[P0] Host-scoped production activation & reconciliation primitive

[James3014]

Summary

DevSpace currently closes bounded repository engineering well (workspace/worktree isolation, delegated workers, Candidate commits, physical reconciliation, cutover/restart mechanics), but there is a missing control-plane seam between an independently verified Candidate and a small, explicitly authorized mutation to host-scoped production artifacts outside repository workspaces.

This gap was exposed by the 2026-09-13 Nexus / OpenSWE / OpenCLI G0 production-closure work. The OpenCLI long-protocol submit regression was diagnosed, repaired, independently reviewed, and physically canaried through real OpenSWE → OpenCLI → ChatGPT Web. However, the final production activation targets live under host-owned locations such as ~/.opencli, the global OpenCLI package install, and the installed nexus-open-swe-runtime launcher. Current DevSpace workspace/file mutation tools correctly refuse those paths, while bash is intentionally not a general host-mutation escape hatch. Delegating the activation to a background worker is also correctly blocked.

The result is an undesirable final state:

Candidate implemented      PASS
Focused verification      PASS
Independent review        PASS
Real semantic canary      PASS
Fresh reconcile           PASS
Zero resend               PASS
Host production activation MANUAL OWNER TERMINAL STEP

The architectural goal is to remove that last manual terminal dependency without introducing arbitrary host shell/write authority.

Canonical ownership / consumers

Implementation owner: DevSpace — local execution/control transport.

First acceptance consumers:

• James3014/Nexus-new — governance/integration consumer and production-closure evidence.
• James3014/nexus-open-swe-runtime — installed external execution runtime / launcher consumer.
• OpenCLI ChatGPT adapter overlay — first concrete host-activation fixture.

This Issue must not move planning, Workforce Admission, Candidate acceptance, Completion Certification, merge, release, or production-claim authority into DevSpace.

Observed G0 evidence

Defect that triggered the gap

OpenCLI submitChatGPTMessage() treated a successful button.click() as successful submission even when the ChatGPT Web UI had not observably accepted the long OpenSWE protocol prompt and no /c/<conversation-id> was created.

The repair changes submit acknowledgement so success requires an observable effect such as an appropriate composer transition, generation state, user-turn transition, or conversation URL transition. A transient/missing composer alone must not be accepted as success.

Candidate evidence

Immutable local Candidate:

commit: f131c9f4533f874e311376f2e6aeb5bc50de1135

Changed source scope:

clis/chatgpt/utils.js
clis/chatgpt/utils.test.js

Verification:

Focused Vitest: 4/4 PASS
node --check: PASS
git diff --check: PASS
Independent rereview: REVIEW_PASS

Real Candidate canary:

installed nexus-open-swe-runtime
→ OpenSWE / Deep Agents
→ OpenCLI
→ production browser profile m5c6uje4
→ ChatGPT Web
→ glob
→ read_file
→ record_finding
→ INTELLIGENCE_COMPLETED
→ outcome_unknown=false
→ project_name=nexus-open-swe-runtime

Fresh-process semantic_reconcile returned the same terminal result and physical conversation readback showed no additional resend turn.

Current live activation identity

Production live has intentionally not been changed yet.

Current preimages:

OpenCLI adapter SHA256:
72c1689e90d0557341d59f8e0a01246662d9aac56006d47d9c921986294e44da

OpenCLI adapter test SHA256:
01c5fad3f2a53ab8c487d9579a20fdf393eb56b8a74690f4a6bb2c435493b82f

launcher SHA256:
dc823725b78e29e314f2e68f53c70bda2a8492dcc937721c51f9cd5df0d7f33a

Dry-run postimages for the bounded submit-ack overlay:

OpenCLI adapter SHA256:
c668f6788ee028715282c19ec84c840f6a49cdcb61f3c1b54ca3be3e93dabda5

OpenCLI adapter test SHA256:
682c21b24d4019519ef9b389601d043f7a8a1a3a45975c4a02005a2e833cef66

launcher SHA256:
abfe07a582ad2f71724f4d4a7c6adef68386b83ce383900cc3629391452b59e5

Dry-run proved the patch can use the accepted live adapter as donor and replace only the submit-ack hunk, preserving the existing local hardening byte-for-byte outside that bounded region.

Problem statement

DevSpace needs a typed, host-scoped activation capability for a small catalog of pre-authorized production artifact classes.

It must provide a safe alternative to all of the following unsafe patterns:

• arbitrary bash / cp / sed host mutation;
• widening workspace roots merely to gain write access;
• background-agent mutation of unrestricted home/global paths;
• blind retry after activation transport failure;
• treating a local process exit as proof that all host mutations either happened or did not happen;
• whole-file replacement when a bounded donor-preserving overlay is required.

