fix(utils): resolve the authoritative home at call time - #4772

Exact-head CI evidence

Head e271a6f156ffcb90dc8a76d1a0ce0ba1fc3f7bb5, base 012f62b52c2489e096a436c65a3fe732b3e250cd, diff digest c98f8956cd768e2b2aa46c7210ff0ca5af0524346000dda30cea672d54ea5781.

First run was a stale-base artifact, not a contract defect

The initial run failed Affected path validation / plan, / evidence producer, and the aggregate. Root cause from the failed step log (job 96476094850, step Verify PR head contains exact base):

##[error]Exact-head CI requires this PR head to contain base 012f62b52c2489e096a436c65a3fe732b3e250cd; rebase onto current dev.

Not missing evidence routing and not a changed-path declaration problem — dev had advanced past the branch point. Rebased onto 012f62b52c (fast-forward, no conflicts, no content change to the fix), then recomputed the digest from the canonical command CI uses:

git diff --binary --full-index --no-ext-diff 012f62b52c...e271a6f156 | sha256sum
# c98f8956cd768e2b2aa46c7210ff0ca5af0524346000dda30cea672d54ea5781

Fresh exact-head status

All affected-path and state gates now pass:

The two remaining reds are the contract gate doing its job, not a defect:

##[error]Verdict needs-human intentionally blocks merge. Obtain independent review
(merge-approved) or, for a low-risk owner change, the explicit merge-self-approved path.

The validator parsed the verdict and refused to merge. That is the correct terminal state for an author-written verdict on a security-boundary change.

Contract state

One verdict line, bound to this exact head, classified high-risk because the diff touches the trusted-home / credential-provenance boundary in packages/utils/src/dirs.ts. merge-self-approved is deliberately not claimed: it is the low-risk owner path, and this change does not qualify.

Post-rebase re-verification on the exact head, pristine HOME:

Independent architect review of the provenance property is in progress; findings will be posted here. Not merging — blocked on independent approval and terminal green, per the needs-human verdict.

🤖 gaebal-gajae

Head mutated — verdict rebound, plus provenance red-team matrix

New exact head e50e6acd2e7c265186d9316e7041a14f20ba8db9, base 012f62b52c2489e096a436c65a3fe732b3e250cd, recomputed digest 10dd86cfccd1ec209a3fecaee255c061b8309b7fe5e1e8e9c4d144e3e0c58101. Exactly one verdict line, rebound to this head. Still needs-human.

Codex review findings addressed (both P1, both valid)

1. Resolver leak in the override test. setAgentDir() replaces the module-level resolver, so restoring only GJC_CODING_AGENT_DIR left later tests in the same worker pinned to a temp dir that afterEach deletes. Now reinstalls the original agent directory through the same entry point and asserts the restore.
2. /etc/passwd read via fs.readFileSync. Converted the test helper to await Bun.file("/etc/passwd").text() per the repository filesystem convention.

Neither touches the production contract; packages/utils/src/dirs.ts is unchanged since the previous head.

Provenance red-team matrix (this head vs. pre-fix d9fabc8f5a)

Every probe spawns bun with a controlled cwd and env and prints the resolved home. Passwd home is /home/bellman; a planted temp dir would be a bypass.

Zero bypasses; every outcome identical to pre-fix.

On the os.homedir() substitution

The pre-fix code read process.env[authoritativeHomeKey]; resolveTrustedHome reads os.homedir(). The concern is whether the ambiguity check declaredHome === runtimeHome could now MISS and honor a planted home. Probed the cases where the two can diverge:

They diverge only when HOME is empty or unset — and in both cases os.homedir() returns the passwd home, i.e. it falls back to the trusted source rather than to attacker input. A planted-and-relative HOME still resolves to the passwd home (verified above). So the substitution is strictly no weaker: divergence moves the value toward the account database, never toward a dotenv-controlled path.

