[pithead-developer]

Closes #559

Generated contract-harness credentials previously entered jq programs, curl bearer-header arguments and OpenSSL HMAC arguments. Access-token configuration now uses private stdin with a constant jq program; authenticated HTTP calls reuse the curl stdin helper; HMAC derivation uses Python's standard library with its key on stdin. Stratum setup/recovery retain the credential-safe stdin transport and fixture isolation from the merged prerequisites. Authentication, apply, revocation, rejection/no-work, recovery and EXIT restoration assertions remain mandatory. Bounded failure diagnostics export only fixed numeric/service-state fields and classified log counts.

The mandatory hardware-free credential regression inspects external arguments, checks raw/derived auth and actual revoked-bearer assertions, exercises special-character passwords and compares restored config bytes on success/failure. make test-suite runs it unconditionally in addition to the Bash suite and the upstream readiness regression. The Python-free kcov container continues measuring the Bash suite without changing its floor. Documentation describes transport, diagnostics and test prerequisites.

Ponytail review: reused the existing curl helper, editor and standard-library HMAC; no dependency or abstraction added. Required tests, documentation, validation and error handling remain.

The prerequisites are merged: PR #567 requires Stratum input, PR #572 isolates its authenticated pool, and PR #574 adds bounded bearer-free listener readiness before separate authenticated/revoked-bearer assertions. The readiness issue was renumbered from #571 to #573 through runner triage and is closed. The owner's resolution identifies harness timing, with no shipped product, release or pin change. This branch incorporates those changes at 115174304518914f1ecb66d277dc96ca4b12add0; merge resolutions preserve both readiness and private transport. The readiness regression now uses the real editor/helper and recognizes bearer data on curl stdin; the credential regression handles bearer-free probes separately from its seven auth assertions.

Validation at this merged head:

• timeout 60 bash tests/test-contract-credentials.sh — PASS.
• timeout 60 bash tests/test-access-token-readiness.sh — PASS: all eight phase cases and the deadline race retain their expectations and byte-identical restoration.
• timeout 60 bash "$TMPDIR/rigforge-559-stratum-check.sh" — PASS: hardware-free driver sources the actual expanded Stratum regression against the real phase/editor/dispatch/EXIT helpers.
• shellcheck --severity=warning tests/e2e-pithead.sh tests/e2e-pithead-tokens.sh tests/test-contract-credentials.sh tests/test-stratum-auth-gate.sh tests/test-access-token-readiness.sh — PASS.
• shfmt -i 4 -d tests/e2e-pithead.sh tests/e2e-pithead-tokens.sh tests/test-contract-credentials.sh tests/test-stratum-auth-gate.sh tests/test-access-token-readiness.sh — PASS.
• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh, make lint-topology, git diff --cached --check — PASS.
• Prior independent mutations restoring token jq interpolation, curl bearer argv, OpenSSL HMAC key argv and Stratum interpolation each failed the credential regression; removing each failure diagnostic independently also failed it. These historical mutation runs are not new hardware proof.
• Repeated author-side verifier and security reviewer — clean against the merged diff.

GitHub owns the full suite, coverage and container e2e; no local container/full-suite PASS is claimed. All eight current-head GitHub checks pass at 115174304518914f1ecb66d277dc96ca4b12add0, including Test suite, Coverage and Docker e2e.

Completed current-head hardware proof: 2160@115174304518914f1ecb66d277dc96ca4b12add0, submitted by managed Devops, executed the ordinary fetch/checkout and both touched phases. I independently read its full status, complete log, artifact inventory and both retained phase artifacts; downloaded sizes matched the inventory. The proof includes named-token raw/derived authentication and apply, separate HTTP 401 revocation checks on both listeners, and Stratum acceptance, wrong-password rejection with no work, and password recovery. The runner verified original configuration/mining restoration, byte-identical temporary stack fixture restoration and healthy baseline/chain sync. Its executing runner is 4ec942b35bc9868ccd350bfbe6e409d2d0d8a7e0, the merged classification fix from bench-ci PR #1255.

The operational blockers bench-ci#1249 and rigforge#575, moved from bench-ci#677, are closed. No implementation changed during recovery. Existing current-head job 2150 ended with a pre-harness Git permission error, with no assertions or artifacts; its full status/log and empty inventory were read. That separate target's operational recovery remains bench-ci#1271. Job 2160 proves this PR's credential behavior; it is not credited as target-specific repair proof for #1271. No duplicate submission or manual bench action was made by this worker.

The exact file-budget freeze command was rerun successfully against the unchanged tested head before this readiness update. All eight current-head GitHub checks pass and the repeated author-side verifier/security reviews remain clean. The draft is ready for the runner's independent review; this session will not merge it.

