Make Codex cleanup deadline deterministic (#101)

[Niko4417]

Scope

• Accepted issue: Defect: Make Codex cleanup coverage proof deterministic #101
• Accepted planning-contract version: v7
• Automated readiness record: Defect: Make Codex cleanup coverage proof deterministic #101 (comment)
• Actual source branch: codex/101-cleanup-determinism-v8
• Accepted target branch: epic/98-codex-tracer
• Parent epic and Quality Envelope rows: Epic: Governed Codex lifecycle tracer — one workspace, one no-effect turn #98; containment, cancellation/crash cleanup, truthful terminal state, resource cleanup, authoritative macOS evidence
• Change classification: defect
• Product decision, finding, or incident: PR Correct workspace projection acceptance boundary (#187) #190 run 31342226233 failed only the inherited Defect: Make Codex cleanup coverage proof deterministic #101 readiness cleanup proof on macOS 26 at 160/161 after the previous Defect: Make Codex cleanup coverage proof deterministic #101 candidate had integrated.
• In scope: owning runtime cleanup deadline allocation, strict direct-child/process/group absence proof, fail-closed retained ownership recovery, and directly adjacent regressions in runtime.rs.
• Out of scope: deadline increases, turn-budget changes, assertion/gate weakening, dependencies, workflows, UI, protocol, Integrated packaged macOS acceptance for the Codex tracer #104 harness changes, Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49, Knowledge Capsules, RAG, or product behavior.
• Native targets, contracts, or trust boundaries affected: macOS Codex runtime process identity, process groups, signals, direct-child wait/reap, owned-process absence, monotonic cleanup deadline.

Product and architecture alignment

• The implemented contract version and fingerprint match the automated readiness record; no semantic planning change was absorbed during implementation.
• The change follows the Decision Addendum, CONTEXT.md, accepted ADRs, and the issue Quality Plan.
• Existing Keiko material was used only after a recorded Reuse Assessment, or the issue records why Existing Keiko evidence is not applicable.
• This greenfield change creates no mandatory build-time or runtime dependency on Existing Keiko.
• Product authority, policy, evidence, and privileged effects remain in their owning Native layer.
• Any durable architecture change is recorded in an ADR.

Acceptance criteria and evidence

Acceptance criterion	Evidence	Exact head or artifact	Result
AC1	Anchored 300 ms phases; strict post-deadline refusal; mandatory direct-child reap; exact ESRCH/ECHILD absence; unavailable observations retain ownership	222fe918295ac52d13138e5570832cdf27efeabe	Local passed; remote pending
AC2	Authoritative PR #190 named failure; deterministic deadline seams; three host suites 171/171; three exact coverage wrappers	222fe918295ac52d13138e5570832cdf27efeabe	Local passed; macOS 14/26 pending
AC3	Separate TERM-resistant parent/reap proof retained; timeout fixture stabilized to one non-churning process; descendant-first order and turn policy unchanged	222fe918295ac52d13138e5570832cdf27efeabe	Passed
AC4	One authorized runtime file; no deadline/gate/assertion/dependency/#104/#49 change; identity, absence, ownership, and recovery audit findings zero	222fe918295ac52d13138e5570832cdf27efeabe	Passed
AC5	Full quality, audit, package/platform/security/signing/test, standard macOS acceptance	222fe918295ac52d13138e5570832cdf27efeabe	Local passed; final integrated canonical pending

Acceptance journey evidence

• Applicability: Not applicable — this is a non-user-facing runtime containment defect; Epic #98 owns the visible tracer journey and final canonical evidence.

• Automated checks exercise user-visible outcomes rather than incidental implementation details.

• Required failure, recovery, accessibility, visual, and platform observations are settled.

Quality Plan settlement

• Applicable positive, negative, boundary, failure, cancellation, and recovery behavior is covered.
• The actually wired production composition was tested where this change crosses layers.
• Applicable security, accessibility, performance, resource, visual, and platform evidence is attached or linked.
• Excluded quality areas retain the rationale accepted in the issue.
• Secrets, credentials, raw customer content, private endpoints, and PII are absent from source, tests, logs, evidence, artifacts, issues, and this pull request.

Verification

• npm ci --ignore-scripts
• npm run quality
• npm audit --audit-level=high
• Every declared native target-specific gate passed on its authoritative platform.
• I reviewed the complete diff against requirements, contracts, trust boundaries, and failure modes.

