# Accepted, deferred, and rejected items

This list records product and implementation issues discovered while reconciling the frozen brief, current host capabilities, source implementation, and real-host verification.

## Accepted and implemented

- One Codex Plugin containing one focused intervention Skill, one local stdio MCP state service, and optional lifecycle Hooks.
- One user-authorized DeepSeek Harness developer-preview adapter over that same MCP core. It registers the same fifteen state tools, contributes no planner/client/executor, and is pinned to Harness `0.1.2-alpha.2`.
- DeepSeek host binding removes workspace and session fields from model-visible schemas, injects canonical active-agent values, uses one bounded MCP child per active session, omits model credentials from child environments, and closes all children on idle eviction or unload.
- Codex retains reasoning, planning, execution, permissions, safety, verification, and delivery ownership.
- Atomic append-only, hash-chained events; ledger-derived current state; explicit supersession/invalidation; corruption recovery and serialized writes.
- First-class `explicit`, `inferred`, `evidence`, `unknown`, and `disputed` states with provenance, scope, confidence rules, timestamps, and retained history.
- Local `on`, `private`, and `off` modes; private semantic memory plus a hashed fail-closed Hook-suppression marker; project isolation; credential-pattern redaction before persistence; exact destructive confirmation; portable incomplete-history export; physical deletion with verification.
- History defaults to post-install visible signals. Long-term inferred signals require three independent tasks plus direct confirmation and become stale after 90 days.
- Manual `start`, `show`, `correct`, `feedback`, `forget`, `export`, and `off` paths in ordinary Codex dialogue.
- Hooks that only inject compact context or add unconfirmed hashed candidates, always fail open, and never decide completion or block a prompt.
- Relative MCP launch from installed `cwd`, because the tested host did not expand `${PLUGIN_ROOT}` inside MCP arguments.
- Underscore MCP namespace `intent_loop`, because it is reliably exposed on the tested Codex host.
- One read-only MCP resource that serves the actual bundled Skill file when the Windows sandbox blocks direct cache reads; it contains no task state and avoids duplicating policy.
- Lock-scoped cross-process request deduplication, PID/owner-token/heartbeat locks, non-mutating reads, and atomic repair that quarantines only a partial-tail digest rather than raw bytes.
- Direct-user transition guards for user-explicit claims and direct-user-only semantic Hook injection; persisted evidence, inference, and imported content cannot become hidden instructions.
- A compact summary export and one-tool manual read paths to reduce first-use latency and output size.
- Complete inventory and license text for direct and MCP-prebundled dependencies, a CycloneDX SBOM, prerelease metadata, checksums, and GitHub artifact attestations.
- Outcome-based paired evaluation with a frozen 80-task corpus; explicit `NO RESULT` rather than inferred efficacy.
- Single-call new-task initialization with server-derived task identity and up to 12 directly stated atomic claims; no model-generated UUID/source hash or separate claim loop.
- Codex project binding through the server-advertised `codex/sandbox-state-meta` capability on every tool call; normal calls omit `project_root`, explicit conflicts fail closed, and non-Codex clients retain explicit-root or exactly-one-root fallback.
- One-to-one private task/session CAS, current-session projection, task-level Hook suppression, pure-private restart recovery/delete, and expected-owner atomic control clearing.
- Atomic ledger replacement plus link-count/realpath checks for internal files and Windows junctions, with locked cleanup of crash-orphaned product temporaries.
- Request IDs bound to operation and normalized-parameter fingerprints; different parameters fail instead of returning a stale prior result.
- Imported claim/candidate/task identity remapping, acyclic supersession validation, and task-delete cleanup of cross-task candidate references.
- Release/reclaim marker races are treated as transient, post-commit lock cleanup cannot surface a false mutation failure, renamed lock remnants receive bounded cleanup retries, and waiters use a bounded no-progress timeout with an absolute ceiling under a progressing writer queue.
- Stale-lock decisions are bound to a concrete directory generation (`dev`, `ino`, and nanosecond birth time where provided), rechecked before and after rename, and paired with explicit present/missing/invalid/raced marker observations. Marker reads also bind the parent lock generation and marker-file generation before open, after read, and at final path validation. Windows access errors receive a bounded fail-closed recheck and can only become `raced`, never deletion or reclaim authority. A stable per-operation reclaim token prevents same-PID adoption, owner-publication failures never recursively delete an unverified newer generation, and invalid crash markers have bounded verified recovery paths.
- Hook request/source identities use a validated event ID or credential-redacted text, and regression tests reject persistence of raw prompts, recognized secrets, or their raw SHA-256 digests.
- Import relations have per-array and total edge ceilings; deletion byte scans propagate unexpected filesystem failures; the next lock removes crash-orphaned release/reclaim marker directories.
- Public beta publication is evidence-gated: pinned GitHub installation, exact tag/cache identity, Windows/Ubuntu/macOS CI, checksums, SBOM/provenance attestations, root-operated use, separate adversarial and user-practical reviews, and verified uninstall/cleanup.

