[arjitj2]

Closes #177

What changed

Orchestrate now reads live PR state, checks and the current-head verdict before a report. Cancellation requires concrete failure evidence. Recovery follows the saved provider policy.

Adapts Cursor 0.15.36 as compatible version 1.17.8. The public bookkeeping CLI, stores, parent Git ownership and model settings remain supported. Cursor's incompatible CLI deletion is excluded.

Verification

• Local Bun tests, strict typecheck, static invariants and plugin validation pass.
• The exact 1.17.8 package was installed in a private Codex profile and loaded in Claude with --plugin-dir.
• Both parents exercised the changed checkpoint and liveness behavior.
• Evidence names the candidate, actions, observed results and limits.
• Maintenance-only package equality is not applicable. This changes skill instructions.

Local checks passed 1,008 Bun tests and 367 Statechart tests with actual pinned TLC, plus maintenance, hook and documentation checks. Exact-head Linux CI40621154778 passed 1,003 Bun tests with five platform skips and 367 Statechart tests.

Both hosts read actual PR178, rejected an obsolete ledger verdict and refreshed the stored head and frontier. They kept a quiet process active, cancelled a controlled failing process and recorded its postmortem. The actual policy CLI rejected a supplied permission continuation. A fresh final installer transaction verified all 650 files against the native-tested package.

These supervised tests use fixed helpers and controlled processes. They do not prove real provider-agent cancellation, full-program autonomy or automatic selection. Claude emitted a native Skill event. Codex loading evidence is indirect. Tests used real user shell permissions without an OS-confinement claim.

Documentation impact

UPSTREAM.md, the ledger, attribution and CHANGELOG.md record the adaptation. The Orchestrate verification recipe covers the changed phase. README is unchanged.

Related #1, #141, #175 and #87.

[arjitj2]

Independent Shipping verification returned PASS+NOTES for head ba48cd2bd0f497a03988d41900fe7259f5b4eb60 against base b654aebbacdf4f6ba24ee19e468588ee3334dc46. Package 4e916716fb3cbbcec3c99ec5a45b1ecaf33f598b is version 1.17.8.

A fresh native verifier reviewed the complete diff and source adaptations. It checked all 650 package and installation hashes, reproduced CLI persistence and peek/drain, and rejected a stale verdict against PR179's live head. It audited both hosts' actual observations and preserved all 85 earlier source decisions. No blocking finding remains.

The tests use fixed helpers and controlled processes. They do not prove real provider-agent cancellation, full-program autonomy, automatic selection or OS confinement. Codex loading evidence is indirect. The permission case is supplied policy state.

Exact-head CI40621154778 remains a separate landing gate. It was in progress at the verifier's final read. No merge or queue action was taken. The private report SHA256 is 4b7da34a9de5c85f1db307a81f157d8519bf171b181e436077b9ef416d7b351a.

[arjitj2]

Validation-method clarification from the final trail audit:

• The Codex native case used per-test danger-full-access, -a never and --ignore-rules. Claude used per-test sandbox.enabled:false, acceptEdits and fixed Python commands. These overrides did not change personal host settings. The test scope was instructional, without an OS-confinement guarantee.
• Codex used a fresh private CLI installation and existing authentication through a temporary link. The link was removed. Claude loaded the exact candidate with --plugin-dir; its global installation was not upgraded.
• Shipping used a fresh native verifier under the workflow's unspecified native default. It did not author the patch. The parent made two wording corrections and shares that verifier's model family, so family independence from every author is partial.
• I used a closing reference for issue177 before publication and rollout were complete. That was my error. I reopened the issue, completed both conditions, then closed it with evidence. Future issues with those conditions will use Related references until delivery is complete.

The tested checkpoint, tag and package are unchanged. The audit found no unresolved blocking source or delivery issue. The tests remain supervised and bounded.