Retained earlier jobs: full status, complete logs and both phase artifacts were read. Job 2019 proves access-token assertions but skipped Stratum for missing input; structured omitted-skip reporting remains bench-ci#1107. Jobs 2086 and 2093 failed actual control revocation and Stratum rejection; their diagnostics motivated the now-merged prerequisites. None proves the current combined head. Their generated evidence remains unedited below. Other hardware phases are outside this credential-transport change. The PR remains draft for independent runner review; the current-head implementation and touched-area hardware gates are complete.

bench-ci job 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 · rigforge · tier4-e2e

• options: {"phases": ["access-tokens", "stratum-auth"]}
• status: completed · conclusion: success · exit 0 · 3m 06s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run success · collect success · restore success · cleanup success
• rows: 7 pass · 0 fail · 0 skip
  Generated by bench-ci evidence 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9; re-run it to check.

bench-ci job 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 · rigforge · tier4-e2e

• options: {"phases": ["access-tokens", "stratum-auth"]}
• status: completed · conclusion: failure · exit 1 · 4m 06s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run failure · collect success · restore success · cleanup success
• rows: 7 pass · 2 fail · 0 skip
• failed rows:
  • revoked entry still answered 000 on :8082 (no issue linked)
  • wrong pass: no rejection within 60s (no issue linked)
    Generated by bench-ci evidence 2086@5705bc8f74c4544a291dceef3813ac91b18bf564; re-run it to check.

bench-ci job 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 · rigforge · tier4-e2e

• options: {"phases": ["access-tokens", "stratum-auth"]}
• status: completed · conclusion: failure · exit 1 · 4m 07s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run failure · collect success · restore success · cleanup success
• rows: 7 pass · 2 fail · 0 skip
• failed rows:
  • revoked entry still answered 000 on :8082 (no issue linked)
  • wrong pass: no rejection within 60s (no issue linked)
    Generated by bench-ci evidence 2093@05341b4ad9f0b9c0b55f95669d28d01722740730; re-run it to check.

bench-ci job 2135@115174304518914f1ecb66d277dc96ca4b12add0 · rigforge · tier4-e2e

• options: {"phases": ["access-tokens", "stratum-auth"]}
• status: completed · conclusion: failure · exit 1 · 0m 49s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run failure · collect success · restore success · cleanup success
• rows: 0 pass · 0 fail · 0 skip
  Generated by bench-ci evidence 2135@115174304518914f1ecb66d277dc96ca4b12add0; re-run it to check.

bench-ci job 2150@115174304518914f1ecb66d277dc96ca4b12add0 · rigforge · tier4-e2e

• options: {"phases": ["access-tokens", "stratum-auth"]}
• status: completed · conclusion: error · exit 1 · 1m 23s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run failure · collect success · restore success · cleanup success
• rows: 0 pass · 0 fail · 0 skip
• error: environment: RigForge pre-harness fetch failed; no candidate phase ran
  Generated by bench-ci evidence 2150@115174304518914f1ecb66d277dc96ca4b12add0; re-run it to check.

bench-ci job 2160@115174304518914f1ecb66d277dc96ca4b12add0 · rigforge · tier4-e2e

• options: {"phases": ["access-tokens", "stratum-auth"]}
• status: completed · conclusion: success · exit 0 · 3m 48s
• baseline verified: yes · rig restored: yes
• node guard: not recorded · no comparison recorded
• steps: checkout success · reserve success · preflight success · run success · collect success · restore success · cleanup success
• rows: 11 pass · 0 fail · 0 skip
  Generated by bench-ci evidence 2160@115174304518914f1ecb66d277dc96ca4b12add0; re-run it to check.

[pithead-developer]

Blocked on authenticated stratum evidence

bench-ci#1106 prevents completing the touched stratum proof. Job 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 successfully exercised the access-token path, but its full log and retained stratum artifact show that the requested stratum phase skipped for missing private input. The generated evidence omits that skip; bench-ci#1107 owns that reporting defect.

The credential fix, special-character/argument-inspection/restoration regression, documentation and repeated verifier/security reviews are finished in draft PR #561. The coverage test-routing correction is pushed at 6664948b5efd6916dc69bd5bfec02ec9fd44f4fc; current-head GitHub checks are pending. Bench maintainers can unblock this by providing the approved runner-managed authenticated fixture or the supported submission that executes right-password mining, wrong-password rejection and recovery. Then rerun the touched phases at the current head and renew full log/artifact/evidence validation. No ready-to-merge claim is made while that proof is missing.

