Retain the owning verifier loader and fence in installed CLI assets

[adrianwebb]

Outcome

The production-installed CLI verifier could not load because it resolved an undeclared local tsx. Its subprocesses now retain the original owning verifier's loader and import fence, while excluding child test flags. CLI runtime dependencies remain unchanged.

Work authority

• Work item / Issue: Current cli backlog: retained requirements after issue consolidation #274 ; current contract/evidence Strict acceptance bindings continuation: approved final integration and required context sdk#411

• Proposal / decision: Approved strict capacity-provider/agent-execution plan, Wave1 package closure and Wave3 criterion2.

• Assignment / checkpoint: Existing selected workday diagnostic asset, package contents and native coverage.

• Actor: Codex under Adrian's implementation authorization.

• Human authority: Implement and follow the retained plan; regression-first coverage, exact candidates and cleanup.

• Agent / capacity provider: Current Codex session; no managed campaign.

• Exact base ref: d99c4fd53dea79772eb126aabb4aeef32fa6ee0a

• Exact head ref: f538a7559ae0756e80c66ec222e78d31f0ce5af1

• Agent-authored under human authority

Plan

Reuse the original Node verifier execution context. Preserve loader/fence order and deny missing/malformed/unrelated loaders. Ship only the necessary preload helper. Strengthen the existing production archive integration with an actual production Reviewer host and missing-helper denial before exact retry. Retain all original public binary, source, symlink, readiness and artifact checks.

Changes and commits

• e712120: unchanged old loader resolution extracted, production failure retained, and three failing unit regressions committed before repair.

• ef9fb4f: an intermediate staging error committed only the unit-file move; retained as ordinary history.

• 5f83eb5: completes inherited preloads/fence and the minimum shipped helper; places unit cases in the required command-boundary directory; registers three exact component cases.

• Existing native production integration uses the immutable Reviewer123 archive, SHA256 063ef40142eaf603a37c14082aad7a34d326aefeae40026cf684af8bdc4bc274, native run38348410425/artifactreviewer-c04f1b295780d4758cbeee16a456d25272ec4b50. It installs production dependencies/scripts disabled, refuses a hoisted CLI loader, denies a missing archived helper, restores the exact bytes and executes the original selected native diagnostic case through the installed Reviewer runner.

• e99998b: native38377608631 failed the complete suite because the original production case reached30,003ms:371passed/1cancelled/0failed/skipped/todo. Retain that failure and the30-second deadline. Reuse the workflow's original exact SDK archive/SHA instead of repacking its thousands of installed files; pack only owning Identity/CLI once and perform one isolated nested production installation of all held archives. Preserve every original assertion, missing-helper denial, exact retry and cleanup. SDK pin is unchanged; explicit test inputs are documented.

• f538a75: preserve replacement native38380449973's second30-second timeout (371passed/1cancelled/0failed/skipped/todo). Release verification uses an empty NPM cache; warm-cache focused results understated its cost. Overlap independent native SDK/owner archive observations and the unchanged installed diagnostic/public-binary proofs. All assertions remain; wait for both proof outcomes before cleanup even if either fails. Retain helper denial/recovery, exact source/asset checks and readiness exclusion. No test selection/concurrency/suite allowance/deadline changed.

Verification

Focused genuine RED:3unit failures; installed loader collection independently failed at the CLI asset. After repair:5unit/native diagnostics assertions and16package/unit contract assertions passed with zero failures/skips/todos. Strict whole-project TypeScript and file architecture passed. The required unit-root assertion exposed an incorrect initial test location; the test was moved intact, preserving the assertion. The unnecessary Reviewer metadata command was removed before the final16passing run; no deadline or allowance increased. Staging/script-name mistakes remain retained.

After the first native timeout, the artifact-reuse/single-install path passed17focused assertions in a warm cache (24,633ms production case), but second native38380449973 still timed out; retained. The final revision passed17focused assertions with zero fail/cancel/skip/todo both normally and under the original empty-cache/two-file-concurrency conditions. Observed cold-cache production duration17,886ms, below the unchanged30,000ms limit. Whole-project strict TypeScript and file architecture passed. Native 38381452116, job115242623721, passed372fresh CLI and200declared executing Reviewer assertions before171component assertions, zero failed/skipped/todo. Submission38381449578 passed. Tested mergecdd8ad00fcc8b02db0c31bc5637d0d0412ab843e/tree5c3b1794a2c98df8906f55b2d0b6208bffbaa762. Independent official artifact audit matched34source digests and all five selected shipped assets. Archive SHA256f1800c556e023bb36ad17635e9cbbf8496597c277465db105983cd7383d0e637; strict report SHA256a53016433e9ca1a079eed76d561ec3e9cfe60b4dee6337135e43d43451c8b0fb. All original failed runs remain retained. No local focused result replaces native invocation prerequisites. Overall checklist remains47COMPLETE/130OPEN; criterion2 remains pending coordinated Reviewer124, actual six-owner installed custody/import closure and final staging read-back.

Risk and rollback

The native fixture now requires an explicit immutable production Reviewer artifact/digest; the existing workflow obtains it and documents the inputs. Missing inputs fail closed. No CLI product/runtime dependency, SDK product source, governed proposal, deadline, grant or runtime selection changes. Revert ordinarily while preserving the RED and failed observations if needed.

Completion summary

Bounded repair and real production archive integration passed fresh native verification and independent official artifact audit. Temporary fixtures close/remove in their owning finally blocks; archives and failures are retained. No managed SDK run/readiness/full-spec pass, release, tag or deployment.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.