Required capability shape

Names are illustrative; preserve one canonical implementation rather than duplicating equivalent surfaces.

host_activation_prepare
host_activation_apply
host_activation_status
host_activation_reconcile
host_activation_rollback

Equivalent naming is acceptable if the contracts below are preserved.

1. Catalog-bound activation kinds

The caller must select a server/repository-defined activation kind. The caller must not supply arbitrary executable commands or unrestricted host paths.

Example initial kind:

OPENCLI_CHATGPT_ADAPTER_OVERLAY

Its target-set policy may resolve internally to the bounded known surfaces needed for this runtime generation, such as:

user OpenCLI ChatGPT adapter override
global packaged OpenCLI ChatGPT adapter
corresponding focused adapter tests
installed nexus-open-swe-runtime OpenCLI launcher pin
activation rollback bundle

The exact host paths should be server-side policy/catalog data, not caller-selected arbitrary paths.

2. Exact preimage fencing

prepare / apply must bind exact current physical identity before any mutation.

At minimum, every target carries:

target_id
expected_preimage_sha256
expected postimage identity or deterministic patch identity

Any drift must fail closed with a typed result such as:

BLOCKED_PREIMAGE_DRIFT

No fuzzy or best-effort application.

3. Donor-preserving bounded transformation

For overlay-style activations, the system must support a contract equivalent to:

accepted live donor
+ exact bounded transformation
= deterministic postimage

This is required when the live artifact contains accepted local hardening that must not be erased by replacing it with an older upstream/Candidate full file.

4. Rollback bundle before first write

Before the first possible host effect, persist a durable rollback bundle containing all target preimages and activation metadata.

The rollback bundle must be independently addressable by the activation operation identity.

5. Durable operation identity before first effect

Create and persist a stable activation operation ID before the first host mutation.

The same durable operation identity must survive:

• caller timeout;
• Dev MCP transport failure;
• controller restart;
• host process failure;
• partial multi-target application.

6. No blind resend

OUTCOME_UNKNOWN != retry permission applies to host activation exactly as it does to external semantic effects.

After an ambiguous transport/process outcome, callers must use host_activation_status / host_activation_reconcile on the same operation, not start a replacement activation.

7. Physical outcome classification

Reconciliation must re-read target bytes and classify the real host state. At minimum:

CONFIRMED_NO_EFFECT
APPLIED
PARTIAL_EFFECT
ROLLED_BACK
EFFECT_UNKNOWN
BLOCKED_PREIMAGE_DRIFT

PARTIAL_EFFECT and EFFECT_UNKNOWN must never be silently mapped to success.

8. Multi-target consistency / rollback

For an activation with mutually pinned targets (e.g. user adapter, global adapter, launcher expected SHA), closure requires all target postimages to match.

If an intermediate step fails and deterministic rollback remains possible, restore all preimages and prove physical rollback by readback.

If rollback cannot be proven, return PARTIAL_EFFECT or EFFECT_UNKNOWN and pin the operation for reconciliation.

9. Physical readback is acceptance evidence, not worker summary

Successful process completion is insufficient.

APPLIED requires exact postimage readback for every governed target.

10. Separate activation from production acceptance

Host activation does not grant final Nexus/OpenSWE production acceptance.

For the G0 acceptance consumer, the downstream chain remains:

host activation APPLIED
→ fresh physical SHA readback
→ launcher dual-pin probe
→ production m5c6uje4 long-protocol canary
→ fresh installed OpenSWE semantic_run
→ INTELLIGENCE_COMPLETED / outcome_unknown=false
→ fresh semantic_reconcile
→ zero resend readback
→ only then production closure

Authority requirements

Support at least these conceptual lanes without conflating them:

• OWNER_DIRECT: exact bounded host activation authorized by the Owner.
• NEXUS_GOVERNED: only after canonical Nexus authority validation is wired; must fail closed until then.

A model/worker output, Candidate commit, GitHub merge, or test PASS cannot independently mint host activation authority.

Architecture Capability Discovery / reuse-before-invention must remain applicable to write-capable automation. This Issue must not introduce a second browser carrier, second OpenCLI semantic transport, or second deployment truth source.

Non-goals

This Issue does not authorize:

• arbitrary host shell execution;
• arbitrary home-directory writes;
• arbitrary global package mutation;
• arbitrary launchd/service management;
• generic package manager privilege;
• model/worker self-deployment;
• bypassing CapabilityPlanner / Workforce Admission;
• Candidate self-acceptance;
• protected merge/release authority;
• declaring production_ready from activation alone;
• reimplementing Nexus Completion/Core truth in DevSpace.

