feat(track-a): harden P1 bridge health and recovery

[blakinio]

SUPERSEDED by fresh-current-main replacement PR #372.

This source branch reached the accepted P1 semantic implementation at head 9ddab031da32c69c55dd2f6940583c2523f00c06, with zero open material semantic findings and successful repair/component evidence (31947189849, 31947285170, 31947365151). It is closed unmerged because direct freshness comparison against main@dbd9520e2f8cc5a26f556bffaae2a83e139615f9 proved it was ahead 32 / behind 6; merging the stale history is not an acceptable promotion path.

PR #372 replays all accepted implementation/test blobs byte-for-byte on current main and preserves the coordinator-serialized shared indexes with compare-proven +1/-0 deltas. Continue P1 promotion only through #372.

The later source-branch CMake failure was GitHub HTTP 429 while cloning the Boost mirror and is retained as infrastructure evidence only. Current physical runtime nonclaims remain :98 UNKNOWN, 6082 UNKNOWN, exact PID/session NOT_REGISTERED. No physical runtime authority is transferred by this closeout.

[blakinio]

Coordinator independent review outcome on exact head edcc3f85bbe084667cb89024b54cd3ab79185809: ACCEPT_WITH_EDITS, not yet promotable.

Verified positives: exact-head Track A governance 31944372661 = SUCCESS; exact-head repository CI 31944372746 = SUCCESS; no review threads; health.py consumes only explicit BridgeBinding, rejects generation/process/endpoint changes, and recovery has no launch/login/restart/signal/attach/client-mutation capability; session-status remains DERIVED_UNTIL_LIVE_CORRELATION.

P1-COORD-001 — REQUIRED REPOSITORY INTEGRATION DOCS. This PR creates the reusable tools/tibia_runtime_bridge/** integration/public lifecycle contract but does not update docs/agents/MODULE_CATALOG.md or docs/agents/CHANGELOG.md. Current main's catalogue explicitly requires same-PR updates for reusable integration contracts. Do not merge without those records and fresh exact-head checks.

P1-COORD-002 — REQUIRED AUTHORITY WORDING. Preserve the distinction that the IPC/discovery API is read-only, while activation through launcher.py uses LD_PRELOAD and is invasive process instrumentation. P1 health/recovery must never interpret 'read-only bridge' as authority to launch/inject/attach on the physical runtime; activation remains RUNTIME-owned under admission/Gate A/rebind/Gate B/bootstrap.

Ownership note: the needed shared MODULE_CATALOG.md / CHANGELOG.md paths are currently explicitly owned by still-open PR #23. Do not create a concurrent writer. Keep #357 Draft until the coordinator can serialize those shared-index edits safely; code implementation itself is accepted subject to the edits above and later physical correlation being RUNTIME evidence, not a merge prerequisite for this hosted internal producer.

[blakinio]

Fresh P1 semantic audit — material findings open

Reviewed exact Draft head edcc3f85bbe084667cb89024b54cd3ab79185809 against the current P1 alias, canonical registration/Gate-B contracts and the separate Draft #360 transition work. I am not changing this branch or promoting it.

MATERIAL 1 — bridge endpoint is not bound to the declared runtime identity

BridgeSession repeatedly verifies that the producer continues to return the same BridgeBinding (RuntimeIdentity + socket pathname), but the actual PING response from bridge.cpp contains only ok, command and main_base_resolved. Therefore a stable binding object does not prove that the process currently answering that Unix-socket pathname is the registered boot/PID/start/exact-profile identity.

A same-path endpoint replacement is sufficient to demonstrate the gap: if the old socket is unlinked/rebound by a replacement helper/client while the admitted binding source has not yet advanced its registration, _identity_guard() still sees the same declared binding and probe() can accept PING + derived session-status from the replacement process as HEALTHY. The existing before/after binding-source checks do not observe peer process identity. The same issue can mix separate DISCOVER connections during session_status() if the pathname is rebound between requests.

This is a correctness/TOCTOU issue even under the cooperative same-UID governance model; no hostile-user assumption is needed.

Required before promotion: bind the IPC response/channel to the registered exact runtime, then regression-test same-path replacement. A suitable Linux-native design is to verify the Unix peer PID (SO_PEERCRED) against RuntimeIdentity.pid and additionally bind process-start/exact-profile evidence (for example identity fields in PING, checked against the accepted registration). Equivalent fail-closed proof is fine. Do not infer identity merely from socket reachability/path stability.

