[lukemaj]

What: Remote completion records the actual completing run and its observed purpose, including a first result after conversation rollback.
Why: Launch identity and purpose can differ from the completing run, even when A has never recorded a prior result.
So what: The parent obtains fresh whole-head Sol MEDIUM and Opus 5.5 MEDIUM reviews and current CI before integration; #381/#379 remain open.

Bounded existing-owner R3 repair approved in #381, with the accepted Sol R1 correction to the amended design. B adds optional purposeScope from the actual persisted completing run. A uses the accepted observed run and scope for first and later results alike; missing scope is explicitly unknown_cause. Qualified delegated_completion provenance identifies environment/thread/run without foreign native-operation lookup fields. Original task purpose/result, launch run, original result and earlier delivery remain immutable; no-observation behavior is preserved. No Run group implementation or authority change.

The new native regression runs actual checkpoint capture and conversation-only rollback (restoreFiles:false), asserts R1 rolled_back, then admits, starts and completes distinct R2/Y before A records any result. Actual authenticated B lifecycle returns R2/Y; A persists completionSource and durable delivery causes R2/Y and accepts the parent wake under Y. The only new test substitution is external provider session.rollbackThread returning its unchanged providerThread and empty thread-start snapshot collections. Real checkpoint/admission/effect/session/lifecycle owners remain in use. A's result observer stays stopped while the native authority channel is restored to authorize B execution. This proves delayed first observation, not a full network outage or live provider rollback.

Pinned Node 24.13.1 / pnpm 11.10.0, cache disabled:

• Same final test bytes against fee6 fail at actual persisted completionSource purpose: expected Y/issue379, received X/issue381. Same test passes with this fix, including delivery and accepted wake assertions.
• 12 native lifecycle cases pass, retaining original completion, later R2, missing-scope old peer, Stop, acknowledgement/reconnection controls; 22 other cases are filtered, with no added skips.
• 43 owner/local cases pass, including SQLite reconstruction, stale wake fencing and one accepted R2 wake. The first missing-scope owner expectation was corrected because absent result history does not prove original-purpose binding.
• Fresh server/contracts tsc-rs with incremental false, targeted lint/format/diff, 56-feature inventory and fork checks pass. Three inherited lint warnings remain. CI owns full coverage.
• Prior unchanged wire proof: five actual frozen de50/current decoder assertions establish additive optional-field compatibility; lifecycleVersion remains 1. No old peer binary is booted.

Canonical R1 response and exact candidate handoff contains commands, Warsaw timestamps/exits, test/runtime/fixture hashes, setup failures, source-before/after, all limits and review disposition. Raw new proof: /home/luke/.local/state/chromeria-379-proof/381-remote-completion-source/r1-fix/. Original fee6 proof remains unchanged. Candidate 85d60f4f2bf082deba4c98f6d355d3cb35f32671, tree 13fffdaf8e007846f5a684dbd9d3a707539da80e; frozen base de50f47a47a87310649e058da0467badc1d48938. Full diff SHA256 639610aab61e9d5cdcc731d3b6b225cf5f4111d41e41bf65800088617f2cacf7. Preserved local checkpoint branch checkpoint/582-before-first-observed-fee6.

Prior approved fixture correction is only layerLaunchCatalog.get with the deterministic adapter and proper unknown-instance failure, bound identically in original red/green; it is unchanged by R1. Existing docs/map.md already references PR #582. No package bump, live provider, browser/device, dev server, shared/live state, installed restart, deployment, merge or dependency clearance. Website impact none: internal completion provenance. Both fresh independent whole-head reviews, current CI, integration and final #379 acceptance remain parent-owned; historical reviews do not clear this head.

Upstream-first: actual main 67c0fc0cdaf963b103518862dd7b68a9c758ecf2 lacks these fork completion owners; refreshed exact open PR "completion purpose" and Issue "remote" "purpose" searches found none. No patch selected or ported.

Requirements and who asked: Parent-approved #381/#379 R3 and accepted Sol R1 require actual completing run identity and truthful observed purpose, including recovered first results.
Deleted: First-result launch-purpose inference, foreign local provenance, protocol-version bump and new architecture/group features.
Bottleneck: Source completion overwrote observed Y with launch X when prior result was absent.
Checked myself: Actual rollback/effect/session/lifecycle owners, identical-input native red/green, persisted completion/delivery/wake, immutable originals, reconstruction/stale-wake/Stop/local controls and scoped gates.

Implemented by GPT-6.1 Sol, MEDIUM reasoning, Codex harness in T3 Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.8 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: 85d60f4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

What: Sol MEDIUM requests changes to #582 for first-observed later-run purpose attribution.
Why: After a supported conversation revert on B, A can receive R2 as its first result but the candidate still assigns launch R1's purpose.
So what: The driver accepts this bounded correction after checking the owning paths; the author must reproduce and repair it before BOTH fresh whole-head reviews and current CI.

Parent adjudication: accepted R1. Source inspection confirms lifecycle skips a run now marked rolled_back, conversation-only checkpoint rollback permits restoreFiles:false and normal later user work can carry another purpose. A accepts a qualified later result, while task.result===null incorrectly selects launch-purpose fallback. This supersedes the amended design's assumption that first observation alone establishes original-purpose equivalence. No new user-owned policy choice is required: the existing completing-run contract already requires truthful observed purpose.

Observed purposeScope must be authoritative even for a first result. Missing scope may use launch-purpose fallback only when actual original-run binding proves it; otherwise it stays unknown. Original task purpose/result/run and prior deliveries remain separate and immutable. No-observation Stop/launch-error behavior remains equivalent. Native proof must cover the real delayed observation, conversation-only revert, actual R2/Y and accepted wake purpose, plus retained recovered-first-result and ordinary-original controls. No merge, native dependency clearance or old-candidate approval is claimed.

