Decisions

2026-10-06: The owner explicitly delegates the annotated v0.10.5 tag push after merging PR #454. S166 verifies the exact tagged source, four green release jobs, normal protected crates.io approval, six certified public files and ten non-yanked crate records before current markers move. The records pull request advances the pinned published-review workflow to those immutable bytes while preserving the unsigned policy, release protection, historical v0.10.4 evidence and independent-review limits; no installed sensitive product or real game runs locally.

2026-10-06: The records-branch full gate found four 30-day supply-chain reviews expired on October 6. The locked Linux, Windows all-feature and shipped Windows graphs still match policy digests 8bbddff3733616feed2aade93f094c86fb23983f0641ed029f59a2ea43217d4a, 989ed8f2d130727e4b36ca5d8e413c550c945e75047ee276dba9ee304c19028f, and c4d871a5442ddf1b4b3c72ca38f485607d33de783545159692031ead67db85f0; counts remain 187/448, 186/424 and 148/317. Exact cargo-deny 0.20.2 ran the all-feature advisory, license, ban and source audit successfully against current data. The pinned versions, feature inventories and compatibility boundaries for ring 0.17.14, rustls-native-certs 0.8.4, tokio-rustls 0.26.4 and cargo-deny 0.20.2 remain unchanged. Renew only their last_reviewed dates to October 6, preserve the separate unsafe-review expiry and exception dates, and make no dependency, workflow, release or product change. This is a bounded recurring policy review, not independent whole-product security acceptance.

2026-10-06 Mermaid still constrains KaTeX to the vulnerable 0.16 line, including in its 12.0.0 release. The site uses exact pnpm workspace overrides for KaTeX, DOMPurify, and source-map-js until its parent dependencies accept fixed versions directly; frozen install, production build, and browser diagram checks guard this compatibility choice. The four historical Rustls lockfiles use the fixed package version without changing the released product graph.

• 2026-10-09, S168: Bundle eight connected operator diagnostics issues under one end-to-end Spec-Kit slice and one PR. Keep #458 retention/GC, #464 ordinary-user artifact access, #468 final-client acquisition/correlation, #155 IGDB, and #94 community sync outside this work boundary. Exact authorization, stored identity, discovery depth, and cleanup selection remain unchanged.
• 2026-10-09, S168: Add exact-pinned unicode-width 0.2.2 (default features disabled, MIT OR Apache-2.0, declared MSRV 1.66) as a CLI runtime dependency and one lockfile package. Complete-string width replaces handwritten ranges that missed non-Latin combining and composed emoji. All application-authored human multicolumn reports use actual preceding-column width plus four spaces, including narrow output. No development exception is granted; only explicit operator authorization can grant a scoped exception.
• 2026-10-09, S168: Keep Doctor summary a pure human projection of unchanged resource checks, and expose --history-details for exact human records. Preserve actionable records alongside scan limitations. Selected Steam metadata APIs avoid unrelated enumeration; typed source/root/target/operation provenance is additive structured telemetry. The controlled early-refusal budget is one second with ready injected process inventory and no downstream calls.
• 2026-10-09, S168: Extend the facade with additive bounded native terminal diagnostics, evidence windows and shared pure stored-case assessment. Connection endings and completed exchanges are independent populations; semantic observation time, distinct from request start, closes the late-response authorization defect. Eligibility clamps packet ownership to the observation cutoff, while late records remain in artifacts. Default adapter methods preserve existing implementations. Missing final-client correlation remains an explicit inconclusive #468 blocker.
• 2026-10-09, S168: Read only finite manifest and process-trace metadata for terminal evidence projection; distinguish finalization, writes, semantic completeness, producer-context readability, current stored readiness, and cleanup. No producer-context test proves ordinary-user access. Project-owned verification child processes use hidden, redirected, noninteractive launch patterns under the repository Windows directive.
• 2026-10-09, S168: The final causal audit corrected pre-authentication HTTP parser/cancellation and cleartext HTTP/2 handshake/auth-wait failures that previously inflated authenticated connection totals. HTTP/2 now carries the actual capability-proof boundary; TLS HTTP/2 retains its preceding authenticated CONNECT authority. Stable cause mapping recognizes exact auth components rather than the substring in authority, and timeout/transport remain independent categories. Focused loopback regressions failed on the former counters and passed after correction; no capability, credential or private failure detail is added to terminal diagnostics.
• 2026-10-09, S168: Preserve version-one plain observation and terminal-snapshot constructors. PhaseQualifiedObservation, PhaseObservationDrain, TerminalDiagnostics and an additive Diagnostics event carry new metadata; the optional phase drain defaults to the unchanged legacy adapter contract. Explicit window-aware policy helpers treat absent indices as unavailable and preserve original owner indices. The CLI caches diagnostics before fact/artifact finalization and publishes an additive deep_capture.diagnostics event with exact decimal nanosecond cutoffs.
• 2026-10-09, S168: The second review corrected current readiness to select greatest durable row IDs per exact applicable key, rather than conflating historical values with current conflicts or relying on collection order. Historical rows remain unchanged; contradictory same-ID values and missing durable chronology cannot authorize readiness. Validated HTTP/1 upgrades count as completed exchanges before independent relay endings. These corrections receive focused and full-gate verification without a third external review trigger.