Verification at this head

bun --cwd=packages/utils run check clean. Exact-head contract validator parsed the rebound digest and failed only on the intentional block:

##[error]Verdict needs-human intentionally blocks merge.

Independent architect and red-team reviews are still running; their findings will be posted here. Not merging — blocked on independent approval and terminal green.

🤖 gaebal-gajae

Independent architect review complete — findings addressed, new exact head

New head d3eb487b3fd920e6164fa287ffa38a0f39738ecc, base 012f62b52c2489e096a436c65a3fe732b3e250cd, recomputed digest 57d3ea89e645f732b262ff47e979edd95aea550cd7434b033a9829e8a5a6e204. One verdict line, rebound. Still needs-human.

Review outcome

The reviewer's architectural_status is BLOCK and code_review_recommendation is REQUEST CHANGES, driven by the P1 below — which is explicitly not a regression from this PR's delta.

P1 dirs.ts:240-245 — pre-existing, NOT fixed here, filed as #4773

accountHomeFromSystem()'s final fallback is os.userInfo().homedir, which is HOME-derived (env HOME=/tmp/xyzhome → returns it verbatim). With no usable local /etc/passwd entry for the uid (NSS/LDAP-backed identity, distroless container), the ambiguous-HOME branch can accept attacker-influenceable input.

I am not claiming this fixed. It predates this PR — introduced by d9fabc8f5a, and my red-team matrix showed byte-identical outcomes before and after the os.homedir() substitution across every planted .env shape. Fixing it means choosing between failing closed (breaks NSS-backed identities at startup) or narrowing the documented invariant, which is a product decision that does not belong inside a regression fix under a needs-human verdict. Tracked separately as #4773 with the reviewer's reproduction conditions.

P2 dirs.ts:245-246 — fixed (this one was mine)

My diff memoized the lookup result including failure, latching a transient failure for the process lifetime. Now only a successful lookup is cached:

if (resolved !== undefined) accountHomeCache = resolved;

P2 trusted-home-resolution.test.ts:116-118 — fixed, and the reviewer was right

setAgentDir() can only construct an override resolver, so restoring a default one through it latched #agentDirOverride = true. Reproduced directly: after the restore, a later os.homedir mock left getAgentDir() pinned at the stale temp path instead of re-rooting to <planted>/.gjc/agent, and XDG category routing silently stopped treating it as default. My post-finally assertion could not catch it because it ran before any second home change.

Both agent-directory lanes now run in a spawned probe (fixtures/agent-dir-override-probe.ts) with the override supplied through the child environment, so the parent's module-level resolver is never mutated — no restore juggling at all. probe() sets the platform-authoritative key (USERPROFILE on Windows, HOME elsewhere) and clears the opposite one.

P3 — fixed, and it closes the coverage gap

Added the two-home ordering the reviewer asked for: an operator override stays pinned across a home change, while a default agent dir re-roots to the new home. A third case asserts the parent worker's resolver still follows the ambient home, proving the subprocess cannot leak.

These tests actually catch the regression

Run against the regressed commit d9fabc8f5a: 9 of 10 fail. Against this head: 10 pass. Not tautologies.

Verification at this head

bun --cwd=packages/utils run check clean. Provenance re-verified after the memoization change: planted HOME and hostile USERPROFILE both still resolve to the account home.

Production packages/utils/src/dirs.ts carries exactly one change beyond the reviewed e271a6f156: the P2 memoization fix. Re-requesting independent review at this head. Not merging — blocked on independent approval and terminal green.

🤖 gaebal-gajae

Re-review verdicts: both YES — final P3 addressed, new exact head

Head 31b633bbc558124d8aa3cb8c5c7ef6dd1128a9b0, base 497142cff57ae06b6b79a9af35a726463a3e11fe (dev advanced; rebased), digest 97da9bd40129e74886c9bb2984cc93b5ed8bc076a50aabf9fe1c2fb9bf40b0db. One verdict line, rebound. Still needs-human.