Full independent report follows unchanged.

Independent whole-head review, round 1, PR #582

REQUEST_CHANGES. One required correctness finding remains: the first accepted result can belong to a later, differently purposed run, but the new completion block still assigns it the original launch purpose. The normal R1-then-R2 correction is supported by the source and retained proof; it does not establish truthful purpose for this reachable first-observation case.

Reviewer: GPT-6.1 Sol, MEDIUM, Codex, as explicitly selected in the task and identified by this runtime. I did not author this component. This verdict alone cannot clear review: the parent requires BOTH fresh Sol MEDIUM and Opus 5.5 MEDIUM whole-head verdicts, current CI and its own current-base/integration checks. Parent publishes this report unchanged and owns statuses; I made no GitHub writes.

Candidate and read-only boundary

• PR: fix(peer): attribute remote follow-ups to the completing run #582, intended base feat/379-cross-machine-parity.
• Frozen base de50f47a47a87310649e058da0467badc1d48938, tree a32295120382ba5d8a8c2f3e052476ad2b07cae9.
• Reviewed HEAD fee6c75b2afb73c107d06bdea39e3c038b9815c9, tree aa361305d3ae0a81cff44e9ae73290e7a79fa1a3.
• Existing source worktree /home/luke/.t3/worktrees/chromeria/fix-381-remote-completion-source, branch fix/381-remote-completion-source. Before and after inspection, git status --porcelain=v1 was empty and HEAD/tree matched the frozen identities. No checkout, fetch, switch, reset, pull, new worktree, source, index or ref writes occurred.
• Independently computed complete binary diff SHA256 925f861c5444873f65ff00d03cfe58f4aa1507f4b6f1d2b15a9c9bd0295fe2a0; all seven final input hashes passed sha256sum -c. Complete candidate is seven files, +427/-7. The final suffix only changes the map reference.
• Exclusive scratch directory was created by successful plain mkdir at /home/luke/.local/state/chromeria-379-proof/582-fee6-review/sol; review output stays there. Canonical main, parent driver, feat(peer): request destination secrets and create signed webhooks without a destination agent #385/Track explicit Issue and PR purpose across runs and continuations #377 workspaces and live userdata were untouched.
• No nested agents, tests, installs, providers, native agents, dev server, browser/device, credential reads, live DB reads, publication or other runtime proof were performed. Shell/Git/GitHub operations were reads, apart from the authorized scratch creation/report.

Required finding R1: first observed does not prove original-purpose identity

Severity: P2, incorrect durable execution-purpose attribution on a supported delayed-observation path.

Primary location: apps/server/src/orchestration-v2/Orchestrator.ts:8370-8384, specifically purpose: followUp ? ... : executionPurposeOf(task); followUp is defined at line 8359 solely by task.result !== null.

Trigger and reachable path:

1. A delegates to B under purpose X, with accepted launch run R1. A disconnects before recording any result, leaving its task.result === null and cursor before R1's terminal event.
2. B finishes R1. An authorized user on B reverts the conversation to its ready thread-start checkpoint, then sends ordinary new work under purpose Y and lets R2 actually start and finish. This is a conversation revert, not an old-server-binary rollback. revertThreadCheckpoint exposes turnCount 0 and restoreFiles: false through the normal client command (packages/client-runtime/src/operations/commands.ts:896-941). dispatchCheckpointRollback admits that target and allows conversation-only restore on a shared checkout (Orchestrator.ts:11686-11858). CheckpointRollbackService.ts:175-182,267-274,365-375 marks R1 rolled_back while retaining the thread. Thus the scenario does not require filesystem restoration, a new grant or forged peer data.
3. Ordinary user message admission permits the new explicit purpose Y; its purpose is independent of delegated binding (Orchestrator.ts:5320-5440, ExecutionPurpose.ts:resolvePurposeIntent). The real old-peer test already exercises a destination user's distinct-purpose follow-up through this owner, though after an original source result rather than before it.
4. On A reconnect, B's lifecycle scans terminal events in sequence but skips runs whose current status is rolled_back (PeerTaskLifecycle.ts:636-649). It therefore returns R2 as the first eligible result, with R2's actual Y scope at line 690. A's completion admission checks sequence and environment/thread identity, not equality with the launch run (Orchestrator.ts:8250-8280), so this authenticated R2 result is accepted.
5. A now stores completionSource.runId = R2, but because no earlier result was recorded, followUp is false and it discards the supplied Y scope in favor of executionPurposeOf(task), X. remoteChild.latestResult.purposeScope and completionSource.purpose.scope contradict each other for the same completing run.

Effect and consumers: completionPurposeCauses copies this X purpose into the durable delivery, and deliveryPurpose / ExecutionPurpose.purposeFromCauses assign the resulting parent wake to X (Orchestrator.ts:5146-5165,12115-12116,12237; ExecutionPurpose.ts:122-145). The contract explicitly defines completionSource as the latest completed child's purpose independent of the original delegated job (packages/contracts/src/orchestrationV2.ts:933-934). The local owner uses the actual completing childRun purpose even for its first result (Orchestrator.ts:12424). This is the same provenance contract the bounded repair is meant to establish, not a request to absorb remote Run-group work or a new purpose policy.

Required correction: Make the authenticated observed run's scope authoritative for its completion source even when it is the first result A sees. Preserve launch purpose only where actual original-run provenance establishes that equivalence; absence of a previously stored result is insufficient evidence. Retain immutable launch/task purpose and original result separately, and keep no-observation behavior equivalent. For missing scope, retain the existing truthful unknown policy unless the actual original-run binding proves the fallback. This can remain within the existing completion owner and optional result field.