2026-10-09 (S169): Preserve ordinary Capture interface precedence, canonical flow identity, inner socket-table total ranking and creation/retention rules. Deep Capture alone requires recognized loopback acquisition and adds its exact authorized TCP listener locality/filter clause. Shared adapter readiness accepts the platform flag or exact known Npcap descriptions, excluding generic virtual/test loopback names. Stage-bound loopback owner selection belongs in the facade and refuses competing owners. Existing watching/history bounds and observation cutoff remain authoritative; successful proxy traffic cannot substitute for packet ownership. Controlled real endpoints with synthesized frames prove source behavior without claiming Npcap acquisition or the supplied machine's root cause. The no-ALPN HTTPS fixture sends a complete first application flight while product classification timing remains unchanged. No package, release, ACL or retention migration is added.

2026-10-09 (S170): Separate recipient identity, producer identity and object ownership. Default production desktop resolution binds the exact Windows session account and ordinary token; explicit SID/destination selection uses a finite authenticated local helper when default proof is unavailable. Private retained ACLs name recipient, distinct producer and SYSTEM, while ephemeral issuer-private material remains producer/SYSTEM only. Historical repair binds terminal manifest and matching closed-journal provenance, every recognized artifact and protected sidecar, exact object identities/descriptors and necessary proven-owned parents into one bounded preview. Matching active or legacy-unproven leases refuse; an unregistered historical/library bundle uses terminal provenance without claiming an absent lease or independent external cleanup success. Handle-based permission changes preserve all evidence bytes, last-write times, names, retention and recovery obligations; narrow parent grants do not propagate into sibling bundles. Actual recipient checks follow reconciliation and preserve written/access/completeness distinctions. Controlled ordinary and labeled group-denied/unrelated-access equivalents avoid elevation, account creation and owner-profile permission changes; actual elevated Administrators-owned, second-human-account and real-game behavior are unverified. Existing BLAKE3/getrandom runtime edges add no lock package. No collection, empty-container purge, dependency PR #470 update or release is included. The governed dependency graph and scoped unsafe-review records are rebound after reviewing the two existing-package runtime edges and Windows token/pipe/session feature exposure; package counts, provider choices and exception/review expiries remain fixed.

2026-10-09 (S170 final review): Preserve explicit indexed sensitive cleanup independently from new-output ACL migration and terminal access-repair provenance, without broadening unindexed-file collection or resource recovery. Create issuer-private state with producer/SYSTEM protection before the first byte, refuse existing or aliased destinations, and clean up failed new writes through the exact handle. No repository caller relies on issuer-key overwrite; the public per-session persistence helper now documents create-new semantics. Use the already ordinary retained context for controlled group-denied fixtures on elevated runners and consume documented FFI output pointers only after API success, without suppressing security scans. Creation of each new output intermediate likewise establishes and verifies the exact recipient contract before descendants. Standalone harness lockfiles preserve versions and add only the existing-package edges.

2026-10-09 (S170 hosted preflight correction): Read-only compatibility and managed-launch validation precede output-recipient authentication, preserving existing actionable target refusals even on elevated hosts without an ordinary linked token. Recipient proof still precedes authorization, output creation and every external session effect. Stored-client selection coverage uses the reserved controlled fixture identity and retains exact persistence and no-session-effects assertions.