Independent re-review outcome

Confirmed fixed: the memoization P2 (failure no longer latched, no sentinel hole), the test-isolation P2 (no in-process setAgentDir remains; children cannot mutate the parent), and the P3 coverage gap (the two-home ordering "directly catches the reported defect").

Final P3 — the reviewer was right, and I verified it empirically

My isolation test asserted only getConfigRootDir(), which is home-derived and stays correct even when #agentDirOverride is latched — so it would have passed against the exact defect it claimed to rule out. Proved it directly:

configRoot assertion passed despite latch; agentDir = /tmp/pinned  orig = /tmp/gjc-test-agent-F3FbsE
(fail) getAgentDir assertion DOES detect the latch

Both probe lanes and the isolation check now run as one ordered test that captures the parent agent directory before the probes and asserts it unchanged after them. getConfigRootDir() is kept only as a secondary home-follow assertion, not as the isolation proof.

Regression-catching power at this head

Overlaid on the regressed commit d9fabc8f5a: 7 of 8 fail. All pass here. The sole pass there is never treats the project directory as the home, which is orthogonal by construction.

Verification at this head

bun --cwd=packages/utils run check clean. On the previous head CI also routed my new tests as dedicated jobs, both green on the runner:

• Affected path validation / test:packages/utils/test/trusted-home-resolution.test.ts — pass
• Affected path validation / test:packages/utils/test/agent-dir-trust.test.ts — pass
• Affected path validation / check:@gajae-code/utils — pass

(A transient local failure after the rebase was a stale locally built native addon — dev bumped to 0.14.2 and my .node still carried the 0.14.1 sentinel. Rebuilt; unrelated to this change and not present in CI.)

Explicitly not fixed here

The accountHomeFromSystem() HOME-derived fallback (#4773) remains open and is not claimed fixed by this PR. The reviewer independently confirmed those fallback lines are unchanged in this delta and that deferring is defensible while this PR stays scoped to the call-time regression.

Not merging — needs-human stands until an independent exact-head APPROVED review from an identity distinct from me, plus terminal green.

🤖 gaebal-gajae

Terminal exact-head CI: every substantive gate green

Head 31b633bbc558124d8aa3cb8c5c7ef6dd1128a9b0, base 497142cff57ae06b6b79a9af35a726463a3e11fe, digest 97da9bd40129e74886c9bb2984cc93b5ed8bc076a50aabf9fe1c2fb9bf40b0db.

The three earlier Affected path validation reds are fully resolved; they were a stale-base artifact, not an evidence-routing or changed-path-declaration defect. Both regression suites this PR adds run as their own CI jobs on the runner and pass there, not just locally.

The only remaining reds are the contract gate refusing to merge on my own verdict:

##[error]Verdict needs-human intentionally blocks merge. Obtain independent review
(merge-approved) or, for a low-risk owner change, the explicit merge-self-approved path.

That is the correct terminal state, not a defect to clear. merge-self-approved is deliberately not claimed: it is the low-risk owner path, and a change to the trusted-home / credential-provenance boundary does not qualify.

Ready for human review

• Independent architect review: both verdicts YES (provenance preserved by the delta; scope complete and correct), architectural_status WATCH, recommendation COMMENT. All four findings it raised are either fixed here or explicitly deferred with an owner.
• Provenance red-team: 12 attack shapes, zero bypasses, outcomes identical to pre-fix d9fabc8f5a.
• Regression power: the new suite fails 7/8 on the regressed commit and passes fully here, so it locks the defect rather than describing it.
• Deferred and not claimed fixed: bug(utils): account-home fallback is HOME-derived, so the trusted-home invariant fails open without a local passwd entry #4773 (accountHomeFromSystem() HOME-derived fallback), independently confirmed pre-existing and unchanged by this delta.

What this needs now is a maintainer's authenticated exact-head APPROVED review from an identity distinct from mine. I am not merging, tagging, or publishing.

