05364c8274d404ae5f6ecc56bb73450d2`) is accepted for the next
+complete candidate CI run. Production publication remains pending.
+
+Four fresh-context workers ran in parallel with disjoint temporary state and
+shared test locking. All 63 selected original test files executed: **2,423 pass,
+0 fail, 0 skip**. Separate current-source GUI verification passed 48 tests;
+a separate runner-isolation preflight passed 25. Those counts are not added to
+2,423. The candidate GUI build succeeded and its 94 generated artifact hashes
+remained unchanged through the manual browser verification.
+
+| Area | Original tests | Additional acceptance |
+| --- | ---: | --- |
+| Native accounts, catalog and fallback | 990 | Seventeen HTTP scenarios and the actual account CLI, including revoked versus transient credentials, replacement races, hard locks, precise model refusal and committed output. |
+| Request bytes, compaction and tool history | 370 | UTF-8 threshold captures, destination and cancellation controls, typed Messages errors, recovery limits, and ordered immutable Ollama tool history. |
+| Pairing, identity and existing-format accounting | 363 | Actual CLI minting, HTTP redemption, browser interaction, identity race negatives, capacity refusal, and durable legacy-journal restart/corruption. |
+| Provider, platform, CLI and historical fixtures | 700 | Discovery and saved-effort persistence across processes, operator commands, synthetic launcher controls, and eight separately executed original historical files. |
+
+A fresh independent acceptance review found no blocker to final candidate CI.
+Two independent visual reviews found only Low wrapping and validation-layout
+polish issues, with no observed clipped text or blocked controls. These are
+retained follow-ups, not claimed fixes or a complete accessibility audit.
+
+## Evidence limits and failed attempts
+
+Failed harness executions remain failed in the private evidence ledger. They
+were not overwritten or included as passing executions. Corrected probes use
+source-backed fixture contracts. Two request-probe expectations received a
+separate independent adjudication: cancellation prevented another physical send
+although the legacy reset-only counter remained zero; a preflighted compaction
+stream legitimately returned HTTP 400 rather than the HTTP 200 required for an
+already-open Messages stream. Neither result proves complete legacy accounting
+or preservation of client-visible partial compaction text.
+
+Manual expiry evidence proves rejection of an expired signed mint capability,
+not expiry of an issued pairing code. Current CLI/HTTP/browser pairing passed;
+full native SSH enrollment at this candidate was unavailable. Earlier native
+join/replacement and teardown evidence remains historical. The named pairing
+owners are byte-identical, which does not make that a fresh integrated native run.
+
+Every one of the 20 uniquely named assertions from the earlier broad failed run
+maps to a current pass in its original file. The former GUI setup error has
+current original-file coverage as well. This does not certify the old broad run
+or identify its historical state writer; its original 21-failure/one-error total
+is preserved. Complete cross-platform CI is still required.
+
+The original Antigravity Windows/multi-account report remains unproven, the real
+launcher scenario remains unavailable, and packaged Windows login behavior is
+not established by native helper/parser tests. The canonical spend migration
+remains excluded; the landed capacity repair preserves the existing format.
+Previously recorded accounting, diagnostic and dependency limitations remain
+explicit. No current required product failure was waived by those limitations.
+
+All owned processes, listeners and disposable homes were closed or removed;
+source and build identity were rechecked. The artifact validator only proves
+schema/source consistency; semantic acceptance comes from the reviewed scenario
+matrix and the explicit dispositions above.
+
+Next: run the complete `lane=all` CI at the accepted source SHA, inspect every
+requested job, then follow the separate version pre-move, promotion and publication
+procedure. This documentation record adds no product changes to that source.
@@ -0,0 +1,31 @@
+# First complete candidate run: NO-GO
+
+The final candidate check ran once against source
+`0818ea1812a028e1c14cd0b0511b44863407bc52` on the immutable
+`codex/release-2770-0818-candidate` branch. Run
+[37162399902](https://github.com/lidge-jun/opencodex/actions/runs/37162399902),
+attempt 1, used `workflow_dispatch` with `lane=all`. Its scope outputs selected
+all areas, including native, GUI, desktop packaging, docs and helper matrices.
+
+The result is **NO-GO**: 37 jobs succeeded, Windows shard 8/9 failed, and the
+aggregate correctly failed. The separate privacy-only job was intentionally
+unrequested; the privacy scan inside `gates` executed successfully.
+
+Linux's four shards, macOS's two shards and full-membership control, and eight
+Windows shards passed. macOS widget/app verification and Linux AppImage/deb,
+sidecar-keyring and packaged-shell E2E also passed. Those results remain valid
+observations of this attempt, not permission to ignore its failed shard.
+
+The reported error is `EPERM` in the temporary-directory teardown of
+`server-management-auth.test.ts`, in the self-logout case. The failing batch
+reported 140 passes and one failure; later batches in that shard did not run.
+The log identifies the recursive removal root, not the particular retained
+resource or permission condition. The cause is not established by the error
+message or by unchanged owning source relative to the earlier green candidate.