MATERIAL 2 — discovery scan failure can be reported as healthy zero-hit state

bridge.cpp::findVptrHits() returns an empty hit list when open("/proc/self/mem", ...) fails, and per-region pread() failures are skipped without a scan-status signal. DISCOVER then returns ok:true with zero hits. session_status() treats those structurally valid zero-hit replies as ok:true, and BridgeSession.probe() can therefore return HEALTHY / bridge_ready=true with in_game_candidate=false even when the discovery mechanism itself is unavailable rather than merely observing a legitimate logged-out/zero-object state.

That conflicts with the documented health meaning that a healthy result has an operational bounded read-discovery path and that a non-ready read-discovery path should be DEGRADED/failure-classified.

Required before promotion: make scan/read failure explicit and fail closed (for example a typed DISCOVER error/scan-status that propagates through session_status() to health), while preserving zero validated hits as a legitimate successful scan. Add a deterministic regression that distinguishes scan succeeded, zero hits from scan unavailable/read failed.

Integration note — current-authority input remains external

Draft #360 can provide the separately governed current Gate-B registration proof, so I am not treating lack of host discovery inside P1 as a defect. However the eventual adapter must pass only a current Gate-B-approved binding; raw BridgeBinding.from_registration(...) by itself does not prove current lease generation/freshness.

Governance cleanup

The task record still leaves Final exact-head repository CI/checks unchecked even though the PR body records exact-head successful runs 31944372661 (Track A governance) and 31944372746 (repository CI). Reconcile that durable task checkbox/checkpoint on the final implementation head, then rerun exact-head checks after any semantic fix.

Audit result: MATERIAL_FINDINGS_OPEN=2; DRAFT_NOT_PROMOTED remains correct. Current runtime nonclaims remain unchanged (:98 UNKNOWN, 6082 UNKNOWN, PID/session NOT_REGISTERED).

[blakinio]

P1 continuation handoff — semantic findings repaired

The canonical P1 task/branch was safely resumed after its prior checkpoint exceeded the repository stale threshold. No duplicate PR was created.

Material findings from #5307270868

RESOLVED — endpoint/runtime identity binding. The P1 lifecycle transport now verifies every Unix IPC connection against the explicit admitted identity using Linux SO_PEERCRED plus current boot-ID hash, /proc/<pid>/stat process-start ticks, and exact peer executable size/SHA-256. PING also carries boot/PID/start/version/size/SHA identity fields and BridgeSession compares them with the accepted RuntimeIdentity; peer/envelope mismatch is STALE_IDENTITY and discards the cached binding. session_status() passes the exact expectation to every separate DISCOVER connection, so same-path rebinding between marker requests fails closed.

RESOLVED — scan failure vs legitimate zero hits. bridge.cpp now has explicit scan result/error states. /proc/self/maps and /proc/self/mem open/read/short-read failures return ok:false; only a completed scan returns scan_status:"OK", including a legitimate zero-hit result. session_status() additionally requires the expected target and scan_status:"OK" before consuming validated_hits.

Regression / build evidence

• 31947189849 on da6d8f5127d5b645e573cb00ba764de72c818fba = SUCCESS — Python compile/focused suite + standalone Qt bridge build.
• 31947285170 on 1ffc2344feb269442a2b4ce7a4d2adefccef2891 = SUCCESS — same-path replacement regression without assuming PID non-reuse + standalone build.
• 31947365151 on semantic implementation head bf0fe057c5f320508dc7c9f0e5f2a55c2c3e1448 = SUCCESS — final focused suite/build including explicit successful-scan protocol regression.
• Temporary validation workflow has now been removed from the branch; current branch head after durable task checkpoint + workflow cleanup is fe37b80423d7cc8b269cd58edc19a2795e01e381.

Fresh exact-source audit result: MATERIAL_FINDINGS_OPEN=0 for the P1-owned implementation paths.

Coordinator edits

P1-COORD-002 is complete in tools/tibia_runtime_bridge/README.md: IPC/discovery is read-only, while launcher.py/LD_PRELOAD activation is invasive process instrumentation and exclusively RUNTIME-owned.

P1-COORD-001 remains an ownership serialization issue, not a code defect: open Draft PR #23 still changes docs/agents/MODULE_CATALOG.md and docs/agents/CHANGELOG.md. I have not raced those shared paths. Current main has also advanced to ddf7dd9408116fbeaca05bfeb69663f30f7cd34f; final main refresh + exact-head normal governance/CI should occur after the shared-index write is serialized.

Runtime nonclaims remain unchanged: :98 UNKNOWN, 6082 UNKNOWN, PID/session NOT_REGISTERED. No Synology/runtime access, bootstrap/login/restart/attach/mutation, owner Codex quota, OpenAI API token, or owner-funded AI quota was used.