Additional affected checks and concise results:

Exact head: 222fe918295ac52d13138e5570832cdf27efeabe
Failure-first: PR #190 run 31342226233, macOS 26 native:coverage, named cleanup test 160/161
Focused deadline/cleanup/recovery tests: passed
Complete host suite: 171/171 x3
npm run native:coverage: 3/3 sequential passes
Native branch coverage: 85.0877%; runtime.rs 85.3365%
npm run quality: passed; host 171/171
npm audit --audit-level=high: 0 vulnerabilities
npm run acceptance:macos: passed
Independent exact-head audit: findings 0
Signatures: Good ED25519; private repository email
Residual test/process groups: 0

Independent audit and findings

• Audit scope and dimensions: exact v7 scope, authenticated remote failure, fixed 300 ms accounting, direct-child reap, exact PID/group absence, PID reuse/unavailable inspection, ownership retirement/recovery, turn behavior, fixture hermeticity, coverage branches, signatures, Integrated packaged macOS acceptance for the Codex tracer #104/Epic: Contract-as-Code migration and lifecycle activation cutover (ADR-0003/ADR-0004) #49 exclusion.
• Audited commit: 222fe918295ac52d13138e5570832cdf27efeabe

Confirmed finding	Evidence	Disposition	Settlement evidence or follow-up
Process-group inspection treated all signal-0 errors as absence	Independent audit	Resolved	Exact ESRCH alone proves absence; other errors fail closed
Retained recovery could retire after group absence without reaping the direct child	Independent audit	Resolved	Mandatory reap plus exact ECHILD/post-reap proof
Timeout fixture continuously churned sleep descendants under coverage	First post-change 170/171 failure and fixture inspection	Resolved	Stable one-process timeout fixture; host 171/171 x3 and coverage green

• Findings are evidence-cited; speculative observations are advisory rather than blockers.
• Every confirmed finding is resolved, explicitly accepted by an authorized human, or linked to a scoped follow-up that does not invalidate current acceptance.
• Verification and audit were repeated after the latest implementation or audit fix.

Integrated epic acceptance

• Applicability: Required — final #104 canonical acceptance will be regenerated after this child integrates and #187/#188 are rebased.
• Production-composition result: standard packaged macOS acceptance passed locally; final tracer canonical pending integration.
• Machine-enforced acceptance result: full local quality and three coverage wrappers passed; remote CI pending.
• macOS evidence: local authoritative host/package gates passed; fresh GitHub macOS 14/26 pending.
• Windows evidence: not applicable — accepted runtime cleanup target and Epic Epic: Governed Codex lifecycle tracer — one workspace, one no-effect turn #98 slice are macOS-only.
• Manual usability, accessibility, visual, signing, or packaging evidence: no user-facing delta; packaging/signing passed locally; final Epic Epic: Governed Codex lifecycle tracer — one workspace, one no-effect turn #98 physical evidence remains owned by Integrated packaged macOS acceptance for the Codex tracer #104.

Delivery

• Target path: child issue -> epic branch
• The target branch matches the delivery path accepted in the issue; no direct push, force push, gate bypass, finding dismissal, or authority widening occurred.
• Commits are signed and every required check is bound to the exact current head and expected producer.
• Advisory tools are not treated as required merge authority under the current quality-gate policy.
• Documentation, ADRs, contracts, known limitations, and follow-ups are current.
• A draft pull request was not promoted to Ready for Human Review before every required Acceptance Journey result and exact-head gate was complete.

For a child-issue pull request targeting its designated epic branch:

• The accepted issue authorizes this epic-branch target.
• Acceptance and audit evidence is complete, every applicable exact-head gate is green, and no blocking finding or review conversation remains.

Residual risks and follow-ups

• Fresh exact-head macOS 14/26 CI and review settlement are required before child integration.
• After integration, Defect: Correct successful workspace projection boundary #187 and Defect: Complete turn cancellation within the 5 s terminal bound #188 must rebase and Integrated packaged macOS acceptance for the Codex tracer #104 must regenerate its complete packaged canonical receipt on the exact assembled epic head.

Closes #101

[Niko4417]

@codex review\n\nReview exact head 222fe918295ac52d13138e5570832cdf27efeabe. Focus on fixed 300 ms deadline accounting, strict post-deadline behavior, direct-child reap, exact PID/process-group absence classification, retained ownership and recovery, unavailable inspection, PID reuse, preservation of turn cleanup, fixture hermeticity, and strict #101 v7 scope. All local gates and independent audit are green; authoritative macOS CI is running.

[Niko4417]

Superseded by readiness-accepted atomic bridge #195. The complete audited #101 aggregate through b2a6de735489024b2cf5e0fd961304965b2ceecb remains immutable input evidence; this PR is closed without merge or retry, and standalone acceptance is not claimed as passed.