[Juliusolsson05]

Refs #1296. Items 1, 2, 4, 5, 8 and 9 are fixed here. Items 3 and 7 (goal-loop settle sleeps and weak negatives) move to #1341, which has the same root cause: persistence outliving afterEach. Its fix is a drain seam in GoalLoopService that touches GoalLoopService.test.ts, which #1337 is changing. Item 6 is declined (below). So this is Refs, not Fixes.

Changes

1. prerequisites.firstRun.test.ts: machine-wide rows on either side are not compared, when they are the provider's own command.
   • binaryResolver scans /opt/homebrew/bin and /usr/local/bin whatever HOME and PATH say.
   • The test skipped rows the recording found machine-wide, but not rows the live probe finds there, so a Mac with Homebrew claude/codex/opencode failed.
   • A row either side found outside the simulated HOME and staged app root is a machine fact.
   • Review: the skipped live row must be the provider's own executable (basename(path) equals the registry's binary name). A resolver returning /opt/homebrew/bin/grok for opencode is now compared, and fails.
   • No production seam was added.
2. githubCli.system.test.ts: dropped the "elapsed < timeout + 2 s" wall-clock assertion around a real gh spawn. The production timeout and the test's 20 s limit already catch a hang.
   • Review: a gh shim first on PATH makes the real runner's answer knowable (it prints a fixture token, so no real credential is read). A runner that never spawns gh now fails.
3. BrowserPocketHost.renderer.test.tsx: waits for the observed restart (vi.waitFor; the first crash backs off 250 ms) instead of a fixed 400 ms sleep.
4. SubAgentWatcher.test.ts: awaits watcher.refresh() instead of polling a 1.5 s wall-clock deadline. CoalescedRefresh runs another full pass for any request made during a pass, so the awaited promise covers a pass that started after the call.
5. Electron harness secrets:
   • Both harnesses used a fixed os.tmpdir()/agent-code-harness-secrets-<pid> directory with a plaintext codec, and never removed it.
   • Each run now gets its own mkdtemp directory, removed on process exit (which covers the app.exit(1) failure paths) and before app.quit().
6. testing/fixtures/agent-activity/runtime-states.json personal data (read in full, per q36).
   • Beyond the /Users/juliusolsson paths and private project names the issue lists, it held queued prompts, drafts, prompt suggestions, sub-agent task descriptions and streaming baselines, plus branch and worktree names of private repos.
   • Redaction policy (scripts/agent-activity-redaction-policy.ts, same-length throughout):
     • text fields and every branch are filled with x;
     • the home user becomes a placeholder;
     • each project other than the exact public agent-code gets its own placeholder, as does each segment of the rest of its path, keys included;
     • a key collision refuses the file rather than merge entries.
   • The committed file is the policy's output, byte for byte. It is regenerated from the pre-redaction corpus in git history (15e43abe^, blob d2653405). A process test reproduces it from the blob (skipped on a shallow checkout).
   • How the tracked fixture can change: only two ways.
     • --redact-from <file> --home-user <recorder>, which accepts ONLY that recorded corpus (checked by sha256).
     • A manual copy of a staged live extraction, after a person's key-by-key privacy audit.
   • Live extraction never writes the tracked fixture.
     • It takes no arguments; --out and anything else are refused.
     • The temp root is realpath'd and refused when it or any ancestor holds a .git entry. That is a filesystem walk, not a git query, so no git environment variable can switch it off. It is checked before any bundle is read.
     • The output is ONE new file, agent-activity-staging-<uuid>.json, opened with wx and mode 0600 under that root (scripts/agent-activity-staging.ts). It is written through its descriptor, never by path, so swapping or linking the path cannot redirect the bytes.
   • Guards on every write (they refuse, printing counts, never names):
     • every home in the source must be the recorder;
     • an ambiguous dash-encoded home refuses;
     • the output may name only the exact canonical placeholder home, and any other spelling refuses (lowercase, backslash, \/, %2F, ~name, a prefix of the placeholder).
   • Stated residual: the pattern-based pass can't recognise every identifier a new live corpus might hold (a project outside Development/, a bare { "user": … }). That is why a staged file needs a person's audit before any copy.
   • The row model reads none of the redacted text, so the agent-activity tests pass unchanged. Two row-model guards are also newly pinned: the terminal guard, and title over Goal.
   • Fleet fixtures: private project names are same-length placeholders. This PR does NOT claim full personal-text redaction across all three fixtures. Six fleet titles are the owner's own prompt fragments, kept verbatim; that is an owner choice (q73):
     • A keeps them;
     • B replaces them with synthetic stand-ins of the same shape. B is prepared as a separate commit on the local branch option-b/synthetic-fleet-titles, ready to push.
   • Owner decision: the original content is still in main's git history, and removing it means rewriting main.