[pithead-developer]

Resumed validation

Rigforge#562 is closed through PR #567, and the runner-managed authentication fixture/routing prerequisites are deployed. PR #561 now merges develop at head 5705bc8f74c4544a291dceef3813ac91b18bf564, preserving the explicit missing-input Stratum refusal. Credential and merged Stratum-gate regressions, focused lint, budget/topology gates and repeated verifier/security reviews are clean.

Job 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 is queued for access-tokens,stratum-auth; its generated evidence is in the PR. The old job's missing-input skip supplies no Stratum proof. Completion must execute acceptance, rejection and recovery and verify restoration; the worker will read full logs/artifacts and regenerate evidence before calling this ready for review. The PR stays a draft.

[pithead-developer]

Diagnostic proof queued

Job 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 failed the control-revocation transport and wrong-password rejection gates. Full status/log and both retained artifacts were read; restoration passed, but the retained output does not establish the failure causes. All eight GitHub checks passed on that head.

The follow-up at 05341b4ad9f0b9c0b55f95669d28d01722740730 preserves the assertions and deadlines while retaining numeric curl/service diagnostics and existing fixed-schema XMRig state/error counts. Injected failures still fail, restore config and hide synthetic secrets; diagnostic-removal mutations fail the regression. Focused lint, budget/topology checks and repeated verifier/security reviews are clean. Job 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 is queued for the same two phases; all generated evidence blocks are refreshed in the PR. The PR remains draft pending full current-head evidence and cause diagnosis if either gate fails again.

[pithead-developer]

Blocked on rigforge#570, with an additional proof prerequisite in bench-ci#1182.

Job 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 fails actual control revocation and Stratum rejection. Its full status/log/artifacts were read and baseline/rig restoration passed. Standalone Stratum does not select or isolate the authenticated fixture; #570 must correct that harness gap before the rejection result can prove the intended contract. The control diagnostic records curl exit 7 despite an active unit; #1182 must diagnose and resolve fixture/listener availability, or identify the concrete product prerequisite. Service activity alone cannot replace HTTP 401 proof.

The credential-transport implementation, mandatory argument-inspection/error-restoration regressions, documentation, clean author-side verifier/security review and all eight current-head GitHub checks are complete in draft PR #561. The owning workers must finish those prerequisites; then this session can incorporate the base and obtain a fresh pushed-SHA narrow run proving revocation plus Stratum acceptance/rejection/recovery. Evidence blocks in the PR have been regenerated. No identical retry, weakened assertion or manual bench intervention was used.

[pithead-developer]

Blocked on bench-ci#1249.

The Stratum and control readiness prerequisites are merged and incorporated into draft PR #561 at pushed head 115174304518914f1ecb66d277dc96ca4b12add0. Credential, readiness and focused Stratum regressions, focused lint, topology and the exact file-budget gate pass. Private credential transport, bounded readiness and the separate auth/revocation assertions are preserved. Verifier and security reviews are clean; six current-head GitHub checks pass, with Test suite and Coverage pending.

The new narrow access-tokens,stratum-auth submission was refused with HTTP 422 stratum_auth_not_available before any job was created. Supported fleet evidence identifies a paused Stratum owner with an unhealthy baseline; the operator already owns its recovery under #1249. That recovery must establish an independently verified healthy baseline and resume managed dispatch before current-head proof can run. When #1249 closes, this session can submit both touched phases on the final pushed SHA, read full logs/artifacts and require actual revoked-bearer HTTP 401 plus all Stratum assertions and restoration. No new job, bypass, duplicate recovery or manual bench intervention occurred.

[pithead-developer]

Blocked on bench-ci#677.

Job 2135@115174304518914f1ecb66d277dc96ca4b12add0 failed while fetching the submitted commit into the borrowed rig's managed checkout: Git could not write to its object database. Full status, complete log and the empty artifact inventory were read; neither requested authentication phase ran. Baseline and rig restoration passed. This matches #677's existing permission failure and product-failure classification defect, so the recurrence is recorded there rather than duplicated.

PR #561's credential implementation, regressions, documentation, clean verifier/security reviews and all eight current-head GitHub checks are complete. Bench maintainers must resolve the managed checkout permission/ownership cause and restore normal fetch capability before a new narrow access-tokens,stratum-auth job can prove actual HTTP 401 revocation, all Stratum assertions and restoration. No manual rig repair, unchanged retry or weakened assertion was performed; the current run is not a product assertion failure or passing hardware proof.

[pithead-developer]

Ready for review

This change removes generated credentials from contract-harness process arguments by reusing stdin-based configuration and HTTP transport plus standard-library HMAC. Mandatory regressions inspect those arguments and preserve authentication, revocation, failure handling and restoration; documentation describes the behavior. The merged prerequisites retain bounded listener readiness and isolate the authenticated Stratum fixture.

