[lukemaj]

What: Active source agents can render HTML from a permitted idle linked environment without starting a destination agent.
Why: HTML admission treated the destination resource context as the live caller, and publication needed a fresh source-authority check after remote waits.
So what: This #382 component targets the #379 integration branch; independent Sol MEDIUM and Opus 5.5 MEDIUM reviews and CI must pass before internal merge.

An active A request previously returned parent_not_active when B was idle; the same credential and request succeeded only after B's fixture run was activated. The repair opts HTML into the existing resource admission with an explicit capability-neutral thread-resource intent. B still prepares its own image bytes and A alone publishes the page. Local callers retain actual run liveness, and browser/device retain their capability checks.

Destination authorization is rechecked after preparation; the source file-effect owner rechecks original authority immediately before writing. The existing external receipt, deterministic attachment identity, same-key replay and changed-input refusal remain. No new permission, protocol, authority service, B credential, package version or grant is introduced.

Related: #382 and #379. Component only, no closing linkage; no main merge, deployment, restart or live-user-data work. Approved repair boundary and full material evidence: #379 (comment). Current base: d5a52b6 after reviewed, CI-green #566. Current head: abd763a; tree be00cc5b511f851a86b69fb08e9cd570555c4eed. Both round-1 reviews approved the prior head; fresh round-2 reviews are required after composition.

Requirements and who asked: User-approved #379/#382 requires source-owned cross-machine HTML with idle destination resources, current authority and safe retries.
Deleted: Destination-agent startup, token borrowing, invented HTML/browser grant, global liveness relaxation and unrelated acceptance work.
Bottleneck: Correct actor/resource distinction and fresh authorization at the existing preparation/publication owners.
Checked myself: Complete component diff and handoff, corrected public-path baseline and focused proof outputs, exact clean component identity and six source hashes; both independent current-candidate reviews remain pending.

Proof, pinned Node 24.13.1 / pnpm 11.10.0:

• Current rebased head: combined HTML/idle-resource/background plus actual Chromium CredentialFill checks pass 52 tests (152 unselected), and cache-disabled server tsc-rs passes. Captured source/config inputs are unchanged throughout both runs. The complete seven-file component diff is byte-identical to round 1; the sole base change is test(peer): check the vault refusal error envelope #566's reviewed test assertion.
• Original source-checkpoint proof, retained on identical component source bytes:
• Failing-before intended idle-B positive returns parent_not_active on e7a11.
• vp test run apps/server/src/peer/PeerAuthority.typedEffects.workflow.test.ts -t 'html382|idle-resource383|background383-r16' --maxWorkers 1: 27 pass, 152 unselected.
• vp test run apps/server/src/mcp/McpToolAccess.test.ts apps/server/src/mcp/McpToolAccess.race.test.ts apps/server/src/htmlRender/HtmlRender.test.ts apps/server/src/peer/PeerAuthority.test.ts --maxWorkers 1: 96 pass, 4 browser-dependent skips.
• Cache-disabled server tsc-rs, six-file formatting and targeted lint pass, with existing lint warnings.
• Real registered authenticated peer/authority/SQLite/HTML services prove B-image/A-page ownership, replay preserving later edits, provider/liveness/scope/archive/mode/deletion/revocation denials and deterministic held-work revocation. External browser measurement remains unavailable in the fixture; no browser/provider/client was launched.

This is scoped component proof, not complete #379 acceptance, final cumulative review, migration/rollback proof or live client verification. #385, remaining #386 criteria and separately owned #531 remain open. Upstream current-main HTML has no linked preparation path; the inspected credential-reuse PR #17096 has a different cause and no upstream patch was ported.

Implementation: GPT-6.1 Sol, Codex, MEDIUM. Integration driver: GPT-6.1 Sol, Codex, MEDIUM.

[lukemaj]

What: Sol MEDIUM approves the whole seven-file component at 926c9a2efd94e486787ae2dd2d3c164f60b41df0, with no required findings.
Why: Its complete diff and consumer review confirms idle resource admission, current original-authority checks after waits, and source-owned receipt/publication behavior.
So what: Opus's independent verdict and current CI remain required before internal merge; review/independent stays pending until both families finish.

Requirements and who asked: User-approved #379/#382 requires exact-candidate independent review before component integration.
Deleted: No second-family review, CI or final outcome acceptance is waived.
Bottleneck: Remaining exact-candidate Opus review and CI.
Checked myself: Read the full Sol report, its seven-path ledger, independently recomputed source/proof binding and explicit limits. The single optional changed-input-test precision observation is retained and does not establish a product defect.

Unchanged Sol round-1 whole-component report

PR #563, Sol MEDIUM, independent whole-component review round 1

What: WHOLE COMPONENT APPROVE at 926c9a2efd94e486787ae2dd2d3c164f60b41df0, with no supported required finding across the seven-file component.
Why: The explicit resource intent admits a verified originating actor into an idle destination context, while the existing authority owner checks preparation after its wait and the actual source file owner checks publication after receipt admission.
So what: The parent relays this report unchanged and pairs it with the separately required Opus review on this exact candidate; this verdict does not establish CI, integration readiness or final #379 acceptance.

Reviewer: GPT-6.1 Sol / Codex / MEDIUM, explicitly requested, separate from the author. No child agents, tests, installs, product driving, provider execution or reviewer consultation. No prior review of this component candidate is reused as approval.

Identity and boundaries

Object	Exact identity
Base	e7a11a84f03f7022a8013aa956d8afec5d250eb3
HEAD	926c9a2efd94e486787ae2dd2d3c164f60b41df0
Tree	acd2f3237c74cfda26fe2aeb68cc5d6159b1a8d3
Source checkpoint	f0babcdf9807e7346e61e09c29ffdbb5630318d9
Main reference supplied	68b3177c859c7f7da7ef546ffedd888aeb844622
Branch	fix/382-idle-html-resource-context
PR	#563

Independently read Git HEAD/tree/status, remotes and upstream divergence, and live PR identity. Git is clean; divergence from the configured component upstream is 0/0. The live open PR has the exact base/head above and targets feat/379-cross-machine-parity. The captured diff is byte-identical to actual git diff BASE HEAD, SHA-256 854bd252f071729c9842dccc98d2b048d804275e3f02b83856731fc3e5ab6e5c. The actual artifact has 649 lines, rather than the brief's approximate 485; all 649 were read in bounded chunks, including every changed test hunk.

Only scratch files in this report's designated sol directory were written. No source/index/ref/worktree/service/database or GitHub content/status mutation occurred. The required product-native PR navigation link was registered for this thread. Parent owns topology, source changes, paired status and publication. The current STOP and final one-approval-PR limit supersede older delivery language in #379.

Elon record

Requirements and who asked: Parent's approved #379/#382 repair and this exact review assignment require live originating A, permitted ordinary idle B with no B token/provider, B image preparation, A-only publication, current authority/modes/resource checks and stable replay. This contributes to Promachos directing work across environments.
Deleted: New grant/service/authority machinery, preview consent for HTML, global liveness exceptions, fabricated B execution, unrelated #386 implementation, review-time test/product execution and historical approval transfer.
Bottleneck: Preserve original-actor authorization at the resource return and actual source file effect while removing the unrelated destination-run prerequisite.
Checked myself: Exact Git/live PR/diff identity; all seven diff sections and current owner/caller code; full required base compatibility reports and current task records; raw red/final workflow/unit logs, failed-attempt diagnostics and run metadata; all 24,349 captured current source/config input hashes, the six source-checkpoint blobs and final proof input maps.

Required findings

None. WHOLE COMPONENT APPROVE is scoped to the exact seven-file repair, not the cumulative parent outcome. Both independent families are required by conjunction; this report supplies only the Sol verdict.

