Verify complete frozen SDK drafts and unchanged fixed work

[adrianwebb]

Outcome

The SDK acceptance verifier rejects an incomplete frozen draft before accepting the later ready proposal. It checks the six fixed work items, source evidence, objective references and absent estimate fields, then compares the ready proposal's fixed objective, evidence and work-item contents with the original submitted input.

Work authority

• Work item / Issue: Continue SDK #376 strict acceptance bindings and installed execution #393 ; original Current sdk backlog: retained requirements after issue consolidation #376
• Proposal / decision: User-authorized strict capacity-provider and agent-execution acceptance implementation plan, SDK acceptance lane.
• Assignment / checkpoint: Criterion70 fixed draft submission; remains unchecked until selected binding, full CI and delivery are verified.
• Actor: Codex through provider-authenticated adrianwebb
• Human authority: adrianwebb, explicit implementation authorization
• Agent / capacity provider: Codex in the authorized local workspace
• Exact base ref: staging b0e7b02a351bc545f3884a7cda7dbb1d79a8bf14
• Exact head ref: codex/sdk-fixed-draft-393 2824f7914c5c8ddf108ee02efdcafff2c685c34e

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Reproduce the shallow draft check, extend the original native SDK/isolated verifier integration, reuse the existing fixed-work and source-evidence assertions for draft and ready observations, then verify actual archives and ordinary staging delivery. The integrator will add criterion70 only after semantic review of its Agent preparation and SDK product wiring.

Changes and commits

• cfbcd17f055d9b8fedd35e697a91beb4b6cad3d9: unit RED3tests/2passed/1failed,0pending.
• 0bdbf6f684f239e06f4674d4324c1f848f9c567d: native RED4tests/2passed/2failed,0pending. The actual retained input and native SDK reads reached the original isolated verifier and accepted incomplete drafts.
• 2824f7914c5c8ddf108ee02efdcafff2c685c34e: one shared existing fixed-work/source assertion path; estimate-free draft checks and exact unchanged fixed-work comparison. One newly necessary unit verifier selects the existing draft-reader test; the existing native verifier and managed product case consume the strengthened checks.
• Tree d8eaea623363550c04085fd0bcd91887219d3212. Acceptance/tests/registries only; the SDK product defect remains reserved for the genuine managed Tester/Engineer chain.

Verification

Pinned Node24.12.0 focused command: node node_modules/vitest/vitest.mjs run --config ./vitest.contracts.config.ts tests/unit/operator-contracts/acceptance/workday-start.test.ts tests/unit/operator-contracts/acceptance/golden-proposal-native.test.ts tests/unit/operator-contracts/golden-product.test.ts --reporter=json --outputFile=<retained-json>:18/18passed,0failed/pending.

The existing native HTTP/public SDK/isolated verifier integration retains all59previous denied observations and adds33rejected frozen-input cases,291original proposal requests in total, plus separately retained reference reads and an unchanged retry. Unit coverage exercises120incomplete/reused draft observations and fixed title/summary/evidence/work-item drift. Original five-second and15second watchdogs remain; listeners, subprocess and private input directory close in finally.

node node_modules/typescript/bin/tsc --noEmit and npm run check:file-lengths pass with strict checking and the original500line limit. The first typecheck exposed TS7022 on the existing reference-read local inference; adding an explicit Row[] annotation repaired it without weakening types. The failed diagnostic is retained.

Required Verify38131274477 passed on exact tested merge 464b5a14e261c3ca73a53102473ade01ffb93e97, source tree d8eaea623363550c04085fd0bcd91887219d3212. Fresh complete577SDK+200executingReviewer assertions passed before all242component steps;0failed/skipped/todo. Independent artifact audit verified every242assertion receipt,37native source-file digests and shipped helper/registry/scene bytes. Report SHA256a938f8e6324d1cbaf10edcd339d2b48defbd2f67a16859a4c3c04ca0a43826a5; CIarchive SHA256d1b75a9a0ec0fdeba2acd34ad13d1694ba54bf30dacfdc18f7847047676c759a.

Actual six-owner archive install used production dependencies with scripts disabled on held Agent2e23cc9/SDK2824f79 and unchanged API/CLI/Deployment/Reviewer candidates. Installation and installed asset discovery passed. Original strict installed selection retained204selected/260deferred/160uncovered and matched source plan SHA256c5be2862579d79de9f2b237f12642e89393cef9e598483e119cb2d907b985a3b; expected nonzero result remains fail-closed on160uncovered criteria. Selected asset bytes matched held Git, all archives and source heads remained unchanged, and owned installed dependencies were removed.

Dependent binding is treeseed-ai/agent#408 at2e23cc93510ee319ac42a471211e7ee879c62946, still undergoing its own fresh CI. Ordinary staging read-back remains pending. Controlled upstream values prove the owning SDK transport/verifier behavior; they do not establish actual governed campaign authority or an API producer transaction.

Risk and rollback

Frozen draft omissions and retained estimates now fail closed. Ready-proposal estimate values remain genuine outputs; only the non-estimate fixed contents must match the original. Revert the ordinary merge to restore the former acceptance checks while preserving both RED commits and original failed observations.

Completion summary

Criterion70 remains unchecked. Current authoritative checklist is15checked/162unchecked; delivered strict selection is43mapped/161uncovered/204selected/260deferred. This candidate does not establish SDK launch readiness or a managed passing receipt.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.