+
+A bounded investigation is collecting causal evidence. No cleanup retry budget,
+assertion, test membership, Windows requirement or release gate has been relaxed.
+There has been no blind retry, version pre-move, main promotion or publication.
+Any separate native diagnostic run is evidence collection only and cannot replace
+successful release verification. Production changes require a reviewed,
+evidence-backed repair and appropriate current-source regression/CI evidence.
@@ -0,0 +1,31 @@
+# Candidate acceptance: GO after unchanged Windows rerun
+
+Candidate `0818ea1812a028e1c14cd0b0511b44863407bc52` passed the complete
+cross-platform gate. Run
+[37162399902](https://github.com/lidge-jun/opencodex/actions/runs/37162399902)
+attempt 2 re-ran only the failed `windows 8/9` job and the aggregate, with the
+same command, assertions, test membership and removal retry schedule. The shard
+passed and the run concluded success: 40 jobs, all nine Windows shards green, and
+only the standalone `privacy gate` skipped because manual dispatch does not request
+it (the privacy scan inside `gates` passed).
+
+The attempt-1 failure is preserved in `021_candidate_first_run.md`. A separate
+non-release Windows diagnostic (run
+[37168238608](https://github.com/lidge-jun/opencodex/actions/runs/37168238608),
+same runner image `20260925.250.1` and Bun 1.4.0) replayed the failing six-file
+batch with instrumentation. The self-logout case's temp home was removed on the
+first attempt, so the failure did not reproduce in isolation. That run is
+diagnostic evidence only and was never treated as release proof; the diagnostic
+branches are not merged.
+
+What remains open: the cause of the intermittent teardown `EPERM` is not
+established. The diagnostic replay changed the temp root from the profile's
+8.3 short path to the runner temp drive, so it cannot exclude the lexical
+alias gap in the Windows ACL reap matcher, where a short-name root does not
+match long-name pending reaps. That gap is a real weakness, but nothing shows it
+caused this failure. It is a follow-up for the test-cleanup path, and the
+release gate did not depend on it.
+
+The candidate is promoted unchanged: the `main` promotion merge `06841165f8`
+(#6550) has the same tree as `0818ea1812`, after the version pre-move #6549
+opened `dev` at 2.78.0. Publication is recorded in `031_publication_outcome.md`.
@@ -0,0 +1,40 @@
+# Publication outcome: 2.77.0 released
+
+OpenCodex 2.77.0 is published as the stable `latest` release from `main`
+commit `06841165f884a9176d701310638b2112aca7a514`, whose tree is identical to
+the verified candidate `0818ea1812`.
+
+1. Version pre-move #6549 opened `dev` at 2.78.0 (`87e3156339`) after its exact-head
+   Cross-platform CI and Service lifecycle passed.
+2. Promotion #6550 merged as a merge commit through the owner-authorized admin PR
+   route. As with #6468, only the main-target `enforce-target` rule and CodeQL's
+   new-alert count against `main` were red; neither gates `release.yml`.
+3. Push-event Cross-platform CI
+   [37169967963](https://github.com/lidge-jun/opencodex/actions/runs/37169967963)
+   and Service lifecycle 37169967951 succeeded on `06841165f8`.
+4. Release workflow
+   [37170949169](https://github.com/lidge-jun/opencodex/actions/runs/37170949169)
+   (`version=2.77.0`, `tag=latest`, `dry-run=false`, `expected-sha=06841165f8`)
+   succeeded in every job: dispatch validation, preflight, five standalone and three
+   desktop packages, verification, npm publish, release attachment and outcomes.
+
+Published evidence:
+
+- npm `@bitkyc08/opencodex@2.77.0`, dist-tag `latest`, gitHead `06841165f8`,
+  shasum `4b0155005e19588bdaab1661eb02479de5546dad`, SLSA v1 provenance (Sigstore
+  log index 3076198266). The registry served the version about five minutes after
+  the publish step acknowledged it.
+- GitHub release [v2.77.0](https://github.com/lidge-jun/opencodex/releases/tag/v2.77.0),
+  tag on `06841165f8`, marked Latest, 25 assets (same set shape as v2.76.0):
+  standalone archives for darwin arm64/x64, linux arm64/x64 and windows x64, the
+  macOS app/dmg, Linux AppImage/deb and Windows MSI, checksums, updater signatures
+  and `latest.json`.
+- Docs deploy for `06841165f8` succeeded (run 37169967937).
+- Install smoke in a throwaway npm prefix with an isolated home: `ocx --version`
+  reports `opencodex 2.77.0` and `ocx help` runs; the darwin arm64 archive matches
+  its published SHA-256.
+
+Not verified here: launching the signed desktop installers on real macOS, Windows
+and Linux hosts, the in-app updater path from 2.76.0, and the native limits already
+recorded for #6220, #6473 and #6502. The intermittent Windows test-teardown
+`EPERM` described in `022_candidate_acceptance.md` remains a test-cleanup follow-up.