PaperClipAI/doc/plans/2026-10-28-kimi-code-runner-integration.md

Kimi Code native Runner integration — 2026-10-28

Owner: this chat, with separate provider, distribution, and product owners. Baseline: dce004259394486f6361d0c0dd5a33a5272acc0a. Branch: codex/kimi-code-runner in the existing managed worktree. Delivery: tested, reviewable PR stack: Runner foundation, shared Core Stop recovery, product setup and acceptance, then qualified pack delivery. Each slice must compile and group cohesive behavior for review. Merge, publication, and production deployment are separate from this handoff. The user confirmed local plus Daytona acceptance.

Merge integration — 2026-10-30

The master integration keeps the existing released Kimi revision 17 and adopts master's upstream-only release attestation. The old source-bound revision 17 fixture remains immutable historical evidence with no current launch authority. The pinned Kimi 2.3.3 distribution and platform closure pins are unchanged. Generated profiles, current digest admission, and shared remote installation must pass again on the integrated source. Earlier native acceptance and public packages retain their original source and digest; they do not establish fresh live or ordinary UI acceptance for this integrated identity.

Release contract

An operator selects Kimi Code in native Runner, saves and reopens its exact model/environment configuration, tests the runtime, assigns ordinary work, sees streamed tools and output, receives independently verified files/artifacts and durable task completion, and can Stop owned work. Existing legacy Kimi agents and their history retain their current execution path.

• First environment: isolated local macOS arm64; remote: Daytona Linux x64.
• Runtime under investigation: official @moonshot-ai/kimi-code@2.3.3, ACP over stdio, behind the existing ACPX driver. The ambient Mac binary is 0.41.0 and cannot establish the new runtime's compatibility.
• Model: explicit caller-selected identifier, acknowledged before the first prompt. Qualification uses authenticated kimi-for-coding; discovery is never a product allowlist.
• Authentication: explicit company-secret KIMI_API_KEY environment binding. Qualification uses only the active global login's short-lived access token; the provider accepted a real model/tool turn. Refresh tokens and login homes are never transferred. Managed Kimi account connections are deferred.
• Instructions: exact composed content must reach native model instructions on create and load, with correlated acknowledgment; missing proof rejects prompt admission. Current official ACP does not consume this field, so a pinned, provider-owned runtime patch is required unless a richer interface proves better.
• Required: model/instruction admission, scoped authenticated tools, streaming, semantic questions, permission decisions, cancellation, session continuation, terminal settlement, cleanup, clean installation, and the ordinary product path. Native question/plan controls are inventoried separately before any claim.
• Deferred unless separately qualified: managed browser login, active steering, inbound media, native question/plan controls, native child/background agents, first-class child projections, additional OS/architectures, and usage accounting. Native ACP reports context occupancy, not usable per-run token/cost totals. Dollar budget enforcement is therefore not a qualified capability.
• Spending: proportionate goal-authorized test/provider/infrastructure work; record material costs and unknowns, diagnose first divergence before paid retry, stop uninformative attempts. No recurring infrastructure commitment.

Architecture and ownership

Provider translation and native patch remain Kimi-owned. Shared Runner supervision, PRP transport, durable decisions, authorization, and task finalization retain their existing contracts. Distribution is a pinned installed closure with no fallback to ambient Kimi. Runtime admission remains pending until required live qualification passes. Provider registration does not migrate legacy agents.

Current release state — 2026-10-30

The pending11 campaign is historical baseline evidence. Its final Daytona Stop/new/resume attempt failed because canonical sandbox reuse left an earlier lease for the same allocation without an explicit ownership handoff. The run created all three provider turns and completed the authored reset, but source inspection correctly rejected ambiguous ownership before file preservation. The original failure and cleanup evidence remain unchanged; the campaign has nineteen passing distinct cases, not twenty.

The repair records an atomic server-owned handoff on both lease rows. Recovery accepts only the complete backward chain of inactive, finalized native owners with matching company, task, agent, workspace, provider and allocation. Missing, foreign, active, conflicting or additional owners remain blocked. The exact producer regression fails before the repair and passes with real file copyback; all 114 owning recovery tests pass. This is deterministic recovery evidence, not a replacement for the live Daytona case.

The foundation was reconciled with master a8e07500db68f187b19de83823eb7fabf1196021. Shared permission, turn attribution and runtime activity changes required new native artifacts and fresh pending14 qualification. Its immutable declaration and Mac/Linux artifacts remain recorded at their actual source identities. The pending11 nineteen passes remain historical baseline evidence with no pending14 or later runtime qualification credit.

CI rejected a stale Pi fixture in a shared Rust unit test after candidate13 was sealed. The corrected test advanced Kimi to pending14 before its shipping build or live cases. Candidate13 and the original failure remain unchanged.

Pending14 has two accepted local cases: Stop/new and message-marker. Both retain their original grade, scoped native14 audit and full physical host closure. The next local Plan-revise-accept attempt failed before its revised model turn at PRP run.attach: ACPX durable launch profile digest does not match runner startup. The sequence stopped. Seven other local cases and all ten pending14 Daytona task cases remain unstarted. The original failed Plan and earlier zero-capture diagnostic stay unchanged; the diagnostic has no acceptance credit.

A credential-free owner regression reproduces the cold restore error. New-run startup authority validates, but the saved launch digest still binds the prior-run grant. The reviewed native repair proves that exact prior digest by changing only the candidate run binding, retains full company/model/profile/closure/expiry/session and artifact checks, and separates bare cold attach from authenticated warm rotation. Its exact-final baseline fails; five focused tests and all thirty-five owning backend tests pass. The initial sandbox TCP-bind failures remain recorded separately from the successful loopback-authorized owning run. These controls are not model acceptance.

The cold repair shipped as pending15 at source 9e82c00ad8e2eba628a33a2e1857379769ad7128. All ten local task cases passed with original grades, scoped native15 audits and physical host closure. The causal Plan-revise-accept case reused the same native/provider session across its first and revised runs. No pending15 Daytona model case ran. Its immutable Linux image was built, independently checked, loaded once and published once at sha256:61b097ec5e1c581a0868c174881497fab556c9197d92261595ddc75469d1787f. The earlier public-push review rejection and later exact human authorization stay recorded. This is an original-source artifact, not acceptance of a later runtime.

Master advanced to 0c70cedce9a803bdc201324528abb35e423e7cd0 before remote qualification. The real reconciliation preserves upstream runtime-context and sidecar contract generation, confirmation replay and provider-pack contract digest verification. The critical Kimi inventory now has 58 source inputs. Maintained identity generation derives pending16, Copilot91 and Grok18; Pi36 is unchanged. Colliding Copilot88 and Grok15 historical fixtures retain the upstream canonical filenames while the unmerged Foundation variants remain byte-exact under branch-qualified names with explicit lineage and no execution authority.