Behavioral and authority dispositions

1. Common local call: actsOnResource("thread-resource") still takes writingCaller for local calls. The read-only-client refusal and canonical provider-owned assertLiveCaller remain. actsAsCaller is unchanged. publish -> prepare -> publishPrepared preserves preparation, page/image limits, title/height handling and attachment identity. The fresh local check uses the existing authority service when present; otherwise it provisions the actual invocation/thread service into loadCaller and checks canonical liveness. Direct trusted service calls without an MCP invocation retain their existing contract. Registered live, local plan and matching background cases pass; background retirement refuses.
2. Ordinary remote call: McpHttpServer authenticates the actual issued A bearer and the B peer session/envelope. withContext validates the exact payload, selected B shell, resource scope and modes. Modern context selection binds durable B identity with incoming A authority and does not call scopeForThread. The new explicit intent uses that same verified authority owner; it does not treat B's configured provider as an actor. The retained positive has a different configured B provider, B idle/no credential, no preview/device grant, exact B SVG bytes in A's stored page, A-qualified reference and no B page.
3. Provenance and current ceilings: recheckInvocation reads the authoritative record, validates its original live chain, intersects the invocation's checked ceiling, checks the actual target resource, rejects archived/deleted/missing contexts, intersects current modes and filters current capabilities. thread-resource skips only the preview/device capability membership requirement. No optional capability or flags allow an accidentally omitted grant. withContext and forwarding retain their payload, resource, origin run and grant-generation bindings. The neutral intent does not confer vault, browser or device access.
4. Incoming failures: The new registered controls deny wrong original provider, ended A, narrowed B scope, archived B, incompatible source interaction/runtime modes, absent/deleted B and revoked authenticated session, with no new pages. The resumed-A positive prevents the preceding denial sequence from masquerading as universal failure. Grant generation/expiry, stale-chain and created-work membership semantics remain at the unchanged existing authority owner; not every such variant is newly executed by this component.
5. Preparation race: B calls the actual prepare, then recheckResource before returning preparedHtml. Three Deferred-held real image streams change source liveness, resource grant or authenticated session during the read. Each observes failure from the actual forwarded B registration independently of source publication, no returned prepared document, no A page/completed receipt and no B page/run/token. The gate wraps the actual filesystem stream and delegates to it; it does not substitute image bytes or authorization. Without the optional gate it uses the actual stream directly.
6. Publication race and receipts: publishPrepared places the fresh original invocation check inside externalDispatch, immediately before writeFileString. Receipt identify/claim work therefore precedes the fresh check. Known authorization failure calls confirmNotDispatched, allowing the winning started receipt to return to bound and preserving the actual refusal instead of a false unknown outcome. The held real successful B HTTP response contains prepared SVG bytes; ending A before release produces capability_denied at publication, no A/B HTML and no completed source receipt. There is no synthetic handler-level effect or pre-wait substitute for this check.
7. Replay and conflicts: Actual source publication still uses deterministic A attachment identity, exclusive keyed creation and the existing reference-only external receipt. Completed receipt replay returns the original reference without rerunning the file effect or overwriting a later A edit. Receipt intent/generation binding remains unchanged. The positive checks later edited file bytes and exactly one completed source receipt; changed input refuses. B preparation itself does not claim external publication or store prepared bytes in a completed generic receipt.
8. Preview/device and genuine run owners: Existing callers still pass their required preview or device intent. The capability test and old failure wording are identical for those variants. Broker/device effect-time checks remain in their owners; local background semantics use the canonical provider-owned predicate, while incoming forwarded foreground-run identity remains strict. Selected existing idle-resource/background regressions pass. request_secret, delegation and worktree handoff declarations were not widened.
9. Legacy and bounded resources: withContext still rejects legacy credential borrowing when the modern authority owner exists. Minimal legacy compositions retain prior live-credential admission, with an additional real-caller check before a new local publication. Missing authority does not fall back when modern provenance/legacy ceilings require its owner. Image content validation, 10 MiB/image and 25 MiB/page limits, bounded stream reads/concurrency and source-only file naming remain. No new browser process is required by intake; existing optional local measurement is unchanged.
10. Temporal limit: These checks do not provide distributed atomic revocation. The accepted validation-to-effect interval remains. The held tests prove the selected observed transitions, not arbitrary OS crashes, physical filesystem isolation or every possible timing.

Per-path ledger

All diff ranges below are one-based and inclusive in the manifest's component.diff. No path is exempted merely because its change is small.

Path	Diff lines fully read	Current context and judgment
apps/server/src/htmlRender/HtmlRender.ts	1-43	Imports, service contract, image parsing/validation, preparation, measurement and complete publish/publishPrepared bodies read through line 520. Actual file effect, authority service/fallback, no-dispatch receipt signal and source ownership inspected. No supported defect.
apps/server/src/mcp/McpToolAccess.ts	44-88	Current lines 1-240, declaration wrapper, writingCaller, actsAsCaller, resource and attachment admission. Factoring retains preview/device sequencing and local policy. No supported defect.
apps/server/src/mcp/toolkits/html/handlers.ts	89-117	Entire current file read, including unchanged preview/error conversion and both registrations. Only render selects neutral intent; recheck occurs after awaited prepare. No supported defect.
apps/server/src/peer/PeerAuthority.ts	118-158	Entire recheckInvocation plus checkBinding, loadResource, checkThread, currentCapabilities, core interactive validate/reverse grant/resource branches and incoming/source ownership read. Explicit variant preserves shared branches. No supported defect.
apps/server/src/peer/PeerAuthority.typedEffects.workflow.test.ts	159-600	Every changed body/helper read, including retained replay/conflict assertions; selected existing idle-resource/background bodies inspected as consumers. Real registrations and file/receipt oracles, independently observable destination denial and held-source return established. Optional assertion precision below.
apps/server/src/peer/PeerAuthority.workflow.fixture.ts	601-636	Options, actual filesystem capture, production-kernel choice, real HTML layer, no-browser leaf, toolkit composition and complete nativeRpcCall/nativeCall inspected. Optional gate delegates actual bytes. No supported defect.
docs/map.md	637-649	Current surrounding graph read. Secondary PR annotation replaces merged #410 with open #563 for #382; no graph/dependency edge is cleared. No supported defect.

Consumers and material history

Fresh source tracing covers McpRouting.ts lines 1-403, threadAccess.ts caller/liveness and command identity, invocation canonical liveness, linkOrigin.ts provenance/resource predicates, request namespace/generation, request-receipt claim/replay/no-dispatch/external helpers, HTTP auth and HTML toolkit registration, forwarding envelope construction and PeerMcpClient public call/channel/error handling. Searches found only the HTML handler's publish and routing's publishPrepared as production publication callers. Current preview/device/preview-controls declarations and their broker/device rechecks were inspected. The shared authority service does not import McpToolAccess/McpRouting/HtmlRender, so the prohibited new access-routing-render import cycle is not introduced.

Read in full: supplied original diagnosis/accepted parent design choice and author response; saved current approved #379 body (all 227 lines, bounded follow-ups after truncated initial output); live #382 body and comments 6246883598, 6246900106 and 6276863197; parent decision 6286812120 (its complete diagnosis is also supplied verbatim); both full original e7a11 main-alignment reports. Read both final #383 R19 reports live, Sol 6284649985 including its complete path ledger and Opus 6284276953. Selected R15/R16 references in the inherited packet were consulted as leads, then current shared source and existing regression consumers were checked.

Material dispositions retained: R15 idle context and R16 local background/original incoming identity separation; publication authorization and stable reference/no-repeat; vault linked-provenance refusal rather than new vault consent; existing main-alignment F1/F2/F3 and Opus R1/R2 repairs. Their prior approvals are context, not transferred to this candidate. This patch does not change vault handlers, configureMcp, attachment staging, automation graphs, accepted-definition execution or client layout.

Not reread cover-to-cover: the 1.35 MB inherited packet, every historical PR/Issue comment, #384's full final reviews or all unchanged native test bodies. Their scoped dispositions/limits were read in the required e7a11 reports and #383 final reports. No claim is made to recertify those components. The packet's selected keyword matches do not count as full historical coverage. This is seven-file whole-component coverage, not whole #379 or the former 107/131-path components.

Proof inspection, identity and reuse

Companion proof-binding.json records independently computed source/log hashes, all run-index metadata, final equality and actual candidate identities. I recomputed all 24,349 entries in the captured TypeScript/JSON/YAML/lockfile input map against current files: zero missing/mismatched inputs. All five final checks have before/after maps exactly equal to that current capture. All six manifest source hashes independently match both the current files and source-checkpoint Git blobs. The source-checkpoint-to-current delta is only docs/map.md, verified with Git. The four red production hashes independently match base Git blobs.

The runner was read: it executes argv arrays with task TMPDIR and Europe/Warsaw, captures raw output and before/after inputs. Runtime/setup logs identify Node v24.13.1 and pnpm 11.10.0. Every indexed command, exit, timestamp, cwd and input-equality field was read in compact untruncated form. Final raw red/workflow/unit logs and setup/format/commit/runtime logs were read; compiler/lint headers, endings, diagnostic classes and error scan were inspected. The 329 repetitive compiler suggestions and every lint warning were not individually adjudicated. Those logs remain hashed, not silently counted as warning-free proof.