Acceptance criteria

A. Contract / safety

• Activation kind resolves targets server-side from an allowlisted catalog; caller cannot provide arbitrary host paths or commands.
• Exact preimage SHA fencing is mandatory for every mutated target.
• Durable operation identity is persisted before the first possible host effect.
• Same-operation status/reconciliation is available after timeout/transport uncertainty.
• Blind repeat of an unresolved activation is rejected/fenced.
• Physical reconciliation distinguishes at least CONFIRMED_NO_EFFECT, APPLIED, PARTIAL_EFFECT, and EFFECT_UNKNOWN.
• Rollback bundle exists before mutation and rollback itself is physically verified.
• Worker/model summary is not sufficient evidence of APPLIED.

B. Negative controls

• Arbitrary caller-provided host path is rejected.
• Path traversal / symlink escape from an allowed target is rejected.
• Preimage SHA mismatch produces zero mutation.
• Conflicting reuse of the same operation identity fails closed.
• Simulated timeout after first target mutation does not permit blind resend.
• Simulated partial multi-target activation reconciles to PARTIAL_EFFECT or verified rollback; never false success.
• Missing/unreadable target remains unknown/blocked; local absence is not authoritative remote/host absence.

C. Initial OpenCLI acceptance fixture

Use the already-verified G0 Candidate as the first real fixture.

• Prepare verifies live adapter/test/launcher preimages.
• Apply produces the bounded donor-preserving submit-ack postimages.
• User/global adapter identities remain equal after activation.
• Launcher pin matches the exact activated adapter SHA.
• No unrelated model-selector/local-hardening bytes regress.
• Existing rollback bundle is recoverable and exact.

D. Downstream production acceptance

After host activation, independently prove through the actual consumer path:

• production OpenCLI launcher/profile is healthy;
• long OpenSWE protocol first turn creates a real /c/<conversation-id>;
• OpenSWE tool-call / tool-result continuation remains same semantic flow;
• fresh semantic operation terminates INTELLIGENCE_COMPLETED with outcome_unknown=false;
• fresh-process reconcile returns the same terminal operation result;
• conversation physical readback proves zero resend;
• only then may the G0 production closure be marked CLOSED.

Current status / claim ceiling

SOURCE_REPAIR_VERIFIED = true
CANDIDATE_REAL_WEB_CANARY = true
CANDIDATE_SEMANTIC_RUN = INTELLIGENCE_COMPLETED
CANDIDATE_FRESH_RECONCILE = PASS
CANDIDATE_ZERO_RESEND = PASS
PRODUCTION_HOST_ACTIVATION = NOT_DONE
PRODUCTION_CLOSURE = NOT_CLOSED

Do not downgrade this issue to merely documenting the manual activation command. The desired closure is a reusable, bounded, auditable DevSpace host-activation primitive so future accepted Candidates do not end with “Owner must return to Mac Terminal and run one command.”

[James3014]

2026-09-13 current execution update

Current closure evidence after the initial Issue body was prepared:

OpenCLI Candidate commit:
f131c9f4533f874e311376f2e6aeb5bc50de1135

Focused Vitest: 4/4 PASS
node --check: PASS
git diff --check: PASS
Independent rereview: REVIEW_PASS

Real Candidate production-profile canary

The immutable Candidate was exercised through the actual execution chain using the installed nexus-open-swe-runtime, production Browser Bridge profile m5c6uje4, and a sandbox OpenCLI adapter override so production host artifacts were not modified.

Observed flow:

OpenSWE / Deep Agents
→ OpenCLI Candidate submit-ack adapter
→ ChatGPT Web
→ new real conversation
→ glob tool_call
→ tool result
→ read_file tool_call
→ tool result
→ record_finding
→ terminal

Conversation:

6aa65305-fcc8-83ee-bb9c-511ef7f34145

Terminal result:

status = INTELLIGENCE_COMPLETED
outcome_unknown = false
project_name = nexus-open-swe-runtime
schema = g0.candidate_submit_ack_final.v1

Fresh-process semantic_reconcile returned the same terminal operation result. Physical conversation readback showed exactly the expected 6 turns (3 protocol user envelopes + 3 assistant responses), proving zero resend during reconcile.