All earlier pending15 passes and artifacts remain historical, source-bound evidence. They supply zero pending16 acceptance credit. The earlier held qualified16 proposal is obsolete and remains immutable. The reconciled source requires new native artifacts on both targets, exact installed pack verification and a fresh 20-case local/Daytona matrix with full resource, key and host closure before a new ordinary qualification proposal. The existing immutable image may be a physical base only when the normal installer verifies the current full Linux pack and native daemon; its old pack is not relabelled as current. No new artifact build, model test or promotion is authorized by this source proposal.

The pending14 zero-model Daytona preflight passed native create/load, HTTPS checks, raw sandbox absence, complete scoped inventory and child-key revocation/list absence. It made no model request and supplies zero task-qualification credit. The retained pending15 Foundation, Core and Product exact-head CI and reviews are green; the new private master reconciliation has no published-head CI claim. Original runner-shutdown attempts and the single successful failed-jobs-only retry request per Core/Product run remain recorded.

At pending16 source 603756c22b2e39de9b5b5c3c26a0eb23c67604a1, the causal local Plan and message cases passed. The next local ask-question case failed with native_finalization_missing: session returned no semantic result. Its native terminal reported completed/yielded without a semantic result. The sequence stopped, and original/physical cleanup passed. The original failure is retained for owner diagnosis. Current acceptance is two passed, one failed and seventeen unstarted; no paid retry or source repair is claimed here.

A proposed ordinary qualified17 transition is prepared separately and remains HELD. It must not be applied, built for release or deployed until Root accepts all twenty pending16 original cases and their full closure at the frozen execution source. Earlier pending15 local passes remain historical and supply no pending16 credit. This ledger does not claim a pending16 pass count, a qualified17 artifact, a hosted result or permission to promote.

The held transition changes the top Product source only. Foundation and Core stay at their reviewed pending16 prerequisite identities; no extra merge or mirrored generation exists only to make branch metadata equal. The final qualified build must bind its actual top revision, complete native58 inventory, full pack contract and exact target artifacts. Ordinary startup and Test must work without a candidate grant, and retained pending16 identities must remain historical-only for execution. The actual accepted pending16 evidence and final qualified limitations must be recorded before the eventual qualified-source commit and artifact build.

Pending qualification uses the existing trusted startup-admission channel with exact company, model, profile, platform closure, expiry, run and session bindings. A warm handoff may rotate only the authenticated run identity through the normal Runner authority transition. Saved agent configuration cannot grant candidate authority. Ordinary installed and hosted qualified setup must work without that test authority.

Required gate	Current evidence	Remaining proof
Merged native behavior	Cold repair RED/GREEN retained; current master union and pending16 deterministic checks reviewed separately	Freeze reconciled source; build and verify both native targets and current pack contract
Local and Daytona acceptance	Pending15 ten local passes; pending14 Plan failure and all original records unchanged	Fresh pending16 twenty-case matrix and full closure; zero carried acceptance credit
Credential isolation	Protected startup and private-stdin SSH checks pass; pending14 zero-model preflight closes	Verify normal qualified setup and Test without candidate authority
Normal distribution	Maintained closure has eighteen public packages and four daemon targets	Exact qualified-source build, full checks and clean installed consumption
Ordinary product setup	Isolated hosted TEST workspace reserved	Installed Mac and hosted Linux setup/Test/save/reopen, assigned skill, download and reconnect

Delivery remains a tested, reviewable PR stack and the isolated hosted TEST workspace. Production deployment, fleet defaults, stable publication and GitHub merge remain outside this handoff.

Historical pending11 acceptance ledger

Required gate	Environment	Observation	Verdict
Exact model and instructions	local and Daytona	Pending11 pinned native create/load/model/instruction controls passed on both platforms; the current authenticated product matrix remains incomplete	partial
Scoped tools and credentials	local and Daytona	Native v6 credential fences passed; the first pending11 Daytona task received its exact full scoped context result and reached the intended unanswered Write	partial
Ordinary setup	installed local and isolated hosted test	Ordinary connect/save/reopen/Test/run/reconnect and assigned-skill behavior remain required	unattempted
Useful task	local and Daytona	Pending11 local and Daytona file editing passed; ordinary installed and hosted downloads remain	partial
Human input and Stop	local and Daytona	All pending11 local human-input and Stop journeys passed; Daytona question, Plan and Write Stop passed; remote Stop/new/resume remains	partial
Continuation and child loss	local and Daytona	All pending11 local continuation journeys and authenticated Daytona native worker loss passed; remote Stop/new/resume remains	partial
Installed distribution	macOS arm64 and Linux x64	Pending11 native closures, Mac binaries and immutable Linux qualification image verified; final normal public-package installation remains	partial
Regression and repository checks	candidate revision	Prior foundation/product heads passed CI and review; shared recovery and admission controls passed real PostgreSQL owning suites and focused tests; final integrated full checks remain	partial

Current pending11 totals remain 0 fully passed, 7 partial, 1 unattempted of 8 gates. The two-environment matrix has nineteen distinct passing case records: all ten local journeys and nine Daytona journeys. Daytona Stop/new/resume remains required. Four original cases retain Core/source 0ca0d6b87d6d69b8a900621fb834ed74cb1ae446 and suite V4. Nine later cases retain source d721f2f9052e19370985e53a7493e8792e319313 and suite V5. Six Daytona cases retain source e972a46e5aedfcb48d7cb61328e81fb70ce7dccb and suite V5. A fresh local Plan workflow at that last revision is representative handoff evidence and adds no distinct case. Each record retains its original expected terminal state; conversation continuity can finish in review. None is relabelled as a later source or suite. Original material failures remain failed.

The final local Stop/new/resume result and cleanup passed. Its original strict audit rejected the server-only /new record because that row retains the default legacy field. A separate reviewed classification verifies the saved human command, company/task/session generation, the complete two-event terminal record, and the unchanged server branch that returns before provider selection or execution. It also checks all three actual provider runs against the exact native Kimi11 model, profile and scope. The original audit remains failed; the derived classification has positive and negative controls, including conflicting duplicate rows in both orders. It does not treat the reset operation as inference.

The next Daytona plan-revision attempt failed during shared agent-directory adoption before the second provider turn started. Its original failed result, cleanup failure and raw package remain unchanged. A real PostgreSQL regression reproduced a metadata-only race: the collection worker changes nextAttemptAt and updatedAt between the final predecessor read and the adoption claim. The repair in code commit 759aad8f4fa8262b8af6e797617c0d89061681be locks and rereads the predecessor under the existing agent and lease locks, compares its complete authority except those two scheduling fields, and retains the original claim predicates with the locked timestamp. Eighteen real-database controls and server no-emit validation pass, including competing owners, same-baseline receipt or checkpoint changes, retirement, canonical changes and foreign scope. The original incident did not retain its exact failed predicate, so the reproduced race is not claimed as conclusive incident causality. Closed-field conflict diagnostics will make a further failure discriminating.

