rdmsm4x - fix - Router verifier round one - codex - FEAT2026092710 - rdmodelrouter

rdmsm4x - fix - Router verifier round one - codex - FEAT2026092710 - rdmodelrouter - 20260927-0312

[2026-09-27 03:04:21 EDT → 2026-09-27 03:12:01 EDT · rdmsm4x · codex@rdmsm4x/rmrnight]

All Required fixes in VERIFY-1.md addressed. Same worktree and branch, FEAT-20260927-10. No merge/push.

F1: planLogin rejects metacharacters, unknown ids and ids belonging to another CLI. Login plans separate argv/environment from display text; CODEX_HOME never enters executable shell text. login --apply uses a dedicated foreground runner with inherited stdin/stdout/stderr, inherited process group and no timeout; returns the official CLI exit status. Uses posix_spawn, since Foundation Process's separate process group failed the first real PTY input probe. Captured status runner is not used. Tests cover rejection, dry-run, apply runner selection and nonzero exit propagation. Synthetic PTY integration verifies all descriptors are TTYs, input works, both output streams arrive, CODEX_HOME is correct, a 16.1s login survives the old 15s limit, and exit 7 propagates. Non-TTY refuses. No real authentication command ran.
F2: rebased onto exact main 4dd4803c2283d0392a0b99713f91d1cf6fa06f65. Main R1 comparator and its extra tests retained, along with typed error exhaustion, cap fixes, install/login-item and appearance changes. Main DEC-RMR-19..23 unchanged. Branch ids mapped 19→24, 20→25, 21→26, 22→27, 23→28, 24→29, 25→30; current docs and RESULT/BUILD-RESULT handoff references corrected. Main integration records are retained as historical checkpoints. archive/keys-before-round1-20260927 preserves original HEAD 4e5b198. Initial rebased suite caught an obsolete blanket Keychain prohibition in main's source audit; refined to allow Security data APIs only inside the intended resolver while retaining native-auth-path bans and positive controls.
F3: RouterStatusReader defaults to KeychainPresenceResolver, requesting attributes only, no data or fingerprint; LAContext.interactionNotAllowed=true plus UI-fail query flag. UI says present (access unchecked), not usable credentials. Resolver cannot disclose values. Explicit Reveal/Copy keeps owner-triggered data access. Test inspects the actual default resolver/query contract without calling Security or accessing real secrets.

Validation:

Prescribed wrapped swift test --jobs 2: 86 tests / 13 suites / 0 failures, rc=0 (round1-tests-final.log). This is 75 prior branch tests + 8 main tests + 3 Round 1 tests.
round1-pty-probe.py: rc=0 (round1-pty-final.log). Initial failed Foundation Process probe retained in round1-pty.log; no owned probe processes remain.
scripts/build-status-app.zsh: rc=0 (round1-build-final.log), CLI and app x86_64 arm64, Intel minos 26.7, plist valid. Unsigned worktree-local artifact, no launch/install/registration/signing.
Final app executable SHA-256: 32036a10f78e42665fbaf14edb6693ff3516bcb8c617417a085a087b7673feb9.
git diff --check: rc=0. Main is an ancestor; merge-tree dry integration returns rc=0 (final postcommit receipt below).
Precommit history scan: 14 commits / 182 reachable blobs / 65 working files / 130 source files / 12 distinct named source values / 0 findings, positive control passed. Final committed scan receipt follows below. No values printed or persisted by the scan.

Remaining boundaries: DEC-20260927-06 attended Keychain reconciliation and real Reveal/Copy acceptance unchanged. No paid calls, auth-file access, Tyrell/mem0 edits, real login, installed-app mutation, canonical main mutation, merge or push. Background Notes publication remains PENDING under the no-prompt directive; changelog file copies retained per fleet-notes-publish. Advisory items outside Required fixes were not claimed resolved.

Round 1 commit receipt — 2026-09-27 03:12:47 EDT

Final commit 231a300b195d116cbac207124959d621b5b5bb8d; Agent trailer present. Rebased predecessor commits 0bea7b4 and 082f23a. Worktree clean (0 dirty/untracked paths); main unchanged at 4dd4803. git merge-tree --write-tree main HEAD returned rc=0 and tree 2c8f07a8f72341dbaa56cef1a4ec710c0694834c. This is a conflict check only, not a merge. No push.

Rollback: preserve the pre-rebase archive branch; revert 231a300 for Round 1 changes. Rebased branch remains separate from main and the installed app. Exact paths changed are in git show --stat 231a300.

Final committed History scan: 15 commits; 197 unique reachable blobs; 65 working files; 130 env sources; 12 distinct named source values; 0 findings. Positive control passed.

Notes publisher returned rc=3 (Background, not Aqua). Both changelog file copies preserved. FEAT-20260927-10 builder lease released; integration remains lead-owned.