Production activation status

Production remains intentionally unchanged:

user adapter SHA256   = 72c1689e90d0557341d59f8e0a01246662d9aac56006d47d9c921986294e44da
global adapter SHA256 = 72c1689e90d0557341d59f8e0a01246662d9aac56006d47d9c921986294e44da

Prepared bounded overlay postimage:

adapter SHA256 = c668f6788ee028715282c19ec84c840f6a49cdcb61f3c1b54ca3be3e93dabda5
test SHA256    = 682c21b24d4019519ef9b389601d043f7a8a1a3a45975c4a02005a2e833cef66
launcher SHA256= abfe07a582ad2f71724f4d4a7c6adef68386b83ce383900cc3629391452b59e5

A fail-closed activation script was prepared and dry-run verified. It uses the accepted live adapter as donor and only overlays the submit-ack hunk, preserving unrelated local hardening.

Important control-plane evidence

An attempt was made to delegate the final host activation to a bounded DevSpace worker because the Owner was away from the Mac. The platform safety layer rejected that dispatch before the worker started because the requested effect would mutate host production paths outside the normal workspace authority boundary.

Therefore:

activation worker started = false
production mutation = none
unknown activation effect = false

Fresh DevSpace runtime identity remained healthy at the time of the attempt:

sourceCommit = c6e09967cb745407de3a7d09808c472d38f6e612
buildId = devspace-1.0.7-c6e09967
mode = normal
reconciliationRequired = false

This sharpens the Issue's acceptance target: the missing capability is not another OpenCLI/browser fix. It is a typed, auditable host-scoped production activation + same-operation reconciliation primitive that can safely bridge an accepted Candidate to explicitly allowlisted host runtime artifacts without arbitrary shell or unrestricted home/global writes.

Current claim ceiling

SOURCE_REPAIR_VERIFIED = true
CANDIDATE_REAL_WEB_CANARY = true
CANDIDATE_SEMANTIC_RUN = INTELLIGENCE_COMPLETED
CANDIDATE_FRESH_RECONCILE = PASS
CANDIDATE_ZERO_RESEND = PASS
PRODUCTION_HOST_ACTIVATION = NOT_DONE
PRODUCTION_CLOSURE = NOT_CLOSED

Next engineering work for this Issue should implement the reusable host activation primitive first; the one-off manual activation script remains a temporary workaround, not the desired architecture.

[James3014]

Parent umbrella is now devspace #125: [P0] Eliminate manual-terminal escape hatches with typed operator actions.

Relationship:

• [P0] Eliminate manual-terminal escape hatches with typed operator actions #125 owns the broader control-plane/product requirement: recurring bounded consequential operations must not fall back to Owner Terminal solely because Dev MCP lacks a typed primitive.
• [P0] Host-scoped production activation & reconciliation primitive #124 remains the first concrete implementation/acceptance fixture: host-scoped production activation + reconciliation for the OpenCLI/OpenSWE G0 closure path.

Please keep #124 narrow. It should produce the first reusable donor pattern for #125, not a generic shell executor.

[James3014]

Post-merge closure status (fresh 2026-09-13 reconciliation):

PR #129 is merged as 653038acdd49dfe33e12942c182ec92abca49393. The Issue was intentionally reopened after GitHub auto-close because source integration is not the same claim as production host activation.

Verified before merge:

• feat: add reconciled host activation #129 rebased/reconciled onto then-current main@d545ab3a3efdda30cd3d1b6edb4718582f47511f
• resolved head 5c9387a5de9493b0b1d2508d539c174168c27d5a
• Diff check PASS
• macOS Smoke typecheck/test/build/doctor PASS
• Ubuntu Smoke PASS
• macOS Chat Swarm jobs + Local agent sessions PASS
• Windows Smoke failure is pre-existing on current main (carrier-binding.test.ts / AUTHORITY_REQUIRED) and not introduced by feat: add reconciled host activation #129

Remaining terminal gate:

1. build/install a DevSpace artifact sourced from merged main containing 653038ac...;
2. cut over the live macOS Dev MCP using the typed cutover path;
3. rediscover the installed Host Activation surface;
4. execute physical host-activation prepare/apply/status/reconcile/rollback acceptance with exact preimage/postimage fencing and ambiguous-effect reconciliation;
5. only then close [P0] Host-scoped production activation & reconciliation primitive #124.

Current blocker is control-plane availability, not source code: the connected dev2 resource started returning Resource not found even for cutover_status / bounded workspace operations. I did not bypass the missing typed control plane with arbitrary host shell or a manual npm ci, because that would defeat the authority/reconciliation contract this Issue is meant to establish.

Keep #124 OPEN until the live installed/runtime acceptance above is physically observed.