Required discriminator: Extend the faithful native lifecycle proof with delayed first observation, B conversation-only revert of R1 and an actually admitted/started R2 under distinct Y. Assert B returns R2/Y, A's immutable task purpose stays X, A completionSource and delivery purposeCauses identify R2/Y, and the accepted parent wake has Y. Pair with the existing recovered-first-result and ordinary-original controls. No runtime reproduction was run by this reviewer; reachability and erroneous assignment above are source-confirmed, and the requested regression remains unexecuted.

Why retained green does not clear it: The modified recovered-first-result owner test supplies no purposeScope and no distinct first-result purpose, then asserts the task purpose for n=1. The native distinct-purpose case first records R1 before starting R2. The old-peer case also first records its original result. Neither discriminates first observation of a differently purposed later run. The amended design's first-result fallback is implemented faithfully, but its equivalence assumption fails on the supported revert path; the parent should adjudicate this concrete evidence rather than transfer design approval.

Complete seven-file coverage

File	Inspected change and reachable implications	Result
apps/server/src/orchestration-v2/Orchestrator.ts	Full 31-line changed region; request purpose/launch binding, attachment, accepted observation fencing, original/latest result ownership, completion planner, delivery purpose and run ownership, recovery and local finalization consumers	R1 required; normal later-result identity/scope and no-observation branch otherwise consistent
apps/server/src/orchestration-v2/RemoteDelegatedTask.test.ts	Entire +191 diff and surrounding ordered/replay/ack fixture; complete new on-disk reconstruction case	Meaningful durable identity, stale wake and admitted-message coverage; first-observed distinct-purpose gap described above
apps/server/src/peer/PeerAuthority.lifecycle.workflow.test.ts	Entire +193/-1 diff, original/continuation test context, new old-wire case and native fixture ownership	Actual persisted cause checks and production admission are meaningful; missing first-observation discriminator
apps/server/src/peer/PeerLinks.testkit.ts	Entire leaf/import diff, catalog owner and existing workflow adapter shape	Authorized bounded get leaf; unknown instance returns typed lookup failure, unexpected provider opening dies; no production admission/capability handler mock introduced
apps/server/src/peer/PeerTaskLifecycle.ts	Entire diff and terminal selection/result assembly, durable text owner and pair authorization path	Scope is derived from actual persisted completing run; its rolled-back filter establishes R1 reachability
packages/contracts/src/peerTask.ts	Full result/observation/lifecycle schemas and additive import; actual decoder path in PeerMcpClient	Optional validated scope fits lifecycle v1 additive decoder proof; no supported malformed/cross-environment forgery introduced
docs/map.md	Entire one-line diff and surrounding #381 part	Secondary PR #582 reference is consistent; no other documentation or product behavior change

I read the whole base-to-head candidate diff, not only the three production files. Reachable consumer inspection included RemoteDelegation.followOnce and its authenticated lifecycle/ack flow, PeerMcpClient schema decoding, PeerAuthority.verifyTask grant-generation/session/pair checks, ProjectionStore preservation, ExecutionPurpose schema/reducer, immutable remote result schemas, local completion owner, and the user checkpoint/message owners needed to establish the finding. This is not a claim to have read every line of the integration or every existing test in the large lifecycle file.

Cleared concerns and proof inspected

• Accepted observations remain fenced by increasing cursor, matching sequence and matching remote environment/thread. Pending/claimed deliveries backpressure later observations; same/stale result replay records no new event. Normal R2 qualified delegated_completion operation IDs do not enter native-operation or local relationship lookup variants. Pair authentication and current authority checks remain at real PeerAuthority/lifecycle owners.
• task.result, task purpose, launch run, originalResult and prior deliveries are not rewritten by this correction. Actual latest result and completion source advance separately. The no-observation legacy, launch-error and Stop branch is retained verbatim in behavior.
• Full native fixture uses issued credentials/native HTTP/OAuth and real event/receipt/lifecycle/persistence owners with deterministic provider/probe leaves. The approved catalog cast mirrors its existing deterministic adapter boundary and is bounded by only codex lookup; it is not evidence that providers ran.
• Read complete implementation brief, canonical handoff report and public handoff/correction, original independent design report and amended design, PR body and complete seven-file diff, Issue feat(peer): continue and stop remote delegated jobs after their first result #381 body, approved spec: native cross-machine control across linked environments #379 comment 6219474098, public feat(peer): complete all-tool cross-machine workflows across web desktop and mobile #386 parent adjudications and their local full reports. Read canonical operations with code-review/review-method/impact/verification/orchestration/bounded-delegation, Elon algorithm and applicable software-state guidance, Great Library README, project AGENTS/CONTRIBUTING/GLOSSARY and Effect service guidance. Healthy hook supplied global contract, full direction triad and preferences. No new terms were introduced.
• Read run.sh, final identity/input manifest, final red/green/owner bindings and decisive raw logs. Native red at 14:14:08-14:14:23 Warsaw exits 1 on expected ordinal 2 versus actual ordinal 1 at persisted completionSource.runId. Final native green at 14:14:41-14:15:12 exits 0: 11 pass, 22 filtered by -t lifecycle381; owner/local green has 43 pass. These are retained author executions, not my executions.
• Reconstructed the red three-test/fixture diff using --src-prefix=i/ --dst-prefix=w/: SHA256 407aad168f370fd516c0b6c0bc2da5f5820eac7a22c217f92f386147b3d0cdd6, matching final red binding with production baseline. Reconstructed implementation diff d803b3a4a12864e65354fdd0e4157d0206c4837a72b8f7cf1dd2714a06bd60c8, matching green binding. Test and fixture SHA256 match between final red, green and final Git; all seven final file hashes match.
• Read compatibility script, old original/resolved decoder diff, binding and result. Exact frozen de50 peerTask.ts hashes to cb41112a211fcd013305adae0f9bcc44b1942af7f0450dd77d291de0e8bf2118. Only its module specifiers were resolved; five assertions cover old decoder acceptance/discard of new scope and observation, new acceptance of omitted scope, malformed rejection and valid retention. This does not run an old B or old A binary.
• Read scoped typecheck/lint/format/inventory/map/fork bindings and relevant outputs. They retain exit 0, existing suggestions and three lint warnings; tsc-rs commands use --noEmit --project, not an explicit --incremental false. No new skip/sleep/poll milestone appears in the diff. Full suite and current CI remain parent-owned; I did not independently clear them. Long diagnostic/fork output was sampled at decisive portions, not reread exhaustively.