[blakinio]

Coordinator final review — ACCEPT / PROMOTION_AUTHORIZED

Reviewed unchanged candidate head 9ddab031da32c69c55dd2f6940583c2523f00c06 against current main@dbd9520e2f8cc5a26f556bffaae2a83e139615f9.

Exact-head/current-base proof

• GitHub synthetic merge commit is 48467346ac9a4e14ef95a0811415b328d82ea165, explicitly Merge 9ddab031... into dbd9520e...; final PR CI therefore exercised the current-base merge ref rather than relying on the stale REST base_sha snapshot.
• Track A canonical live governance 31947837496 = SUCCESS on exact head 9ddab031....
• Track A agent runtime governance 31947837571 = SUCCESS on exact head 9ddab031....
• Repository CI 31947837633 = SUCCESS on exact head 9ddab031... / current-base merge ref 48467346....
• No unresolved review threads.

Semantic/integration audit

• Both material findings from #5307270868 are closed: exact Unix peer/process/executable binding plus matching PING identity envelope; explicit scan success/failure with successful zero-hit distinguished from scanner failure.
• Dedicated hosted semantic/build runs 31947189849, 31947285170, 31947365151 all succeeded; the last validated semantic implementation head is bf0fe057c5f320508dc7c9f0e5f2a55c2c3e1448.
• Comparison from that validated semantic head to final 9ddab031... changes no tools/** or tests/** implementation: only removal of the temporary validation workflow, the two serialized repository-index records, and durable task metadata.
• P1-COORD-001 and P1-COORD-002 are complete. MODULE_CATALOG.md and CHANGELOG.md each add exactly one narrow P1 record after merged serialization PR docs(track-a): serialize shared indexes for P1 closeout #370; authority wording explicitly keeps LD_PRELOAD activation RUNTIME-owned.
• Fresh P1 audit result: MATERIAL_FINDINGS_OPEN=0, COORDINATOR_EDITS_OPEN=0.

Boundary

Physical P1 E2E is NOT_APPLICABLE_WITH_REASON for this GitHub-hosted producer (runtime_access:none). Physical attach/reacquisition/restart/relogin remains exclusively RUNTIME-owned and is not a merge prerequisite for this internal P1 producer. Current physical nonclaims remain :98 UNKNOWN, 6082 UNKNOWN, PID/session NOT_REGISTERED.

No Synology/live runtime, login, X11/VNC, client mutation, credentials, owner Codex quota, OpenAI API token or owner-funded AI quota was used.

Coordinator disposition: PROMOTION_AUTHORIZED. Convert #357 from Draft and squash-merge only if head remains exactly 9ddab031da32c69c55dd2f6940583c2523f00c06 and main remains the validated dbd9520e2f8cc5a26f556bffaae2a83e139615f9.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[blakinio]

COORD outcome: ACCEPT on exact head 9ddab031da32c69c55dd2f6940583c2523f00c06, subject to the already-running final protected CI gate only.

Independent coordinator re-audit covered the delta from previously audited edcc3f85bbe084667cb89024b54cd3ab79185809 through the current head, including bridge.cpp, health.py, ipc_client.py, tests, README, and the serialized shared-index additions. Result: MATERIAL_FINDINGS_OPEN=0.

Verified properties:

• every lifecycle IPC connection binds to explicit admitted peer identity via Linux SO_PEERCRED, boot identity, PID/start ticks and exact executable size/SHA;
• PING must match the exact identity envelope; stale/replaced peer fails closed and binding is discarded;
• /proc scanner failures remain explicit failures and cannot masquerade as successful zero-hit discovery;
• session-status remains DERIVED_UNTIL_LIVE_CORRELATION;
• read-only IPC/discovery is clearly separated from RUNTIME-owned invasive LD_PRELOAD activation;
• merged coordinator PR docs(track-a): serialize shared indexes for P1 closeout #370 (dbd9520e2f8cc5a26f556bffaae2a83e139615f9) legally serialized only MODULE_CATALOG.md + CHANGELOG.md to P1; feat(track-a): harden P1 bridge health and recovery #357 adds exactly one scoped record to each and preserves unrelated content;
• no physical runtime authority/evidence is claimed by this hosted producer; current :98, 6082, PID/session remain UNKNOWN/NOT_REGISTERED unless RUNTIME proves otherwise;
• review threads: 0.

Exact-head checks already green: Track A canonical-live governance 31947837496, Track A agent runtime governance 31947837571, repository CI 31947837633. Final Ready-generation CI 31947967363 is still in progress at this coordinator observation. Protected auto-merge may promote only if that final gate succeeds and the head remains unchanged.

[blakinio]

Coordinator disposition: SUPERSEDED by fresh-main exact replay PR #372. The accepted semantic implementation/evidence remains provenance for #372; this stale branch must not be promoted directly.