The failed remote campaign's key is revoked. Additional cleanup uses raw sandbox resource APIs with an explicit verified organization: a toolbox lookup returning 404 cannot establish sandbox deletion. Exact filtered inventory exposed two archived verification probes omitted by the earlier summary. All eight known owned allocations, including preflight, now return authoritative resource 404. The provider list retains stale entries; every returned owned entry was separately checked through the resource API. The earlier summary and failed cleanup grade remain preserved. Future campaigns require the corrected raw-resource cleanup and its real-SDK mocked-HTTP regression before allocation.

A separate host prerequisite failed before any test or model request because PostgreSQL 18.1 exhausted macOS System V semaphores. Qualification uses a verified official PostgreSQL 18.6 build with named POSIX semaphores through an isolated, recorded worktree dependency binding. A fresh migrated control plane reached health 200 at the actual source revision; a same-cluster SQL check confirmed its version, database and empty company schema. Owned processes and ports closed. The binding must be restored before normal package validation. Earlier PostgreSQL 18.1 evidence retains its original environment identity.

The source-mode Product E2E control plane serves the checked-out source. Its source revision, production-byte baseline and separately compiled Core artifact are distinct roles. Native Mac binaries and the immutable Linux image retain actual build source 3a2dc2d78df0da51ef56dd6d898a2993496d3567; neither is relabelled or rebuilt for a Core-only ownership repair.

The shared directory repair passed a fresh local and Daytona Plan workflow, including three native turns, the exact human revision decisions and resource cleanup. Five subsequent Daytona cases passed: ordinary and structured questions, structured-question restart, file editing, and restart continuity. The last Stop/new/resume case failed before reset: the cancelled native turn retained a workspace preservation obligation, and the saved /new message did not cross that hold. The original failed result and its original cleanup grade are retained. Independent raw resource checks found one stopped allocation despite an empty filtered inventory; exact run, organization and ownership evidence authorized its separate deletion, followed by an authoritative resource 404.

Native admission renewed the real preparation lease and changed the run to native mode without retiring that earlier ownership. The recorded future expiry can block workspace recovery after the provider has stopped. The original inspector log does not identify whether its coordinator, active-control or preparation-lease predicate fired first. A real PostgreSQL regression reproduces the stale fields on both local and remote admission. The repair clears controllerBootId, controllerLeaseExpiresAt and executionStage in the existing row-locked native admission transaction. The current preparation owner is still validated before the native coordinator commits. All twenty-eight controls pass, including foreign and expired ownership, cancellation before admission, transaction rollback, live preparation recovery and a later workspace synchronization failure. Workspace preservation, native ownership and physical Stop guards stay unchanged.

The preparation handoff repair passed a fresh local Stop/new/resume workflow at a44ebc8abe8ebc766a207a9e68460db9829d6129: three native runs, one authored server reset, generation one and a fresh final native session. Original result, raw evidence, native/control classification and physical cleanup pass. It is a representative regression check and adds no distinct case.

A second real PostgreSQL regression found that a valid Stop can arrive after a workspace check has saved a twenty-four to thirty-six second retry delay. The existing post-cleanup callback did not advance that check when physical Stop became confirmed. The shared repair records one marker bound to the same run, recovery generation and closed native/physical receipt digest. Only the normal post-executor cleanup producer records that evidence. The recovery service can advance its matching Stop recheck once, preserving retries, window and provider cooldown. A marker arriving while the worker runs stays pending until its failure commit, so the notification cannot be lost. File preservation and model admission remain under their existing owners.

The exact final positive fails against the prior implementation and passes with this repair. Nineteen final focused controls and typecheck pass. The earlier owning recovery and run-control suites passed one hundred thirty-two tests; those results retain their earlier test-module identity. The positive uses the actual resolved preserve-without-replay writer, saved human /new intent, real archive copy-back and normal explicit continuation admission. It proves timely reset eligibility; actual browser generation and a fresh native turn still require the final Daytona case. No blocker, timeout, grading, schema or polling change is included.

The six shared Core source/test changes are a separate prerequisite, #18245, based on the frozen Runner foundation. Product retains its Kimi plan, UI, fixtures and provider files. Product contains the real prerequisite ancestry, including queued-input repair 5c964f5d3cfd65e493b92c53cfe0c80b0d21f54d. The final compiled Core must identify the integrated product source; earlier Core, native and image identities are retained separately.

A further real PostgreSQL control reproduced an already queued /new request being cancelled before provider admission and its saved wake marked skipped. The shared dispatch owner now keeps only that exact current human wake deferred inside the cancellation transaction. It requires the canonical no-execution proof, matching native preservation action and unfinalized native baseline. The existing queued-writer guard orders copyback after that commit. Real copyback and the normal callback then adopt the original input once, including concurrent callback delivery. Foreign, terminal and unverified requests remain fenced. The unchanged production patch passed 164 owning tests; final focused controls, the actual stranded-recovery retry discriminator and no-emit validation passed. A saved prior session reference remains a hint. The deferred wake prevents a competing automatic retry; no new retry policy, queue hook or polling was added.

The extra cancelled admission receipt remains in the raw Product E2E evidence. Kimi suite V6 classifies it separately from the three native provider turns and the single authored reset. It requires the complete server event receipt and final public proof of the human command, stopped source, preservation, authorization, reset and fresh native session. Provider counts, deadlines and earlier grades stay unchanged. Forty-nine focused controls and narrow typecheck pass. Controlled Chromium exercised the prior count failure and corrected full flow; that is fixture calibration, not live model acceptance. The nineteen accepted originals retain V4/V5. Only the remaining fresh case uses V6, fingerprint f7883fff6c2a5fda14571ef150849e3d2514be036fed941e257276e6b956e5d7.

Next, complete the one remaining Daytona Stop/new/resume case. The local representative remains valid because the additional event behavior requires a remote physical termination receipt and preserves local Stop policy. The controller must check every exact sandbox ID from authoritative run records, including failed attempts, even when filtered inventory is empty. Retain the nineteen passing cases only under the explicit source impact record. Qualification promotion remains held until twenty distinct cases and physical resource and key closure are verified. Afterward build the normal four-platform daemon and eighteen-package distribution, verify ordinary installed local setup, and deploy the exact qualified revision only to kimi.test.paperclip.app for normal configuration, assigned-skill, CSV download and persistence checks. Those installation and hosted journeys remain required. Production, fleet defaults, stable publication and GitHub merge remain outside this handoff.

Earlier pending11 recovery observations

The following observations retain their original source, artifacts and next-step context. The current state above supersedes their campaign instructions.

