Milestone v1.0 Audit (provisional)
Overall status: gaps_found. Three gaps block or remain open: G-01 and G-02 (no AgentOS driver is bound, so realm up never reaches active, and CLI-01 and RT-04 stay open), and G-04 (QUAL-01 is not met across the repo). G-09 (OMP-05, advisory writes) and G-10 (FS-02, pinned root is still a path) are also open. Five gaps from the previous pass are closed in the working tree: G-03 (ACP entry), G-05 (Omp status poll), G-06 (doctor agentos reading), G-07 (single state-dir resolver), and G-08 (error code and cause over MCP and ACP). The production realm up path still cannot reach active, so F1, F3, F4, and F7 stay unreachable.
Method (re-audit): read the changed code for G-03 through G-10 and the tests that the claims name. Grepped the repo for catch and promise rejection handlers in src/, then read each catch body (section 6). Ran a PCRE scan for empty and comment-only catch bodies (none found). No tests, typecheck, lint, build, or state-changing git command was run. Gate results are the orchestrator's (typecheck 0, lint 0, 1056 tests, 1047 pass, 0 fail, 9 skipped) and were not re-run. Integration links L2, L3, L7, and L10 were carried forward from the prior pass and not re-read. Links L1, L4, L5, L6, L8, and L9 were re-read in this pass.
Disposition (user decisions, 2026-10-22)
The frontmatter counts and downgraded_by_audit are the re-audit counts from before these decisions.
Every requirement row in section 1 and every gap in section 5 now has a disposition. The four user decisions in section 4 are recorded here. The overall status stays gaps_found, and the frontmatter counts are not recomputed here.
- G-01, G-02 (RT-04, CLI-01): deferred to a follow-up milestone by user decision. v1.0 ships fail-closed:
realm uprefuses with AGENTOS_NOT_CONFIGURED until an AgentOS driver exists. Spike:docs/integration/agentos.md, "Spike result" (no-go as designed). Both stay open, not closed. - G-04 (QUAL-01): amended by user decision. The requirement now names its exceptions (REQUIREMENTS.md, QUAL-01). The mcp residual (section 6, site 4) is fixed. Nine sites remain, in the eight named exceptions: (a) sites 1 and 2; (b) site 3; (c) site 6; (d) site 5; (e) site 7; (f) site 8; (g) site 9; (h) site 10.
- G-09 (OMP-05): 5.3 accepted. The advisory default is kept by user decision; fail-closed stays the documented opt-in for containment deployments. 5.4 (OQ-P5-02, host interception not verified) stays open.
- G-10 (FS-02): accepted approximation, pending the user's confirmation. Stays Partial.
- OMP-03 (tooltip wording, G-05 residual): accepted by user decision: one status item, detail in its text; no tooltip API on this host.
- G-03, G-05 (apart from the OMP-03 wording and latency), G-06, G-07, G-08: closed, as recorded in section 5.
1. Requirements matrix
Traceability column is REQUIREMENTS.md, unchanged by this pass. Audit column is this audit's finding. Gap IDs (G-nn) are defined in section 5.
| ID | Phase | Traceability | Audit | Evidence (verified) | Notes |
|---|---|---|---|---|---|
| FOUND-01 | 1 | Complete | satisfied | package.json scripts typecheck, lint, test, build; tsconfig.json:8 strict; grep for @ts-ignore, eslint-disable, as any in src/ and test/ returns nothing; 01-VERIFICATION.md Truth 1 | Gate results come from the orchestrator, not this audit. No format script exists; FOUND-01 does not require one. |
| FOUND-02 | 1 | Complete | satisfied | src/core/states.ts, src/core/errors.ts, src/contract/tools.schema.json, src/contract/session-record.schema.json, src/core/policy.schema.json (present); test/core/states.test.ts, test/core/policy.schema.test.ts, test/contract/tools.schema.test.ts, test/contract/session-record.schema.test.ts (present); 01-VERIFICATION.md Truth 2 | Catalogue is now 27 codes (test/core/errors.test.ts:79), with MCP_INPUT_FAILED and CLEANUP_FAILED added. |
| FOUND-03 | 1 | Complete | satisfied | docs/integration/ holds agentos, podman, openshell, anda, omp, mcp, acp, hosts (plus anda-decision, runtime-decision); each has a read date of 2026-10-21 or 2026-10-22 | |
| CORE-01 | 2 | Complete | satisfied | test/core/state-machine.test.ts:83 "every disallowed pair … REALM_INVALID_TRANSITION (CORE-01)"; test/core/states.test.ts:109 self-transitions; 02-VERIFICATION.md Truth 1 | |
| CORE-02 | 2 | Complete | satisfied | src/core/status.ts (sole STATUS_LABELS); test/core/status.test.ts (present); 02-VERIFICATION.md Truth 2 | Surface repaint is covered under OMP-02 and OMP-03, which are closed for G-05. |
| CORE-03 | 2 | Complete | satisfied | src/core/policy.schema.json (advisory default, shellEnabled false, startupBudgetMs 10000, toolQueueMs 2000); test/core/policy.test.ts, test/core/fail-closed.test.ts (present); 02-VERIFICATION.md Truth 3 | |
| CORE-04 | 2 | Complete | satisfied | src/core/events.ts; test/core/events.test.ts (present); 02-VERIFICATION.md Truth 2 | publish rethrows the first listener failure after all listeners run (events.ts:46-55). |
