release(r30): finalize adopted Agent OS registry, installer, and proof

.gitattributes

@@ -1,3 +1,4 @@
 *.sh text eol=lf
 scripts/*.sh text eol=lf
 scripts/*.ps1 text eol=lf
+docs/r30/patches/*.patch binary

.github/workflows/ci.yml

@@ -18,6 +18,32 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  browser-use-dependency-compatibility:
+    name: browser-use-dependencies (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Prove browser-use dependency compatibility
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install '.[browser-use]'
+          python -m pip check
+          python -c "import browser_use, litellm"
+
   test-and-audit:
     name: test-and-audit
     runs-on: ubuntu-latest
@@ -59,6 +85,12 @@ jobs:
         run: |
           python -m spark_cli.cli verify --registry-pins --json | python -c "import json,sys; d=json.load(sys.stdin); n=int(d.get('unverified', 0)); assert n <= 3, f'unexpected unverified pins: {n}'; print('unverified:', n)"
 
+      - name: release_policy_binding_gate
+        run: python scripts/harness_checks/release_policy_binding_gate.py --root . --range "${{ github.event.pull_request.base.sha && format('{0}..{1}', github.event.pull_request.base.sha, github.sha) || 'HEAD' }}"
+
+      - name: gate_evidence_separation
+        run: python scripts/harness_checks/gate_evidence_separation.py --root . --range "${{ github.event.pull_request.base.sha && format('{0}..{1}', github.event.pull_request.base.sha, github.sha) || 'HEAD' }}"
+
   secret-scan:
     name: secret-scan
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -36,9 +36,9 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@dc73d59c2d7bd4f8194098a91219eeee6d8a1719 # v4
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           languages: python
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@dc73d59c2d7bd4f8194098a91219eeee6d8a1719 # v4
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1

.github/workflows/docker-optional.yml

@@ -42,12 +42,17 @@ jobs:
       - name: Run sandbox help with hardened flags
         run: |
           docker run --rm \
+            --user 1000:1000 \
             --network none \
             --read-only \
             --cap-drop ALL \
             --security-opt no-new-privileges \
+            --pids-limit 128 \
+            --memory 512m \
+            --memory-swap 512m \
+            --cpus 1.0 \
             --tmpfs /tmp:rw,noexec,nosuid,size=256m \
-            --tmpfs /sandbox:rw,nosuid,uid=1000,gid=1000,size=512m \
+            --tmpfs /sandbox:rw,noexec,nosuid,uid=1000,gid=1000,size=512m \
             spark-cli-sandbox:ci \
             --help
 

AGENTS.md

@@ -56,6 +56,7 @@ Use allowlisted serializers for read models. If a source payload contains unknow
 
 ## Authority and Route Rules
 
+- **Before adding or changing any route / approval / fallback logic, read `docs/harness-discipline/` (start at `00_README.md`).** It is the harness-wide fix-discipline ruleset grounded in the 2026-06-24 audit. Non-negotiables that bite CLI work directly: no route-specific regex may own execution authority (`RL-01`); the approval gate must bind to the parsed/typed action, never a re-tokenized `argv` (`R-01`, fixes `approval.py`/`cli.py:17925`); `requires_approval` must mean *enforced* (`RL-05`); a security toggle must not be re-readable from mutable runtime (`RL-06`, fixes `SPARK_APPROVAL_ENFORCE`); and a failure must never return a success-shaped value (`RL-08`). New "for now" code needs a stopgap retirement owner (`R-15`).
 - CLI may own operator diagnostics and local repair guidance, but Builder owns RouteConfidenceGateV1 and AOC route judgment.
 - `spark fix` and `spark doctor` outputs should expose metadata-only route context and verification commands, not mutate high-risk surfaces without explicit gates.
 - High-agency actions must fail closed unless authority, capability, freshness, consequence risk, confirmation, and privacy boundary are known.