Optional work, unknowns and retained limits

No separate optional redesign is requested. R3's normal later-result defect is repaired; original design R1/R2/R4, #377 local group intent, #385 authority work, full #381 lifecycle/client acceptance and #379 catalog acceptance remain separate and are not cleared or absorbed here. Existing group wake text still uses immutable originals, as locally; this review adds no group text policy.

No physical cross-machine, client, real provider, native agent, full catalog, old binary, deployment, installation or live-data proof is claimed. Historical reviews, green CI claims in the brief and retained proof do not substitute for the required second fresh review/current CI. I did not inspect live process liveness; the retained process record says liveAfter: []. No review publication, commit status or PR linking mutation was made under this read-only assignment. Parent owns publication, status, adjudication, any correction and both fresh reviews of a changed candidate.

Elon record

Requirements and who asked: User's frozen read-only review and approved #381/#379 R3 require actual completing-run identity and truthful scope while preserving original job/result and authority.
Deleted: Unrelated remote Run-group design work, new lifecycle/purpose machinery, provider/browser/device execution, duplicate proof runs and review ceremony writes.
Bottleneck: The source first-result branch assumes source observation order proves completing-run purpose equivalence.
Checked myself: Exact candidate/base/tree/diff and seven file hashes; all seven file diffs, authenticated observation and delivery consumers, supported conversation revert and independent user purpose admission, retained bound red/green and decoder evidence. No test execution inferred.

Final source check: clean status, HEAD fee6c75b2afb73c107d06bdea39e3c038b9815c9, tree aa361305d3ae0a81cff44e9ae73290e7a79fa1a3. No process or child started by this review needs cleanup.

[lukemaj]

What: Fresh Sol MEDIUM whole-head review approves exact 85d60f4 with no actionable findings.
Why: The prior first-observation purpose defect is resolved by the source correction and retained native discriminator.
So what: Full report follows unchanged; separate fresh Opus MEDIUM and current CI remain required before integration.

Independent whole-head review, round 2, PR #582

APPROVE for the inspected exact candidate. No supported actionable correctness finding remains in the complete seven-file change and the reachable completion, observation, authority and delivery paths inspected. The prior first-observed-purpose finding is resolved by the source correction and discriminating retained evidence, rather than by transferring an old verdict.

Reviewer: GPT-6.1 Sol, MEDIUM, Codex, explicitly selected by the user and identified by this runtime. I did not author the component. This is one fresh independent whole-head verdict only: the separate fresh Opus 5.5 MEDIUM review, current CI, current-base integration checks and wider outcome acceptance remain parent-owned. Parent publishes this report unchanged and owns statuses.

Exact identity and read-only boundary

• PR: fix(peer): attribute remote follow-ups to the completing run #582.
• Intended base: feat/379-cross-machine-parity, commit de50f47a47a87310649e058da0467badc1d48938, tree a32295120382ba5d8a8c2f3e052476ad2b07cae9.
• Initial and final HEAD: 85d60f4f2bf082deba4c98f6d355d3cb35f32671, tree 13fffdaf8e007846f5a684dbd9d3a707539da80e.
• Existing worktree: /home/luke/.t3/worktrees/chromeria/fix-381-remote-completion-source, branch fix/381-remote-completion-source. Initial and final git status --porcelain=v1 were empty. Base-to-head divergence is 0 3. Read-only gh pr view returned this exact base/head and branch pair.
• Independently computed full binary diff SHA256: 639610aab61e9d5cdcc731d3b6b225cf5f4111d41e41bf65800088617f2cacf7, using git -c diff.mnemonicPrefix=false diff --binary --no-ext-diff de50f47a47a87310649e058da0467badc1d48938 HEAD. Seven files, +655/-7. I read the entire base-to-head diff, not only the round-1 delta.
• Exclusive output directory was created by successful plain mkdir: /home/luke/.local/state/chromeria-379-proof/582-85d60-review/sol. Output is limited to this directory. No source, index, refs, checkout, fetch, switch, reset, pull, new worktree or GitHub writes occurred. No tests, installs, provider processes, nested delegation, UI, dev servers, credential operations or live database operations were performed.
• The app-owned PR link was registered and confirmed by list_thread_pull_requests, as required by the harness. No PR publication, review comment or commit status was submitted. Canonical main, parent driver, Track explicit Issue and PR purpose across runs and continuations #377/feat(peer): request destination secrets and create signed webhooks without a destination agent #385 workspaces and live userdata were untouched.

Required finding disposition

Prior Sol R1: resolved. In Orchestrator.ts:8366-8395, every accepted observed result now supplies both its actual run identity and its optional portable scope. The first result follows the same rule as later results. An absent field becomes unscoped/unknown_cause; there is no remaining inference from task.result === null to original launch purpose. The no-observation fallback remains the existing branch.

I traced the concrete delayed-first-observation path again. checkpoint.rollback accepts a ready thread-start checkpoint and restoreFiles:false without requiring isolated file restoration (Orchestrator.ts:11690-11870). CheckpointRollbackService uses the real provider session owner and marks terminal runs beyond the checkpoint rolled_back (:175-182,267-274,365-375). PeerTaskLifecycle.ts:636-698 skips rolled-back predecessors and derives scope from the actual eligible persisted run. The normal human message owner can admit distinct purpose Y while the delegated job and launch retain X. Absence of an A result is therefore still insufficient evidence of X, but the corrected code no longer relies on it.

