docs/HANDOFF-2026-09-22.md

Rama master · réplica de lectura del repositorio original.

# Engineering audit handoff — 2026-09-22

> Archived finite audit snapshot. Repository handoff: 当前一份是 [HANDOFF-2026-10-15.md](HANDOFF-2026-10-15.md). Index: [README.md](README.md).

Audit baseline: `a454117d5f6fa679c0d2417a5281c2e06db9346b`. Six groups contain repairs for 14 of 15 reproduced mechanisms. C2 remains reproduced/open; its unsafe interrupted draft was preserved but excluded. The evidence register contains 140 assessed rows (22 reproduced, 78 demoted, 22 candidate, 18 UNVERIFIED).

Main is the sole remaining owner after the Owner requested no further agents. The original independent reviews and Main's blocker resolutions remain in the review directory (`.agent/audit-20260922/reviews/`, local evidence). In particular, protocol's final corrections were implemented/reviewed by Main after the independent initial review; there was no fresh independent final review. No push, release, live-account calibration or system change is authorized.

The exact final tested commit, per-child exits/counts, reviewed source hashes, original/rebased commit mapping and local merge status belong to the acceptance receipt (`.agent/audit-20260922/evidence/integration/acceptance.json`, local evidence) and final gate receipt (`.agent/audit-20260922/evidence/integration/final-gate.json`, local evidence). These ignored local audit artifacts must be retained with this checkout. This tracked document describes stable contracts and the acceptance procedure; it does not predict its own commit or test result.

## Stable source/test contracts and focused evidence

These describe reviewed behavior and its test boundary, independently of future integration SHAs. Final acceptance depends on the measured combined gate receipt.

| Group | Concrete behavior and deciding evidence |
| --- | --- |
| State durability | Both account-save paths on failure retain dirty retry state, including direct sync save from clean state and directory-fsync failure after rename; a later healthy flush persists it. Result (`.agent/audit-20260922/evidence/repairs/state-dirty/result.json`, local evidence): baseline reds plus added clean-state red, guarded 6/6 regression tests and 72/72 affected controls. |
| Input boundaries | Deep trace traversal truncates safely; proxy preserves backend CORS/OPTIONS and appends the actual peer; image fetch shares an absolute eight-second deadline across redirects/body receipt; full-buffer JPEG dimension checks precede decode; PDF streams use their associated structured dictionary, including nested/escaped literals. Red/green index (`.agent/audit-20260922/evidence/repairs/input-boundaries/README.md`, local evidence) and mutation result (`.agent/audit-20260922/evidence/repairs/input-boundaries/mutation-01-local.json`, local evidence): guarded final 51/51, 16/16 bounded mutations caught. Node-22-only test hook removed; actual Node 20 execution remains UNVERIFIED. |
| Diagnostics | Generated bootstrap credentials reach their intended console once without entering application logs/subscribers; wire-test children identify and validate their actual comparison base and reject wrong provenance. Evidence index (`.agent/audit-20260922/evidence/repairs/diagnostics/INDEX.md`, local evidence) covers baseline reds, fixed controls and reverted-logging/baseline-gate negative controls. Console capture remains outside the secret-log guarantee. |
| Scale | Unmapped-model warning suppression retains at most 1,024 FIFO SHA-256 keys instead of unbounded raw names, preserving model resolution/status behavior and duplicate suppression. Red/green/mutation index (`.agent/audit-20260922/evidence/repairs/scale/INDEX.md`, local evidence): focused 5/5, affected controls 283/283, four bounded mutations caught. No measured RSS or OOM claim. |
| Test egress | Default test setup installs denial before product imports; only the fully armed existing live predicate bypasses default installation, while an explicit preload still wins. Evidence index (`.agent/audit-20260922/evidence/repairs/test-egress/INDEX.md`, local evidence): sentinel-backed baseline red, fixed zero underlying transports, focused 5/5 and four caught mutations. Live arming was checked with synthetic sentinels, not real credentials. |
| Protocol | Cascade fresh/replayed visible prose obeys stop, complete declared tool arguments remain opaque, reasoning promotion uses the final visible stop boundary, and Messages receives the actual winning stop through trusted context. Safe EOF/failure tails precede terminal frames. A8 sanitizes both reached fallback log sinks, proven with nonempty daily JSONL. Result (`.agent/audit-20260922/evidence/repairs/protocol/result.json`, local evidence): 11 new review regressions failed before correction; 214 related tests and two durable log tests passed; six focused mutations rejected. C2 backpressure remains open: no producer/drain, cancellation, queue or RSS improvement is claimed. |

## Coverage, plans, and limits

The closed register has 140 rows: 22 reproduced, 78 demoted, 22 candidates, 18 UNVERIFIED. The 22 reproduced rows represent 15 mechanisms, not 22 independent defects. W1–W30, CUT1–CUT18, and all seven fixed lenses have dispositions. Findings (`.agent/audit-20260922/findings.tsv`, local evidence), report (`.agent/audit-20260922/REPORT.md`, local evidence), and delivery synthesis (`.agent/audit-20260922/lanes/delivery-plan.md`, local evidence) retain supporting context.

