PR target correction — owner instruction

This child is implemented from and merged into codex/epic-200-git-backed-harness, NOT main. Keep one issue branch / one PR, independent exact-SHA review and required head + resulting epic-branch CI. Record acceptance as integrated into the epic, not released. The full branch goes to main only through the single final #200 PR after all #201–#207 and integrated gates are complete. See #200 delivery-contract comment; this supersedes the original child main-merge wording, leaving title/description fixed.

G7 implementation contract

Base bb1ac21b69acdc26b94ec0ced6340563e0b75f33 on the epic branch; G6 closed after independent review and green head/resulting epic CI. Original input and epic-only PR correction remain fixed.

Thin ordinary Git workflow: CLI-only project export --project SELECTOR --bundle FILE --confirm and project restore --project SELECTOR --project-id ID --storage-ref REF --ref refs/heads/main --bundle FILE --expected-head OID --confirm. No new bundle schema, semantic snapshot authority, import API, operation ledger, database or service. Export produces one standard private Git bundle for the configured branch; source content/history/receipts are private bytes, never public fixtures or tracker attachments. Output DTOs carry IDs/head/counts, not filesystem paths.

Restore accepts only a new, absent managed store and an unregistered selector; it cannot overwrite even an empty existing directory. CLI rejects an active selected daemon before restore; duplicate physical authorities remain blocked by existing registration validation. A failed registration preserves validated Git data for explicit project register recovery. No project identity rewriting, active retarget, old SQLite adoption or automatic restart/index/provider setup. Require exact full expected bundle head/ref and project identity. Restrict Git environment as existing adapter; reject prerequisites, extra refs, malformed objects, invalid/foreign schema/identity/paths, counter regression, removed entities, changed/missing receipts or wrong receipt result origins. Validate complete bounded linear history, not just latest files. Use finite byte/entry/history/time limits; exhausted validation is unavailable, never evidence of continuity.

Verification: deterministic real temporary Git export/restore with edits/tombstones/comments/wiki; compare exact bytes/citations/history and same-key original replay after loss of disposable cache and daemon restart; negative mismatched identity/head/ref, corrupt/truncated/incremental/extra-ref bundles, existing destination, receipt continuity and bound/cancellation fixtures. Extend integrated CLI/MCP/protected Admin coverage over restored authority; keep unchanged remote-mode suite. Full Go/vet/relevant race, types/unit/assets/semantic browser/docs/diff and independent exact-SHA review/head+epic CI remain required.

UX cohort: backup/storage selection stays a trusted CLI handoff in existing Local projects UI; browser/MCP never accept backup paths or bytes. Document exact commands, restore recovery, private backup handling, process-crash/CAS/retry constraints, service-owned Git, private IPC versus explicit loopback UI, optional RAG rebuild. Existing UI handoff/status/read/edit/search/history must continue working after restore; no separate backup console. Rollout triage must assess unchanged npm advisories and retain earlier unexplained O5 qualifier honestly before final whole-epic delivery. No release/install.

G7 implemented on clean head 3e41f5efd10e6de07d23577d44d2ef87feadc1b4, tree 4dce92e3965e2bac053c24f014980e78fab353fb, epic-only base bb1ac21b69acdc26b94ec0ced6340563e0b75f33 (12 paths). Contract193849694: ordinary private Git bundle export/restore via trusted CLI, no new protocol/authority/journal/service. Import validates exact ref/head/project, ordinary pack/object integrity and complete bounded linear source/counter/entity/receipt history. New absent managed destination only; CLI refuses an active selected daemon, and locked registration validates the entire candidate. Verified Git survives a registration race/failure for explicit register recovery. No backup paths/bytes reach MCP/Admin. Added CLI-only capability and product instructions; existing Local projects UI handoff/status/read/edit/search/history remains the cohort.

Deterministic tests use real temporary Git, SHA1/SHA256, create/edit/comment/wiki/tombstones, original-key replay, fixed identity/ref/head, truncated/extra-ref/incremental/pack-fanout refusals, removed/changed receipts, wrong result origin/entity/counter/history, budgets/cancellation and registration recovery. Integrated CLI/MCP compare restored exact bytes/citations/history/receipt; protected actual Admin indexes, loses real disposable index, restarts, verifies lexical fallback/history/original receipt. Poisoned credential sources and provider trap assert no hidden credential/GitCode access. A regression caught ref-vs-filesystem ambiguity in the bare runner; explicit -- fixed it without relaxing the Git environment.