All commands use prefix npm exec --offline --package=node@24.13.1 --package=pnpm@11.10.0 -- pnpm exec, except installation uses that pinned npm prefix followed by pnpm install --frozen-lockfile --yes.

Record	Exact command after prefix	Observed result
red.json / red.log	vp test run apps/server/src/peer/PeerAuthority.typedEffects.workflow.test.ts -t html382 --maxWorkers 1	Exit 1, 1 intended failure / 172 unselected; parent_not_active at success assertion. Four production files match e7a11. This older test input is not mislabeled identical to final differing-provider input.
green-family.json / .log	`vp test run apps/server/src/peer/PeerAuthority.typedEffects.workflow.test.ts -t 'html382	idle-resource383
green-unit.json / .log	vp test run apps/server/src/mcp/McpToolAccess.test.ts apps/server/src/mcp/McpToolAccess.race.test.ts apps/server/src/htmlRender/HtmlRender.test.ts apps/server/src/peer/PeerAuthority.test.ts --maxWorkers 1	Exit 0, four files, 96 passed / 4 skipped, 46.39 seconds. Browser-dependent skips remain skips.
typecheck-final.json / .log	vp run --filter t3 --no-cache typecheck	Exit 0, actual tsc-rs --noEmit, cache disabled, suggestions and zero error TS diagnostics.
lint-final.json / .log	vp lint followed by the exact six source/test paths in the manifest	Exit 0 with warnings.
fmt-check.json / .log	vp fmt --check followed by those same six paths	Exit 0, all six matched files formatted.

Failed attempts remain failures: green-expanded exit -15 was canceled after ineffective outer suspension; held-diagnose exit 1 observed successful preparation before the supposed gate, proving that gate did not hold the actual read. The fixture now wraps the actual captured stream. green-temporal exit 1 had three passes and two incidental exact-capability-set failures; current assertions preserve provider identity and absence of preview/device while allowing unrelated registry capabilities. typecheck-initial exit 2 caught missing Effect services, exact-optional construction and global fetch; current source explicitly provisions services, constructs the optional property conditionally and uses the existing Fetch leaf. No failed attempt is included in 27/96 passing counts. Earlier intermediate greens have different inputs and are not current proof.

Original diagnosis's raw run-2 command/metadata/log and before/after hash records were read; the supplied complete observations explain idle-active-idle under one A credential. It is one finite test with ten calls, not ten independent tests. The initial missing scratch-manifest failure and corrected preflight remain historical setup facts. No upstream port is used; the accepted bounded upstream search found no same-cause fix and is not claimed freshly repeated here.

This is retained affected-repository evidence, not a trusted complete scoped-delivery gate. The captured extension filter excludes such inputs as TSX, environment files and ignored dependency contents; hashes do not independently observe every runtime/environment assumption. I ran no tests and made no current browser/client/provider/physical-host, OS-crash, restart/migration or complete CI observation. Shared-fixture consumers beyond the selected family/four unit files were not all rerun. Current complete CI and primary integrated client proof remain parent-owned.

Optional proof improvement, not a required correction

O1: In the changed-input control at PeerAuthority.typedEffects.workflow.test.ts:2077, the call issues a fresh default credential and only asserts isError. Existing stable namespace/generation code supports the intended conflict, but asserting invalid_request plus the exact different-input diagnostic, and supplying the original explicit credential/capabilities, would distinguish semantic conflict from another refusal more directly. This is test precision, not evidence of a reachable product defect; unchanged receipt identity code and the original diagnostic already establish the intended mechanism.

No speculative redesign or additional mandatory test is requested.

Unfinished and acceptance limits

No required finding remains in this exact seven-file scope. #382 and parent #379 remain open. #385/#386 edges, native/browser/client acceptance, independently upgraded peers, migration, complete CI and final cumulative review are not cleared here. Historical optional/unmeasured viewer/feed/font/column/Android, vault audit/docs and private-config-replay items retain their prior states; #531 remains separately owned and untouched.

Parent must combine this report with the independently produced Opus verdict, preserving findings by conjunction rather than vote, and verify the exact current candidate before any authorized next step. No merge, deployment, installation, installed restart or final acceptance is authorized by this report.

Final verdict: WHOLE COMPONENT APPROVE, exact base e7a11a84f03f7022a8013aa956d8afec5d250eb3, head 926c9a2efd94e486787ae2dd2d3c164f60b41df0, tree acd2f3237c74cfda26fe2aeb68cc5d6159b1a8d3.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.9 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: abd763a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

What: #563 Test Server 7 failed one existing CredentialFill assertion; 1,361 tests passed and 11 were skipped in that shard.
Why: CredentialFill.test.ts:440 expects plain error text, while the inherited registered-tool serializer returns the identical safe message in a JSON object.
So what: The driver assigns a separate compatibility-test repair at integration e7a11; #563 remains frozen while its Opus review completes, then will be rebased and revalidated after the lower-layer component merges.

Requirements and who asked: The user requires fixing inherited integration CI and preserving meaningful vault error/no-secret behavior.
Deleted: No production error-contract change, broad fallback, weakening to isError-only, unrelated HTML source change or blind rerun of the failed job.
Bottleneck: Align this one legacy test with the established public safe error envelope and prove the exact origin-mismatch message and no-secret/audit invariants still hold.
Checked myself: Downloaded completed job logs despite the overall run still executing; read exact expected/received values and the CredentialFill test. Read current McpHttpServer.wireToolkit/toolkitRegistration, which deliberately returns scrubbed JSON failures to preserve declared receipt errors. No #563 source hunk changes credential filling or registration. This is a supported test-contract mismatch, not an infrastructure failure claim.

Job: https://github.com/toolboxmd/chromeria/actions/runs/39396196252/job/118539645232, exact PR head 926c9a2. Failure: returns only the outcome and writes a value-free audit line per attempt. Expected text is the originMismatch message; received text is JSON containing exactly that same message. The repair must parse/check the public envelope without losing exact-message, actual-page/vault, sentinel-exclusion or audit assertions. It needs isolated Chromium execution, not a schema-only pass. No production behavior or authority expansion is selected.

[lukemaj]

What: Both required independent families approve the whole #563 component at 926c9a2efd94e486787ae2dd2d3c164f60b41df0, with no required findings.
Why: Opus confirms verified idle-resource admission, post-preparation original-authority checks, and source publication protected at the file-effect owner; Sol's matching report is comment 6287312643.
So what: Paired review can be marked successful on this exact head, but internal merge remains blocked by inherited CredentialFill CI. The separate lower-layer test repair must be reviewed/integrated, then #563 rebased and revalidated on its resulting current candidate.

Requirements and who asked: The user requires both independent exact-candidate reviews and current CI before integration/final delivery; latest approval authorizes final main merge only after all final gates.
Deleted: No red-CI bypass, earlier-head approval transfer, rollout, deployment or restart.
Bottleneck: Separate inherited vault error-envelope test repair and the resulting current-base composition checks.
Checked myself: Read both complete reports, scope/path/consumer ledgers, proof identity and limits. Current known CI failure is the existing CredentialFill safe-error serialization expectation, documented in comment 6287355184. Optional precision/performance/helper observations are retained and unselected; none establishes a required repair.

Unchanged Opus round-1 whole-component report

#382 idle HTML resource-context component, Opus 5.5 MEDIUM, round 1

What: WHOLE COMPONENT APPROVE at head 926c9a2efd94e486787ae2dd2d3c164f60b41df0, tree acd2f3237c74cfda26fe2aeb68cc5d6159b1a8d3, base e7a11a84f03f7022a8013aa956d8afec5d250eb3. There is no required finding. Four optional proof and design notes follow.
Why: html_render now admits a verified linked caller through the existing PeerAuthority.recheckInvocation owner with an explicit capability-neutral thread-resource intent. B rechecks after its real image preparation, and A's actual file-effect owner rechecks inside externalDispatch before writing. Local, legacy, preview and device admission are unchanged.
So what: The parent relays this report unchanged and pairs it with Sol's verdict. This is not cumulative #379 acceptance, and no approval transfers to any other candidate.

