The old shape was "look at the arguments, then run", so every guard that needed a
fact about the target fetched it itself, whenever it happened to need it. Three
failures follow at once: the same fact is computed repeatedly and may disagree
with itself; the guard is hard to reason about because its inputs arrive from
everywhere; and on a remote placement most of those fetches answer about the
wrong machine.
PREPARE reads the sealed placement ONCE and derives everything from that single
read — the fact door, the executor projection, and for an ssh placement the one
bundled prepare the target answers. A transitive AST test walks the pipeline and
requires every other placement read to be DECLARED with its reason; the earlier
scan read two function bodies and no further, so extracting the gate chain took
its reads out of view in the same commit that introduced them.
AUTHORIZE projects the final arguments into three NAMED views — handler, guard,
execution — bound immutably together, with every intentional difference declared
in a table. The guard projection used to be passed around as "the args", so the
authorized set and the executed set were two look-alike objects one rename apart.
EXECUTE hands the bound token to the target or continues on Home, and the
question that decides which is whether the operation ADDRESSES Home, not whether
the task is remote: by the ratified root matrix a remote task calling a
HOME-native root keeps its Home handler, and asking the placement instead sent
every guard keyed on the Home binding to its empty fallback.
Keep generic runtime data and cross-target system writes guarded in light mode, retain actionable cwd/not-found errors, and align private-binding test handlers with the frozen dispatch contract.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Resolve command, script, service, and run-kind verification targets once and carry the selected binding through interpreter choice, guards, execution, and receipts while preserving task custody.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Windows: the python-resolver tests built fake venvs in POSIX layout
(bin/python) while project_venv_python correctly looks for
Scripts\python.exe — the fixture is now platform-aware; the isolated-checkout
test repos pin core.autocrlf=false so the LF staged patch applies in the
detached worktree on autocrlf=true runners. ui-smoke: the desktop chat scroll
probe re-injects its bubbles after the viewport resize dance — a resize can
re-render the chat from the (empty) real history and silently drop injected
nodes, which made the post-resize assertion an environment-dependent flake.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Operator phase 2 of the owner-approved 6.65-6.67 release cycle. The physical
mutation lease/holder subsystem was deliberately descoped by the owner:
attribution is evidence-only (root-task baseline, terminal candidate snapshot,
attributed commit staging, projection into acceptance/review evidence, no
structural outcome veto). Ships the surface-aware Python interpreter resolver,
auditable Skill Review rounds/history, the single task-tree disposition
authority with cancel-wins, the SSOT operator review wrapper with typed exit
codes, the parallel hermetic pytest preflight, and the chronic red-CI
light-model test fix.
Review: advisory=skipped (prompt-size cap, non-blocking), triad
fable-5/gpt-5.6-sol/gemini-3.5-flash all responded, scope fable-5 responded,
aggregate PASSED (run 20260716T221730Z, $16.38). Full non-serial+serial pytest
green; ruff -F clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