The new lifecycle regression at PeerAuthority.lifecycle.workflow.test.ts:405-633 establishes this sequence through registered MCP delegation, issued native credentials/OAuth peer HTTP, real persistence, production B kernel, checkpoint command/effect/service and actual admitted/started R2. It asserts successful rollback effect, R1 rolled_back, deterministic adapter starts for both distinct runs, authenticated lifecycle R2/Y before A has any result, immutable launch/task purpose X, persisted completion source and delivery causes R2/Y, and accepted parent wake Y.

The only new rollback substitution is the external session's rollbackThread leaf returning the same provider thread and an empty thread-start snapshot. Production rollback/admission/effect/event/lifecycle owners are retained. Restarting only the native authority transport while result followers remain stopped proves delayed first observation, not complete network outage. The final test's synthetic direct source command consumes an actual authenticated lifecycle observation through the real source owner; it is not a claim that an automatic follower was running during that deliberately stopped interval.

The changed recovered-first-result missing-scope expectation is justified: that fixture does not establish original-run purpose equivalence. Unknown is now required for both its first and later missing-scope results. Ordinary original completion with supplied scope retains its actual scope in the native original-plus-continuations control.

Cleared mechanisms and complete file coverage

Changed file	Coverage and conclusion
apps/server/src/orchestration-v2/Orchestrator.ts	Entire production diff and surrounding remote completion owner, launch/result immutability, sequence/environment/thread checks, delivery backpressure, completion planning, purpose aggregation, wake admission, acknowledgement and delivered-state ownership. Observed result is authoritative; no-observation behavior remains equivalent.
apps/server/src/orchestration-v2/RemoteDelegatedTask.test.ts	Entire +191-line diff, surrounding ordered/ack/stale replay fixture, database/runtime construction and new complete SQLite reconstruction case. Checks actual completing cause, stable durable delivery identity, stale R1 rejection and exactly one accepted R2 message/run. Repeated recovery offers are correctly distinguished from duplicate accepted wakes.
apps/server/src/peer/PeerAuthority.lifecycle.workflow.test.ts	Entire +423/-1 candidate diff, full relevant original-plus-two-continuations case, delayed-first-observation and old-wire cases. Retains immutable original identities, actual R2 scope, lost ACK/follower reconstruction, monitor exclusion and bounded result retrieval. Assertions inspect persisted records rather than only status counts.
apps/server/src/peer/PeerLinks.testkit.ts	Entire imports/get-leaf diff and catalog surrounding code. Codex-only deterministic capabilities/selection boundary, typed lookup failure for unknown instances, and unexpected provider opening dies. This is the approved fixture repair, not replacement of production capability/admission logic.
apps/server/src/peer/PeerTaskLifecycle.ts	Entire diff, actual terminal selection/result assembly and authentication entry. Scope is executionPurposeOf(run).scope from the selected run, with existing truthful legacy behavior for absent persisted purpose.
packages/contracts/src/peerTask.ts	Entire diff and result/observation/lifecycle contracts; actual network decoder and persisted latest-result consumer. Optional validated scope is additive; malformed scope is rejected at decode.
docs/map.md	Entire one-line change and surrounding part. Adds secondary PR #582 to #381 without changing the primary reference.

Additional reachable consumers read include RemoteDelegation.modernFollow and its cursor ACK/backpressure/truncated-result flow, followOnce legacy branch, PeerMcpClient lifecycle decoder, PeerAuthority.verifyTask, ProjectionStore.preserveCompletionDelivery, ExecutionPurpose.resolvePurposeIntent and purposeFromCauses, completion delivery contracts and local completion-source owner. Fixture inspection covered deterministic adapter/rollback leaf, production kernel/layers, real lifecycle/peer serving, issued native MCP calls, connection scopes/reconnect and automation workspace/milestone helpers.

• Observation admission still requires increasing cursor, cursor/result sequence agreement, adequate snapshot sequence and matching environment/thread. Pending/claimed delivery prevents later result overwrite. Same/stale result replay produces no additional event.
• Qualified remote operation IDs remain inside existing delegated_completion provenance. No B-local relationship field or native-operation witness is fabricated. Network schema decoding and real pair/session/grant-generation/current-resource checks remain upstream of result consumption.
• task.result, task purpose, launch run and originalResult stay separate from latestResult and completionSource. Existing delivery-purpose consumers now receive the actual completing run. Delivery finalization checks deliveryOwnsLatestCompletion before marking a task delivered, so an old R1 actor cannot consume R2 merely because task identity matches.
• Stop/launch-error/no-observation paths are retained; no unrelated group-purpose or authority owner was changed. No new skip, sleep, poll or timeout milestone appears in the diff. Existing 30-second case bounds are not new proof milestones.

Retained proof independently inspected

All executions below belong to the author. I ran none under this read-only assignment.

Current evidence root: /home/luke/.local/state/chromeria-379-proof/381-remote-completion-source/r1-fix/.