🤖 gaebal-gajae

Second production defect found and fixed — new exact head

Head b5da93e8bc10a96e19a5946b4cb4ef57a9e5d7e4, base 497142cff57ae06b6b79a9af35a726463a3e11fe, digest e55e226799e989f40547ed99695b4dba2d49212ef6da302939aae9802659b9ae. One verdict line, rebound. Still needs-human.

P2 dirs.ts:399 — real, reproduced, fixed

Codex caught a genuine production defect that my call-time refresh introduced, and it is not cosmetic. refreshCategoryDirs() inferred "is this the default agent dir?" from path equality alone. That inference was previously only reachable at construction; making the home refreshable at runtime made it reachable on every home change. Consequence: an explicit GJC_CODING_AGENT_DIR that happens to equal <newHome>/.gjc/agent starts following $XDG_DATA_HOME.

Reproduced before touching anything — the agent dir looks unchanged while the database silently relocates:

before: agentDir= /tmp/tmp.Bsx4.../.gjc/agent
        agentDb = /tmp/tmp.Bsx4.../.gjc/agent/agent.db
after : agentDir= /tmp/tmp.Bsx4.../.gjc/agent     <- unchanged
        agentDb = /tmp/tmp.Ao0f.../gjc/agent.db   <- jumped into XDG

That is a silent user-state relocation: writes land in one store and later reads in another. Fix is one line of intent — the override state, not the path shape, decides whether XDG may apply:

isDefault = !this.#agentDirOverride && this.agentDir === path.join(this.configRoot, "agent")

and refreshConfigDirOverride() now passes !this.#agentDirOverride explicitly rather than letting the default re-infer it.

Coverage. The probe fixture now also reports getAgentDbPath(), so the XDG lane is observable, and a dedicated case pins the exact scenario. Verified it bites: reverting only the resolver change fails that case and only that case (8 pass / 1 fail), and restoring it returns 9/9. The override lane also asserts after.agentDb === before.agentDb.

P1 sync filesystem — fixed

Temp-dir helper and cleanup moved to node:fs/promises (mkdtemp / rm) per the repository convention; call sites and the enclosing cases are now async.

Verification at this head

bun --cwd=packages/utils run check clean. Provenance re-verified after the change: planted HOME and hostile USERPROFILE both still resolve to the account home.

Standing review state

The independent architect re-review returned both verdicts YES with status WATCH; its only open item was the P3 isolation assertion, already fixed in 31b633bbc5. This new P2 arrived after that review, so the delta since it was last examined is: the XDG-lane fix, its regression case, and the async-fs conversion.

#4773 remains open and is still not claimed fixed here.

Re-requesting review at this head. Not merging — needs-human stands pending an authenticated exact-head approval from an identity distinct from mine.

🤖 gaebal-gajae

Terminal exact-head CI at b5da93e8bc — 18 green, 3 intentional

Every substantive gate passes, including both regression suites as dedicated runner jobs and the full affected-path matrix (native-build, install-methods, darwin-arm64 tab-worker smoke, evidence producer, check:@gajae-code/utils, both ts-build lanes), plus Virtual integration validation, Local public surfaces, and all four gjc-state-gates.

The three reds are one cause, and it is the gate working correctly:

##[error]Verdict needs-human intentionally blocks merge.

No stale-digest error — the validator accepted e55e2267… against this exact head.

Where this landed

Two of those were real production defects in my own change, both found by review rather than by me, and both reproduced before being fixed. Every regression case was verified to fail on the code it guards — the suite fails 7/8 on d9fabc8f5a, and reverting only the XDG-lane fix fails that case and no other.

Ready for a human

• Independent architect: both verdicts YES, status WATCH, recommendation COMMENT.
• Provenance: 12 attack shapes, zero bypasses, identical to pre-fix.
• Local: utils 378/0 under both pristine and ambient HOME; skills 36/0; MCP red-team 16/0.

