Record project initial privacy failure and halt admissions

doc/plans/2026-10-26-chat-catalog-eval-progress.md

@@ -7,8 +7,8 @@ Updated: 2026-10-27. This is the single progress record for [the saved goal](202
 - **244 scenarios / 35 areas / 191 capabilities**, frozen inventory digest `9dc9cf6a5426cf1b56bc30a3571851f233f9dd5e93a1292eaee414d33b52df77`. All original queries, contexts and expected outcomes remain unchanged. **196 passes required**; blocked, partial, unsupported and unrun remain in the denominator.
 - **229 authored: 220 without declared coverage gaps, 9 partial, 15 unimplemented** at exact committed-source metadata checkpoint `32b472dfa5640987e199c2e0aa21b2c7c02555c6`. There are 227 concrete lazy descriptors plus two legacy task cases. Actual callbacks, bounds, policies and source dependencies were reconciled from this one Git archive; newer area work remains pending. These are authoring counts, not acceptance.
 - Five partial definitions contain concrete executable supported-surface/context blocker probes: two access grants, subscription provenance, skill-use authority/context and genuine prior-day routine history. Four have unfinished required branches: the Grok origin integration closure, named ChatGPT setup, team installer failures and private-repository after-grant completion. **225 authoring-resolved; 4 unfinished; 15 absent.** Only actual reserved execution can process a concrete blocker; offline probes/calibrations do not establish processing. Incomplete conditions cannot pass.
-- **Four scenarios attempted; five actual measurements; zero first-attempt passes and zero final passes (0/244 for both rates).** Goal-tree is exhausted after two failures. Alignment and purpose each retain one failed initial attempt and one allowed correction/rerun remaining.
-- **No live launcher or provider process is running.** Admissions stopped after the authorized sign-in initial failed PostgreSQL bootstrap and finalization; its recovery state remains private with cleanup unconfirmed. The other four authorized initial cases remain unreserved. Final retries remain held for coherent B. No unchanged rerun, extra nudge, deadline extension, automatic retry or relabeled canonical health probe was used.
+- **Five scenarios attempted; six actual measurements; zero first-attempt passes and zero final passes (0/244 for both rates).** Goal-tree is exhausted after two failures. Alignment and purpose each retain one failed initial attempt and one allowed correction/rerun remaining.
+- **No live launcher or provider process is running.** Project creation ordinal 1 completed from immutable `6951f67ecd1aaedec789703dc9c7227bddd2b59a` on the qualified owned-Docker PostgreSQL 18.6 lane. All ten behavior checks passed, but the final persisted-state privacy scan failed on the disposable instance configuration; cleanup passed. Admissions stopped for shared harness diagnosis. Comment-with-reference, broken-link and edit-profile remain unreserved. No rerun or final-B admission occurred.
 - Current recovery: semaphore cleanup approval is still pending and no set has been removed. Read-only discovery verified an already running local Docker Linux/arm64 engine; an explicit owned PostgreSQL18.6 lane is being qualified. Its one infrastructure-only health check at `772c29dad9` failed before container start because Docker Desktop represents the exact host password bind with `/host_mnt`; no Paperclip, native or model work began. The initial failed cleanup receipt is preserved; separate authorized cleanup verified exact container/volume absence and removed only its password. The separately authorized corrected infrastructure-only health at `325af67e3d` passed PostgreSQL18.6, normal onboarding/migrations/API and zero work; exact owned resources were removed with no cleanup failures. The Docker lane is qualified; host IPC cleanup is no longer required. AgentMail/GitHub read-only discovery is authorized/completed; designated self-email and repository choices remain pending.
 - Production baseline `8373d7867963674ff960d2345d0d28086f799bc7`; branch `codex/chat-catalog-evals`. PR #17794 merged via `2ee36a4`. No eval/core PR has been created. No merge is eligible.
 
@@ -225,3 +225,11 @@ Manager review correction to the five-computer handoff: `test-computer` now read
 ## Immutable metadata reconciliation — 32b472dfa5
 
 All 227 concrete lazy exports and 2 legacy definitions were reconciled from the exact Git archive 32b472dfa5, with all 244 original requests/capabilities/inventory hashes preserved. Every historical attempt object was compared against its original ledger bytes: 4 scenarios / 5 measurements remain unchanged, with 0 eligible passes. Source-only/unfinished probes remain distinct from concrete supported-surface blockers and live processing. The accepted preinitial fixture correction 2e6a5dbe27 removes outcome instructions from broken-link descriptions without changing its grader; the separate note correction requires an affirmative instruction with a parsed same-origin actual design href and rejects negated/wrong-target/foreign links. No attempt budget was consumed. The execution candidate incorporates these exact source corrections separately from the metadata cutoff; newer area handoffs remain queued.
+
+## Latest measured slice: project creation initial (2026-10-27)
+
+`projects.create-project` ordinal 1 ran from reviewed immutable `6951f67ecd1aaedec789703dc9c7227bddd2b59a`, production baseline `8373d7867963674ff960d2345d0d28086f799bc7`, profile `runner-codex-subscription`, model `gpt-5.6-sol`, automatic retries zero. Campaign `catalog-initial-2026-10-27T07-03-53-222Z-projects-create-project` retains the original failed result and persisted-state scan. Two real native runs and two source-chat human turns satisfied all ten independent behavior checks, including exact retry reusing the first project. The supervisor then reported `secret_leak` in private disposable `config.json`; the scan sidecar preserves original result status `passed`, but the actual measured outcome remains **failed**.
+
+Source diagnosis: the owned Docker helper registers its generated password and connection string as protected roots; normal server configuration intentionally stores that connection string in the private disposable config; the generic persisted-home scan has no corresponding narrowly validated custody handling. This identifies a shared harness custody conflict, pending manager review; it does not establish a product or model leak. Further admissions stopped and the other three selected cases remain unreserved. Exact result: `tests/runner-e2e/results/catalog-initial-2026-10-27T07-03-53-222Z-projects-create-project/chat-features/runner-codex-subscription/local/projects.create-project/attempt-1/result.json`.
+
+Cleanup passed; actual database identity reports the exact pinned PostgreSQL 18.6 artifact and container status `removed`. Actual heartbeat usage is **704,239 total tokens including cache** across two runs; subscription dollars remain unpriced. No imported fixture cost events were included. Original earlier failures and cleanup overlays remain unchanged.