Reviewer: Claude Opus 5.5 (claude-opus-5-5), MEDIUM, Claude Code, independent of the Sol author. I ran no tests, used no child agents, and wrote nothing outside this scratch directory.

Elon record

Requirements and who asked: Approved #379 v5 ("Idle context is resolved by the destination resource service from durable ownership and these grants, with no scopeForThread token borrowing"), plus parent decision 6286812120 selecting a capability-neutral resource intent for html_render only, with rechecks after preparation and before source publication.
Deleted: Tests, installs, product driving, and any external or status writes by this reviewer. No approval transfer from the e7a11 main-alignment verdicts.
Bottleneck: Whether the new intent and the two effect-time rechecks preserve original-actor liveness, scope, archive and mode checks on every caller path, without widening run-owned tools.
Checked myself: Git identity, diff and source hashes; all 24,349 captured proof inputs against the current tree; the full 7-path diff; the current owners and callers listed in the ledger below; raw red and green logs and their run metadata; live PR #563 and comment 6286812120.

Identity

• git rev-parse HEAD HEAD^{tree}: 926c9a2e… / acd2f323…. The worktree status is clean.
• git diff e7a11a84f0 HEAD | sha256sum = 854bd252…6e5c, which equals component.diff and manifest.diffSha256. That is 7 paths, +438/−49.
• All 6 source hashes in the manifest equal sha256sum of the current files.
• git diff f0babcdf98 HEAD changes only docs/map.md, one line.
• Live PR fix(peer): render HTML from idle destination contexts #563: OPEN, draft, base feat/379-cross-machine-parity, headRefOid 926c9a2. This matches.

Verdict

WHOLE COMPONENT: APPROVE for exact base, head and tree above. No required finding.

Requirement dispositions

Requirement	Disposition and evidence
Local live A publishes as before	Met. On the local path, recheckResource takes the writingCaller branch (McpToolAccess.ts:191), the same check as actsAsCaller. The extra recheck in publishPrepared uses recheckInvocation with client === undefined, so it applies the same isLiveCallerShell check (PeerAuthority.ts:3301-3311). For peer-created local threads, the record validation it repeats is the check McpRouting.ts:100-125 already makes at admission (checkThread), so there is no new class of refusal. The test covers local live, plan and matching-background callers, and refusal after retirement.
Remote live A, idle B with a different provider and no B token: B prepares, A publishes one artifact	Met. On B, scope.client.linked && scope.authority leads to recheckInvocation(scope, "thread-resource", B). It skips isLiveCallerShell for B and validates the original A envelope over the reverse channel (validate at :1153-1180 uses ask(sessionId, validate)). Publication happens only in McpRouting.ts:307-325 on A. The idleHtml382 fixture uses provider html382-other-provider with activeRunId null and scopeForThread undefined, and checks the exact SVG data URI, ["B-owned.svg"] only on B, and an attachment ID containing the A parent.
No preview/device grant needed, and the intent cannot be omitted	Met. intent is a required positional literal union (PeerAuthority.ts:285), and actsOnResource's first argument is required. Only "thread-resource" skips capabilities.has (:3325). All 20+ preview, device and previewControls callers still pass "preview"/"device", and the refusal message for those intents is byte-identical. The test credential has only orchestration.
Wrong or ended actor, revoked or stale chain, scope, archive, delete, modes	Met. Each case has a source path. A-side writingCaller covers the wrong provider and an ended A. B-side recheckInvocation covers validate (A's liveness via reverse validate, grant session), checkResource (scope), loadResource (deleted), archivedAt (:3294) and exceededDispatchModeLimit (:3314). The actsAsCaller behavior these replace on B (loadCaller) also had a mode check, assertTargetWithinLimits(clientModeCeiling). recheckInvocation intersects the same clientModeCeiling with the authority ceiling, so B-side mode policy is not weaker.
Grant narrowed, revoked or source ended during real preparation: B returns no prepared bytes	Met by source. handlers.ts:56 rechecks after prepare and before return. Tests hold the real fs.stream read; see optional O1 on how precise the assertions are.
A ends while B's response is held: A's file effect refuses	Met. The recheck in HtmlRender.ts:446-467 runs inside externalDispatch's perform, after the forwarding and receipt waits and before writeFileString. The test holds the actual fetch response, observes the real prepared SVG bytes, stops A, and then gets capability_denied, no files and no completed receipt.
Known refusal is not a false outcome_unknown	Met. Effect.tapError(() => confirmNotDispatched) covers only the recheck block, before any write. The test confirms no completed receipt and the capability_denied code.
Replay keeps the original reference and later edits; changed input conflicts	Met. The receipt replay path is unchanged. The positive test checks same-key replay equality and that the edited bytes survive. Changed input is covered in the existing html382 test continuation.
actsAsCaller and run-owned tools unchanged; no new authority system, no circular import	Met. actsAsCaller lines 166-177 are untouched, and no other declaration was migrated. A transitive runtime-import walk (regex heuristic, type-only imports excluded) finds no path from PeerAuthority.ts, threadAccess.ts, ThreadManagementService.ts or McpInvocationContext.ts back to HtmlRender.ts, so the new HtmlRender imports form no cycle.
Legacy linked peers (no authority)	Unchanged. recheckResource falls back to writingCaller (B must be live), as before.

Cleared concerns

• Multi-hop C→A→B HTML publication into an idle A thread. Cleared. A single environmentId cannot name both a hop and a target. remoteTarget(scope, A) on A returns undefined, so the call stays local and takes the linked prepare branch. Separately, forwardingCaller (PeerForwarding.ts:169-201) refuses linked onward forwarding without durable onward consent.
• The fixture filesystem wrapper changes default behavior. Cleared. actualFs is makeNode's ambient Node FileSystem (fixture:548). With no gate, stream delegates directly, and writeFileString for publication is the real implementation. The test-only gate holds only the real read and does not substitute bytes.

Optional findings (not blocking)

• O1. Held-preparation assertions are coarse. it.live.each(["source-ended","grant-narrowed","grant-revoked"]) asserts only Exit.isFailure(preparing). It does not assert which owner refused or what the error code was.
  • source-ended: PeerForwarding.call has no HTML-specific post-response recheck; the only post-response rechecks there (:525, :609, :648) are preview/device ones. So this case does discriminate the new handlers.ts:56 recheck.
  • grant-revoked: this case could also fail through session teardown on the transport.
  • Suggestion: assert the capability_denied code or the specific denial message. That would pin the recheck as the refusing owner.
• O2. The new B-side mode branch has no direct observation.
  • The plan, runtime-narrow, absent, deleted and revoked negatives assert only isError. The mode cases most likely refuse at A's existing forwarding limits.
  • So the thread-resource branches of recheckInvocation have no direct unit case in PeerAuthority.test.ts: the mode message, the capability skip, and archived/deleted.
  • Source review supports these branches; a small unit case would pin them.
• O3. A small second copy of local liveness. HtmlRender's fallback without PeerAuthority re-implements loadCaller + assertLiveCaller with explicit provisioning. It is equivalent to McpRouting's existing refusal of authority/legacy scopes without an owner. It exists to avoid the McpToolAccess cycle the parent forbade. If an acyclic shared helper becomes available, it could replace this copy.
• O4. Cost. A linked render now makes two reverse validations on B (admission plus post-prepare) and one recheck on A. That is one extra control-channel round trip per remote render, which the brief requires. It is not a performance claim and was not measured.
• Carried historical observation. The revoked-session refusal wording (does not support durable requests v1) is unchanged and is still asserted only as isError. It is not a cause claim.

