test(session): pin no-authority nested managed reads on every platform

[Yeachan-Heo]

What

This refresh contains one test file only: packages/coding-agent/test/session/managed-nested-read-pin.test.ts.

It pins the authority-absent nested readExpected contract on every CI platform by spoofing Darwin only while constructing the store. The production source comment from c0985d0a1 was intentionally excluded; this PR does not modify production code.

Exact-head evidence

• Base: 6696988b6dd757f898ab7b33984ba830b6344109 (origin/dev)
• Head: 3d76e44be757a534e9c62d804b5fe637c1bf9661
• Exact base...head binary diff SHA-256: 9662d2625c12219813865118af5aeb1fd09373a6c9f2c243048a5aa5cec20a4d
• Local targeted regression: bun test packages/coding-agent/test/session/managed-nested-read-pin.test.ts — 3 pass, 0 fail.
• Local package check: bun --cwd=packages/coding-agent run check — pass (Biome and TypeScript).
• Affected-path plan at this exact base/head selects the coding-agent check plus test shards; GitHub Actions is running the authoritative plan.

Approval gate

The prior probepark approval was for c0985d0a1 and is not valid for this refreshed head. An independently authenticated exact-head probepark review has been requested. No self-approval is used.

gajae.pr-review-verdict.v1 merge-approved sha256:9662d2625c12219813865118af5aeb1fd09373a6c9f2c243048a5aa5cec20a4d reviewer:human reviewer-id:probepark evidence:independent-architect-review-cross-platform-nested-managed-read-pin-non-tautological-public-readExpected-contract-symlink-boundary-retained-no-global-mutation

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Yeachan-Heo]

Dependency hold — audited against submitted head ff996124d352dd75c6f1419db3fa1c1a294f1ba0 and its exact stacked base e4824ff7580d733f905efc9e1a5868c3459f9530 (#4583).

• Scope is one commit and two paths. The production-file delta is documentation-only around the existing deny guard; the executable follow-up is the new pin test. No fix(session): restore Darwin nested managed reads in readExpected #4583 product-fix code is present in this delta.
• fix(session): restore Darwin nested managed reads in readExpected #4583 remains OPEN against dev, so this PR remains intentionally held and stacked. I will not retarget/reconstruct it until fix(session): restore Darwin nested managed reads in readExpected #4583 reaches a proved terminal disposition.
• Independent red/green proof on an isolated archive of this exact submitted head: native build passed; the pin test is GREEN (3 pass, 0 fail); reinserting #assertPathBackedReadRelative(relativePath) at readExpected makes the same suite RED (1 pass, 2 fail) with managed_nested_path_unsupported. Evidence SHA-256: fd2da7f4007a1a1269d8879068994d0c7257b2fe85f1fea99de0186a5995a72b.
• workflow_dispatch runs 31881962218 and 31881980475 failed before any step, annotation, or runner assignment in Virtual integration validation. The submitted workflow is byte-identical to lane-start dev; this is concurrency/runner admission evidence, not a test(session): pin no-authority nested managed reads on every platform #4585 test failure. Audit SHA-256: 9337860c344467d3346af3b07e0de271ef52803067a562f74a4d259a9956e933.

No approval is being asserted while the dependency is open.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Stacked-PR CI status note. This PR targets fix/darwin-nested-managed-reads (#4583), so Dev CI's pull_request trigger (dev-base only) does not fire for it. Attempted the documented workflow_dispatch lane (runs 31881980475, 31881962218): both fail in Virtual integration validation with 0 steps executed (queued → failure, no runner, no logs, no annotations). Same signature on an unrelated branch's dispatch from 2h earlier (run 31878960298) — the dispatch lane itself is broken, independent of this change.

Local evidence at exact head ff996124d3 (darwin-arm64; the pin's constructor-spoof makes the no-authority branch execute identically on Linux, which is the entire point of the test):

• managed-nested-read-pin.test.ts 3/3 pass; negative control: 2/3 fail red against origin/dev's guarded variant (the exact regression this pins)
• session-manager/ 24 files: 297 pass / 1 fail (pre-existing main failure, unchanged)
• bun --cwd=packages/coding-agent run check: clean

Plan: once #4583 merges, retarget this PR to dev so the full pull_request CI graph runs on this head before its own review.