At unchanged head 115174304518914f1ecb66d277dc96ca4b12add0, all eight GitHub checks pass and author-side verifier/security reviews are clean. Managed job 2160@115174304518914f1ecb66d277dc96ca4b12add0 supplies the missing runtime proof: ordinary fetch/checkout, named-token authentication/apply, actual revoked-bearer HTTP 401, Stratum acceptance/rejection/no-work/recovery, and verified rig/baseline/temporary-fixture restoration. I read full status/log and both artifacts, checked their sizes, and regenerated every retained evidence block in the body. Earlier failed/error jobs remain recorded as such.

Unrelated hardware phases were not run because this fix changes credential transport in these two phases. No local container/full-suite PASS is claimed; GitHub owns those checks. No code, release/pin or payout configuration changed during operational recovery. The PR stays draft for the independent reviewer and runner merge gate.

[pithead-reviewer]

Adversarial review: PASS

Reviewed head: 115174304518914f1ecb66d277dc96ca4b12add0.

PASS at 1151743: private credential transport and mandatory regressions satisfy #559 while preserving authentication, revocation, Stratum and restoration gates. Independent regression/mutation checks, all eight head checks and current-head job 2160 substantiate the claim; public topology scans, security and ponytail review have no findings. Earlier failed/error jobs remain historical evidence with their existing owners and are not credited as passing proof.

Acceptance: remove generated master/named tokens, derived bearer keys and Stratum passwords from external process arguments using private stdin/owner-only transport and constant programs. Prove argument safety without hardware and retain raw/derived authentication, authenticated apply, actual revoked-bearer HTTP 401 on both listeners, Stratum acceptance/rejection/no-work/recovery and byte-identical EXIT restoration, including failures.

Job 2160 executes all seven access-token and four Stratum assertions. Its full log, status and both phase artifacts agree; ordinary branch checkout/apply, rig restoration, temporary fixture byte restoration and healthy baseline/chain-sync verification all succeeded. Job 2150 remains an environment error owned by bench-ci#1271; a subsequent successful product proof does not close that separate target recovery. Historical 2019 omitted-skip reporting remains bench-ci#1107; its skipped Stratum phase is not coverage.

Base and file-budget rules held; no release files, product services, OS changes or companion PR. No findings.

Command record (private tool/scratch locations use placeholders):

