FE-1317: Close host-landing oracle identity over PTY behavior

[lunelson]

Why

Comparison evidence must become stale whenever terminal-driving behavior changes. Several PTY-affecting files were missing from the oracle fingerprint, allowing old evidence to appear current.

What

• Adds every identified PTY-driving and observation input to the immutable oracle pack.
• Proves that changing any input changes the fingerprint while identical inputs remain stable.
• Isolates tests from local provider credentials and git-signing configuration.

How to test

1. Run the oracle-pack identity tests and confirm each PTY input changes the fingerprint independently.
2. Repeat with byte-identical inputs and confirm the fingerprint remains stable.
3. Run the tests with local credentials and git signing configured and confirm neither affects the result.

[lunelson]

• FE-1352: Upgrade Pi to 0.84.x on next and close its change surface #428
• FE-1348: Validate current Brunch usage and testing paths #427
• FE-1321: Converge TUI and web session runtime contracts #416
• FE-1320: Structural private-mission isolation for /compare-specs #415
• FE-1318: Reconcile canonical documentation with current topology #414
• FE-1317: Close host-landing oracle identity over PTY behavior #413 👈 (View in Graphite)
• FE-1316: Audit current system authority and drift #412
• FE-1311: Remove dead code and clarify repository contracts #402
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Low Risk
Changes comparison fingerprint membership and test isolation only; no product PTY or comparison execution path behavior is altered beyond stale-evidence detection becoming more complete.

Overview
Closes FE-1317 by expanding brunch-host-landing-oracles-v1 so oraclePackSha256 content-addresses every behavior-bearing PTY input: tui-driver.ts, session.ts, screen.ts, plus newly included keys.ts and driver.exp. A focused dispatch test asserts identical inputs keep a stable hash and that mutating any one of those files changes the pack hash—without changing PTY driver runtime behavior.

Planning artifacts move host-landing-oracle-identity to Recently Completed and archive the closeout in PLAN_HISTORY.md.

Separate test hardening: tier-2 “no model” boot stubs ANTHROPIC_API_KEY and forces an empty model list so ambient credentials cannot trigger kicks; comparison fixture git tags use --no-sign to avoid machine-local signing config flakiness.

^{Reviewed by Cursor Bugbot for commit c69463b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit f109ea4. Configure here.}

[Copilot]

Pull request overview

This PR closes a provenance gap in Brunch’s execution-comparison system by ensuring the host-landing oracle’s immutable “oracle pack” fingerprint includes all PTY behavior-bearing inputs, and adds regression coverage to prove the fingerprint changes on any relevant input change while remaining stable for identical inputs. It also includes small changes intended to reduce test flakiness from ambient developer environment configuration.

Changes:

• Extend the compiled brunch-host-landing-oracles-v1 implementation file set to include tui-driver/keys.ts and tui-driver/driver.exp so PTY-driving behavior is fully captured in the oracle pack hash.
• Add a regression test that mutates each PTY input one-at-a-time and asserts the oracle pack hash changes, while identical inputs produce an identical hash.
• Hardening for local-environment flakiness: force “no model available” in Tier-2 harness services, avoid signed tags in git fixtures, and isolate provider creds from a determinism test.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/dev/tier-2-harness.ts	Forces the “no model available” harness path to stay deterministic by overriding model availability to empty.
src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts	Adds regression coverage asserting oracle pack hash sensitivity per PTY input and stability for identical inputs.
src/dev/execution-comparison-operator.ts	Adds keys.ts and driver.exp to host-landing compiled oracle implementationFiles for fingerprint completeness.
src/dev/comparison-provenance.test.ts	Prevents local git signing config from affecting tag creation in fixtures via git tag --no-sign.
src/dev/tests/tier-2-harness.test.ts	Stubs provider env vars to ensure deterministic boots don’t become live turns due to ambient credentials.
memory/PLAN.md	Marks FE-1317 as completed and removes the now-closed frontier definition entry.
docs/archive/PLAN_HISTORY.md	Archives the FE-1317 closeout summary and traceability notes.
.pi/settings.json	Updates Pi settings (currently introduces machine-local absolute paths).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts:169

• Building rivalPath via inputPath.split('/') can fail on Windows and the current ?? '' fallback risks writing to the temp dir itself (or, if split fails and returns an absolute path, escaping the temp dir). Use a separator-agnostic split and remove the empty fallback.

      const rivalPath = join(root, inputPath.split('/').at(-1) ?? '');

src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts:153

• This test extracts file names by splitting on '/', which breaks on Windows paths (fileURLToPath returns platform-native separators). Use a separator-agnostic split (or basename) so the assertion is portable.

This issue also appears on line 169 of the same file.

    expect(ptyInputs.map((path) => path.split('/').at(-1))).toEqual(hostLandingPtyInputNames);

[kostandinang]

The pack now fingerprints the PTY inputs that actually change host-landing behavior, and the tests isolate ambient credentials/signing. That's the right identity contract.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts:169

• inputPath.split('/') is not portable. On Windows it will return the full absolute path, and join(root, <absolute path>) will ignore root, causing the test to write into the real source file path instead of the temp directory.

      const rivalPath = join(root, inputPath.split('/').at(-1) ?? '');

src/dev/execution-comparison/tests/operator-oracle-dispatch.test.ts:153

• Using path.split('/') assumes POSIX separators. On Windows this expression returns the full absolute path (no '/' separators), which makes the assertion fail and can mask later issues in this test.

This issue also appears on line 169 of the same file.

    expect(ptyInputs.map((path) => path.split('/').at(-1))).toEqual(hostLandingPtyInputNames);

[cursor]

Merge activity

• Aug 19, 3:33 PM UTC: Graphite rebased this pull request, because this pull request is set to merge when ready.