Final author gates passed: go test ./... (qualification98.276s,servicectl81.624s), go vet ./...,11-package race (servicectl167.346s,service126.420s,localgit62.813s,CLI45.123s,cmd50.775s); focused backup/Git/service/CLI/Admin races; Svelte0errors/warnings,24unit,licenses;96semantic browser passed/1opt-in live skipped,41.0s,retries0; unchanged embedded assets rebuild/validation; semantic artifact guard; product docs/diff;31release fixtures. No Mermaid changed or dependencies updated. The npm applicability question was statically triaged separately in #200 comment193850097, not claimed patched; earlier O5 cause remains unexplained despite passing qualification.

Independent full exact-SHA review and required head/resulting epic CI are next; author gates are not source clearance. No #207 closure, whole-epic/main merge, release or installation yet.

Independent exact-SHA review of 3e41f5efd10e6de07d23577d44d2ef87feadc1b4 is REVISE, two P2 findings, no other P0–P2: (1) a delete receipt could acknowledge a live result; (2) a newly introduced create receipt could acknowledge a pre-existing ID without allocation. The original byte-neutral counterexamples reproduced locally unchanged under race; genuine delete and same-blob update controls passed. Their immutable fixture digests are be72cd9de7694aa4543c641410dcc9a9bd8be329aea31e885ede5edebe698dc7 and 4521afba180d51a0d6d5dcf96285181bfe0e6ac54b019c3d9acea3c6b0fd2963.

Minimal correction now in the issue branch: shared resultAt checks operation/result kind and live-vs-deleted/empty-body outcome; creation/add also checks the bounded immediate parent, absent stable ID and exact next-counter allocation. No extra provenance/storage framework, receipt format, authority or scope change. Added permanent regression/positive controls, nine-operation mismatch coverage, and updated docs. Both original negative/control pairs passed go test -race ./internal/localgit -run '^TestReview' -count=3 (18.803s) after the fix; raw fixtures stay private and unchanged.

Full Go/race gates are still running; a new clean pushed SHA, fresh independent exact-SHA review and fresh required CI are mandatory. The old head's CI38654863623/job116162105509/attempt1 did pass all18 steps, but does not qualify the changed source. !199 remains open, #207 incomplete, epic6/7; no merge/tag/install.

Review corrections published on clean exact head 53b8f4fecde74c3d8fa1c97ea22b9b93f051134f, tree c9e5850c5f53ab1f429fe5bb418eb3ab344ca4d8, !199 target unchanged: codex/epic-200-git-backed-harness, base bb1ac21b69acdc26b94ec0ced6340563e0b75f33. Follow-up delta:4 files,27 production lines plus deterministic negative/positive tests and documentation; complete G7 now14 paths. Both P2 corrections remain in the common receipt-result path, so export/restore and ordinary replay share the invariant.

Passed on this final source: go test ./... (qualification98.779s; servicectl90.870s; localgit78.853s); 11-package go test -race across CLI/config/Git/service/IPC/Admin/cache/RAG/repositorydocs/MCP (servicectl162.456s,service121.859s,localgit81.803s); go vet ./...; docs and diff/cached-whitespace. Permanent two counterexamples and two genuine controls passed repeated race12.652s; original byte-identical artifacts/controls passed race count3,18.803s. Prior UI gates bind unchanged UI bytes; fresh CI will rerun all required steps on this new SHA.

New independent complete G7 review and new exact-head mirror CI requested. No merge/closure until both clear plus unchanged canonical PR/base/threads, then resulting epic CI. No partial main merge, tag or install.

Second exact-SHA review of 53b8f4fecde74c3d8fa1c97ea22b9b93f051134f was REVISE, one remaining P2 original-parent eligibility family: a fresh comment under an already-deleted issue, or an update of a deleted entity, could restore and falsely replay while the identical request conflicted on its original parent. No other P0–P2; previous two raw regression files passed unchanged. The new raw artifact digest is 54947f8cadfffdc63d252ea7e1048ac64911a2954fd723f09835093daee4906a; both cuts independently reproduced unchanged, with genuine later-parent-deletion replay passing.

Correction published as clean head 3530308192e0c70ba516007077c1443f0a031d4c, tree c867dfc72f49cf4e1616ed63133e259aa03b198b, still !199 to epic base bb1ac21b69acdc26b94ec0ced6340563e0b75f33 only. The same bounded resultAt now checks eligibility against the receipt's immediate original parent: create/add fresh allocation, live issue for a new comment, live target for update/delete. It never tests today's state; genuine old receipts survive later deletion and legitimate same-blob updates. No payload/provenance attestation, authority store, protocol or format addition. Permanent negative tests now require typed invalid_schema; new historical controls/docs included. Complete G7 is15 paths.