• Read full current report.md, run.sh, final-input manifest, final red/green bindings and raw red/green logs. The runner binds command, Warsaw time, exit, runtime/lock, Git identity, working diff and changed file hashes.
• native-red-typed: 20 October 2026, 14:49:04-14:49:17 Warsaw, exit 1. Exact delayed-first-observation command against fee6 production source fails at line 598: expected issue 379/Y, received issue 381/X. Preceding real rollback, R2 startup/completion and authenticated observation assertions succeeded.
• native-green-typed: 14:49:26-14:49:43 Warsaw, exit 0, one passed and 33 filtered. Same final tests; corrected production source passes the later delivery and parent-wake assertions too.
• Independently reconstructed red working diff SHA256 19a72efd73d2ef0d5881166ec9fb085b3f1e5f916416791349c4526add939ddf and green 4a99ee95ce30a4d93d39300e60f47b804ba43962b2b037fee71abe48ea9c5884 with --src-prefix=i/ --dst-prefix=w/ against fee6. Both match bindings. Retained before-source SHA256 70c5f7fcd96a7ae477b8b37e4cb030f4722414494a9ac7cd3888ba1989e57df7 matches exact fee6 Orchestrator. Current Orchestrator is 68dc509641ecc67e4625724f6cc857e1514aecd5e66601a7dc6f07a7c2289992.
• All seven current final-inputs.sha256 entries passed against the frozen worktree, including unchanged fixture and local control. Final lifecycle test hash 0d111ce929a47e58c73eac3bd8abb1bfab65bd420a3e4e69839f8209500b75f9 and owner test 7798aa4b638f060aab63d41592e122e9ebda35f4a966dbec1f17888de347ecd9 match both final red/green bindings and candidate files.
• Read final native/owner bindings and raw pass summaries: 12 lifecycle cases, 22 filtered; 43 owner/local cases. These are affected checks, not full-suite proof or removed skips. Read fresh server/contracts typecheck bindings: tsc-rs --noEmit --incremental false --project ..., exit 0. Read scoped lint/format/inventory/diff/fork bindings and decisive output. Existing diagnostic suggestions and three inherited lint warnings remain; fork postcommit binds this exact candidate and passes with 56 features.
• Read original handoff report, original native red/green bindings, decisive original red assertion and original final identity. Its red distinguishes R2 versus incorrectly recorded R1. This is historical evidence for the original R3 defect; current affected runs and fresh source review, not its old verdict, support this candidate.
• Read compatibility script, frozen original/resolved decoder diff, binding and output. Exact de50 peerTask.ts hashes to cb41112a211fcd013305adae0f9bcc44b1942af7f0450dd77d291de0e8bf2118. Only import specifiers were changed. Five assertions cover old decoder accepting/discarding new scope in result/observation, current decoding old result, malformed scope rejection and valid retention. Contract and B builder bytes are unchanged from that proof. No old A/B binary was booted.

Inputs and actual limits

Read canonical operations and applicable review-method, impact-analysis, verification, orchestration, bounded-delegation, test-design, Elon algorithm and software state/boundary guidance; Great Library README and AgentsMD install/harness limits. The healthy hook supplied global contract, full triad and private preferences. Read project AGENTS, CONTRIBUTING, glossary and server Effect service guidance. No concepts or instructions were changed.

Read complete original implementation brief, original independent design report, amended design report, original and current handoff reports and prior Sol R1 supplied in the packet. Read live PR body/identity, full #381 body, approved #379 comment 6219474098, canonical correction and public design adjudication introductions. The broader #379 body retrieval was truncated; its relevant lifecycle/authority and acceptance contract was inspected, but I do not claim a complete reread of every broader tool/secret/automation paragraph. Public full design/handoff copies duplicate the local reports and packet; I did not exhaustively reread every duplicate or every historical comment.

I read all candidate diff lines. I did not read every line of the 3,248-line shared fixture's unrelated browser/device/schedule branches, the complete integration diff, all existing lifecycle tests, every historical setup failure log, or exhaustive compiler/fork diagnostic output. Those long outputs were inspected at bindings and decisive portions. No separate optional redesign is requested and no supported unresolved candidate finding remains in inspected scope.

No physical cross-machine, real provider rollback, client, full catalog, old binary, live installation, deployment or final #379 acceptance is established here. Existing group wake text policy, remote Run-group design R1/R2/R4, #377 and #385 work remain separate. Current CI and all merge/dependency statuses remain parent-owned. This approval does not clear the whole #381 lifecycle/client outcome or #379.

Elon record

Requirements and who asked: User requests a fresh frozen whole-head read-only Sol MEDIUM review of the bounded approved #381/#379 completion-provenance repair, including the prior reachable first-observation failure.
Deleted: First-result launch-purpose inference, unrelated group/authority scope, duplicate runtime execution, nested delegation and review-publication writes.
Bottleneck: Establish that actual observed run/scope reaches persisted delivery and wake admission without corrupting original identity or allowing stale delivery ownership.
Checked myself: Full seven-file candidate diff and identity/hash, current result/admission/authority/delivery consumers, real rollback selection path, same-test retained red/green bindings/raw outcome, all seven input hashes and additive decoder evidence. No test execution inferred.

Final source identity remains clean HEAD 85d60f4f2bf082deba4c98f6d355d3cb35f32671, tree 13fffdaf8e007846f5a684dbd9d3a707539da80e, base tree a32295120382ba5d8a8c2f3e052476ad2b07cae9. No process or child was started by this review and none needs cleanup.

[lukemaj]

What: Opus 5.5 MEDIUM approves exact whole candidate 85d60f4 with no required correction.
Why: The prior first-observed purpose defect is fixed and the same-test native red/green discriminates it.
So what: Full report follows unchanged; parent verifies current CI/base and owns component integration.

Parent adjudication: accepted with explicit limits. The optional old-B original-result note is retained: when scope is absent, unknown_cause remains deliberate and truthful under the accepted correction; no new identity inference or source change is requested. This completes the required current-head code-review pair with Sol #582 (comment) . Neither review clears broader #381/#379 acceptance.

Independent whole-head review, round 2, PR #582 (Opus 5.5 MEDIUM)

APPROVE for exact candidate 85d60f4f2bf082deba4c98f6d355d3cb35f32671. No supported actionable correctness finding remains in the complete seven-file change or in the reachable completion, observation, authority and delivery paths I inspected. The prior Sol R1 first-observed-purpose defect is fixed in source and discriminated by retained same-test red/green evidence.