What remains is not something I can or should clear myself: an authenticated exact-head APPROVED review from an identity distinct from mine. merge-self-approved stays unclaimed — it is the low-risk owner path, and this touches the trusted-home boundary. No merge, tag, or publish from me.

🤖 gaebal-gajae

Signed exact-head UID-cache fix status

head=60694e75f0b66a34fc35ff3150dcea27654384c2 base=ba7096f72184929070f295019e8173c41ab1e468 digest=6711f35b14bcf66a143698c6ceb46899411e7ccb38f4d0c151a8e3d400bcbdd3

The worktree was reconciled to remote 191d942d, the unrelated #4784 skill-discovery edits were discarded, and the unique effective-UID cache fix was integrated and pushed once as 60694e75. The fix keys NSS cache entries by effective UID plus account identity; failed B lookup and concurrent A→B→A transition coverage are included. #4783 is already in base ba7096f and was not duplicated.

Local evidence: UID transition/security suites 43 pass / 5 skip; full @gajae-code/utils suite 397 pass / 5 skip; utility type/lint check passes. The ambient user-scope discovery suite still has pre-existing HOME/os.homedir test-environment failures and was not carried into this head as unrelated skill-discovery code.

Fresh exact-head review is requested from snowykr. Full affected CI is required for this new head; no merge is authorized until the exact-head review approves and every required gate is green.

Final exact-head review request: head=60694e75f0b66a34fc35ff3150dcea27654384c2, base=ba7096f72184929070f295019e8173c41ab1e468, digest=6711f35b14bcf66a143698c6ceb46899411e7ccb38f4d0c151a8e3d400bcbdd3. The UID-cache A→B→A security test and full utils checks pass; no stale 6008... digest remains in the PR body, issue comments, or reviews. Please review this exact head. No merge is authorized until your approval and all required CI gates are green.

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head 60694e75f0b66a34fc35ff3150dcea27654384c2, base ba7096f72184929070f295019e8173c41ab1e468, digest 6711f35b14bcf66a143698c6ceb46899411e7ccb38f4d0c151a8e3d400bcbdd3. One canonical verdict line; the checklist and digest now name this head, and no stale head references remain in the body.

I shipped a real regression and a third critic pass caught it

My earlier fix for the reviewer's XDG finding was wrong, and I have reverted it.

setAgentDir() exports GJC_CODING_AGENT_DIR. A child process therefore inherits the exact value the parent set programmatically and cannot distinguish it from an operator-supplied one. Gating XDG on "override state" put parent and child on different storage lanes for one logical profile:

parent (setAgentDir default) -> $XDG_STATE_HOME/gjc/python-gateway
child  (inherited env var)   -> <agentDir>/python-gateway     ** diverges **

Confirmed against base 343067ab8f, where the child correctly follows XDG — so this was mine, not pre-existing. Splitting a live store across processes is worse than the narrow complaint the change was meant to answer, so an agent directory equal to the home-derived default is the default profile however it arrived. The sticky #xdgEligible decision is retained, so a lane still cannot change mid-process when a home refresh makes a path coincide.

Re-applying the reverted gating fails the new parent/child regression; the pinned dirs-python-gateway contract stays green either way.

The earlier snowykr finding is therefore not fixed as originally requested, and I am not claiming it is. It is a genuine trade-off: honoring it as stated breaks parent/child consistency. If the maintainer wants inherited overrides off XDG, that needs a way to distinguish propagation from operator intent — worth its own issue, not a silent change here.

Also integrated

A concurrent commit on this branch (60694e75, not mine) scopes the account-home cache by effective uid so a cached NSS home cannot cross a uid transition. Fast-forwarded rather than clobbered; all invariants re-verified on the combined tree.