Passed: final go test ./... (localgit72.781s,servicectl79.009s; qualification passed99.834s on identical production then cached), go vet ./..., docs/diff/cached-whitespace; 11-package race on identical final production (servicectl160.292s,service118.828s,localgit83.218s); final strict permanent receipt tests repeated race27.325s. New byte-identical prior-state fixture/control passed race count3,15.979s. Earlier UI bytes remain unchanged; fresh exact-head CI rechecks all required gates. Head53b8 CI38656191378/job116166418669 passed all18, but is obsolete for the new head.

Fresh independent full15-path review and fresh mirror CI requested. #207 remains incomplete/!199 open, epic6/7. No merge/closure until exact-SHA review, head CI, unchanged canonical base/threads and resulting epic CI; whole-epic/main gates follow separately. No release/install.

Independent final complete G7 review: SOURCE CLEAR / no remaining P0–P2 for 3530308192e0c70ba516007077c1443f0a031d4c, tree c867dfc72f49cf4e1616ed63133e259aa03b198b, unchanged epic base bb1ac21b69acdc26b94ec0ced6340563e0b75f33. All15 subject paths independently matched; cumulative patch digest 3ab794062864734a965e894a1024aa01222978cb16578fb74cce42be09241a47.

All three original raw artifacts passed byte-identically under -race -count=3 (26.435s): deletion outcome, fresh allocation, original-parent live eligibility, genuine delete/no-op update and replay after later parent deletion. Maintained exact-head Git/service/CLI/MCP/protected Admin restore/corruption/limits/SHA1/SHA256/registration-recovery/cache-loss/replay races passed (28.018/2.322/3.954/5.577s). Existing G1/G2 caller races, affected vet/docs/whitespace also passed. No author edits or remote writes by reviewer; independent remote readback matched reviewed head/epic base.

This clears G7 source only. Required head CI38657283466/attempt1/job116169935975 is still live; canonical PR/thread gates and resulting epic CI remain required before #207 closure. Whole-epic review/main integration remain separate. Earlier O5 cause and unchanged npm advisory counts are not relabeled fixed. No merge around pending/red checks, no partial main merge/tag/install.

!199 merged only into codex/epic-200-git-backed-harness as cc69d9a7f1020136da0645889077a91fb31d173a, after independent SOURCE CLEAR for reviewed head 3530308192e0c70ba516007077c1443f0a031d4c, exact-head CI38657283466/attempt1/job116169935975 all18success, canonical open PR/head/base and refreshed unresolved discussions=0. Main remains c7a0af638ccb4a7292a46e05143c9b82832c29d9; no partial main merge.

Required resulting epic CI has been triggered once through configured mirror3349 and is pending. #207 stays open until that exact merge-SHA run succeeds and final acceptance is posted; whole-epic final review/main PR/resulting main CI still follow. No release/install.

G7 complete in the isolated epic branch. !199 merge cc69d9a7f1020136da0645889077a91fb31d173a has the exact reviewed tree c867dfc72f49cf4e1616ed63133e259aa03b198b and expected parents bb1ac21b69acdc26b94ec0ced6340563e0b75f33 + reviewed 3530308192e0c70ba516007077c1443f0a031d4c.

Independent complete15-path SOURCE CLEAR/no P0–P2 in193851135; exact-head CI38657283466/attempt1/job116169935975 and resulting epic CI38658020721/attempt1/job116172313338 passed all18 required steps, including native user-systemd, independently verified. Canonical provider/head/base and fresh unresolved discussions=0 were checked before merge. All original reviewer artifacts and genuine controls pass unchanged; local full Go/race/vet/UI/docs/artifact/release-fixture gates and integrated real restore/cache-loss/CLI/MCP/Admin/history/citations/replay evidence are recorded in193850941 and the new #200 7/7 checkpoint.

Acceptance: ordinary private self-contained Git bundle, absent/new inactive managed target only, exact original identity/ref/commit/whole linear history, typed bounded refusal for malformed/corrupt/oversize/incremental/mismatched data, unchanged entities/receipts/counters, original operation/allocation/live-eligibility proof, safe registration recovery, source/index separation and private CLI-only files. No experimental SQLite adoption, active overwrite, new semantic protocol/authority, silent remote/provider setup or path-bearing MCP/Admin response.

Epic checkpoint/dependencies updated BEFORE closure. Main is unchanged c7a0af638ccb4a7292a46e05143c9b82832c29d9; whole-epic source review/sole main PR/resulting main CI still required before epic completion. No release/install.