## Deferred

- A controlled opt-in user study and the complete 160-run paired dataset.
- Natural host `PostCompact` plus resume observation under real long-running use; fixture and state-recovery contracts pass, but a naturally triggered compaction cycle was not retained as trusted Hook state during this build.
- Stable operating-system support beyond the exact-release evidence. The three headless runner systems pass the public code-candidate matrix and real temporary Harness lifecycles, but the product remains a prerelease and native GUI-specific behavior remains outside this claim.
- MCP App or any rich interface. `enable_mcp_apps` is disabled on the tested surface, and the headless path is complete without it.
- SQLite or remote storage. The local JSONL design is sufficient for the bounded MVP and has concurrency/corruption tests.
- Explicit import of older history beyond portable Intent Loop graphs. No claim of complete pre-install understanding is allowed.
- Claude Code, Cursor, Gemini CLI, WorkBuddy, and additional host adapters. The DeepSeek adapter is a one-time, user-authorized transport experiment and does not clear the efficacy gate for further host expansion.
- OpenAI universal-directory submission. The current local stdio architecture does not meet the hosted public HTTPS MCP and domain-verification boundary, and changing that would require a separately authorized product/privacy decision.

## Rejected

- Prompt pack, intake form, one-shot brief, PRD generator, mandatory checklist, or completion gate.
- New Agent Harness, independent chat client, App Server client, digital twin, complete user profile, or large workbench.
- Parsing Codex transcript files or treating them as a stable plugin API.
- Hooks as semantic judges, permission bypasses, prompt blockers, or mechanisms that force another turn.
- Automatically promoting tool output, quoted content, silence, acceptance, or one repeated choice to user-explicit or durable intent.
- Silently overwriting an old claim, collapsing unknowns/disagreements, or forcing the user and agent to agree.
- Claiming product value from tool-call counts, question counts, fields, protocol prose, a valid package, or green tests.

