docs/agent-control-verification.md

Rama main · réplica de lectura del repositorio original.

# Agent control verification

Verification date: 2026-10-08, Asia/Kolkata. Platform base: `b4bc4bb43e5fb3fe39099805fbc8ea2ece44007e` (alpha.57).

This record separates source coverage, automated checks, native development acceptance and publication.
The feature changes are not yet merged or released. The website agent guide was published separately with released and in-development capabilities labelled.
Oracle Free query acceptance now passes for the pinned 23.26 standalone configuration. The failed Oracle runs below remain as historical evidence.

## Contract and interface coverage

The OpenAPI contract contains 329 operations:

| Interface classification | Operations |
| --- | ---: |
| Generic scoped invocation | 171 |
| Separate installation invocation | 78 |
| Dedicated workflows | 33 |
| Human or protocol prerequisites | 47 |
| Unclassified | 0 |

The generated inventory found 368 literal dashboard calls and no unmatched literal contract routes.
Dynamic calls and alternate transports require manual review. Counts do not prove native or production parity.
The Go source inventory accounts for 341 literal API route declarations: 327 match OpenAPI and 14 have explicit exclusions.
CI rejects a new literal route without a contract or documented exclusion. Multiplexed and dynamic routes require separate review.

Contract SHA-256: `2b7e8201c86ba68c315131ce2ae683950a0650110e22a19c72819e74c625ea54`.
See [the inventory](agent-parity/coverage-matrix.md), [generation process](agent-parity/contract-generation.md) and [connection workflows](agent-parity/connection-workflows.md).

## Implemented boundaries

| Requirement | Implementation and evidence |
| --- | --- |
| One contract | OpenAPI supplies the shared Go operation catalog, TypeScript types and generated dashboard proxy routes. Discovery returns schemas and the contract hash. |
| Explicit authority | Go checks current credentials, role, scope and resource ownership. Project, installation and host-only connections have separate authority boundaries. |
| Separate opt-ins | Generic writes, deployments, pod commands, SQL reads/writes, terminals, administration and credentials require their corresponding grants and options. |
| Credential control | `x-hakopod-agent` metadata supplies credential requirements to shared and Cloud checks. Write access does not imply credential access. Secret responses use no-store caching. |
| Reviewed writes | Database writes require a reviewed resource revision. Platform operations retain canonical plan, review, revision and retry-key checks. |
| Exact values | Pod output uses base64. SQL null remains JSON null. Query cells use text. CLI/MCP JSON decoding preserves integers above 2^53. |
| Bounded work | Pod commands and SQL each have four process-wide slots and a 20-second deadline. Pod output is capped at 64 KiB per stream. SQL caps results at 1,000 rows and 1 MiB. |
| Bounded terminals | Sessions have bounded input, output retention, duration and idle time. Polling uses exact decimal cursors and reports missed retained output. Trusted product scopes survive creation requests. Active streams recheck current keys, product authority and required permissions. |
| Accurate uncertainty | Disconnected pod commands do not claim process termination. SQL reports unknown unless the final result or rollback is confirmed. No automatic command or query retry is added. |
| Current Cloud authority | Workspace identity, current role, delegated credential and node credential restrictions intersect. Delegated callers cannot approve their own requests. |
| Sensitive evidence | Audits omit command bodies, SQL, parameters, database credentials and result rows. No fixture evidence establishes production behavior. |

## Automated checks

All compilation and artifact-producing tests in this continuation ran on bounded VM snapshots or CI runners.
Source edits, source generation, formatting and inspection ran locally. Snapshots copied files and did not hard-link mutable source.