At this earlier snapshot, pending11 totals: 0 fully passed, 7 partial, 1 unattempted of 8 gates. The current twenty-cell matrix has four passing cells on frozen Core/source 0ca0d6b87d6d69b8a900621fb834ed74cb1ae446, pending Kimi11 and suite V4: local native Write Stop, local native worker loss, local message-marker, and Daytona native Write Stop. Their original reports retain that identity; sixteen cells remain. Original failed attempts remain failed. The fixture-only V5 successor clarifies Plan marker formatting and expands detailed run evidence without changing their task prompts, graders, Core, native closures, or immutable image. The remote observer source hash changes with its new diagnostics and remains an explicit test-identity derivative in the scoped context; full model-facing byte equality is not claimed. Original Stop did not invoke the fault branch, common observer functions remain unchanged, and fresh authenticated worker-loss coverage through the new observer is required before final acceptance. Profile9 results remain historical support. These grouped gates do not replace per-cell evidence.

The explicit-only kimi-qualification Product E2E suite has 20 required cells: message-marker, plan-revise-accept, ask-question, structured-question-resume, structured-question-restart-resume, file-edit-validate, continuity-restart, and stop-new-resume, native pending-permission Stop, and native pending-permission worker loss, each on local and Daytona. Each has one required repetition and zero automatic paid retries. Historically, all ten profile9 local cells passed with report packaging and cleanup. Stop retains source 821256d6, campaign local-2026-10-29T14-46-04-979Z, run 91557abb-b9c0-422d-af1e-f0e82e948e96. The other nine retain source f7ac439e and their individual campaigns between 15:10 and 15:33 UTC. The qualification-only observer correction leaves all native runtime/profile/image inputs unchanged. It reads argc-bounded kernel argv while retaining exact compiled-loader hashes, sealed native bytes, inode, ancestry and run identity; a real compiled native/ACPX peer proved title mutation, excluded an environment canary, rejected foreign/ambiguous targets and retired the child. All ten original result hashes were independently checked. The four earlier local failures remain unchanged alongside their later diagnoses and cleanup receipts.

Historical profile9 Daytona qualification stopped at its first lifecycle case. A later independent message-marker control passed all six matchers, durable Done, native Succeeded and cleanup on source 50736cb6, run 0a809b5e-9a82-4590-9283-cbaa359f676f. That is one case, not the full matrix. The first launch stopped at admission because two executable digests were missing; no task or sandbox was created. With the exact image Node/runnerd digests supplied, the first actual Stop cell failed before provider startup: setup Test could not reach the global Kimi catalog. Its failed/cleanup-failed grade is preserved. Six archived Test sandboxes were subsequently ownership-verified, deleted and checked absent404; that post-failure recovery does not change the original grade.

Assigned-skill behavior and ordinary connect/save/reopen/Test/run/reconnect remain separate requirements, including the requested hosted test workspace.

Earlier state before fixture V5

Four current cells passed with independently checked report hashes, native profile/model identity, terminal state, and cleanup. Local Plan acceptance then stopped because the model omitted the required draft marker in its actual write_document input; saved bytes, API reads, and the Plan UI matched that input. The strict marker and revision/approval checks remain. A fixture-only successor makes the literal first-line format explicit and increments the Kimi definition to V5; a later passing response does not establish reliability or alter the original failure.

The first current Daytona worker-loss attempt failed inside its one-shot fault observer. Its original diagnostic erased the failing guard and cannot establish whether a signal occurred. A separate no-network Linux x64 control used the immutable image, actual Kimi and compiled ACPX, and a simulated model. Python 3.13.5 process-handle signaling and all fourteen Linux selector controls passed. The real pending Write was reached, then inspection failed with a missing-file error before any fault signal. Normal Stop retired all seven owned processes, and both controllers independently verified the sandbox absent before the temporary key was revoked. This is diagnostic evidence, not authenticated task acceptance. A second inspect-only control located the exact read: the selector resolved the authenticated parent executable to a deleted Linux memfd alias, then tried to reopen that name instead of its held descriptor. It failed before signaling. Its normal Stop retired all seven processes, and sandbox deletion and key revocation were independently verified. The descriptor correction then passed a same-process Linux comparison: the old selector reproduced that exact error, the corrected selector verified the held executable and its kernel seals, and the unchanged process-handle operation killed only the owned native Kimi child. The unanswered permission expired with provider_process_lost and replay disabled; a correctly scoped stale approval failed, no file effect or second model request occurred, and all seven owned processes retired. Sandbox deletion and temporary-key revocation passed independently. All model responses in these controls were simulated. Fresh authenticated worker-loss acceptance remains required. The existing TypeScript wrapper still expected fourteen Python tests after the suite grew to twenty-five. It reproduced that count failure, then passed all four checks after its expected count was updated. This correction changes test accounting only.

Pending Kimi11 and Copilot83 are frozen after the actual lock-refresh prerequisite was merged. The prerequisite's squash commit has the same complete tree as the reviewed source. Genuine merges preserved all published identity fixtures and the managed lockfile; no history-only reconciliation or policy bypass was used.

Fresh pending11 Mac native controls passed. The Linux qualification image was built, published under an immutable digest, and independently checked against all 42 exported layers, native executable hashes, and installed metadata readers. These are delivery prerequisites, not the twenty authenticated Product E2E cells.

The first pending11 Daytona Stop attempt reached real inference, one normal UI Allow once for the scoped empty-input context read, and the exact intended native Write permission. It failed before submitting Stop. The fixture incorrectly equated the native turn with the controller envelope turn and tried to parse a bounded display event as the full tool result. The official encrypted checkpoint retained the full matching result and its completed delivery acknowledgment.

The run then reached its configured 120-second timeout. Recovery later overwrote that error after mistaking the remote numeric PID for an unrelated live process on the controller host. Commit a24ebd5e7e3fa0d086e91cd3824efd52c8eaee0b requires exact current host-authored local process identity before local probes or clearing. Remote or unknown identities stay under native recovery authority. Real PostgreSQL tests reproduce both remote collision states, preserve verified local live/dead behavior, and retain authenticated remote termination handling.

The corrected fixture passed 62 deterministic controls, targeted typecheck, and the real MCP/sidecar/Core-to-official-PostgreSQL boundary with seven negative scope/session controls. It positively bridges native and controller turns through the exact authenticated request and delivered command. It binds the logical workspace separately from the physical observer lease and retains the original calibration fixture as version1 beside the new version2 fixture. The current suite is version4 and remains explicitly pending.

The next controlled attempt, on 23958e5ad07e0b93b8eef098a9d0038c215bad15, passed the full scoped context checkpoint proof and reached the native Write. It then failed before Stop because the UI check counted all visible request cards: the resolved context request and the pending Write. Its original failed/cleanup-failure grade, 49 raw files and 65 executable snapshots remain unchanged. Separate cleanup again verified all owned cloud resources absent and revoked the temporary key. This is a second failed attempt, not Stop acceptance.