## Accepted defects and host constraints

- The installed MCP launch initially failed on a literal `${PLUGIN_ROOT}` path. This was fixed with relative `cwd` packaging and revalidated in the installed cache.
- Non-interactive write approvals could not be pre-approved on this CLI build; real E2E used the normal interactive approval surface. The plugin does not weaken the host boundary.
- An ambiguous Hook-review keystroke sequence was not accepted as evidence. Persistent trust was audited and found absent; Hook delivery was then verified with the explicit one-invocation CLI bypass.
- A clean project could discover `$intent` but could not shell-read its installed cache file. The MCP Skill resource fallback was added, tested with the official client, reinstalled, and verified in that clean project.
- Independent adversarial review found private-mode cross-process leakage and ownership/recovery gaps, explicit-claim transition gaps, persistent prompt-injection risk, unsafe stale-lock and link handling, escaped secret-field gaps, import/deletion identity collisions, crash residue, and incomplete bundled-license evidence. Each release-blocking item was accepted and implemented as a regression-tested control; later findings on filesystem error propagation, relation bounds, lock-marker cleanup races, malformed host metadata, and unsafe project-root forms were also implemented. The reviewer approved the frozen source and local distribution candidate with no remaining P0/P1/P2 code finding.
- Independent first-use review found cache-read recovery friction, an unreliable multi-call start that attempted shell/global-Memory preparation, unnecessarily long manual command paths, missing aggregate candidate counts, and an oversized default export. The repaired build reads the MCP Skill fallback once when needed, starts with one `intent_start_task` call that omits paths and IDs, and completes snapshot/correction/feedback/summary/off without mirrored Memory. A separate reviewer then installed public beta.2 from GitHub and gave RELEASE after every business lifecycle call succeeded on its first attempt and off rejected the next write.
- Beta.1 tag CI exposed a real stale-lock generation race rather than noise. Beta.2 repaired that generation/error/token/invalid-marker family, but a final Windows recheck then reproduced a marker/parent `realpath` transition race. Beta.2 was also marked superseded. Beta.3 binds both generations, uses bounded fail-closed Windows transition rechecks, expands the suite to 72 tests, and passed root plus independent 10-by-32-process pressure with P0/P1 zero.
- The frozen baseline originally prohibited another-host port before the paired study. On 2026-08-31 the user explicitly authorized a DeepSeek Harness version plus Linux/macOS delivery. The accepted exception is limited to a thin transport/package adapter, shared semantics, developer-preview labeling, and no efficacy claim. It creates no precedent for an independent Harness, new planner, extra data collection, or more host ports.
- The first three-OS candidate run exposed macOS realpath aliasing in Hook/MCP entry detection and a lowercase Linux dependency-license filename. Both findings were accepted: entry identity now compares real filesystem paths with a safe URL fallback, and legal discovery covers packaged uppercase and lowercase license names on case-sensitive filesystems.
- The repair commit passed all 18 jobs in public run `33370869114`: Codex on Node 20/22/24, the DeepSeek adapter on Node 22.19/24, and a real temporary Harness package lifecycle on Windows, Ubuntu, and macOS. This clears the bounded transport gate while leaving the paired efficacy study at `NO RESULT`.
- A later adversarial v0.2 review reproduced a same-session concurrency failure after an all-green candidate: one failed call immediately closed the shared MCP client and terminated an active sibling. The candidate was held. The accepted repair drains active siblings, rejects new acquisitions, retains capacity during close, and closes idempotently. The reviewer reran the original failure, slow-close capacity, and double-failure probes plus both full suites and returned `RELEASE`, P0/P1 zero, with repaired exact-commit CI as its final publication condition.
- Repaired code commit `d0fba7103c7999ce4f47b3ee6602380b7ead7932` passed all 18 jobs in public run `33377049544`, including the six DeepSeek adapter jobs and real temporary Harness lifecycles on Windows, Ubuntu, and macOS. This satisfied the adversarial review's final publication condition.
- Fresh Codex installation from public tag `v0.2.0-beta.1` reported installed version `0.1.0-beta.3` because the hidden plugin manifest had not advanced with the package manifests. Follow-up adversarial review also found that the running MCP handshake still reported `0.1.0-beta.1`. The tag was left immutable and the release was marked superseded. The accepted beta.2 repair aligns the hidden manifest, source server constant, both package manifests and lockfiles, generated runtimes, SBOMs, and install references; distribution/catalog checks now assert the live handshake identity and the DeepSeek pack check requires an exact 16-file allowlist, including the notice path referenced by the runtime banner.
- A final Windows freeze run reproduced a legitimate peer-cleanup race after `readdir`/`lstat`: one of 32 writers misclassified a delete-pending orphan lock as `PATH_ESCAPE`, leaving 32 instead of 33 events. The accepted repair binds initial/current/final observations to the original bigint generation, retries only bounded access transitions, treats only confirmed `ENOENT` as disappearance, rejects replacement/type/stable-outside states, and rechecks deadline-edge `ENOENT`/outside results. Deterministic regressions plus 10 rounds over 320 real child processes passed; adversarial recheck returned `RELEASE`, P0/P1 zero.