Per-path ledger

Path	Read	Judgment
apps/server/src/htmlRender/HtmlRender.ts	Full hunk, plus lines 405-535 (prepare, publishPrepared, publish, the return)	Recheck at the effect boundary, inside the receipt perform
apps/server/src/mcp/McpToolAccess.ts	Full hunk, plus lines 1-260 (declare, writingCaller, actsAsCaller, actsOnResource, recheckAttachmentStaging, writes)	Factoring equivalent for preview/device
apps/server/src/mcp/toolkits/html/handlers.ts	Full file	Only html_render opts in; html_preview unchanged
apps/server/src/peer/PeerAuthority.ts	Full hunk, plus checkBinding/recheckInvocation (3230-3335), validate (914-1210), loadResource/checkThread (1473-1520)	Branch limited to the intent; ceilings, archive and modes kept
apps/server/src/peer/PeerAuthority.typedEffects.workflow.test.ts	Full hunk (all new and rewritten html382 cases)	Real registered seams; see O1 and O2
apps/server/src/peer/PeerAuthority.workflow.fixture.ts	Full hunk, plus actualFs origin (545-575) and htmlLayer	Test-only gate on the real stream
docs/map.md	Full hunk, plus lines 95-110	PAR: #382 PR #563 replaces merged #410; follows the map rule for open PRs

Consumers and callers read at head:

• McpRouting.ts: lines 100-140 (local checkThread admission), 225-330 (capabilityFor, invokeRouted, HTML publication).
• threadAccess.ts: lines 54-124.
• McpInvocationContext.ts: lines 188-225.
• McpRequestReceipts.ts: confirmNotDispatched, externalDispatch, externalReplay.
• PeerForwarding.ts: remoteTarget, forwardingCaller, forward/call entry, and the preview/device recheck sites.
• linkOrigin.ts: callerLinkOrigin, assertSameLink.
• McpSessionRegistry.currentScope.
• Grep inventory of every actsOnResource and recheckInvocation caller.

Not reread: the remainder of the 10.6k-line native test file, the bodies of idleResource383/background383-r16, and the PeerAuthority.test.ts and McpToolAccess*.test.ts bodies. For those I rely on their passing runs.

Material history

• Read in full: the approved spec: native cross-machine control across linked environments #379 body (379-current-body.md); the feat(peer): transfer attachments and make remote retries preserve operation identity #382 body and comments 6246883598, 6246900106 and 6276863197; parent decision 6286812120 (live, author lukemaj, matches the brief); both e7a11 main-alignment reports (Sol and Opus 5.5). The F1/F2/F3 and R1/R2 dispositions there are unaffected: this diff touches none of the vault, configure or broker paths.
• feat(peer): view and drive remote browsers and devices from a source-only client #383 R15/R16: bounded search of 534-r19-full-inherited-and-current-packet.txt (1.35 MB, not reread in full). It confirms the same idle-resource admission pattern was accepted for preview/device. This repair extends that owner rather than adding a parallel one.
• Not read: the feat(peer): run destination schedules webhooks and Spectrum while the creator is offline #384 final reviews, because this diff does not touch automation.

Proof checked

• red (red.json/red.log): exit 1. The failing test is the intended idle-B positive, with exact parent_not_active. 1 failed, 172 skipped. Not a setup failure.
• green-family: exit 0, 27 passed, 152 skipped, selector html382|idle-resource383|background383-r16. The default reporter does not list individual test names, so the per-case pass set is inferred from the count plus the source.
• green-unit: exit 0, 96 passed and 4 browser skips across 4 files.
• typecheck-final: exit 0. lint-final: exit 0. fmt-check: exit 0. commit: exit 0.
• Input binding: all five final runs carry the identical 24,349-entry after.inputHashes map. sha256sum -c --quiet over that map against the current tree reported zero mismatches, and the 6 changed files match the manifest. Run metadata records head as e7a11 with a dirty status, because the runs preceded the commit; content equality, not that label, binds them to this tree.
• What the map leaves out: mostly apps/web and apps/mobile .tsx files, .repos, and .github. None of these are server inputs.
• Failed attempts: green-expanded (−15, stopped while stalled), held-diagnose (1), green-temporal (1) and typecheck-initial (2) are failures and are not counted as proof.
• Limits: no reviewer execution; no real browser, client, provider or physical filesystem isolation; no OS crash, migration or CI. The validation-to-effect interval remains, as the spec: native cross-machine control across linked environments #379 body accepts.

Reuse and unread

No prior review verdict was reused. The e7a11 approvals cover only the main-alignment scope. The unread items are listed in the ledger above.

[lukemaj]

What: #566 is internally merged as d5a52b6, and #563 is rebased/published at abd763a.
Why: The lower-layer vault assertion now matches the existing safe error contract, removing the known inherited CI failure before HTML composition.
So what: Both fresh whole-component MEDIUM reviews are running on #563's new exact head and current CI is active; no earlier-head approval is transferred.

Requirements and who asked: The user requires reviewed, current components with green checks, then final cumulative exact-head reviews/CI before the now-authorized main merge.
Deleted: No red-check bypass, unrelated source change, approval transfer or fleet rollout/deploy/restart.
Bottleneck: Current #563 paired reviews and CI, followed by remaining outcome acceptance/final candidate.
Checked myself: Fresh #566 readback had the exact reviewed e0bbbe5 head, current e7a11 base, authenticated review/independent success and all current CI gates successful. Transfer budgets met all ceilings. Verified GitHub MERGED and resulting integration tree 6e5d60ba26612d66a21411b91880cf4aaf701e9c equals the reviewed test-only candidate tree.

Merge policy: repository allows squash only, so #566 was squash-merged at 11:19:15 Warsaw on 20 October 2026 after readiness checks. Driver fast-forwarded cleanly to d5a52. No main merge or product runtime change occurred.

#563 topology: exact new base d5a52b6; head abd763a; tree be00cc5b511f851a86b69fb08e9cd570555c4eed. Clean native rebase of both commits; range-diff shows both equal. The complete seven-file component diff remains byte-identical, SHA256 854bd252f071729c9842dccc98d2b048d804275e3f02b83856731fc3e5ab6e5c. Published with exact old-head 926c9a2 lease; old checkpoint checkpoint/563-before-vault-d5a52 retained for recovery.

Current-head proof: combined actual Chromium CredentialFill plus HTML/idle-resource/background checks pass 52 tests (152 unselected); cache-disabled server tsc-rs passes. Both ran with captured 24,349 source/config hashes unchanged throughout and independently rehashed against current files; exact commands/exits/times/logs are retained in rebase-abd763-focused and rebase-abd763-typecheck records. Older 96-unit/fmt/lint evidence remains scoped reuse on unchanged component bytes, not complete CI. No real product/client/provider or final acceptance claim.

Fresh review tasks: 379-563-r2-sol-medium-abd763a-whole-v1 and 379-563-r2-opus55-medium-abd763a-whole-v1. review/independent is pending on abd763a. Source remains frozen for those two read-only reviews. The merged #566 worktree/branch and test-browser artifacts are temporarily retained for these composition reviews and final proof reproducibility; driver owns retirement when that continuing need ends. Internal integration is not terminal #379 delivery.

#382 and #379 remain open; #385/#386/#531 frontier is unchanged. Final main merge authorization remains conditional and does not authorize rollout, deployment, installed restart or live data. Main is still 68b3177.

[lukemaj]

What: Opus 5.5 MEDIUM approves the whole rebased #563 component at abd763a, with no required findings.
Why: The complete component diff remains identical, the new base changes only the reviewed vault test, and fresh current-owner checks plus 52 passing affected tests support composition.
So what: Sol's fresh round-2 verdict and current CI remain required before internal merge; earlier paired approval on 926c9a2 is not transferred.

Requirements and who asked: User-approved #379/#382 requires current-base exact-candidate independent review and proof before component integration.
Deleted: No old-head approval transfer, second-family waiver, CI bypass or rollout authority.
Bottleneck: Sol round 2 and current CI on abd763a.
Checked myself: Read the full Opus report, current identity/base/diff comparisons, seven-path reuse ledger, proof binding and explicit optional/unread limits. All prior optional observations remain recorded and unselected.

Unchanged Opus round-2 whole-component report

#563 / #382 idle HTML resource-context component, Opus 5.5 MEDIUM, round 2

What: WHOLE COMPONENT APPROVE at head abd763a6c4e05e7d19a3b69c35da93dcad18a0d4, tree be00cc5b511f851a86b69fb08e9cd570555c4eed, base d5a52b646be5a265255c7f2e1aa9c1a9d8ed0755. No required finding.
Why: The 7-path component diff is byte-identical to R1, the only base change is a disjoint test file, and a fresh read of the current owners confirms the explicit thread-resource intent, B's post-prepare recheck and A's in-dispatch publication recheck still hold.
So what: The parent relays this unchanged and pairs it with Sol's independent R2 verdict on the same identity. This is not cumulative #379 acceptance, CI status or merge readiness.

Reviewer: Claude Opus 5.5 (claude-opus-5-5), MEDIUM, Claude Code. Independent of the Sol author. No tests, installs, children, providers, browsers or external writes; only this file was written. No prior verdict transferred; R1 reads are reused only where blob equality is verified below.