[Yeachan-Heo]

Dependency hold and lane-ownership receipt:

• This lane now owns exactly submitted PR test(session): pin no-authority nested managed reads on every platform #4585: local owner/pr-4585-current-dev-reconstruct, preserve/pr-4585-submitted, and remote test/pin-darwin-nested-managed-reads all resolve to ff996124d352dd75c6f1419db3fa1c1a294f1ba0. The local upstream was removed to prevent accidental push while held.
• Live stacked base is open fix(session): restore Darwin nested managed reads in readExpected #4583 head f87f4b8d41fdd589c10ff8874ee1502a298de3eb. The PR remains mergeable clean, exact-head approvals are 0, and its contract remains needs-human at digest 864569331866f86d6ca43595c2bf7c953e47e09a0cc267d2f4bcd065779bcc66.
• No fix(session): restore Darwin nested managed reads in readExpected #4583 code has been duplicated or reconstructed. The submitted follow-up delta remains preserved; reconstruction/retargeting is prohibited until fix(session): restore Darwin nested managed reads in readExpected #4583 reaches a proved terminal merge/close disposition.
• Independent pin-test proof remains GREEN (3 pass, 0 fail) and RED under guard reinsertion (1 pass, 2 fail), evidence SHA-256 fd2da7f4007a1a1269d8879068994d0c7257b2fe85f1fea99de0186a5995a72b.
• workflow_dispatch runs 31881962218 and 31881980475 executed zero steps with no runner or annotations; they are classified as concurrency/runner-admission failures, not product failures. Audit SHA-256 9337860c344467d3346af3b07e0de271ef52803067a562f74a4d259a9956e933.

The hold clears only after #4583 terminally merges or closes; this lane then performs the required exact-dev reconstruction/disposition immediately.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Base fix #4583 has merged to dev as squash d332b7890ed95ff71d1a80e00bd4d31809558e69 (parent cd51365cc2). This PR's base branch fix/darwin-nested-managed-reads now points at the final pre-merge head bb0fa99be1. Please re-stack this PR onto dev through this lane's own process — nothing here was absorbed or mutated by #4583. Note post-merge Dev CI on dev currently carries a pre-existing circular-import TDZ failure (END_PATCH_MARKER / web-scrapers) that predates the merge; it is being triaged separately from this stack.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Post-merge reconstruction is complete on the existing PR and branch.

• fix(session): restore Darwin nested managed reads in readExpected #4583 disposition proved: merged to dev as d332b7890ed95ff71d1a80e00bd4d31809558e69.
• Existing test/pin-darwin-nested-managed-reads was force-updated with exact lease from ff996124d3 to reconstructed head c0985d0a1a91614beb457a18e8453f5042265d30; no duplicate PR or implementation commit was created.
• PR test(session): pin no-authority nested managed reads on every platform #4585 is retargeted to dev at exact base d332b7890e.
• git range-diff e4824ff758..ff996124d3 d332b7890e..c0985d0a1a is exact-equivalent (=); the diff is only the explanatory guard comment and managed-nested-read-pin.test.ts.
• Canonical exact-head digest: 32d23a7dc80ee13f0642cd7562a9632da8dd4ad93dd27255aa38b2019fa45aa9; the PR body contains exactly one needs-human verdict line.
• Green proof: 3 pass / 0 fail. Guard-reinsertion negative control: 1 pass / 2 fail with managed_nested_path_unsupported. Package typecheck passed. Evidence report SHA-256: 36ad33afb9cf131cd41f75215a47a0292432c4e4b59d689a0609ae1043a410d1.

Fresh exact-head independent review is requested; merge remains blocked pending non-author approval and replacement CI.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Authoritative replacement CI is terminal product-green for exact head c0985d0a1a91614beb457a18e8453f5042265d30 and digest 32d23a7dc80ee13f0642cd7562a9632da8dd4ad93dd27255aa38b2019fa45aa9.

Run 31892452530: canonical plan, four GJC state shards and aggregate, native build, Windows session regression, package check/type build, the new pin test, resident-cache regression, CLI smoke, evidence producer/aggregate, and virtual integration all passed. The sole red job is the intentional needs-human PR-contract bootstrap.

@probepark @HaD0Yun @IYENTeam — fresh non-author exact-head approval is requested. The diff is one equivalent follow-up commit over merged #4583: explanatory guard comment plus the three-case no-authority nested-read pin. Local negative control restores the rejected guard and fails 2/3 with managed_nested_path_unsupported; current behavior passes 3/3.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[probepark]

Approve at c0985d0a1 - this pins by test what I could only assert by reading

When I approved #4583 I accepted the removal of #assertPathBackedReadRelative on the grounds that
#assertPathBackedDirectoryChain plus captureManagedFileNoFollow subsume it. That was an argument
from reading the source, and I said so - the suite there showed no differential. This closes that
gap properly.

