[adrianwebb]

Outcome

Grouped proposals reach the Agent kernel's TreeDX preparation boundary with their shared memberships intact. The provider and sandbox guest consume the same SDK contract as group admission.

Work authority

• Work item / Issue: Complete communication closeout inside the original assignment window #496; shared plan in Continue coached Atlas team delivery and persistent agent improvements from #428 sdk#429 and Complete accounting transition observations for strict Agent acceptance api#553.
• Proposal / decision: Real UI proposal 07341861-d24b-471c-bf0d-86e68ec2df7a v2, open; no Decision issued for this blocked planning attempt.
• Assignment / checkpoint: assignment_lxyTbK9MbU8ViBBtOeJ-9fiZjOhHALqv failed treedx_content_invalid on groupIds; scoped-stopped workday workday-abaaf045-1b78-4cb8-a0f3-8c2432f5c56c.
• Actor: Codex integrator.
• Human authority: @adrian; explicit instruction to restore class/group/topic behavior through small existing-Issue slices and fix real blockers.
• Agent / capacity provider: UI Engineer; provider_-rcKRK8gG2NGnOU3yGu_CV3Wz7ACppTP. Integrator repairs its blocked SDK consumer.
• Exact base ref: staging af30dc646576e1fc03839cf410a768c49e0e30fb, fetched before branching and publication.
• Exact head ref: codex/group-contract496 2a6c814b8132738963d6093318df9e832c405b23.

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reproduce the native rejection, align the dependency and exact CI artifact, then retry the same real portfolio planning work after supported runtime adoption. Preserve original deadline 2026-10-20T16:47:00Z and failed evidence. This does not authorize work outside proposals/Decisions.

Changes and commits

• bc18e336: regression through actual prepareTreeDxContent; group preservation and negative individual-target/malformed membership cases.
• 78ca028b: pin shared SDK staging 69c07896708deaaed228cc6e14f12c41e5289981, npm-generated lock and matching install-exact-sdk Action.
• Provider/guest build paths already package the installed SDK; no new runtime path, permission, handler, or deadline changes.

Verification

Before repair, regression: 1 failed / 1 passed with the exact native groupIds unrecognized-key error. After repair: vitest run tests/modern/kernel/proposal-groups.test.ts tests/modern/kernel/provider-kernel-review.test.ts: 10 passed. npm run build:dist passed. npm run capacity-provider:build -- --roles base,guest passed.

Local build used verified SDK PR #433 artifact from successful run 39448753653, tested merge b7d3c7028354e7b98150798c35d01f35e5202906. Its tree, PR head and protected merge all equal 19df6eb32b731804e2a51d7c7b91561c6e0c05e2. CI installs the protected commit's own artifact. Required Agent Actions and real group retry remain pending. These focused checks are not managed end-to-end acceptance.

The native execution receipt records about 30.16 elapsed seconds and verified sandbox teardown; its planning product failed at kernel commit. No successful estimate or approved product is claimed.

Risk and rollback

SDK dependency change affects provider and guest parsing; required CI remains intact. Roll back by reverting this PR's two commits and rebuilding the previously selected provider/guest through trsd. Do not rewrite issued authority or erase the failed attempt.

CI run 39453214399 failed the file architecture rule: the new regression made 11 direct executable files in the kernel directory. Commit 2a6c814b8132738963d6093318df9e832c405b23 folds the identical cases into existing architecture/custody/context-custody-readback.test.ts. File architecture now passes; that suite plus provider-kernel-review passes 20 cases. No runtime code or assertion/limit changed. Replacement required CI pending.

Completion summary

Dependency repair and focused regression pass locally. Runtime adoption, independent Actions, group planning and required participation/readiness are still unproven. Existing seven published group subscriptions are configuration evidence only.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Latest installed-consumer repair: SDK rc124 is published from exact protected b754118c8035913b20ca9663ca418d48fa4dce05, Verify 39460744562, promotion/read-back 39463261142. Registry archive SHA256 567559d55bc25cf3101f66c0931aba8228efadcf7cc4625bad3ef244d8b882b1 matches the sealed artifact; npm latest remains 0.12.62. Agent now depends on published 0.13.0-rc.124 with npm-generated registry integrity, and verify plus both image-preparation paths install the same exact SDK. This closes the actual unbuilt nested Git-SDK installed-consumer failure from run 39455681695; no consumer assertion or timeout was weakened. The genuine native production archive installation test passes locally (10.06s), and the exact workflow alignment case passes. Earlier local retries against a stale hydrated rc123 dependency failed and remain retained; the successful run followed an actual clean SDK124 dependency installation. Required new-head Actions remain pending. Runtime adoption will wait for active work closure.