[roodboi]

Native preflight hid the offending service and field behind generic graph refusals, and counted missing shared-source consent as a configuration blocker. This adds fixed, value-free reasons and remedies from the existing runtime admission checks.

Before	After
One graph subset or route requirements sentence	Separate service/field findings for each unmet requirement
“The reviewed graph contains blocking diagnostics”	The underlying field diagnostics, without the duplicate generic finding
Opaque dependency-cache or foreign-platform refusal	Named services and offending cache labels or platform field
Consent mixed into blockers	Report v2 separates consent_needed; text and JSON keep all discovered blockers regardless of consent

Admission predicates and first-error precedence are preserved. No native feature is enabled. Malformed detail batches fall back to a closed refusal; repeated findings are deduplicated. All structured runtime failures have a 1 MiB bound, including authored up planning; startup errors rise from 256 KiB to 1 MiB while startup-log schema bounds and the explicit log-decoding gate remain unchanged. Authored startup preserves validated service/field findings, and per-service resource-budget refusals identify the service. Structurally invalid input may still stop review early.

Tracks HACK-2192, diagnostics-only first unit. Release intent: fix. JSON consumers must accept report version 2 and use ready for the verdict.

The frozen next integration preserves both configuration-refusal and interactive-session diagnostics, plus the extracted file-only preflight collector. hack upgrade check now counts missing consent separately and requires both zero blockers and zero consent items before describing a project as native-ready. Its finding remains informational, so Compose is unaffected.

Validation includes the real CLI consent projection, focused refusal/transport/startup tests, default and all-feature Rust gates, native guest compilation, compiled CLI/compiler acceptance, typecheck, lint, privacy and docs checks. Exact-head outcomes and hosted/bot status are recorded in the integration comment. Linux results do not qualify deferred macOS fixtures; no additional Mac jobs are requested by this integration.

This PR follows #794. Final Ready waits for the lead's #794 merge confirmation, any required normal merge and resolution review, and the resulting head's checks. The next.17 freeze and lead merge authority remain in force.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hack-docs	Ready	Preview	Nov 15, 2026 2:47am UTC

[linear-code]

HACK-2192

[roodboi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-15T02:51:28.844799Z	177cc9f	Manual request
🔒 Security Review	✅ Completed 2026-11-15T02:54:40.502186Z	177cc9f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 7008500969

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7008500969

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Pushed test-only follow-up 056b3334d30e8554e69550b281d4b85b809873b3 for the Candidate core failure: malformed staging input can make the child exit before the test writes stdin. The helper now reaps that child and accepts only BrokenPipe together with failed status and empty output. A deterministic regression forces that ordering; existing valid-input and malformed-input assertions remain.

Also gave the retained-file invalid-deadline test the same 30-second setup budget as adjacent cases. It passed locally in 6.6 seconds with all 11 assertions unchanged; the prior 5-second harness limit was too short. Product deadlines are unchanged.

Persistent review CLEAN at this head. Focused environment tests, changed-test lint, all-feature Clippy and privacy passed locally. Full TS and new-head hosted CI remain pending; no Ready claim.

[roodboi]

@codex review

Please review current head 056b3334d30e8554e69550b281d4b85b809873b3; the previous receipt covers 70085009. The new commit changes only the staging test helper and a retained-file test's setup timeout.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 056b3334d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 056b3334d3

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Pushed the lead's required fixes at 294019d88fb138f8a6edadf011dbf159437d50ad:

• Structured runtime errors share a 1 MiB envelope, including authored graph native plan/frontend-plan and startup, so batches over 8 KiB retain their code and findings. Startup's envelope rises from 256 KiB to 1 MiB; log decoding remains explicit and individual log bounds are unchanged. Raw stderr is never surfaced.
• Authored startup preserves and revalidates those findings before rendering service/field guidance. A malformed batch is discarded; admission and retry behavior are unchanged.
• Per-service graph_budget now carries the first offending service. The guide distinguishes service-relative finding fields from absolute plan-diagnostic paths.

Persistent reviewer delta: CLEAN at this exact SHA. Local evidence: 45 TS tests pass, 21 Mac cases skipped; root typecheck, check/privacy, changed-file lint and docs prepare/check pass; focused Rust precedence/service regression and all-feature runtime build pass. A real Rust project plan refusal from a synthetic 12-service project was 13,906 bytes: the TS client preserved the code, all 48 findings and all 12 names, with sentinel values omitted. This is Compose compiler evidence; the authored-start transport fixture uses a synthetic batch and still needs macOS execution. ci:mac requests that hosted gate.