The corrected selector binds the exact target card to the independently verified native pending callback before and after lookup. It retains resolved history and the same card after cancellation or expiry. Ten Chromium controls reproduce the old failure and reject wrong targets, duplicates, changed callback identity and disabled decisions. The existing native/context controls and targeted typecheck pass; suite version4 and its promised behavior are unchanged.

Fresh CI also exposed intended-local test fixtures that inserted bare PIDs without using the real process-metadata writer. Those fixtures now use that writer and retain their original recovery, contract and concurrency assertions. The separate unknown-owner test kept its original assertion and exposed a real guard-order regression: an observed run could lose its ownership warning. The minimal repair restores the existing observed-owner warning before the unknown-ID hold, without probing host PIDs or granting clearing, signaling or retry authority. Both unknown and remote observed-owner controls pass, as do all 65 recovery-module controls and the original assembled recovery cases. Real remote timeouts retain their errors.

The original failed/cleanup-failure verdict and raw reports remain unchanged. Separate cleanup verified every owned sandbox absent and revoked the temporary test key. The fixture's later close error did not establish its retirement seal; no cleanup check is relaxed. The generic ACPX display clipping metadata defect is pre-existing and remains a documented limitation; full model-facing delivery uses a separate acknowledged path.

The repair changes controller recovery and qualification fixtures. It does not change the Kimi native patch, either closure, the tested Mac binaries, or the Linux image inputs. A new matrix revision must record the exact reviewed delta and rebuilt server identity while retaining the original artifact build SHAs. The next paid action is one corrected Daytona Stop cell after the rebuilt controller and strict checkpoint/card admission controls pass. Its original grade, raw files and physical cleanup must pass independent audit before the remaining nine remote and ten local cells.

After all twenty cells pass, promote ordinary admission in a separate reviewable qualification PR, build the normal four-platform daemon/public-package set, and verify the installed local UI. Then deploy the exact qualified revision only to the user-approved isolated kimi.test.paperclip.app test workspace and drive the ordinary hosted configuration, assigned-skill, artifact and persistence journey. Production, fleet defaults, stable publication and GitHub merge remain outside this handoff.

Reconciliation and earlier qualification history

The following records describe earlier candidate states and their original evidence. The current state above supersedes their next-step and blocker text.

The next shipping prerequisite is now frozen at the existing lock-refresh PR #18185, head 9600623783d118a79f8008deb9ab05d80715a15a. Reconciliation is in progress; the earlier master freeze below remains historical. The trusted repository policy permits lock changes only through its maintained refresh branch or Dependabot. This existing prerequisite contains the exact thirteen-line lock correction already used by the candidate, with matching reviewed report proof. It also inherits three newer master changes, including native finalization and the Antigravity builder. Actual foundation merge conflicts make a genuine reconciliation necessary. The new behavior and published identity bytes must survive; no policy exception, mixed-branch rename, or history-only merge is used.

The builder is one of Kimi's 31 attested source files, so that reconciliation requires a new pending identity, expected version11, and a later qualified identity, expected version12. No full paid pending10 cell was started. Its successful Linux build, zero-prompt native create/load proof, complete exported image integrity checks, and controlled Mac native fence remain evidence for pending10 only. The exported image is retained without ECR publication. A fresh build and all twenty live cells will bind the reconciled candidate. Later unrelated master activity alone does not reopen this prerequisite freeze.

The revised remote fixture also passed the actual maintained MCP-to-checkpoint boundary and an isolated real PostgreSQL observer check. That check used the official encrypted checkpoint loader in a read-only transaction, verified the saved checkpoint remained unchanged, and closed the observer before stopping its owned database. The integrated observer's bytes match the calibrated source. These controls are prerequisites for the first live native Stop case; they do not establish authenticated model behavior or full recovery acceptance.

The shipping baseline is now frozen at master 9f3fc2094f61e311b2c5adb4d5beccefc0199943. The reconciled foundation is 7c6cffafa26c70e50c241c71dd536aa79406041d and product code is 60f0bb7b3171e773f21fe80fb524d9130e36500f, with 97 and 77 review paths respectively. Both existing PR branches were updated by fast-forward. Published master identity bytes win over conflicting unmerged variants; original candidate variants remain in preserved Git history and their evidence receipts.

Current Kimi10 is pending and hidden from ordinary selection, command digest sha256:c8a39af9d580cdb5fe20a3333a566e2f97a1b4ec3a0025cb647d2144df358604. The native2.3.3 patch v6 and vendor closures are unchanged. Current dependent identities are Pi35, Copilot82 and Grok14. Earlier prepared qualified10 and Copilot82 digests and the 9ba72696 draft image identity are obsolete and must not be reused. Qualification will promote a new identity only after live gates.

Master adds reachable notification context/helper environment and Unix Runner FIFO/listener/thread behavior, plus connection/restart ownership fixes. This changes actual Kimi and native Bash execution, beyond identity text. All twenty local/Daytona cells will therefore refresh against pending10, preceded by actual native credential/context controls. Old9 grades and native binaries are not relabeled as pending10 or as the final release.

The pending10 image build is pinned to product 60f0bb7b, canonical candidate content af2d4e8d8ea38381eb265dfdf8141d23ca31369bcb7ae12db8c6daa1b34a4e15. Its source was verified through an anonymous public checkout; no operator or provider credential is sent to the build. Later test-only changes require a canonical image-input comparison, not a rewritten image provenance claim.

The foundation PR #18028 at 08a5516b and product PR #18029 at 6123a67a had green CI at those heads. The product review was Greptile 5/5 with one actionable report configuration load-order comment. That comment is addressed in the subsequent harness repair; fresh-head CI/review remain required. Both PRs remain draft because real acceptance is incomplete. Full typecheck and build passed. The local full test command failed three AI-connection cases after a first 15-second timeout, then accumulated an idle-transaction/TRUNCATE wait chain in the unchanged Git-expiration suite. The three connection cases passed separately without source changes. The full command was interrupted after recording the lock chain; all owned processes and its database port were independently verified stopped. This is not a full local test pass or an established explanation of every failure.