| CORE-05 | 3 | Complete | satisfied | test/lifecycle/mutation-gate.test.ts, test/tools/queue-timeout.test.ts (present); 03-VERIFICATION.md Truth 1 | The controller gate holds. Structured-refusal loss across the daemon boundary (G-08) is closed. |
| CORE-06 | 2 | Complete | satisfied | test/lifecycle/idempotent.test.ts, test/lifecycle/controller.test.ts, test/lifecycle/create-interrupt.test.ts:74 "(C1, CORE-06)" (present); 02-VERIFICATION.md Truth 5 | |
| FS-01 | 2 | Complete | satisfied | src/fs/canonicalize.ts, src/fs/root.ts; test/fs/canonicalize.test.ts, test/fs/root.test.ts, test/fs/write.test.ts:197-210 escape cases "(FS-01, D-34)" (present); 02-VERIFICATION.md Truth 4 | Composition-level policy bind is closed (compose.ts:90-94, security review 5.1). The residual bind race is FS-02 (G-10). |
| FS-02 | 2 | Partial (accepted approximation) | partial, G-10 open | create-time check: src/fs/root.ts:63-80 (verifyPinnedAt, device and inode plus the /proc/self/fd real path), called once at src/lifecycle/controller.ts:186; test/fs/root.test.ts:73-110 (four cases: same dir, symlink alias, replaced dir, moved dir with link). Per-operation I/O: src/fs/read.ts:42, src/fs/canonicalize.ts:216, src/tools/workspace.ts:85-120 | Narrowed at create only. PinnedRoot still holds a path string (src/fs/root.ts:13-22). Every read, write, list, and tool call resolves that path again. The requirement's "pinned root descriptor" is not met. Security 5.2 is open. |
| FS-03 | 2 | Complete | satisfied | src/fs/credentials.ts; test/fs/deny-credentials.test.ts (present); 02-VERIFICATION.md | |
| FS-04 | 2 | Complete | satisfied | test/fs/lock.test.ts, test/fs/write.test.ts (present); 02-VERIFICATION.md | |
| FS-05 | 2 | Complete | satisfied | test/fs/atomic-write.test.ts (present; :197 cleanup cause, G-04); 02-VERIFICATION.md | |
| RT-01 | 3 | Partial (live-gated) | partial | Unit: test/runtime/hardening.test.ts, test/runtime/session-execution.test.ts; live body in test/integration/podman-gate.test.ts, skipped on Podman 4.9.3 | Inspect field paths are provisional (hardening.ts:1-10, security review R1). Live run deferred. |
| RT-02 | 3 | Partial (live-gated) | partial | test/runtime/podman-probe.test.ts, test/runtime/podman-version.test.ts (present); 03-10-SUMMARY.md | Live probe output deferred. |
| RT-03 | 3 | Partial (live-gated) | partial | test/runtime/openshell-argv.test.ts, openshell-routing.test.ts, openshell-policy.test.ts (present) | Live conformance deferred. No production execution path exists without a driver (G-01). |
| RT-04 | 3 | Open | OPEN (unsatisfied; G-01) | Against it: docs/integration/agentos.md "Spike result" recommends no-go with three blockers; src/runtime/session-execution.ts:208-210 throws AGENTOS_NOT_CONFIGURED; src/daemon/main.ts binds no agentosDriver; 03-10-SUMMARY.md:33 "No concrete AgentOS driver exists"; test/daemon/daemon.test.ts:219 asserts the refusal | 03-VERIFICATION.md marks RT-04 SATISFIED (unit) against a fake supervisor only (test/runtime/agentos-supervisor.test.ts). That does not meet "managed only through its supported API". |
| RT-05 | 4 | Partial (live-gated) | partial | test/runtime/egress.test.ts, config.test.ts, openshell-policy.test.ts, session-execution.test.ts (present); live x3 in podman-gate.test.ts | IPv6 enforcement is partial by design (D-76). The egress chain is unreachable in production without a driver (L7). |
| RT-06 | 6 | Complete | satisfied | test/daemon/channel.test.ts, test/doctor/control-channel.test.ts, test/daemon/daemon.test.ts RT-06 cases (present); e2e 0700/0600 and no-socket-in-argv checks per 06-VERIFICATION.md Truth 4; commit 4b1d4ab (smoke run) in git log | State-dir source is now one resolver (G-07, src/runtime/host-paths.ts:36-44, test test/runtime/host-paths.test.ts:42). Live socket permission check is still deferred (06 items). |
| RT-07 | 2 | Complete | satisfied | test/lifecycle/controller.test.ts:93 "create writes the record with containerId null before the fake create runs (RT-07)"; :109 ordering before start; test/session/store.test.ts (present) | |
| RT-08 | 4 | Partial (live-gated) | partial | test/runtime/down-sweep.test.ts, test/session/reap.test.ts, test/session/store.test.ts (present); reapStartup is wired at src/daemon/daemon.ts:458 | The 04-VERIFICATION note "no in-src caller" is stale. Live reap deferred. |
| RT-09 | 3 | Partial (live-gated) | partial | test/runtime/down-sweep.test.ts (present); live zero-orphan body in podman-gate.test.ts | |
| ANDA-01 | 3 | Partial (live-gated) | partial | test/anda/boundary-decision.test.ts (present); docs/integration/anda-decision.md; src/anda/client.ts, src/anda/shape.ts | Live RPC deferred. |
| ANDA-02 | 3 | Partial (live-gated) | partial | test/anda/handshake.test.ts (present); 03-VERIFICATION.md | The "version handshake" is a shape check only, because no documented version surface exists. That narrowing is accepted in the phase report but is not the literal requirement. |
| ANDA-03 | 3 | Partial (live-gated) | partial | test/anda/reconnect.test.ts, test/core/backoff.test.ts, test/lifecycle/bridge-retry.test.ts (present) | Live retry deferred. |
