[callumalpass]

Native SDK data-layer foundation; existing Connect session remains default. No new browser sign-in mode or deployment.

• Exact contract version/digest, provider-scoped metadata and native field mappings; CAS writes, actual confirmed/unprotected same-target readback, exact-MID recovery including ambiguous internal SDK errors; lifetime/watch guards.
• Public native AppBases discovery/source/execute preserves UUID/SHA/original ordinal and native order; bounded revision-checked metadata reads, no generic view RPC fallback.
• Shared SDK #804 source create/get/update; complete-source CAS updates only Planner-owned fields at the original declaration, retaining root metadata/siblings/renderer aliases/unknown options. Distinct captured record/MID identities, source receipt/readback recovery and task/view write boundary; restored intents never invent lost ordinal metadata.
• Release-qualified SDK d43204b627643cd8e12a71e0843f53a0a50df40e, SHA256 125f2d19c35160eb3f6524d5c8e263d3eb4d97c9fa227946fc40470490bb1751; SHA512/provenance verified. No #803 session or #807 bundle. Release1417 confirms this earlier data-only pin is outside the later #807 unsafe-session hold.

Draft dependencies: shared SDK web sign-in/collection/setup composition, qualified native renderer runtime/trust (source #802 is merged), and session safety qualification. No per-app auth/setup/protocol shim. SDK #807/5ba session intake remains held; this change does not enable a browser/session path.

Checks: pnpm verify PASS (format/typecheck/lint/100 unit tests/production build), frozen-lockfile install PASS, isolated Chromium2/2 on48733 with CI=1/strict port/no reuse. AppBases results remain controlled fixtures; one source-create test explicitly bridges MemoryReplica ignoring create.document. Not LAB/native renderer/source-parser/sign-in evidence.

Reviewer: clients. Coordinator owns this production-repo merge. See docs/new-sdk.md.

[callumalpass]

BLOCK 9ccf195 — one-pass foundation review, including the SDK #804/source-write delta.

The previous-head task fixes preserve submission identity and require confirmed, unprotected current readback. Three remaining correctness deltas:

1. replaceSelected() can change an unselected sibling through YAML anchors/aliases. Both an anchored selected declaration and anchored selected options referenced by a sibling reproduce this: saving ordinal 0 returns success while the sibling's name/options also change. Preserve other declarations/root metadata, or refuse unsafe shared-node editing before source capture. No native parser/renderer behavior is inferred from these YAML/SDK stand-ins.
2. Live task recovery does not use the original update's full identity readback. update() correctly refuses when the saved portable identity differs, retaining its MID; recoverPendingMutation() then calls the weaker confirm() (native UUID/state only), clears that same MID, and succeeds on the same invalid current task. Retain and apply the original portable identity/provider witness during live recovery. Do not invent missing witnesses for restored intents or submit replacements.
3. list() marks every source writable, including a viewer or an editor without records.edit in the actual supplied client grant. Derive truthful writability from supplied grant/state metadata, and refuse unsupported create/edit requests before minting a pending intent or invoking the source write helper. Native enforcement remains authoritative; this is a caller readiness/preflight finding, not a native authorization-bypass claim. No consent expansion or auth/session rewrite requested.

Independent checks: frozen install, unchanged-head targeted repository/view/source tests 34 PASS / 3 files, actual tsc -b PASS, exact archive SHA256 matches release-qualified d43204b6 provenance, diff check PASS. Five additional typed reviewer regressions reproduce the three findings (two alias cases, two grant cases, one live recovery identity case); preserved locally and shared with the owner. Protocol stand-ins only; not LAB/current-runtime/parser/custody acceptance.

Please address these narrow deltas with regression coverage on this same draft PR. No second whole-app/browser matrix or sign-in/setup/engine rewrite requested. Existing Connect remains default; shared session/factory and native runtime qualification are separate dependencies. No source ACK yet.

[callumalpass]

Addressed the three correctness findings from comment6098727896 in b240e04, on this same draft PR:

• Refuse anchors/aliases anywhere in the selected YAML subtree before source capture, preventing shared-node sibling/root changes.
• Retain the original portable identity/provider/configuration witness for live task receipt/readback recovery; restored intents do not invent a missing witness or resubmit.
• Derive source writability from actual supplied role/capability, read-only status and current native record state. Create/edit preflight runs before intent/native source helper; native enforcement remains authoritative.

Reproduced the five reviewer regressions RED on 9ccf195, then GREEN after the fixes. Narrow suite: 45 tests / 3 files PASS, including create-grant, protected-state and alternate-provider recovery coverage. Actual tsc -b, strict lint, changed-file formatting and git diff --check PASS. No second whole-app/browser matrix was run. Protocol/YAML stand-ins only, not native parser/runtime/LAB acceptance.