Recovery and re-evidence on 2026-10-29:

• The previous checkout and its worktree registration disappeared. The cause is unknown. Pushed source was restored into a newly attached managed worktree; frozen dependency installation and the full build passed again. Historical local pass logs and all ten audited result hashes survived, but the original raw report packages did not. Those passes are not reconstructed from logs or synthetic calibration evidence.
• Commit 6123a67a adds an explicit absolute report-root override with unchanged default storage, physical output containment, and traversal/symlink rejection. Actual final publication was checked across checkout removal, early failure, redaction, and missing mandatory evidence. The repair passed 123 focused evidence tests, seven sentinel tests, harness typecheck, actual CLI admission checks, and independent outside-sentinel preservation. These are harness controls, not provider acceptance.
• All ten fresh local profile9 cells passed at exact 6123a67a, including final packaging and cleanup. Their original packages now live outside the checkout. Independent collection rehashed all 221 files without mismatch; each owned server and embedded database stopped and each temporary data root was absent. The 19 retained run records are not a model-call count.
• An independent temporary Cloud TEST credential reached the global Kimi endpoint and the exact installed Linux9 runtime passed native startup. The first controller attempt then failed before any test body: a Promise resolver shadowed the path resolver during event validation. The original failed and cleanup-failed grade remains. Credential-free actual-event replay reproduced the error and verified the correction. Empty JUnit suites, retained Playwright events, and source readiness gates establish that product fixture allocation and provider admission were never reached. Owned processes/ports were absent; the independent preflight sandbox was deleted and checked404, and the temporary credential was revoked and checked absent.
• The corrected controller reached the actual first Daytona cell. That attempt failed closed at remote_native_fixture:lease_metadata: its fixture selected a reusable warm environment, while the native lifecycle observer requires an isolated non-reusable lease. The observer guard is retained. Both observed owned sandboxes were separately deleted and checked404; its temporary credential was revoked and checked absent. The original failed and cleanup-failed grade remains; model usage is unavailable. A narrow fixture-producer correction and fresh Daytona acceptance are required before qualification.

The follow-up harness repair at d5fc5c42 changes only the two remote native lifecycle fixture configurations to isolated non-reusable leases. The eight other Daytona cases remain warm and all ten local execution inputs are unchanged. This per-case override is included in the suite fingerprint. The real fixture-producer regression first failed both lifecycle cases, then passed with three unchanged controls. The strict remote observer is unchanged. The same repair loads the normal campaign report setting from its local environment file after admission, with a credential-free actual-launch red/green regression; listing and installed-startup admission retain their prior behavior. Focused catalog/producer/observer/storage checks passed 227 tests with one existing skip, and harness typecheck passed. Native profile9, vendor closures and image inputs are unchanged; retain the fresh local evidence at 6123a67a and pin a fresh Daytona campaign to the repaired source rather than relabeling old attempts.

Additional profile9 Daytona first divergences and shipping reconciliation:

• Restoring source did not restore its ignored Linux companion manifest/binary. The next run failed closed before launch. Exact image9 assets were recovered under a Linux-only release descriptor with their original source 5f4c9edc; no other platform binary was invented or relabeled. Actual source, compiled Runner and compiled server-vendor readers passed strict manifest/profile/ closure/binary checks, while the Mac daemon remained unchanged. This proves the scoped controller asset recovery, not a complete four-platform release.
• After those assets were restored, a real Kimi turn requested native Read for the bootstrap file. Its canonical request had no proven file target and was never approved. The lifecycle case timed out and failed session recovery; the original failed/cleanup-failed verdict is retained. All observed owned sandboxes and temporary credentials were separately retired and verified.
• A bounded real pinned-native control established that approve-reads delegates these provider requests; it does not automatically approve native Read. The proposed replacement uses server-owned get_task_context, whose empty-input schema and active-task authority are independently checked, with one explicit fixture-human approval after observer baseline and continuation publication. Unknown native Read is still unapproved and unqualified. Native Write must remain genuinely pending before Stop/loss. Synthetic proof rows alone do not establish delivery: production boundary calibration identified semantic input in the durable checkpoint and a delivered result command, rather than a semantic result event in the public run log. The checkpoint observer and full fresh runtime acceptance remain gates before using this replacement.
• The master merge preserved sealed private-handoff custody ahead of ordinary report-root configuration, including after dotenv. Actual private/public launch regressions passed 57 tests and a wrong-root mutation failed all four relevant cases. A missing upstream tar-stream lock importer was repaired by the canonical pinned package manager: exactly thirteen added lines, with no unrelated resolution churn. Frozen installation and Runner TypeScript build passed. Combined harness checks passed 325 tests with one existing skip, plus 137 Node tests and six Rust notification controls with one existing opt-in ignore. Full repository checks and current-head review remain release gates.
• All ten fresh local9 report packages remain outside the checkout, and the explicitly approved 14.8 MB private backup was verified by full checksum, byte count and encryption read-back. Future raw payloads have no implied upload authorization from that one archive approval.

Material local attempts remain distinct:

• The first profile9 Stop attempt failed its outdated final UI oracle. Inspection also found duplicated partial assistant text; the provider-neutral consumer now respects the existing nested progress marker. Its retained event regression demonstrated red then green.
• A later Stop passed all behavior/cleanup checks but failed report packaging: custom screenshot filenames did not satisfy the existing final-state.png contract. Two capture names were corrected, with positive and missing-final packager checks. The original grade remains failed.
• One replacement failed before provider admission because two of its three credential-home quorum ports belonged to unrelated listeners dating from October 4 and 21. The guard correctly refused ownership. Foreign processes were untouched, and separate scoped cleanup verified our processes retired.
• The next local Stop passed behavior, report evidence and physical cleanup in 33.8 seconds. The following provider-loss attempt reached an unanswered Write but refused fault injection: macOS ps renders loader bytes differently from the pinned argv. An unpaid real guarded-native probe reproduced that exact hash divergence. The corrected observer reads argc-bounded argv with those exact byte and ownership checks retained; the subsequent real loss cell passed.

Profile9 distribution proof now covers eighteen actual public-layout tarballs, a clean scripts-disabled consumer, fresh installed CLI setup through the admitted Node/npm proxy, network-denied reuse, unchanged lockfile and installed native ACP create/load/model/EOF. No developer login home, refresh token, private database override or model prompt was used for that packaging proof.

The native Linux image was built from frozen source 5f4c9edc; later source changes affect UI and test observers, with image inputs unchanged. An initial export timed out after image construction and saved no smoke proof. The corrected job 14af59a4-93be-4f83-990e-e308625ab1cc completed in 9m40s with timestamped stages, independently saved native smoke proof and a streaming compressed export. Image ID is sha256:139869415cdd7c7cd2a59f21626b8bdbbe0088f17209abf8cdda4f6a80b99718; content identity is 4560ebf62a9640e43aff893b1a6dd497746eeb2787732818b62acd911cdb0b7b. Create/load instruction acknowledgments and bounded EOF passed without prompts or credentials. Local collection verified the full archive, source, profile, closure, pack and daemon hashes. Its published immutable reference is public.ecr.aws/q2k8x0v0/paperclip/kimi-qualification-eed3@sha256:bad9994dadf1a55743dabed3cd3f785210131938d4407c8b0ca92a30a922c177. A real credential-free Daytona import/native smoke passed in 122.4 seconds on Linux x64 with 4 CPU, 4 GiB memory and 10 GiB disk, then its exact sandbox was deleted and checked404. It verified native create/load/model/instruction/EOF boundaries without a model prompt. No authenticated Daytona task has passed. All build failures are retained; the rejected IAM expansion was never applied and no operator/provider token was sent to CodeBuild.