| Snapshot or unit | Result and scope |
| --- | --- |
| `hakopod-agent-readonly-final` | Platform production build, typecheck, 72 server/library tests, 238 UI tests and 55 SDK tests passed. Includes capability-driven read-only UI and unavailable-scope refusal. |
| `hakopod-agent-final-descriptions` | Final OpenAPI/proxy generation and exact SDK generation check passed after agent-language corrections. |
| `hakopod-agent-interface-final-v2` | Earlier full Go run passed except an obsolete unsupported-MySQL assertion. Corrected cluster tests passed separately. Later rollback changes require a fresh full run. |
| `hakopod-agent-bcf36b48-full-go` | Full `go test -count=1 -p=1 -timeout=20m ./...` passed on the committed archive and exact templates submodule. Later terminal changes require separate checks. |
| `hakopod-agent-terminal-runtime-v5` | Focused scope, stream guard, terminal authority, polling and buffer tests passed. |
| `hakopod-agent-terminal-final-v8` | Focused race tests and native terminal polling passed in 104.264 seconds. Includes explicit machine grants, runtime narrowing, product revocation and confirmed namespace cleanup. Later CLI consent and attachment changes require a separate result. |
| `hakopod-agent-terminal-final-v9` | Focused race tests passed in 122.325 seconds. Includes current CLI/machine grants, administrator wildcard rejection, active grant removal, attachment failures and SQL authorization. Native terminal input/output, exit, product revocation and namespace cleanup passed in 75.96 seconds. The first input request succeeded immediately after the first poll, without retry. |
| `agent-cli-terminal-poll-20261008` v3 | CLI polling protocol tests passed in 0.192 seconds. Covers cursor progression, output bounds, truncation, exit status, input readiness, rejected input and DELETE cleanup. |
| `agent-cli-terminal-outcome-v4-20261008` | CLI polling tests passed in 0.171 seconds. Invalid remote exit codes report an unknown process outcome. Valid exit codes remain unchanged. |
| `agent-sql-grants-final-20261008` | SQL API authorization and scope tests passed in 2.039 seconds. Writes require both current SQL grants. CLI and machine administrator wildcards cannot replace either grant. |
| `hakopod-sql-execution-mode` and columns outcome v2 | All five focused driver tests passed after explicit nontransactional execution and column-failure outcome fixes. Read-only requests retain server-enforced transactions. Nontransactional failures do not claim rollback. |
| `agent-route-inventory-20261008` | Source inventory and three drift-check regressions passed. Covers new routes, missing exclusion reasons, obsolete exclusions, documented exclusions and comments. |
| `agent-contract-schema-v3` | Full operations suite passed in 5.406 seconds. The compiled JSON Schema validator covers unions, exact one-of semantics, conditionals, references with sibling constraints, exact numeric bounds, Unicode length, collections, closed object extensions and open webhook payloads. External schemas are refused. Error redaction and independent input bounds passed. Dashboard and SDK types were regenerated with openapi-typescript 7.13.0. |
| `agent-contract-paths-v4` | Full operations suite passed in 6.136 seconds. Every route variable has one required path declaration. Generation rejects duplicate and invalid declarations. Dashboard and SDK types were regenerated with openapi-typescript 7.13.0. |
| `agent-contract-summaries-v5` | Full operations suite passed in 2.885 seconds. All 328 operations have explicit action summaries. Generation rejects missing or obsolete summary entries. Independent source review checked action semantics, asynchronous outcomes and credential wording. Dashboard, SDK and editor schemas were regenerated on the VM. |
| `agent-contract-summaries-v6` | Full operations suite passed in 1.997 seconds after clarifying queued notifications, proxy changes, database bindings and volume resize actions. Dashboard, SDK and editor schemas were regenerated on the VM. |
| `agent-catalog-semantic-v2` | Full operations package tests passed in 2.280 seconds. Discovery preserves the OpenAPI summary and description in operation pages and details. Absent descriptions remain absent. |
| `agent-dashboard-drift-20261008` | The dashboard regeneration command and exact generated-file comparison passed on a disposable VM snapshot. CI now rejects changes to dashboard API types or editor schemas that were not regenerated. |
| `agent-oracle-decoder-limits-v5` | Nine adversarial decoder tests passed. The query-only receive limit checks packet lengths and accumulated values before allocation or append. It also limits cumulative wire reception. Management connections retain the upstream default. Six SQL and receive-limit mapping tests passed separately. Native Oracle execution remains separate. |
| `agent-oracle-private-diagnostics-v3` | Driver tests passed in 0.003 seconds and network receive-limit tests passed in 0.005 seconds. A synthetic nonempty warning decoded and consumed exactly its frame without standard output or standard error. Independent review confirmed that removing unconditional diagnostics preserves protocol consumption and returned errors. Manifest SHA-256: `0cd9d50af447ec30d2d3d89fc944deca7e49b3cfe5b796b675dbe23cdbf66205`. |
| `agent-oracle-null-v1` | Driver tests passed in 0.007 seconds and network tests passed in 0.005 seconds. Three new tests exercise the actual NULL decoder, subsequent field alignment, stale value removal, receive limits and rejection of nonempty NULL fields. Independent review checked the narrow upstream backport and the additional rejection. Manifest SHA-256: `b2c008ec3778456713370b4ea1395287f1b968d9bee3e7b85db6b726e0851039`. Native Oracle acceptance remains separate. |
| `agent-oracle-query-final-compile-v2-20261008` | The native test compiled with its execution gate unset in 0.022 seconds. Cancellation now requires observed server execution and a pending result before cancellation. The result must report a conservative outcome within five seconds. Autonomous-function persistence checks remain intact. Test and fixture logs omit raw backend errors and result bodies. Native execution remains separate. |
| `agent-oracle-mode-v2-20261008` | Focused SQL driver, rollback, execution-mode, Oracle guard and receive-limit mapping checks passed in 0.056 seconds. Native acceptance compiled with its gate unset. Oracle refuses read-only and transactional requests before runtime access. The candidate advertises no transaction guarantee. Native execution remains separate. |
| `agent-mysql-rollback-final-v6-20261008` | The SQL driver and rollback suite passed in 0.045 seconds on a complete frozen snapshot. Cluster vet passed. MySQL rollback checks the server warning count before releasing the transaction. Any warning, failed diagnostic or failed release reports `unknown`. A native persisted-write positive control remains separate. |