Exact-head CI

15 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, both ts-builds, evidence producer, Virtual integration validation, Local public surfaces, all four gjc-state-gates. The three reds share one cause and carry no stale-digest error:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 397 pass / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; both check targets clean; 12-shape provenance matrix with zero bypasses; parent/child lane consistency verified directly.

Fourteen defects were found across review rounds, eight of them in my own change — including three found after I had declared the work finished. Each was reproduced before being fixed and reverted afterwards to confirm its regression bites.

Blocking action, human-only: one authenticated APPROVED review at exact head 60694e75f0. merge-self-approved is restricted to low-risk owner changes and this is high-risk; three independent critic passes rejected direct merge, risk downgrade, gate bypass, and splitting. #4761 stays open until this merges.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head bf23f94498f7525ae3008f8fac6b76bc92618f78, base ba7096f72184929070f295019e8173c41ab1e468, digest dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292. One canonical verdict line; checklist, digest and head references all name this head.

Fourth critic pass — in-scope items fixed, one filed separately

Fixed here:

• Platform- and NSS-gated cases returned silently, so a vacuous pass was indistinguishable from a real assertion in CI output. They now report why they skipped.
• Two storage-lane cases had identical setup and overlapping assertions, and one still carried the comment for the override-state gating I reverted. Consolidated into the single lane-stability case.

Filed as #4786, not fixed here: module-level home-derived constants outlive the now call-time home — e.g. packages/ai/src/auth-broker/remote-store.ts:78 builds DEFAULT_PRESENTATION_SIDECAR from getConfigRootDir() at import. That is the same shape as #4761 one layer out, and it matters for credential coherence since <configRoot>/.env is a trusted source.

It is genuinely out of scope: introduced by bc63eaaa88 (#4512), present on dev today, and this PR's diff touches only packages/utils. It became observable because the resolver is now mutable, but the import-time capture predates that. Fixing consumer modules in packages/ai inside a packages/utils regression fix under a needs-human verdict would be the wrong place for it.

Exact-head CI

19 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, both ts-builds, evidence producer, native-build, darwin-arm64, Virtual integration validation, Local public surfaces, all four gjc-state-gates. Two reds, one cause, no stale digest:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 396 pass / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; dirs-python-gateway 3/0; both check targets clean; 12-shape provenance matrix with zero bypasses; parent/child storage-lane consistency verified directly.

Across four independent critic passes and two reviewer rounds, sixteen defects were found — nine in my own change, four of them after I had first declared the work finished. Each was reproduced before being fixed and reverted afterwards to confirm its regression bites. Two findings I declined to "fix" and documented instead, because implementing them as stated would break a pinned contract (#4772 comment above) or belongs to another package (#4786).

Blocking action, human-only: one authenticated APPROVED review at exact head 8ed2bc1df2. merge-self-approved is policy-restricted to low-risk owner changes; this is high-risk, and every critic pass rejected direct merge, risk downgrade, gate bypass and splitting as illegitimate. #4761 stays open until this merges, then closes against the merged dev SHA with a re-run reproduction.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

Final exact-head status: head=bf23f94498f7525ae3008f8fac6b76bc92618f78, base=ba7096f72184929070f295019e8173c41ab1e468, digest=dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292. The owner fix-forward replaces Linux-only NSS test early returns with Bun framework it.skipIf reporting; Linux execution is unchanged. UID transition/NSS/trusted-home/agent-dir suites pass (42 pass / 5 skip), utility check passes, and the pushed head contains no #4784 skill-discovery changes. snowykr is requested for this exact head; full CI must rerun. No merge is authorized until exact-head approval and all required gates are green.

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head bf23f94498f7525ae3008f8fac6b76bc92618f78, base ba7096f72184929070f295019e8173c41ab1e468, digest dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292. One canonical verdict line; head, base and digest in the checklist all name this head, and the stale 371 pass count and wrong base SHA are corrected.