The user additionally requested hosted verification and confirmed an isolated workspace at https://kimi.test.paperclip.app. It was created through the normal Cloud UI under the existing authorized owner; the shared QA identity lease was left untouched. It is active and empty on verified Core f8484a9f8d1f68e9534fee4f29e00e716dc680f4, distribution cloud-40777791731-1, not the Kimi build. A singleton TEST campaign enabled Native Runner on only this workspace with matching applied/desired hashes; fleet defaults stayed unchanged. Use the maintained Core preview deployment for this unmerged branch, record its exact serving SHA/image, and qualify the Kimi user journey there. This does not certify the private Cloud UI composition. No production or fleet-default change is in scope.

The active remote blocker is now narrowed by independent controls. The same fresh selected credential verifies through the host catalog path, while the actual remote metadata helper returns KIMI_PROVIDER_ERROR. Installed helper/Node bytes, profile admission and key/model forwarding match the expected boundary. A fixed remote GET failed with ECONNRESET before HTTP, with sandbox blocking false and no allowlists. Credential-free controls also reset for example.com, including direct IPv4 curl, with no proxy variables present. All three diagnostic sandboxes were destroyed and checked404. No TLS protection was weakened, endpoint switched or inference attempted during those diagnostics.

Daytona's current network policy says Tier1/2 organization restrictions override sandbox settings. Its essential service list includes *.kimi.com and *.moonshot.ai, but not the selected account's official global api.kimi.ai endpoint. This is consistent with the observations, not a confirmed cause: this key cannot read its organization policy (HTTP401). It advertises only the public US target. The user was asked to confirm full egress or another suitable test credential, while the existing TEST Cloud provider setup is being checked. The global account must not be routed to the separate CN endpoint as a workaround.

Critical path: establish legitimate Daytona egress to the global Kimi endpoint, then run ten authenticated Daytona cells. Only after native qualification should a new immutable profile promote ordinary admission/default packaging, with final installed artifact/image checks and ordinary setup/assigned skills. Deploy the exact candidate to the isolated test workspace, complete its hosted journey, and finish the PR stack. A promotion patch has been prepared and tested only in TEMP; it is not applied and does not count as qualification.

Evidence and first divergences

• Frozen root dependency installation passed with the normal network-enabled package manager. Restricted-network signature fetch failures were retained; no signature gate was disabled.
• Runner TypeScript/Rust typecheck passed before final sidecar registration edits. Focused Runner contracts: 297 tests passed. Product setup/admission, token, catalog, and route checks have separate passing results; these are not live proof.
• Both locked runtime closures built in 8.4 seconds with 33 required npm packages. macOS arm64 installed native metadata and Linux x64 metadata under emulation passed create/model/load/EOF; Linux emulation is not Daytona qualification.
• Real bundled ACPX manager admitted exact kimi-for-coding and current bound instructions with physical cleanup. The first two attempted turns failed before semantic tool delivery. The second retained the native 403: account subscription lacked Kimi Code entitlement. Native CLI login succeeded, and the user then subscribed. Those failures remain failures; no cost counters were available.
• The first entitled turn completed native execution and called the exact MCP echo with the instruction-only nonce. Its smoke observer incorrectly expected paperclip_echo at a handler that receives canonical echo. Native arguments, MCP receiver error, and terminal completion establish a grading/observer failure, not a successful tool round trip. The corrected observer then passed a real authenticated semantic echo, native terminal completion, and physical cleanup. Its profile2 evidence is retained separately from the final candidate.
• Review found and corrected a real normal-path gap: the packaged sidecar's handwritten agent parser omitted Kimi even though direct driver metadata passed. Final sidecar checks and real Rust/sidecar product acceptance remain required.
• Native controlled-model probes use the actual pinned Kimi and bundled ACPX. They found upstream approval construction omitted toolInput; the owned patch now carries exact nested and UTF-8 arguments, including empty objects. Denied Write caused no file effect, and native HTTP418 remained a typed failed turn.
• The next probe found provider credentials inherited into native Bash. The patch filters KIMI_API_KEY and private instruction transport from native subprocesses while preserving explicitly assigned task variables. Actual ACPX always advertises terminal capability, which routed Bash through its own host; the final provider patch forces the owned filtered native process path instead. Final verification must observe zero terminal/create requests and no secret in the actual child, rather than merely inspecting a filtered object.
• Bundling exposed a Function.toString() source difference that changed patched native bytes. The patch now embeds one canonical static helper source; raw and archived CJS setup produce the same pinned output. Final source comment removal changes its byte identity again before profile4 freeze; old evidence keeps its original closure and profile identity.
• Required repository checks remaining: final full typecheck, supported full test run with the original infrastructure failure retained, full build, and the ordinary setup/save/reopen/Test/run/reconnect path. Token gates and map structure currently pass. Setup Test now uses the official authenticated model catalog; it does not claim inference, quota, or task execution from a metadata response.

The full repository build passed on candidate profile5. Its first Product E2E message-marker attempt reached real UI/server/database setup, then stayed paused: the installed-runtime-only Test warning is rejected by the ordinary agent lifecycle. No model turn started. This candidate failure is preserved separately from the retry. The correction performs a fixed-endpoint authenticated model-catalog probe before reporting a successful Test. A real catalog request accepted the credential and returned exact kimi-for-coding; the official KimiCLI/2.3.3 client header is required (a generic client was rejected with HTTP403). The selected ID is never substituted. The first release also disables native question and plan tools so only the promised semantic interaction path remains available.

Historical profile8 command digest: sha256:53c63af8722894e14d48ed55526f99fcd79e06c86ae1c7aa384ef7ee8c56efd4. Native runtime patch v6 SHA256: 79980aa95c54f325a05cbdf883f74443705db28f3e412a1b5ae22929d939eb66. Closure pins: macOS arm64 6038325abd0431c30097ff1f572a9b29816e1b4da372d8cb86b2ca5d18ea34e7, Linux x64 105d8394adbbc76a953a12cc51b5288eb940ad693291e584f6cdc6407213164d. The actual native Kimi plus bundled ACPX controlled-service probes passed seven requests for instructions/arguments/auth fencing/denial/failure, then nine for pending-permission Stop and spontaneous owned native-worker loss. Both pending callbacks aborted, stale approval caused no response/write/new model request, and workers physically retired within five seconds. The model service was simulated; these results do not establish authenticated product acceptance.

To retain native macOS Runner acceptance without changing shared IPC state, an official checksummed PostgreSQL 18.6 build with named POSIX semaphores passed fresh initialization, normal migrations, SQL empty-database checks, and cleanup. Only this worktree's unshared native dependency entry was temporarily pointed at that private build. It was restored before canonical public-package staging. The accepted database process/version must be disclosed with each affected result; no database fixture contract or tracked dependency file was changed.