Elon record

Requirements and who asked: Approved #379/#382 repair (parent decision 6286812120): live A prepares through a permitted idle B with no B token/run, B prepares, A alone publishes, current authority/modes/archive/scope rechecked after waits and before the effect, stable replay. Parent R2 brief requires a fresh whole judgment on the rebased identity.
Deleted: Reviewer test execution, broad optional cleanup, any verdict transfer from R1 or #566.
Bottleneck: Whether rebasing onto d5a52 changed any input the component's behavior or proof depends on.
Checked myself: Git identity, diff hashes, range-diff, base delta, all 6 manifest hashes, both current-proof input maps (24,349 entries each) against the current tree, current proof logs, current owner and caller source.

Identity

Check	Result
git rev-parse HEAD HEAD^{tree}	abd763a6… / be00cc5b…; status clean; 0/0 vs origin/fix/382-idle-html-resource-context
HEAD~2	d5a52b646b…, ancestor confirmed
git diff d5a52 HEAD | sha256sum	854bd252…6e5c = component.diff = R1 SHA
git diff 926c9a2e HEAD -- <7 paths>	0 bytes: all 7 component blobs identical to R1 head
git diff 926c9a2e HEAD --stat	only apps/server/src/preview/CredentialFill.test.ts
git diff e7a11 d5a52	same single file, sha256 74c99b94… = base-input.diff
range-diff	both commits = (f0babcd→8142b7f, 926c9a2→abd763a)
6 manifest file hashes	all match current files

Base composition

base-input.diff read in full. It is test-only: the originMismatch case now asserts structuredContent absent, decodes the content as a one-element text tuple whose text is JSON {message} with excess properties rejected, and adds no-extra-vault-read and empty-#user oracles. No production, fixture, MCP serializer or shared-helper change. None of the 7 component paths imports or is imported by it. #566 Sol and Opus R1 reports both record WHOLE COMPONENT APPROVE for that scope (verdict lines read; their bodies not reread). Composition introduces no new interaction.

Fresh current-source dispositions

Requirement	Disposition
Local live A publishes as before	Met. recheckResource (McpToolAccess.ts:182-193) takes writingCaller, which itself is refuseReadOnlyClient → loadCaller → assertLiveCaller (:116-119), the same check actsAsCaller (:166-177, unchanged) applies. The explicit extra refuseReadOnlyClient is idempotent. publishPrepared's added recheck is additive after admission.
Remote A, idle B, no B token/run	Met. On B, linked+authority goes to PeerAuthority.recheckInvocation(scope, "thread-resource", B) (:3279-3330): authoritative record read, validate (original chain), authority ceiling intersection, checkResource, archived/missing target denial, clientModeCeiling intersection, mode limit. No isLiveCallerShell for B. Publication only at McpRouting.ts:307-325 on A.
No invented capability; intent not omissible	Met. Required literal union (PeerAuthority.ts:285); only thread-resource skips capabilities.has (:3325). Current inventory: 20 "preview", 3 "device", 1 "thread-resource"; device/preview denial strings unchanged.
Recheck after preparation wait	Met. handlers.ts:53-56 calls prepare then recheckResource("thread-resource") before returning preparedHtml.
Recheck immediately before A file effect	Met. HtmlRender.ts:446-467 inside externalDispatch's effect, before writeFileString; known refusal runs confirmNotDispatched (McpRequestReceipts.ts:65-68), so it is not misreported as outcome_unknown. McpRouting preserves OrchestratorMcpFailure (:320-323), matching the observed capability_denied.
Legacy and no-authority paths	Unchanged. Linked without authority falls back to writingCaller (B must be live). Without the PeerAuthority service, publication refuses authority/legacy scopes and otherwise checks canonical local liveness.
Replay/conflict, image limits, attachment identity	Unchanged code; deterministic ID, wx flag and receipt replay untouched.
actsAsCaller, run-owned tools, no new authority system	Met; only html_render migrated; no import cycle (R1 walk; imports unchanged since).

R1 optional adjudication (all unchanged, unimplemented, still optional)

• Sol O1 changed-input conflict asserts only isError with a fresh default credential. Still optional: receipt identity code is unchanged and the original diagnosis observed the exact invalid_request diagnostic.
• Opus O1 held-preparation cases assert only Exit.isFailure. source-ended still discriminates the new handlers.ts:56 recheck (no HTML post-response recheck in forwarding); grant-revoked could fail via transport teardown. Asserting the code would pin the owner. Optional.
• Opus O2 no direct unit case for thread-resource branches (mode message, capability skip, archived/deleted). Source supports them; registered workflow negatives assert errors. Optional.
• Opus O3 local-liveness fallback duplicated in HtmlRender.ts to avoid the forbidden cycle. Optional.
• Opus O4 one extra reverse validation per remote render; required by the brief, cost unmeasured. Not a performance claim.
• Revoked-session wording (does not support durable requests v1) remains an observation, not a cause claim.

No new finding.

Per-path coverage

Path	Current read	Reuse
htmlRender/HtmlRender.ts	diff 1-43; current 110-135, 395-535	blob = R1
mcp/McpToolAccess.ts	diff 44-88; current 102-128, 150-200	blob = R1
mcp/toolkits/html/handlers.ts	full file	blob = R1
peer/PeerAuthority.ts	diff 118-158; current 3270-3335	blob = R1; validate/loadResource bodies reused from R1
peer/PeerAuthority.typedEffects.workflow.test.ts	diff 159-600 in full	blob = R1; unchanged remainder not reread
peer/PeerAuthority.workflow.fixture.ts	diff 601-636	blob = R1; actualFs origin reused from R1
docs/map.md	diff 637-649	blob = R1

Consumers read now: McpRouting.ts:296-335, McpRequestReceipts.confirmNotDispatched, production grep of publish/publishPrepared (only handlers.ts:64 and McpRouting.ts:313), actsOnResource inventory. Reused from R1 because blobs and imports are unchanged: threadAccess.ts, McpInvocationContext.ts, PeerForwarding.ts, linkOrigin.ts, multi-hop clearance.

Proof binding

• rebase-abd763-focused: exit 0, Test Files 2 passed, 52 passed | 152 skipped, 43.28s; selector html382|idle-resource383|background383-r16|fillCredential|matchingItemHost over the workflow test and CredentialFill.test.ts; PLAYWRIGHT_BROWSERS_PATH task-private. 52 = prior 27 family + 25 CredentialFill, inferred from counts (default reporter lists no names).
• rebase-abd763-typecheck: exit 0, tsc-rs --noEmit ⊘ cache disabled, zero error TS.
• Both runs: before = after input map (24,349), and I rehashed every entry against the current tree: 0 mismatches. The map includes all 6 code paths and CredentialFill.test.ts; docs/map.md is outside its extension filter (non-code).
• Retained on identical inputs, not rerun: 96-pass/4-skip unit set, lint, fmt. Not a whole-repo gate.
• Not claimed: current CI (parent-owned, not assumed green), real client/browser rendering, provider, physical filesystem isolation, OS crash, migration, distributed-atomic revocation.

Material history and unread

Original diagnosis, parent choice, author handoff and both R1 reports read in full in this brief. Prior #379 body, #382 records, main-alignment and #383 R15/R16/R19 dispositions were read for R1; this rebase changes nothing they bear on, so they are reused, not reread. Not read: #566 report bodies beyond verdict lines, the unchanged 10.6k-line remainder of the workflow test, #384 reviews.

Verdict

WHOLE COMPONENT APPROVE: base d5a52b646be5a265255c7f2e1aa9c1a9d8ed0755, head abd763a6c4e05e7d19a3b69c35da93dcad18a0d4, tree be00cc5b511f851a86b69fb08e9cd570555c4eed. Required findings: none. Sol R2 remains independently required by conjunction.

[lukemaj]

What: Both required independent families approve the whole #563 component at abd763a, with no required findings.
Why: Sol's fresh complete seven-path review confirms the idle-context and temporal authorization repair after the reviewed lower-layer test composition; Opus's matching report is comment 6287793490.
So what: Paired review is successful on this exact head, while internal merge waits for the remaining current CI jobs.

Requirements and who asked: User-approved #379/#382 requires both independent current-candidate reviews and current CI before component integration and final outcome gates.
Deleted: No pending-CI bypass, prior-head approval transfer, optional scope expansion or rollout authority.
Bottleneck: Current CI completion on abd763a, then remaining outcome acceptance and final cumulative candidate.
Checked myself: Read both complete round-2 reports and their coverage/proof limits. Live #563 has the exact abd763a head and d5a52 base; lint, build/typecheck, package tests and server shards 1/2/4/7 are green. Server shards 3/5/6/8 remain in progress at this readback; the earlier vault failure shard now passes.