Full Rust, full TS and hosted current-head verification remain pending. Deferred coverage/location/deduplication items are tracked on HACK-2192, comment b722d2f1-5e12-450b-b1b9-26dfddb4daee. Report v2 moves shared_source_grant_required from blockers to consent_needed; consumers must use ready and the exit status for the verdict.

Integration with next still waits for the lead's explicit batch-merge confirmation. No Ready or Mac-census acceptance claim.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 294019d88f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 294019d88f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Integrated the explicitly confirmed next batch 292d31279d541e88d8a74449bd8606a1585c7725 by normal merge at bf20f0a6d40706b1f93b7b1906a5d8388f8a3992. Same persistent reviewer CLEAN on this exact head (static integration review only). 77 passing focused TypeScript tests, 21 macOS-only skips; current CLI typecheck passes. Full local gates and hosted checks remain pending; no Ready or real-Mac claim.

The shared 1 MiB structured failure budget, authored service/field rendering, first-error service on graph_budget, and report v2 are preserved. The startup error budget also rises from 256 KiB to 1 MiB; explicit startup-log validation is unchanged. Lead-owned real-project census remains separate.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: bf20f0a6d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: bf20f0a6d4

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Merged confirmed next b1e123bb7f73b6dcea468498f0f2b3d46e195d71 normally at 85859ed, including #796/HACK-2206. Same persistent reviewer round 6: CLEAN, static automatic-merge review. No conflicts or changes to the previously reviewed unit behavior.

Current-head Linux checks: 52 incoming regression tests pass, 430 assertions, plus typecheck and check/privacy. Earlier Rust/model results apply only to unchanged inputs; full TypeScript and exact-head hosted qualification remain pending.

Correction to the earlier triage: the local-network-hint.test.ts “open --json keeps the hint out of the JSON payload” failure was on hosted macOS shards 1–3, not Linux. This head carries the fix. Standard PR Linux passes do not demonstrate execution of deferred macOS-sensitive files. The remaining Docker signal flake and Darwin descriptor-inheritance issue remain separately tracked; any failure still needs its logs classified.

No Ready or real-Mac claim. Lead owns acceptance and merge.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 85859ed266

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 85859ed266

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

The older frozen full TypeScript run at 056b3334 finished: 11,014 passed, 400 skipped, one failed across 759 files. The sole failure is the pre-#796 open --json assertion: it expected only url but received the documented DNS notice fields. This is local Linux evidence; it does not change the lead's hosted macOS-shard classification. Current head already carries #796, whose focused regressions pass.

A new frozen full-suite run has started at 85859ed266f7fbd1c5b469d023ca1ad069beca17, with the pinned Bun and prepared compiler. No current-head full-suite pass or Ready claim yet.

[roodboi]

Merged current next bb6a7d17716140a738a97fc2863a7a678caf17eb normally, including #789 and #788. Current head: f1cd46a. Same persistent reviewer round 7: CLEAN, faithful automatic merge, no conflict resolution edits. All previously required unit fixes are preserved.

Current-head local evidence: 87 focused lifecycle/host-process/readiness/hint tests pass (538 assertions), docs prepare/check pass. Typecheck/lint are finishing. Rust and model inputs are unchanged; prior results remain identified by their tested revisions. Fresh hosted and bot qualification is pending.

The broad ci:mac opt-in was removed before this push under the lead's runner-backlog instruction. Standard PR checks do not prove the macOS-only authored-up fixture; that evidence remains explicitly deferred/separate. The existing full local TS run stays frozen at 85859ed2 and is not relabeled as a run of this head. Final Ready still waits for the lead's explicit #794 merge confirmation, then resolution/review of the native-preflight integration.

No Ready claim at this head and no PR merge performed.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f1cd46a43e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: f1cd46a43e

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

The frozen local full TypeScript run passed at 85859ed: 11,073 passed, 404 skipped, 0 failed, 105,115 assertions across 761 files (pinned Bun 1.4.4, umask 022, prepared compiler; CLI test task executed, DB test task cached). The checkout remained clean and unchanged throughout the run.