| `agent-mysql-persistence-v1-20261008` | The native control passed in 421.15 seconds. In one fresh disposable fixture, a MyISAM write persisted and the production rollback helper reported `unknown`. The InnoDB control reported `rolled_back` and persisted no row. Normal cleanup completed, with namespace, pods, PVCs and backing PV absence confirmed. The earlier gate-unset compilation and driver tests passed in 0.043 seconds. |
| `agent-myduck-query-v6` | Focused cluster checks passed in 0.722 seconds. API error mapping passed in 0.399 seconds. The adapter rejects multiple statements and ambiguous string/comment syntax before Kubernetes access. Bound values retain their original content. Native execution remains separate. |
| Vitess selector v12 | Focused checks passed in 0.286 seconds. Spec comparison permits only the pinned CRD defaults `equal.hexWidth=0` and `tabletPools[].name=""` when absent. Nondefault values, wrong types and unrelated fields remain rejected. Native gateway selection remains separate. |
| `hakopod-agent-sql-postrows` | Driver regressions passed for authority loss after write-authorized row queries. Confirmed rollback reports `rolled_back`; failed rollback reports `unknown`. |
| `agent-scope-delete-v5-20261008` | PostgreSQL scope tests passed in 14.877 seconds, API tests in 3.202 seconds and the full operations package in 3.110 seconds. Covers replacing empty demo after setup, browser management authority, machine denial, confirmation, retained history, failed resurrection, resource-insertion races, scope grants, key revocation and retired IDs. Personal development remains protected, while additional personal environments can be removed. Generated contract drift was empty. No Kubernetes behavior changed. |
| `hakopod-scope-proxy-parity-v17` | All 73 dashboard server/library tests passed on the VM in 7.815 seconds. Fresh CI exposed a missing environment-detail proxy route. The exact route is now allowed. Regression requests verify sealed-session authentication, same-origin enforcement, confirmation-body forwarding and rejection of deeper unrelated routes. |
| `agent-sql-ready-final-v15` | Dashboard typecheck, 240 UI tests and the production client/SSR build passed. Browser checks verified keyword completion, warning markers, F8 diagnostic details, warning removal after correction, repeated edits, blank input and Escape focus on Parameters. One local worker retains at most one active request and the latest pending request. Startup has a 10-second limit after wrapper import; parsing has a separate two-second limit. The built worker is 3,762,880 bytes before compression. Its SHA-256 is `a9069065e2d869fbc379d628565007b2ed346586def6f53e449d208c7c371a0e`. Final visual coverage is recorded separately. |
| `agent-oracle-isolated-native-v1-20261008` | The isolated diagnostic harness completed in 1073 seconds. Bound NUMBER and typed NULL succeeded. Bound NUMBER plus NULL failed during the direct query with static classification `ttc_response_code_3`; the production adapter reported `database_query_failed` with an unknown outcome. Untyped NULL returned no row through the direct path. Early adapter probes also reported pre-execution unavailability. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Diagnostic completion does not qualify Oracle query support. |
| `hakopod-oracle-static-native-v1` | The tagged metadata diagnostic completed in 920.61 seconds. Bare NULL arrived as a character column with zero maximum length and produced no row. NUMBER plus bare NULL failed; typed numeric NULL returned a row. The evidence identifies a different path from the upstream type-0 decoder. Events contain only allowlisted stage, type, size and source fields. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Snapshot manifest SHA-256: `fbf166b9e57fc693d827ab1f250b51f49b48d03da5bb8aebc706f0dad7ea4b6b`. This diagnostic does not qualify Oracle query support. |
| Oracle zero-length character decoder | Earlier synthetic CHAR/NCHAR regressions assumed CLR bytes for described zero-length columns. Removing the character early return made those tests pass; RAW behavior was unchanged. The later Python-driver comparison and native boundary result show that this assumption needs revision. Those synthetic passes do not establish the server wire format. Final focused tests passed driver 0.054 seconds and network 0.006 seconds. Coverage includes NULL/NUMBER ordering, stale values, following-field alignment, receive limits, fixed-CLR and array sentinels. Full native snapshot `hakopod-oracle-character-final-native-v1` at `b66d8a65` failed after 738.163 seconds at the first adapter query with `database_query_failed/unknown`. Numeric/NULL, CLOB, cancellation and autonomous-persistence assertions were not reached. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Manifest SHA-256: `e3ee420040c4dca9515eaa11d2e55f56e2de08b1d273f64c1aedc9f882fad264`. Oracle query capability remains disabled. |
| `agent-oracle-stages-final-v4-20261008` | Tagged diagnostic privacy, cause and output-bound tests passed in 0.072 seconds. Native stage-test compilation passed with its execution gate unset in 0.036 seconds. Default-build SQL driver tests passed in 0.067 seconds. Independent review checked static error categories, private context opt-in, bounded output, fresh 20-second probe budgets, deferred cleanup and one-row/EOF consumption under the driver session context. The default-build helper is empty. The native diagnostic completed in 562.290 seconds. Adapter, prepared-direct and driver-direct probes all failed during Query with `ttc_response_code_3` before their contexts expired. The adapter took 5–15 seconds; direct probes took 1–5 seconds. The same failure occurred without explicit PrepareContext, and all probes failed before their contexts expired. The evidence does not identify the protocol defect or qualify Oracle query support. Normal cleanup and an independent check confirmed exact namespace, SIDB, PVC and backing PV absence. Manifest SHA-256: `6022d6238f576e0a3c600bb01cc46796ab22e6534893397736a352d67f53dfd6`. |
| `agent-oracle-boundaries-v2-20261008` | Tagged metadata and boundary tests passed in 0.003 seconds. Native stage-test compilation passed with the execution gate unset in 0.073 seconds. Default NULL, statement and zero-length character regressions passed in 0.004 seconds across 11 top-level tests and nine subcases. The earlier default test filter matched no tests and is not counted as coverage. Independent review approved statement-scoped opt-in, 16-event and 4,096-byte bounds, static categories, exact TTC3 classification and empty default-build hooks. No decoder reads or error flow changed. All five runtime/test files match the frozen snapshot. The native diagnostic completed in 561.386 seconds. The driver-direct trace recorded NUMBER/small then character/zero metadata, a complete metadata trailer, and both row-column end markers. TTC3 followed with `boundary=row_column_end`. The markers show that the decoder handlers returned; they do not prove correct consumption or values. Adapter and prepared-direct Query also failed with TTC3 before their deadlines. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. This is diagnostic evidence, not Oracle acceptance. Manifest SHA-256: `f5f9b3bb6c06f7f453c6212bf0a80cea7dea3a93705c0b8da0f2917d3b689b40`. Native log SHA-256: `84cc1c7f4212d43f19ef4f82157706639c4159f8fd33d2a865be2ffd0697642f`. |
