Enigma complete supervisor repair: independent acceptance, 2026-10-24

Accepted candidate 83b0163fcd99c0c8989fa091fb3d34e5fdde7ab1 from /tmp/enigma-supervisor-exit-repair-oct24/repo, inheriting terminal candidate ca285950d409fe8a18c65831a2d619e01c6667b0 and unchanged FindFirst supporting files from 455f3ba3e30a3eedef9a3ce984c1fb0321f9541a. The transformed complete supervisor now propagates terminal capture denial as exit1 after cleanup and receipt publication. A shell AND dependent remains absent. No test-only exit is appended to the accepted source. The guard is in the production transform, outside finally, preserving original polling/cleanup/publication exceptions.

This is independent offline acceptance and conditional scoped main integration. PNG startup, menu and gameplay remain unaccepted. No full build, native/WASM instantiation, guest, browser, acquisition, deployment, box operation or worker launch occurred. No box ID/state/expiry is assigned; lifecycle stays with the coordinator. Historical box labels in source fixtures are not observations.

Exact inputs and unchanged rejection

Assignment main donor: f879fd0cd81d918ea54a18b1b222fae25dd6d618 at /tmp/enigma-findfirst-independent-integrate-oct24/repo. Independent prior rejection: 53990b0c159b2c6a46824ca038ab2a1fefa70c75 at /tmp/enigma-runner-repairs-independent-integrate-oct24/repo. Before checkout, all79 focused blobs (913502 bytes) were measured and verified against candidate Git blobs; existing donor files matched byte for byte. Fresh git init used explicit noncone sparse paths and read-only object alternates. Root tracked files, index, refs, original inputs and all donors stayed read-only.

Adjacent identity.json binds those blobs, five historical/transitive originals against Git d8cd8c54c8d63c107696f1e4ef7a1e229dcadc1e, all nine original review seals, unchanged oracle/failing receipts,23 standing pngjs files, and installed tool identities/standing footprints. Original runner SHA256: 4d7b9587676db38fcf3314807acb2b2a42b5f09d2c98fcf3dccb8a6cde9e1809; original supervisor: 73be15954cedc19340779ff6bda2397cb94927ca702d2baebdccd5e763cf7b73; accepted adapter: f34e2b9fca0cafe2304f9231d9c5e759ddce66c01cf8c5b5dae15bc4edea5ee6. The independent original oracle remains SHA256 608d6fb2e87a59c0fe65445d057bed30fc40b6906f4ab48a61fafebb08d48a67.

The original oracle still exits1 as expected: old actual supervisor exit0, dependent runs, terminal denial receipt remains. Original failing receipts and original assertions remain unchanged. The separately named test/test-enigma-supervisor-denial-accepted.py changes only the evidence directory binding. oracle-binding.diff proves the change; its candidate snapshot is generated from the actual checked-out adapter. This unchanged acceptance oracle exits0, observing supervisor exit1 and no dependent. Its existing appended exit positive control remains a control only, separate from the observed candidate.

Fresh external acceptance

Adjacent independent.py is the independently written, executed acceptance harness; external-cases.json retains every observation. It transforms the exact historical supervisor with the actual candidate adapter, extracts the actual helper and complete try/loop/finally through EOF, and executes the byte-identical historical stop() using fake child/group interfaces. Receipt I/O, Python exit and shell AND are real; no historical setup, guest recipe or actual kill runs. It observes TERM, group checks, KILL, wait, a positive adopted-child reap, exhaustion, log close and terminal receipt publication. Polling and fast-exit denial both exit1 and block dependent work with the receipt retained. Fast exit0/1, original exceptions, malformed/oversized receipts and unrelated child errors are also covered by the inspected and separately executed complete subprocess regression.

The fresh harness tests successful/disabled/missing-receipt paths against the original complete tail, rejecting malformed, oversized and wrong-pin receipts. Original polling, cleanup and publication exceptions propagate without replacement by SystemExit. Removing only the inserted production guard yields exactly the previous rejected transformed source: exit0 and dependent runs. The unchanged denial assertion rejects that mutation. Producer regression independently checks the historical unrelated child-exit semantics, including its pre-existing exit0.

The actual compiler-boundary triple composition fixture is byte-identical to the original independent fixture relocated into test/, preserving its repo-relative resolution. It intercepts the full runner at real Node Module._compile, actually loads the historical transformed VFS and original capture module, and uses the hash-verified real pngjs codec. FTQ and TFQ pass; four other orders reject before runner entry. Full transformed runner equality and real VFS equality are checked. The unchanged literal/wildcard/path/metadata oracle passes, normal pixels match, receipt inode/directory fsync is observed, original error identity is retained and no next main.run occurs after denial. Removing both catch rethrows makes two runs and is rejected. Seven further terminal mutations and the VFS end-anchor mutation are rejected. compiler-recipe.json records exact full-file/input pins and byte, line and SHA256 excerpt ranges/order; no toy source or replacement oracle is used.

Commands and integration

Commands executed in this isolated checkout under fresh MemAvailable>=805306368, Node heap256MiB, CPU/wall60s, capture1MiB and perfile24MiB controls:

The three JS entries classify as unit using unchanged main tools/test-tiers.js. Already accepted main filesystem/quietFS files are dependencies only and are not duplicated or edited. Complete terminal+exit+FindFirst source, fixtures, original rejection and supporting evidence remain in the accepted tree. Integration uses the shared flock, reconciles the actual remote main, retests the exact merged tree and requires fast-forward-only publication plus actual remote SHA verification. Task-root ops/integration.json, publication.json, final scoped patch and final tree record the resulting revision, remote baseline, commands and test results. There is no claim of main publication without those receipts.

Resource and recovery record

Initial projected peak43400297/67108864 bytes included Git/source/temp/evidence, the full external session/events/history, positive SQLite future growth, and8MiB reserve. Initial projected host free3021116311>=2982150144; fresh memory admission passed. Subsequent accounting retains full history and positive SQLite high-water growth, standing tools/donors separately, and future/reserve charges; final receipt supersedes this initial projection. No denied operation was retried or bypassed. No mount argv exists because no conditional guest/mount execution is authorized. Trusted Git SSH is exactly the dedicated-key/known-hosts command in admission and publication receipts; trust files and credentials are unchanged.

/tmp/enigma-supervisor-independent-integrate-oct24/ops/ retains bounded raw commands/results, resources, publication, cleanup and recovery receipts. Remote commits preserve source and evidence; ignored operational receipts remain separately retained on this host. Own watcher and temporary child directories are cleaned up; ops/result.json is written last. Stop after this assigned acceptance/integration.