Keep development readiness state outside immutable CLI archives

[adrianwebb]

Outcome

The supported CLI development watcher refreshes a timestamp marker under dist. npm shipped that marker, so a rebuild changed archive integrity even when executable bytes were unchanged. Exclude only the readiness marker and atomic temporary sibling through the existing package files selection. Preserve source/development readiness and strict executable-asset custody.

Work authority

• Work item / Issue: CLI Current cli backlog: retained requirements after issue consolidation #274; SDK #387 continuation.

• Proposal / decision: User-approved capacity-provider and agent-execution implementation plan.

• Assignment / checkpoint: Immutable CLI archive packaging and existing public command boundary; no managed workday.

• Actor: Codex desktop.

• Human authority: adrianwebb, explicit implementation and cleanup authorization.

• Agent / capacity provider: Codex desktop; no managed provider execution claimed.

• Exact base ref: staging 22b6a27136a3583f4128cfd763917371e5572985.

• Exact head ref: codex/immutable-cli-archives-274 ee555a7501468c697f49c0b4ed618dbb4f269857.

• Agent-authored under human authority

Plan

Regression first, strengthen the existing package unit/native cases and their existing component scene refs, then repair package selection. Use the checked Reviewer repair for fresh strict owner prerequisites before component scenes.

Changes and commits

• 543e6bb: failing marker-selection and checked-Reviewer regressions; native archive case adds marker writes and independent unchanged inventory/integrity check.
• 82af902: exclude dist/.treeseed-build-complete.json and its .new sibling from npm files; pin scene action to checked Reviewer9dc625e2186e6d618cea30a17afd79fe64a95998.

No verifier IDs or suite selection changed. Existing 168 component refs retain all previous assertions; actual production CLI/SDK/Identity installation and public binary proof remain intact. Native case retains its original 30-second bound (focused observed15.66s).

Verification

• Original focused marker regression: 1 failed; original checked-Reviewer regression:1 failed, retained separately.
• Focused package unit/native suite:12/12 passed, zero fail/skip/todo.
• Complete declared npm test on exact82af902:369/369 passed, zero fail/cancel/skip/todo;121.09s, log SHA2568e4d0e66a95f0ba413a0b184fe1e31b231cc94034d72b28790d234eeb667dbea.
• Strict TypeScript checking of both changed test files passed. Source length/architecture checks passed. Original component plan168refs, zero diagnostics.
• Local npm run verify:direct failed before test execution at strict SBOM because existing node_modules lacks transitive development dependencies; retained log SHA256e635423cf89a22118e6e95ed412d52e21a8756107ce2228d15c1a4a845041d64. No bypass or passing release receipt claimed. Clean required Actions verification remains pending, including fresh complete CLI and executing Reviewer suites before component scenes.
• Joined actual-six-owner diagnostic install succeeded then strict custody denied mutable CLI marker. Both diagnostic installed trees removed, actual archives/failed observations retained on disk. No managed acceptance or passing six-owner execution claim.

50c3b12 retains final checked-Reviewer-pin RED; ee555a7 consumes checked Reviewer #112. Replacement run 38030387337 is in progress. Prior run 38027013056 was deliberately canceled after Agent demonstrated the shared nested artifact defect. No completed full-suite, fresh prerequisite or scene receipt is claimed for that canceled run. Log SHA256 aa9d7671469300c55d8bad23eb5d9952a919facf3c64b5526afd1723a125449a.

Current scene action pin is 77f8f0003ccdc477cf90801fd7b0a23b1a1bb82f. Reviewer #112 required Actions 38029391897 passed 199 initial and fresh assertions before 113 component steps and ordinary exact tested-tree staging read-back. Final pin focused cases passed after retained RED (9/9); this run must provide fresh consumer and executing Reviewer prerequisites.

Required verification 38030387337 passed initial CLI 369 assertions, then fresh CLI 369 and executing Reviewer 199 assertions before all 168 component steps. No failures/skips/todos or binding diagnostics. Exact tested merge abfbecf91b7589d9bde7f2a169b889d30a6a8b76, tree 3c03d77cd510db7195abed48b9dbab28cfe82548. Scene artifact 11662113561 ZIP SHA256 31a61078b949b394324d25bc387a701e982415d44bd99a6bc90ac927c9427d2f; report SHA256 5c2ddaba41bd0fe39a22e9cb6b826f47aec22f40ece01284c0ee8867b1bba334. Required submission-contract checks failed because the earlier abbreviated authority/checklist did not match the existing template; this metadata repair supplies all existing required fields and exact checklist text, and must itself pass before merge.

Risk and rollback

Bounded declarative package exclusion. Development marker files remain generated and observed by the existing watcher. All executable files remain covered by the original custody check; any executable mutation must continue to fail. Ordinary revert preserves test-first history.

Completion summary

Local complete suites, focused native regression and required verification Actions pass. Submission-contract validate 38031420066 passed. Ordinary merge and exact tested-tree staging read-back completed at d443ddce30edd92e98a1313280f673d5bd31b691; primary staging is clean and main is preserved. Only this delivery's remote branch was deleted using an exact lease. This is a prerequisite repair; strict SDK readiness and managed acceptance remain blocked by the outstanding plan requirements.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.