| `agent-oracle-scalar-fetch-v2-20261008` | Candidate default driver/network packages passed in 0.005/0.004 seconds. Tagged driver/network packages passed in 0.005/0.004 seconds. Full Oracle native-test compilation passed with its execution gate unset in 0.020 seconds. Independent review approved fetch-only CHAR/NCHAR null-by-describe handling, stale-value removal, UDT/array exclusions, upstream BasicRead restoration, and separate positive-length NULL CLR tests. The native suite also checks three known NULL-returning scalar functions without logging query text or values. Focused checks used v1, whose runtime/test files match v2. The first native launch refused a manifest that included itself before creating any fixture. The corrected v2 snapshot passed checksum preflight. Full native acceptance failed after 545.109 seconds. The large-number/bare-NULL assertion passed, then the first CARDINALITY(NULL) sentinel query returned `database_query_failed/unknown`. Subsequent scalar probes, writes, CLOBs, cancellation and persistence checks were not reached. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Oracle remains disabled. Manifest SHA-256: `759c11f80f003f8c805987e4b9adc58e11f4c8aa719cc1fd9ed92c51746777ee`. Native log SHA-256: `4861d4795d1cd1236d497b7a96162245c5c15ea99605c0f4ba8d03cf2bda0497`. |
| `agent-oracle-function-probes-v2-20261008` | Default driver/network tests passed in 0.005/0.005 seconds; tagged packages passed in 0.005/0.004 seconds. Gate-unset static and privacy tests passed in 0.037 seconds. Independent review approved four fixed probes, static type/cause categories, 16-event and 4,096-byte bounds, fresh 20-second connections and at most two row reads. The native diagnostic completed in 539.590 seconds. Numeric/bare-NULL control succeeded. CARDINALITY and LENGTHB exposed NUMBER/zero metadata and TTC3 after row-column completion. The timestamp function exposed timestamp_tz/small metadata and the same boundary failure. Small normalized length does not prove an incoming zero length. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Oracle remains disabled. Manifest SHA-256: `9efafc54b59827b71899cece47b696898f8a2714c88bba837511eb3499b4cdcf`. Native log SHA-256: `35858adba14aabbdbfa073625e0a30ff67ac196e226c7a7138d7d07db3879842`. |
| `agent-oracle-described-null-v2-20261008` | Complete nested default driver/network tests passed in 0.004/0.003 seconds and tagged tests in 0.005/0.004 seconds. Default cluster checks passed in 0.034 seconds and tagged compilation/privacy checks in 0.042 seconds, with native gates unset. Independent source review approved original-length capture before normalization, the scalar-only guard, stale-value clearing, exclusions and test-only diagnostic gates. The combined native run failed after 648.234 seconds. All four fixed metadata probes completed with `cause=none` and `rows_complete`. The timestamp column was `timestamp_tz_dty`, normalized small, with incoming `described_zero=true`. The full test passed numeric/scalar NULL checks, schema writes, DML/readback, request refusal and row/CLOB bounds. Cancellation failed because the query ended before execution proof; its error was discarded, so the cause remains unknown. Later parent-transaction and autonomous-persistence checks were not reached. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Oracle remains disabled. Manifest SHA-256: `28791903c89513ee8b258eb1f3436a718ffa60d936a8c65175d663eb4d3885a5`. Native log SHA-256: `e8ba532399b55197cef994d86cede3afd271d3cfc65f57e3eec06daf9a7e46aa`. |
| `agent-oracle-cancel-stages-v3-20261008` | Complete nested default driver/network tests passed in 0.005/0.004 seconds and tagged tests in 0.005/0.003 seconds. Default cluster checks passed in 0.034 seconds; tagged diagnostic race and compile checks passed in 1.218 seconds. Source review approved separate bounded setup/execution contexts, a 45-second transport lifetime, synchronized static diagnostics and worker completion before independent checks. The full native suite failed after 691.562 seconds. Its only failed assertion was cancellation execution proof. Query preparation succeeded, then Query failed in under one second with `oracle_resource_limit` and an active context. The billion-level test workload exhausted a server resource; this was not a context deadline. All four metadata probes and earlier query checks passed. Later checks confirmed server read-only refusal of DML, autonomous persistence after a read-only parent rollback, and an unknown adapter outcome after a function committed and raised an error. Normal cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. Oracle remains disabled pending a valid cancellation workload. Manifest SHA-256: `6be0c872b8f9e1448c411db7126ea5c68c0a0383f298d8bd4bdb6e6f7b6f871f`. Native log SHA-256: `a03016bfa5748fff9c62356f976d74e18ab9e62afbc1758436d47d2f66b306f9`. |
| `agent-oracle-cancel-sleep-v1-20261008` | Complete nested default driver/network tests passed in 0.004/0.005 seconds and tagged tests in 0.004/0.003 seconds. Default cluster checks passed in 0.030 seconds; tagged diagnostic race and compile checks passed in 1.209 seconds. Independent review approved two fixed-duration APP functions with no additional privileges, a short positive control, unchanged execution proof and cancellation bounds, and owned cleanup after worker completion. Full Oracle Free native query acceptance passed in 633.981 seconds. The server executed the cancellation query, and cancellation returned in 2.440 seconds. Exact numeric/NULL values, scalar NULL functions, schema/DML writes and readback, request refusal, row/CLOB bounds, autonomous persistence after parent rollback, and unknown outcome after commit-then-error all passed. Both temporary functions were absent after cleanup. Normal fixture cleanup confirmed exact namespace, SIDB, PVC and backing PV absence. This qualifies the tested Oracle Free configuration, not Enterprise or a production deployment. Manifest SHA-256: `7eac91517dc2b4abb9e12ee7a554ecbcce382fc78e2326be8eece119730f2d11`. Native log SHA-256: `40889e716fb20db169eaaa4c6616b6fcbf10d878d60630acc351e01f6234ed94`. |
| `agent-cloud-policy-v2` | Shared credential-policy helper, focused server/gateway/state/identity and full Cloud Go suite passed before rebase. |
| `agent-cloud-c7f346a-9d0f49a-20261008` | After rebase onto Cloud main `c7f346a3`, the full Cloud Go unit suite passed at `9d0f49a4` with engine `b8bfc42e`. No database integration URL was set for this run. The earlier `agent-cloud-rebased-v1` directory was accidentally reused and is no longer an immutable snapshot. Its replacement run was discarded. This new snapshot used exclusive directory creation. |
| `agent-cloud-terminal-native-v8` | Final Cloud gateway/server race tests passed in 5.281 and 7.751 seconds. Covers terminal response validation, caller binding, revocation, reservation cleanup and hosted browser routing. Combined hosted and connected-node native polling passed in 74.78 seconds. |