• pwd; git status --short; git rev-parse HEAD — assigned checkout clean at 1151743; private location withheld.
• cat AGENTS.md; cat CONTRIBUTING.md — read develop-base, validation, topology, file-budget and merge contracts.
• cat /SKILL.md; cat /SKILL.md; cat /SKILL.md — applied minimal-change and complexity review; graph instructions initially truncated, CLI-supported code-only extraction used in private scratch.
• gh pr view 561 --repo p2pool-starter-stack/rigforge --json title,body,author,baseRefName,headRefName,headRefOid,isDraft,comments,reviews,files,commits,url — develop base, matching reviewed SHA, six changed files, eight discussion comments, no reviews. Read latest developer Ready for review dated 2026-10-05T04:33:58Z.
• gh issue view 559 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read credential-argument exposure claim and all 13 comments. Acceptance: private credential transport with constant programs, hardware-free argument inspection, preserved authentication/revocation/Stratum/restoration gates.
• python3 captured-source readers — read complete current claim/discussion and direct references; accepted only owner and pithead App statements as project claims. Supplied private bench-ci source context read without refetching.
• ls graphify-out/graph.json — absent; no tracked graph or ignore rule added because review must leave the branch untouched.
• git diff origin/develop...HEAD --stat — six files, 238 insertions, 23 deletions; tests, Makefile and corrected documentation only.
• git diff origin/develop...HEAD — reviewed all changed hunks; no relaxed assertions, swallowed new failures, stub product behavior, silent narrowing, TODO fix, unsupported output or untested added machinery.
• sed -n '1,160p' — read detector contract; blocking topology and nonblocking advisories distinguished.
• bench-ci --help; bench-ci log --help; bench-ci artifacts --help — read qualified evidence, full-log and artifact retrieval syntax.
• gh pr checks 561 --repo p2pool-starter-stack/rigforge — all eight checks pass: Test suite, Coverage, Docker e2e, shell/Markdown/YAML lint, Gitleaks and Zizmor; none skipped.
• python3 private-scratch/source-capture driver — owner-only scratch created; current PR body, eight PR comments and 13 issue comments captured.
• python3 --self-test — exit 0: 14 positive, 11 negative and 14 scrub round-trip controls pass.
• python3 — clean, exit 0; matched text never printed.
• graphify --help — confirmed extraction/query CLI.
• graphify extract . --code-only --no-cluster --max-workers 1 --out — exit 0; 863 nodes, 1,687 edges. Thirty-nine non-code files skipped; 12 data files yielded no nodes. Navigation only, no validation claim.
• graphify query 'phase_access_tokens phase_stratum_auth set_cfg _control_curl _cleanup test-contract-credentials' --graph --budget 2000 — traced editor, curl helper, phases, cleanup and tests; 108 nodes, budget-truncated navigation output.
• gh issue view 554 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read ordinary-control credential prerequisite; closed through fix(tests): hide ordinary control setup token from jq arguments #560.
• gh issue view 562 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read missing-input refusal and fixture history; closed through fix(tests): fail explicit Stratum auth when input is missing #567.
• gh issue view 570 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read isolated-fixture prerequisite and owner rulings; closed through fix(tests): isolate standalone Stratum authentication fixture #572.
• gh issue view 571 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — exit 1, GitHub cannot resolve old number. Current body and runner-provided triage establish its replacement Repeated control transport failure after revocation despite active service (job 2093) #573; required replacement read.
• gh issue view 573 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read owner ruling: recovered shipped listeners require harness readiness; closed through fix(tests): wait for token-gate listeners after apply #574.
• gh issue view 575 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read transferred permission-recovery issue and trusted Devops completion; closed.
• gh pr view 567 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url,mergedAt,mergeCommit,headRefOid — read merged missing-input prerequisite, body and discussion; no linked job reused as current-head proof.
• gh pr view 572 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url,mergedAt,mergeCommit,headRefOid — read merged fixture-isolation prerequisite, body and discussion; no linked job reused as current-head proof.
• gh pr view 574 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url,mergedAt,mergeCommit,headRefOid — read merged readiness prerequisite and owner correction history; no linked job reused as current-head proof.
• cat tests/test-contract-credentials.sh; cat tests/e2e-pithead-tokens.sh; sed -n '1,180p' tests/e2e-pithead-control.sh; sed -n '1,230p' tests/e2e-pithead.sh — traced real constant-program editing, private HTTP/HMAC transport, assertions, failure propagation and EXIT restoration.
• sed -n '405,475p' tests/e2e-pithead.sh — verified isolated Stratum setup and recovery use stdin, explicit dispatch requires input, rejection/no-work/recovery remain separate assertions.
• rg -n test/coverage/diagnostic registration in Makefile, tests/run.sh, tests/test-stratum-auth-gate.sh, tests/e2e-control-replay.sh, .github/workflows/ci.yml, tests/coverage.sh — credential regression mandatory in make test-suite; existing coverage floor unchanged.
• git log --oneline origin/develop..HEAD — six branch commits, including prerequisite merges; no release or product scope added.
• python3 regenerated-evidence/status/log reader — all six evidence blocks exactly match PR body. Initial json.loads rejected CLI status trailers; raw_decode then read complete JSON and failure trailers correctly.
• timeout 60 bash tests/test-contract-credentials.sh — exit 0, contract credential regressions: PASS; success and injected edit/apply/revocation/Stratum failures restore config bytes and hide synthetic credentials.