| ANDA-04 | 3 | Partial (live-gated) | partial | test/anda/no-shim.test.ts (present); no src/anda/native/; docs/integration/anda-decision.md | The evidence supports satisfied, since the shim condition was not met. The Partial label has no live gate attached, so the traceability row looks stale. Kept as Partial to match traceability. |
| TOOL-01 | 2 | Complete | satisfied | test/contract/tools.schema.test.ts, test/contract/tool-input-gate.test.ts, test/tools/dispatch.test.ts (present); 02-VERIFICATION.md | Validation holds. Refusal codes now reach MCP and ACP as codes (G-08: src/mcp/server.ts:150-160, src/acp/agent.ts:84-92, test/mcp/server.test.ts:203, test/acp/agent.test.ts:235). |
| TOOL-02 | 2 | Complete | satisfied | test/contract/exec-policy.test.ts:79-86 "the shell form is rejected with SHELL_NOT_ALLOWED" (verified by grep) | |
| TOOL-03 | 4 | Partial (live-gated) | partial | test/tools/dispatch.test.ts, workspace.test.ts, no-bypass.test.ts, test/runtime/openshell-routing.test.ts (present); test/daemon/client.test.ts:262 (cause kept across the daemon) | Live exec deferred. Exec is refused in production until a driver is bound (G-01). |
| TOOL-04 | 4 | Partial (live-gated) | partial | test/tools/queue-timeout.test.ts (present; TOOL-04 cases per 04-VERIFICATION.md); test/runtime/session-execution.test.ts kill-on-timeout | Live hung-exec probe deferred. |
| TOOL-05 | 5 | Partial (live-gated) | partial (G-03 and G-08 closed) | realm acp entry: src/cli/main.ts:453-476, src/acp/stdio.ts:9-15, test/acp/stdio.test.ts:44, test/cli/cli.test.ts:599-697; MCP and ACP keep code and message: src/mcp/server.ts:150-160, src/acp/agent.ts:84-92, test/mcp/server.test.ts:203, test/acp/agent.test.ts:235; equivalence in-process test/surfaces/equivalence.test.ts | ACP and MCP are both reachable from the shipped binary. Equivalence is proven in-process only. Production up is refused until a driver is bound (G-01), so realm acp exits 1 in production. Live client drives deferred. Non-RealmError ACP replies carry no catalogue code (section 6). |
| AUD-01 | 2 | Complete | satisfied | test/audit/log.test.ts:41-48, 169-171 outcome assertions; test/audit/redaction.test.ts (present); 02-VERIFICATION.md Truth 5 | |
| AUD-02 | 2 | Complete | satisfied | test/lifecycle/no-host-env.test.ts (present); 02-VERIFICATION.md Truth 5 | |
| OMP-01 | 5 | Partial (live-gated) | partial | Budget path: src/omp/plugin.ts:223-264 (overrun renders realm disconnected with the code STARTUP_BUDGET_EXCEEDED; the session continues); test/omp/plugin.test.ts (3 OMP-01 cases); src/omp/extension.ts:37 reads the state dir from the config (G-07 closed); test/omp/extension.test.ts:83 | No live Omp session. In production the realm cannot reach active (G-01). readHostRuntime runs at extension load and throws when the config is missing or invalid (extension.ts:37). That matches "with realm configured", but the load-time throw is not covered by a test in this pass. |
| OMP-02 | 5 | Partial (live-gated) | partial (G-05 closed) | One status item: src/omp/plugin.ts:138-148 (REALM_STATUS_KEY, the only setStatus call). Poll: src/omp/plugin.ts:112-114 (STATUS_POLL_MS = 2000) armed at :331-334. Shutdown clears poll and timers: :187-205, :340-342. Tests test/omp/plugin.test.ts:494-569 (transition on poll, no stacked reads, failed-poll paint once, no paint after shutdown) and :701-748 | A daemon transition reaches the label within 2 s by polling. It is not pushed on the transition. No live render check. |
| OMP-03 | 5 | Partial (accepted approximation) | partial (G-05 second item closed; tooltip wording open) | Reason and time share the one status item text: src/omp/plugin.ts:17-18 (P5-D5, the host offers no tooltip); test/omp/plugin.test.ts:465-493 | The second status item is gone, so the P5-D5 deviation is smaller. The literal "status tooltip" is still not met. Accepting text-in-status, or amending the wording, is a user decision. |
| OMP-04 | 5 | Partial (live-gated) | partial | test/omp/plugin.test.ts (2 OMP-04 cases); retry via dispatcher.call({ retry: {} }) | Live command registration deferred. |
| OMP-05 | 5 | Partial (live-gated) | partial, G-09 open | test/omp/plugin.test.ts (3 OMP-05 cases); test/realm/compose.test.ts mode gate; advisory path src/omp/plugin.ts:432-448 notifies and lets the write proceed (unchanged) | Security review 5.3 (advisory unbound writes proceed with only a warning) and 5.4 (OQ-P5-02, bypass paths unproven) are open. Whether advisory stays the default is a user decision (security 8.2). |
| CLI-01 | 6 | Open | OPEN (unsatisfied; G-02) | Surface gaps closed: realm acp (src/cli/main.ts:453-476, :518-520; G-03), state dir from the one resolver (src/cli/main.ts:491; G-07). Open cause: src/runtime/session-execution.ts:208-210 refuses; up never reaches active. Carried-forward contradiction: 06-03-SUMMARY.md and 06-04-SUMMARY.md claim CLI-01; STATE.md Blockers | 06-VERIFICATION.md Truth 1 and CLI-01 are SATISFIED (unit) on fake-backed e2e only (test/daemon/e2e.test.ts). |
