[adrianwebb]

Outcome

The authenticated assignment package proxy can restore exact GitHub Git and release-tarball dependencies used by real projects. Real API Tester assignment_CjdPV1YxwZNa9S1VA_s8hyI8oTyQqJmG failed before model execution during dependency restoration. Its API lockfile includes an SDK Git commit and a Deployment GitHub release archive; npm-only destination policy cannot restore either.

Work authority

• Work item / Issue: Current deployment backlog: retained requirements after issue consolidation #834; current bounded plan and full evidence Complete accounting transition observations for strict Agent acceptance api#553; Complete communication closeout inside the original assignment window agent#496
• Proposal / decision: accepted API Decision2839f4c7-16bb-4aa4-b6c2-20280108537c; runtime recovery supporting its actual simulation
• Assignment / checkpoint: failed real Tester in workday-7385096d-f4e2-44e7-be92-ba9713ad7634; original failure retained and scoped workday cancelled/ended
• Actor: Codex integrator as adrianwebb
• Human authority: continuing explicit approval for implementation, verification, merge and adoption
• Agent / capacity provider: api/tester on provider_-rcKRK8gG2NGnOU3yGu_CV3Wz7ACppTP; integrator-authored boundary repair
• Exact base ref: staging540cf263f5e23eeaf7c10d433da13a765603242e
• Exact head ref: codex/package-artifact-proxy553 58a9114

Contributor mode:

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Retain exact source authority and historical failures. Reproduce denied dependency hosts, repair the original proxy boundary, prove real authenticated immutable-artifact read-back and authorization negatives, bind existing native scene, then run fresh complete owner suites/scenes before merge or adoption.

Changes and commits

• 88edfa5 RED: GitHub package-artifact destination regression fails on base;18 prior checks pass.
• 58a9114: exact HTTPS package-host allowlist adds github.com, codeload.github.com, release-assets.githubusercontent.com and objects.githubusercontent.com. Subscription-host policy, port443 restriction, assignment-specific guest authentication, package-registry permission, expiry, direct-egress firewall and no upstream credentials remain in force.
• Extract the existing CONNECT server constructor without a second implementation so the native test uses that exact production server with the actual KataSandboxRuntime preparation/authentication and persisted guest token.
• Native test downloads the published API rc113 manifest and asserts its sealed SHA256aa9713961069c0791d5f666c6b1bb3e033d15bcbe45802c6a16f84b7be1b49c5 through both GitHub and redirected release-asset transport. It denies unknown/foreign guest, host token, missing package authority, expired authority, unsupported API host and port444. Owned fixture persistence is removed and checked absent; no VM/model is launched or managed acceptance claimed.
• Bind new unit/native cases in the existing component scene. Reserve unique Deployment0.1.0-rc.323; rc322 tag/candidate remains immutable. Paired Agent500 supplies process-scoped Git SSH→HTTPS transport without source/lockfile edits.

Verification

20 focused checks/2 files pass in a disposable root container with the real compiled owning runtime, exact production proxy, live public rc113 artifact, native curl redirects/authentication and all denial cases. Strict build passes. Earlier local fixture configuration paths, unprivileged chown, source-vs-generated instrumentation and missing curl attempts are retained as setup failures, not RED or acceptance proof. Local sudo required interactive authentication; no escalation or host modification was attempted. Complete Actions owner prerequisites, native suites and coded scenes remain pending and required.

Risk and rollback

Package authority now permits HTTPS tunnels to these exact public package-distribution hosts. CONNECT is a host boundary; Git commit and package integrity checks own artifact identity. It is not a path or HTTP-method authorization layer. There are no guest upstream credentials or direct-public-egress permissions. Unsupported hosts/subdomains remain denied. Revert through protected PR/checks and adopt a verified prior runtime only after affected assignments drain; preserve original retained work, failed results, usage and deadlines.

Completion summary

The owning package transport has real unit and focused integration proof. Full exact-candidate Actions/scenes and actual API Tester→Engineer→Reviewer continuation remain unproven; no readiness-counter product is attributed to agents yet.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.