• timeout 60 bash tests/test-access-token-readiness.sh — exit 0; all eight phase cases plus deadline race pass, including byte-identical EXIT restoration.
• FILE_BUDGET_REQUIRE_BASE=1 bash scripts/lint-file-budget.sh — exit 0; every ceiling respected and budget monotonic.
• make lint-topology — exit 0; scanner self-tests pass and repository topology classes clean.
• shellcheck --severity=warning tests/e2e-pithead.sh tests/e2e-pithead-tokens.sh tests/test-contract-credentials.sh tests/test-stratum-auth-gate.sh tests/test-access-token-readiness.sh — exit 0, no warnings; independently repeated.
• shfmt -i 4 -d tests/e2e-pithead.sh tests/e2e-pithead-tokens.sh tests/test-contract-credentials.sh tests/test-stratum-auth-gate.sh tests/test-access-token-readiness.sh — exit 0, no formatting diff; independently repeated.
• git diff --check — no whitespace errors; repeated at finish.
• cat tests/test-stratum-auth-gate.sh; sed -n '1,210p' tests/test-access-token-readiness.sh; sed -n '1,80p' tests/e2e-control-replay.sh; sed -n '530,575p' tests/e2e-pithead.sh — reviewed real fixture, readiness, sanitized diagnostic and dispatch/restoration contracts; truncated portions reread narrowly.
• python3 retained-artifact reader — all eight complete phase artifacts read; actual assertions agree with logs/rows. Historical 2019 Stratum skip remains reporting issue bench-ci#1107, never accepted as coverage.
• gh api repos/p2pool-starter-stack/rigforge/actions/runs/37170371209 --jq '{head_sha,status,conclusion,event}' — completed/success pull_request run on reviewed head.
• gh api repos/p2pool-starter-stack/rigforge/actions/runs/37170371213 --jq '{head_sha,status,conclusion,event}' — completed/success security run on reviewed head; Gitleaks and workflow audit green.
• gh api --paginate --slurp repos/p2pool-starter-stack/rigforge/pulls/561/comments — zero inline review comments.
• git worktree add --detach 1151743 — isolated mutation checkout created; assigned branch unchanged.
• git show origin/develop:tests/e2e-pithead-tokens.sh; timeout 60 bash tests/test-contract-credentials.sh in scratch retaining new test — reverting non-test token fix fails, exit 1: credential appeared in process arguments.
• git show origin/develop:tests/e2e-pithead.sh; timeout 60 bash tests/test-contract-credentials.sh in scratch retaining new test — reverting Stratum failure diagnostic fails required assertion, exit 1.
• timeout 60 bash tests/test-contract-credentials.sh in restored scratch — exit 0, PASS; scratch clean.
• python3 independent mutation driver; timeout 60 bash tests/test-contract-credentials.sh for each variant — bearer-header argv, HMAC-key argv, removed token diagnostic and Stratum recovery interpolation each fail with exit 1; restoring reviewed files passes with exit 0.
• python3 focused Stratum driver; timeout 60 bash /stratum-driver.sh — exit 0, 88 assertions pass, zero fail; sources actual tests/test-stratum-auth-gate.sh with repository assertion helpers and real editor/phase/dispatch/EXIT functions.
• sed -n '1,90p' tests/test-e2e-gate-fail-closed.sh; sed -n '18,65p' tests/e2e-control-replay.sh; sed -n '180,205p' tests/test-access-token-readiness.sh; sed -n '530,567p' tests/e2e-pithead.sh — reread harness registration, fixed-schema diagnostics, timeout race and actual dispatch.
• rg -n assertion helper definitions in tests/run.sh — located repository helpers for focused driver; an earlier broad assertion search was truncated and not treated as complete evidence.
• python3 linked-source/body/comment readers — completed direct-reference reading and owner/App filtering. Supplied bench-ci#1106/#1107/#1182/#1231/#1249/#677/#1271/#922 and PR #1255 context used as supplied, without recursive evidence tracing.
• python3 — clean, exit 0 across body, discussion, inline comments and issue comments.
• python3 — clean, exit 0; older linked surfaces supply no current-PR topology finding.
• git status --short --branch; git rev-parse HEAD — assigned checkout remains clean and detached at reviewed head.
• gh pr view 561 --repo p2pool-starter-stack/rigforge --json headRefOid,baseRefName,body,comments — final recapture confirms unchanged head and develop base.
• gh pr checks 561 --repo p2pool-starter-stack/rigforge — final repetition: all eight checks still pass, none skipped.
• Manual security and ponytail review of complete diff/real flow — no findings. Reuses existing stdin curl/editor and standard-library hmac; no new dependency, interface, binding, privileged action or unpinned supply chain. No weakened restoration or required validation.
• Not run locally: full suite, coverage, Docker/container/compose/mini-stack or any hardware tier. GitHub supplies tiers 1–3; current-head job 2160 supplies live touched-area proof. bench-ci make check/OpenAPI, Pithead CLI parity and os/ KVM gates do not apply to this RigForge harness-only diff; no companion PR requiring merge order.
• source ~/.config/bench-ci/env; bench-ci evidence 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 — exit 0; success, exit 0; seven pass, zero structured fail/skip; log explicitly skips Stratum for missing input; restoration verified; pasted block matches exactly.
• source ~/.config/bench-ci/env; bench-ci status 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 — exit 0; complete qualified job record read, agrees with evidence.
• source ~/.config/bench-ci/env; bench-ci log 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 — exit 0; full log read; success, exit 0; seven pass, zero structured fail/skip; log explicitly skips Stratum for missing input; restoration verified. Raw box values withheld.
• source ~/.config/bench-ci/env; bench-ci artifacts 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 — exit 0; two phase artifacts, 675/226 bytes (access-tokens/Stratum).
• source ~/.config/bench-ci/env; bench-ci artifacts 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 e2e-pithead-access-tokens.log --out — exit 0; full 675-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci artifacts 2019@3a73ea59d2d5a7576e1a0602b7d8521e788647b9 e2e-pithead-stratum-auth.log --out — exit 0; full 226-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci evidence 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 — exit 0; failure, exit 1; seven pass, two fail; control HTTP 000 and Stratum rejection failures; historical precursor, not head proof; restoration verified; pasted block matches exactly.