This is prior-head Linux evidence, not a run of current f1cd46a43e603a5afab0de9bc3d8407faa88a9ae, and it does not execute macOS-only authored startup cases. The subsequent #789/#788 merge has its separate 87-test/typecheck/lint/docs evidence and still requires current-head hosted qualification. Final Ready remains gated on the lead's explicit #794 merge confirmation and reviewed resolution.

[roodboi]

Reviewer handoff update: the lead reports the Hack Dance Claude account unavailable. I attempted the requested replacement, Muse muse-wonder-full-1.0, with prior reports and this PR's context. The orchestrator refused the launch: provider_unavailable — Muse Code CLI is installed but failed to run. No alternate provider or CLI fallback was used.

second-family review: pending, lead

The previous static CLEAN at f1cd46a43e603a5afab0de9bc3d8407faa88a9ae remains recorded; the line above covers the requested replacement and next integration review. Final Ready still waits for explicit lead confirmation that #794 is in next, then the normal merge and resolution. Current next also conflicts with this branch in error.rs after #774's merge; the eventual resolution must preserve both configuration-refusal and interactive-session fields/methods. No worktree changes or new push were made for this reviewer update.

[roodboi]

Prepared integration: 6cc53d691d9db1f97422ce557d75a0674de367c0. Final Ready remains held for the lead's #794 merge confirmation; the next.17 freeze is unchanged.

Normally merged frozen next 8e7242db9466fe14f52b9bfb4513c02fa9d68bf4 in 256e6435. The three conflict resolutions preserve both configuration-refusal and interactive-session fields, the extracted preflight collector with the consent-aware exit rule, and every test from both sides. The follow-up fixes the incoming upgrade-check consumer: zero blockers alone no longer means native-ready when consent is missing. Its finding stays informational; Compose is unaffected.

The same persistent second-family reviewer returned CLEAN at this exact head, including the resolutions and integration fix.

Local checks at this source:

• Default Rust: 1,254 passed, 40 skipped; all-feature Rust: 1,557 passed, 50 skipped. Pinned nextest, zero retries; doctests contain zero tests.
• Default/all-feature Clippy and Rust formatting passed.
• Native guest build and static Linux ARM64 artifact verification passed.
• Focused TypeScript: 139 passed, 21 skipped across 8 files, 1,366 assertions.
• Root typecheck/check, privacy, changed-file lint, CLI/compiler builds, compiled native-plan CLI acceptance, and docs checks passed. DB typecheck was cached; CLI typecheck executed.

Two local setup failures were corrected without changing source or assertions: the guest invocation initially lacked the configured C-compiler shim; four project-share tests initially rejected my group-writable temporary ancestor. With the shim and private temporary-directory permissions, the guest gate and full Rust suites passed.

Hosted CI and bot review for this new head are pending. Linux checks do not qualify skipped Mac fixtures; no additional macOS dispatch was requested. After #794 lands, this PR still needs the resulting normal integration, resolution review and final-head checks before Ready for lead:. Later HACK-2192 follow-ups remain outside this PR.

[roodboi]

@codex review

Please review 6cc53d691d9db1f97422ce557d75a0674de367c0: normal integration of frozen next, the three documented conflict resolutions, and consent-aware upgrade-check readiness. The previous receipt covers f1cd46a43e. Persistent second-family review and local gates passed; final Ready remains held for #794.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 6cc53d691d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6cc53d691d

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Ready for lead: 6cc53d6

Takeover note: this unit moved to a new owner session after the previous one ran out of capacity. Nothing was pushed in this session; the head above is the previous owner's integration of frozen next 8e7242d.

Merge with next: already done. The head contains next 8e7242d (merge 256e643). No new merge was needed.

Second merge after #794: yes, it will be needed. A scratch merge of #794's head 3cda82b into this head conflicts in 4 files, one hunk each:

• src/backends/native-preflight.ts: ready becomes no blockers, no consent, review completed and runtime_setup.state === "ready". The report keeps both runtime_setup and consent_needed. Exit status still follows blockers plus consent.
• src/lib/upgrade-check-project.ts: the info summary becomes "Native configuration has N blocker(s) and M consent item(s); runtime setup and runtime review were not checked. Compose is unaffected."
• tests/native-preflight-cli.test.ts: keep both imports.
• docs/guides/native-candidate.md: the ready and exit wording combines both rules.

The merge also needs two non-conflicting test fixes:

• tests/upgrade-check.test.ts: the feat(native): guide first-use runtime setup #794 probe stub gains consentNeeded: 0, and the expected summary string is updated.
• tests/native-preflight-cli.test.ts: the "consent never hides findings" no-effects assertion now allows feat(native): guide first-use runtime setup #794's read-only runtime setup inspect call.