| CLI-02 | 6 | Complete | satisfied | test/cli/cli.test.ts:377-405 "(CLI-02)" asserts stdout PODMAN_MISSING, exit 1, zero spawns; test/daemon/e2e.test.ts fast path (per 06-VERIFICATION.md) | Fake runner only. A live missing-Podman host is deferred. |
| CLI-03 | 6 | Complete | satisfied (G-06 closed) | src/doctor/checks.ts:588-632 (agentOsCheck: unbound gives fail with AGENTOS_NOT_CONFIGURED and the driver fix; a live session gives pass; no live session or a throwing probe gives fail with AGENTOS_CRASH_LOOP); the daemon supplies the reading at src/daemon/daemon.ts:183-189; test/doctor/control-channel.test.ts:200-262 (agentos cases); test/daemon/daemon.test.ts:390 (doctor dispatch) | The daemon's own reading is not asserted by any test. The warn-only "not probed" status is gone. Live doctor run deferred (06 items). |
| CLI-04 | 6 | Partial (live-gated) | partial | docs/hosts/snippets/ holds omp, muse-code, claude-code, grok-build, hermes-agent (present); test/docs/host-snippets.test.ts (present); docs/integration/hosts.md read dates 2026-10-21 and 2026-10-22 | Copy-paste against real hosts deferred. |
| QUAL-01 | 1 | Complete | OPEN (G-04) | Phase 1 scope: 01-VERIFICATION.md Truth 4. Controller sites closed: no .catch(() => undefined) left in src/lifecycle/controller.ts; orphanFailure, causeCode, and CLEANUP_FAILED in controller.ts:112-114, 420-439, 666-698, 744-758; test/lifecycle/teardown-failures.test.ts:76-165 (5 cases), test/lifecycle/create-interrupt.test.ts:393; src/fs/canonicalize.ts:191-197 and test/fs/canonicalize.test.ts:266; src/fs/atomic-write.ts:76-82 and test/fs/atomic-write.test.ts:197. Repo-wide sweep (section 6): 10 silent sites remain | The requirement says "no silent catch blocks exist". Section 6 lists 10 sites that drop an error with no code or cause. Most are deliberate and documented, but the literal rule is not met. Moves to Partial (accepted approximation) only if the user amends the rule to name these exceptions. |
| QUAL-02 | 2 | Complete | satisfied | test/quality/suite-taxonomy.test.ts, test/integration/podman-gate.test.ts (skip reason names PODMAN_UNSUPPORTED_VERSION); MCP/ACP contract tests test/mcp/server.test.ts, test/acp/agent.test.ts, test/surfaces/equivalence.test.ts (present); ACP stdio entry test/acp/stdio.test.ts | The Phase 2 "partial, accepted" marking is superseded by the Phase 5 files, though no Phase 5 report re-cites QUAL-02. |
| QUAL-03 | 7 | Complete | satisfied | docs/policy-reference.md (all seven keys per 07-VERIFICATION.md); 07-SECURITY-REVIEW.md, 07-SUPPLY-CHAIN-REVIEW.md (present) | Release-gate decisions stay open: S-4 (Anda licence), S-5 (no LICENSE file, confirmed absent, and no license field in package.json), and security section 8. They gate the release and do not falsify "recorded". |
Counts: satisfied 23, partial 20, open 3 (total 46, no orphans). The traceability table records 24 Complete, 20 Partial, 2 Open. The differences are QUAL-01 (traceability Complete, audit Open) and the additional open gap G-04 that it carries.
Mismatches with the 3-source rule. Every REQ-ID is in at least one VERIFICATION report, so none is orphaned. No SUMMARY frontmatter exists for phases 1 to 4 (summaries are prose) or phase 7 (no plans). Those phases were checked manually. For phase 5, 05-05-SUMMARY.md has no requirements-completed field. For phase 6, 06-02 and 06-06 do not have one. 06-03 and 06-04 claim CLI-01, which contradicts the Open status.
2. Phase verification status
| Phase | Report status | Score | Audit view |
|---|---|---|---|
| 1 Scaffold and Frozen Contracts | passed | 4/4 SC | Passed for Phase 1 scope. Its QUAL-01 claim is repo-wide and is open (G-04). |
| 2 Policy, State, and Filesystem | passed | 16/16 | Passed. QUAL-02 MCP/ACP clause is covered by Phase 5 test files. FS-02 is still open on the pinned-root descriptor (G-10). |
| 3 Container Runtime and Bridges | passed_with_gated_live_items | 10/10 unit, 5 live-gated | Overclaim: RT-04 marked SATISFIED but traceability is Open (G-01). Live items deferred. |
| 4 Reaper, Egress, Dispatcher | human_needed | 21/21 unit | Stale: "reapStartup has no in-src caller" is now wired (daemon.ts:458). Five live items deferred. |
| 5 Omp, MCP, ACP | human_needed | 5/5 unit | Missed ACP entry (G-03) is closed: realm acp is in the CLI. Status poll (G-05) is closed. Open: OMP-05 advisory writes (G-09). Manifest entry misstated: it says ./dist/src/omp/plugin.js, but package.json:6, test/omp/plugin.test.ts:566, and omp.md all use extension.js. Limitation (f) is stale (security review 5.1 and section 7). OMP-03 tooltip deviation (P5-D5). Seven live items deferred. |
| 6 CLI, Daemon, Packaging | human_needed | 5/5 unit | Overclaim: CLI-01 SATISFIED, but production up is refused (G-02). Doctor agentos (G-06) and state-dir mismatch (G-07) are closed. Six live items deferred. |
| 7 Policy Reference and Security Review | human_needed | 9/9 | Both reviews recorded with open dispositions. Five human items deferred. |
Phase 4 and 5 are "passed" only in the sense that unit evidence is complete. Neither gate is a live pass.
