[ancongui]

A final official-CLI recovery can now request administrator-selected checks already retained on its run. The separate coding MCP channel accepts only a configured command index and request identity; forge owns the arguments, timeout, runner, current authority and shared budget.

Studio guides the administrator through check review, an explicit grant, mitigation review and final reservation. It retains the exact bodies and future recovery identity before writing, checks the current grant separately from its historical receipt, and uses exact reads after an uncertain response. Missing browser state, changed authority, revocation and expiry hold the flow. Legacy CLI-only recovery stays separate, with its existing four-attempt contract and one final fifth allowance.

The SDK and CLI expose candidate, grant, exact-receipt, current-status and revocation operations. Codex and Claude adapters receive one invocation-scoped loopback tool, separate from the 162 operator MCP tools. Source-bound results, unknown-effect holds and independent final verification remain required. Codex explicitly preapproves only run_configured_check within this already granted channel, retaining global approval_policy="never" and workspace-write. Host runners retain their existing service-account execution limits.

The API server now selects the stdlib asyncio event loop explicitly. A known uvloop host with a finite POSIX file-size limit is refused with a typed runtime-admission error before configured native provider dispatch intent and before the final CLI launch guard or child creation. Custom providers, unlimited parents and the untrusted command executor retain their existing behavior. Already-spent tasks and recovery reservations remain spent. External ASGI hosts must select asyncio.

This prepares version 0.2.29, documents the native API and execution boundaries, and refreshes all 484 controlled walkthrough records, including 20 images for the new journey. The Agentic catalog contains 260 centralized prompt resources. The isolated runner exporter now initializes the redaction context needed by its standalone program. Child-environment credential checks and parent artifact admission remain separate boundaries; parent-only tokens never enter the generated program.

Validation

• Backend: 44 native PostgreSQL/API/runtime contract tests and the exported server DTO-to-Studio reader gate passed with controlled external fixtures.

• Actual Codex client: pinned 0.163 completed native discovery → scoped MCP → the actual SandboxExecutor/HostRunner → the normal configuration loader and a read-only test PostgreSQL SELECT 1. One runner receipt, valid WAL, known process settlement and clean teardown were confirmed. Responses came from a finite local fixture; paid model requests and actual CRM effects were zero.

• Integrated Studio: 543 unit tests, types, lint, formatting and production build passed. The focused wizard qualification covers keyboard use, mobile, short screens, 200% CSS zoom, cross-tab exclusion and uncertain-response readback.

• Documentation: 64 canonical producer tests; strict build and discovery; 10 Node tests, 19 Python tests and 94 rendered-browser cases. Five GitHub Pages path cases, all 61 pages and 7,858 local URLs passed. The new guide and both LR diagrams have additional theme, layout and keyboard-scroll checks.

• Packaging: offline wheel and source builds passed boundary and exact-payload checks. A fresh installation matches the qualified dependency versions, all 228 Python modules, bundled Studio and Manrope files; installed SDK/schema checks and version smoke passed.

• The first full CI on a01661a finished with 3,698 Python tests passed, two failed, 51 skipped and four warnings; Studio passed 543 unit tests and 723 browser cases, and documentation passed 94 browser cases. The failures exposed a missing standalone redaction dependency and a stale 258-resource expectation. Both regressions are preserved in the original run.

• The exporter correction passed 82 affected host tests, Ruff, formatting across 557 files and mypy across 228 source files. Five native Docker cases were skipped and two database cases were excluded from this focused run. Real isolated-subprocess tests cover archive success, symlink rejection, child-environment credential rejection and parent rejection of a returned parent-only token. That intermediate head was then canceled while the separately reproduced uvloop signal regression was corrected.

• The final loop correction passes 57 affected tests, including 14 focused host and native C controls; two database tests were excluded. Independent review reran the exact 14 cases and checked a real uvloop subclass. Ruff, formatting across 558 files, mypy across 228 modules, strict documentation and 19 documentation tests passed.

• An actual synthetic Uvicorn server entered through the production forge serve callback and launched the production process adapter: the native C probe retained the finite 16 KiB limit and ignored signal, returned EFBIG, exited zero and drained its group. A separate external uvloop server returned the typed refusal with zero launch-guard or child calls. Both servers completed lifespan shutdown and cleanup. These controls used no database, model or official coding CLI.

Full CI for 8f7b193b passed: 3,712 Python tests, 51 skipped and four warnings; 543 Studio unit tests across 66 files; 723 Studio browser cases; and 94 documentation browser cases. All five Verify jobs and the separate documentation build passed. The exact downloadable CI wheel and source archive match all 1,927 tracked source files, bundled Studio, metadata, RECORD and legal notices. Both distributions are byte-identical to the local exact-source build; the wheel matches the fresh isolated base and analytics installation with all 228 production modules. Merge, tag and published-release verification remain pending independent review.

Authenticated-provider inference, actual Claude-client execution and complete same-run CRM acceptance remain separate pending gates. The finite official-Codex check qualifies the native MCP path; controlled captures and protocol fixtures do not establish those remaining outcomes.