Platform CI results apply to the exact commits below. They do not publish images or qualify Oracle queries.

| Commit | CI result | Separate acceptance |
| --- | --- | --- |
| `e9b00927` | [37705921191](https://github.com/hakopod/hakopod/actions/runs/37705921191) passed full Go, native-acceptance compilation, Oracle decoder tests, vet, command builds, scripts, dashboard and SDK. | Template and Managed Actions amd64/arm64, PostgreSQL network, ingress and certificates passed. |
| `2e3952cc` | [37708257805](https://github.com/hakopod/hakopod/actions/runs/37708257805) passed. | See the earlier checkpoint record. |
| `1329b451` | [37715423425](https://github.com/hakopod/hakopod/actions/runs/37715423425) passed Go, native-acceptance compilation, Oracle decoder tests, vet, commands, scripts, generated files, dashboard, SDK and server-image build. The image includes the local Oracle module and authorization sources. | No additional result is claimed in this row. |
| `97d5cad8` | [37718789722](https://github.com/hakopod/hakopod/actions/runs/37718789722) passed Go, dashboard, SDK and server-image jobs, including the type-0 NULL backport. | No additional result is claimed in this row. |
| `3049180e` | [37720876211](https://github.com/hakopod/hakopod/actions/runs/37720876211) passed Go, dashboard, SDK and server-image jobs. | Network, ingress, certificates, templates and Managed Actions passed. |
| `54d859e45bc3df9bad4ef0537799271dea34f6c2` | [37731542046](https://github.com/hakopod/hakopod/actions/runs/37731542046) passed after the alpha.57 rebase. Full Go took 21 minutes 23 seconds, including native-acceptance compilation, Oracle decoder tests, vet and command builds. Dashboard, SDK and server-image jobs passed. | PostgreSQL network, TLS/certificates, ingress/interface, templates amd64/arm64 and Managed Actions amd64/arm64 passed. Optional BuildKit was skipped by its scenario. |
| `53533297bff2b24bec41ae54c66aa4fa6c2319e8` | [37734903761](https://github.com/hakopod/hakopod/actions/runs/37734903761) passed full Go, dashboard, SDK and server-image jobs. | PostgreSQL network, TLS, ingress, templates amd64/arm64 and Managed Actions amd64/arm64 passed. Optional BuildKit was skipped by its scenario. |
| `eaa0945c16ae87034dd80d481b60680eb223e30f` | [37739239348](https://github.com/hakopod/hakopod/actions/runs/37739239348) was cancelled after the next push. Go was cancelled and is not counted as a pass. Dashboard, SDK and server-image jobs passed. | Network, TLS, ingress, templates amd64/arm64 and Managed Actions amd64/arm64 passed. Optional BuildKit was skipped by its scenario. |
| `18234e5dea81881be65cd4593d39156f3b0820a5` | [37740738131](https://github.com/hakopod/hakopod/actions/runs/37740738131) passed all Go, dashboard, SDK and server-image jobs. | PostgreSQL network, TLS, ingress, templates amd64/arm64 and Managed Actions amd64/arm64 passed. Optional BuildKit was skipped by its scenario. |