3. Integration findings
The gsd-integration-checker subagent ran in the prior pass. This pass re-read L1, L4, L5, L6, L8, and L9 in the working tree. L2, L3, L7, and L10 are carried forward. Each link is wired (PASS), wired but partial (PARTIAL), or broken (FAIL). The score is PASS links out of 10.
| Link | Result | Evidence | Requirements |
|---|---|---|---|
| L1 Controller to AgentOS driver/supervisor | FAIL | No concrete AgentOsDriver in src/ (only the interface, src/runtime/agentos.ts:22). Daemon binds none (src/daemon/main.ts sets no driver; src/daemon/daemon.ts:157-162). requireAgentOs throws (session-execution.ts:208-210). Re-verified in this pass. | RT-04, RT-03, OMP-01, CLI-01 (G-01, G-02) |
L2 Dispatcher to daemon tool method, to CLI and MCP | PASS | One dispatcher constructor (src/realm/compose.ts:75); reached via daemon, realm mcp (src/cli/main.ts:406-420), and realm acp (src/cli/main.ts:453-476). Carried forward. | TOOL-03, TOOL-05 |
| L3 Reaper to daemon startup | PASS | reapStartup awaited in startDaemon after listen and chmod, before openGate() (src/daemon/daemon.ts:458). Carried forward. | RT-08 |
| L4 Control socket path, CLI, OMP, doctor | PASS | readHostRuntime (src/runtime/host-paths.ts:36-44) is the one resolver. Daemon src/daemon/main.ts:48, CLI src/cli/main.ts:491, Omp src/omp/extension.ts:37. The doctor is run by the daemon with its own stateDir (daemon.ts:183-189). XDG_STATE_HOME is not read anywhere in src/. Re-verified in this pass. | CLI-01, OMP-01, RT-06 (G-07 closed) |
| L5 Dispatcher to MCP error mapping | PASS | Daemon replies {error:{code,causeCode}} (daemon.ts:498-503, channel.ts:200-212). DaemonClient.call throws makeRealmError(code, causeCode) (src/daemon/client.ts:124-127). MCP returns realmErrorResult with code, message, retryable, causeCode (src/mcp/server.ts:150-160). Non-RealmError still maps to -32603 (section 6, site 4). Re-verified in this pass. | TOOL-05, TOOL-01, TOOL-03 (G-08 closed) |
| L6 Dispatcher to ACP entry point | PASS | realm acp in CLI_COMMANDS (src/cli/main.ts:37) and the switch (:518-520), then runAcp (:453-476), then runAcpOverStdio (src/acp/stdio.ts:9-15), then runAcpAgent (src/acp/agent.ts:188). Re-verified in this pass. The entry runs only when up leaves the realm active or degraded (:461-467), which production never does (L1). | TOOL-05, QUAL-02 (G-03 closed) |
L7 Policy egressAllow to OpenShell policy document | PASS in code, unreachable | Chain: validate in constructor (session-execution.ts:95), write policy (openshell.ts:261-276), render (egress.ts:50-66). Runs after requireAgentOs, so production never writes it. Carried forward. | RT-05 (via G-01) |
L8 Doctor agentos item to supervisor probe | PASS | agentosReading (src/daemon/daemon.ts:183-184) passes {bound:false} or {bound:true, alive} to runChecks (:186-190). agentOsCheck maps each reading (src/doctor/checks.ts:588-632). Production always reports fail AGENTOS_NOT_CONFIGURED until a driver is bound. Re-verified in this pass. | CLI-03, RT-04 (G-06 closed) |
| L9 Controller events to OMP status indicator | PARTIAL | The plugin reads daemon status on a 2 s poll (src/omp/plugin.ts:112-114, 331-334) and on attach, retry, and guarded calls (:172, 203, 208, 289). It does not subscribe to controller events, so a transition shows within 2 s, not at once. Re-verified in this pass. | OMP-02, OMP-03 (G-05 closed; latency is the residual) |
| L10 OMP extension to daemon autostart, CLI spawn | PASS | src/omp/extension.ts uses ensureDaemon, startDetachedDaemon, connectDaemon, and client.up. Entry ./dist/src/omp/extension.js matches tsconfig.json (rootDir: ".", outDir: "dist"). Carried forward. | OMP-01 |
Score: 7 of 10 links PASS (L2, L3, L4, L5, L6, L8, L10). L9 is PARTIAL. L1 is FAIL. L7 is PASS in code but unreachable.