README.md

@@ -458,6 +458,10 @@ Use `spark <cmd> --help` for full flags.
 | `spark secrets list|set|get|delete` | Keychain-backed secret store |
 | `spark config get|set|unset|list` | User config at `~/.spark/config/config.json` |
 
+`spark doctor llm` rejects provider URLs containing credentials, query strings, fragments, unsafe schemes, or private/metadata targets. For direct provider calls it validates every DNS answer, pins the request to the validated address while preserving TLS hostname verification, and does not follow redirects.
+
+`spark os compile` writes memory-movement and voice-surface read models with redacted `request_ref`/`trace_ref` compile metadata. Those refs prove compiled read-model lineage; they do not authorize memory movement, cleanup, promotion, voice transcription, speech synthesis, Telegram delivery, or execution.
+
 `spark update` checks all selected installed-runtime clones for local edits before it stops services or runs install commands. Use `spark update --stash-local-runtime` for intentional local hotfix testing, `spark update --skip-dirty` to update only clean modules, and `spark update --continue` after manually fixing a preflight stop. If runtime processes were stopped and `SPARK_AUTOSTART=1`, update restarts Spark Live and prints a compact post-update health summary; use `--no-live-restart` to keep the stack manual.
 
 ## State Layout

docs/ACCESS_LEVEL5_READ_ONLY_ELIMINATION_AUDIT_2026-06-28.md

@@ -0,0 +1,145 @@
+# Access Level 5 Read-Only Elimination Audit - 2026-06-28
+
+Status: active proof, not just documentation.
+
+## Invariant
+
+When a trusted Telegram chat moves from Access level 1, 3, or 4 to Access level
+5, Spark must not merely store the chat preference. The transition is valid only
+when all of these are true:
+
+1. `spark access status --level 5 --json` reports `effective_access_level=5`.
+2. Level 5 service guardrails are active for Spawner and the active Telegram
+   service profile.
+3. `level5.effective_codex_sandbox` is exactly `danger-full-access`.
+4. The Telegram runner proves it can write a temporary state file before the chat
+   is marked operator.
+5. Default Codex worker launchers use the persisted Level 5 service guardrails
+   even when the current parent process still has stale `read-only` or
+   `workspace-write` values.
+6. `level5.full_permission_proof.ok` is `true`; when the proof object is
+   present, Telegram treats it as authoritative and does not fall back to older
+   green-looking fields.
+
+If any one of those is false, Spark must say Level 5 is blocked or partial; it
+must not claim full operator access.
+
+## Current Live State
+
+Fresh local audit on 2026-06-28, rechecked after Spawner access-action runner
+hardening:
+
+- Effective access level: `5`
+- Level 5 activation state: `active_for_services`
+- Service enabled: `true`
+- Current shell process enabled: `false`
+- Current shell Codex sandbox: `workspace-write`
+- Service Codex sandbox: `danger-full-access`
+- Effective Codex sandbox: `danger-full-access`
+- Full permission proof: `ok=true`, `missing=[]`
+- Spark workspace writable: `true`
+- Service can operate whole computer: `true`
+- Missing/stale services: none
+- Skipped unstartable Telegram profiles: `sparkqa-bot`
+- `spark live status --json`: `ok=true`, no unhealthy modules reported
+
+The current shell not carrying Level 5 env is acceptable only because the worker
+launchers read persisted module guardrails before launching Codex. A launcher that
+uses stale process env directly is a release bug.
+
+## Guardrail Coverage
+
+- Spark CLI writes the Level 5 bundle into Spawner and every Telegram profile env:
+  `SPARK_ALLOW_HIGH_AGENCY_WORKERS=1`,
+  `SPARK_ALLOW_EXTERNAL_PROJECT_PATHS=1`, and
+  `SPARK_CODEX_SANDBOX=danger-full-access`.
+- Spark CLI requires active service restart proof before reporting Level 5 as
+  effective for services.
+- Telegram refuses to switch the chat to operator unless the CLI payload proves
+  effective full-access sandbox and the Telegram runner write probe passes.
+- Telegram now consumes `level5.full_permission_proof` directly. If that proof
+  exists and is not green, the chat stays out of operator mode even if older
+  compatibility fields look green.
+- Telegram natural language changes such as "change my access level from one to
+  five confirm" preserve the confirmation and still require fresh Level 5 proof.
+- Spawner default Codex launch paths now have regression coverage proving stale
+  `read-only` process env is promoted from persisted Level 5 service guardrails.
+- Spawner access execution actions now use the same persisted Level 5 env
+  promotion before launching `spark` actions, so access repair/setup commands do
+  not inherit stale `read-only` from the service parent process.
+
+## Proof Commands
+
+Fresh focused proof passed:
+
+```bash
+npm test -- --run \
+  src/lib/server/access-execution-actions.test.ts \
+  src/lib/server/high-agency-workers.test.ts \
+  src/lib/server/provider-clients/codex-cli-client.test.ts \
+  src/lib/services/spark-agent-bridge.test.ts \
+  src/routes/api/access/execution-lanes/access-execution-lanes.integration.test.ts
+```
+
+Result: 2026-06-28 Spawner proof passed with 44 tests, including the regression
+that a stale `SPARK_CODEX_SANDBOX=read-only` service process still launches
+access actions with persisted `danger-full-access` Level 5 env.
+
+```bash
+npm run build
+```
+
+Result: 2026-06-28 Spawner build passed.
+
+```bash
+npm run test:run -- \
+  src/lib/server/provider-clients/codex-cli-client.test.ts \
+  src/lib/services/spark-agent-bridge.test.ts
+```
+
+Result: 22 Spawner tests passed.
+
+```bash
+PYTHONPATH=src python3 -m pytest -q tests/test_access.py \
+  -k 'level5_transition or active_for_services or service_proof'
+```
+
+Result: 5 Spark CLI tests passed, 25 deselected, 6 subtests passed.
+
+```bash
+npm test -- --run \
+  tests/accessLevel5Natural.test.ts \
+  tests/level5RuntimeEnv.test.ts \
+  tests/accessActions.test.ts \
+  tests/accessPolicy.test.ts
+```
+
+Result: Telegram Access 5, stale-env promotion, and permission-proof tests passed.
+
+```bash
+npm test -- --run tests/accessPolicy.test.ts tests/accessActions.test.ts \
+  tests/profileEnv.test.ts tests/recursiveLevel5RuntimeEnv.test.ts
+```
+
+Result: 2026-06-28 focused Telegram proof passed, including CLI proof-object
+adoption and stale read-only env promotion.
+
+## Non-Bugs That Can Still Say Read-Only
+
+- Historical mission result rows may still contain old read-only failure text.
+  They are evidence history, not current capability truth.
+- Intentionally read-only creator missions and diagnostic routes must remain
+  read-only even under Access 5.
+- A random Codex Desktop thread can still have a lower current-process sandbox.
+  Spark may only claim full access for work launched through the proven Level 5
+  service lane or a process that itself proves `danger-full-access`.
+
+## Maintenance Rule
+
+Any new Codex launch surface must add a test for this exact stale-env shape:
+
+- persisted service env says Level 5 full access,
+- current process env says `SPARK_CODEX_SANDBOX=read-only` or `workspace-write`,
+- default Codex launch resolves to `--sandbox danger-full-access`,
+- `level5.full_permission_proof.ok` is the authoritative full-access verdict,
+- intentionally read-only commands remain intentionally read-only.

