[adrianwebb]

Outcome

Prove that SDK golden acceptance reads execute through the installed public CLI with supported library, proposal and team selectors. Extend the existing packaged native library case; preserve its original negative cases and 30-second deadline.

Work authority

• Work item / Issue: Continue strict acceptance bindings: current checklist and native reconciliation delivery sdk#401 and owning CLI274
• Proposal / decision: Explicit user-authorized strict acceptance implementation plan
• Assignment / checkpoint: SDK/CLI installed execution and public-boundary proof; SDK405 dependency
• Actor: Codex through provider-authenticated adrianwebb
• Human authority: adrianwebb, explicit implementation authorization
• Agent / capacity provider: Codex in authorized local workspace
• Exact base ref: staging 6a1f8fc3892c069c1efab72c05baa0f0dfa48964
• Exact head ref: codex/cli-sdk-reader-401 1684a31bfa43b9fa2edddd11202d8894a7f2aa80

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reuse cli.golden.execution-library-lookup-native-1 in its existing component scene. Execute the SDK's actual shipped helper against the original generated CLI binary and native HTTP transport. No copied command catalog, new runner, product configuration, deployment environment or workspace source fallback.

Changes and commits

• c292a32 commits the native installed-helper regression before dependency repair: 5 tests,4passed/1failed at missing actual installed SDK export; zero skipped/todo.

• d1080de consumes SDK405's audited archive from required Verify38164849288, tested merge ac5b9abd8a7e615d9ef5886e342859dd2b183d5e, SHA256 ff7a7af40bfce7398f137eabcbf9212f2e8d8f3ddb18c9f152df8b76fdb8c9e3. Production scripts remain disabled; exact checksum checked before installation. Use existing Reviewer e60ad2581e7ff041f058af04bd810796fea748f9 to retain corrected complete-suite custody.

• Existing library lookup/pagination/active-team checks and seven original denials remain. Add exact-ref library read, project proposal, workday, assignments and graph; each uses actual SDK helper and CLI process, original HTTP bytes,403/503/socket interruption/malformed response, retained failed history and exact retry.

• Preserve source/package/installed SDK asset/input bytes, absence of write authority, owned process/server/temp cleanup, original 30-second timeout. The read-only TreeDX file POST is the sole allowed POST with exact original body.

• 1684a31 retains all five positive reads and20 added denials but batches independent probes concurrently within the original30000ms deadline. Tracks every owned child through exit/cleanup and explicitly requires all27original+added failed observations. Update the original thin-package assertion to the held Reviewer pin; no weaker regex, case or assertion removal.

Verification

Node24.12.0:

NODE_OPTIONS=--import=/home/adrian/Projects/platform/packages/cli/tests/support/os-custody.ts node --import tsx --test tests/unit/command-boundary/selectors/project.test.ts:5/5passed,0failed/cancelled/skipped/todo; native case21470.503948ms within original30000ms. The systemd-creds preload is the existing explicitly synthetic OS custody fixture; this is real CLI/SDK/process/HTTP integration, not native host encryption or API governance proof. Supplied session and server responses are controlled fixtures.

Original npm run build:dist, strict node node_modules/typescript/bin/tsc --noEmit, npm run check:file-lengths and git diff --check pass. Earlier local invocation omitted inherited OS fixture preload and failed os_credential_unavailable; retained without relabeling.

SDK dependency: fresh584/584 SDK+200/200 executing Reviewer before249/249 component steps,0failed/skipped/todo. All249 assertion receipts and38 source digests independently match tested merge; actual archive selected assets match source. Report SHA256 dbaa3823d5e382ef5255787bd4b235044620f8caef923ad302174b94087e3259.

Initial required Verify38166270003 failed before any scene:367passed/1failed/1cancelled,0skipped/todo. I missed the exact Reviewer pin assertion and sequential added probes hit30000ms on CI. Original raw failed log retained, not a passing prerequisite. Candidate1684 batches only independent probes and preserves all27denials; focused original native+thin-package files14/14passed,0failed/cancelled/skipped/todo, native9149.720532ms. Strict compiler and original file/architecture checks pass. Replacement required CI must freshly repeat complete CLI/Reviewer prerequisites before component scenes; no reused passing receipt, longer deadline or omitted cases. Audit and ordinary staging merge/read-back pending. No live campaign.

Risk and rollback

Exact archive is held immutably; no registry or moving-source substitution. Ordinary revert from freshly fetched protected staging restores prior native case/workflow while retaining failed observations. No credential exposure, runtime changes or new worktrees.

Completion summary

Focused native integration passes. Required Actions and delivery custody pending. No acceptance binding checked from this prerequisite repair and no SDK readiness/managed acceptance claim.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Verified candidate read-back

Replacement required Verify38166667223 passed on tested merge4f241b2e7b9deb744c49b9bd4a0405c394eba71e: fresh369/369 CLI and200/200 executing Reviewer e60ad2581e7ff041f058af04bd810796fea748f9 before168/168 component steps, zero failed/skipped/todo/diagnostics. Independent audit reconciles168 actual assertion receipts and33 native Git source digests. Actual archive SHA256f7197cf8ffdf4f9cf6df158de234d26c92126f51ed71d17a155cea664a425dbe; report87ebc8d795b0f357c7383eb83368e4b5b117cacdb9932dc2a66a693d0cfb1383. Scene artifact11712903053 ZIP8229326b11869ab363c97191f3c967c77ffeff402ea513b77b1f29f76cca5265; package11712883073 ZIP45448b1d0f4690766bc7995ecce9a033b02d23fb5c3daa2cf9efaed8f0a4bb48. Shipped workday acceptance, OS custody helper and registry/scene definitions match native Git. The component-only library integration remains a source prerequisite/native component assertion; it is not claimed as a shipped managed verifier. Existing selected CLI managed assets remain shipped. Ordinary merge and final six-owner installed composition read-back remain pending; no binding credit or managed acceptance claim.