Flows (end to end, production path):
| Flow | Result | Evidence |
|---|---|---|
F1 realm up, status, down reaches active and disconnected | BROKEN | Production up ends in error (L1). Works only in the fake-backed test/daemon/e2e.test.ts. |
F2 realm up with Podman missing | WORKS | Exit 1 with PODMAN_MISSING, no spawn (test/cli/cli.test.ts:377). |
| F3 Omp session start reaches realm active | BROKEN | L1. Attach runs, and the status reads disconnected with a code (plugin.ts:246-264). Active is not reached with fakes only (test/omp/plugin.test.ts). |
| F4 Omp retry | BROKEN | Retry needs a driver (L1). Works with fakes only. |
| F5 MCP tool call through the dispatcher | PARTIAL | Routing is wired (L2). Read, list, and status are reachable. Exec and write are refused while not active. Refusal codes now reach the client (L5, G-08 closed). |
| F6 ACP tool call | BLOCKED | Entry exists (L6, G-03 closed). realm acp refuses at attach because up never reaches active (L1). |
| F7 Egress allowlist reaches OpenShell create | UNREACHABLE | Wired (L7). Needs L1. |
F8 realm doctor report | WORKS | Nine items listed. With a daemon, agentos fails AGENTOS_NOT_CONFIGURED with the driver fix (L8). With no daemon, it warns REALM_NOT_ACTIVE. |
Flows working in production: 2 of 8 (F2, F8). Score: 2/8.
Cross-phase notes. The Phase 4 claim that the reaper has no in-src caller is stale, because L3 is wired. The Phase 5 claim that the MCP and ACP surfaces are equivalent holds in-process only. The Phase 6 claim that CLI-01 is satisfied rests on fake-backed e2e, not on the production path.
4. Deferred and human-needed items
Decision required from the user (not made by this audit): the AgentOS path after the no-go spike (docs/integration/agentos.md "Spike result"). Either accept G-01 and G-02 as a follow-up milestone, or bind a driver. Until then RT-04 and CLI-01 stay open, and F1, F3, F4, F6, and F7 stay unreachable in production.
Other user decisions that this audit does not make: OMP-03 tooltip wording (accept text-in-status or amend); OMP-05 advisory default and the unbound-write warning (G-09, security 5.3 and 8.2); QUAL-01 exceptions (G-04: accept the section 6 exceptions by amending the rule, or fix the sites).
Live-gated and human-needed items, grouped by phase. These are the deferred verifications listed in STATE.md, rows 3 to 7.
| Phase | Items | Source | Resume |
|---|---|---|---|
| 3 | RT-01 live container conformance; RT-03 live argv; RT-04 live AgentOS run (blocked by no driver); RT-09 zero-orphan sweep; ANDA-02 and ANDA-03 live RPC; OQ-P3-01/02/03/12/14/15 live-gated; OQ-P3-11 Open; OQ-P3-16 Blocked | 03-VERIFICATION.md live list; runtime-decision.md | /gsd:verify-work 3 on Podman 5.x |
| 4 | Live egress allowed and denied (x2, including IPv6); live crash reap; live dispatcher exec; live policy acceptance and hung-exec timeout | 04-VERIFICATION.md items 1 to 5 | /gsd:verify-work 4 |
| 5 | Live autostart within budget; live overrun settle; live status rendering and the 2 s poll; live retry; live required-mode refusal and bypass probing; live MCP client drive; live ACP client drive via realm acp | 05-VERIFICATION.md items 1 to 7 | /gsd:verify-work 5 |
| 6 | Live up, status, down cycle; live Podman-missing run; live doctor (agentos item); live realm mcp and realm acp from a host; snippet copy-paste in five hosts; live socket permissions | 06-VERIFICATION.md items 1 to 6 | /gsd:verify-work 6 |
| 7 | Podman 5.x hardening field paths and egress; Omp hook fail-closed (OQ-P5-01, OQ-P5-02); MCP and ACP client behaviour; supply-chain reproduce steps and three release decisions (S-1 appears addressed by engines >=22.13.0, not re-reviewed; S-4; S-5); advisory default decision (security 8.2) | 07-VERIFICATION.md items 1 to 5 | /gsd:verify-work 7 |
Open security items (the review does not close them):
- G-09 (OMP-05): security 5.3, advisory unbound writes proceed with only a warning; disclosure required. 5.4, OQ-P5-02:
writeandeditguard is the only control, with three bypass paths unproven. - G-10 (FS-02): security 5.2, the pinned root is still a path. Create-time verification exists (
verifyPinnedAt), but per-operation I/O re-resolves the path. - 5.1 partial: the advisory half is open (see G-09).
- 5.6 teardown: five open items (plugin fire-and-forget shutdown, replacement-session race, no shutdown guarantee). Not re-verified in this pass, although the plugin shutdown timers are covered by G-05.
- 5.5 residual R7: policy root breadth is not checked (
/is accepted). - 5.7 LOW-02: ACP null-id parity, open and low.
Non-critical tech debt and bookkeeping (not gaps):
05-VERIFICATION.mdmanifest entry saysplugin.js; actual isextension.js(also05-REVIEW.md:386).05-VERIFICATION.mdLimitation (f) is stale (security section 7).04-VERIFICATION.md"no in-src caller" is stale (L3).06-VERIFICATION.mdandtest/doctor/control-channel.test.ts:94title says "eight items" while the registry has nine.- ANDA-04 traceability is Partial without a live gate (see section 1).
- ROADMAP plan checkboxes for phases 3 and 4 are unchecked although the work is executed. ROADMAP "Plans: TBD" for phases 5 and 6, though summaries exist.