• source ~/.config/bench-ci/env; bench-ci status 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 — exit 0; complete qualified job record read, agrees with evidence.
• source ~/.config/bench-ci/env; bench-ci log 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 — exit 0; full log read; failure, exit 1; seven pass, two fail; control HTTP 000 and Stratum rejection failures; historical precursor, not head proof; restoration verified. Raw box values withheld.
• source ~/.config/bench-ci/env; bench-ci artifacts 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 — exit 0; two phase artifacts, 624/173 bytes (access-tokens/Stratum).
• source ~/.config/bench-ci/env; bench-ci artifacts 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 e2e-pithead-access-tokens.log --out — exit 0; full 624-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci artifacts 2086@5705bc8f74c4544a291dceef3813ac91b18bf564 e2e-pithead-stratum-auth.log --out — exit 0; full 173-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci evidence 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 — exit 0; failure, exit 1; seven pass, two fail; diagnostic confirms control rc=7/active=1 and no Stratum auth errors; closed prerequisites Repeated control transport failure after revocation despite active service (job 2093) #573/Standalone stratum-auth must isolate the authenticated fixture pool #570 own subsequent fixes; restoration verified; pasted block matches exactly.
• source ~/.config/bench-ci/env; bench-ci status 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 — exit 0; complete qualified job record read, agrees with evidence.
• source ~/.config/bench-ci/env; bench-ci log 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 — exit 0; full log read; failure, exit 1; seven pass, two fail; diagnostic confirms control rc=7/active=1 and no Stratum auth errors; closed prerequisites Repeated control transport failure after revocation despite active service (job 2093) #573/Standalone stratum-auth must isolate the authenticated fixture pool #570 own subsequent fixes; restoration verified. Raw box values withheld.
• source ~/.config/bench-ci/env; bench-ci artifacts 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 — exit 0; two phase artifacts, 689/389 bytes (access-tokens/Stratum).
• source ~/.config/bench-ci/env; bench-ci artifacts 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 e2e-pithead-access-tokens.log --out — exit 0; full 689-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci artifacts 2093@05341b4ad9f0b9c0b55f95669d28d01722740730 e2e-pithead-stratum-auth.log --out — exit 0; full 389-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci evidence 2135@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; failure, exit 1; zero rows; pre-harness fetch permission fault, no candidate execution; historical ownership bench-ci#677/rigforge#575; restoration verified; pasted block matches exactly.
• source ~/.config/bench-ci/env; bench-ci status 2135@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; complete qualified job record read, agrees with evidence.
• source ~/.config/bench-ci/env; bench-ci log 2135@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; full log read; failure, exit 1; zero rows; pre-harness fetch permission fault, no candidate execution; historical ownership bench-ci#677/rigforge#575; restoration verified. Raw box values withheld.
• source ~/.config/bench-ci/env; bench-ci artifacts 2135@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; empty inventory, matching zero candidate phases.
• source ~/.config/bench-ci/env; bench-ci evidence 2150@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; error, exit 1; zero rows; pre-harness fetch permission fault owned by existing bench-ci#1271; restoration verified; not candidate proof; pasted block matches exactly.
• source ~/.config/bench-ci/env; bench-ci status 2150@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; complete qualified job record read, agrees with evidence.
• source ~/.config/bench-ci/env; bench-ci log 2150@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; full log read; error, exit 1; zero rows; pre-harness fetch permission fault owned by existing bench-ci#1271; restoration verified; not candidate proof. Raw box values withheld.
• source ~/.config/bench-ci/env; bench-ci artifacts 2150@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; empty inventory, matching zero candidate phases.
• source ~/.config/bench-ci/env; bench-ci evidence 2160@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; success, exit 0; 11 pass, zero fail/skip; current-head ordinary fetch/checkout and both phases executed; baseline and rig restored; executing runner 4ec942b35bc9868ccd350bfbe6e409d2d0d8a7e0; pasted block matches exactly.
• source ~/.config/bench-ci/env; bench-ci status 2160@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; complete qualified job record read, agrees with evidence.
• source ~/.config/bench-ci/env; bench-ci log 2160@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; full log read; success, exit 0; 11 pass, zero fail/skip; current-head ordinary fetch/checkout and both phases executed; baseline and rig restored; executing runner 4ec942b35bc9868ccd350bfbe6e409d2d0d8a7e0. Raw box values withheld.
• source ~/.config/bench-ci/env; bench-ci artifacts 2160@115174304518914f1ecb66d277dc96ca4b12add0 — exit 0; two phase artifacts, 933/306 bytes (access-tokens/Stratum).
• source ~/.config/bench-ci/env; bench-ci artifacts 2160@115174304518914f1ecb66d277dc96ca4b12add0 e2e-pithead-access-tokens.log --out — exit 0; full 933-byte artifact retrieved and size verified.
• source ~/.config/bench-ci/env; bench-ci artifacts 2160@115174304518914f1ecb66d277dc96ca4b12add0 e2e-pithead-stratum-auth.log --out — exit 0; full 306-byte artifact retrieved and size verified.