Optional test-precision/helper/cost observations remain recorded and unselected. No whole #379 acceptance or current complete-CI claim follows from component review.

Unchanged Sol round-2 whole-component report

PR #563, Sol MEDIUM, fresh whole-component review round 2

What: WHOLE COMPONENT APPROVE at abd763a6c4e05e7d19a3b69c35da93dcad18a0d4, with no required finding across the complete seven-path component after lower-layer composition.
Why: The explicit resource intent preserves the authenticated original actor while permitting idle destination preparation; the destination checks after preparation and the source file owner checks inside the actual receipt-protected publication effect. The new base changes a test expectation to the existing safe MCP serializer contract and does not alter production behavior.
So what: Parent relays this report unchanged and combines it with the separately required independent model verdict by conjunction. This is component review only, not final #379 acceptance, current CI clearance or authorization to deploy or restart an installed runtime.

Reviewer: GPT-6.1 Sol / Codex / MEDIUM, explicitly requested. Fresh judgment, no prior verdict transferred. No children, tests, installs, providers, product services, Browser, Device, Metro or live SQL were run by this reviewer.

Exact identity

• Base: d5a52b646be5a265255c7f2e1aa9c1a9d8ed0755.
• HEAD: abd763a6c4e05e7d19a3b69c35da93dcad18a0d4.
• Tree: be00cc5b511f851a86b69fb08e9cd570555c4eed.
• Workspace: /home/luke/.t3/worktrees/chromeria/fix-382-idle-html-resource-context.
• Branch: fix/382-idle-html-resource-context; tracked upstream divergence 0/0; status empty.
• PR: fix(peer): render HTML from idle destination contexts #563. Read-only live query confirms OPEN, draft, this exact HEAD, targeting feat/379-cross-machine-parity.
• Actual complete git diff --no-ext-diff BASE HEAD equals the supplied 649-line component.diff byte for byte, SHA256 854bd252f071729c9842dccc98d2b048d804275e3f02b83856731fc3e5ab6e5c, seven paths, +438/-49.
• Actual e7a11-to-current-base diff equals base-input.diff byte for byte. It changes only apps/server/src/preview/CredentialFill.test.ts. Current base tree is 6e5d60ba26612d66a21411b91880cf4aaf701e9c, identical to test(peer): check the vault refusal error envelope #566 reviewed head e0bbbe5; their Git diff is empty.
• Supplied range-diff maps the same two component commits onto the current base. I independently verified the resulting entire component diff, rather than using that mapping as approval.

All six source/test manifest SHA256 values independently match current files. No source, index, refs, other workspace or GitHub content/status was written. The runtime-required PR navigation link was registered and its presence confirmed with list_thread_pull_requests; that app navigation registration is the sole external metadata action. Only this designated scratch report directory was written. Parent remains sole writer and topology owner.

Elon record

Requirements and who asked: Approved #379/#382 and the parent review assignment require live original A, permitted ordinary idle B with a different configured provider and no B credential/run, B-owned image preparation, A-only publication, current chain/resource/archive/mode checks and stable replay. This supports Promachos directing work across environments.
Deleted: New scope, service, grant, invented HTML preview permission, borrowed B token, B startup, global liveness exemption, historical approval transfer, reviewer test/product execution and broad optional cleanup.
Bottleneck: Preserve original authority after preparation waits and immediately before the actual source publication while removing only the unrelated B-run prerequisite.
Checked myself: Clean exact Git/head/tree/base and live PR identity; full current seven-path diff and actual base-input equality; current owners/callers/receipt guards; full supplied diagnosis/choice/author response/R1 reports and both #566 reports; raw selected proof and metadata; all 24,349 captured current source/config hashes.

Required findings

None. WHOLE COMPONENT APPROVE for this exact base, HEAD and tree. Both independent models remain required by conjunction; this report supplies only the Sol result.

Behavioral dispositions

1. Local/live/plan/background: actsOnResource("thread-resource") takes unchanged writingCaller locally, including read-only-client refusal and canonical provider-owned liveness. actsAsCaller is untouched. Local publish -> prepare -> publishPrepared retains limits, image validation and reference identity. The publication check uses current PeerAuthority when available; minimal legacy composition provisions the actual invocation/thread services into loadCaller and assertLiveCaller. Modern authority/legacy ceiling without its owner refuses. Trusted direct service calls without an MCP invocation retain their established contract. Registered local live, plan and matching background controls pass; retired background refuses.
2. Ordinary linked idle B: Actual HTTP authentication and authority acceptance precede declaration admission. withContext checks payload, canonical selected shell, resource scope and mode ceiling, then binds B's durable thread identity to incoming authority. Its modern branch never borrows scopeForThread. The new required intent skips only preview/device capability membership. B's configured provider is resource metadata, not a live actor. The positive checks B idle/no credential/different provider, exact B SVG bytes in A's page, A-qualified reference and B retaining only its SVG.
3. Current authority/resource/modes: recheckInvocation loads the current authority record, validates its original chain, intersects the invocation ceiling, loads the actual target, rejects archive/deletion/absence, applies checkResource, intersects current modes and filters capabilities. validate retains current link identity/expiry, authenticated grant/reverse validation, original run/archive and parent/onward/resource obligations. No new authority service or positive cache is introduced. Stale/expired-chain variants retain their owner checks but are not each newly executed here.
4. Preparation wait: B awaits real prepare, then recheckResource before returning preparedHtml. Deferred-held real filesystem streams exercise original-source end, grant narrowing and session revocation. The direct forwarding result independently observes failure without relying on A publication. Coarse failure-code limits are retained below; session revocation can also fail at transport teardown.
5. Actual source effect: publishPrepared checks inside externalDispatch's winning perform, after remote return and receipt admission, immediately before writeFileString. It checks original A, not selected B. confirmNotDispatched is confined to failed pre-write authorization, permitting the winning receipt attempt to return to bound and preserve the actual denial. It never marks a later write failure as safely undispatched. The held successful B HTTP response contains real prepared SVG bytes; ending A before release yields capability_denied, no page and no completed receipt.
6. Replay/conflict: Unchanged semantic input/generation binding precedes routing. The external receipt stores only the original reference; a completed replay bypasses the file effect and preserves later A edits. Changed semantic input is rejected by identify. The retained changed-input assertion is less precise than it could be, as separately adjudicated below. No new completed generic preparation receipt containing page bytes is introduced.
7. Other resource/run consumers: Preview, preview-controls and device retain explicit required capability intents and their own effect-time checks. The factored admission has equivalent sequencing for those variants. Genuine run-owned tools remain on unchanged actsAsCaller; secret, delegation and worktree authority are not widened. Local background liveness remains distinct from strict incoming foreground-run identity.
8. Bounds/legacy/surfaces: Existing 10 MiB image/25 MiB page bounds, bounded reads/concurrency, content validation and source attachment naming remain. No wire/storage/client/provider contract changes. Legacy credential admission remains live-run based; modern peers do not silently fall back. Existing optional measurement behavior is unchanged. This backend repair applies through shared registered MCP services; web/desktop/mobile presentation, remote/relay/tunnel and actual provider behavior are not newly client-verified by this review.
9. Temporal boundary: Neither check creates distributed atomic revocation. The accepted validation-to-effect interval remains. Held tests establish their selected transitions, not arbitrary OS crashes or every possible interleaving.

Full seven-path current coverage

All current diff sections were freshly read in full. No earlier path read or verdict substitutes for current component coverage. Inclusive ranges refer to the supplied, independently matched component.diff.