Early campaign cost record: subscription model calls have no reliable native usage counters; cost is unknown. At that point one cloud job was stopped before building and no image or Daytona sandbox had been created. Original 403s, the grading defect, credential-boundary failures, and database setup failure remain separate failed or blocked attempts; none are overwritten by retries.

The Code endpoint for this finite release is the global coding API https://api.kimi.ai/coding/v1, matching the successfully restored account. Mainland-region routing and managed OAuth refresh are outside this release. Authenticated qualification binds only the existing login's access token to the isolated run; refresh tokens and the ambient login home are not transferred.

The second local message-marker attempt reached the real model and tools. Run 4d394aef-0e6a-49a8-9fb0-873651d0241f finished in 24 seconds, accepted the finish contract, saved task Done, and passed physical cleanup. Its original verdict is failed: progress text and final text shared one provider item, so the visible final bubble contained both. Native patch v5 now forwards actual turn-step UUID boundaries. The Kimi projection validates their provenance and order before passing generic assistant boundaries to Runner. It does not infer boundaries from text, tools, or HTTP response identifiers. The actual native Kimi/ACPX controlled peer passed this framing case alongside instructions, tool arguments, credential isolation, denial, typed failure, Stop, and native-worker loss.

Historical profile7 verification: 162 sidecar/projection/metadata/instruction tests, 144 driver/projection tests, and 18 Rust provider-state tests passed. TypeScript, Rust daemon staging, bundled entrypoints, and all three affected immutable profile checks passed. The archived installer passed fresh public downloads, offline reuse, tamper rejection and cancellation on profile7. Final installed CLI/server tarballs remain to be rebuilt and checked. The full repository test run continues against the owned migrated PostgreSQL 18.6 Docker database; the earlier host semaphore and unmigrated-database setup failures remain retained.

The third local message-marker attempt passed all six independent matchers, accepted finish, durable Done, and cleanup on profile7/source 5fe7d496e1603626ceb5838f37c4fecce23580ee. Campaign local-2026-10-28T14-24-09-928Z, run 68705f91-d195-4532-9fd4-e8b1826d6ed9, completed in 45.1 seconds including cleanup and evidence collection. Its rendered final reply is the exact marker. The profile7 installed CLI/server tarballs also passed fresh public setup, offline reuse, exact native create/model/load/instruction receipts and EOF.

Lifecycle authoring then found that native Kimi approval omitted its tool kind. Patch v6 carries the native tool's existing canonical kind. The actual native callback now passes shared normalization: exact Write target with Allow once, Deny and Cancel; missing/foreign workspace contexts offer only Deny/Cancel and reject acceptance. The complete nine-request controlled native peer passed. The engine metadata correction and v6 change advance the installed closures. Profile7 evidence retains its original identity; the affected permission and installed-runtime paths require profile8 evidence before qualification.

CI found stale dependent provider attestations and fixture expectations. Pi31 attests the changed shared environment/sandbox sources without changing its native closure. Copilot73 attests historical-profile decoding changes; Grok11 remains current. Old fixtures stay immutable. Ninety-five Pi/Copilot installation tests passed with one existing opt-in skip, plus 18 image contract tests and four Grok identity-generator tests. Kimi lifecycle authoring passed 44 deterministic cases; the exact Linux pidfd selector passed 14 real cases on native ARM64 Linux and 110 TypeScript observer/contract tests with one existing skip. Linux x64 emulation returned ENOSYS for pidfd and is retained as an unsuccessful infrastructure attempt; only actual Daytona Linux x64 can qualify that target.

The rebased profile7 full typecheck/build passed and profile8 full build passed before the final dependent-provider identity refresh. The local full-test run was interrupted after unrelated shared-database cleanup failures and stale migration module errors. A fresh current-build isolated PostgreSQL migration probe passed. A replacement full run and final checks remain required. Later focused HTTP tests hit import/hook timeouts while host load was 63/120 with 92% CPU use; their original failures remain retained, without committed deadline increases. CI for the corrected source will provide an independent Linux check.

Review branches are published as draft PRs Runner foundation #18028 and product setup #18029. The first foundation review was 5/5 with no comments on its exact prior head; the corrected final head requires a fresh review. Neither PR is ready for merge until required product acceptance and checks pass.

2026-10-30: native behavior and cleanup recovery accepted

The profile 16 candidate (e027eb4e…, SDK 2.3.3, native artifact source 603756c22b2e39de9b5b5c3c26a0eb23c67604a1) has evidence for ten distinct local behaviors and ten distinct Daytona behaviors. These are functional acceptances, not twenty originally green attempts: local Ask retains its first failure; the Daytona permission case retains an accounting-observer failure; the final provider-loss case retains its original cleanup-failure grade. Fixture/Core sources for the remote evidence are 8bc5ce3b… and e7f65045…; the fixture-only rebuild changed only build-info among 10,993 compiled files.

The final Daytona case delivered loss to the exact owned native child while Write approval was pending. Its six matchers passed, including no file effect, expiry of the original callback, rejection of stale Allow, one failed native run, blocked task state, and complete native process retirement. Its workspace recovery completed and confirmed stop, then deliberately queued sandbox destruction for five minutes later. The test's 120-second environment-delete wait ended before that ordinary cleanup deadline.

A separate recovery restored the same captured control-plane state to an isolated working copy and used the normal server, company-secret rotation, cleanup scheduler, and environment DELETE route. Cleanup became successful, DELETE returned its documented HTTP 200, and the environment was absent from the database. No model turn, new run, new lease, or direct domain SQL update was used for recovery. Both the original and recovery processes, ports, provider resources, and temporary keys were closed. Root's combined acceptance record is SHA256 25d0eae952eab91c6d54abb6850d4abf1b69f1045e7d7bb05333f8b87c184c0a; it preserves the original failed grades and distinguishes native proof from later normal cleanup recovery.

The readiness correction waits for the same agent before changing permission policy, avoiding invalidation of an in-flight verification. Setup and native work now have separate finite windows, and remote deadline diagnostics identify the operation without retaining SDK text. Canonical focused verification passed 223 tests with one existing Linux-only skip on Mac, plus the full fixture TypeScript check. Native runtime bytes and model/callback limits were unchanged. Profile 17 public-package installation and the actual hosted walkthrough on kimi.test.paperclip.app remain separate delivery gates; this section does not claim either has passed.

The cleanup fixture now uses one absolute Kimi deadline at the original test start plus 660 seconds, within the unchanged 690-second total limit. It leaves 30 seconds for final evidence. Each DELETE request and retry sleep uses only the remaining time. Other flows retain their 120-second default. The actual canonical fixture tests passed 73 assertions across three files, including ordinary deferred cleanup beyond 120 seconds, deadline exhaustion, request timeout forwarding, and HTTP success versus pending cleanup. This source correction does not regrade the preserved failed live attempt.