The scratch result typechecks, and 327 focused tests pass: native-preflight-cli, upgrade-check, native-runtime-client, native-preflight* and doctor*. 8 doctor adopted-project tests fail, but they fail the same way on plain next 8e7242d on this Linux host, so they are environmental and unrelated. I will apply this resolution as a normal merge once #794 is in next.

Review:

• One persistent second-family reviewer (Codex gpt-6.1-sol) reviewed the full PR diff against next, the merge 256e643 with its follow-up, and the prepared feat(native): guide first-use runtime setup #794 resolution. Verdict: CLEAN at 6cc53d6. No findings, no open decisions.
• The Codex bot review is clean at this head.
• computer pr review-status: CLEAR at 6cc53d6 (no unresolved bot threads, head contains next).

Hosted checks at this head: 27 pass, 1 skipped, 2 failed:

• test shard 1/8 (macos-15-arm64) failed in tests/python-free-download.test.ts, test "bounded cancellation refuses uncertain read-error settlement and preserves the primary failure". It hit the 5 s timeout, and the mock was called 2 times instead of 1.
• The test summary job failed only because of that shard.

This PR does not touch that file or the download code. The failure is not one of the named flakes (HACK-2235, HACK-2243), so I did not rerun it. Please rerun the failed job, or tell me to.

Not verified:

• No macOS-only authored-startup fixtures were run in this session.
• The 18-project preflight census is still the lead's Mac step.
• The prepared feat(native): guide first-use runtime setup #794 resolution has not been pushed; it is not part of this head.

[roodboi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 177cc9ffef

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 177cc9ffef

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Ready for lead: 177cc9f

This head is a normal merge of next e47681e into 6cc53d6. next now includes #794. No rebase.

Merge resolutions:

• src/backends/native-preflight.ts:
  • ready requires no blockers, no consent, a completed review and runtime_setup.state === "ready".
  • The report keeps both runtime_setup and consent_needed.
  • The exit status still follows blockers plus consent.
• src/lib/upgrade-check-project.ts: the informational summary counts blockers and consent items and says that setup and review were not checked.
• tests/native-preflight-cli.test.ts and docs/guides/native-candidate.md: union of both sides.
• Test fixes:
  • The upgrade-check probe stub gains consentNeeded.
  • The no-effects assertion allows feat(native): guide first-use runtime setup #794's read-only runtime setup inspect call.
• packages/runtime-core/src/project/compose/dependency_cache.rs: next added a refusal for anonymous volumes. I kept this branch's finding collection and added that refusal so it fires only when nothing earlier refused, which keeps next's first-error order.
• packages/runtime-core/src/project/compose/service.rs: this merged without a textual conflict but did not compile. next made the volume map mutable for anonymous volumes. This branch's per-service compile_services now takes &mut, and the loop passes the same map. On any error, the whole result is an error.

Admission is unchanged. Every refusal still names its service and field, and values are never shown.

Review:

• The same persistent Codex reviewer, in round 2, returned CLEAN at this head, covering both new resolutions.
• The Codex bot code review and the security review are clean at 177cc9f.
• computer pr review-status: CLEAR.

Hosted, exact-head run:

• Every Linux job passed: test shards 4–8, docker-e2e and its 4 shards, Config compiler (ubuntu-latest and ubuntu-24.04-arm), Candidate core (ubuntu-latest), linux-process-lifetime, runtime-images, secret-scan, docs site, Runtime state models and test focus.
• Config compiler (macos-latest) also passed.
• Queued, not waited for: Candidate core (macos-latest) and test shards 1/8, 2/8 and 3/8, which run on macOS.

Ran locally (Linux, pinned toolchains):

• check:local (fmt and clippy) and all-features clippy.
• Rust tests: default 1,266 passed, 0 failed; all-features 1,571 passed, 0 failed.
• check:native-plan-cli: every scripts/check-native-*-plan-cli.ts, plus check-config-compiler-cli.ts and config import.
• 163 focused TypeScript tests: preflight, upgrade-check, runtime client, startup logs, dependency cache.
• bun run typecheck, bun run check (includes the privacy check) and docs:check.

Not verified: the macOS jobs above, macOS-only authored-startup fixtures, real-VM scenarios, and the 18-project preflight census. These are the lead's Mac batch.