- STATE.md "Deferred Items" table reads "(none)" while "Deferred Verification" lists five phases. These should be recorded before archive.
- Security review section 8 items 1 to 8 are recommended before release, none implemented.
- STATE.md Pending Todos: ensure-expiry reason text; detached daemon log file; client reply size cap; Omp no-logic header comment; complete DaemonStatus fixture; recursive mkdir ancestor mode; codebase-wide typed-lint pass.
- Supply chain: S-4 (Anda licence conflict blocks vendoring Anda code); S-5 (no
LICENSEfile, nolicensefield). - Phase 1 ROADMAP note "tooling format gap" is informational. No format script exists, and FOUND-01 does not require one.
realm acpandrealm mcpshare the same attach path. Neither has a live client run recorded.
5. Gap register (re-audit against the working tree)
Status key: CLOSED means the claim was read in code and the named test exists. OPEN means the claim does not hold or its residual remains. Evidence is the file and test that were read.
| Gap | Requirement | Status | Evidence | Residual |
|---|---|---|---|---|
| G-01 | RT-04, RT-03, OMP-01, CLI-01 | OPEN (blocker; user decision) | No concrete AgentOsDriver in src/ (interface only, src/runtime/agentos.ts:22). Daemon binds none (src/daemon/main.ts, src/daemon/daemon.ts:157-162). requireAgentOs throws AGENTOS_NOT_CONFIGURED (src/runtime/session-execution.ts:208-210). Unchanged. | Decision: bind a driver or accept as a follow-up milestone. |
| G-02 | CLI-01 | OPEN (blocker; follows G-01) | realm up never reaches active: src/cli/main.ts:459-476 exits 1 on any non-active state. Surface gaps (G-03, G-07) are closed. | Closes when G-01 is decided and up reaches active on the production path. |
| G-03 | TOOL-05, QUAL-02 (L6) | CLOSED | src/acp/stdio.ts:9-15 (runAcpOverStdio); realm acp in CLI_COMMANDS (src/cli/main.ts:37) and dispatched (:518-520); runAcp (:453-476) attaches with up and serves stdout as protocol frames only. Tests: test/acp/stdio.test.ts:44 (initialize, then realm/tool RealmError answered with code, message, and causeCode); test/cli/cli.test.ts:599 (serves and writes only frames), :648, :675, :697 (exit 1 paths). | Reachable through the bin. Exits 1 in production until G-01 closes. Live ACP client run not done. |
| G-04 | QUAL-01 | OPEN (residual) | Controller closed: no .catch(() => undefined) in src/lifecycle/controller.ts; orphanFailure, causeCode, and REALM_STOPPING with cause in place (controller.ts:112-114, 420-439, 666-698, 744-758). Tests: test/lifecycle/teardown-failures.test.ts:76-165, test/lifecycle/create-interrupt.test.ts:393. CLEANUP_FAILED cause: src/fs/canonicalize.ts:191-197, src/fs/atomic-write.ts:76-82, tests test/fs/canonicalize.test.ts:266 and test/fs/atomic-write.test.ts:197. | Section 6 lists 10 silent sites across src/. Close by giving each a code or cause, or by amending QUAL-01 to name the documented exceptions. |
| G-05 | OMP-02, OMP-03 (L9) | CLOSED | One status item (src/omp/plugin.ts:138-148). 2 s poll armed at session start (:112-114, 331-334). Shutdown clears the poll and timers (:187-205, :340-342). Tests: test/omp/plugin.test.ts:494-569 (transition on poll, no stacked reads, failed poll paints once, no paint after shutdown) and :701-748 (poll cleared on shutdown, not cleared while attached). | Residual sits on the requirement rows, not the gap: OMP-03 tooltip wording (P5-D5) and up-to-2 s latency. Not verified live. |
| G-06 | CLI-03, RT-04 (L8) | CLOSED | src/doctor/checks.ts:588-632 (agentOsCheck: unbound gives fail AGENTOS_NOT_CONFIGURED; live gives pass; not live or probe throws gives fail AGENTOS_CRASH_LOOP). Daemon supplies the reading (src/daemon/daemon.ts:183-190). Tests: test/doctor/control-channel.test.ts:200-262 (no daemon, live, not live, probe throws, unbound). | No test asserts the daemon's own unbound reading (daemon.ts:183-184). Item-level cases do. Live doctor not run. |
| G-07 | RT-06, OMP-01, CLI-01 (L4) | CLOSED | readHostRuntime is the one resolver (src/runtime/host-paths.ts:36-44). resolveStateDir is absent from src/ (grep). Callers: src/cli/main.ts:491, src/daemon/main.ts:48, src/omp/extension.ts:37. XDG_STATE_HOME is not read anywhere in src/. Tests: test/runtime/host-paths.test.ts:42-70 (state dir from config whatever XDG_STATE_HOME names; missing or relative config is SCHEMA_INVALID), test/omp/extension.test.ts:83 (decoy socket under XDG_STATE_HOME is not dialled), test/cli/cli.test.ts (unreadable config exits 2 before any dial). | None for the gap. The config file is now required for every command (exit 2 without it). That is a behaviour change to note for the user. |
| G-08 | TOOL-05, TOOL-01, TOOL-03 (L5) | CLOSED | src/mcp/server.ts:150-160 (realmErrorResult: code, message, retryable, causeCode). src/acp/agent.ts:84-92 (realmErrorData). src/daemon/client.ts:124-127 (reply to RealmError with code and causeCode). src/daemon/channel.ts:200-212 (decode accepts only code and causeCode, validated). Tests: test/mcp/server.test.ts:203, test/acp/agent.test.ts:235, test/daemon/client.test.ts:262-297 (cause kept; no causeCode property without one), test/daemon/channel.test.ts:201. | Non-RealmError paths still get no catalogue code on MCP (-32603) or ACP (section 6, sites 4 and note A). |