The later Oracle Free native pass is recorded separately. These CI results do not qualify later source changes.

Cloud commit `3d89b96` contains the terminal mapping and gateway fixes. Separate commit `57941ca` pins platform `9c6bad12`. Cloud run `37703834911` passed service and dashboard smoke checks, API tests, recovery transport and toolkit checks. Hosted packaging failed because Vitess source did not match its reviewed qualification delta. This remains a qualification blocker.
Cloud checkpoint `2e7cb399413330ebc12b16f3310ea4e7d036a958` pins platform `54d859e45bc3df9bad4ef0537799271dea34f6c2`. [CI run 37732696960](https://github.com/hakopod/hakopod-cloud/actions/runs/37732696960) passed checks, host recovery, PostgreSQL API race tests and vet. Hosted service/dashboard checks and 24 node-control tests passed. Packaging failed at `engine/release/verify-vitess-runtime.py:202` with `Vitess source changed outside the reviewed source delta`. The gate remains unchanged; final-source qualification remains required.
A read-only reconstruction verified the exact engine and templates revisions. The current runtime inventory contains 1,791 files; the reviewed inventory contains 1,702. There are 51 changed and 89 added files, including eight protected authorization, dependency and Vitess query paths. Templates contribute no differences. This requires fresh native lifecycle, recovery, reseed, revocation, scale and HTTP acceptance. A new compatibility hash alone cannot qualify the changed runtime.

Cloud snapshot manifest SHA-256: `733f67092275b98550ab66ab3d9000c38c42cfc29939bc349f45e5997372e3c7`.
Cloud terminal v8 manifest SHA-256: `7078674f4856addb1cbb430a93fbc1b1914fb67662af7f7c4d387fd7190624ab`.

The `agent-oracle-free-enable-v1-20261008` snapshot copied the passing `agent-oracle-cancel-sleep-v1-20261008` source and overlaid five reviewed capability files.
Database scope tests passed in 0.005 seconds. Cluster scope, request-mode and driver checks passed in 0.024 seconds.
The API `TestDatabaseQuery` suite passed with PostgreSQL integration in 1.515 seconds.
Each job had a 200% CPU limit, a 2 GiB memory limit and a 900-second deadline.
The five-file source map has canonical SHA-256 `ff683b13290b6ddfa7a0507518fbed982659d7619025a34a978d796968582198`.
Both API capability discovery and cluster dispatch now require the qualified Oracle Free spec. Engine-only Oracle discovery remains unsupported.
The change does not grant read-only or transactional execution. Enterprise, customer images and other configurations remain unsupported.