[pithead-reviewer]

adversarial-review: PASS at 1151743, round 1, by the pithead-reviewer reviewer (a fresh session that did not produce this head; gpt-6.1-sol).

PASS at 1151743: independent regressions, mutation failures, eight green head checks and job 2160 substantiate #559’s credential-transport and preserved authentication/restoration contracts. Security, ponytail and public topology reviews have no findings. The verdict and full command record are published on PR #561.

Evidence

• pwd; git status --short; git rev-parse HEAD — assigned checkout clean at 1151743; private location withheld.
• cat AGENTS.md; cat CONTRIBUTING.md — read branching, validation, topology, singular file-budget and merge rules.
• cat /SKILL.md; cat /SKILL.md; cat /SKILL.md — applied complexity and minimal-change review; initial graph instructions truncated, supported CLI extraction used in private scratch.
• gh pr view 561 --repo p2pool-starter-stack/rigforge --json title,body,author,baseRefName,headRefName,headRefOid,isDraft,comments,reviews,files,commits,url — develop base, matching head, six changed files, eight discussion comments, no reviews. Read latest developer Ready for review dated 2026-10-05T04:33:58Z.
• gh issue view 559 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read claim and 13 comments. Acceptance: private credential transport with constant programs, hardware-free argument inspection, preserved authentication/revocation/Stratum/restoration gates.
• python3 captured-source readers — read current claim/discussion and direct references; only owner and pithead App statements accepted as project claims. Runner-prefetched private context read without refetching.
• ls graphify-out/graph.json — absent; branch left untouched.
• git diff origin/develop...HEAD --stat — six files, 238 insertions, 23 deletions; harness, tests, Makefile and documentation only.
• git diff origin/develop...HEAD — reviewed complete diff; no weakened assertions, swallowed new failures, stub product behavior, silent narrowing, TODO fix or untested added machinery.
• sed -n '1,160p' — read blocking-topology and advisory contracts.
• bench-ci --help; bench-ci log --help; bench-ci artifacts --help — read qualified evidence, full-log and artifact syntax.
• gh pr checks 561 --repo p2pool-starter-stack/rigforge — all eight checks pass: Test suite, Coverage, Docker e2e, shell/Markdown/YAML lint, Gitleaks and Zizmor; none skipped.
• python3 private-scratch/source-capture driver — owner-only scratch created; PR body, eight PR comments and 13 issue comments captured.
• python3 --self-test — exit 0; 14 positive, 11 negative and 14 scrub round-trip controls pass.
• python3 — clean, exit 0.
• graphify --help — confirmed extraction/query CLI.
• graphify extract . --code-only --no-cluster --max-workers 1 --out — exit 0; 863 nodes, 1,687 edges. Non-code files skipped; 12 data files produced no nodes. Used for navigation only.
• graphify query 'phase_access_tokens phase_stratum_auth set_cfg _control_curl _cleanup test-contract-credentials' --graph --budget 2000 — located editor, transport, phases, cleanup and tests; budget-truncated navigation output.
• gh issue view 554 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read ordinary-control credential prerequisite; closed through fix(tests): hide ordinary control setup token from jq arguments #560.
• gh issue view 562 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read missing-input refusal and fixture history; closed through fix(tests): fail explicit Stratum auth when input is missing #567.
• gh issue view 570 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read isolated-fixture prerequisite and owner rulings; closed through fix(tests): isolate standalone Stratum authentication fixture #572.
• gh issue view 571 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — exit 1: old number cannot resolve. Current body and runner triage establish replacement Repeated control transport failure after revocation despite active service (job 2093) #573, which was read.
• gh issue view 573 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read owner ruling on harness readiness; closed through fix(tests): wait for token-gate listeners after apply #574.
• gh issue view 575 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url — read transferred permission-recovery issue and trusted Devops completion; closed.
• gh pr view 567 --repo p2pool-starter-stack/rigforge --json title,body,author,comments,state,url,mergedAt,mergeCommit,headRefOid — read merged missing-input prerequisite; its jobs were not reused as current-head evidence.