[pithead-developer]

Closes #554

Ordinary control setup previously embedded its temporary write token in jq's program argument. The shared set_cfg editor now accepts quoted jq options, allowing phase_control to pass the token through stdin using --rawfile and a constant program. Setup fields, apply failure handling, ordinary DONATION/thermal gates and EXIT restoration are preserved. The harness documentation describes both setup and request transport.

Ponytail review: kept only the shared editor option forwarding, ordinary-control caller, regression and doc correction; no additional abstraction or unrelated phase changes. Separate credential exposures are tracked in #559.

Validation:

• timeout 60 bash tests/test-refresh-window-control.sh — PASS. The real editor's jq arguments are inspected, config values asserted, every synthetic log checked for the token, setup edit/apply failures rejected, and the real EXIT trap restores byte-identical config on failure and success.
• Old ordinary-control setup mutation with the new test — FAIL as expected; corrected setup — PASS.
• shellcheck --severity=warning tests/e2e-pithead-control.sh tests/test-refresh-window-control.sh — PASS.
• shfmt -i 4 -d tests/e2e-pithead.sh tests/e2e-pithead-control.sh tests/test-refresh-window-control.sh — PASS.
• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh, make lint-topology, git diff --check — PASS.
• make lint — stopped during the aggregate ShellCheck pass after prolonged resource use; no aggregate PASS claimed. make lint-md — unavailable locally (npx missing); GitHub runs both gates.
• Author-side verifier and security reviewer — clean after strengthening failure-path restoration tests.

All eight GitHub checks passed on 1ff6628b056227907a3158fd62ec0cf217133e3d, including shell lint, suite, coverage and Docker e2e. No container or hardware tests ran locally. Other hardware phases are outside this ordinary setup change.

The renewed ordinary control proof's full status, complete log and sole retained artifact were inspected. It exercises authenticated setup, DONATION application/persistence, the thermal direct-feed gate and restoration. The hardware-free regression separately inspects jq arguments and checks log secrecy and byte-identical EXIT restoration on success and setup failures; the hardware job does not inspect process arguments. Final verifier review at the unchanged head is clean; the prior security review remains clean. The file-budget freeze gate passed again after evidence review. The PR remains draft for the independent reviewer.

Historical job 2016 remains an error with no candidate scenarios or artifacts. Recovery under bench-ci#1063 enabled the renewed proof without a code change. One profiler helper-end timestamp in the renewed log/artifact contains a redaction marker, an existing diagnostic defect tracked by bench-ci#1011. That record was not used for timing claims and does not affect the ordinary control assertions or #554's argument-inspection regression. Separate phase credential exposures remain scoped to #559.

Unchanged limitations: no real process-observer capture was performed; argv/log absence is covered by the synthetic regression. Other contract phases, mining performance and long-duration stress were not run because this change only alters ordinary control credential setup. All required GitHub gates passed; local aggregate lint was stopped and local markdown lint was unavailable as recorded above.

Bench evidence:

bench-ci job 2016@1ff6628b056227907a3158fd62ec0cf217133e3d · rigforge · tier4-e2e

• options: {"phases": ["control"]}
• status: completed · conclusion: error · exit none · 25m 07s
• baseline verified: no · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight failure · run skipped · collect skipped · restore failure · cleanup success
• rows: 0 pass · 0 fail · 0 skip
• error: baseline unverified since the last live-stack job (p2pool=running/unhealthy, wallet-rpc=running/starting); refusing before this run's scenarios
  Generated by bench-ci evidence 2016@1ff6628b056227907a3158fd62ec0cf217133e3d; re-run it to check.

bench-ci job 2026@1ff6628b056227907a3158fd62ec0cf217133e3d · rigforge · tier4-e2e

• options: {"phases": ["control"]}
• status: completed · conclusion: success · exit 0 · 7m 46s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run success · collect success · restore success · cleanup success
• rows: 4 pass · 0 fail · 0 skip
  Generated by bench-ci evidence 2026@1ff6628b056227907a3158fd62ec0cf217133e3d; re-run it to check.

[pithead-developer]

Blocked on bench-ci#1063. Job 2016@1ff6628b056227907a3158fd62ec0cf217133e3d ended in error: preflight refused the unverified live-stack baseline, so the candidate control scenarios never ran. Full status/log and the empty artifact inventory were read; no rows ran, rig restoration succeeded, and baseline verification failed. This supplies no hardware verdict for #554.

The code, regression tests, corrected documentation and author-side adversarial/security reviews are complete in draft PR #560, and all eight GitHub checks pass at that head. The managed recovery role owning bench-ci#1063 must diagnose and restore current baseline health and verify safe admission. Once that prerequisite closes, this issue needs a fresh narrow ordinary control job on the current head and review of its full log, artifacts and exact evidence. No blind retry or manual bench/rig action was performed.

[pithead-developer]

Ready for review

The ordinary control harness now supplies its temporary write token to a constant jq program through stdin. The shared editor preserves config publication and apply failure handling; the regression runs that real helper, rejects token-bearing arguments, checks all synthetic logs, and exercises the real EXIT restoration trap after both setup failures and successful control behavior. Restoring the old setup makes the regression fail.