2026-10-09 (S170 package import correction): Reconcile the closed ordinary PE import contract with the Windows Terminal Services session-identity API's wtsapi32.dll import. Keep exact import equality, package/lifecycle checks and delayed Npcap policy unchanged; mismatch diagnostics now expose expected and observed DLL sets. This operating-system import adds no Cargo package or security waiver.

2026-10-09 (S170 historical replay authority): Bind published-candidate replay to its verified immutable source contract and report validator instead of applying today's PE import closure to historical binaries. The maintained harness still runs against digest-verified published assets. Candidate registry, tag, source identity and published asset hashes remain unchanged; current-source packaging certification remains independent and exact.

2026-10-09, S171: Newly declared managed session contents use 30 days, 20 completed sessions and 2 GiB, collecting oldest eligible contents first after authorized effectful session finalization and excluding the just-returned bundle. Explicit saved/custom destinations and legacy output retain evidence until explicit cleanup. Routine collection preserves empty containers; explicit purge is separately authorized. Exact whole-session provenance, inactive generation leases, DELETE-capable Windows object handles and synchronized external retirement records precede destructive effects. Read-only diagnosis separates healthy/empty history from actionable capacity. Exact destructive filesystem collection is Windows-only; other platforms report unsupported rather than use unchecked path deletion. No release or dependency update is part of S171.

2026-10-09, S171 scoped review: New first-party Windows file/disposition and retirement-store FFI receives source and synthetic lifecycle review; the native threat registry adds collection/active/interruption abuse coverage. Supply-chain graph identities, dependency/provider inventories and review/exception expiry remain fixed. This is scoped source verification, with independent PR review still required before owner handoff.

2026-10-09, S171 ownership review: New ownership and maintenance leases use globally visible Windows mutexes to preserve generations across desktop sessions. Historical session-local leases require conclusive inactivity corroboration; a missing local lease plus an extant or reused producer PID remains unresolved. Registry retirement pins original ancestors and single-link record identity through disposition; maintenance identity canonicalizes Windows case aliases.

2026-10-09, S171 Windows pin correction: A controlled ancestor-rename test demonstrates that zero-access directory handles do not enforce the requested rename exclusion. Collection, registry maintenance and the existing private-output ancestor helper therefore use read-capable handles while denying delete sharing. This narrowly corrects the shared path authority required by retirement-file creation; it introduces no new usage policy or dependency.

2026-10-09, S171 descriptor validation: Hosted Windows tests and synthetic alias/order regressions expose why rendered SDDL text is not filesystem ownership authority. Retirement-store validation therefore compares exact owner SID, protected DACL and the exact producer/SYSTEM full-access inheritable allow ACE population. Descriptor aliases, ACE order and auto-inheritance control rendering do not change that population; wrong owner, extra principals, inherited or deny ACEs and weaker rights remain refused.

2026-10-09 S172 prepares v0.10.6 from merged S167-S171 and all remaining fragments since v0.10.5, aligning first-party versions, generated evidence, conformance, audited graph digests and specification applicability. The established release branch and version-only tooling perform no tag, push or publication. Short release highlights and the candidate handoff preserve verified v0.10.5 public markers until later exact-source publication reconciliation. The exact site patch from dependency PR #470 is included; the stale HTTPS fixture failure is already corrected by merged S169 and current-source acceptance remains required.

2026-10-09 (S172): Both hosted audit attempts failed before cargo-deny ran because Docker Hub refused the action's pinned Rust image with HTTP 429. Replace that container bootstrap with native Rust 1.88.0 and locked source installation of the same governed cargo-deny 0.20.2. Keep every all-feature advisory, license, ban and source check, existing dependency policy and fail-closed acceptance. The supply-chain wiring gate now requires these exact native commands. No exception, dependency version or review expiry changes.

2026-10-09 (S172 final review): Pin the native audit's Rust action to reviewed commit e2a55d2ffb04f378e9626c28d38b36d230d1e12f and select Rust 1.88.0 through its toolchain input. The upstream composite action was inspected for input handling, rustup installation and toolchain selection. The supply-chain wiring gate requires both the exact action commit and explicit version, preserving the same locked cargo-deny 0.20.2 and complete audit command. This resolves the final external finding without a third review trigger.