Fifth critic pass — both items closed

Vacuous skips. My previous "fix" only printed a warning and still returned early, so platform-gated cases counted as passing assertions on non-Linux. Now it.skipIf, which reports a runner-level skip. Proven by forcing the gate: 7 skip / 0 pass instead of 7 silent passes.

A concurrent agent landed the identical itLinux/skipIf change as bf23f94498 while I was preparing mine. I dropped my duplicate and took theirs after verifying equivalence (6 itLinux call sites, zero leftover early returns) rather than clobbering another lane's work.

Stale PR metadata. The checklist named base a34cbd700b when the actual base is ba7096f721, and the testing section still claimed 371 pass. Both corrected; no stale references remain.

Exact-head CI

15 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, both ts-builds, evidence producer, Virtual integration validation, Local public surfaces, all four gjc-state-gates. Two reds, one cause, no stale digest:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 396 pass / 5 skip / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; both check targets clean; 12-shape provenance matrix with zero bypasses.

Eighteen defects surfaced across two reviewer rounds and five independent critic passes — eleven in my own change, six of them found after I first called the work finished. Each was reproduced before being fixed and re-broken afterwards to confirm its regression bites. Three findings I declined to implement as stated and documented instead: routing inherited GJC_CODING_AGENT_DIR off XDG (splits parent/child storage lanes — reverted with reasoning above), module-level home-derived constants in packages/ai (pre-existing from #4512 — filed as #4786), and the original snowykr XDG framing that the first of those supersedes.

Blocking action, human-only: one authenticated APPROVED review at exact head bf23f94498. merge-self-approved is policy-restricted to low-risk owner changes; this is high-risk, and all five critic passes rejected direct merge, risk downgrade, gate bypass and splitting as illegitimate. #4761 stays open until this merges, then closes against the merged dev SHA with a re-run reproduction.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

Note: a late architect review landed against a stale head — both P1s already adjudicated

A long-running review just completed against head 4b8ad444 / base 6a55d0f12d. The branch is now at bf23f94498 / base ba7096f721, several heads later, so its findings are recorded here rather than silently dropped.

It raised two P1s. Both are already resolved or deliberately decided, with evidence:

P1 — "the ambiguous-home distinctness rule is broadened." Correct observation, intentional change. The old rule tested independence by string inequality (accountHome !== runtimeHome), which discarded the account lookup precisely when it agreed. That locked an operator out of their own user state whenever a checkout declared HOME dynamically — reproduced on clean dev as User state is unavailable: no trustworthy home directory. Independence is now a property of the source: NSS cannot be influenced by HOME, so its answer is evidence whichever path it names; an os.userInfo() fallback never is.

Re-verified at the current head just now:

The fail-closed property the reviewer wants protected is intact; what changed is that corroboration is no longer mistaken for self-justification.

P1 — "an environment-declared default-path agent override is still routed through XDG at startup." This is the snowykr finding. I implemented it, then reverted it, because setAgentDir() exports GJC_CODING_AGENT_DIR — a child inherits the exact value the parent set programmatically and cannot distinguish it from operator intent. Routing the inherited form off XDG put parent and child on different storage lanes for one profile ($XDG_STATE_HOME/gjc/python-gateway vs <agentDir>/python-gateway), splitting a live store. Full reasoning and reproduction are in the comment above; honoring the finding as stated needs a way to distinguish propagation from selection, which belongs in its own issue.

The review's test-quality points (non-discriminating failed-getent, traversal, and LDAP/SSSD paths) were independently raised and fixed in later passes: failures are now injected through the resolver's own lookup rather than simulated beside it, and platform-gated cases report real skipIf skips instead of vacuous passes.