## Native development acceptance

Tests use only `k3d-hakopod-dev` and owned disposable resources.

| Workflow | Evidence |
| --- | --- |
| Pod execution | Passed separate stdout/stderr, exit 7 and authorization revocation in 5.91 seconds. |
| Application terminal polling | Snapshot `agent-terminal-runtime-v4-20261008` passed owned pinned-pod input/output, exit 7, key revocation and trusted product-authority revocation. The product revocation check closed the output handler in 3.07 seconds while the key remained valid. The full test passed in 62.55 seconds and confirmed namespace deletion. |
| Cloud terminal polling | Snapshot `agent-cloud-terminal-native-v8` passed hosted and connected-node input/output, exit status, Cloud grant revocation and exact downstream cleanup while the enrolled engine key remained valid. The test uses fixture Cloud identity/state and relay routing with the production gateway, canonical HTTP and real Kubernetes execution. It does not qualify a deployed relay. Namespace absence was confirmed. |
| PostgreSQL | Final rollback snapshot `agent-control-pg-rollback-20261008` passed focused transaction/revocation checks and managed native acceptance in 112.25 seconds. Covers TLS, exact values, DDL/DML/readback, limits, read-only refusal, cancellation and confirmed-versus-unknown rollback. Namespace and volumes were removed. |
| SQL through HTTP and MCP | `agent-query-api-mcp-v2` passed in 90.70 seconds. Canonical HTTP and HTTP MCP verified explicit grants, stale-review rejection, exact numeric/null/parameter values, writes and readback, per-operation audit identity/outcomes/redaction, session closure and revoked-key refusal. The owned PostgreSQL namespace and volumes were removed. |
| MySQL | Native snapshot `agent-mysql-query-expanded-v2` passed in 294.97 seconds. It verified exact binds, DDL, transactional and nontransactional DML persistence, read-only enforcement, result limits and confirmed rollback after authority loss. A later engine probe passed in 426.800 seconds. The fixture created an actual MyISAM table, but its managed Group Replication configuration rejected the insert with code 3098. A same-connection InnoDB positive control passed, and the MyISAM row count remained zero. This establishes the behavior of that managed configuration only. Dedicated cancellation reached actual execution. Both runs confirmed namespace and volume cleanup. The later warning-aware rollback helper passed its isolated persistence control in 421.15 seconds. That fresh fixture stopped Group Replication to permit a MyISAM write. The helper reported `unknown` with one persisted MyISAM row and `rolled_back` with zero InnoDB rows. Normal cleanup and exact namespace, pod, PVC and backing PV absence passed. This control verifies driver outcomes, not HA lifecycle behavior. |
| ClickHouse | Native v4 passed JSONCompact numeric/null preservation, read-only insert refusal, result limits, cancellation and normal namespace cleanup. Nontransactional execution only. |
| MyDuck | Native v8 passed in 100.38 seconds. The PostgreSQL DescribeExec path verified binds, exact numeric and NULL readback, read-only refusal, multiple-statement rejection before dispatch, row/byte/protocol limits and authority loss. The test observed the PostgreSQL aggregate in the shared process list before cancellation and required a result within five seconds. Namespace and backing PV absence were confirmed. Queries require explicit write permission and nontransactional mode. Read-only enforcement is unsupported. |
| Oracle | Full Oracle Free query acceptance passed in 633.981 seconds on `agent-oracle-cancel-sleep-v1-20261008`. It covered exact numeric/scalar NULL values, schema writes, DML/readback, request refusal, row/CLOB bounds, observed cancellation and autonomous persistence. Cancellation returned in 2.440 seconds. A committed autonomous write survived parent rollback; commit-then-error produced an unknown adapter outcome. Temporary functions, namespace, SIDB, PVC and backing PVs were absent after normal cleanup. This evidence applies to the pinned Free 23.26 standalone configuration. Enterprise remains unqualified. |
| Vitess | Checkpoint `1329b451` standalone acceptance passed in 227.00 seconds. A later sharded run exposed SINGLE-mode cross-shard DML rejection. Corrected native v2 sharded acceptance passed in 687.25 seconds with scatter reads, routed binds, single-shard writes and rollback, rejection of transactional and nontransactional cross-shard updates, complete dataset comparisons and cleanup. The same suite's standalone case failed after 228.05 seconds because the tablet-execution observer was unavailable. Both fixture namespaces and all matching PV claims were absent after normal cleanup. Suite exit was 1 after 915.355 seconds. The instrumented standalone v3 then passed in 322.63 seconds, with exact namespace and PV claim absence verified. The observer deadline and assertions were unchanged. Runtime driver, selector, policy, dispatcher and query-model hashes match between the passing sharded and standalone snapshots. The only native-test change added safe observer failure classification without changing assertions or the two-second deadline. Query capability is enabled with the SINGLE policy and `cross_shard_dml=false`. |

`TestDatabaseQueryAPIMCPLive` uses a disposable PostgreSQL fixture through the canonical HTTP API and HTTP MCP transport.
The first native attempt found a test-decoding error: MCP places the SQL result inside an explicitly untrusted `data` envelope.
The corrected test verifies that envelope and passed all assertions and cleanup.
Its test SHA-256 is `b058d663417a0379a78b42296b688cca302ebf8edc3ab20672aded060ca805e7`.
The v2 snapshot manifest SHA-256 is `13bc2bca7dbda8b11d0314afd3d740beb1175cd0393286d8fb5bf9011fad1af1`.

The query transport verifies the managed application identity with TLS. A fixed byte relay runs in the exact owned, pinned database container.
SQL and credentials do not appear in relay command arguments. Kubernetes does not supply database authorization.

