[roodboi]

A CLI output change could pass light PR CI while tests/local-network-hint.test.ts was deferred to macOS. This file's open --json subprocess contract is portable; only its hint expectations vary by platform. Add it to BOTH_POOL_FILES, so selected light PRs run it once across the existing five Linux shards and retain its current macOS coverage.

Cost: zero additional macOS minutes per PR, with about four Linux seconds budgeted when the file is selected. No workflow, required-check or branch-rule change. The final net diff changes five planner/runner/test/doc paths and contains no product-code or output-contract test change.

The deferral report distinguishes files already run on Linux from files awaiting execution. Both still await macOS qualification. Real-source regressions cover src/commands/project.ts (the actual open handler), src/ui/logger.ts and src/lib/local-network-hint.ts: each source must exist, selection mode must be selected, the file must enter both pools, and the ordinary PR matrix remains [4,5,6,7,8]. Other platform-sensitive files retain their existing tiers and label opt-ins.

Verification

Normal merge of next at bb6a7d17 includes #789 and #788. Incoming #789 strengthens the source-CLI fixture with deterministic DNS and exact { url } assertions; it is preserved unchanged. The hosted negatives below predate that strengthening, which makes the gate stricter. No manual macOS dispatch was added for this PR; protected script changes receive the existing automatic full tier.

• Final tree 809fcec4cefba390d8b94dd895e47593a9745f58 has clean persistent second-family review. Product code and tests/local-network-hint.test.ts match next at bb6a7d17 byte for byte.
• Final local checks: 150 tests / 834 assertions across selector, shard, network-hint and loopback contracts; root typecheck/check and staged privacy check pass.
• Requested historical negative: at a28c5705, revert only fix(cli): dogfood fixes, round 2 (doctor store-reader summary, open --json test on hosts without DNS) #796's test change. Run 43526479675, Linux shard 5 fails in tests/local-network-hint.test.ts:154; structured annotations show the old { url } equality rejecting the documented dns: unresolved and hint fields. This proves Linux wiring and reproduces the original miss on that runner.
• Deterministic product negative: restore fix(cli): dogfood fixes, round 2 (doctor store-reader summary, open --json test on hosts without DNS) #796's test and temporarily emit an unknown JSON key at 64cff6c1. Run 43529281444, Linux shard 5 fails at expectOpenPayload (local-network-hint.test.ts:167) in both resolver branches. Shard 7 independently rejects the key in project-open-loopback.test.ts:43, :66 and :109.
• Both checkpoints finished before advancing. Evidence comes from structured annotations; draft fan-in failures and expected installer fixture-interruption annotations are not counted. The unknown key is fully removed by a normal forward restore commit. The temporary negative commits remain in history; squash merge preserves only the final five-path diff.

This policy PR changes protected planner scripts, so its own ready CI gets the full tier. The unit regressions prove ordinary light-PR selection; the hosted negatives prove Linux wiring and contract enforcement. Current-head bot review and positive hosted checks remain required before the Ready for lead: note.

HACK-2203 addition / HACK-2206. Rust process isolation is separate PR #798.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hack-docs	Ready	Preview	Nov 14, 2026 12:33am UTC

[linear-code]

HACK-2206

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[roodboi]

Negative control 1 completed at a28c5705b174edf41ee48cef44e78bcbf9f192fb: run 43526479675, Linux test shard 5/8 failed specifically in tests/local-network-hint.test.ts:154. Structured check annotations show the old { url } equality rejected the actual documented dns: unresolved and hint fields. The runner records that file failing after 1.6s. This is the requested hosted reproduction after reverting only #796's test change; draft fan-in failures are not counted.

Next I will restore #796's test and introduce a separate deterministic unknown JSON key in the product output, then restore product bytes after recording that control. The open handler is actually in src/commands/project.ts; I corrected the selector regression's earlier nonexistent open.ts probe and added an existence assertion for every source probe. Ordinary light-selection evidence will use the real handler path. No Ready claim.

[roodboi]

Checkpoint 2 is published at 64cff6c149c98fb440934b3ba05d434680dc22b7: #796's corrected test is restored, and a temporary ci_contract_negative_control JSON key is emitted by emitOpenOrigin in src/commands/project.ts. The corrected expectOpenPayload rejects it in both local CLI subprocess cases, independent of DNS. This remains an intentional draft negative; product bytes will be restored after its hosted Linux shard finishes.

The real-source selector regressions now require source-file existence and selection.mode === "selected". All three probes pass; the updated selector suite passes 85 tests / 272 assertions. The corrected positive tree previously passed 146 focused tests / 812 assertions before the extra mode checks. No Ready claim.

[roodboi]

Negative control 2 completed at 64cff6c149c98fb440934b3ba05d434680dc22b7: run 43529281444, Linux shard 5 fails specifically at expectOpenPayload in tests/local-network-hint.test.ts:167. Both CLI cases reject the temporary ci_contract_negative_control key; the runner records that file failing after 1.8s. This is deterministic contract enforcement, separate from the DNS-dependent historical-test revert.

Additional expected mutation detection: Linux shard 7 rejects the same key in tests/project-open-loopback.test.ts:43, :66 and :109. Installer fixture-interruption annotations are separate expected nested negative fixtures.

The full checkpoint run has finished. Product bytes are now restored locally to next, and final positive verification plus exact-tree persistent review are running. A normal forward commit will publish the restore before marking this PR ready. No Ready claim yet.

[roodboi]

@codex review

Restored final head: 77b147663be2f7d866c2c4ff4b09a82c21bbe3c7, tree 0d13120d24b2c9b04b5acfe83aca1b794ed63a84. Both hosted negative controls are complete and cited in the description. Temporary product output is fully removed; src/commands/project.ts and tests/local-network-hint.test.ts match next byte for byte. The final diff is five planner/report/regression/doc paths only.

Persistent second-family review is clean on this exact tree. Final positive local verification: 150 tests / 835 assertions, root typecheck/check and privacy check pass. PR is now ready for review, with positive hosted CI pending; this is not the Ready for lead: note.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-14T00:35:11.523893Z	8faefd2	Manual request
🔒 Security Review	✅ Completed 2026-11-14T00:37:58.521287Z	8faefd2	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 77b147663b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 77b147663b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

@codex review

Current head 8faefd2b normally merges next at bb6a7d17, including #789 and #788 as requested by the lead. Persistent review is clean on exact tree 809fcec4cefba390d8b94dd895e47593a9745f58; the net diff remains five intended paths with no product change. Incoming deterministic DNS fixture strengthening is preserved. Positive merged checks: 150 tests / 834 assertions, root typecheck/check pass.

No manual macOS dispatch was added for this PR. Its protected planner-script changes receive the existing automatic full tier. Positive current-head CI is pending; no Ready-for-lead claim yet.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 8faefd2bdb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8faefd2bdb

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.