docs/LAUNCH_RUNBOOK.md

@@ -26,6 +26,21 @@ Run this from the exact branch or worktree intended for production. Do not push
 installer changes until this gate passes and any paired Spark repo updates are
 ready to ship together.
 
+For the R30 installer batch, start from:
+
+- [R30 documentation index](./R30_DOCUMENTATION_INDEX_2026-06-27.md)
+- [R30 release plan](./R30_RELEASE_PLAN_2026-06-27.md)
+- [R30 source owner audit](./R30_SOURCE_OWNER_AUDIT_2026-06-27.md)
+- [R30 owner handoff packet](./R30_OWNER_HANDOFF_PACKET_2026-06-27.md)
+- [R30 evidence packet](./R30_EVIDENCE_PACKET_2026-06-27.md)
+- [R30 installer preparation checklist](./R30_INSTALLER_PREP_2026-06-27.md)
+- [R30 Domain Chip Labs Telegram creator plan](./R30_DOMAIN_CHIP_LABS_TELEGRAM_CREATOR_PLAN_2026-06-28.md)
+- [R30 Domain Chip Labs and Spawner readiness spec](./R30_DCL_SPAWNER_READINESS_SPEC_2026-06-28.md)
+- [R30 Telegram live trace recapture](./R30_TELEGRAM_LIVE_TRACE_RECAPTURE_2026-06-28.md)
+- [R30 stability, Domain Chip Labs, and Spawner goal prompt](./R30_STABILITY_DCL_SPAWNER_GOAL_PROMPT_2026-06-28.md)
+- [R30 public release note draft](./R30_RELEASE_NOTE_DRAFT_2026-06-27.md)
+- [R30 goal prompt](./R30_GOAL_PROMPT_2026-06-27.md)
+
 ```bash
 python -m pytest
 python -m spark_cli.cli verify --installers --json
@@ -82,18 +97,24 @@ bash ./install.sh
 Both installers install the CLI, run the default starter setup, and write Spark
 state under `~/.spark` unless `SPARK_HOME` is set.
 
-## Non-interactive setup
+## Identity Setup
+
+Use a BotFather token and at least one Telegram admin id. Keep secrets in a
+shell prompt, `@env:` references, or the Spark secret backend; do not paste them
+into files that may be committed.
 
-Use a BotFather token and at least one Telegram admin id. Keep secrets in
-environment variables or a shell prompt; do not paste them into files that may be
-committed.
+Initial Telegram identity and operator-access setup is intentionally
+interactive. A non-interactive command that includes `--bot-token` or
+`--admin-telegram-ids` is a sensitive `identity_access_mutation` and must fail
+closed before writing generated config or state. Use an interactive terminal for
+the initial identity mutation:
 