MyDuck must not advertise read-only support. Its reviewed UI requires an explicit write selection and explains nontransactional persistence.
A capability is enabled only after the corresponding native checks pass. Support is read from the target's query-capability endpoint.
MyDuck v8 used `1329b451` plus the reviewed cancellation test from `47bcf09e`.
Its adapter SHA-256 was `ebe7bc93cedab28aa97db987a76d9514e2c5ff0da1d0d1a63dde7893b84cdcad`.
Its test SHA-256 was `06c59aff17461daa9f680263163e745c56a9b2cc3fba518373886d8655c3681f`.
Its native log SHA-256 was `0aa7738cc435d02fec1feadba0dcdf012e373285e249145572b9db16c0d29ec2`.

The failed Oracle fixture required two recovery stages. The existing platform storage helper passed in 0.537 seconds.
The pinned operator's deletion routine then passed in 0.177 seconds. Independent review checked both temporary harnesses before execution.
They checked captured resource UIDs, ownership, deletion state, revision and the exact spec before permitted mutations.
The operator harness allowed only removal of the known SIDB finalizer after confirming empty pod and PVC inventories.
Bounded checks then confirmed namespace, SIDB, PVC and backing PV absence. No production dependency or deletion logic changed for recovery.
The harness SHA-256 values were `c7a08a4d42eb2578b0b1228a5310f883e77f6c1847e3add48785af943f92b0bf` and `722c4b10ad95cbdd699415eaa8239509c902c1f94e50c2772c4ea5a4dfc442a6`.

The pre-b66 metadata snapshot was audited after the boundary diagnostic. Its full manifest matches `fbf166b9e57fc693d827ab1f250b51f49b48d03da5bb8aebc706f0dad7ea4b6b`. It contains the original CHAR/NCHAR zero-length shortcut and a local replacement for go-ora v3.0.1. The earlier failure cannot be attributed to an absent shortcut or an inferred default coder length. Its cause remains unproved.

Later terminal snapshots v6 and v7 passed functional assertions but failed the 45-second namespace cleanup wait. They are not passing acceptance results. Snapshots v8 and v9 used a bounded 90-second absence check and passed cleanup without changing cluster resources or finalizers.

## Independent review

The [UI review](agent-control-ui-review.md) passed for the documented route families, both themes, 1440px and 390px layouts, keyboard interactions and measured bounds.
All artificial UI fixtures are labelled DEVELOPMENT ONLY. Full Cloud shell, physical touch, assistive technology and 320px layouts remain unverified.
The Oracle Free supplement passed independent screenshot review in both themes at 1440×1000 and 390×1000.
It verified explicit write selection, nontransactional warnings, keyboard focus and retained input after an unknown outcome.
Ordinary viewport captures ruled out overlap seen only in full-page exports. Synthetic mobile taps covered mode selection, Statement help and review access.

An independent contract review identified Cloud credential inheritance and stale delegated permission reporting. Both fixes passed re-review on Cloud commit 69980179.
A later SQL review identified unconfirmed rollback claims. PostgreSQL and MySQL corrections passed the regression and native checks recorded above. A later post-rows authority-loss correction passed independent review and driver regressions; it changes failure reporting without changing successful execution or the Kubernetes transport.
Terminal review also required current `pods:exec` checks for runtime-scoped browser and CLI sessions. Creation, follow-ups and active streams now apply that ceiling. Scoped fixture tests require actual project membership; global administrator status does not replace that membership.
Further review found that direct CLI sessions could inherit execution from an administrator wildcard. CLI pod commands, terminals and SQL now require explicit grants. Active terminal checks detect removal of that grant even when administrator permission remains.
The CLI and canonical polling handlers now coordinate attachment before accepting input. Early attachment failures return an error instead of a successful empty poll.
SQL write authorization now checks both current SQL permissions. Issuance validation does not replace execution-time authorization.
The SQL driver now honors explicit nontransactional writes and reports conservative outcomes after column-metadata failures.

## Release limits

Website [PR 46](https://github.com/hakopod/hakopod-website/pull/46) merged separately. On October 8, read-only checks returned HTTP 200 for the public [agent page](https://hakopod.com/agents/) and [connection guide](https://hakopod.com/docs/agent-control/). Their published copy distinguishes released self-hosted MCP workflows from command, SQL, administration and Cloud work still in development. This verifies publication of the guide, not platform execution or Cloud availability.

Cloud delegated terminals support polling. Hosted browser streaming is preserved by routing tests; the Cloud dashboard currently hides terminal controls. Connected-node browser streaming and installation/host administration are unavailable in Cloud.
The native connected-node test uses controlled relay routing, not a deployed production relay.
No platform or Cloud feature merge, new release, production deployment, public endpoint or production SQL execution is claimed here.
Revocation cannot remove the interval between the final authority check and remote execution.
Nontransactional writes and implicit-commit DDL can persist after failure. Inspect unknown outcomes before retrying.

Historical checks remain in earlier Git revisions. A previous successful snapshot does not qualify later behavior changes.