The assertion that matters

it("still rejects a symlinked intermediate directory via the per-component chain walk", async () => {
  const { store, baseDir } = createStoreWithoutAuthority();
  publishNested(store, "artifacts/kept.txt", "present");
  const outside = path.join(baseDir, "outside");
  fs.mkdirSync(outside, { mode: 0o700 });
  fs.writeFileSync(path.join(outside, "escape.txt"), "attacker");
  fs.rmSync(path.join(store.dir, "artifacts"), { recursive: true });
  fs.symlinkSync(outside, path.join(store.dir, "artifacts"));
  expect(() => store.readExpected("artifacts/escape.txt")).toThrow();
});

That is a real escape attempt, not a shape assertion: a genuine directory is replaced with a symlink
pointing outside the store, and the read of a file behind it must throw. Exactly the case the
removed blanket guard used to catch incidentally.

I verified it discriminates rather than trusting it

Deleting the chain walk from the production path:

-				this.#assertPathBackedDirectoryChain(resolved);
+				// MUTATED: chain walk removed

(fail) ManagedSessionDescendantStore.readExpected nested reads without retained authority > still rejects a symlinked intermediate directory via the per-component chain walk
 2 pass  1 fail

Restored, 3 pass / 0 fail. So the test is a live guard: if anyone later decides the chain walk is
redundant the way the blanket check was, CI stops them. That is the property #4583 was missing.

returns null for a missing nested leaf without throwing is the right companion - it pins that
tightening the path checks did not turn a benign ENOENT into an exception, which is the usual
collateral damage when hardening a read path.

merge-approved.

_{Reviewed by @probepark - method: fresh-worktree run at the exact head, then mutated the production chain-walk call away to confirm the symlink-escape assertion fails without it, and restored to confirm the clean result.}

[Yeachan-Heo]

gajae.reconcile-evidence.v1 base:6696988b6dd757f898ab7b33984ba830b6344109 head:3d76e44be757a534e9c62d804b5fe637c1bf9661 sha256:9662d2625c12219813865118af5aeb1fd09373a6c9f2c243048a5aa5cec20a4d scope:test-only local:bun-test-managed-nested-read-pin-3-pass-and-coding-agent-check-pass approval:probepark-exact-head-requested

[probepark]

Independent maintainer review at exact head 056357b. independent-architect-review-cross-platform-nested-managed-read-pin-non-tautological-public-readExpected-contract-symlink-boundary-retained-no-global-mutation

[probepark]

Independent maintainer review at exact head d4f8028. independent-architect-review-cross-platform-nested-managed-read-pin-non-tautological-public-readExpected-contract-symlink-boundary-retained-no-global-mutation

[Yeachan-Heo]

dev advanced pre-merge — rebase/reconstruct executed, stale review/CI invalidated.

dev moved 7265a61c8e… → 9af5c7a0fc… (7 PRs: #4590, #4603, #4619, #4623, #4636, #4643, #4645) while Dev CI run 32095913768 was still in progress at old head 056357b59e…. Nothing was merged from this PR.

Reconstruction:

• Single test commit rebased onto new dev tip: new exact head 5a18002e10311f045157a091a659569455834458, base 9af5c7a0fc528bf3c0e7fdf909d9be966bc4d047.
• Diff remains exactly one test file (packages/coding-agent/test/session/managed-nested-read-pin.test.ts, +93), byte-identical to the approved patch.
• Canonical git diff --binary --full-index --no-ext-diff base...head digest recomputes to the same 9662d2625c12219813865118af5aeb1fd09373a6c9f2c243048a5aa5cec20a4d (the verdict digest binds patch bytes, not SHAs).
• Local verification at the reconstructed head: pin test 3 pass / 0 fail; bun --cwd=packages/coding-agent run check pass (Biome + tsc). No semantic conflicts with the landed session-router/AI changes.

The prior exact-head approval (probepark review 4956988640 @ 056357b59e…) and Dev CI run 32095913768 are stale for the new head. Pushing the reconstructed head to this PR branch now; a fresh exact-head review at 5a18002e10 and green Dev CI on the new head are required before merge.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]