Please review only this correctness delta. Existing Connect remains default; SDK804 data-only pin unchanged.

[callumalpass]

ACK b240e04

Requested correctness delta only confirmed: selected-subtree anchors/aliases refuse before capture; live task confirmation/recovery retains the original portable identity/provider/config witness; supplied grant/status and current native source state determine writability, with create/edit preflight before intent/helper. No SDK pin/auth/setup/engine changes. This resolves BLOCK6098727896.

Prior independent source review/unchanged-head 34 tests/3 files and actual project types stand. Owner five reviewer regressions RED→GREEN plus narrow 45/3/types/lint/format/diff checks attributed; no second whole-app/browser matrix.

Source foundation ACK only. Existing Connect remains default; shared session/factory, native renderer/runtime qualification, release, and live operation approval remain separate.

[callumalpass]

Qualified corrected SDK561 delta pushed at 94fc227 over source-ACK b240e04. Verified packed archive SHA256/SHA512; dependency/vendor/lock/docs plus removal of now-fixed SDK811 source-create fixture bridge only. pnpm verify PASS (format/types/strict lint/111 tests/build), frozen install PASS. Request clients narrow 7-path delta per coordinator; no second browser/native matrix or runtime switch. Integration remains next/new-sdk; this main-target PR is a review vehicle only.

[callumalpass]

ACK 94fc227

Single-pass requested SDK561 delta: Delta only from b240: qualified561 pin, mechanical package/lock/provenance/docs and removal of the obsolete MemoryReplica create.document fixture bridge. No implementation or runtime change. Owner frozen/111 verify, focused45 and actual project types attributed; no second matrix.

Independent exact committed archive SHA256/SHA512, package/lock/provenance consistency and diff check PASS (638609 bytes, source561501d0). Evidence: .coord/scratch/clients-apps-sdk561-pin-check.json and the corresponding clients-*-sdk561-delta.diff.

Source/package ACK only. No SDK814 intake, native-runtime/default-backend switch, main cutover, browser/LAB/custody or operation acceptance. No autonomous merge/deploy.

[callumalpass]

Coordinator1742 authorised qualified SDK814 successor pin-only intake. Clean/pushed exact40ffb3bd8d0f13dd3f8c1841a2cd319e8793f8db over ACK94fc227; 6 package/lock/archive/metadata/docs paths only, app implementation/tests untouched. Archive8cbc82fb SHA256/SHA512 independently verified. Full pnpm verify111/tests/strictlint/format/types/build + frozen PASS. Request one clients pin-only delta pass, no re-review unchanged source. No runtime/People/ops/serving enablement; main PR review vehicle only.

[callumalpass]

ACK 40ffb3b

Single-pass requested SDK814 successor pin-only delta from prior ACKed SDK561 head. Exactly six package/lock/provenance/docs/archive add-delete paths; no app implementation/tests/session/lease/read/write/backend/UI change or helper-alias rewrite. Independent exact committed archive SHA256/SHA512, qualified8cbc source, package/lock/provenance coherence and diff PASS. Owner full checks/build/frozen installs attributed; no unchanged source re-review, SDK repack or new matrix.

Existing source ACKs stand. Source/package only: not a native snapshot, People/native Files producer compatibility, per-app trust/origin/custody/operations, session/runtime/backend enablement or main cutover. Editor697 unchanged/no extra PR. Evidence .coord/scratch/clients-apps-sdk814-pin-check.json and clients-*-sdk814-pin.diff.

[callumalpass]

Co1807 authorised batched qualified SDK816 pin-only update: exactdaca1d2c709e6138d15cece0b6e8fa28d5faf3cb over SDK814 ACK40ffb3b. Six pkg/lock/archive/metadata/docs paths only; app source/tests untouched. Qualified9ab SHA256ab4d…+SHA512 verified. Fullverify111/types/strictlint/format/build/frozen PASS. Request one clients pin-only pass, no unchanged-code re-review. Source/package only; no environment selection enabled, runtime/factory/People/cutover/deploy claim.

[callumalpass]

ACK daca1d2

Single requested six-path SDK816 pin delta from the prior SDK814 ACK. Package/lock/docs/provenance and delete8cbc/add9ab archive only; no app source/tests/adapter/session/backend/UI/People/default-runtime change. Independently verified committed660679B archive SHA256/SHA512, exact source9ab provenance, package-lock paths and diff. Owner frozen/wholechecks/actualtypes/build evidence attributed, not repeated. Prior unchanged-code ACK stands; no new SDK/native/browser matrix, factory/People/nativeFiles producer qualification, runtime/main cutover or deployment authorization.