[Brian Krabach (bkrabach)]

Change

• Report every verified local listener, preserving individual failures and distinguishing configured public origins from verified host endpoints. Enumerate numeric Linux/macOS interface addresses for wildcard binds, retaining local ownership, exact leaf pinning and partial-scope disclosures.
• Make doctor check certificate SAN coverage, validity/expiry and local chains, with safe remediation for intact app-owned CAs versus missing/expired CA material or supplied certificates.
• Apply approved session write-list changes at the next supported tool boundary without another message, remount or replay. Preserve in-flight snapshots, read/denied policies, existing child ceilings, Stop/runtime fences and conservative retirement fallback for unsupported writer compositions.
• Include release preparation in this PR: versions, authored notes and one canonical frontend build, rather than a separate version-only PR.

Version and release notes

0.69.2 patch, relative to latest published v0.69.1: these are corrective diagnostics and refinements to an existing permission workflow, not a new supported public integration surface. The combined shipped diff also includes the already-merged update-policy documentation, explicitly as accepted direction rather than implemented support.

The authored entry covers all shipped changes and includes high-impact notice approved-write-access-next-tool-boundary: approved write-list changes may affect the next supported call during active work. Existing authority ceilings, in-flight snapshots and Stop remain unchanged. Historical entries and notice IDs are preserved.

Validation

Behavior source: b6cfb01, tree 9b80b7cae239ac8092beb36ded7d1c818567d716. Existing independently reviewed behavior bytes and tests are unchanged after integration with current main; the additional delta is release metadata/assets and previously merged update-policy documentation.

• Exact-source isolated Docker DTU: 250 network passed / 8 skipped; 490 permission/runtime passed / 6 skipped / 2 subtests passed / 0 deselected.
• Real HTTPS explicit/wildcard listener and offline doctor/leaf-renewal integration: 3 passed.
• Actual service -> RuntimeManager pipe -> Worker.command -> Core reference-writer boundary: 1 passed, preserving PID/activation/generation/epoch, earlier snapshots, child/read/denied ceilings and Stop without new model input.
• The 56 passed / 2 skipped permission subprocess/ripgrep recovery run overlaps the final suite and is not additional disjoint coverage. Original failed attempts and their corrected invocation/fixture results are retained, not counted as passes.
• Independent security/network reviews resolved their original findings. Release-owner evidence review verified the qualification summary/archive hashes, selected commands/status/JUnit/logs and all 3,581 archived source files against the exact Git tree. These are independent agent reviews, not GitHub approving reviews.
• One canonical python scripts/release.py prepare --version 0.69.2 --notes-file <outside-checkout> --build in the reused owned isolated environment: passed, 11.6 seconds. Node 22.23.4 / npm 10.9.9 / Python 3.13.12 / uv 0.11.3. Frontend build identity d24b9df133e279c4.
• uv sync --locked --dry-run --group dev --group artifacts: passed, 0.094 seconds, no environment mutation. It reports nine packages would be installed, including the local app and optional artifact libraries; this is lock consistency, not a claim that all artifact dependencies are installed or tested.
• Maintained frontend build-artifact verify/apply confirmed all non-static source inputs and 314 generated files match their manifest before import. No generated bundle was hand-edited; release-source.json is not committed. git diff --check passed.
• Required CI and an actual independent approving GitHub review of the final head remain merge gates. Automatic release.yml publication and post-release.yml package smoke remain pending until protected merge.

Limits

No native Windows app/service qualification, native macOS end-to-end enumeration or guest nonloopback IPv6 claim. Explicit platform/filesystem skips remain. The worker-pipe integration uses a task-mounted coordinator, retained-generation fixture and shared-writer-handle seam; it is not uninterrupted live-provider-turn or full production bundle/shared-session-lock evidence. Certificate diagnostics are offline configuration checks, not remote-device trust or served-certificate proof. No running installation is upgraded by this PR/release pilot.

Evidence

• Original exact-source qualification handoff
• Qualification JSON SHA-256: 0ab4ab441690c387d714cfb1737942e3284082a29b5cb112188ab0cb68935f38
• Complete retained guest evidence archive SHA-256: 3a7fe55763226c36d4d611d18c985b6034ee726262fa147ee7d2cfe364f02f66

Release workflow target: one PR -> required CI/review -> protected merge -> automatic publication and installed-package smoke. No competing tag/publisher, no broad repeat campaign, and no live adoption. Repository protections remain unchanged.

[Brian Krabach (bkrabach)]

Exact combined-tree qualification

Qualified behavior head b6cfb01 (base c017f3a) in one owned Docker Compose DTU, Python3.13.12, synthetic nonroot home, no host mounts/credentials/published ports. All3581 tracked file hashes verified before and after; application source unchanged. Frozen dependency comparison differs only by upstream root version.

• Nine network suites: 250 passed,8 skipped (7 nativeWindows;1 no nonloopbackIPv6 in guest).
• Combined permission/runtime suites: 490 passed,6 skipped,2 subtests passed, no deselections. Skips:2 unsupported filesystem aliases;4 nativeWindows/installed-default runtime checks.
• Separate affected subprocess/real-ripgrep/native-child recovery lane:56passed2skipped (overlaps final suite; do not sum). All four cases previously deselected on the author host now passed with real rg in the guest.
• Real aiohttp HTTPS explicit/wildcard numeric sockets, authenticated health probes/per-target failure collection, and doctor missingSAN -> leaf renewal with unchanged CA: 3 passed. Container service-manager state is a fixture seam; not systemd process proof.
• Actual AppService/Management -> RuntimeManager subprocess pipes -> production Worker.command refresh -> Core/reference write_file/edit_file/apply_patch: 1 passed. Same PID/activation/generation/epoch, no new input/model command; earlier snapshots and mounted configs immutable; child/read/denied boundaries and Stop preserved. Initial native mount, retained generation, and shared ownership handle are explicit fixture seams. No actual paid provider turn ran; this is not uninterrupted-provider-turn proof.

Original failed setup, fixture TLS ordering, missing search/PYTHONPATH subprocess invocation, and native-validator interruption receipts retained rather than relabelled. Corrected affected and full runs passed; no application security check weakened. Final full guest status was observed after a host wait timeout; the command was not replayed.

Independent agent security recheck resolved relocated-denial, unguarded-wrapper and ambiguous-instance findings; network reviewer resolved mappedIPv6 local-ownership, missingCA renewal advice, blocking prep, deadline and scopedSAN findings. These are independent boundary reviews, not GitHub approval.

Retained evidence: behavior-guest-evidence.tar,76916736bytes,SHA256 3a7fe55763226c36d4d611d18c985b6034ee726262fa147ee7d2cfe364f02f66, containing exact source manifest, full commands/logs/JUnit and integration fixtures/traces. Summary in task-owned network-dtu/evidence/locked/behavior-qualification.json. Native macOS enumeration and full nativeWindows qualification remain explicit limits. Unsupported/custom writer compositions retain conservative retirement fallback.

No merge/release by this task. Release coordinator owns any subsequent version/assets preparation and independent approval/CI gates.