Reviewer: Claude Opus 5.5, MEDIUM, Claude Code harness in T3 Code, as the user explicitly required (different model family from the author and from the Sol reviewer). I did not author this component or its fix. This is one fresh independent whole-head verdict. It does not transfer from, or rely on, the Sol R2 verdict; I read Sol R2 only as a prior claim set and checked its claims against source. Current CI, current-base integration checks, publication, review/independent status and #381/#379 acceptance remain parent-owned. Parent publishes this report unchanged.

Exact identity and read-only boundary

• PR fix(peer): attribute remote follow-ups to the completing run #582, live state OPEN, non-draft; live gh pr view head 85d60f4f2bf082deba4c98f6d355d3cb35f32671, base feat/379-cross-machine-parity at de50f47a47a87310649e058da0467badc1d48938; live base ref resolves to the same SHA.
• Base tree a32295120382ba5d8a8c2f3e052476ad2b07cae9; head tree 13fffdaf8e007846f5a684dbd9d3a707539da80e. Divergence base...HEAD 0 3.
• Worktree /home/luke/.t3/worktrees/chromeria/fix-381-remote-completion-source, branch fix/381-remote-completion-source. git status --porcelain=v1 empty at start and end; HEAD/tree identical at start and end (final check 2026-10-20 15:05 Warsaw).
• Independently computed git -c diff.mnemonicPrefix=false diff --binary --no-ext-diff de50f47a… HEAD | sha256sum = 639610aab61e9d5cdcc731d3b6b225cf5f4111d41e41bf65800088617f2cacf7, seven files, +655/-7. Matches the brief.
• Scratch created by successful plain mkdir (parent created with -p, final directory new): /home/luke/.local/state/chromeria-379-proof/582-85d60-review/opus55. This report is the only write.
• No source, index, ref, checkout, fetch, switch, reset, pull, worktree or GitHub writes. No tests, installs, provider/native agents, dev server, UI/browser/device, credential or live-DB operations, and no nested delegation. GitHub use was read-only (gh pr view, gh issue view, gh api GETs).

Prior finding disposition

Sol R1 (fee6): resolved. Orchestrator.ts:8366-8390 now builds completionSource from every accepted observed result: runId = observation.result.runId, scope = observation.result.purposeScope ?? unscoped/unknown_cause, provenance delegated_completion with the qualified remote:<env>:<thread>:<run> id. The task.result === null inference is gone. The no-observation branch (Stop, launch error, legacy) keeps the de50 expression verbatim.

I re-traced why first observation is not proof of the launch run:

• PeerTaskLifecycle.ts:633-647 skips monitors, restart predecessors, rolled_back runs and recovery-retried runs, so the first eligible terminal can be a later run.
• ThreadLaunchService.ts:1040-1066 gives B's launch run the scope carried in delegatedFrom.purposeLaunch (A's resolved X) when A sent an intent; with no intent both sides resolve to LEGACY_EXECUTION_PURPOSE (ExecutionPurpose.ts:72-75, executionPurpose.ts:209-213). So for the ordinary original completion from a current B, B's reported scope equals A's task.purpose.scope; the change does not alter that case.
• Restart continuations on B inherit the source run's scope through continuationPurposeRunId (Orchestrator.ts:5344-5360), so a recovered-first result from a current B also reports X.
• Rollback to a ready thread-start checkpoint with restoreFiles:false followed by a human message under Y is a supported path; the new native case exercises it end to end.

Whole-candidate coverage

File	What I read and concluded
apps/server/src/orchestration-v2/Orchestrator.ts	Entire diff plus the whole dispatchRemoteDelegatedTaskComplete owner (8247-8460): observation fence (increasing cursor, cursor/sequence agreement, snapshot sequence, env/thread match), pending/claimed backpressure, originalResult/runId immutability, latestResult, delivery reset on acknowledged/delivered follow-up, group planner call. Also completionPurposeCauses, deliveryPurpose, deliveryOwnsLatestCompletion (5146-5172), remote request purpose binding (7971-7997), attach (8150-8239) and the local completion owner (12423). Correct.
apps/server/src/peer/PeerTaskLifecycle.ts	Entire diff and terminal selection/assembly (620-705). Scope comes from the selected persisted run via executionPurposeOf, legacy fallback for runs without purpose. Correct.
packages/contracts/src/peerTask.ts	Entire diff. purposeScope: Schema.optional(ExecutionPurposeScope): additive, validated at decode; malformed scope rejected.
apps/server/src/peer/PeerLinks.testkit.ts	Entire diff. Codex-only get leaf with real CodexProviderCapabilitiesV2, typed ProviderAdapterRegistryLookupError for other ids, openSession dies. Parent-authorized fixture leaf; the cast covers a partial adapter object in a test kit and does not replace admission or capability logic.
apps/server/src/orchestration-v2/RemoteDelegatedTask.test.ts	Entire +191 diff. The recovered-first-result case now expects unknown_cause for the missing-scope first result; that is a requirement change adjudicated by the parent (missing scope never proves X), not an expectation copied from output. New on-disk case: R1 then R2 with scope, ack, stale R1 wake rejected, full SQLite runtime reconstruction, two recovery passes, identical and distinct-id replay produce no events, exactly one accepted R2 message and run, wake purpose = R2 scope.
apps/server/src/peer/PeerAuthority.lifecycle.workflow.test.ts	Entire +423/-1 diff. Original-plus-two-continuations now checks persisted completionSource/purposeCauses per run with distinct #381/#379 scopes, immutable original, qualified provenance, one delivery per run in SQL. New delayed-first-observation case and old-wire case read in full (see below).
docs/map.md	One-line secondary PR #582 ref on the #381 part; consistent with AGENTS map rule.

Other reachable consumers read: RemoteDelegation.ts modern follow (990-1080; truncated-result spread preserves purposeScope, random command id fenced by cursor), purpose forwarding at launch (325-445, 655-680), ProjectionStore.ts:859 completionSource preservation, OrchestratorMcpService.ts:1735-1745 (task_status now reports latestTerminalPurpose consistent with latestResult), ExecutionPurpose.resolvePurposeIntent/purposeFromCauses, RestartContinuation.ts:330-380.