Declined

6. Electron harness budgets (electronHarness.ts, runtimeHarness.ts). These are bounded condition waits in the Electron journey tier. They fail fast rather than hang, and they are not part of the unit or system suites. Replacing them needs Electron-level events (frame teardown, binding publication) that the harness can't observe today. Widening them is forbidden anyway.

Verification (head afebaca5, which is d084251f merged with main)

• Items 2, 4 and 5 pass 3/3 runs.
• The first-run suite passes (4 passed, 1 skipped); its grok-for-opencode mutant fails it.
• The gh never-spawns mutant fails the shim case.
• Redaction and staging (testing/unit/agentActivityRedactionPolicy.test.ts, testing/unit/agentActivityStaging.test.ts, testing/system/fixtures-privacy/): 36/36 green.
• Each of these turns a test red when removed or broken:
  • the source home check, the output guard, the recorded-corpus check, and key redaction;
  • the no-arguments rule and the .git walk (including under GIT_CEILING_DIRECTORIES and a bogus GIT_DIR);
  • writing through the descriptor (a by-path write follows a swapped symlink), and mode 0600.
• Agent-activity passes 32/32. npx tsc -b is clean.
• Not reproduced locally: item 1's original failure needs a Homebrew claude/codex/opencode. This Mac has only Homebrew grok.

Plan: docs/plans/2026-09-26-machine-time-dependent-tests.md.

🤖 Generated with Claude Code

[Juliusolsson05]

Owner decision pending (steering q73): the two tracked fleet fixtures still carry verbatim agent titles that include owner prompt fragments. W4 kept them on purpose, because the titles are what the agent-activity finding is about. Options: (A) keep them verbatim, or (B) replace them with synthetic titles that preserve the meaning and adjust the tests. The manager recommends B, since this is a public repo. Until the owner answers, this PR does NOT claim complete personal-text redaction across all three fixtures. The reviewer still completes the new-head audit and the byte-regeneration check.

[Juliusolsson05]

Review disposition (final head afebaca5: d084251f merged with main)

Round 1 (a/b codex, c pi, at cb047747):

• a major, first-run: a machine-wide row was excused even when it was the wrong executable. Fixed (cd893952): the executable's name must match the provider. The grok-for-opencode mutant is red.
• b major, gh: the real-gh case passed when gh was never spawned. Fixed (cd893952): a PATH-first shim. The never-spawns mutant is red.
• c majors (private project and branch names left; the fixture was not the script's output; placeholders merged same-length names). Fixed (2f930233): a policy module, one placeholder per identity, byte-identical regeneration. c's minors (terminal guard, title over Goal) are pinned.

Round 2 (2f930233): a, b and c were all MERGE-READY. c's key-redaction coverage note was pinned later.

Privacy hardening rounds (steering q74, q76, q78, q79, q80, q81, q82; a/c final checks):

• --redact-from now:
  • requires --home-user;
  • reads homes from the source, not the output;
  • refuses every non-canonical home spelling and ambiguous dash homes;
  • accepts ONLY the recorded corpus (sha256).
• Live mode:
  • never writes the tracked fixture and takes no arguments;
  • refuses a temp root that is inside a working tree (a .git walk, not a git query);
  • writes ONE wx 0600 file through its descriptor (q82, manager-verified by inspection).
• Every step has a real-process or unit regression that was red on the previous head, and each guard's removal is a killed mutation.

Not done here / owner:

• Fleet titles (q73): six titles are the owner's prompt fragments, kept verbatim.
  • A = keep them;
  • B = synthetic stand-ins, ready as a separate commit.
  • This PR does not claim full redaction of the fleet fixtures.
• History: the pre-redaction content is still in main's git history. Rewriting it is the owner's call.
• Stated residual: a staged live extraction needs a person's key-by-key audit before any copy into the tracked fixture. The pattern-based pass can't recognise every identifier a new corpus might hold.

[Juliusolsson05]

OWNER-APPROVED: the fleet fixtures KEEP the verbatim agent titles (q73 option A). The owner judges them innocent enough.
Owner, 2026-09-27T07:33:05Z: "just make these for me, just keep the fixtures in, they are innocent enough. do not delete stuff often" (manager applied it).