[antoinetoussaint-byte]

Fix local readiness, release verification and process cleanup needed for CLI 0.1.220. Generated runnable checks now materialize selected modules and compare effective binding values; doctor respects environment exclusions. Publication verifies downloaded archives against producer checksums and GitHub digests, checks installer credentials through Core, and stamps tracked generated clients through the existing release transaction. Python stamps the semantic TOML project.version while preserving unrelated fields.

Stop consumes Core's authenticated registry APIs and persisted launch workspace, so child processes remain attributable after their controller exits or environment changes. It preserves incompatible birth evidence, refuses marker-only signaling, and cannot bypass registry refusal through agent-name or orphan fallback kills. Bounded reconciliation handles mixed producer generations. Historical root line/JSON compatibility remains; supported namespaces are decoded and signaled only by Core.

Validation:

• Independent readiness, publication, client-stamping and stop architecture/elegance reviews; reproduced findings repaired, including wrong Python version field, raw agent kill bypass, and missed mixed-version child recovery.
• Full cmd/processgroup/conformance suites; full publish/generators suites; complete lint clean. Final race runs pass (cmd 17.258s, processgroup 41.104s, conformance 7.684s); fresh independent final closure review at 8add946 verifies all four stop findings closed, six permanent regressions, both original probes and an extra preview-refusal probe.
• Merged the first-Init port guard excuses every container this service's agent kept #1201 at afa66a6 is integrated here. Independent combined-source review accepts the exact attribution/stop composition; orchestration and cmd suites pass at the combined source.
• Real native Redis: scoped stop removes A with a live controller, and after killing A's controller, while B's agent/Redis identities and registrations survive. The live controller exits reporting its lost agent; this is not a graceful-controller-status claim. Final clean CLI 8add946 with Core bc4e15ca also passes the stronger case: identity-bound kills remove both A controller and agent, Redis remains authenticated with OwnerAlive=false and an empty observable workspace, then scoped stop removes Redis while B retains its exact boot/birth identities. Redis producer is clean local source bf62b03f, not a corrected published 0.0.100 release.

Classification: fixes at their owners. Reuses Core registry discovery/authentication/identity-bound effects and installer credential rules, generator-owned bindings and TOML parsing, and the existing release transaction. No new registry, local generation pipeline, hosted fixture grant, or cloud deployment.

Docs updated: docs/commands.md, docs/cli-reference.md (generated), docs/orchestration.md, docs/publish-client-versions.md, docs/publish-verification.md, docs/supported-matrix.md.

Selects published Core v0.19.8 (a06da5fc), whose complete Go module contents equal reviewed bc4e15ca. Combined head e9cf1cf is pushed for CI. Local combined processgroup suite observed a 10-second dev-server scan timeout; three unchanged isolated reproductions passed, but a subsequent full-package run hit a different native-scan timeout. Independent investigation measured complete scans over ~2,300 processes, found no reproducible source regression, and passed the exact unmodified full package at clean e9cf1cf in 12.722s with all original deadlines. Precise cause of the two earlier delays remains unproven. No timeout or gate was weakened. Final-head CI and actual CLI publication verification remain required. Corrected agent publication and composition qualification proceed separately at their owners; this CLI release does not certify an unchanged old agent. No CLI 0.1.220 archive or checksum is claimed yet. ps remains a documented signature-based diagnostic view, narrower than registered stop discovery.

[antoinetoussaint-byte]

Closed by the cli owner, unmerged and unreviewed as a stack, on the coordinator's instruction.

This branch holds the 6-line runnable-bindings slice (1fac1a7c) plus seven unrelated commits stacked on it afterwards (publish verification, client-library stamping, a codefly stop/processgroup rework), and it is conflicting with main. Nobody reviewed the stack, and it will not be reviewed as one.

Where each part goes:

• The slice — superseded by generate: runnable-bindings materializes pinned modules, so --check can run on a fresh checkout #1208, the same commit rebased onto current main and opened on its own.
• Publish verification and client stamping — live on feat/publish-verify (f6c4ab6e), with the handoff notes; that work continues there as its own PR after v0.1.220.
• The codefly stop / processgroup rework — stays on this branch; the cli owner re-cuts it as its own PR after v0.1.220 (the stop path is item 4 on the cli list). Nothing is discarded: the commits remain on stale-generated-output/runnable-bindings-check-materializes.

The branch is kept, not deleted.