Cleared concerns

• Stale wake consumption. deliveryOwnsLatestCompletion compares the delivery cause runId to the task's current completionSource runId; with R2 recorded, an R1 delivery cannot own it. The on-disk test rejects the old R1 wake and accepts one R2 wake.
• Replay and ordering. Unchanged fence and backpressure; same/stale observation replays emit nothing (asserted by event sequence).
• Forged origin. A B-supplied scope is only an attribution value, decoded by schema after real pair/session/grant checks upstream. It enters completionSource.purpose, never a local lookup field or native-operation witness. A linked B could already report arbitrary result text; this adds no authority.
• Legacy pre-purpose tasks. Where task.purpose was undefined, de50 recorded no completionSource (wake cause unknown); now an observed result supplies its scope. That improves accuracy and does not change the no-observation path.
• Test seam. The new native case uses registered delegate_task, issued credential/OAuth peer HTTP, real SQLite/event/receipt/outbox, the production checkpoint command, effect worker and rollback service. It asserts the rollback effect succeeded, R1 rolled_back, both runs actually started by the deterministic adapter, B observation R2/Y, A task.result still null before admission, immutable task purpose/launch, completionSource and purposeCauses R2/Y, and an accepted parent wake with scope Y. The only substitution is the external session.rollbackThread leaf returning a thread-start snapshot. The A-side delegated_task.remote.complete is dispatched directly with the real authenticated observation while followers are deliberately stopped: this proves delayed first observation through the real source owner, not a full network outage or an automatic follower run. No sleeps, polls, skips or new timeouts (server testTimeout is 120 s).

Retained proof inspected (author executions; I ran none)

• r1-fix/native-red-typed: 14:49:04-14:49:17 Warsaw, exit 1. Binding HEAD/tree are fee6; Orchestrator restored to fee6 bytes (orchestrator-before.ts SHA256 70c5f7fc… equals git show fee6:…Orchestrator.ts). Raw log: 1 failed / 33 skipped; failure at test line 598, expected issue 379, received 381, on completionSource.purpose.scope.
• r1-fix/native-green-typed: 14:49:26-14:49:43, exit 0, 1 passed / 33 skipped; Orchestrator SHA256 68dc5096… equals the candidate file.
• Lifecycle test 0d111ce9… and owner test 7798aa4b… identical in both bindings and in the candidate. sha256sum -c final-inputs.sha256: all seven entries OK against the frozen worktree.
• native-controls-final: 12 passed / 22 skipped (filtered by -t lifecycle381). owner-local-final: 43 passed in two files. These are affected checks, not the full suite.
• Read the scoped typecheck/lint/format/inventory/fork commands in the report (fresh --incremental false typechecks, exit 0). I did not reopen every scoped-check log; I rely on the report and binding format verified above for those.
• Compatibility: contracts and B builder bytes are unchanged since the fee6 five-assertion frozen-decoder proof, so it still applies. It is decoder-level only; no old A or B binary was booted.

Optional (not required)

• Old-B original completion now reports unknown_cause. With an A on this candidate and a B that predates purposeScope, even the launch run's own original result yields an unknown wake scope, where de50 recorded X. When observation.result.runId equals a remoteChild.runId recorded by attach and the launch carried purposeLaunch, B's run scope provably equals X (ThreadLaunchService.ts:1056-1066), so X could be kept for that case. The canonical correction (feat(peer): continue and stop remote delegated jobs after their first result #381 comment 6290392661) and the parent adjudication explicitly choose "explicit unknown when an older peer supplies no scope", the result is truthful, and the window is a transient mixed-version link between the user's own machines. I do not request a change; noting it so the parent decides with it in view.

Inputs read and limits

Read in full: canonical operations SKILL, code-review index, review-method, impact-analysis, verification, orchestration, bounded-delegation; Great Library README; project AGENTS (in context), CONTRIBUTING, root GLOSSARY, docs/internals/effect-services.md; original worker brief; original Sol design review (R1-R4); amended design v2; original fee6 handoff report; prior Sol R1 report (in packet); current r1-fix report; Sol R2 report (in packet); #381 full body; canonical correction 6290392661 (full, in two reads); current handoff 6291267471 (identical to local r1-fix report apart from one trailing blank line). Approved #379 comment 6219474098: read its verdict, graph and #381 entry; the middle portion was truncated once in terminal output and I did not reread every paragraph, so I claim only the parts relevant to #381. Other #379/#386 historical comments not read.

Not read: every line of the 3,248-line shared workflow fixture (only the helpers the new tests call were relied on by name, and its bytes are unchanged from fee6 per final-inputs.sha256), the whole integration branch, all existing lifecycle tests, historical setup-failure logs, and full scoped-check outputs. No physical cross-machine, real provider rollback, client, old binary, full suite, CI or #379 acceptance is established here.

Elon record

Requirements and who asked: User requires a fresh read-only Opus 5.5 MEDIUM whole-head review of #582 under approved #381/#379 R3 and the accepted Sol R1 correction.
Deleted: Duplicate runtime execution, reliance on prior verdicts, publication/status writes and scope beyond the seven files and their consumers.
Bottleneck: Confirming that the observed run's scope reaches persisted completion, delivery and wake without breaking original immutability, replay fencing or the no-observation path.
Checked myself: Live PR/base identity, full diff hash, all seven file diffs, completion/attach/launch-purpose/lifecycle/follower/status consumers, retained red/green raw assertions and every final input hash. No test execution inferred.

Final state: HEAD 85d60f4f2bf082deba4c98f6d355d3cb35f32671, tree 13fffdaf8e007846f5a684dbd9d3a707539da80e, status clean. No process started; nothing to clean up.