No head change, so the digest and verdict line are unaffected: head bf23f94498f7525ae3008f8fac6b76bc92618f78, digest dcbed0e7ab50b3cdbb46cb2b5257d714bff10a51879c86aa4add941fba597292, still needs-human.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

Final exact-head status: head=ee43d7db2444ad6ad481d0044b1013b493e18ce0, base=ba7096f72184929070f295019e8173c41ab1e468, digest=a94b2aac2fae6c3a05475622eb094729ebb50dc27b1c4511a77b84caffdad458. The explicit plugin-home P2 is fixed: caller-supplied getPluginsDir(home) now returns the explicit config path when authoritative-home resolution is unavailable, while equal-home/default XDG behavior remains unchanged and is regression-tested. UID/NSS/trusted-home/agent-dir tests pass (44 pass / 5 skip) and utility check passes. Fresh exact-head snowykr review is requested; full CI must rerun. No merge is authorized until exact-head approval and all required gates are green.

Terminal verdict: OWNER_CONFIRMATION_REQUIRED

Head c1542c4bce28716bc19ffdfd25e80cde1b02a4fb, base ba7096f72184929070f295019e8173c41ab1e468, digest 5e0a9dfeaad525e9a3d23654debd7eaed8ce507406079250b215dcb6855e6a30. One canonical verdict line; head, base, digest and counts in the checklist all name this head.

A late architect review (head 024c019) accepted the production design and found four more harness defects — all fixed

Its four explicit acceptance verdicts were ACCEPT on root-alias handling, cache provenance / NSS memoization, lazy-lookup equivalence, and — notably — the constructor contract: "initial path equality plus sticky eligibility is the correct current contract; reject the override-state-only change for this PR." That independently confirms the revert I made after the parent/child lane split, and closes out the snowykr framing.

Fixed at this head:

• refreshCategoryDirs kept a defaulted isDefault still encoding the rejected override-state policy. Unreachable, but it invited exactly the path-shape recomputation stickiness exists to prevent. The argument is now required, so there is no second source of truth.
• Missing converse coverage. Only the non-default→default transition was tested. Added the reverse: a dir that was default at construction stays on XDG after a refresh makes its path non-default. Reverting stickiness now fails both lane cases (12 pass / 2 fail), not one.
• Catch-all REFUSED. The cache-provenance probe mapped every exception to REFUSED, so an import failure or a bad patch would satisfy the assertion and hide the real error. It now rethrows anything that is not the known refusal.
• Stale docs. getTrustedConfigRootDir() was still described as "stable" although it is call-time, and the changelog still framed independence as a value comparison after the source-provenance rule replaced it.

Its remaining harness points about forcing the NSS/fallback branches were already addressed in later passes: failures are injected through the resolver's own lookup, and platform-gated cases report real skipIf skips.

Also confirmed by that review: the #4773 deferral premise is obsolete — #4779 is in the base, and this delta stays compatible with its fail-closed rule.

Exact-head CI

19 passing — affected-path aggregate, all three regression suites as dedicated jobs, check:@gajae-code/utils, install-methods, native-build, darwin-arm64, evidence producer, both ts-builds, Virtual integration validation, Local public surfaces, all four gjc-state-gates. Three reds, one cause, no stale digest:

error: Verdict needs-human intentionally blocks merge.

Final state

utils 397 pass / 5 skip / 0 fail under pristine and ambient HOME; skills 36/0; MCP red-team 16/0; both check targets clean; 12-shape provenance matrix with zero bypasses.

Twenty-three defects across two reviewer rounds and six independent review passes — fifteen in my own change, ten found after I first called the work finished. Each was reproduced before being fixed and re-broken afterwards to confirm its regression bites.

Blocking action, human-only: one authenticated APPROVED review at exact head c1542c4bce. merge-self-approved is policy-restricted to low-risk owner changes; this is high-risk, and every review pass rejected direct merge, risk downgrade, gate bypass and splitting. #4761 stays open until this merges, then closes against the merged dev SHA with a re-run reproduction.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

Current head is approved by snowykr. A body-only exact-head refresh was issued to obtain fresh PR contract/bootstrap and current Dev CI evidence; no source/head mutation occurred. Merge remains gated on fresh current checks.