The corrected wire measurement compared baseline `a454117` with annotated-release base `c22e0bf36fef2f4c07bbd3feb87c124d6e361b14` (`v3.9.37`): child exit 0, one pass, zero skips, 270 comparisons. Receipt (`.agent/audit-20260922/evidence/wire-recheck/result.json`, local evidence). Original wire conclusions are retracted/UNVERIFIED. Byte-identical compared modules do not prove live response semantics or upstream acceptance.

Earlier broad suites reached upstream catalog endpoints with synthetic accounts and received actual 401s. Their functional results are not offline evidence; this led to D-TEST-EGRESS. The deny guard covers exercised Node APIs, not an OS sandbox, arbitrary `net.Socket` use, all binaries, or every possible child. Guard installation and inheritance must be evidenced for the actual acceptance children.

Baseline Windows skips comprise 77 POSIX-git fixtures; one new wire fixture makes 78 expected at the prior diagnostics checkpoint. Actual final counts are recorded in the final gate receipt, not inferred from this expectation. A prior guarded input gate failed with native Node OOM/spawn UNKNOWN and incomplete file accounting; interrupted or missing-exit runs are not passes. Full Unix dynamic mutation qualification, live behavior, real decoder stress, long wall-clock/load behavior, and rendered/accessibility UI qualification remain UNVERIFIED. Node 20 binary execution is unavailable here.

ISSUE-250/258/272/273 remain frozen UNVERIFIED. ROADMAP (`.agent/audit-20260922/ROADMAP.md`, local evidence) is ranked planning with estimated costs and deciding tests, not implementation authorization. W22 is canonical for Windows star-history; CUT15 is its alias. MIXED, SCALE002/003 and CUT18 remain candidates; measured soft-budget/fairness exceptions remain demoted, not an authorization for a new hard cap.

UI-PLAN (`.agent/audit-20260922/UI-PLAN.md`, local evidence) is proposal only: establish both-skin/locales/browser baselines before independently authorized slices. CUT18 catalog recovery and SCALE003 animation cleanup need reproduction and future UI scope. Prior 68 guard-suite passes do not establish rendering, accessibility, packaged assets, or browser compatibility.

## Final acceptance procedure

Six reviewed repair groups are staged by rebase and ff-only with unchanged accepted hashes. C2 is excluded under the approved bounded repair design because an awaitable Cascade writer must first be separated safely from the shared synchronous legacy path. Its independent review records five concrete blockers; do not resurrect the five-await draft as a fix. The roadmap retains the deciding test and estimate.

Run the following exact commands strictly serially in the clean integration worktree, with the environment below applied only to the command child and relevant descendants; never alter the OMP parent/global environment:

```text
NODE_OPTIONS=--import file:///D:/Project/WindsurfAPI/scripts/mutation-network-deny.mjs
RELOGIN_LIVE=0
WIRE_BASE_TREE=D:/Project/WindsurfAPI/.claude/worktrees/audit-wire-v3.9.37
WIRE_BASE_REQUIRED=1

npm test -- --test-concurrency=2
npm run secret-scan
node --check src/index.js
npm run gate
```

The block specifies child environment values, not PowerShell assignment syntax. Before each command, capture actual tested HEAD, tree/dirty state, base HEAD (must equal `c22e0bf36fef2f4c07bbd3feb87c124d6e361b14`), nonsecret environment names/values, command and working directory. Capture complete stdout/stderr, direct child exit/signal, full test/release summaries, actual skips and wire-child provenance/270 comparisons. Record missing output or nonzero exit as incomplete/failing. Do not replace required checks with predictions, change runner/product budgets, or infer passes from launcher exit alone.

After Main reviews the exact clean tested HEAD and all receipts, local master ff-only is the final acceptance action. Final integrated SHA, observed counts, merge state and final artifact reconciliation belong in the live acceptance record and final delivery; they are deliberately not guessed here. No push or release follows from local acceptance.