GitHub lint, suite, coverage, Docker e2e and security checks passed on the PR head. The renewed queued ordinary control proof preserves authenticated application, DONATION persistence, thermal summary publication and restoration; I read its full status/log and sole artifact, and the PR includes its exact generated evidence. Author-side verifier and security reviews are clean. Historical job 2016 remains an error; the known unrelated profiler-redaction occurrence is recorded on bench-ci#1011.

I did not capture real process-observer traces or run other contract phases, mining-performance checks or long stress tests. Token secrecy is established by the argument/log regression; the narrow hardware run establishes preserved ordinary gate behavior. The PR stays draft for the independent review session.

[pithead-reviewer]

adversarial-review: PASS at 1ff6628, round 1, by the pithead-reviewer reviewer (a fresh session that did not produce this head; claude-sonnet-5-5).

PR #560 resolves #554: ordinary phase_control now passes its write token to a constant jq program via stdin (--rawfile), and set_cfg forwards extra jq options. I re-derived the evidence myself: the new regression fails against the pre-fix harness and passes at the head. All 8 GitHub checks are green. Job 2026 is a green tier4-e2e control run on the exact head, and its evidence block matches the one in the PR body.

Evidence

• gh pr view 560 / gh issue view 554: the issue asks for the token out of jq argv and logs, a hardware-free argv regression, and setup/restoration/gate coverage preserved. The diff touches only tests/ (README, e2e-pithead-control.sh, e2e-pithead.sh, test-refresh-window-control.sh). Head is 1ff6628, base develop. The Ready-for-review comment makes no claim the evidence below contradicts.
• gh pr checks 560: all 8 pass (Coverage, End-to-end (Docker), markdownlint, shellcheck+shfmt, yamllint, gitleaks, Test suite, zizmor). Draft state and branch-behind are not findings.
• bash tests/test-refresh-window-control.sh at the head: 'thermal refresh-window regressions: PASS', rc=0.
• Mutation: scratch copy of the head via git archive, with tests/e2e-pithead-control.sh and tests/e2e-pithead.sh restored from 1ff6628~1 (diff confirmed identical to the old files). The same test run exits rc=1 at the first 'fresh' case, because the jq wrapper rejects the token in argv. The new test is load-bearing.
• shellcheck --severity=warning on the 3 changed scripts: rc=0. shfmt -i 4 -d on the 3 changed scripts: rc=0. FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh: 'file budget OK'. make lint-topology: 'topology classes OK'.
• /bin/bash 3.2.57 with set -u: "${@:3}" with fewer than 3 args raised no unbound-variable error; my probe only failed on its own jq syntax.
• source ~/.config/bench-ci/env; bench-ci evidence 2026@1ff6628b056227907a3158fd62ec0cf217133e3d printed the same block as the PR body: tier4-e2e, phases [control], conclusion success, exit 0, baseline verified yes, rig restored yes, rows 4 pass / 0 fail / 0 skip, all 7 steps success.
• bench-ci log 2026@1ff6628b…: the checkout is 1ff6628. The control phase ran against real jq: POST /apply accepted, DONATION 0->1 applied and persisted, 'applied max_temp_c reaches a new direct sister-API summary within 16s', 'e2e-pithead: 4 ok, 0 failed', checkout restored, live stack healthy, 'conclusion: success'. The job tested the current head, and the diff is tests-only. One <tier-input> marker appears in the log, which is the known redaction defect on bench-ci#1011 (open, owns it); it is not used for timing claims.
• Job 2016 (error, baseline refused at preflight) is quoted in the body as historical, and its block matches the one bench-ci#1063 recorded. bench-ci#1063 is closed with the baseline recovered.
• detect-topology.py over the PR body, the PR comments and the Control harness setup exposes its temporary write token in jq arguments #554 body and comments: 'clean', rc=0.
• gh issue view 559: OPEN, 'Other contract harness phases expose credentials in process arguments'. The remaining token-in-argv sites (e2e-pithead.sh tok-507/tok-114, e2e-pithead-tokens.sh) are out of Control harness setup exposes its temporary write token in jq arguments #554's scope and tracked there.

Findings

• [note] tests/test-refresh-window-control.sh:55-56: The argv check wraps a jq shell function and uses eval "$(sed -n ...)" to pull the real set_cfg, _cleanup and snapshot_config out of e2e-pithead.sh. It never observes a real process's argv. The PR body states this limitation. The hardware job 2026 shows the rawfile path works with the rig's real jq. If those functions are renamed or reshaped, the sed extraction will fail loudly rather than silently pass.
• [note] PR body: The body quotes job 2016, a historical error, next to job 2026. It is labelled historical, so it is not a finding. Consider dropping the 2016 block once merged.
• [note] tests/README.md:40-42: The edited paragraph runs one long line (the 'Both keep the token out of process arguments...' sentence continues mid-line). markdownlint passes; it is a cosmetic tidy only.