| G-09 | OMP-05 | OPEN (user decision) | Unchanged: advisory path notifies and lets the write proceed (src/omp/plugin.ts:432-448). Security 5.3 and 5.4 (OQ-P5-02) open. | Decision: disclosure and the advisory default (security 8.2), plus proof of the three bypass paths. |
| G-10 | FS-02 | OPEN (narrowed) | verifyPinnedAt (src/fs/root.ts:63-80) checks device, inode, and the /proc/self/fd real path, and is called at src/lifecycle/controller.ts:186. Tests: test/fs/root.test.ts:73-110. | The pinned root is still a path (src/fs/root.ts:13-22). Verification closes its descriptor before returning, so a swap after return is not caught. Each read, write, list, and tool call re-resolves the path (src/fs/read.ts:42, src/fs/canonicalize.ts:216). Close by holding a descriptor in PinnedRoot or re-checking device and inode per operation. |
6. QUAL-01 catch sweep (silent sites)
Method. grep for catch across src/ gives about 125 occurrences in 31 files, including comment mentions. Every catch body that was not a plain rethrow was read. Promise handlers were listed with .catch(, .then(undefined, then( with a rejection callback, and .finally(. A PCRE scan for empty and comment-only catch bodies found none. Classification: rethrows, returns a typed result, records the cause, or silent. Silent means the error is dropped or replaced with no code or cause, or the body is empty or comment-only.
Silent sites (10). Each is deliberate unless marked otherwise, and none records a code or cause.
src/anda/client.ts:457:catch { failed = true; }around a listener call. The listener error is dropped. The event is kept undelivered for redelivery (F2, F3). Deliberate.src/anda/client.ts:451:result.then(undefined, () => {...})drops a listener rejection. It sets the event undelivered. Same rule as site 1. Deliberate.src/anda/client.ts:488-489:stamp()catch returns null when the injected clock throws. The clock error is dropped. The transition stays unstamped until the clock works (site 448 rule). Deliberate.src/mcp/server.ts:176:catchincallTool. A non-RealmError from the dispatcher becomes{ code: -32603, message: "Internal error" }. The error is not recorded, with no catalogue code, cause, or diagnostic. Not documented. This is the clearest silent site.src/lifecycle/controller.ts:330:return this.enterError(error). When a stop or destroy already owns the session, the probe error is not recorded (F4). When the session is still in service, the error is recorded with its code. Conditionally silent, documented.src/lifecycle/controller.ts:710-716:stopStarted. Whenexec.stopfails and the fallbackexec.destroysucceeds, the stop error is dropped with no code. Deliberate recovery; the stop failure leaves no trace.src/omp/plugin.ts:253: superseded attach. The late rejection ofpendingis dropped (() => undefined). Its client is closed on success. Deliberate.src/omp/plugin.ts:258: attach that the budget already failed. The late rejection ofpendingis dropped. The budget code was recorded when the race rejected (plugin.ts:246-259). Deliberate.src/daemon/channel.ts:105-122(replyForMalformedLinereturns null when no id is recoverable, comment at:105-107) withsrc/daemon/daemon.ts:376-378and:397-399(null leads todropSocket,daemon.ts:244-250): a malformed line with no recoverable id gets no reply and no diagnostic. Silent by design. The rule is in code and in.planning/phases/06-cli-daemon-and-host-packaging/06-01-SUMMARY.md:104. It is not indocs/integration/runtime-decision.md. The client-side mapping of a closed socket was not read in this pass.src/audit/redact.ts:46-49:redactValuecatch returns the REDACTED sentinel. The error text is withheld because it may carry a secret (fail-closed). Deliberate.
Not counted as silent, noted for completeness:
- Note A,
src/acp/agent.ts:178-186: a non-RealmError reply isINTERNAL_ERRORwith the message "tool dispatch failed" and no catalogue code. It writes the error message to stderr, so the cause is recorded there. Typed reply is absent. src/anda/client.ts:255: monitor rejection recordsANDA_UNREACHABLEas bridge state. Typed.src/omp/plugin.ts:246,:281: failure recorded as its code (REALM_NOT_ACTIVEorOPENSHELL_START_FAILEDby default).src/daemon/daemon.ts:425: unexpected rejection becomes a refusal reply withcodeOf(SCHEMA_INVALIDfor non-RealmError).src/runtime/session-execution.ts:287: a non-ESRCH kill failure is turned into a boolean, and the caller reports a typedfailedoutcome (:362-366).src/fs/canonicalize.ts:191-197: a failed descriptor close is kept as CLEANUP_FAILED, the cause of the verification code.src/fs/root.ts:98-124: each lookup failure becomes POLICY_DENIED. The errno is dropped but a code is always thrown.src/core/events.ts:46-55: listener failures are rethrown after every listener has run.src/omp/extension.ts:25,:52,src/tools/dispatch.ts:122,:243,src/tools/workspace.ts:140,src/cli/main.ts:281: rethrow, or record and rethrow.
Result for QUAL-01: the controller and filesystem catches that the previous audit named now carry codes or causes. The repo-wide rule still has the 10 sites above.