Path	Diff lines	Current context inspected and disposition
apps/server/src/htmlRender/HtmlRender.ts	1-43	Entire service file through line 540, including parsing, bounded image preparation, captured services, optional measurement, complete publication paths and pre-write recheck. Correct effect owner; no required finding.
apps/server/src/mcp/McpToolAccess.ts	44-88	Current lines 1-240, declaration/withContext wrapper, read-only refusal, writingCaller, actsAsCaller, resource factoring and attachment neighbor. Capability intents and local policy preserved.
apps/server/src/mcp/toolkits/html/handlers.ts	89-117	Entire file and both registrations. Only render selects neutral intent; external-unknown retained and post-prepare check ordered before return.
apps/server/src/peer/PeerAuthority.ts	118-158	Full recheckInvocation/checkBinding, loadResource/checkThread, original-run and reverse-validation branches of validate. Explicit intent preserves common chain/resource/mode/archive checks. Not a whole-file authority audit.
apps/server/src/peer/PeerAuthority.typedEffects.workflow.test.ts	159-600	Every changed helper/body/assertion, unchanged changed-input continuation and selected existing idle-resource/background positive consumer bodies. Registered real seams and persisted file/receipt oracles; assertion precision remains optional.
apps/server/src/peer/PeerAuthority.workflow.fixture.ts	601-636	Full hunks, actualFs capture, HtmlRender layer/no-browser leaf, nativeRpcCall/nativeCall, production-kernel/receipt composition inventory. Optional stream gate delegates actual bytes and default stream unchanged.
docs/map.md	637-649	Full hunk and surrounding graph. Secondary #563 ref replaces merged #410; no dependency edge or issue is closed.

Additional fresh traces: complete McpRouting.ts; threadAccess load/caller/mode/liveness; canonical McpInvocationContext.isLiveCallerShell; linkOrigin provenance and resource delegation; McpRequestReceipts identity/conflict, external claim/replay/reset and helper context; HTTP registry authentication/authority binding and wire registration; PeerForwarding original scope/onward admission and envelope preparation; PeerMcpClient public authenticated tools/call and control channel. Production publication inventory finds the HTML handler's local publish and routing's publishPrepared. Representative preview/device/preview-controls declarations retain their explicit capability strings. Import directions add no McpToolAccess import to HtmlRender and avoid the prohibited access-routing-render cycle.

R1 optional notes, freshly adjudicated

• Sol O1, changed-input credential/error precision: retained optional, unimplemented. Current test at approximately line 2077 still issues a default fresh credential and checks only isError. Same original credential/capability set plus exact invalid_request/different-input message would distinguish semantic conflict more directly. Current receipt namespace/generation/input-digest source and retained original diagnostic support the mechanism; no demonstrated product defect or required repair follows.
• Opus O1, held-preparation failure code: retained optional, unimplemented. Exit.isFailure does not identify a precise refusing owner. Source-ended/grant-narrowed paths support the post-prepare check; grant-revoked may fail by transport teardown. Do not call all three precise capability_denied observations or exclusive proof of the same owner.
• Opus O2, direct neutral-intent mode/archive unit coverage: retained optional, unimplemented. Registered source-mode denials can happen at A admission, and there is no new direct unit case for every B branch. Current shared branch source supports the required behavior. No missing proof is silently claimed cleared.
• Opus O3, fallback local helper duplication: retained optional, unimplemented. The small explicit load/provision/assert sequence preserves the no-authority composition without introducing the prohibited cycle. No concrete divergent behavior is established; a future shared helper is not required by this repair.
• Opus O4, validation cost: remains unmeasured. The extra current-authority checks are required by the accepted temporal boundary; no latency, throughput or cost improvement is asserted. No benchmark requirement is invented.
• Revoked-session wording: the older durable-requests diagnostic remains an imprecise historical observation, not a cause claim or newly repaired error message.

Lower-layer composition and material history

Read the complete supplied original diagnosis, accepted owner choice, full author response and both full #563 R1 reports as history, not approval. Read saved #379 body, #382 body and named approval/integration/latest records. Current task authority explicitly supersedes older shipment language: latest authorization permits only the final main merge after all remaining acceptance, both exact final-head reviews and current green CI. No rollout/deployment/installed restart/live userdata operation is granted here.

Read both complete saved e7a11 main-alignment reports. Their F1 external vault receipts, F2 stable configure replay and F3/Opus R1/R2 linked vault/profile refusal remain relevant shared-owner constraints. This component changes none of those vault/configuration behaviors; shared resource factoring retains capability admission, and receipt sequencing is preserved. Their approvals are not recertification of current cumulative #379. #383 R15 idle-resource/R16 local-background versus incoming-actor separation was considered from both full R1 reports and the main-alignment dispositions, then current admission and representative selected regression consumers were traced. No whole #383 historical review is claimed.

Read both complete #566 reports at 379-vault-error-proof-repair/review-r1/{sol,opus55}/report.md, the full actual current base-input diff and current CredentialFill registered test region. Freshly inspected McpHttpServer wireToolkit/toolkitRegistration and installed Effect 4.0.5 McpServer result handling. Return-mode declared failures encode safe {message} as text JSON, set isError and omit structuredContent. The strict one-element tuple/fromJsonString decoder and exact message equality match that existing contract; retained raw sentinel scanning/audit checks and added URI-only vault-call/empty real input oracles preserve refusal/privacy/no-read/no-fill intent. #563 changes neither serializer nor that test. Both #566 reports support decoder strictness, one by installed-source tracing and one by a bounded empirical probe; I ran no probe. No conflicting production composition was found.

Not reread: the 1.35 MB inherited packet, every historical comment, full #383 R19 or #384 final reports, all unchanged native test bodies or complete #566 browser installer evidence. Their previously stated dispositions and limitations are historical context through the complete reports above, not fresh per-path review reuse or cumulative approval. No current upstream search was repeated; no port is used and the supplied diagnosis's bounded upstream result is historical only.

Current proof binding and limits

Read manifest.json, full component.diff, range-diff.txt, base-input.diff and current-proof.json. Independently recomputed all 24,349 source/config hashes from current focused-run capture against current files: zero mismatches/missing files. Both new runs have identical before/after maps, exact current HEAD/tree, clean status, and maps equal to current bytes. Exact argv/cwd/environment/start/end/exit and before/after metadata were inspected.

• rebase-abd763-focused.json/.log: exit 0, two files, 52 passed / 152 unselected, 43.28s Vitest duration. Executed 20 October 2026 11:20:18.848362 to 11:21:07.027033 Warsaw. Pinned Node24.13.1/pnpm11.10.0 prefix; selected HTML/idle-resource/background plus CredentialFill/matchingItemHost. The argv explicitly uses the task-private Chromium cache. This is 27 selected workflow cases plus all 25 CredentialFill cases, not 52 HTML cases and not a repository gate. Raw output has repeated experimental SQLite warnings.
• rebase-abd763-typecheck.json/.log: exit 0, 11:20:18.840994 to 11:20:41.095099 Warsaw, vp run --filter t3 --no-cache typecheck under the same pinned prefix. Header confirms actual tsc-rs --noEmit with cache disabled; no error TS diagnostics. Repetitive suggestions were inspected structurally, not individually adjudicated.
• Retained green-unit: raw log inspected, 96 passed / 4 browser skips, exit 0. Retained six-file format raw log passes; lint exit 0 with existing warnings. Independently comparing original green-family/unit/typecheck/lint/format captures with the current map finds exactly one changed captured input, CredentialFill.test.ts. All six component source/test inputs are unchanged. These are retained affected checks, not newly executed exact-head unit/lint/format runs or a complete scoped-delivery gate.
• Original red raw failure summary shows intended parent_not_active at the idle success assertion, exit 1, 1 failed / 172 unselected. It is older same-provider test text, not the final strengthened different-provider text. Failed instrumentation, temporal assertion and initial compiler attempts remain failed attempts as documented in the full supplied author response; no passing count includes them.

The captured extension filter does not hash every runtime assumption, ignored dependency or environment file. I did not independently rehash Chromium executables or perform runtime/client proof. No browser launched by this reviewer; retained Chromium evidence is isolated synthetic-page CredentialFill execution, not live vault/account or integrated HTML client acceptance. HTML fixture browser measurement remains unavailable. No claim of physical filesystem separation, actual provider execution, independently upgraded peers, migration/restart/OS-crash proof or current complete CI is made. CI is parent-owned and was not polled or inferred green.

End state

No required correction remains in the inspected complete seven-path component. #385/#386/#531, remaining repair/acceptance, client and final cumulative #379 review gates retain their states; #531 was untouched. Parent owns unchanged publication of findings, paired review status and all topology/integration decisions. Current both-model component review is a conjunction, not a vote or transfer of final approval.

Final verdict: WHOLE COMPONENT APPROVE, base d5a52b646be5a265255c7f2e1aa9c1a9d8ed0755, HEAD abd763a6c4e05e7d19a3b69c35da93dcad18a0d4, tree be00cc5b511f851a86b69fb08e9cd570555c4eed.