 ```bash
-spark setup --non-interactive \
-  --bot-token "$TELEGRAM_BOT_TOKEN" \
-  --admin-telegram-ids "$TELEGRAM_ADMIN_IDS" \
+spark setup \
+  --bot-token "@env:TELEGRAM_BOT_TOKEN" \
+  --admin-telegram-ids "@env:TELEGRAM_ADMIN_IDS" \
   --llm-provider zai \
-  --zai-api-key "$ZAI_API_KEY"
+  --zai-api-key "@env:ZAI_API_KEY"
 ```
 
 Z.AI launch defaults:
@@ -103,7 +124,7 @@ Z.AI launch defaults:
 
 OpenAI launch default:
 
-- model: `gpt-5.5`
+- model: `gpt-5.6-sol`
 
 The installer stores cloud keys through the Spark secret backend. Generated
 module env files should contain secret references and non-secret metadata, not
@@ -141,9 +162,11 @@ Then verify in Telegram:
 - a normal message receives an LLM-backed response
 - `/diagnose` reports Telegram, LLM, memory, and mission relay state
 
-## Sandbox smoke
+## Sandbox Smoke
 
-Before launch, run at least one clean install with an isolated `SPARK_HOME`.
+Before launch, run at least one guarded refusal smoke with an isolated
+`SPARK_HOME`. This proves unattended identity mutation fails closed; it is not a
+successful fresh install.
 
 Windows PowerShell:
 
@@ -158,8 +181,7 @@ spark setup --non-interactive `
   --no-autostart `
   --no-start-now `
   --skip-install-commands `
-  --skip-runtime-check
-spark status --json
+  --skip-runtime-check; "exit=$LASTEXITCODE"
 ```
 
 Linux or WSL:
@@ -175,11 +197,17 @@ spark setup --non-interactive \
   --no-autostart \
   --no-start-now \
   --skip-install-commands \
-  --skip-runtime-check
-spark status --json
+  --skip-runtime-check ; echo "exit=$?"
 ```
 
-After the smoke, scan generated config, state, and logs for accidental secrets
+Expected result:
+
+- exit code `2`
+- output says Spark blocked a sensitive `identity_access_mutation`
+- no generated module env/state files contain the fake token, fake provider key,
+  old dashboard variables, or private-key material
+
+After the smoke, scan generated config, state, and logs for accidental residue
 or deferred dashboard configuration. Keep the scan focused on generated files;
 installed source checkouts can contain redaction fixtures and runbook examples.
 
@@ -188,10 +216,10 @@ grep -R "fake-zai-key\|fake-token\|SPARK_API_URL\|SPARK_DASHBOARD_URL\|sscli_v1\
   "$SPARK_HOME/config" "$SPARK_HOME/state" "$SPARK_HOME/logs" 2>/dev/null || true
 ```
 
-The fake LLM key must not appear in generated module env files. Non-secret Z.AI
-metadata such as provider, base URL, and model is expected. With a fake
-Telegram token and `--no-start-now`, `spark status` may report the Telegram bot
-or runtime processes as unhealthy; that is expected for this no-secret smoke.
+The fake token and fake LLM key must not appear in generated module env files.
+Do not use this guarded-refusal lane to claim runtime setup success; run the
+interactive identity setup lane with a disposable test bot when release truth is
+green enough for a full fresh-install smoke.
 
 ## Troubleshooting