tests/runner-e2e/chat-campaign-manifest.json

@@ -4116,9 +4116,60 @@
       "readiness": "implemented",
       "executionId": "chat-features.runner-codex-subscription.local.projects.create-project",
       "blocker": null,
-      "attempts": [],
-      "qualifyingDefinitionDigest": null,
-      "qualifyingGraderDigest": null,
+      "attempts": [
+        {
+          "ordinal": 1,
+          "outcome": "failed",
+          "executionId": "chat-features.runner-codex-subscription.local.projects.create-project",
+          "startedAt": "2026-10-27T07:03:53.222Z",
+          "finishedAt": "2026-10-27T07:06:50.432Z",
+          "sourceRevision": "6951f67ecd1aaedec789703dc9c7227bddd2b59a",
+          "workingTreeDigest": "47a870ad808d1c035fdd33b6a03cae551e613dba3a5bdbad27ae73b723e15188",
+          "definitionDigest": "567438721d3906fcc37e884375250066033f04e74ea2ca3b21d86e5f95dab953",
+          "suiteDefinitionDigest": "84c79b71867072783585112b8835a5080a2da146d303deda091a9cbaf2d9c8b1",
+          "graderDigest": "567438721d3906fcc37e884375250066033f04e74ea2ca3b21d86e5f95dab953",
+          "model": "gpt-5.6-sol",
+          "profile": "runner-codex-subscription",
+          "environment": "local",
+          "automaticRetries": 0,
+          "correction": null,
+          "classification": "secret_leak_pending_harness_custody_diagnosis",
+          "observedFailure": "Secret leak in persisted Paperclip home state at paperclip-home/instances/runner-e2e-c5fde44ccf0a66ae/config.json: exact secret value (unattributed credential)",
+          "evidencePaths": [
+            "tests/runner-e2e/results/chat-catalog-campaign/initial-selection-6951f67ecd.json",
+            "tests/runner-e2e/results/catalog-initial-2026-10-27T07-03-53-222Z-projects-create-project/chat-features/runner-codex-subscription/local/projects.create-project/attempt-1/result.json",
+            "tests/runner-e2e/results/chat-catalog-campaign/active-projects.create-project.json"
+          ],
+          "usage": {
+            "costUsd": null,
+            "tokens": 704239,
+            "coverage": "Actual two native usage receipts;704239 total tokens including cache; subscription cost unpriced, fixture cost events excluded."
+          },
+          "cleanup": "passed",
+          "corePrDependencies": [],
+          "databaseLane": {
+            "lane": "owned-docker-postgres",
+            "image": "postgres@sha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336",
+            "imageId": "sha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336",
+            "version": "18.6-1.pgdg13+2"
+          },
+          "productIdentity": {
+            "kind": "source-build",
+            "productionSourceRevision": "8373d7867963674ff960d2345d0d28086f799bc7",
+            "snapshotSourceRevision": "6951f67ecd1aaedec789703dc9c7227bddd2b59a",
+            "nativeBinarySha256": "9d8af6b85b836a03092ade2273be6f29f5c2f6ec67ee891d83ee9693ba39d3b4",
+            "workspaceBuildDigest": "222e10a8a2a20d3015ec4470b952e2dd9b927dfe9390c4a5ed1e19d740c0e35b",
+            "receiptPaths": [
+              "tests/runner-e2e/results/chat-catalog-campaign/snapshot-6951f67ecd.json",
+              "tests/runner-e2e/results/chat-catalog-campaign/snapshot-10d0ce63610.json",
+              "tests/runner-e2e/results/chat-catalog-campaign/snapshot-0fdcb539a8.json"
+            ],
+            "coreCandidate": false
+          }
+        }
+      ],
+      "qualifyingDefinitionDigest": "567438721d3906fcc37e884375250066033f04e74ea2ca3b21d86e5f95dab953",
+      "qualifyingGraderDigest": "567438721d3906fcc37e884375250066033f04e74ea2ca3b21d86e5f95dab953",
       "productPolicy": {
         "lane": "source-build",
         "sourceBaselineRevision": "8373d7867963674ff960d2345d0d28086f799bc7"